Files
wenquanauth/function/trade.inc.php
T
youpaishidifu 6669f4bc9c 加固-01/02: CWD 无关 include 改造 + UEditor 全入口鉴权 (P0-01)
A. 相对路径 include/require 全量改写为 __DIR__ 基址
   - 修复 nginx+fastcgi 下 php-cgi 继承启动目录 CWD (D:\phpstudy_pro\COM)
     导致 require '../function/...' 相对路径 include 全部失效;
     28 文件 101 处统一改为 __DIR__ 绝对基址,任意 Web 服务器行为一致。
   - 补齐带括号/缺斜杠漏改的 13 处 (controller.php、epay lib、
     payment.php、notify_url.php、return_url.php)。
   - function/config.inc.php 增加 config.local.inc.php 本地覆盖机制
     (该文件加入 .gitignore 不入库),仓库默认配置保持中立。

B. UEditor 后台入口安全加固 (P0-01)
   - admin/php/controller.php 全部 action 前置管理员会话校验
     (admin_username + admin_password),匿名无法上传/抓取/列目录/读配置。
   - 禁用远程图片抓取 catchimage (SSRF 向量),删除 action_crawler.php。
   - 上传/列表白名单剔除 .exe/.dll/.iso/.cab/.swf。
   - Uploader: 移除 iconv('unicode') Windows 告警行;
     getFileInfo/action_list 的 URL 拼接增加 REQUEST_SCHEME 回退。

验证: 匿名访问全部 action 返回未授权;登录态上传成功且 URL 正确;
catchimage 已禁用;JSON 合法;全量 php -l 0 错误;
nginx(8081) 与内置服务器(8082) 双通道回归通过。
2026-10-10 11:10:29 +08:00

132 lines
5.8 KiB
PHP
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<?php
/**
* Created by PhpStorm.
* User: 温泉
* Date: 2019/2/17
* Time: 11:47
*
*/
/**
* 订单处理
* @param $tradeinfo
* @return false|string
*/
function trade_do($tradeinfo){
global $db;
$MailTips[] = MakeTradeTips($tradeinfo);
ignore_user_abort(true);//关闭浏览器继续处理,保证订单不会处理到一半就凉了
if ($tradeinfo['type'] == '1') {
//代理充值
if (!$agentinfo = $db->select_first_row('sq_agent', '*', array('username' => $tradeinfo['user']), 'AND')) {
return makejson(-101,'代理信息获取失败');
}
$newinfo['money'] = $agentinfo['money'] + $tradeinfo['paymoney'];
$newinfo['allrecharge'] = $agentinfo['allrecharge'] + $tradeinfo['paymoney'];
if (!$db->update('sq_agent', array('username' => $tradeinfo['user']), 'AND', $newinfo)) {
return makejson(-102,'代理信息更新失败');
}
$db->insert_back_id('sq_log_agent', array('time' => time(), 'aid' => $agentinfo['ID'], 'ip' => get_real_ip(), 'msg' => '成功充值' . $tradeinfo['paymoney'] . '元,余额' . $newinfo['allrecharge']));
return makejson(1,'充值余额成功!');
}
if ($tradeinfo['type'] == '2') {
//代理开通商品
if (!$fidinfo = $db->select_first_row('sq_fidlist', '*', array('ID' => $tradeinfo['fid']), 'AND')) {
return makejson(-201,'商品信息拉取失败');
}
if (!$agentinfo = $db->select_first_row('sq_agent', '*', array('ID' => $tradeinfo['agentid']), 'AND')) {
return makejson(-202,'代理信息拉取失败');
}
$allspend = $agentinfo['allspend'] + $tradeinfo['paymoney'];
$db->update('sq_agent', array('ID' => $tradeinfo['agentid']), 'AND', array('allspend' => $allspend));
include_once __DIR__ . '/function_auth.php';
$back = auth_add($tradeinfo['user'],$tradeinfo['pass'],$tradeinfo['ip'],$tradeinfo['num'] * $fidinfo['num'],$tradeinfo['uqq'],$tradeinfo['mail'],$fidinfo['appid'],4,'',$agentinfo['ID'],$newkey,$tips);
if ($back == 1){
return makejson(1,'授权新增成功');
}else if ($back==2){
return makejson(1,'授权续费成功');
}else if ($back==3){
return makejson(2,'成功生成卡密',array('kami'=>$newkey));
}else{
return makejson($back,$tips);
}
}
if ($tradeinfo['type'] == '3') {
//在线购买
if (!$fidinfo = $db->select_first_row('sq_fidlist', '*', array('ID' => $tradeinfo['fid']), 'AND')) {
return makejson(-301,'商品信息拉取失败');
}
include_once __DIR__ . '/function_auth.php';
if ($tradeinfo['paytype'] == 'czkm') {
if (!$kamiinfo = $db->select_first_row('sq_key','*',array('kami'=>$tradeinfo['kami']),'AND'))
{
return makejson(-301,'卡密不存在');
}
$back = auth_add($tradeinfo['user'],$tradeinfo['pass'],$tradeinfo['ip'],$tradeinfo['num'] * $fidinfo['num'],$tradeinfo['uqq'],$tradeinfo['mail'],$fidinfo['appid'],2,$kamiinfo['ID'],$kamiinfo['aid'],$newkey,$tips);
}elseif ($tradeinfo['paytype'] == 'zxzf') {
$back = auth_add($tradeinfo['user'],$tradeinfo['pass'],$tradeinfo['ip'],$tradeinfo['num'] * $fidinfo['num'],$tradeinfo['uqq'],$tradeinfo['mail'],$fidinfo['appid'],2,0,0,$newkey,$tips);
}else {
return makejson(-302,'操作错误');
}
if ($back == 1){
return makejson(1,'授权新增成功');
}else if ($back==2){
return makejson(1,'授权续费成功');
}else if ($back==3){
return makejson(2,'成功生成卡密',array('kami'=>$newkey));
}else{
return makejson($back,$tips);
}
}
if ($tradeinfo['type'] == '4') {
$nowtime = Get_Date();
$db->insert_back_id('sq_agent', array('username' => $tradeinfo['user'], 'password' => $tradeinfo['pass'], 'begintime' => time(), 'levelid' => $tradeinfo['fid'], 'status' => 1, 'qq' => $tradeinfo['uqq']));
$T['title'] = '您的代理已成功开通!';
$T['content'][] = 'QQ:'.$tradeinfo['uqq'];
$T['content'][] = '账号:'.$tradeinfo['user'];
$T['content'][] = '时间:'.Get_Date();
$T['content'][] = '等级:'.level_idgetname($tradeinfo['fid']);
$MailTips[] = $T;
SendTipsMail($tradeinfo['mail'],$MailTips,$back);
return makejson(1,'代理开通成功');
}
return makejson(-404,'订单类型异常');
}
function MakeTradeTips($tradeinfo){
$T['title'] = '您的订单已成功处理!';
$T['content'][] = '订单金额:'.$tradeinfo['paymoney'].' 元';
switch ($tradeinfo['paytype']){
case 'czkm':
$T['content'][] = '支付方式:充值卡密';
break;
case 'yezf':
$T['content'][] = '支付方式:代理余额';
break;
case 'zxzf':
switch ($tradeinfo['onlinepaytype']){
case 'zfb':
$T['content'][] = '支付方式:在线支付-支付宝';
break;
case 'wx':
$T['content'][] = '支付方式:在线支付-微信支付';
break;
case 'qq':
$T['content'][] = '支付方式:在线支付-QQ钱包';
break;
default:
$T['content'][] = '支付方式:在线支付-未知';
}
break;
default:
$T['content'][] = '支付方式:未知方式';
}
$T['content'][] = '订单名称:'.$tradeinfo['name'];
$T['content'][] = '下单时间:'.Get_Date($tradeinfo['begintime']);
$T['content'][] = '完成时间:'.Get_Date();
$T['content'][] = '订单编号:'.$tradeinfo['tradeno'];
return $T;
}