建站之星最新0DAY

//code
public function save_profile() {
       $user_info =@ ParamHolder::get('user', array());//获取数组
       if (sizeof($user_info) <= 0) {
           $this->assign('json', Toolkit::jsonERR(__('Missing user information!')));
           return '_result';
       }
       $passwd_changed = false;
       try {
           $o_user = new User(SessionHolder::get('user/id'));
           if ($user_info['email'] != $o_user->email) {
               /* Check duplicates */
               if ($o_user->count("email=?", array($user_info['email'])) > 0) {
                   $this->assign('json', Toolkit::jsonERR(__('User E-mail address exists!')));
                   return '_result';
               }
           }

           $o_user->set($user_info);
           /* Check password */
           $passwd_info =@ ParamHolder::get('passwd', array());
           if (sizeof($passwd_info) != 2) {
               $this->assign('json', Toolkit::jsonERR(__('Invalid Password!')));
               return '_result';
           }

           if (strlen(trim($passwd_info['passwd'])) > 0 ||

               strlen(trim($passwd_info['re_passwd'])) > 0) {

               if ($passwd_info['passwd'] == $passwd_info['re_passwd']) {

                   $o_user->passwd = sha1($passwd_info['passwd']);

                   $passwd_changed = true;
               }
           }

           $o_user->save(); //可以xo了 这里我不跟踪了 这个源码看的我蛋疼

       } catch (Exception $ex) {
           $this->assign('json', Toolkit::jsonERR($ex->getMessage()));
           return '_result';
       }
       if ($passwd_changed) {

               SessionHolder::destroy();

           $this->assign('json', Toolkit::jsonOK(array('forward' => 'index.php')));

       } else {

               $forward_url = Html::uriquery('mod_user', 'edit_profile');

           $this->assign('json', Toolkit::jsonOK(array('forward' => $forward_url)));

       }

       return '_result';

   }

数据库user表结构

直接改一下包可以秒了

后台解析漏洞可以秒