晒秘密插件的一个程序漏洞，懂程序的进来帮忙改进一下！

剑雨琴侠 · 发表于 2009-6-19 12:49:58

本帖最后由剑雨琴侠于 2009-6-19 12:58 编辑

这几天下载了晒秘密的插件，冰凉秘密和私房话版本的都结合使用了，发现两程序都存在一个暴露参与者身份的问题，就是在随便看看页面中的最新动态中，参与秘密的动态信息为“有人偷偷参与了某个秘密”，里面有参与者个人主页的链接，这样就暴露了参与者的身份以及内容。

本站地址：
http://www.sxlxh.com/home

问题应该出在mimi_cp.php这个程序中，调试好多次就是不成功！问题应该出在title_template、uid这几个关键位置，知道问题所在的帮忙解决一下！谢谢！

原来的帖子：
https://discuz.dismall.com/viewthread.php?tid=1148504
https://discuz.dismall.com/viewthread.php?tid=1147811
https://discuz.dismall.com/viewthread.php?tid=1290089

剑雨琴侠 · 发表于 2009-6-19 13:16:43

下面是mimi_cp.php文件的源码

<?php
include_once(S_ROOT.'./source/function_edit_credit.php');
$op = $_GET['op'];
if (empty($op)) {
showmessage('未定义的方法');
}
if ('post' == $op) {
$title = trim($_POST['title']);
if (empty($title) || empty($_POST['content']) || empty($_SGLOBAL['supe_username'])) {
showmessage("标题内容或用户名不能为空");
}
$post_mimi_id = intval($_POST['mimi_id']);
//修改
if ($post_mimi_id > 0) {
$data = array(
'title' => shtmlspecialchars($title),
'content' => trim($_POST['content']),
'typeid' => intval($_POST['typeid']),
'typeid2' => intval($_POST['typeid2'])
);
updatetable("app_mimi", $data, "id = {$post_mimi_id}");
showmessage("修改成功！", "mimi.php?do=mimi&ac=view&id={$post_mimi_id}");
}
$data = array(
//'uid' => $_SGLOBAL['supe_uid'],
//'username' => $_SGLOBAL['supe_username'],
'title' => shtmlspecialchars($title),
'content' => trim($_POST['content']),
'typeid' => intval($_POST['typeid']),
'typeid2' => intval($_POST['typeid2']),
'dateline' => $_SGLOBAL['timestamp'],
'status' => 1
);
$mimi_id = inserttable('app_mimi', $data, 1);
$_SGLOBAL['db']->query("UPDATE ".tname('space')." SET credit=credit+1 WHERE uid='$_SGLOBAL[supe_uid]'");
//事件feed
$fs = array();
$fs['icon'] = 'mimi';
$fs['title_template'] = "有人偷偷发表了题为 {subject} 的<a href=http://www.sxlxh.com/home/mimi.php>秘密</a>!";
if ($title != '') {
$fs['title_data'] = array(
'subject' => "<a href="mimi.php?do=mimi&ac=view&id={$mimi_id}">{$title}</a>"
//'score' => $score
); }else{
$fs['title_data'] = array(
'subject' => "<a href="mimi.php?do=mimi&ac=view&id={$mimi_id}">秘密#{$mimi_id}</a>"
);
}
$fs['body_template'] = '';
$fs['body_data'] = array();
include_once(S_ROOT.'./source/function_cp.php');
//事件发布(只显示到首页，但不显示到个人空间)
function feed_add_nospace($icon, $title_template='', $title_data=array(), $body_template='', $body_data=array(), $body_general='', $images=array(), $image_links=array(), $target_ids='', $friend='', $appid=UC_APPID, $returnid=0) {
global $_SGLOBAL;
$feedarr = array(
'appid' => $appid,//获取appid myop为0
'icon' => $icon,
//'uid' => $_SGLOBAL['supe_uid'],
//'username' => $_SGLOBAL['supe_username'],
'dateline' => $_SGLOBAL['timestamp'],
'title_template' => $title_template,
'body_template' => $body_template,
'body_general' => $body_general,
'image_1' => empty($images[0])?'':$images[0],
'image_1_link' => empty($image_links[0])?'':$image_links[0],
'image_2' => empty($images[1])?'':$images[1],
'image_2_link' => empty($image_links[1])?'':$image_links[1],
'image_3' => empty($images[2])?'':$images[2],
'image_3_link' => empty($image_links[2])?'':$image_links[2],
'image_4' => empty($images[3])?'':$images[3],
'image_4_link' => empty($image_links[3])?'':$image_links[3],
'target_ids' => $target_ids,
'friend' => $friend
);
$feedarr = sstripslashes($feedarr);//去掉转义
$feedarr['title_data'] = serialize(sstripslashes($title_data));//数组转化
$feedarr['body_data'] = serialize(sstripslashes($body_data));//数组转化
$feedarr['hash_template'] = md5($feedarr['title_template']."\t".$feedarr['body_template']);//喜好hash
$feedarr['hash_data'] = md5($feedarr['title_template']."\t".$feedarr['title_data']."\t".$feedarr['body_template']."\t".$feedarr['body_data']);//合并hash
$feedarr = saddslashes($feedarr);//增加转义
//去重
$query = $_SGLOBAL['db']->query("SELECT feedid FROM ".tname('feed')." WHERE uid='$feedarr[uid]' AND hash_data='$feedarr[hash_data]' LIMIT 0,1");
if($oldfeed = $_SGLOBAL['db']->fetch_array($query)) {
updatetable('feed', $feedarr, array('feedid'=>$oldfeed['feedid']));
return 0;
}
if($returnid) {
return inserttable('feed', $feedarr, $returnid);
} else {
inserttable('feed', $feedarr);
}
}
feed_add_nospace($fs['icon'], $fs['title_template'], $fs['title_data'], $fs['body_template'], $fs['body_data'], $fs['body_general'],$fs['images'], $fs['image_links'], $fs['target_ids'], $fs['friend']);
updatecredit($_SGLOBAL['supe_uid'], $score, '-');
showmessage("秘密说出来，舒服了吧？", "mimi.php?do=mimi&ac=view&id={$mimi_id}");
}
elseif ('reply' == $op )
{
$mimi_id = intval($_POST['mimi_id']);
$mimi_title = trim($_POST['mimi_title']);
$mimi_uid = intval($_POST['mimi_uid']);
if (empty($mimi_id)) {
showmessage("参数错误");
}
$content = trim($_POST['content']);
if (empty($content) ) {
showmessage("回复内容不能为空");
}
$data = array(
'uid' => $_SGLOBAL['supe_uid'],
'username' => $_SGLOBAL['supe_username'],
'content' => trim($_POST['content']),
'mimi_id' => $mimi_id,
'typeid2' => intval($_POST['typeid2']),
'dateline' => $_SGLOBAL['timestamp']
);
$reply_id = inserttable('app_mimi_reply', $data, 1);
//更新回复数
$sql = "UPDATE ".tname("app_mimi")." SET reply_count = reply_count + 1 WHERE id = ".$mimi_id;
$_SGLOBAL['db']->query( $sql );
if ($mimi_uid != $_SGLOBAL['supe_uid']) {
//通知
include_once(S_ROOT.'./source/function_cp.php');
$message = "参与了您发表的秘密 <a href='http://www.sxlxh.com/home/mimi.php?do=mimi&ac=view&id=".$mimi_id."'>".$mimi_title."</a>";
notification_add($mimi_uid, app, $message);
}
//事件feed
$icon = 'mimi';
$title_template = "有人悄悄的参与了秘密 <a href='http://www.sxlxh.com/home/mimi.php?do=mimi&ac=view&id=".$mimi_id."'>".$mimi_title."</a>";
feed_add($icon, $title_template);
showmessage("秘密参与成功", $theurl, 1);
}
elseif ('finish' == $op)
{
$mimi_id = intval($_POST['mimi_id']);
$theurl = trim($_POST['theurl']);
//获取信息
$sql = "SELECT * FROM ".tname("app_mimi")." WHERE id= $mimi_id AND uid = ".$_SGLOBAL['supe_uid'] ;
$query = $_SGLOBAL['db']->query( $sql );
$mimi = $_SGLOBAL['db']->fetch_array( $query );
if (empty($mimi)) {
showmessage("信息不存在或者已经被删除", 'mimi.php?do=mimi');
}
if (2 == $mimi['status']) {
showmessage("此问题已经结贴。请不要重复提交。");
}
$pscore = $_POST['score'];
if ($mimi['score'] != array_sum($pscore) ) {
showmessage("悬赏分与分配的分值不一致");
}
foreach ($pscore as $key => $val) {
$sql = "UPDATE ".tname('app_mimi_reply')." SET score = ".intval($val)." WHERE id =".$key;
$_SGLOBAL['db']->query($sql);
}
$sql = "SELECT * FROM ".tname('app_mimi_reply')." WHERE mimi_id = $mimi_id ";
$query = $_SGLOBAL['db']->query($sql);
$list = array( );
while ( $value = $_SGLOBAL['db']->fetch_array( $query ) )
{
$list[$value['uid']]['fen'] = intval($list[$value['uid']]['fen']) + $value['score'];
//$list[$value['uid']]['username'] = $value['username'];
}
$arr_fedd_str = "";
include_once(S_ROOT.'./source/function_cp.php');
foreach ($list as $key => $val) {
if (empty($val['fen'])) {
continue;
}
updatecredit($key, $val['fen'], '+');
$arr_fedd_str[] = "<a href='space.php?uid=0'>{$val['username']}</a>: {$val['fen']}分 ";
$message = "对 <a href="mimi.php?do=mimi&ac=view&id={$mimi_id}">{$mimi['title']}</a> 做了结贴，您获得了 {$val['fen']}分。";
notification_add($key, "app", $message );
}
$sql = "UPDATE ".tname("app_mimi")." SET status='2', msg='". addslashes(implode("，", $arr_fedd_str))."' WHERE id = $mimi_id ";
$_SGLOBAL['db']->query($sql);
//事件feed
$fs = array();
$fs['icon'] = 'mimi';
$fs['title_template'] = "{actor} 对问答 {subject} 做了结贴，给分情况： ". implode("，", $arr_fedd_str);
$fs['title_data'] = array(
'subject' => "<a href="mimi.php?do=mimi&ac=view&id={$mimi_id}">{$mimi['title']}</a>"
);
$fs['body_template'] = '';
$fs['body_data'] = array();
include_once(S_ROOT.'./source/function_cp.php');
feed_add_nospace($fs['icon'], $fs['title_template'], $fs['title_data'], $fs['body_template'], $fs['body_data'], $fs['body_general'],$fs['images'], $fs['image_links'], $fs['target_ids'], $fs['friend']);
showmessage("恭喜您，结贴成功。", $theurl);
}
elseif ('delete' == $op)
{
$mimi_id = intval($_GET['id']);
if (empty($mimi_id)) {
showmessage("参数错误");
}
$sql = " select * from ".tname('app_mimi')." where id = ".$mimi_id." ";
$query = $_SGLOBAL['db']->query( $sql );
$info = $_SGLOBAL['db']->fetch_array( $query );
$u_ser_id = $info[uid];
if (empty($info))
{
showmessage("信息不存在或者已经被删除", 'mimi.php?do=mimi');
}
if ( $_SGLOBAL['supe_uid'] != $info['uid'] && $_SGLOBAL['supe_uid'] != ADMIN_ID ) {
showmessage("您没有删除此问答的权限", 'mimi.php?do=mimi');
}
$sql = "DELETE FROM ".tname('app_mimi')." WHERE id = {$mimi_id} ";
$query = $_SGLOBAL['db']->query($sql);
$sql = "DELETE FROM ".tname('app_mimi_reply')." WHERE mimi_id = {$mimi_id} ";
$query = $_SGLOBAL['db']->query($sql);
$_SGLOBAL['db']->query("UPDATE ".tname('space')." SET credit=credit-1 WHERE uid={$u_ser_id}");
showmessage("删除成功！", "mimi.php?do=mimi", 0);
}
elseif ('replydelete' == $op)
{
$mimi_id = intval($_GET['mimi_id']);
$id = intval($_GET['id']);
if (empty($mimi_id) || empty($id)) {
showmessage("参数错误");
}
$sql = " select * from ".tname('app_mimi_reply')." where id = ".$id." ";
$query = $_SGLOBAL['db']->query( $sql );
$info = $_SGLOBAL['db']->fetch_array( $query );
if (empty($info))
{
showmessage("信息不存在或者已经被删除", 'mimi.php?do=mimi');
}
if ( $_SGLOBAL['supe_uid'] != $info['uid'] && $_SGLOBAL['supe_uid'] != ADMIN_ID ) {
showmessage("您没有删除的权限", 'mimi.php?do=mimi');
}
$sql = "DELETE FROM ".tname('app_mimi_reply')." WHERE id = {$id} ";
$query = $_SGLOBAL['db']->query($sql);
showmessage("删除成功！", "mimi.php?do=mimi&ac=view&id={$mimi_id}");
}

复制代码

剑雨琴侠 · 发表于 2009-6-19 15:25:49

晕给四五个版主发了短消息也没有人过来帮一把

daymake · 发表于 2009-6-19 15:26:42

慢慢等等吧

剑雨琴侠 · 发表于 2009-6-20 11:29:57

晕这样的秘密谁敢晒啊

剑雨琴侠 · 发表于 2009-6-21 23:27:51

晕列表里面都找不到了顶起

剑雨琴侠 · 发表于 2009-6-25 09:33:19

我继续顶！！！

heye521 · 发表于 2009-7-22 02:31:49

害怕呀哈啊

wkl17 · 发表于 2009-7-28 14:19:56

看得出楼主很用心。。。我也是。。哈哈。。但是我只能帮顶了。。。

wkl17 · 发表于 2009-7-28 14:21:53

https://discuz.dismall.com/viewthread.php?tid=1290089
一楼最底部有这一句话：插件爱好者请加我QQ:280392287 交流意见!

加入去和群主谈谈？？（如果有结果了要分享一下哈。。。）

		自动登录	找回密码
密码			立即注册

[疑难] 晒秘密插件的一个程序漏洞，懂程序的进来帮忙改进一下！