DedeBIZ
/
DedeV6
Watch 2
Star 0
Fork 0
Code Pull Requests 0 Releases 25 Activity
国内流行的内容管理系统（CMS）多端全媒体解决方案 https://www.dedebiz.com
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2199 Commits
3 Branches
110MB
Tree: 91c46336c6
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '91c46336c6'
${ noResults }
DedeV6/src/system/common.func.php

785 lines
31KB
Raw Blame History 

  1. <?php

  2. if (!defined('DEDEINC')) exit ('dedebiz');

  3. /**

  4.  * 系统核心函数存放

  5.  * 

  6.  * @version        $id:common.func.php 4 16:39 2010年7月6日 tianya $

  7.  * @package        DedeBIZ.Libraries

  8.  * @copyright      Copyright (c) 2022 DedeBIZ.COM

  9.  * @license        GNU GPL v2 (https://www.dedebiz.com/license)

  10.  * @link           https://www.dedebiz.com

  11.  */

  12. //类似Bootstrap警告框

  13. define('ALERT_PRIMARY', 1);

  14. define('ALERT_SECONDARY', 2);

  15. define('ALERT_SUCCESS', 3);

  16. define('ALERT_DANGER', 4);

  17. define('ALERT_WARNING', 5);

  18. define('ALERT_INFO', 6);

  19. define('ALERT_LIGHT', 7);

  20. define('ALERT_DARK', 8);

  21. define("ALERT_TPL", '<div style="position:relative;padding:0.75rem 1.25rem;margin-bottom:1rem;width:auto;font-size:14px;color:~color~;background:~background~;border-color:~border~;border:1px solid transparent;border-radius:0.5rem">~content~</div>');

  22. //$content:文档，$type:alert类型

  23. function DedeAlert($content, $type = ALERT_PRIMARY, $isHTML = false)

  24. {

  25.     $colors = array(

  26.         ALERT_PRIMARY => array('#cfe2ff','#b6d4fe','#084298'),

  27.         ALERT_SECONDARY => array('#e2e3e5','#d3d6d8','#41464b'),

  28.         ALERT_SUCCESS => array('#d1e7dd','#badbcc','#0f5132'),

  29.         ALERT_DANGER => array('#f8d7da','#f5c2c7','#842029'),

  30.         ALERT_WARNING => array('#fff3cd','#ffecb5','#664d03'),

  31.         ALERT_INFO => array('#cff4fc','#b6effb','#055160'),

  32.         ALERT_LIGHT => array('#fefefe','#fdfdfe','#636464'),

  33.         ALERT_DARK => array('#d3d3d4','#bcbebf','#141619'),

  34.     );

  35.     $content = $isHTML? RemoveXSS($content) : htmlspecialchars($content);

  36.     $colors = isset($colors[$type])? $colors[$type] : $colors[ALERT_PRIMARY];

  37.     list($background, $border, $color) = $colors;

  38.     return str_replace(array('~color~','~background~','~border~', '~content~'),array($color,$background,$border,$content),ALERT_TPL);

  39. }

  40. if (version_compare(PHP_VERSION, '7.0.0', '>=')) {

  41.     if (!function_exists('mysql_connect') and function_exists('mysqli_connect')) {

  42.         function mysql_connect($server, $username, $password)

  43.         {

  44.             return mysqli_connect($server, $username, $password);

  45.         }

  46.     }

  47.     if (!function_exists('mysql_query') and function_exists('mysqli_query')) {

  48.         function mysql_query($query, $link)

  49.         {

  50.             return mysqli_query($link, $query);

  51.         }

  52.     }

  53.     if (!function_exists('mysql_select_db') and function_exists('mysqli_select_db')) {

  54.         function mysql_select_db($database_name, $link)

  55.         {

  56.             return mysqli_select_db($link, $database_name);

  57.         }

  58.     }

  59.     if (!function_exists('mysql_fetch_array') and function_exists('mysqli_fetch_array')) {

  60.         function mysql_fetch_array($result)

  61.         {

  62.             return mysqli_fetch_array($result);

  63.         }

  64.     }

  65.     if (!function_exists('mysql_close') and function_exists('mysqli_close')) {

  66.         function mysql_close($link)

  67.         {

  68.             if ($link) {

  69.                 return @mysqli_close($link);

  70.             } else {

  71.                 return false;

  72.             }

  73.         }

  74.     }

  75.     if (!function_exists('mysql_error') and function_exists('mysqli_connect_error')) {

  76.         function mysql_error($link)

  77.         {

  78.             if (mysqli_connect_errno()) {

  79.                 return mysqli_connect_error();

  80.             }

  81.             if ($link) {

  82.                 return @mysqli_error($link);

  83.             } else {

  84.                 return false;

  85.             }

  86.         }

  87.     }

  88.     if (!function_exists('mysql_free_result') and function_exists('mysqli_free_result')) {

  89.         function mysql_free_result($result)

  90.         {

  91.             return mysqli_free_result($result);

  92.         }

  93.     }

  94.     if (!function_exists('split')) {

  95.         function split($pattern, $string)

  96.         {

  97.             return explode($pattern, $string);

  98.         }

  99.     }

  100. }

  101. //一个支持在PHP Cli Server打印的方法

  102. function var_dump_cli($val,...$values)

  103. {

  104.     ob_start();

  105.     var_dump($val,$values);

  106.     error_log(ob_get_clean(), 4);

  107. }

  108. function get_mime_type($filename)

  109. {

  110.     if (!function_exists('finfo_open')) {

  111.         return 'unknow/octet-stream';

  112.     }

  113.     $finfo = finfo_open(FILEINFO_MIME_TYPE);

  114.     $mimeType = finfo_file($finfo, $filename);

  115.     if (preg_match('#\.(php|pl|cgi|asp|aspx|jsp|php5|php4|php3|shtm|shtml)$#i', trim($filename))) {

  116.         return 'forbid/octet-stream';

  117.     }

  118.     finfo_close($finfo);

  119.     return $mimeType;

  120. }

  121. function is_all_numeric(array $array)

  122. {

  123.     foreach ($array as $item) {

  124.         if (!is_numeric($item)) return false;

  125.     }

  126.     return true;

  127. }

  128. function make_hash()

  129. {

  130.     $rand = dede_random_bytes(16);

  131.     $_SESSION['token'] = ($rand === FALSE) ? md5(uniqid(mt_rand(), TRUE)) : bin2hex($rand);

  132.     return $_SESSION['token'];

  133. }

  134. function dede_random_bytes($length)

  135. {

  136.     if (empty($length) or !ctype_digit((string) $length)) {

  137.         return FALSE;

  138.     }

  139.     if (function_exists('openssl_random_pseudo_bytes')) {

  140.         return openssl_random_pseudo_bytes($length);

  141.     }

  142.     if (function_exists('random_bytes')) {

  143.         try {

  144.             return random_bytes((int) $length);

  145.         } catch (Exception $e) {

  146.             return FALSE;

  147.         }

  148.     }

  149.     if (is_readable('/dev/urandom') && ($fp = fopen('/dev/urandom', 'rb')) !== FALSE) {

  150.         version_compare(PHP_VERSION, '5.4.0', '>=') && stream_set_chunk_size($fp, $length);

  151.         $output = fread($fp, $length);

  152.         fclose($fp);

  153.         if ($output !== FALSE) {

  154.             return $output;

  155.         }

  156.     }

  157.     return FALSE;

  158. }

  159. //SQL语句过滤程序，由80sec提供，这里作了适当的修改

  160. if (!function_exists('CheckSql')) {

  161.     function CheckSql($db_string, $querytype = 'select')

  162.     {

  163.         global $cfg_cookie_encode;

  164.         $clean = '';

  165.         $error = '';

  166.         $old_pos = 0;

  167.         $pos = -1;

  168.         $enkey = substr(md5(substr($cfg_cookie_encode.'dedebiz', 0, 5)), 0, 10);

  169.         $log_file = DEDEDATA.'/checksql_'.$enkey.'_safe.txt';

  170.         $userIP = GetIP();

  171.         $getUrl = GetCurUrl();

  172.         //如果是普通查询语句，直接过滤一些特殊语法

  173.         if ($querytype == 'select') {

  174.             $notallow1 = "[^0-9a-z@\._-]{1,}(union|sleep|benchmark|load_file|outfile)[^0-9a-z@\.-]{1,}";

  175.             if (preg_match("/".$notallow1."/i", $db_string)) {

  176.                 fputs(fopen($log_file, 'a+'), "$userIP||$getUrl||$db_string||SelectBreak\r\n");

  177.                 exit("<span>Safe Alert: Request Error step 1 !</span>");

  178.             }

  179.         }

  180.         //完整的SQL检查

  181.         while (TRUE) {

  182.             $pos = strpos($db_string, '\'', $pos + 1);

  183.             if ($pos === FALSE) {

  184.                 break;

  185.             }

  186.             $clean .= substr($db_string, $old_pos, $pos - $old_pos);

  187.             while (TRUE) {

  188.                 $pos1 = strpos($db_string, '\'', $pos + 1);

  189.                 $pos2 = strpos($db_string, '\\', $pos + 1);

  190.                 if ($pos1 === FALSE) {

  191.                     break;

  192.                 } elseif ($pos2 == FALSE || $pos2 > $pos1) {

  193.                     $pos = $pos1;

  194.                     break;

  195.                 }

  196.                 $pos = $pos2 + 1;

  197.             }

  198.             $clean .= '$s$';

  199.             $old_pos = $pos + 1;

  200.         }

  201.         $clean .= substr($db_string, $old_pos);

  202.         $clean = trim(strtolower(preg_replace(array('~\s+~s'), array(' '), $clean)));

  203.         if (

  204.             strpos($clean, '@') !== FALSE  or strpos($clean, 'char(') !== FALSE or strpos($clean, '"') !== FALSE

  205.             or strpos($clean, '$s$$s$') !== FALSE

  206.         ) {

  207.             $fail = TRUE;

  208.             if (preg_match("#^create table#i", $clean)) $fail = FALSE;

  209.             $error = "unusual character";

  210.         }

  211.         //老版本数据库不支持union，程序不使用union，但黑客使用它，所以检查它

  212.         if (strpos($clean, 'union') !== FALSE && preg_match('~(^|[^a-z])union($|[^[a-z])~s', $clean) != 0) {

  213.             $fail = TRUE;

  214.             $error = "union detect";

  215.         }

  216.         //发布版本的程序比较少包括--,#这样的注释，但黑客经常使用它们

  217.         elseif (strpos($clean, '/*') > 2 || strpos($clean, '--') !== FALSE || strpos($clean, '#') !== FALSE) {

  218.             $fail = TRUE;

  219.             $error = "comment detect";

  220.         }

  221.         //这些函数不会被使用，但是黑客会用它来操作文件，down掉数据库

  222.         elseif (strpos($clean, 'sleep') !== FALSE && preg_match('~(^|[^a-z])sleep($|[^[a-z])~s', $clean) != 0) {

  223.             $fail = TRUE;

  224.             $error = "slown down detect";

  225.         } elseif (strpos($clean, 'benchmark') !== FALSE && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~s', $clean) != 0) {

  226.             $fail = TRUE;

  227.             $error = "slown down detect";

  228.         } elseif (strpos($clean, 'load_file') !== FALSE && preg_match('~(^|[^a-z])load_file($|[^[a-z])~s', $clean) != 0) {

  229.             $fail = TRUE;

  230.             $error = "file fun detect";

  231.         } elseif (strpos($clean, 'into outfile') !== FALSE && preg_match('~(^|[^a-z])into\s+outfile($|[^[a-z])~s', $clean) != 0) {

  232.             $fail = TRUE;

  233.             $error = "file fun detect";

  234.         }

  235.         //老版本数据库不支持子查询，该功能也用得少，但黑客可以使用它来查询数据库敏感信息

  236.         elseif (preg_match('~\([^)]*?select~s', $clean) != 0) {

  237.             $fail = TRUE;

  238.             $error = "sub select detect";

  239.         }

  240.         if (!empty($fail)) {

  241.             fputs(fopen($log_file, 'a+'), "$userIP||$getUrl||$db_string||$error\r\n");

  242.             exit("<span>Safe Alert: Request Error step 2!</span>");

  243.         } else {

  244.             return $db_string;

  245.         }

  246.     }

  247. }

  248. /**

  249.  *  载入助手，系统默认载入助手示例

  250.  *  <code>

  251.  *  if (!function_exists('HelloDede'))

  252.  *  {

  253.  *      function HelloDede()

  254.  *      {

  255.  *          echo "Hello! Dede";

  256.  *      }

  257.  *  }

  258.  *  </code>

  259.  *  开发中使用这个助手的时候直接使用函数helper('test');初始化它，然后在文件中就可以直接使用:HelloDede();调用

  260.  *

  261.  * @access    public

  262.  * @param     mix   $helpers  助手名称，可以是数组，可以是单个字符串

  263.  * @return    void

  264.  */

  265. $_helpers = array();

  266. function helper($helpers)

  267. {

  268.     //如果是数组，则进行递归操作

  269.     if (is_array($helpers)) {

  270.         foreach ($helpers as $dede) {

  271.             helper($dede);

  272.         }

  273.         return;

  274.     }

  275.     if (isset($_helpers[$helpers])) {

  276.         return;

  277.     }

  278.     if (file_exists(DEDEINC.'/helpers/'.$helpers.'.helper.php')) {

  279.         include_once(DEDEINC.'/helpers/'.$helpers.'.helper.php');

  280.         $_helpers[$helpers] = TRUE;

  281.     }

  282.     //无法载入助手

  283.     if (!isset($_helpers[$helpers])) {

  284.         exit('Unable to load the requested file: helpers/'.$helpers.'.helper.php');

  285.     }

  286. }

  287. function dede_htmlspecialchars($str)

  288. {

  289.     global $cfg_soft_lang;

  290.     if (version_compare(PHP_VERSION, '5.4.0', '<')) return htmlspecialchars($str);

  291.     if ($cfg_soft_lang == 'gb2312') return htmlspecialchars($str, ENT_COMPAT, 'ISO-8859-1');

  292.     else return htmlspecialchars($str);

  293. }

  294. /**

  295.  *  载入助手，这里会员载入用helps载入多个助手

  296.  *

  297.  * @access    public

  298.  * @param     string

  299.  * @return    void

  300.  */

  301. function helpers($helpers)

  302. {

  303.     helper($helpers);

  304. }

  305. //兼容php4的file_put_contents

  306. if (!function_exists('file_put_contents')) {

  307.     function file_put_contents($n, $d)

  308.     {

  309.         $f = @fopen($n, "w");

  310.         if (!$f) {

  311.             return FALSE;

  312.         } else {

  313.             fwrite($f, $d);

  314.             fclose($f);

  315.             return TRUE;

  316.         }

  317.     }

  318. }

  319. /**

  320.  *  短消息函数，可以在某个动作处理后友好的系统提示

  321.  *

  322.  * @param     string  $msg       消息系统提示

  323.  * @param     string  $gourl     跳转地址

  324.  * @param     int     $onlymsg   仅显示信息

  325.  * @param     int     $limittime 限制时间

  326.  * @param     string  $btnmsg    按钮提示

  327.  * @param     string  $target    跳转类型

  328.  * @return    void

  329.  */

  330. function ShowMsg($msg, $gourl, $onlymsg = 0, $limittime = 0)

  331. {

  332.     if (defined('DEDE_DIALOG_UPLOAD') && !isset($GLOBALS['noeditor'])) {

  333.         echo json_encode(array(

  334.             "uploaded"=>0,

  335.             "error"=>array(

  336.                 "message" => $msg,

  337.             ),

  338.         ));

  339.         return;

  340.     }

  341.     if (isset($GLOBALS['format']) && strtolower($GLOBALS['format'])==='json') {

  342.         echo json_encode(array(

  343.             "code"=>0,

  344.             "msg"=>$msg,

  345.             "gourl"=>$gourl,

  346.         ));

  347.         return;

  348.     }

  349.     if (empty($GLOBALS['cfg_plus_dir'])) $GLOBALS['cfg_plus_dir'] = '..';

  350.     $htmlhead  = "<!DOCTYPE html><html><head><meta charset='utf-8'><meta http-equiv='X-UA-Compatible' content='IE=Edge,chrome=1'><meta name='viewport' content='width=device-width,initial-scale=1'><title>系统提示</title><link rel='stylesheet' href='/static/web/css/bootstrap.min.css'><link rel='stylesheet' href='/static/web/css/admin.css'></head><base target='_self'><body class='body-bg'><script>";

  351.     $htmlfoot  = "</script></body></html>";

  352.     $litime = ($limittime == 0 ? 1000 : $limittime);

  353.     $func = '';

  354.     if ($gourl == '-1') {

  355.         if ($limittime == 0) $litime = 5000;

  356.         $gourl = "javascript:history.go(-1);";

  357.     }

  358.     if ($gourl == '' || $onlymsg == 1) {

  359.         $msg = "<script>alert(\"".str_replace("\"", "“", $msg)."\");</script>";

  360.     } else {

  361.         //当网址为:close::objname时，关闭父框架的id=objname元素

  362.         if (preg_match('/close::/', $gourl)) {

  363.             $tgobj = trim(preg_replace('/close::/', '', $gourl));

  364.             $gourl = 'javascript:;';

  365.             $func .= "window.parent.document.getElementById('{$tgobj}').style.display='none';\r\n";

  366.         }

  367.         $func .= "var pgo=0;function JumpUrl(){if (pgo==0) {location='$gourl'; pgo=1;}}";

  368.         $rmsg = $func;

  369.         $rmsg .= "document.write(\"<div class='tips'><div class='tips-box'><div class='tips-head'><p>系统提示</p></div>\");";

  370.         $rmsg .= "document.write(\"<div class='tips-body'>\");";

  371.         $rmsg .= "document.write(\"".str_replace("\"", "“", $msg)."\");";

  372.         $rmsg .= "document.write(\"";

  373.         if ($onlymsg == 0) {

  374.             if ($gourl != 'javascript:;' && $gourl != '') {

  375.                 $rmsg .= "<div class='text-center mt-3'><a href='{$gourl}' class='btn btn-success btn-sm'>点击反应</a></div>\");";

  376.                 $rmsg .= "setTimeout('JumpUrl()', $litime);";

  377.             } else {

  378.                 $rmsg .= "</div>\");";

  379.             }

  380.         } else {

  381.             $rmsg .= "</div></div>\");";

  382.         }

  383.         $msg  = $htmlhead.$rmsg.$htmlfoot;

  384.     }

  385.     echo $msg;

  386. }

  387. /**

  388.  * 表中是否存在某个字段

  389.  *

  390.  * @param  mixed $tablename 表名称

  391.  * @param  mixed $field 字段名

  392.  * @return void

  393.  */

  394. function TableHasField($tablename, $field)

  395. {

  396.     global $dsql;

  397.     $dsql->GetTableFields($tablename,"tfd");

  398.     while ($r = $dsql->GetFieldObject("tfd")) {

  399.         if ($r->name === $field) {

  400.             return true;

  401.         }

  402.     }

  403.     return false;

  404. }

  405. function GetSimpleServerSoftware()

  406. {

  407.     if (preg_match("#^php#i",$_SERVER["SERVER_SOFTWARE"])) {

  408.         return 'PHP Server';

  409.     } else if (preg_match("#^apache#i",$_SERVER["SERVER_SOFTWARE"])){

  410.         return 'Apache';

  411.     } else if (preg_match("#^nginx#i",$_SERVER["SERVER_SOFTWARE"])){

  412.         return 'Nginx';

  413.     } else if (preg_match("#^microsoft-iis#i",$_SERVER["SERVER_SOFTWARE"])){

  414.         return 'IIS';

  415.     } else if (preg_match("#^caddy#i",$_SERVER["SERVER_SOFTWARE"])){

  416.         return 'Caddy';

  417.     } else {

  418.         return 'Other';

  419.     }

  420. }

  421. /**

  422.  *  获取验证码的session值

  423.  *

  424.  * @return    string

  425.  */

  426. function GetCkVdValue()

  427. {

  428.     @session_id($_COOKIE['PHPSESSID']);

  429.     @session_start();

  430.     return isset($_SESSION['securimage_code_value']) ? $_SESSION['securimage_code_value'] : '';

  431. }

  432. /**

  433.  *  PHP某些版本有Bug，不能在同一作用域中同时读session并改注销它，因此调用后需执行本函数

  434.  *

  435.  * @return    void

  436.  */

  437. function ResetVdValue()

  438. {

  439.     @session_start();

  440.     $_SESSION['securimage_code_value'] = '';

  441. }

  442. function IndexSub($idx, $num)

  443. {

  444.     return intval($idx) - intval($num) == 0 ? '0 ' : intval($idx) - intval($num);

  445. }

  446. /**

  447.  * HideEmail隐藏邮箱

  448.  *

  449.  * @param  mixed $email

  450.  * @return string

  451.  */

  452. function HideEmail($email)

  453. {

  454.     if (empty($email)) return "暂无";

  455.     $em   = explode("@",$email);

  456.     $name = implode('@', array_slice($em, 0, count($em)-1));

  457.     $len  = floor(strlen($name)/2);

  458.     return substr($name,0, $len).str_repeat('*', $len)."@".end($em);   

  459. }

  460. //用来返回index的active

  461. function IndexActive($idx)

  462. {

  463.     if ($idx == 1) {

  464.         return ' active';

  465.     } else {

  466.         return '';

  467.     }

  468. }

  469. //是否是HTTPS

  470. function IsSSL()

  471. {

  472.     if (@$_SERVER['HTTPS'] && ('1' == $_SERVER['HTTPS'] || 'on' == strtolower($_SERVER['HTTPS']))) {

  473.         return true;

  474.     } elseif ('https' == @$_SERVER['REQUEST_SCHEME']) {

  475.         return true;

  476.     } elseif ('443' == $_SERVER['SERVER_PORT']) {

  477.         return true;

  478.     } elseif ('https' == @$_SERVER['HTTP_X_FORWARDED_PROTO']) {

  479.         return true;

  480.     }

  481.     return false;

  482. }

  483. //获取对应版本号的更新SQL

  484. function GetUpdateSQL()

  485. {

  486.     global $cfg_dbprefix, $cfg_dbtype, $cfg_db_language;

  487.     $result = array();

  488.     $query = '';

  489.     $sql4tmp = "ENGINE=MyISAM DEFAULT CHARSET=".$cfg_db_language;

  490.     $fp = fopen(DEDEROOT.'/install/update.txt','r');

  491.     $sqls = array();

  492.     $current_ver = "";

  493.     while(!feof($fp))

  494.     {

  495.         $line = rtrim(fgets($fp,1024));

  496.         if (preg_match("/\-\- ([\d\.]+)/",$line,$matches)) {

  497.             if (count($sqls) > 0) {

  498.                 $result[$current_ver] = $sqls;

  499.             }

  500.             $sqls = array();

  501.             $current_ver = $matches[1];

  502.         }

  503.         if (preg_match("#;$#", $line)) {

  504.             $query .= $line."\n";

  505.             $query = str_replace('#@__',$cfg_dbprefix,$query);

  506.             if ($cfg_dbtype == 'sqlite') {

  507.                 $query = preg_replace('/character set (.*?) /i','',$query);

  508.                 $query = preg_replace('/unsigned/i','',$query);

  509.                 $query = str_replace('TYPE=MyISAM','',$query);

  510.                 $query = preg_replace ('/TINYINT\(([\d]+)\)/i','INTEGER',$query);

  511.                 $query = preg_replace ('/mediumint\(([\d]+)\)/i','INTEGER',$query);

  512.                 $query = preg_replace ('/smallint\(([\d]+)\)/i','INTEGER',$query);

  513.                 $query = preg_replace('/int\(([\d]+)\)/i','INTEGER',$query);

  514.                 $query = preg_replace('/auto_increment/i','PRIMARY KEY AUTOINCREMENT',$query);

  515.                 $query = preg_replace('/,([\t\s ]+)KEY(.*?)MyISAM;/','',$query);

  516.                 $query = preg_replace('/,([\t\s ]+)KEY(.*?);/',');',$query);

  517.                 $query = preg_replace('/,([\t\s ]+)UNIQUE KEY(.*?);/',');',$query);

  518.                 $query = preg_replace('/set\(([^\)]*?)\)/','varchar',$query);

  519.                 $query = preg_replace('/enum\(([^\)]*?)\)/','varchar',$query);

  520.                 if (preg_match("/PRIMARY KEY AUTOINCREMENT/",$query)) {

  521.                     $query = preg_replace('/,([\t\s ]+)PRIMARY KEY([\t\s ]+)\(`([0-9a-zA-Z]+)`\)/i','',$query);

  522.                 }

  523.                 $sqls[] = $query;

  524.             } else {

  525.                 if (preg_match('#CREATE#i', $query)) {

  526.                     $sqls[] = preg_replace("#TYPE=MyISAM#i",$sql4tmp,$query);

  527.                 } else {

  528.                     $sqls[] = $query;

  529.                 }

  530.             }

  531.             $query='';

  532.         } else if (!preg_match("#^(\/\/|--)#", $line)) {

  533.             $query .= $line;

  534.         }

  535.     }

  536.     if (count($sqls) > 0) {

  537.         $result[$current_ver] = $sqls;

  538.     }

  539.     fclose($fp);

  540.     return $result;

  541. }

  542. /*会员中心调用主题模板<?php obtaintheme('head.htm');?>*/

  543. if (!function_exists('obtaintheme')) {

  544.     require_once DEDEINC."/archive/partview.class.php";

  545.     function obtaintheme($path)

  546.     {

  547.         global $cfg_basedir, $cfg_templets_dir, $cfg_df_style;

  548.         $tmpfile = $cfg_basedir.$cfg_templets_dir.'/'.$cfg_df_style.'/'.$path;

  549.         $dtp = new PartView();

  550.         $dtp->SetTemplet($tmpfile);

  551.         $dtp->Display();

  552.     }

  553. }

  554. //标签调用[field:id function='obtaintags(@me,3)'/]3表示调用文档3个标签

  555. if (!function_exists('obtaintags')) {

  556.     function obtaintags($aid, $num = 3)

  557.     {

  558.         global $dsql, $cfg_cmspath;

  559.         $tags = '';

  560.         $query = "SELECT * FROM `#@__taglist` WHERE aid='$aid' LIMIT $num";

  561.         $dsql->Execute('tag',$query);

  562.         while($row = $dsql->GetArray('tag')) {

  563.             $link = $cfg_cmspath."/apps/tags.php?/{$row['tid']}";

  564.             $tags .= ($tags==''?"<a href='{$link}'>{$row['tag']}</a>" : "<a href='{$link}'>{$row['tag']}</a>");

  565.         }

  566.         return $tags;

  567.     }

  568. }

  569. //提取文档多图片[field:body function='obtainimgs(@me,3)'/]3表示调用文档3张图片，则附加字段需添加body字段调用

  570. if (!function_exists('obtainimgs')) {

  571.     function obtainimgs($string, $num)

  572.     {

  573.         preg_match_all("/<img([^>]*)\s*src=('|\")([^'\"]+)('|\")/", $string, $matches);

  574.         $imgsrc_arr = array_unique($matches[3]);

  575.         $i = 0;

  576.         $result = "";

  577.         foreach($imgsrc_arr as $imgsrc)

  578.         {

  579.             if ($i == $num) break;

  580.             $result .= "<img src=\"$imgsrc\">";

  581.             $i++;

  582.         }

  583.         return $result;

  584.     }

  585. }

  586. //联动单筛选{dede:php}obtainfilter(模型id,类型,'字段1,字段2');{/dede:php}类型表示前台展现方式对应case值

  587. function obtainfilter($channelid, $type = 1, $fieldsnamef = '', $defaulttid = 0, $toptid = 0, $loadtype = 'autofield')

  588. {

  589.     global $tid, $dsql, $id, $aid;

  590.     $tid = $defaulttid ? $defaulttid : $tid;

  591.     if ($id!="" || $aid!="") {

  592.         $arcid = $id!="" ? $id : $aid;

  593.         $tidsq = $dsql->GetOne("SELECT * FROM `#@__archives` WHERE id='$arcid'");

  594.         $tid = $toptid==0 ? $tidsq["typeid"] : $tidsq["topid"];

  595.     }

  596.     $nofilter = (isset($_REQUEST['TotalResult']) ? "&TotalResult=".$_REQUEST['TotalResult'] : '').(isset($_REQUEST['PageNo']) ? "&PageNo=".$_REQUEST['PageNo'] : '');

  597.     $filterarr = string_filter(stripos($_SERVER['REQUEST_URI'], "list.php?tid=") ? str_replace($nofilter, '', $_SERVER['REQUEST_URI']) : $GLOBALS['cfg_cmsurl']."/apps/list.php?tid=".$tid);

  598.     $cInfos = $dsql->GetOne("SELECT * FROM  `#@__channeltype` WHERE id='$channelid'");

  599.     $fieldset=$cInfos['fieldset'];

  600.     $dtp = new DedeTagParse();

  601.     $dtp->SetNameSpace('field', '<', '>');

  602.     $dtp->LoadSource($fieldset);

  603.     $biz_addonfields = '';

  604.     if (is_array($dtp->CTags)) {

  605.         foreach($dtp->CTags as $tida=>$ctag)

  606.         {

  607.             $fieldsname = $fieldsnamef ? explode(",", $fieldsnamef) : explode(",", $ctag->GetName());

  608.             if (($loadtype!='autofield' || ($loadtype=='autofield' && $ctag->GetAtt('autofield')==1)) && in_array($ctag->GetName(), $fieldsname)) {

  609.                 $href1 = explode($ctag->GetName().'=', $filterarr);

  610.                 $href2 = explode('&', $href1[1]);

  611.                 $fields_value = $href2[0];

  612.                 switch ($type) {

  613.                     case 1:

  614.                         $biz_addonfields .= '<div class="mb-3">';

  615.                         $biz_addonfields .= (preg_match("/&".$ctag->GetName()."=/is",$filterarr,$regm) ? '<a href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'" class="btn btn-outline-success btn-sm">全部</a>' : '<a href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'" class="btn btn-success btn-sm">全部</a>');

  616.                         $addonfields_items = explode(",",$ctag->GetAtt('default'));

  617.                         for ($i=0; $i<count($addonfields_items); $i++)

  618.                         {

  619.                             $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);

  620.                             $biz_addonfields .= ($fields_value!=urlencode($addonfields_items[$i]) ? '<a title="'.$addonfields_items[$i].'" href="'.$href.'" class="btn btn-outline-success btn-sm">'.$addonfields_items[$i].'</a>' : '<a href="'.$href.'" class="btn btn-success btn-sm">'.$addonfields_items[$i].'</a>');

  621.                         }

  622.                         $biz_addonfields .= '</div>';

  623.                     break;

  624.                     case 2:

  625.                         $biz_addonfields .= '<select name="filter'.$ctag->GetName().'" onchange="window.location=this.options[this.selectedIndex].value" class="form-control w-25 mr-3">

  626.                             '.'<option value="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'">全部</option>';

  627.                         $addonfields_items = explode(",",$ctag->GetAtt('default'));

  628.                         for ($i=0; $i<count($addonfields_items); $i++)

  629.                         {

  630.                             $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);

  631.                             $biz_addonfields .= '<option value="'.$href.'"'.($fields_value==urlencode($addonfields_items[$i]) ? ' selected="selected"' : '').'>'.$addonfields_items[$i].'</option>

  632.                             ';

  633.                         }

  634.                         $biz_addonfields .= '</select>';

  635.                     break;

  636.                     case 3:

  637.                         $biz_addonfields .= '<div class="mb-3">';

  638.                         $biz_addonfields .= (preg_match("/&".$ctag->GetName()."=/is",$filterarr,$regm) ? '<a href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'"><input type="radio" name="filter'.$ctag->GetName().'" value="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'" onclick="window.location=this.value">全部</a>' : '<span><input type="radio" name="filter'.$ctag->GetName().'" checked="checked">全部</span>');

  639.                         $addonfields_items = explode(",",$ctag->GetAtt('default'));

  640.                         for ($i=0; $i<count($addonfields_items); $i++)

  641.                         {

  642.                             $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);

  643.                             $biz_addonfields .= ($fields_value!=urlencode($addonfields_items[$i]) ? '<a title="'.$addonfields_items[$i].'" href="'.$href.'"><input type="radio" name="filter'.$ctag->GetName().'" value="'.$href.'" onclick="window.location=this.value">'.$addonfields_items[$i].'</a>' : '<span><input type="radio" name="filter'.$ctag->GetName().'" checked="checked">'.$addonfields_items[$i].'</span>');

  644.                         }

  645.                         $biz_addonfields .= '</div>';

  646.                     break;

  647.                 }

  648.             }

  649.         }

  650.     }

  651.     echo $biz_addonfields;

  652. }

  653. //联动单筛选获取附加表

  654. function litimgurls($imgid = 0)

  655. {

  656.     global  $dsql, $lit_imglist;

  657.     $row = $dsql->GetOne("SELECT c.addtable FROM `#@__archives` AS a LEFT JOIN `#@__channeltype` AS c ON a.channel=c.id WHERE a.id='$imgid'");

  658.     $addtable = trim($row['addtable']);

  659.     $row = $dsql->GetOne("SELECT imgurls FROM `$addtable` WHERE aid='$imgid'");

  660.     $ChannelUnit = new ChannelUnit(2, $imgid);

  661.     $lit_imglist = $ChannelUnit->GetlitImgLinks($row['imgurls']);

  662.     return $lit_imglist;

  663. }

  664. //联动单筛选字符过滤函数

  665. function string_filter($str, $stype = "inject")

  666. {

  667.     if ($stype == "inject") {

  668.         $str = str_replace(

  669.             array("select", "insert", "update", "delete", "alter", "cas", "union", "into", "load_file", "outfile", "create", "join", "where", "like", "drop", "modify", "rename", "'", "/*", "*", "../", "./"),

  670.             array("", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""),

  671.             $str

  672.         );

  673.     } else if ($stype == "xss") {

  674.         $farr = array("/\s+/", "/<(\/?)(script|META|STYLE|HTML|HEAD|BODY|STYLE |i?frame|b|strong|style|html|img|P|o:p|iframe|u|em|strike|BR|div|a|TABLE|TBODY|object|tr|td|st1:chsdate|FONT|span|MARQUEE|body|title|\r\n|link|meta|\?|\%)([^>]*?)>/isU", "/(<[^>]*)on[a-zA-Z]+\s*=([^>]*>)/isU",);

  675.         $tarr = array(" ", "", "\\1\\2",);

  676.         $str = preg_replace($farr, $tarr, $str);

  677.         $str = str_replace(

  678.             array("<", ">", "'", "\"", ";", "/*", "*", "../", "./"),

  679.             array("&lt;", "&gt;", "", "", "", "", "", "", ""),

  680.             $str

  681.         );

  682.     }

  683.     return $str;

  684. }

  685. /**

  686.  * GetMimeTypeOrExtension

  687.  *

  688.  * @param  mixed $str 字符串

  689.  * @param  mixed $t 类型，0获取mime type，1获取扩展名

  690.  * @return string

  691.  */

  692. function GetMimeTypeOrExtension($str, $t = 0) {

  693.     $mime_types = array(

  694.         'aac' => 'audio/aac',

  695.         'abw' => 'application/x-abiword',

  696.         'arc' => 'application/x-freearc',

  697.         'avi' => 'video/x-msvideo',

  698.         'azw' => 'application/vnd.amazon.ebook',

  699.         'bin' => 'application/octet-stream',

  700.         'bmp' => 'image/bmp',

  701.         'bz' => 'application/x-bzip',

  702.         'bz2' => 'application/x-bzip2',

  703.         'csh' => 'application/x-csh',

  704.         'css' => 'text/css',

  705.         'csv' => 'text/csv',

  706.         'doc' => 'application/msword',

  707.         'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',

  708.         'eot' => 'application/vnd.ms-fontobject',

  709.         'epub' => 'application/epub+zip',

  710.         'gif' => 'image/gif',

  711.         'htm' => 'text/html',

  712.         'html' => 'text/html',

  713.         'ico' => 'image/vnd.microsoft.icon',

  714.         'ics' => 'text/calendar',

  715.         'jar' => 'application/java-archive',

  716.         'jpeg' => 'image/jpeg',

  717.         'jpg' => 'image/jpeg',

  718.         'js' => 'text/javascript',

  719.         'json' => 'application/json',

  720.         'jsonld' => 'application/ld+json',

  721.         'mid' => 'audio/midi',

  722.         'midi' => 'audio/midi',

  723.         'mjs' => 'text/javascript',

  724.         'mp3' => 'audio/mpeg',

  725.         'mp4' => 'video/mp4',

  726.         'mpeg' => 'video/mpeg',

  727.         'mpkg' => 'application/vnd.apple.installer+xml',

  728.         'odp' => 'application/vnd.oasis.opendocument.presentation',

  729.         'ods' => 'application/vnd.oasis.opendocument.spreadsheet',

  730.         'odt' => 'application/vnd.oasis.opendocument.text',

  731.         'oga' => 'audio/ogg',

  732.         'ogv' => 'video/ogg',

  733.         'ogx' => 'application/ogg',

  734.         'otf' => 'font/otf',

  735.         'png' => 'image/png',

  736.         'pdf' => 'application/pdf',

  737.         'ppt' => 'application/vnd.ms-powerpoint',

  738.         'pptx' => 'application/vnd.openxmlformats-officedocument.presentationml.presentation',

  739.         'rar' => 'application/x-rar-compressed',

  740.         'rtf' => 'application/rtf',

  741.         'sh' => 'application/x-sh',

  742.         'svg' => 'image/svg+xml',

  743.         'swf' => 'application/x-shockwave-flash',

  744.         'tar' => 'application/x-tar',

  745.         'tif' => 'image/tiff',

  746.         'tiff' => 'image/tiff',

  747.         'ttf' => 'font/ttf',

  748.         'txt' => 'text/plain',

  749.         'vsd' => 'application/vnd.visio',

  750.         'wav' => 'audio/wav',

  751.         'weba' => 'audio/webm',

  752.         'webm' => 'video/webm',

  753.         'webp' => 'image/webp',

  754.         'woff' => 'font/woff',

  755.         'woff2' => 'font/woff2',

  756.         'xhtml' => 'application/xhtml+xml',

  757.         'xls' => 'application/vnd.ms-excel',

  758.         'xlsx' => 'application/vnd.ms-excel',

  759.         'xml' => 'application/xml',

  760.         'xul' => 'application/vnd.mozilla.xul+xml',

  761.         'zip' => 'application/zip',

  762.         '3gp' => 'video/3gpp',

  763.         '3g2' => 'video/3gpp2',

  764.         '7z' => 'application/x-7z-compressed',

  765.         'wmv' => 'video/x-ms-asf',

  766.         'wma' => 'audio/x-ms-wma',

  767.         'mov' => 'video/quicktime',

  768.         'rm' => 'application/vnd.rn-realmedia',

  769.         'mpg' => 'video/mpeg',

  770.         'mpga' => 'audio/mpeg',

  771.     );

  772.     if ($t===0) {

  773.         return isset($mime_types[$str])? $mime_types[$str] : 'application/octet-stream';

  774.     } else {

  775.         foreach ($mime_types  as $key => $value) {

  776.             if ($value == $str) return $key;

  777.         }

  778.         return "dedebiz";

  779.     }

  780. }

  781. //自定义函数接口

  782. if (file_exists(DEDEINC.'/extend.func.php')) {

  783.     require_once(DEDEINC.'/extend.func.php');

  784. }

  785. ?>