WooYun.org

$ac = empty($_GET['ac']) ? 'profile' : trim($_GET['ac']);
if(in_array($ac, array('index', 'news', 'profile', 'credit', 'models'))) {
	include_once(S_ROOT.'./source/cp_'.$ac.'.php');

if(empty($itemid)) { //这里让$itemid 不为空
		
		if(!empty($_SCONFIG['posttime']) && $_SGLOBAL['group']['groupid'] != 1) {
			if($_SGLOBAL['timestamp'] - $_SGLOBAL['member']['lastposttime'] < $_SCONFIG['posttime']) {
				showmessage('post_too_much');
			}
		}
		$newsarr['uid'] = $_SGLOBAL['supe_uid'];
		$newsarr['username'] = $_SGLOBAL['supe_username'];
		$newsarr['dateline'] = $_SGLOBAL['timestamp'];
		
		if($_POST['fromtype'] == 'newspost') {
			$newsarr['fromtype'] = 'newspost';
			$newsarr['fromid'] = intval($_POST['id']);
		} else {
			$newsarr['fromtype'] = 'userpost';
		}
		if(!checkperm('allowdirectpost')) {
			$itemarr['itemid'] = inserttable('spaceitems', $newsarr, 1);
			inserttable('spacenews', $itemarr);
			getreward('postinfo');
			postspacetag('add', $_POST['type'], $itemarr['itemid'], $tagarr,1);
			$do = 'pass';
		} else {
			$itemarr['itemid'] = inserttable('postitems', $newsarr, 1);
			inserttable('postmessages', $itemarr);
			postspacetag('add', $_POST['type'], $itemarr['itemid'], $tagarr,0);
			$do = 'me';
		}
		//更新用户最新更新时间
		if($_SGLOBAL['supe_uid']) {
			updatetable('members', array('updatetime'=>$_SGLOBAL['timestamp'], 'lastposttime'=>$_SGLOBAL['timestamp']), array('uid'=>$_SGLOBAL['supe_uid']));	
		}
	} else { //进入else
		if(empty($_SGLOBAL['supe_uid'])) showmessage('no_permission');
		updatetable('postitems', $newsarr, array('itemid'=>$itemid));
		updatetable('postmessages', $itemarr, array('itemid'=>$itemid));
		$itemid = empty($_POST['oitemid']) ? $itemid : $_POST['oitemid'];//没有intval
		postspacetag('update', $_POST['type'], $itemid, $tagarr, 0);//跟这里
	}

function postspacetag($op, $type, $itemid, $tagarr, $status) {
	global $_SGLOBAL;
	$deletetagidarr = $addtagidarr = $spacetagidarr = array();
	if($op == 'add') {	//已经存在的tag,执行加入操作
		if(!empty($tagarr['existsid'])) {
			$addtagidarr = $tagarr['existsid'];
			$_SGLOBAL['db']->query('UPDATE '.tname('tags').' SET spacenewsnum=spacenewsnum+1 WHERE tagid IN ('.simplode($tagarr['existsid']).')');
		}
	} else {
		$query = $_SGLOBAL['db']->query('SELECT * FROM '.tname('spacetags').' WHERE itemid=\''.$itemid.'\' AND status=\''.$status.'\'');//查询
		while ($spacetag = $_SGLOBAL['db']->fetch_array($query)) {
			if(!empty($tagarr['existsid']) && in_array($spacetag['tagid'], $tagarr['existsid'])) {
				$spacetagidarr[] = $spacetag['tagid'];
			} else {
				$deletetagidarr[] = $spacetag['tagid'];//赋值
			}
		}
		foreach ($tagarr['existsid'] as $etagid) {
			if(!empty($spacetagidarr) && in_array($etagid, $spacetagidarr)) {
			} else {
				$addtagidarr[] = $etagid;
			}
		}
		if(!empty($deletetagidarr)) { 
//这里要$deletetagidarr不为空 
那么也就是要让
$query = $_SGLOBAL['db']->query('SELECT * FROM '.tname('spacetags').' WHERE itemid=\''.$itemid.'\' AND status=\''.$status.'\'')这个查询出来的有内容
			$_SGLOBAL['db']->query('DELETE FROM '.tname('spacetags').' WHERE itemid='.$itemid.' AND tagid IN ('.simplode($deletetagidarr).') AND status=\''.$status.'\'');//这里delete查询 WHERE itemid='.$itemid.'  没有被单引号引住。。 并且没intval导致注入
			$_SGLOBAL['db']->query('UPDATE '.tname('tags').' SET  spacenewsnum=spacenewsnum-1 WHERE tagid IN ('.simplode($deletetagidarr).')');
		}