WooYun.org

case "do":
	
		if($TS_APP['options']['iscreate'] == 0 || $TS_USER['user']['isadmin']==1){
			
			$groupname = trim($_POST['groupname']);//这里没有过滤
			$groupdesc = tsClean($_POST['groupdesc']);//重点函数tsClean过滤了
			
			if($groupname=='' || $groupdesc=='') {
				tsNotice('小组名称和介绍不能为空！');
			}
			
			//过滤内容开始
			if($TS_USER['user']['isadmin']!=1){
				aac('system')->antiWord($groupname);
				aac('system')->antiWord($groupdesc);
			}
			//过滤内容结束
			
			//配置文件是否需要审核
			$isaudit = intval($TS_APP['options']['isaudit']);
			if($TS_USER['user']['isadmin']==1){
				$isaudit = 0;
			}
			
			$isGroup = $new['group']->findCount('group',array(
				'groupname'=>$groupname,
			));
			
			if($isGroup > 0) {
				tsNotice("小组名称已经存在，请更换其他小组名称！");
			}
			$groupid = $new['group']->create('group',array(
				'userid'	=> $userid,
				'groupname'	=> $groupname,
				'groupdesc'	=> $groupdesc,
				'isaudit'	=> $isaudit,
				'addtime'	=> time(),//重点，这里插入进去，未过滤。
			));