WooYun.org

function exchanges_action(){
		$_GET['page']=$_POST['page'];
		$where=$_POST['jobwhere']." ORDER BY `lastupdate` DESC";//这里关键点, 可以看到前面还接了一个$_POST['jobwhere'] 。
		$urlarr['page']="{{page}}";
		$pageurl=$this->url("index","index",$urlarr);
	
		$rows=$this->get_page("company_job",$where,$pageurl,6,"`id`,`name`,`uid`,`salary`,`edu`,`lastupdate`");//这里把where带入查询。
	
		
		if($rows&&is_array($rows)){
			include(PLUS_PATH."com.cache.php");
			if(count($rows)<6){
				$page=1;
			}else{
				$page=intval($_GET['page'])+1;
			}
			$html="<input type=\"hidden\" value='".$page."' id='exchangep'/>";
			foreach($rows as $key=>$val){
				$job_url=$this->config[sy_weburl]."/".$this->url("index","com",array("c"=>"comapply","id"=>$val[id]),"1");
				$time  = date("Y年m月d日",$val['lastupdate']);
				$html.="<div class=\"index_job_list\"><div class=\"jobtit\"><a title=\"".$val['name']."\" target=\"_blank\" href=\"".$job_url."\">".$val['name']."</a>
				<em class=\"endtime\">".$time."</em></div><div class=\"award\"><span>薪资：".$comclass_name[$val['salary']]."</span><em> 学历：".$comclass_name[$val['edu']]."</em></div><div class=\"go\"><a target=\"_blank\" href=\"".$job_url."\">查看职位>></a></div></div>";
			}
		}
		echo $html;die;//最后输出

if($config['sy_istemplate']!='1' || md5(md5($config['sy_safekey']).$_GET['m'])!=$_POST['safekey'])//继续拿到safekey绕过过滤
{   
	foreach($_POST  as $id=>$v){
		
		$str = html_entity_decode($v,ENT_QUOTES,"GB2312");
		
		$v = common_htmlspecialchars($id,$v,$str,$config);
		
		safesql($id,$v,"POST",$config);
		
		$id = sfkeyword($id,$config);
		$v = sfkeyword($v,$config);
		$_POST[$id] = $v;
	}
}

function Refresh_job_action()
	{
		if($_POST['ids']){
			$num=count($_POST['ids']);//统计下数目	 
		}else{
			$num=$this->obj->DB_select_num("company_job","`state`='1' and `uid`='".$this->uid."'");
		}
		if($num==0)
		{
			echo "您暂无正常职位！";die;
		}
	
		$statis=$this->obj->DB_select_once("company_statis","`uid`='".$this->uid."'");
		if($statis['vip_etime']>time() || $statis['vip_etime']=="0")
		{
			if($statis['rating_type']==1)
			{
				if($statis['breakjob_num']>=$num){
					$value="`breakjob_num`=`breakjob_num`-$num";
					$this->obj->DB_update_all("company_statis",$value,"`uid`='".$this->uid."'");
				}else{
					if($this->config['com_integral_online']=="1"){
						$integral=$this->config['integral_jobefresh']*($num-$statis['breakjob_num']);
						if($statis['integral']<$integral){
							echo "会员刷新职位数、".$this->config['integral_pricename']."均不足！";die;
						}else{
							$value="`breakjob_num`='0',`integral`=`integral`-$integral";
							$this->obj->DB_update_all("company_statis",$value,"`uid`='".$this->uid."'");
							$this->insert_company_pay($integral,2,$this->uid,'批量刷新职位',1,8);
						}
					}else{
						echo "会员刷新职位数不足！";die;
					}
				}
			}
		}else{
			if($this->config['com_integral_online']=="1"){
				$integral=$this->config['integral_jobefresh']*($num-$statis['breakjob_num']);
				if($statis['integral']<$integral){
					echo "会员刷新职位数、".$this->config['integral_pricename']."均不足！";die;
				}else{
					$value="`breakjob_num`='0',`integral`=`integral`-$integral";
					$this->obj->DB_update_all("company_statis",$value,"`uid`='".$this->uid."'");
					$this->insert_company_pay($integral,2,$this->uid,'批量刷新职位',1,8);
				}
			}else{
				echo "会员刷新职位数不足！";die;
			}
		}
		if($_POST['ids']!=""){
//这里关键点。  当post来的ids不为空的时候
			$ids=@implode(",",$_POST['ids']);
		//又组合成字符串 下面直接把组合成的字符串带入到了查询当中
                // 而且组合成的字符串带入查询的时候并没有被单引号 所以可以注入
			$nid=$this->obj->DB_update_all("company_job","`lastupdate`='".time()."'","`id` in (".$ids.") and `uid`='".$this->uid."'");//注入点
		}else{
			$nid=$this->obj->DB_update_all("company_job","`lastupdate`='".time()."'","`status`='1' and `uid`='".$this->uid."'");
		}