[PHP] 纯文本查看 复制代码 //code
public function save_profile() {
$user_info =@ ParamHolder::get('user', array());//获取数组
if (sizeof($user_info) <= 0) {
$this->assign('json', Toolkit::jsonERR(__('Missing user information!')));
return '_result';
}
$passwd_changed = false;
try {
$o_user = new User(SessionHolder::get('user/id'));
if ($user_info['email'] != $o_user->email) {
/* Check duplicates */
if ($o_user->count("email=?", array($user_info['email'])) > 0) {
$this->assign('json', Toolkit::jsonERR(__('User E-mail address exists!')));
return '_result';
}
}
$o_user->set($user_info);
/* Check password */
$passwd_info =@ ParamHolder::get('passwd', array());
if (sizeof($passwd_info) != 2) {
$this->assign('json', Toolkit::jsonERR(__('Invalid Password!')));
return '_result';
}
if (strlen(trim($passwd_info['passwd'])) > 0 ||
strlen(trim($passwd_info['re_passwd'])) > 0) {
if ($passwd_info['passwd'] == $passwd_info['re_passwd']) {
$o_user->passwd = sha1($passwd_info['passwd']);
$passwd_changed = true;
}
}
$o_user->save(); //可以xo了 这里我不跟踪了 这个源码看的我蛋疼
} catch (Exception $ex) {
$this->assign('json', Toolkit::jsonERR($ex->getMessage()));
return '_result';
}
if ($passwd_changed) {
SessionHolder::destroy();
$this->assign('json', Toolkit::jsonOK(array('forward' => 'index.php')));
} else {
$forward_url = Html::uriquery('mod_user', 'edit_profile');
$this->assign('json', Toolkit::jsonOK(array('forward' => $forward_url)));
}
return '_result';
}
数据库user表结构
直接改一下包可以秒了
后台解析漏洞可以秒
forum:
http://www.unhonker.com/bug/812.html | 
发表于 2012-12-26 20:56:18
发表于 2012-12-26 21:23:58
