function template_safe($content)
{
if (preg_match("/(\\<\\?|file_put|file_get|fopen|fwrite|fread|file\\(|eval)/i", $content)) {
msg('模板内容包含不安全写法，请通过FTP修改模板');
}
$content = stripslashes($content);
$content = strip_sql($content, 0);
return $content;
}
function remote($file, $savepath, $savename = '')
{
global $DT, $_userid;
$this->file = strip_sql($file, 0);
$this->userid = $_userid;
$this->ext = file_ext($file);
in_array($this->ext, array('jpg', 'jpeg', 'gif', 'png', 'bmp')) or $this->ext = 'jpg';
$this->maxsize = $DT['uploadsize'] ? $DT['uploadsize'] * 1024 : 2048 * 1024;
$this->savepath = $savepath;
$this->savename = $savename;
}
function dhtmlspecialchars($string)
{
if (is_array($string)) {
return array_map('dhtmlspecialchars', $string);
} else {
$string = htmlspecialchars($string, ENT_QUOTES, DT_CHARSET == 'GBK' ? 'GB2312' : 'UTF-8');
$string = str_replace('&', '&', $string);
if (defined('DT_ADMIN')) {
return $string;
}
$_string = str_replace(array('"', '"', '"'), array('', '', ''), $string);
if ($_string == $string) {
return $string;
}
return strip_sql($_string);
}
}
function tag($parameter, $expires = 0)
{
global $DT, $CFG, $MODULE, $DT_TIME, $db;
if ($expires > 0) {
$tag_expires = $expires;
} else {
if ($expires == -2) {
$tag_expires = $CFG['db_expires'];
} else {
if ($expires == -1) {
$tag_expires = 0;
} else {
$tag_expires = $CFG['tag_expires'];
}
}
}
$tag_cache = false;
$db_cache = $expires == -2 || defined('TOHTML') ? 'CACHE' : '';
if ($tag_expires && $db_cache != 'CACHE' && strpos($parameter, '&page=') === false) {
$tag_cache = true;
$TCF = DT_CACHE . '/tag/' . md5($parameter) . '.htm';
if (is_file($TCF) && $DT_TIME - filemtime($TCF) < $tag_expires) {
echo substr(file_get($TCF), 17);
return;
}
}
$parameter = str_replace(array('&', '%'), array('', '##'), $parameter);
$parameter = strip_sql($parameter);
parse_str($parameter, $par);
if (!is_array($par)) {
return '';
}
$par = dstripslashes($par);
extract($par, EXTR_SKIP);
isset($prefix) or $prefix = $db->pre;
isset($moduleid) or $moduleid = 1;
if (!isset($MODULE[$moduleid])) {
return '';
}
isset($fields) or $fields = '*';
isset($catid) or $catid = 0;
isset($child) or $child = 1;
isset($areaid) or $areaid = 0;
isset($areachild) or $areachild = 1;
isset($dir) && check_name($dir) or $dir = 'tag';
isset($template) && check_name($template) or $template = 'list';
isset($condition) or $condition = '1';
isset($group) or $group = '';
isset($page) or $page = 1;
isset($offset) or $offset = 0;
isset($pagesize) or $pagesize = 10;
isset($order) or $order = '';
isset($showpage) or $showpage = 0;
isset($showcat) or $showcat = 0;
isset($datetype) or $datetype = 0;
isset($target) or $target = '';
isset($class) or $class = '';
isset($length) or $length = 0;
isset($introduce) or $introduce = 0;
isset($debug) or $debug = 0;
isset($lazy) or $lazy = 0;
isset($cols) && $cols or $cols = 1;
if ($catid) {
if ($moduleid > 4) {
if (is_numeric($catid)) {
$CAT = $db->get_one("SELECT child,arrchildid,moduleid FROM {$db->pre}category WHERE catid={$catid}");
$condition .= $child && $CAT['child'] && $CAT['moduleid'] == $moduleid ? " AND catid IN (" . $CAT['arrchildid'] . ")" : " AND catid={$catid}";
} else {
if ($child) {
$catids = '';
$result = $db->query("SELECT arrchildid FROM {$db->pre}category WHERE catid IN ({$catid})");
while ($r = $db->fetch_array($result)) {
$catids .= ',' . $r['arrchildid'];
}
if ($catids) {
$catid = substr($catids, 1);
}
}
$condition .= " AND catid IN ({$catid})";
}
} else {
if ($moduleid == 4) {
$condition .= " AND catids LIKE '%,{$catid},%'";
}
}
}
if ($areaid) {
if (is_numeric($areaid)) {
$ARE = $db->get_one("SELECT child,arrchildid FROM {$db->pre}area WHERE areaid={$areaid}");
$condition .= $areachild && $ARE['child'] ? " AND areaid IN (" . $ARE['arrchildid'] . ")" : " AND areaid={$areaid}";
} else {
if ($areachild) {
$areaids = '';
$result = $db->query("SELECT arrchildid FROM {$db->pre}area WHERE areaid IN ({$areaid})");
while ($r = $db->fetch_array($result)) {
$areaids .= ',' . $r['arrchildid'];
}
if ($areaids) {
$areaid = substr($areaids, 1);
}
}
$condition .= " AND areaid IN ({$areaid})";
}
}
$table = isset($table) ? $prefix . $table : get_table($moduleid);
$offset or $offset = ($page - 1) * $pagesize;
$percent = dround(100 / $cols) . '%';
$num = 0;
$order = $order ? ' ORDER BY ' . $order : '';
$condition = stripslashes($condition);
$condition = str_replace('##', '%', $condition);
if ($showpage) {
$num = $db->count($table, $condition, $tag_expires ? $tag_expires : $CFG['db_expires']);
$pages = $catid ? listpages(get_cat($catid), $num, $page, $pagesize) : pages($num, $page, $pagesize);
} else {
if ($group) {
$condition .= ' GROUP BY ' . $group;
}
}
if ($page < 2 && strpos($parameter, '&page=') !== false) {
$db_cache = 'CACHE';
$tag_expires = $CFG['tag_expires'];
}
if ($template == 'null') {
$db_cache = 'CACHE';
}
$query = "SELECT " . $fields . " FROM " . $table . " WHERE " . $condition . $order . " LIMIT " . $offset . "," . $pagesize;
if ($debug) {
echo $parameter . '<br/>' . $query . '<br/>';
}
$tags = $catids = $CATS = array();
$result = $db->query($query, $db_cache, $tag_expires);
while ($r = $db->fetch_array($result)) {
if ($moduleid == 4 && isset($r['company'])) {
$r['alt'] = $r['companyname'] = $r['company'];
if ($length) {
$r['company'] = dsubstr($r['company'], $length);
}
}
if (isset($r['title'])) {
$r['title'] = str_replace('"', '"', trim($r['title']));
$r['alt'] = $r['title'];
if ($length) {
$r['title'] = dsubstr($r['title'], $length);
}
if (isset($r['style']) && $r['style']) {
$r['title'] = set_style($r['title'], $r['style']);
}
}
if ($lazy && isset($r['thumb']) && $r['thumb']) {
$r['thumb'] = DT_SKIN . 'image/lazy.gif" class="lazy" original="' . $r['thumb'];
}
if (isset($r['introduce']) && $introduce) {
$r['introduce'] = dsubstr($r['introduce'], $introduce);
}
if (isset($r['linkurl']) && $r['linkurl'] && $moduleid > 4 && strpos($r['linkurl'], '://') === false) {
$r['linkurl'] = $MODULE[$moduleid]['linkurl'] . $r['linkurl'];
}
if ($showcat && $moduleid > 4 && isset($r['catid'])) {
$catids[$r['catid']] = $r['catid'];
}
$tags[] = $r;
}
$db->free_result($result);
if ($showcat && $moduleid > 4 && $catids) {
$result = $db->query("SELECT catid,catname,linkurl FROM {$db->pre}category WHERE catid IN (" . implode(',', $catids) . ")");
while ($r = $db->fetch_array($result)) {
$CATS[$r['catid']] = $r;
}
if ($CATS) {
foreach ($tags as $k => $v) {
$tags[$k]['catname'] = $v['catid'] ? $CATS[$v['catid']]['catname'] : '';
$tags[$k]['caturl'] = $v['catid'] ? $MODULE[$moduleid]['linkurl'] . $CATS[$v['catid']]['linkurl'] : '';
}
}
}
if ($template == 'null') {
return $tags;
}
if ($tag_cache) {
ob_start();
include template($template, $dir);
$contents = ob_get_contents();
ob_clean();
file_put($TCF, '<!--' . ($DT_TIME + $tag_expires) . '-->' . $contents);
echo $contents;
} else {
include template($template, $dir);
}
}
$dbaks = array_reverse($dbaks);
}
include tpl('database_import');
break;
default:
if (isset($backup)) {
$fileid = isset($fileid) ? intval($fileid) : 1;
$sizelimit = $sizelimit ? intval($sizelimit) : 2048;
if ($fileid == 1 && $tables) {
if (!isset($tables) || !is_array($tables)) {
msg('请选择需要备份的表');
}
$random = timetodate($DT_TIME, 'Y-m-d H.i.s') . ' ' . strtolower(random(10));
$tsize = 0;
foreach ($tables as $k => $v) {
$tables[$k] = strip_sql($v, 0);
$tsize += $sizes[$v];
}
$tid = ceil($tsize * 1024 / $sizelimit);
cache_write($_username . '_backup.php', $tables);
} else {
if (!($tables = cache_read($_username . '_backup.php'))) {
msg('请选择需要备份的表');
}
}
$dumpcharset = $sqlcharset ? $sqlcharset : $CFG['db_charset'];
$setnames = $sqlcharset && $db->version() > '4.1' && (!$sqlcompat || $sqlcompat == 'MYSQL41') ? "SET NAMES '{$dumpcharset}';\n\n" : '';
if ($db->version() > '4.1') {
if ($sqlcharset) {
$db->query("SET NAMES '" . $sqlcharset . "';\n\n");
}
define("UC_DBNAME", $MOD['uc_dbname']);
define("UC_DBPRE", $MOD['uc_dbpre']);
define("UC_KEY", $MOD['uc_key']);
define('UC_APPID', $MOD['uc_appid']);
define("UC_API", $MOD['uc_api']);
define("UC_IP", $MOD['uc_ip']);
define("UC_DBTABLEPRE", $MOD['uc_dbpre']);
define("UC_CONNECT", $MOD['uc_mysql'] ? 'mysql' : '');
define('UC_DBCHARSET', $MOD['uc_charset']);
define('API_RETURN_SUCCEED', 1);
define('API_UPDATEPW', 1);
define('API_UPDATECREDIT', 1);
define('API_GETCREDITSETTINGS', 1);
define('API_UPDATECREDITSETTINGS', 1);
require_once DT_ROOT . '/api/ucenter/client.php';
$code = strip_sql($code, 0);
parse_str(uc_authcode($code, 'DECODE', UC_KEY), $uc_arr);
#log_write($uc_arr, 'uc', 1);
if ($DT_TIME - intval($uc_arr['time']) > 3600) {
exit('Authracation Has Expiried');
}
if (empty($uc_arr)) {
exit('Invalid Request');
}
$action = $uc_arr['action'];
switch ($action) {
case 'test':
exit('1');
break;
case 'synlogin':
$username = $uc_arr['username'];
require DT_ROOT . '/include/cache_' . $CFG['cache'] . '.class.php';
require DT_ROOT . '/include/session_' . $CFG['session'] . '.class.php';
require DT_ROOT . '/include/file.func.php';
if (!empty($_SERVER['REQUEST_URI'])) {
strip_uri($_SERVER['REQUEST_URI']);
}
if ($_POST) {
$_POST = strip_sql($_POST);
strip_key($_POST);
}
if ($_GET) {
$_GET = strip_sql($_GET);
strip_key($_GET);
}
if ($_COOKIE) {
$_COOKIE = strip_sql($_COOKIE);
strip_key($_COOKIE);
}
if (!IN_ADMIN) {
$BANIP = cache_read('banip.php');
if ($BANIP) {
banip($BANIP);
}
$destoon_task = '';
}
if ($_POST) {
extract($_POST, EXTR_SKIP);
}
if ($_GET) {
extract($_GET, EXTR_SKIP);
}
<?php
/*
[Destoon B2B System] Copyright (c) 2008-2015 www.destoon.com
This is NOT a freeware, use is subject to license.txt
*/
$_SERVER['REQUEST_URI'] = '';
require '../common.inc.php';
header("Content-type:text/javascript");
check_referer() or exit('document.write("Invalid Referer");');
$tag = isset($auth) ? decrypt($auth) : '';
$tag or exit('document.write("Invalid Parameter");');
is_file(DT_ROOT . '/file/script/0' . md5($tag) . '.js') or exit('document.write("Invalid Script");');
$tag = strip_sql($tag);
foreach (array($DT_PRE, '#', '$', '%', '&', 'table', 'fields', 'password', 'payword', 'debug') as $v) {
strpos($tag, $v) === false or exit('document.write("Invalid Tag");');
}
ob_start();
tag($tag);
$data = ob_get_contents();
ob_clean();
echo 'document.write(\'' . dwrite($data ? $data : 'No Data') . '\');';
function login_log($username, $password, $admin = 0, $message = '')
{
global $DT_PRE, $DT_TIME, $DT_IP, $L;
$password = is_md5($password) ? md5($password) : md5(md5($password));
$agent = addslashes(htmlspecialchars(strip_sql($_SERVER['HTTP_USER_AGENT'])));
$message or $message = $L['member_login_ok'];
if ($message == $L['member_login_ok']) {
cache_delete($DT_IP . '.php', 'ban');
}
$this->db->query("INSERT INTO {$DT_PRE}login (username,password,admin,loginip,logintime,message,agent) VALUES ('{$username}','{$password}','{$admin}','{$DT_IP}','{$DT_TIME}','{$message}','{$agent}')");
}
break;
case 'find':
$mid or $mid = '';
$tb = isset($tb) ? trim($tb) : '';
if (isset($MODULE[$mid]) && $mid > 3) {
$table = get_table($mid);
$note = urlencode($MODULE[$mid]['name']);
} else {
$table = $DT_PRE . $tb;
$note = '';
}
dheader('?file=' . $file . '&action=dict&table=' . $table . '¬e=' . $note);
break;
case 'dict':
isset($table) && $table or exit;
$table = strip_sql($table, 0);
if (strpos($table, $DT_PRE) === false) {
$rtable = $table;
} else {
$rtable = substr($table, strlen($DT_PRE));
$rtable = preg_replace("/_[0-9]{1,}/", '', $rtable);
}
if ($submit) {
$csv = '';
foreach ($name as $k => $v) {
$v = str_replace(',', '，', $v);
$n = str_replace(',', '，', $note[$k]);
$csv .= $k . ',' . $v . ',' . $n . "\n";
}
file_put(DT_ROOT . '/file/setting/' . $rtable . '.csv', trim($csv));
dmsg('更新成功', '?file=' . $file . '&action=' . $action . '&table=' . $table . '¬e=' . urlencode($nt));
/*
[Destoon B2B System] Copyright (c) 2008-2013 Destoon.COM
This is NOT a freeware, use is subject to license.txt
*/
define('DT_NONUSER', true);
if ($_SERVER['QUERY_STRING']) {
$exprise = isset($_GET['tag_expires']) ? intval($_GET['tag_expires']) : 0;
$moduleid = isset($_GET['moduleid']) ? intval($_GET['moduleid']) : 0;
$moduleid > 3 or exit('document.write("<h2>Bad Parameter</h2>");');
$tag = $_SERVER['QUERY_STRING'];
$_SERVER['QUERY_STRING'] = $_SERVER['REQUEST_URI'] = '';
foreach ($_GET as $k => $v) {
unset(${$k});
}
$_GET = array();
require '../common.inc.php';
header("Content-type:text/javascript");
$DT['jstag'] && $DT['safe_domain'] && check_referer() or exit('document.write("<h2>Invalid Referer</h2>");');
$tag = strip_sql(stripslashes(urldecode($tag)));
foreach (array($DT_PRE, '#', '$', '%', '&', 'table', 'fields', 'password', 'payword', 'debug') as $v) {
strpos($tag, $v) === false or exit('document.write("<h2>Bad Parameter</h2>");');
}
ob_start();
tag($tag, $exprise);
$data = ob_get_contents();
ob_clean();
echo 'document.write(\'' . dwrite($data) . '\');';
} else {
header("Content-type:text/javascript");
echo 'document.write("<h2>Bad Parameter</h2>");';
}
//发起人在线
dheader('?chatid=' . $chatid);
}
//
} else {
//当前为发起人
if ($DT_TIME - $chat['treadtime'] > $MOD['chat_poll'] * 3) {
//接收人已经断开
$db->query("UPDATE {$table} SET tgettime=0 WHERE chatid='{$chatid}'");
} else {
//接收人在线
//
}
}
} else {
$forward = addslashes(htmlspecialchars(strip_sql($forward)));
if (strpos($forward, $MOD['linkurl']) !== false) {
$forward = '';
}
//创建一个新对话
$db->query("INSERT INTO {$table} (chatid,fromuser,touser,tgettime,forward) VALUES ('{$chat_id}','{$chat_fromuser}','{$chat_touser}','0','{$forward}')");
}
} else {
if (isset($chatid) && is_md5($chatid)) {
$chat = $db->get_one("SELECT * FROM {$table} WHERE chatid='{$chatid}'");
if ($chat && $chat['touser'] == $_username) {
$chat_id = $chatid;
$chat_status = 3;
if (check_name($chat['fromuser'])) {
if ($DT_TIME - $chat['freadtime'] > $MOD['chat_poll'] * 3) {
//发起对话人已经断开
<?php
defined('DT_ADMIN') or exit('Access Denied');
$tb = isset($tb) ? strip_sql(trim($tb), 0) : '';
$tb or msg();
$len = strlen($DT_PRE);
if (substr($tb, 0, $len) == $DT_PRE) {
$tb = substr($tb, $len);
}
$do = new fields();
$do->tb = $tb;
$menus = array(array('添加字段', '?file=' . $file . '&tb=' . $tb . '&action=add'), array('字段列表', '?&file=' . $file . '&tb=' . $tb));
$this_forward = '?moduleid=' . $moduleid . '&file=' . $file . '&tb=' . $tb;
switch ($action) {
case 'add':
if ($submit) {
if ($do->pass($post)) {
$do->add($post);
dmsg('添加成功', $this_forward);
} else {
msg($do->errmsg);
}
} else {
include tpl('fields_add');
}
break;
case 'edit':
$itemid or msg();
$do->itemid = $itemid;
if ($submit) {
if ($do->pass($post)) {
