WooYun.org

function onadd() {
        $navtitle = "提出问题";
        if (isset($this->post['submit'])) {
            $title = htmlspecialchars($this->post['title']);
            $description = $this->post['description'];//未做处理
            $cid1 = $this->post['cid1'];
            $cid2 = $this->post['cid2'];
            $cid3 = $this->post['cid3'];
            $cid = $this->post['cid'];
            $hidanswer = intval($this->post['hidanswer']) ? 1 : 0;
            $price = abs($this->post['givescore']);
            $askfromuid = $this->post['askfromuid'];
            $this->setting['code_ask'] && $this->checkcode(); //检查验证码
            $offerscore = $price;
            ($hidanswer) && $offerscore+=10;
            (intval($this->user['credit2']) < $offerscore) && $this->message("财富值不够!", 'BACK');
            //检查审核和内容外部URL过滤(此处也不是处理特使字符，只是审核和检查有没有外部url)
            $status = intval(1 != (1 & $this->setting['verify_question']));
            $allow = $this->setting['allow_outer'];
            if (3 != $allow && has_outer($description)) {
                0 == $allow && $this->message("内容包含外部链接，发布失败!", 'BACK');
                1 == $allow && $status = 0;
                2 == $allow && $description = filter_outer($description);
            }
            //检查标题违禁词（这也不是处理）
            $contentarray = checkwords($title);
            1 == $contentarray[0] && $status = 0;
            2 == $contentarray[0] && $this->message("问题包含非法关键词，发布失败!", 'BACK');
            $title = $contentarray[1];
            //检查问题描述违禁词（也不是）
            $descarray = checkwords($description);
            1 == $descarray[0] && $status = 0;
            2 == $descarray[0] && $this->message("问题描述包含非法关键词，发布失败!", 'BACK');
            $description = $descarray[1];
            /* 检查提问数是否超过组设置 */
            ($this->user['questionlimits'] && ($_ENV['userlog']->rownum_by_time('ask') >= $this->user['questionlimits'])) &&
                    $this->message("你已超过每小时最大提问数" . $this->user['questionlimits'] . ',请稍后再试！', 'BACK');
            $qid = $_ENV['question']->add($title, $description, $hidanswer, $price, $cid, $cid1, $cid2, $cid3, $status);