DedeBIZ
/
DedeV6
Watch 2
Star 0
Fork 0
Code Pull Requests 0 Releases 25 Activity
国内流行的内容管理系统（CMS）多端全媒体解决方案 https://www.dedebiz.com
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1653 Commits
3 Branches
110MB
Tree: 9ab4780a5d
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '9ab4780a5d'
${ noResults }
DedeV6/src/system/common.func.php

650 lines
27KB
Raw Blame History 

  1. <?php

  2. if (!defined('DEDEINC')) exit('dedebiz');

  3. /**

  4.  * 系统核心函数存放文件

  5.  * 

  6.  * @version        $id:common.func.php 4 16:39 2010年7月6日 tianya $

  7.  * @package        DedeBIZ.Libraries

  8.  * @copyright      Copyright (c) 2022 DedeBIZ.COM

  9.  * @license        https://www.dedebiz.com/license

  10.  * @link           https://www.dedebiz.com

  11.  */

  12. //类似Bootstrap警告框

  13. define('ALERT_PRIMARY', 1);

  14. define('ALERT_SECONDARY', 2);

  15. define('ALERT_SUCCESS', 3);

  16. define('ALERT_DANGER', 4);

  17. define('ALERT_WARNING', 5);

  18. define('ALERT_INFO', 6);

  19. define('ALERT_LIGHT', 7);

  20. define('ALERT_DARK', 8);

  21. define('ALERT_COLORS', array(

  22.     ALERT_PRIMARY => array('#cfe2ff','#b6d4fe','#084298'),

  23.     ALERT_SECONDARY => array('#e2e3e5','#d3d6d8','#41464b'),

  24.     ALERT_SUCCESS => array('#d1e7dd','#badbcc','#0f5132'),

  25.     ALERT_DANGER => array('#f8d7da','#f5c2c7','#842029'),

  26.     ALERT_WARNING => array('#fff3cd','#ffecb5','#664d03'),

  27.     ALERT_INFO => array('#cff4fc','#b6effb','#055160'),

  28.     ALERT_LIGHT => array('#fefefe','#fdfdfe','#636464'),

  29.     ALERT_DARK => array('#d3d3d4','#bcbebf','#141619'),

  30. ));

  31. define("ALERT_TPL", '<div style="position:relative;padding:.75rem 1.25rem;margin-bottom:1rem;width:auto;font-size:12px;color:~color~;background:~background~;border-color:~border~;border:1px solid transparent;border-radius:.5rem">~content~</div>');

  32. //$content:文档，$type:alert类型

  33. function DedeAlert($content, $type = ALERT_PRIMARY, $isHTML=false)

  34. {

  35.     $content =  $isHTML? RemoveXSS($content) : htmlspecialchars($content);

  36.     $colors = isset(ALERT_COLORS[$type])? ALERT_COLORS[$type] : ALERT_COLORS[ALERT_PRIMARY];

  37.     list($background, $border, $color) = $colors;

  38.     return str_replace(array('~color~','~background~','~border~', '~content~'),array($color,$background,$border,$content),ALERT_TPL);

  39. }

  40. if (version_compare(PHP_VERSION, '7.0.0', '>=')) {

  41.     if (!function_exists('mysql_connect') and function_exists('mysqli_connect')) {

  42.         function mysql_connect($server, $username, $password)

  43.         {

  44.             return mysqli_connect($server, $username, $password);

  45.         }

  46.     }

  47.     if (!function_exists('mysql_query') and function_exists('mysqli_query')) {

  48.         function mysql_query($query, $link)

  49.         {

  50.             return mysqli_query($link, $query);

  51.         }

  52.     }

  53.     if (!function_exists('mysql_select_db') and function_exists('mysqli_select_db')) {

  54.         function mysql_select_db($database_name, $link)

  55.         {

  56.             return mysqli_select_db($link, $database_name);

  57.         }

  58.     }

  59.     if (!function_exists('mysql_fetch_array') and function_exists('mysqli_fetch_array')) {

  60.         function mysql_fetch_array($result)

  61.         {

  62.             return mysqli_fetch_array($result);

  63.         }

  64.     }

  65.     if (!function_exists('mysql_close') and function_exists('mysqli_close')) {

  66.         function mysql_close($link)

  67.         {

  68.             return mysqli_close($link);

  69.         }

  70.     }

  71.     if (!function_exists('mysql_free_result') and function_exists('mysqli_free_result')) {

  72.         function mysql_free_result($result)

  73.         {

  74.             return mysqli_free_result($result);

  75.         }

  76.     }

  77.     if (!function_exists('split')) {

  78.         function split($pattern, $string)

  79.         {

  80.             return explode($pattern, $string);

  81.         }

  82.     }

  83. }

  84. //一个支持在PHP Cli Server打印的方法

  85. function var_dump_cli($val,...$values)

  86. {

  87.     ob_start();

  88.     var_dump($val,$values);

  89.     error_log(ob_get_clean(), 4);

  90. }

  91. function get_mime_type($filename)

  92. {

  93.     if (!function_exists('finfo_open')) {

  94.         return 'unknow/octet-stream';

  95.     }

  96.     $finfo = finfo_open(FILEINFO_MIME_TYPE);

  97.     $mimeType = finfo_file($finfo, $filename);

  98.     finfo_close($finfo);

  99.     return $mimeType;

  100. }

  101. function is_all_numeric(array $array)

  102. {

  103.     foreach ($array as $item) {

  104.         if (!is_numeric($item)) return false;

  105.     }

  106.     return true;

  107. }

  108. function make_hash()

  109. {

  110.     $rand = dede_random_bytes(16);

  111.     $_SESSION['token'] = ($rand === FALSE) ? md5(uniqid(mt_rand(), TRUE)) : bin2hex($rand);

  112.     return $_SESSION['token'];

  113. }

  114. function dede_random_bytes($length)

  115. {

  116.     if (empty($length) or !ctype_digit((string) $length)) {

  117.         return FALSE;

  118.     }

  119.     if (function_exists('openssl_random_pseudo_bytes')) {

  120.         return openssl_random_pseudo_bytes($length);

  121.     }

  122.     if (function_exists('random_bytes')) {

  123.         try {

  124.             return random_bytes((int) $length);

  125.         } catch (Exception $e) {

  126.             return FALSE;

  127.         }

  128.     }

  129.     if (is_readable('/dev/urandom') && ($fp = fopen('/dev/urandom', 'rb')) !== FALSE) {

  130.         version_compare(PHP_VERSION, '5.4.0', '>=') && stream_set_chunk_size($fp, $length);

  131.         $output = fread($fp, $length);

  132.         fclose($fp);

  133.         if ($output !== FALSE) {

  134.             return $output;

  135.         }

  136.     }

  137.     return FALSE;

  138. }

  139. //SQL语句过滤程序，由80sec提供，这里作了适当的修改

  140. if (!function_exists('CheckSql')) {

  141.     function CheckSql($db_string, $querytype = 'select')

  142.     {

  143.         global $cfg_cookie_encode;

  144.         $clean = '';

  145.         $error = '';

  146.         $old_pos = 0;

  147.         $pos = -1;

  148.         $enkey = substr(md5(substr($cfg_cookie_encode.'dedebiz', 0, 5)), 0, 10);

  149.         $log_file = DEDEDATA.'/checksql_'.$enkey.'_safe.txt';

  150.         $userIP = GetIP();

  151.         $getUrl = GetCurUrl();

  152.         //如果是普通查询语句，直接过滤一些特殊语法

  153.         if ($querytype == 'select') {

  154.             $notallow1 = "[^0-9a-z@\._-]{1,}(union|sleep|benchmark|load_file|outfile)[^0-9a-z@\.-]{1,}";

  155.             if (preg_match("/".$notallow1."/i", $db_string)) {

  156.                 fputs(fopen($log_file, 'a+'), "$userIP||$getUrl||$db_string||SelectBreak\r\n");

  157.                 exit("<span>Safe Alert: Request Error step 1 !</span>");

  158.             }

  159.         }

  160.         //完整的SQL检查

  161.         while (TRUE) {

  162.             $pos = strpos($db_string, '\'', $pos + 1);

  163.             if ($pos === FALSE) {

  164.                 break;

  165.             }

  166.             $clean .= substr($db_string, $old_pos, $pos - $old_pos);

  167.             while (TRUE) {

  168.                 $pos1 = strpos($db_string, '\'', $pos + 1);

  169.                 $pos2 = strpos($db_string, '\\', $pos + 1);

  170.                 if ($pos1 === FALSE) {

  171.                     break;

  172.                 } elseif ($pos2 == FALSE || $pos2 > $pos1) {

  173.                     $pos = $pos1;

  174.                     break;

  175.                 }

  176.                 $pos = $pos2 + 1;

  177.             }

  178.             $clean .= '$s$';

  179.             $old_pos = $pos + 1;

  180.         }

  181.         $clean .= substr($db_string, $old_pos);

  182.         $clean = trim(strtolower(preg_replace(array('~\s+~s'), array(' '), $clean)));

  183.         if (

  184.             strpos($clean, '@') !== FALSE  or strpos($clean, 'char(') !== FALSE or strpos($clean, '"') !== FALSE

  185.             or strpos($clean, '$s$$s$') !== FALSE

  186.         ) {

  187.             $fail = TRUE;

  188.             if (preg_match("#^create table#i", $clean)) $fail = FALSE;

  189.             $error = "unusual character";

  190.         }

  191.         //老版本数据库不支持union，程序不使用union，但黑客使用它，所以检查它

  192.         if (strpos($clean, 'union') !== FALSE && preg_match('~(^|[^a-z])union($|[^[a-z])~s', $clean) != 0) {

  193.             $fail = TRUE;

  194.             $error = "union detect";

  195.         }

  196.         //发布版本的程序可能比较少包括--,#这样的注释，但黑客经常使用它们

  197.         elseif (strpos($clean, '/*') > 2 || strpos($clean, '--') !== FALSE || strpos($clean, '#') !== FALSE) {

  198.             $fail = TRUE;

  199.             $error = "comment detect";

  200.         }

  201.         //这些函数不会被使用，但是黑客会用它来操作文件，down掉数据库

  202.         elseif (strpos($clean, 'sleep') !== FALSE && preg_match('~(^|[^a-z])sleep($|[^[a-z])~s', $clean) != 0) {

  203.             $fail = TRUE;

  204.             $error = "slown down detect";

  205.         } elseif (strpos($clean, 'benchmark') !== FALSE && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~s', $clean) != 0) {

  206.             $fail = TRUE;

  207.             $error = "slown down detect";

  208.         } elseif (strpos($clean, 'load_file') !== FALSE && preg_match('~(^|[^a-z])load_file($|[^[a-z])~s', $clean) != 0) {

  209.             $fail = TRUE;

  210.             $error = "file fun detect";

  211.         } elseif (strpos($clean, 'into outfile') !== FALSE && preg_match('~(^|[^a-z])into\s+outfile($|[^[a-z])~s', $clean) != 0) {

  212.             $fail = TRUE;

  213.             $error = "file fun detect";

  214.         }

  215.         //老版本数据库不支持子查询，该功能也用得少，但黑客可以使用它来查询数据库敏感信息

  216.         elseif (preg_match('~\([^)]*?select~s', $clean) != 0) {

  217.             $fail = TRUE;

  218.             $error = "sub select detect";

  219.         }

  220.         if (!empty($fail)) {

  221.             fputs(fopen($log_file, 'a+'), "$userIP||$getUrl||$db_string||$error\r\n");

  222.             exit("<span>Safe Alert: Request Error step 2!</span>");

  223.         } else {

  224.             return $db_string;

  225.         }

  226.     }

  227. }

  228. /**

  229.  *  载入小助手，系统默认载入小助手示例：

  230.  *  <code>

  231.  *  if (!function_exists('HelloDede'))

  232.  *  {

  233.  *      function HelloDede()

  234.  *      {

  235.  *          echo "Hello! Dede";

  236.  *      }

  237.  *  }

  238.  *  </code>

  239.  *  开发中使用这个小助手的时候直接使用函数helper('test');初始化它，然后在文件中就可以直接使用:HelloDede();调用

  240.  *

  241.  * @access    public

  242.  * @param     mix   $helpers  小助手名称，可以是数组，可以是单个字符串

  243.  * @return    void

  244.  */

  245. $_helpers = array();

  246. function helper($helpers)

  247. {

  248.     //如果是数组，则进行递归操作

  249.     if (is_array($helpers)) {

  250.         foreach ($helpers as $dede) {

  251.             helper($dede);

  252.         }

  253.         return;

  254.     }

  255.     if (isset($_helpers[$helpers])) {

  256.         return;

  257.     }

  258.     if (file_exists(DEDEINC.'/helpers/'.$helpers.'.helper.php')) {

  259.         include_once(DEDEINC.'/helpers/'.$helpers.'.helper.php');

  260.         $_helpers[$helpers] = TRUE;

  261.     }

  262.     //无法载入小助手

  263.     if (!isset($_helpers[$helpers])) {

  264.         exit('Unable to load the requested file: helpers/'.$helpers.'.helper.php');

  265.     }

  266. }

  267. function dede_htmlspecialchars($str)

  268. {

  269.     global $cfg_soft_lang;

  270.     if (version_compare(PHP_VERSION, '5.4.0', '<')) return htmlspecialchars($str);

  271.     if ($cfg_soft_lang == 'gb2312') return htmlspecialchars($str, ENT_COMPAT, 'ISO-8859-1');

  272.     else return htmlspecialchars($str);

  273. }

  274. /**

  275.  *  载入小助手，这里会员可能载入用helps载入多个小助手

  276.  *

  277.  * @access    public

  278.  * @param     string

  279.  * @return    string

  280.  */

  281. function helpers($helpers)

  282. {

  283.     helper($helpers);

  284. }

  285. //兼容php4的file_put_contents

  286. if (!function_exists('file_put_contents')) {

  287.     function file_put_contents($n, $d)

  288.     {

  289.         $f = @fopen($n, "w");

  290.         if (!$f) {

  291.             return FALSE;

  292.         } else {

  293.             fwrite($f, $d);

  294.             fclose($f);

  295.             return TRUE;

  296.         }

  297.     }

  298. }

  299. /**

  300.  *  显示更新信息

  301.  *

  302.  * @return    void

  303.  */

  304. function UpdateStat()

  305. {

  306.     include_once(DEDEINC."/inc/inc_stat.php");

  307.     return SpUpdateStat();

  308. }

  309. $arrs1 = array();

  310. $arrs2 = array();

  311. /**

  312.  *  短消息函数，可以在某个动作处理后友好的系统提示

  313.  *

  314.  * @param     string  $msg       消息系统提示

  315.  * @param     string  $gourl     跳转地址

  316.  * @param     int     $onlymsg   仅显示信息

  317.  * @param     int     $limittime 限制时间

  318.  * @return    void

  319.  */

  320. function ShowMsg($msg, $gourl, $onlymsg = 0, $limittime = 0)

  321. {

  322.     if (isset($GLOBALS['format']) && strtolower($GLOBALS['format'])==='json') {

  323.         echo json_encode(array(

  324.             "code"=>0,

  325.             "msg"=>$msg,

  326.             "gourl"=>$gourl,

  327.         ));

  328.         return;

  329.     }

  330.     if (empty($GLOBALS['cfg_plus_dir'])) $GLOBALS['cfg_plus_dir'] = '..';

  331.     $htmlhead  = "<!DOCTYPE html><html><head><meta charset='utf-8'><meta http-equiv='X-UA-Compatible' content='IE=Edge,chrome=1'><title>系统提示</title><base target='_self'></head><body><script>";

  332.     $htmlfoot  = "</script></body></html>";

  333.     $litime = ($limittime == 0 ? 1000 : $limittime);

  334.     $func = '';

  335.     if ($gourl == '-1') {

  336.         if ($limittime == 0) $litime = 5000;

  337.         $gourl = "javascript:history.go(-1);";

  338.     }

  339.     if ($gourl == '' || $onlymsg == 1) {

  340.         $msg = "<script>alert(\"".str_replace("\"", "“", $msg)."\");</script>";

  341.     } else {

  342.         //当网址为:close::objname时，关闭父框架的id=objname元素

  343.         if (preg_match('/close::/', $gourl)) {

  344.             $tgobj = trim(preg_replace('/close::/', '', $gourl));

  345.             $gourl = 'javascript:;';

  346.             $func .= "window.parent.document.getElementById('{$tgobj}').style.display='none';\r\n";

  347.         }

  348.         $func .= "var pgo=0;function JumpUrl(){if (pgo==0){location='$gourl'; pgo=1;}}";

  349.         $rmsg = $func;

  350.         $rmsg .= "document.write(\"<style>body{margin:0;line-height:1.6;letter-spacing:.6px;font:14px Helvetica Neue,Helvetica,PingFang SC,Tahoma,Arial,sans-serif;color:#545b62;background:#f5f5f5}a{color:#1eb867;text-decoration:none}.tips-box{margin:70px auto 0;width:500px;height:auto;background:#fff;border-radius:.5rem;box-shadow:0 .125rem .25rem rgba(0,0,0,.075)}.tips-head{margin:0 20px;padding:18px 0;border-bottom:1px solid #f5f5f5}.tips-head p{margin:0;padding-left:10px;line-height:16px;text-align:left;border-left:3px solid #dc3545}.tips-body{padding:20px;min-height:130px;color:#545b62}.btn{margin-top:20px;text-align:center}.btn a{display:inline-block;padding:.375rem .75rem;font-size:12px;color:#fff;background:#1eb867;border-radius:.5rem;text-align:center;transition:all .3s}.btn a:focus{background:#006829;border-color:#005b24;box-shadow:0 0 0 0.2rem rgba(72,180,97,.5)}.text-primary{color:#007bff}@media (max-width:768px){.tips{padding:0 15px}.tips,.tips-box{width:100%}}</style>\");";

  351.         $rmsg .= "document.write(\"<div class='tips'><div class='tips-box'><div class='tips-head'><p>系统提示</p></div>\");";

  352.         $rmsg .= "document.write(\"<div class='tips-body'>\");";

  353.         $rmsg .= "document.write(\"".str_replace("\"", "“", $msg)."\");";

  354.         $rmsg .= "document.write(\"";

  355.         if ($onlymsg == 0) {

  356.             if ($gourl != 'javascript:;' && $gourl != '') {

  357.                 $rmsg .= "<div class='btn'><a href='{$gourl}'>点击反应</a></div>\");";

  358.                 $rmsg .= "setTimeout('JumpUrl()',$litime);";

  359.             } else {

  360.                 $rmsg .= "</div>\");";

  361.             }

  362.         } else {

  363.             $rmsg .= "</div></div>\");";

  364.         }

  365.         $msg  = $htmlhead.$rmsg.$htmlfoot;

  366.     }

  367.     echo $msg;

  368. }

  369. /**

  370.  * 表中是否存在某个字段

  371.  *

  372.  * @param  mixed $tablename 表名称

  373.  * @param  mixed $field 字段名

  374.  * @return void

  375.  */

  376. function TableHasField($tablename,$field)

  377. {

  378.     global $dsql;

  379.     $dsql->GetTableFields($tablename,"tfd");

  380.     while ($r = $dsql->GetFieldObject("tfd")) {

  381.         if ($r->name === $field) {

  382.             return true;

  383.         }

  384.     }

  385.     return false;

  386. }

  387. function GetSimpleServerSoftware()

  388. {

  389.     if (preg_match("#^php#i",$_SERVER["SERVER_SOFTWARE"])) {

  390.         return 'PHP Server';

  391.     } else if (preg_match("#^apache#i",$_SERVER["SERVER_SOFTWARE"])){

  392.         return 'Apache';

  393.     } else if (preg_match("#^nginx#i",$_SERVER["SERVER_SOFTWARE"])){

  394.         return 'Nginx';

  395.     } else if (preg_match("#^microsoft-iis#i",$_SERVER["SERVER_SOFTWARE"])){

  396.         return 'IIS';

  397.     } else if (preg_match("#^caddy#i",$_SERVER["SERVER_SOFTWARE"])){

  398.         return 'Caddy';

  399.     } else {

  400.         return 'Other';

  401.     }

  402. }

  403. /**

  404.  *  获取验证码的session值

  405.  *

  406.  * @return    string

  407.  */

  408. function GetCkVdValue()

  409. {

  410.     @session_id($_COOKIE['PHPSESSID']);

  411.     @session_start();

  412.     return isset($_SESSION['securimage_code_value']) ? $_SESSION['securimage_code_value'] : '';

  413. }

  414. /**

  415.  *  PHP某些版本有Bug，不能在同一作用域中同时读session并改注销它，因此调用后需执行本函数

  416.  *

  417.  * @return    void

  418.  */

  419. function ResetVdValue()

  420. {

  421.     @session_start();

  422.     $_SESSION['securimage_code_value'] = '';

  423. }

  424. function IndexSub($idx, $num)

  425. {

  426.     return intval($idx) - intval($num) == 0 ? '0 ' : intval($idx) - intval($num);

  427. }

  428. /**

  429.  * HideEmail隐藏邮箱

  430.  *

  431.  * @param  mixed $email

  432.  * @return string

  433.  */

  434. function HideEmail($email)

  435. {

  436.     if (empty($email)) return "暂无";

  437.     $em   = explode("@",$email);

  438.     $name = implode('@', array_slice($em, 0, count($em)-1));

  439.     $len  = floor(strlen($name)/2);

  440.     return substr($name,0, $len).str_repeat('*', $len)."@".end($em);   

  441. }

  442. //用来返回index的active

  443. function IndexActive($idx)

  444. {

  445.     if ($idx == 1) {

  446.         return ' active';

  447.     } else {

  448.         return '';

  449.     }

  450. }

  451. //是否是HTTPS

  452. function IsSSL()

  453. {

  454.     if (@$_SERVER['HTTPS'] && ('1' == $_SERVER['HTTPS'] || 'on' == strtolower($_SERVER['HTTPS']))) {

  455.         return true;

  456.     } elseif ('https' == @$_SERVER['REQUEST_SCHEME']) {

  457.         return true;

  458.     } elseif ('443' == $_SERVER['SERVER_PORT']) {

  459.         return true;

  460.     } elseif ('https' == @$_SERVER['HTTP_X_FORWARDED_PROTO']) {

  461.         return true;

  462.     }

  463.     return false;

  464. }

  465. //获取对应版本号的更新SQL

  466. function GetUpdateSQL()

  467. {

  468.     global $cfg_dbprefix, $cfg_dbtype, $cfg_db_language;

  469.     $result = array();

  470.     $query = '';

  471.     $sql4tmp = "ENGINE=MyISAM DEFAULT CHARSET=".$cfg_db_language;

  472.     $fp = fopen(DEDEROOT.'/install/update.txt','r');

  473.     $sqls = array();

  474.     $current_ver = "";

  475.     while(!feof($fp))

  476.     {

  477.         $line = rtrim(fgets($fp,1024));

  478.         if (preg_match("/\-\- ([\d\.]+)/",$line,$matches)) {

  479.             if (count($sqls) > 0) {

  480.                 $result[$current_ver] = $sqls;

  481.             }

  482.             $sqls = array();

  483.             $current_ver = $matches[1];

  484.         }

  485.         if (preg_match("#;$#", $line)) {

  486.             $query .= $line."\n";

  487.             $query = str_replace('#@__',$cfg_dbprefix,$query);

  488.             if ($cfg_dbtype == 'sqlite') {

  489.                 $query = preg_replace('/character set (.*?) /i','',$query);

  490.                 $query = preg_replace('/unsigned/i','',$query);

  491.                 $query = str_replace('TYPE=MyISAM','',$query);

  492.                 $query = preg_replace ('/TINYINT\(([\d]+)\)/i','INTEGER',$query);

  493.                 $query = preg_replace ('/mediumint\(([\d]+)\)/i','INTEGER',$query);

  494.                 $query = preg_replace ('/smallint\(([\d]+)\)/i','INTEGER',$query);

  495.                 $query = preg_replace('/int\(([\d]+)\)/i','INTEGER',$query);

  496.                 $query = preg_replace('/auto_increment/i','PRIMARY KEY AUTOINCREMENT',$query);

  497.                 $query = preg_replace('/,([\t\s ]+)KEY(.*?)MyISAM;/','',$query);

  498.                 $query = preg_replace('/,([\t\s ]+)KEY(.*?);/',');',$query);

  499.                 $query = preg_replace('/,([\t\s ]+)UNIQUE KEY(.*?);/',');',$query);

  500.                 $query = preg_replace('/set\(([^\)]*?)\)/','varchar',$query);

  501.                 $query = preg_replace('/enum\(([^\)]*?)\)/','varchar',$query);

  502.                 if (preg_match("/PRIMARY KEY AUTOINCREMENT/",$query)) {

  503.                     $query = preg_replace('/,([\t\s ]+)PRIMARY KEY([\t\s ]+)\(`([0-9a-zA-Z]+)`\)/i','',$query);

  504.                 }

  505.                 $sqls[] = $query;

  506.             } else {

  507.                 if (preg_match('#CREATE#i', $query)) {

  508.                     $sqls[] = preg_replace("#TYPE=MyISAM#i",$sql4tmp,$query);

  509.                 } else {

  510.                     $sqls[] = $query;

  511.                 }

  512.             }

  513.             $query='';

  514.         } else if (!preg_match("#^(\/\/|--)#", $line)) {

  515.             $query .= $line;

  516.         }

  517.     }

  518.     if (count($sqls) > 0) {

  519.         $result[$current_ver] = $sqls;

  520.     }

  521.     fclose($fp);

  522.     return $result;

  523. }

  524. /*会员中心调用默认主题模板<?php pasterTempletDiy('head.htm');?>*/

  525. if (!function_exists('pasterTempletDiy')) {

  526.     function pasterTempletDiy($path)

  527.     {

  528.         global $cfg_basedir, $cfg_templets_dir, $cfg_df_style;

  529.         $tmpfile = $cfg_basedir.$cfg_templets_dir.'/'.$cfg_df_style.'/'.$path;

  530.         $dtp = new PartView();

  531.         $dtp->SetTemplet($tmpfile);

  532.         $dtp->Display();

  533.     }

  534. }

  535. //标签调用标签[field:id function='GetMyTags(@me,2)'/]2表示调用文档2个标签

  536. if (!function_exists('GetMyTags')) {

  537.     function GetMyTags($aid, $num=3)

  538.     {

  539.         global $dsql, $cfg_cmspath;

  540.         $tags = '';

  541.         $query = "SELECT * FROM `#@__taglist` WHERE aid='$aid' LIMIT $num";

  542.         $dsql->Execute('tag',$query);

  543.         while($row = $dsql->GetArray('tag')) {

  544.             $link = $cfg_cmspath."/apps/tags.php?/{$row['tid']}";

  545.             $tags.= ($tags==''?"<a href='{$link}'>{$row['tag']}</a>" : "<a href='{$link}'>{$row['tag']}</a>");

  546.         }

  547.         return $tags;

  548.     }

  549. }

  550. //联动单筛选标签{dede:php}AddFilter(模型id,类型,'字段1,字段2');{/dede:php}类型对应以下case数值

  551. function litimgurls($imgid = 0)

  552. {

  553.     global $lit_imglist, $dsql;

  554.     $row = $dsql->GetOne("SELECT c.addtable FROM `#@__archives` AS a LEFT JOIN `#@__channeltype` AS c ON a.channel=c.id WHERE a.id='$imgid'");

  555.     $addtable = trim($row['addtable']);

  556.     $row = $dsql->GetOne("SELECT imgurls FROM `$addtable` WHERE aid='$imgid'");

  557.     $ChannelUnit = new ChannelUnit(2, $imgid);

  558.     $lit_imglist = $ChannelUnit->GetlitImgLinks($row['imgurls']);

  559.     return $lit_imglist;

  560. }

  561. //联动单筛选字符过滤函数

  562. function string_filter($str, $stype = "inject")

  563. {

  564.     if ($stype == "inject") {

  565.         $str = str_replace(

  566.             array("select", "insert", "update", "delete", "alter", "cas", "union", "into", "load_file", "outfile", "create", "join", "where", "like", "drop", "modify", "rename", "'", "/*", "*", "../", "./"),

  567.             array("", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""),

  568.             $str

  569.         );

  570.     } else if ($stype == "xss") {

  571.         $farr = array("/\s+/", "/<(\/?)(script|META|STYLE|HTML|HEAD|BODY|STYLE |i?frame|b|strong|style|html|img|P|o:p|iframe|u|em|strike|BR|div|a|TABLE|TBODY|object|tr|td|st1:chsdate|FONT|span|MARQUEE|body|title|\r\n|link|meta|\?|\%)([^>]*?)>/isU", "/(<[^>]*)on[a-zA-Z]+\s*=([^>]*>)/isU",);

  572.         $tarr = array(" ", "", "\\1\\2",);

  573.         $str = preg_replace($farr, $tarr, $str);

  574.         $str = str_replace(

  575.             array("<", ">", "'", "\"", ";", "/*", "*", "../", "./"),

  576.             array("&lt;", "&gt;", "", "", "", "", "", "", ""),

  577.             $str

  578.         );

  579.     }

  580.     return $str;

  581. }

  582. //联动单筛选发布三种类型

  583. function AddFilter($channelid, $type=1, $fieldsnamef='', $defaulttid=0, $toptid=0, $loadtype='autofield')

  584. {

  585.     global $tid, $dsql, $id, $aid;

  586.     $tid = $defaulttid ? $defaulttid : $tid;

  587.     if ($id!="" || $aid!="") {

  588.         $arcid = $id!="" ? $id : $aid;

  589.         $tidsq = $dsql->GetOne("SELECT * FROM `#@__archives` WHERE id='$arcid'");

  590.         $tid = $toptid==0 ? $tidsq["typeid"] : $tidsq["topid"];

  591.     }

  592.     $nofilter = (isset($_REQUEST['TotalResult']) ? "&TotalResult=".$_REQUEST['TotalResult'] : '').(isset($_REQUEST['PageNo']) ? "&PageNo=".$_REQUEST['PageNo'] : '');

  593.     $filterarr = string_filter(stripos($_SERVER['REQUEST_URI'], "list.php?tid=") ? str_replace($nofilter, '', $_SERVER['REQUEST_URI']) : $GLOBALS['cfg_cmsurl']."/apps/list.php?tid=".$tid);

  594.     $cInfos = $dsql->GetOne("SELECT * FROM  `#@__channeltype` WHERE id='$channelid'");

  595.     $fieldset=$cInfos['fieldset'];

  596.     $dtp = new DedeTagParse();

  597.     $dtp->SetNameSpace('field', '<', '>');

  598.     $dtp->LoadSource($fieldset);

  599.     $dede_addonfields = '';

  600.     if (is_array($dtp->CTags)) {

  601.         foreach($dtp->CTags as $tida=>$ctag)

  602.         {

  603.             $fieldsname = $fieldsnamef ? explode(",", $fieldsnamef) : explode(",", $ctag->GetName());

  604.             if (($loadtype!='autofield' || ($loadtype=='autofield' && $ctag->GetAtt('autofield')==1)) && in_array($ctag->GetName(), $fieldsname)) {

  605.                 $href1 = explode($ctag->GetName().'=', $filterarr);

  606.                 $href2 = explode('&', $href1[1]);

  607.                 $fields_value = $href2[0];

  608.                 switch ($type) {

  609.                     case 1:

  610.                         $dede_addonfields .= (preg_match("/&".$ctag->GetName()."=/is",$filterarr,$regm) ? '<a href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'" class="btn btn-outline-success btn-sm">全部</a>' : '<a href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'" class="btn btn-success btn-sm">全部</a>');

  611.                         $addonfields_items = explode(",",$ctag->GetAtt('default'));

  612.                         for ($i=0; $i<count($addonfields_items); $i++)

  613.                         {

  614.                             $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);

  615.                             $dede_addonfields .= ($fields_value!=urlencode($addonfields_items[$i]) ? '<a title="'.$addonfields_items[$i].'" href="'.$href.'" class="btn btn-outline-success btn-sm">'.$addonfields_items[$i].'</a>' : '<a href="'.$href.'" class="btn btn-success btn-sm">'.$addonfields_items[$i].'</a>');

  616.                         }

  617.                     break;

  618.                     case 2:

  619.                         $dede_addonfields .= '<select name="filter'.$ctag->GetName().'" onchange="window.location=this.options[this.selectedIndex].value">

  620.                             '.'<option value="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'">全部</option>';

  621.                         $addonfields_items = explode(",",$ctag->GetAtt('default'));

  622.                         for ($i=0; $i<count($addonfields_items); $i++)

  623.                         {

  624.                             $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);

  625.                             $dede_addonfields .= '<option value="'.$href.'"'.($fields_value==urlencode($addonfields_items[$i]) ? ' selected="selected"' : '').'>'.$addonfields_items[$i].'</option>

  626.                             ';

  627.                         }

  628.                         $dede_addonfields .= '</select>

  629.                         ';

  630.                     break;

  631.                     case 3:

  632.                         $dede_addonfields .= (preg_match("/&".$ctag->GetName()."=/is",$filterarr,$regm) ? '<a href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'"><input type="radio" name="filter'.$ctag->GetName().'" value="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'" onclick="window.location=this.value">全部</a>' : '<span><input type="radio" name="filter'.$ctag->GetName().'" checked="checked">全部</span>');

  633.                         $addonfields_items = explode(",",$ctag->GetAtt('default'));

  634.                         for ($i=0; $i<count($addonfields_items); $i++)

  635.                         {

  636.                             $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);

  637.                             $dede_addonfields .= ($fields_value!=urlencode($addonfields_items[$i]) ? '<a title="'.$addonfields_items[$i].'" href="'.$href.'"><input type="radio" name="filter'.$ctag->GetName().'" value="'.$href.'" onclick="window.location=this.value">'.$addonfields_items[$i].'</a>' : '<span><input type="radio" name="filter'.$ctag->GetName().'" checked="checked">'.$addonfields_items[$i].'</span>');

  638.                         }

  639.                     break;

  640.                 }

  641.             }

  642.         }

  643.     }

  644.     echo $dede_addonfields;

  645. }

  646. //自定义函数接口

  647. if (file_exists(DEDEINC.'/extend.func.php')) {

  648.     require_once(DEDEINC.'/extend.func.php');

  649. }

  650. ?>