DedeBIZ
/
DedeV6
Watch 2
Star 0
Fork 0
Code Pull Requests 0 Releases 25 Activity
国内流行的内容管理系统（CMS）多端全媒体解决方案 https://www.dedebiz.com
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1203 Commits
3 Branches
110MB
Tree: f2407fb514
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'f2407fb514'
${ noResults }
DedeV6/src/system/common.func.php

569 lines
24KB
Raw Blame History 

  1. <?php

  2. if (!defined('DEDEINC')) exit('dedebiz');

  3. //显示类似BS的提示信息

  4. define('ALERT_PRIMARY', 1);

  5. define('ALERT_SECONDARY', 2);

  6. define('ALERT_SUCCESS', 3);

  7. define('ALERT_DANGER', 4);

  8. define('ALERT_WARNING', 5);

  9. define('ALERT_INFO', 6);

  10. define('ALERT_LIGHT', 7);

  11. define('ALERT_DARK', 8);

  12. define('ALERT_COLORS', array(

  13.     ALERT_PRIMARY => array('#cfe2ff','#b6d4fe','#084298'),

  14.     ALERT_SECONDARY => array('#e2e3e5','#d3d6d8','#41464b'),

  15.     ALERT_SUCCESS => array('#d1e7dd','#badbcc','#0f5132'),

  16.     ALERT_DANGER => array('#f8d7da','#f5c2c7','#842029'),

  17.     ALERT_WARNING => array('#fff3cd','#ffecb5','#664d03'),

  18.     ALERT_INFO => array('#cff4fc','#b6effb','#055160'),

  19.     ALERT_LIGHT => array('#fefefe','#fdfdfe','#636464'),

  20.     ALERT_DARK => array('#d3d3d4','#bcbebf','#141619'),

  21. ));

  22. define("ALERT_TPL", '<div class="alert alert-danger mb-0">~content~</div>');

  23. //$content:内容 $type:alert类型

  24. function DedeAlert($content, $type = ALERT_PRIMARY)

  25. {

  26.     $content = htmlspecialchars($content);

  27.     $colors = isset(ALERT_COLORS[$type])? ALERT_COLORS[$type] : ALERT_COLORS[ALERT_PRIMARY];

  28.     list($background, $border, $color) = $colors;

  29.     return str_replace(array('~color~','~background~','~border~', '~content~'),array($color,$background,$border,$content),ALERT_TPL);

  30. }

  31. /**

  32.  * 系统核心函数存放文件

  33.  * @version        $Id: common.func.php 4 16:39 2010年7月6日 tianya $

  34.  * @package        DedeBIZ.Libraries

  35.  * @copyright      Copyright (c) 2022, DedeBIZ.COM

  36.  * @license        https://www.dedebiz.com/license

  37.  * @link           https://www.dedebiz.com

  38.  */

  39. if (version_compare(PHP_VERSION, '7.0.0', '>=')) {

  40.     if (!function_exists('mysql_connect') and function_exists('mysqli_connect')) {

  41.         function mysql_connect($server, $username, $password)

  42.         {

  43.             return mysqli_connect($server, $username, $password);

  44.         }

  45.     }

  46.     if (!function_exists('mysql_query') and function_exists('mysqli_query')) {

  47.         function mysql_query($query, $link)

  48.         {

  49.             return mysqli_query($link, $query);

  50.         }

  51.     }

  52.     if (!function_exists('mysql_select_db') and function_exists('mysqli_select_db')) {

  53.         function mysql_select_db($database_name, $link)

  54.         {

  55.             return mysqli_select_db($link, $database_name);

  56.         }

  57.     }

  58.     if (!function_exists('mysql_fetch_array') and function_exists('mysqli_fetch_array')) {

  59.         function mysql_fetch_array($result)

  60.         {

  61.             return mysqli_fetch_array($result);

  62.         }

  63.     }

  64.     if (!function_exists('mysql_close') and function_exists('mysqli_close')) {

  65.         function mysql_close($link)

  66.         {

  67.             return mysqli_close($link);

  68.         }

  69.     }

  70.     if (!function_exists('mysql_free_result') and function_exists('mysqli_free_result')) {

  71.         function mysql_free_result($result)

  72.         {

  73.             return mysqli_free_result($result);

  74.         }

  75.     }

  76.     if (!function_exists('split')) {

  77.         function split($pattern, $string)

  78.         {

  79.             return explode($pattern, $string);

  80.         }

  81.     }

  82. }

  83. //一个支持在PHP Cli Server打印的方法

  84. function var_dump_cli($val)

  85. {

  86.     ob_start();

  87.     var_dump($val);

  88.     error_log(ob_get_clean(), 4);

  89. }

  90. function get_mime_type($filename)

  91. {

  92.     if (!function_exists('finfo_open')) {

  93.         return 'unknow/octet-stream';

  94.     }

  95.     $finfo    = finfo_open(FILEINFO_MIME_TYPE);

  96.     $mimeType = finfo_file($finfo, $filename);

  97.     finfo_close($finfo);

  98.     return $mimeType;

  99. }

  100. function is_all_numeric(array $array)

  101. {

  102.     foreach ($array as $item) {

  103.         if (!is_numeric($item)) return false;

  104.     }

  105.     return true;

  106. }

  107. function make_hash()

  108. {

  109.     $rand = dede_random_bytes(16);

  110.     $_SESSION['token'] = ($rand === FALSE)

  111.         ? md5(uniqid(mt_rand(), TRUE))

  112.         : bin2hex($rand);

  113.     return $_SESSION['token'];

  114. }

  115. function dede_random_bytes($length)

  116. {

  117.     if (empty($length) or !ctype_digit((string) $length)) {

  118.         return FALSE;

  119.     }

  120.     if (function_exists('openssl_random_pseudo_bytes')) {

  121.         return openssl_random_pseudo_bytes($length);

  122.     }

  123.     if (function_exists('random_bytes')) {

  124.         try {

  125.             return random_bytes((int) $length);

  126.         } catch (Exception $e) {

  127.             return FALSE;

  128.         }

  129.     }

  130.     if (is_readable('/dev/urandom') && ($fp = fopen('/dev/urandom', 'rb')) !== FALSE) {

  131.         version_compare(PHP_VERSION, '5.4.0', '>=') && stream_set_chunk_size($fp, $length);

  132.         $output = fread($fp, $length);

  133.         fclose($fp);

  134.         if ($output !== FALSE) {

  135.             return $output;

  136.         }

  137.     }

  138.     return FALSE;

  139. }

  140. //SQL语句过滤程序，由80sec提供，这里作了适当的修改

  141. if (!function_exists('CheckSql')) {

  142.     function CheckSql($db_string, $querytype = 'select')

  143.     {

  144.         global $cfg_cookie_encode;

  145.         $clean = '';

  146.         $error = '';

  147.         $old_pos = 0;

  148.         $pos = -1;

  149.         $enkey = substr(md5(substr($cfg_cookie_encode.'dedebiz', 0, 5)), 0, 10);

  150.         $log_file = DEDEDATA.'/checksql_'.$enkey.'_safe.txt';

  151.         $userIP = GetIP();

  152.         $getUrl = GetCurUrl();

  153.         //如果是普通查询语句，直接过滤一些特殊语法

  154.         if ($querytype == 'select') {

  155.             $notallow1 = "[^0-9a-z@\._-]{1,}(union|sleep|benchmark|load_file|outfile)[^0-9a-z@\.-]{1,}";

  156.             //$notallow2 = "--|/\*";

  157.             if (preg_match("/".$notallow1."/i", $db_string)) {

  158.                 fputs(fopen($log_file, 'a+'), "$userIP||$getUrl||$db_string||SelectBreak\r\n");

  159.                 exit("<span>Safe Alert: Request Error step 1 !</span>");

  160.             }

  161.         }

  162.         //完整的SQL检查

  163.         while (TRUE) {

  164.             $pos = strpos($db_string, '\'', $pos + 1);

  165.             if ($pos === FALSE) {

  166.                 break;

  167.             }

  168.             $clean .= substr($db_string, $old_pos, $pos - $old_pos);

  169.             while (TRUE) {

  170.                 $pos1 = strpos($db_string, '\'', $pos + 1);

  171.                 $pos2 = strpos($db_string, '\\', $pos + 1);

  172.                 if ($pos1 === FALSE) {

  173.                     break;

  174.                 } elseif ($pos2 == FALSE || $pos2 > $pos1) {

  175.                     $pos = $pos1;

  176.                     break;

  177.                 }

  178.                 $pos = $pos2 + 1;

  179.             }

  180.             $clean .= '$s$';

  181.             $old_pos = $pos + 1;

  182.         }

  183.         $clean .= substr($db_string, $old_pos);

  184.         $clean = trim(strtolower(preg_replace(array('~\s+~s'), array(' '), $clean)));

  185.         if (

  186.             strpos($clean, '@') !== FALSE  or strpos($clean, 'char(') !== FALSE or strpos($clean, '"') !== FALSE

  187.             or strpos($clean, '$s$$s$') !== FALSE

  188.         ) {

  189.             $fail = TRUE;

  190.             if (preg_match("#^create table#i", $clean)) $fail = FALSE;

  191.             $error = "unusual character";

  192.         }

  193.         //老版本的Mysql并不支持union，常用的程序里也不使用union，但是一些黑客使用它，所以检查它

  194.         if (strpos($clean, 'union') !== FALSE && preg_match('~(^|[^a-z])union($|[^[a-z])~s', $clean) != 0) {

  195.             $fail = TRUE;

  196.             $error = "union detect";

  197.         }

  198.         //发布版本的程序可能比较少包括--,#这样的注释，但是黑客经常使用它们

  199.         elseif (strpos($clean, '/*') > 2 || strpos($clean, '--') !== FALSE || strpos($clean, '#') !== FALSE) {

  200.             $fail = TRUE;

  201.             $error = "comment detect";

  202.         }

  203.         //这些函数不会被使用，但是黑客会用它来操作文件，down掉数据库

  204.         elseif (strpos($clean, 'sleep') !== FALSE && preg_match('~(^|[^a-z])sleep($|[^[a-z])~s', $clean) != 0) {

  205.             $fail = TRUE;

  206.             $error = "slown down detect";

  207.         } elseif (strpos($clean, 'benchmark') !== FALSE && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~s', $clean) != 0) {

  208.             $fail = TRUE;

  209.             $error = "slown down detect";

  210.         } elseif (strpos($clean, 'load_file') !== FALSE && preg_match('~(^|[^a-z])load_file($|[^[a-z])~s', $clean) != 0) {

  211.             $fail = TRUE;

  212.             $error = "file fun detect";

  213.         } elseif (strpos($clean, 'into outfile') !== FALSE && preg_match('~(^|[^a-z])into\s+outfile($|[^[a-z])~s', $clean) != 0) {

  214.             $fail = TRUE;

  215.             $error = "file fun detect";

  216.         }

  217.         //老版本的MYSQL不支持子查询，我们的程序里可能也用得少，但是黑客可以使用它来查询数据库敏感信息

  218.         elseif (preg_match('~\([^)]*?select~s', $clean) != 0) {

  219.             $fail = TRUE;

  220.             $error = "sub select detect";

  221.         }

  222.         if (!empty($fail)) {

  223.             fputs(fopen($log_file, 'a+'), "$userIP||$getUrl||$db_string||$error\r\n");

  224.             exit("<span>Safe Alert: Request Error step 2!</span>");

  225.         } else {

  226.             return $db_string;

  227.         }

  228.     }

  229. }

  230. /**

  231.  *  载入小助手,系统默认载入小助手

  232.  *  在/data/helper.inc.php中进行默认小助手初始化的设置，创建一个示例为test.helper.php文件基本内容如下：

  233.  *  <code>

  234.  *  if (!function_exists('HelloDede'))

  235.  *  {

  236.  *      function HelloDede()

  237.  *      {

  238.  *          echo "Hello! Dede";

  239.  *      }

  240.  *  }

  241.  *  </code>

  242.  *  则我们在开发中使用这个小助手的时候直接使用函数helper('test');初始化它，然后在文件中就可以直接使用:HelloDede();来进行调用

  243.  *

  244.  * @access    public

  245.  * @param     mix   $helpers  小助手名称,可以是数组,可以是单个字符串

  246.  * @return    void

  247.  */

  248. $_helpers = array();

  249. function helper($helpers)

  250. {

  251.     //如果是数组，则进行递归操作

  252.     if (is_array($helpers)) {

  253.         foreach ($helpers as $dede) {

  254.             helper($dede);

  255.         }

  256.         return;

  257.     }

  258.     if (isset($_helpers[$helpers])) {

  259.         return;

  260.     }

  261.     if (file_exists(DEDEINC.'/helpers/'.$helpers.'.helper.php')) {

  262.         include_once(DEDEINC.'/helpers/'.$helpers.'.helper.php');

  263.         $_helpers[$helpers] = TRUE;

  264.     }

  265.     //无法载入小助手

  266.     if (!isset($_helpers[$helpers])) {

  267.         exit('Unable to load the requested file: helpers/'.$helpers.'.helper.php');

  268.     }

  269. }

  270. function dede_htmlspecialchars($str)

  271. {

  272.     global $cfg_soft_lang;

  273.     if (version_compare(PHP_VERSION, '5.4.0', '<')) return htmlspecialchars($str);

  274.     if ($cfg_soft_lang == 'gb2312') return htmlspecialchars($str, ENT_COMPAT, 'ISO-8859-1');

  275.     else return htmlspecialchars($str);

  276. }

  277. /**

  278.  *  载入小助手，这里用户可能载入用helps载入多个小助手

  279.  *

  280.  * @access    public

  281.  * @param     string

  282.  * @return    string

  283.  */

  284. function helpers($helpers)

  285. {

  286.     helper($helpers);

  287. }

  288. //兼容php4的file_put_contents

  289. if (!function_exists('file_put_contents')) {

  290.     function file_put_contents($n, $d)

  291.     {

  292.         $f = @fopen($n, "w");

  293.         if (!$f) {

  294.             return FALSE;

  295.         } else {

  296.             fwrite($f, $d);

  297.             fclose($f);

  298.             return TRUE;

  299.         }

  300.     }

  301. }

  302. /**

  303.  *  显示更新信息

  304.  *

  305.  * @return    void

  306.  */

  307. function UpdateStat()

  308. {

  309.     include_once(DEDEINC."/inc/inc_stat.php");

  310.     return SpUpdateStat();

  311. }

  312. $arrs1 = array();

  313. $arrs2 = array();

  314. /**

  315.  *  短消息函数，可以在某个动作处理后友好的提示信息

  316.  *

  317.  * @param     string  $msg       消息提示信息

  318.  * @param     string  $gourl     跳转地址

  319.  * @param     int     $onlymsg   仅显示信息

  320.  * @param     int     $limittime 限制时间

  321.  * @return    void

  322.  */

  323. function ShowMsg($msg, $gourl, $onlymsg = 0, $limittime = 0)

  324. {

  325.     global $cfg_soft_lang, $cfg_cmsurl;

  326.     if (empty($GLOBALS['cfg_plus_dir'])) $GLOBALS['cfg_plus_dir'] = '..';

  327.     $htmlhead  = "<!DOCTYPE html><html><head><meta charset='utf-8'><meta http-equiv='X-UA-Compatible' content='IE=Edge,chrome=1'><title>提示信息</title><base target='_self'></head>";

  328.     $htmlhead .= "<body><center><script>";

  329.     $htmlfoot  = "</script></center></body></html>";

  330.     $litime = ($limittime == 0 ? 1000 : $limittime);

  331.     $func = '';

  332.     if ($gourl == '-1') {

  333.         if ($limittime == 0) $litime = 5000;

  334.         $gourl = "javascript:history.go(-1);";

  335.     }

  336.     if ($gourl == '' || $onlymsg == 1) {

  337.         $msg = "<script>alert(\"".str_replace("\"", "“", $msg)."\");</script>";

  338.     } else {

  339.         //当网址为:close::objname时，关闭父框架的id=objname元素

  340.         if (preg_match('/close::/', $gourl)) {

  341.             $tgobj = trim(preg_replace('/close::/', '', $gourl));

  342.             $gourl = 'javascript:;';

  343.             $func .= "window.parent.document.getElementById('{$tgobj}').style.display='none';\r\n";

  344.         }

  345.         $func .= "var pgo=0;function JumpUrl(){if (pgo==0){location='$gourl'; pgo=1;}}";

  346.         $rmsg = $func;

  347.         $rmsg .= "document.write(\"<style>body{margin:0;line-height:1.5;font:14px Helvetica Neue,Helvetica,PingFang SC,Tahoma,Arial,sans-serif;color:#545b62;background:#f8f8f8}a{color:#28a745;text-decoration:none}.tips{margin:70px auto 0;padding:0;width:500px;height:auto;background:#fff;border-radius:.2rem;box-shadow:0 .125rem .25rem rgba(0,0,0,.075)}.tips-head{margin:0 20px;padding:16px 0;border-bottom:1px solid #f8f8f8}.tips-head p{margin:0;padding-left:10px;line-height:16px;text-align:left;border-left:3px solid #dc3545}.tips-box{padding:20px;min-height:130px;color:#545b62}.btn a{display:inline-block;margin:20px auto 0;padding:.375rem .75rem;font-size:12px;color:#fff;background:#28a745;border-radius:.2rem;text-align:center;transition:all .6s}.btn a:focus{background:#006829;border-color:#005b24;box-shadow:0 0 0 0.2rem rgba(38,159,86,.5)}@media (max-width:768px){body{padding:0 15px}.tips{width:100%}}</style>\");";

  348.         $rmsg .= "document.write(\"<div class='tips'>";

  349.         $rmsg .= "<div class='tips-head'><p>提示信息</p></div>\");";

  350.         $rmsg .= "document.write(\"<div class='tips-box'>\");";

  351.         $rmsg .= "document.write(\"".str_replace("\"", "“", $msg)."\");";

  352.         $rmsg .= "document.write(\"";

  353.         if ($onlymsg == 0) {

  354.             if ($gourl != 'javascript:;' && $gourl != '') {

  355.                 $rmsg .= "<div class='btn'><a href='{$gourl}'>点击反应</a></div>\");";

  356.                 $rmsg .= "setTimeout('JumpUrl()',$litime);";

  357.             } else {

  358.                 $rmsg .= "</div>\");";

  359.             }

  360.         } else {

  361.             $rmsg .= "</div>\");";

  362.         }

  363.         $msg  = $htmlhead.$rmsg.$htmlfoot;

  364.     }

  365.     echo $msg;

  366. }

  367. /**

  368.  *  获取验证码的session值

  369.  *

  370.  * @return    string

  371.  */

  372. function GetCkVdValue()

  373. {

  374.     @session_id($_COOKIE['PHPSESSID']);

  375.     @session_start();

  376.     return isset($_SESSION['securimage_code_value']) ? $_SESSION['securimage_code_value'] : '';

  377. }

  378. /**

  379.  *  PHP某些版本有Bug，不能在同一作用域中同时读session并改注销它，因此调用后需执行本函数

  380.  *

  381.  * @return    void

  382.  */

  383. function ResetVdValue()

  384. {

  385.     @session_start();

  386.     $_SESSION['securimage_code_value'] = '';

  387. }

  388. function IndexSub($idx, $num)

  389. {

  390.     return intval($idx) - intval($num) == 0 ? '0 ' : intval($idx) - intval($num);

  391. }

  392. //用来返回index的active

  393. function IndexActive($idx)

  394. {

  395.     if ($idx == 1) {

  396.         return ' active';

  397.     } else {

  398.         return '';

  399.     }

  400. }

  401. //是否是HTTPS

  402. function IsSSL()

  403. {

  404.     if ($_SERVER['HTTPS'] && ('1' == $_SERVER['HTTPS'] || 'on' == strtolower($_SERVER['HTTPS']))) {

  405.         return true;

  406.     } elseif ('https' == $_SERVER['REQUEST_SCHEME']) {

  407.         return true;

  408.     } elseif ('443' == $_SERVER['SERVER_PORT']) {

  409.         return true;

  410.     } elseif ('https' == $_SERVER['HTTP_X_FORWARDED_PROTO']) {

  411.         return true;

  412.     }

  413.     return false;

  414. }

  415. //用户名称标签{dede:field.mid function="GetMemberInfos('uname',@me)"/}和[field:mid function="GetMemberInfos('uname',@me)"/]

  416. function GetMemberInfos($fields, $mid)

  417. {

  418.     global $dsql;

  419.     if ($mid <= 0) {

  420.         $revalue = "Error";

  421.     } else {

  422.         $row=$dsql->GetOne("SELECT * FROM `#@__member` WHERE mid='{$mid}'");

  423.         if (!is_array($row)) {

  424.             $revalue = "Not user";

  425.         } else {

  426.             $revalue = $row[$fields];

  427.         }

  428.     }

  429.     return $revalue;

  430. }

  431. //用户头像标签{dede:field.mid function='face(@me)'/}和[field:mid function='face(@me)'/]

  432. function face($mid)

  433. {

  434.     global $dsql;

  435.     if ($mid <> 0) {

  436.         $row = $dsql->GetOne("SELECT * FROM `#@__member` WHERE mid='$mid'");

  437.         if ($row['face'] == "") {

  438.             $face = "/static/web/img/avatar.png";

  439.         } else {

  440.             $face = $row['face'];

  441.             $face = "$face";

  442.         }

  443.     }

  444.     return $face;

  445. }

  446. //Tag数量标签[field:id function='GetMyTags(@me,2)'/]2表示输出2个文档

  447. if (!function_exists('GetMyTags')) {

  448.     function GetMyTags($aid, $num=3) {

  449.         global $dsql,$cfg_cmspath;

  450.         $tags = '';

  451.         $query = "SELECT * FROM `#@__taglist` WHERE aid='$aid' LIMIT $num";

  452.         $dsql->Execute('tag',$query);

  453.         while($row = $dsql->GetArray('tag')) {

  454.             $link = $cfg_cmspath."/apps/tags.php?/{$row['tid']}";

  455.             $tags.= ($tags==''?"<a href='{$link}'>{$row['tag']}</a>" : "<a href='{$link}'>{$row['tag']}</a>");

  456.         }

  457.         return $tags;

  458.     }

  459. }

  460. /*调用前台主题模板<?php pasterTempletDiy('header.htm');?>*/

  461. if (!function_exists('pasterTempletDiy')) {

  462.     function pasterTempletDiy($path) {

  463.         global $cfg_basedir,$cfg_templets_dir,$cfg_df_style;

  464.         $tmpfile = $cfg_basedir.$cfg_templets_dir.'/'.$cfg_df_style.'/'.$path;

  465.         $dtp = new PartView();

  466.         $dtp->SetTemplet($tmpfile);

  467.         $dtp->Display();

  468.     }

  469. }

  470. //联动单筛选标签{dede:php}AddFilter(模型id,类型,'字段1,字段2');{/dede:php}

  471. function litimgurls($imgid = 0)

  472. {

  473.     global $lit_imglist, $dsql;

  474.     $row = $dsql->GetOne("SELECT c.addtable FROM `#@__archives` AS a LEFT JOIN `#@__channeltype` AS c ON a.channel=c.id WHERE a.id='$imgid'");

  475.     $addtable = trim($row['addtable']);

  476.     $row = $dsql->GetOne("SELECT imgurls FROM `$addtable` WHERE aid='$imgid'");

  477.     $ChannelUnit = new ChannelUnit(2, $imgid);

  478.     $lit_imglist = $ChannelUnit->GetlitImgLinks($row['imgurls']);

  479.     return $lit_imglist;

  480. }

  481. //字符过滤函数安全

  482. function string_filter($str, $stype = "inject")

  483. {

  484.     if ($stype == "inject") {

  485.         $str = str_replace(

  486.             array("select", "insert", "update", "delete", "alter", "cas", "union", "into", "load_file", "outfile", "create", "join", "where", "like", "drop", "modify", "rename", "'", "/*", "*", "../", "./"),

  487.             array("", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""),

  488.             $str

  489.         );

  490.     } else if ($stype == "xss") {

  491.         $farr = array("/\s+/", "/<(\/?)(script|META|STYLE|HTML|HEAD|BODY|STYLE |i?frame|b|strong|style|html|img|P|o:p|iframe|u|em|strike|BR|div|a|TABLE|TBODY|object|tr|td|st1:chsdate|FONT|span|MARQUEE|body|title|\r\n|link|meta|\?|\%)([^>]*?)>/isU", "/(<[^>]*)on[a-zA-Z]+\s*=([^>]*>)/isU",);

  492.         $tarr = array(" ", "", "\\1\\2",);

  493.         $str = preg_replace($farr, $tarr, $str);

  494.         $str = str_replace(

  495.             array("<", ">", "'", "\"", ";", "/*", "*", "../", "./"),

  496.             array("&lt;", "&gt;", "", "", "", "", "", "", ""),

  497.             $str

  498.         );

  499.     }

  500.     return $str;

  501. }

  502. //联动单筛选自定义表单发布

  503. function AddFilter($channelid, $type=1, $fieldsnamef=array(), $defaulttid=0, $toptid=0, $loadtype='autofield')

  504. {

  505.     global $tid, $dsql, $id, $aid;

  506.     $tid = $defaulttid ? $defaulttid : $tid;

  507.     if ($id!="" || $aid!="") {

  508.         $arcid = $id!="" ? $id : $aid;

  509.         $tidsq = $dsql->GetOne("SELECT * FROM `#@__archives` WHERE id='$arcid'");

  510.         $tid = $toptid==0 ? $tidsq["typeid"] : $tidsq["topid"];

  511.     }

  512.     $nofilter = (isset($_REQUEST['TotalResult']) ? "&TotalResult=".$_REQUEST['TotalResult'] : '').(isset($_REQUEST['PageNo']) ? "&PageNo=".$_REQUEST['PageNo'] : '');

  513.     $filterarr = string_filter(stripos($_SERVER['REQUEST_URI'], "list.php?tid=") ? str_replace($nofilter, '', $_SERVER['REQUEST_URI']) : $GLOBALS['cfg_cmsurl']."/plus/list.php?tid=".$tid);

  514.     $cInfos = $dsql->GetOne("SELECT * FROM `#@__channeltype` WHERE id='$channelid'");

  515.     $fieldset=$cInfos['fieldset'];

  516.     $dtp = new DedeTagParse();

  517.     $dtp->SetNameSpace('field', '<', '>');

  518.     $dtp->LoadSource($fieldset);

  519.     $dede_addonfields = '';

  520.     if(is_array($dtp->CTags)) {

  521.         foreach($dtp->CTags as $tida=>$ctag)

  522.         {

  523.             $fieldsname = $fieldsnamef ? explode(",", $fieldsnamef) : explode(",", $ctag->GetName());

  524.             if(($loadtype!='autofield' || ($loadtype=='autofield' && $ctag->GetAtt('autofield')==1)) && in_array($ctag->GetName(), $fieldsname) ) {

  525.                 $href1 = explode($ctag->GetName().'=', $filterarr);

  526.                 $href2 = explode('&', $href1[1]);

  527.                 $fields_value = $href2[0];

  528.                 switch ($type) {

  529.                     case 1:

  530.                     $dede_addonfields .= (preg_match("/&".$ctag->GetName()."=/is",$filterarr,$regm) ? '<a href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'">全部</a>' : '<a href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'" class="btn btn-success btn-sm">全部</a>');

  531.                     $addonfields_items = explode(",",$ctag->GetAtt('default'));

  532.                     for ($i=0; $i<count($addonfields_items); $i++)

  533.                     {

  534.                         $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);

  535.                         $dede_addonfields .= ($fields_value!=urlencode($addonfields_items[$i]) ? '<a title="'.$addonfields_items[$i].'" href="'.$href.'">'.$addonfields_items[$i].'</a>' : '<a href="'.$href.'" class="btn btn-success btn-sm">'.$addonfields_items[$i].'</a>');

  536.                     }

  537.                     break;

  538.                     case 2:

  539.                     $dede_addonfields .= '<select name="filter'.$ctag->GetName().'" onchange="window.location=this.options[this.selectedIndex].value">

  540.                         '.'<option value="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'">全部</option>';

  541.                     $addonfields_items = explode(",",$ctag->GetAtt('default'));

  542.                     for ($i=0; $i<count($addonfields_items); $i++)

  543.                     {

  544.                         $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);

  545.                         $dede_addonfields .= '<option value="'.$href.'"'.($fields_value==urlencode($addonfields_items[$i]) ? ' selected="selected"' : '').'>'.$addonfields_items[$i].'</option>

  546.                         ';

  547.                     }

  548.                     $dede_addonfields .= '</select>';

  549.                     break;

  550.                     case 3:

  551.                     $dede_addonfields .= (preg_match("/&".$ctag->GetName()."=/is",$filterarr,$regm) ? '<a title="全部" href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'"><input type="radio" name="filter'.$ctag->GetName().'" value="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'" onclick="window.location=this.value">全部</a>' : '<span><input type="radio" name="filter'.$ctag->GetName().'" checked="checked">全部</span>');

  552.                     $addonfields_items = explode(",",$ctag->GetAtt('default'));

  553.                     for ($i=0; $i<count($addonfields_items); $i++)

  554.                     {

  555.                         $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);

  556.                         $dede_addonfields .= ($fields_value!=urlencode($addonfields_items[$i]) ? '<a title="'.$addonfields_items[$i].'" href="'.$href.'"><input type="radio" name="filter'.$ctag->GetName().'" value="'.$href.'" onclick="window.location=this.value">'.$addonfields_items[$i].'</a>' : '<span><input type="radio" name="filter'.$ctag->GetName().'" checked="checked">'.$addonfields_items[$i].'</span>');

  557.                     }

  558.                     break;

  559.                 }

  560.             }

  561.         }

  562.     }

  563.     echo $dede_addonfields;

  564. }

  565. //自定义函数接口

  566. if (file_exists(DEDEINC.'/extend.func.php')) {

  567.     require_once(DEDEINC.'/extend.func.php');

  568. }

  569. ?>