diff --git a/src/install/sql-dfdata.txt b/src/install/sql-dfdata.txt index 1f7b39ec..1c3c4e31 100755 --- a/src/install/sql-dfdata.txt +++ b/src/install/sql-dfdata.txt @@ -4109,6 +4109,6 @@ INSERT INTO `#@__plus` VALUES (27, '友情链接模块', '', '', 'DedeBIZ', 1, ''), (10, '挑错管理', '', '', 'DedeBIZ', 1, ''); -INSERT INTO `#@__sysconfig` (`varname`, `info`, `groupid`, `type`, `value`) VALUES ('cfg_disable_funs', '模板引擎禁用PHP函数', 7, 'bstring', 'phpinfo,eval,exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source,file_put_contents'); +INSERT INTO `#@__sysconfig` (`varname`, `info`, `groupid`, `type`, `value`) VALUES ('cfg_disable_funs', '模板引擎禁用PHP函数', 7, 'bstring', ''); INSERT INTO `#@__sysconfig` (`varname`, `info`, `groupid`, `type`, `value`) VALUES ('cfg_disable_tags', '模板引擎禁用标签', 7, 'bstring', ''); ALTER TABLE `#@__arctiny` ADD INDEX `idx_typeid_arcrank_sortrank` (`typeid`, `arcrank`, `sortrank`); \ No newline at end of file diff --git a/src/system/autoload.inc.php b/src/system/autoload.inc.php index 918ae016..fe99f023 100755 --- a/src/system/autoload.inc.php +++ b/src/system/autoload.inc.php @@ -15,8 +15,7 @@ function __autoload($classname) { return TRUE; } - if (in_array($classname, array("archives","freelist","listview","partview","rssview", - "searchview","sglistview","sgpage","specview","taglist"))) { + if (in_array($classname, array("archives","freelist","listview","partview","rssview","searchview","sglistview","sgpage","specview","taglist"))) { $classname = "arc.".$classname; } $libclassfile = $classname.'.class.php'; diff --git a/src/system/autoload7.inc.php b/src/system/autoload7.inc.php index 2698fb4f..187484bb 100755 --- a/src/system/autoload7.inc.php +++ b/src/system/autoload7.inc.php @@ -15,8 +15,7 @@ function dede_autoloader($classname) { return TRUE; } - if (in_array($classname, array("archives","freelist","listview","partview","rssview", - "searchview","sglistview","sgpage","specview","taglist"))) { + if (in_array($classname, array("archives","freelist","listview","partview","rssview","searchview","sglistview","sgpage","specview","taglist"))) { $classname = "arc.".$classname; } $libclassfile = $classname.'.class.php'; diff --git a/src/system/common.func.php b/src/system/common.func.php index 0f15ebf2..d091228d 100755 --- a/src/system/common.func.php +++ b/src/system/common.func.php @@ -46,7 +46,6 @@ if (version_compare(PHP_VERSION, '7.0.0', '>=')) { } } } - function get_mime_type($filename) { if (! function_exists('finfo_open')) @@ -59,14 +58,12 @@ function get_mime_type($filename) finfo_close($finfo); return $mimeType; } - function is_all_numeric(array $array){ foreach($array as $item){ if(!is_numeric($item)) return false; } return true; } - function make_hash() { $rand = dede_random_bytes(16); @@ -194,10 +191,10 @@ $arrs2 = array(); /** * 短消息函数,可以在某个动作处理后友好的提示信息 * - * @param string $msg 消息提示信息 - * @param string $gourl 跳转地址 - * @param int $onlymsg 仅显示信息 - * @param int $limittime 限制时间 + * @param string $msg 消息提示信息 + * @param string $gourl 跳转地址 + * @param int $onlymsg 仅显示信息 + * @param int $limittime 限制时间 * @return void */ function ShowMsg($msg, $gourl, $onlymsg = 0, $limittime = 0) @@ -284,4 +281,114 @@ function IndexActive($idx) //这里主要兼容早期的用户扩展,v5.7之后我们建议使用小助手helper进行扩展 if (file_exists(DEDEINC.'/extend.func.php')) { require_once(DEDEINC.'/extend.func.php'); +} +/** + * 添加多选联动筛选 + * + * @return string + */ +function litimgurls($imgid=0) +{ + global $lit_imglist,$dsql; + $row = $dsql->GetOne("SELECT c.addtable FROM #@__archives AS a LEFT JOIN #@__channeltype AS c ON a.channel=c.id where a.id='$imgid'"); + $addtable = trim($row['addtable']); + $row = $dsql->GetOne("Select imgurls From `$addtable` where aid='$imgid'"); + $ChannelUnit = new ChannelUnit(2,$imgid); + $lit_imglist = $ChannelUnit->GetlitImgLinks($row['imgurls']); + return $lit_imglist; +} +//字符过滤函数，用于安全 +function string_filter($str,$stype="inject") { + if ($stype=="inject") { + $str = str_replace ( + array ("select", "insert", "update", "delete", "alter", "cas", "union", "into", "load_file", "outfile", "create", "join", "where", "like", "drop", "modify", "rename", "'", "/*", "*", "../", "./"), + array ("","","","","","","","","","","","","","","","","","","","","",""), + $str); + } else if ($stype=="xss") { + $farr = array ("/\s+/" , "/<(\/?)(script|META|STYLE|HTML|HEAD|BODY|STYLE |i?frame|b|strong|style|html|img|P|o:p|iframe|u|em|strike|BR|div|a|TABLE|TBODY|object|tr|td|st1:chsdate|FONT|span|MARQUEE|body|title|\r\n|link|meta|\?|\%)([^>]*?)>/isU", "/(<[^>]*)on[a-zA-Z]+\s*=([^>]*>)/isU",); + $tarr = array (" ","","\\1\\2",); + $str = preg_replace ($farr, $tarr, $str); + $str = str_replace ( + array( "<", ">", "'", "\"", ";", "/*", "*", "../", "./"), + array("<",">","","","","","","",""), + $str); + } + return $str; +} +//载入自定义表单，用于发布 +function AddFilter($channelid, $type=1, $fieldsnamef=array(), $defaulttid=0, $loadtype='autofield') +{ + global $tid,$dsql,$id; + $tid = $defaulttid ? $defaulttid : $tid; + if ($id!="") + { + $tidsq = $dsql->GetOne(" Select typeid From `#@__archives` where id='$id' "); + $tid = $tidsq["typeid"]; + } + $nofilter = (isset($_REQUEST['TotalResult']) ? "&TotalResult=".$_REQUEST['TotalResult'] : '').(isset($_REQUEST['PageNo']) ? "&PageNo=".$_REQUEST['PageNo'] : ''); + $filterarr = string_filter(stripos($_SERVER['REQUEST_URI'], "list.php?tid=") ? str_replace($nofilter, '', $_SERVER['REQUEST_URI']) : $GLOBALS['cfg_cmsurl']."/apps/list.php?tid=".$tid); + $cInfos = $dsql->GetOne(" Select * From `#@__channeltype` where id='$channelid' "); + $fieldset=$cInfos['fieldset']; + $dtp = new DedeTagParse(); + $dtp->SetNameSpace('field','<','>'); + $dtp->LoadSource($fieldset); + $dede_addonfields = ''; + if(is_array($dtp->CTags)) + { + foreach($dtp->CTags as $tida=>$ctag) + { + $fieldsname = $fieldsnamef ? explode(",", $fieldsnamef) : explode(",", $ctag->GetName()); + if(($loadtype!='autofield' || ($loadtype=='autofield' && $ctag->GetAtt('autofield')==1)) && in_array($ctag->GetName(), $fieldsname) ) + { + $href1 = explode($ctag->GetName().'=', $filterarr); + $href2 = explode('&', $href1[1]); + $fields_value = $href2[0]; + $fields_value1 = explode('|', $fields_value); + $dede_addonfields .= ''.$ctag->GetAtt('itemname').'：'; + switch ($type) { + case 1: + $dede_addonfields .= (preg_match("/&".$ctag->GetName()."=/is",$filterarr,$regm) ? 'GetName()."=".$fields_value,"",$filterarr).'" style="display:inline-block;padding:.25rem .5rem;line-height:1.5;color:#fff;background:#008e38;border-color:#008e38;border-radius:.2rem">全部' : '全部').' '; + $addonfields_items = explode(",",$ctag->GetAtt('default')); + for ($i=0; $iGetName().'=') ? str_replace("=".$fields_value,"=".$fields_value."|".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]); + $is_select = in_array(urlencode($addonfields_items[$i]), $fields_value1) ? 1 : 0; + $fields_value2 = ""; + for ($j=0; $jGetName()."=".$fields_value,$ctag->GetName()."=".$fields_value, "&".$ctag->GetName()."=&"), array("&".$ctag->GetName()."=".$fields_value2,$ctag->GetName()."=".$fields_value2, "&"), $filterarr); + $href3 = !end(explode("=", $href3)) ? str_replace("&".end(explode("&", $href3)), "", $href3) : $href3; + + $dede_addonfields .= ($fields_value!=urlencode($addonfields_items[$i]) && $is_select!=1 ? ''.$addonfields_items[$i].'' : ''.$addonfields_items[$i].'×')." "; + } + $dede_addonfields .= '

'; + break; + case 2: + $dede_addonfields .= (preg_match("/&".$ctag->GetName()."=/is",$filterarr,$regm) ? 'GetName()."=".$fields_value,"",$filterarr).'">全部' : '全部').' '; + $addonfields_items = explode(",",$ctag->GetAtt('default')); + for ($i=0; $iGetName().'=') ? str_replace("=".$fields_value,"=".$fields_value."|".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]); + $is_select = in_array(urlencode($addonfields_items[$i]), $fields_value1) ? 1 : 0; + $fields_value2 = ""; + for ($j=0; $jGetName()."=".$fields_value,$ctag->GetName()."=".$fields_value, "&".$ctag->GetName()."=&"), array("&".$ctag->GetName()."=".$fields_value2,$ctag->GetName()."=".$fields_value2, "&"), $filterarr); + $href3 = !end(explode("=", $href3)) ? str_replace("&".end(explode("&", $href3)), "", $href3) : $href3; + + $dede_addonfields .= ($fields_value!=urlencode($addonfields_items[$i]) && $is_select!=1 ? ' '.$addonfields_items[$i].'' : ' '.$addonfields_items[$i].'')." "; + } + $dede_addonfields .= '

'; + break; + } + } + } + } + echo $dede_addonfields; } \ No newline at end of file diff --git a/src/system/extend.func.php b/src/system/extend.func.php index b1b64b15..e50ed4e6 100755 --- a/src/system/extend.func.php +++ b/src/system/extend.func.php @@ -1,4 +1,4 @@ \ No newline at end of file