WooYun.org

public function actionDel() {
        if (IBOS::app()->request->isAjaxRequest) {
            $repids = Env::getRequest('repids');
            $uid = IBOS::app()->user->uid;
            if (empty($repids)) {
                $this->error(IBOS::lang('Parameters error', 'error'),
                        $this->createUrl('default/index'));
            }
            $pk = '';
            if (strpos($repids, ',')) {
                $repids = trim($repids, ',');
                $pk = explode(',', $repids);
            } else {
                $pk = array($repids);
            }
            $reports = Report::model()->fetchAllByPk($pk);
            foreach ($reports as $report) {
                // 权限判断
                if ($report['uid'] != $uid) {
                    $this->ajaxReturn(array('isSuccess' => false, 'msg' => IBOS::lang('You do not have permission to delete the report')));
                }
            }
            //删除附件
            $aids = Report::model()->fetchAllAidByRepids($pk);
            if ($aids) {
                Attach::delAttach($aids);
            }
            //若已安装日程，删除关联表数据和有提醒时间的日程
            $isInstallCalendar = Module::getIsEnabled('calendar');
            if ($isInstallCalendar) {
                Calendars::model()->deleteALL("`calendarid` IN(select `cid` from {{calendar_rep_record}} where FIND_IN_SET(`repid`, '{$repids}')) ");
                CalendarRepRecord::model()->deleteAll("repid IN ({$repids})");