ABCMS news publishing system vulnerabilities and fixes

 

// APP/Controller/Admincp. php

Function actionliulan ()

{

// Administrator Information

$ Nowindex = $ _ GET ['page']? $ _ GET ['page']: 1;

// Obtain the data starting from the nth Query

$ Page = $ _ GET ['page']? ($ _ GET ['page']-1) * 6: 0;

// Query data

$ Liulan = $ this-> admin-> findAll ('', 'Id desc', array (6, $ page ));

// Var_dump ($ liulan); exit;

// Query the total number of records

$ Count = $ this-> admin-> findCount ();

// Instantiate page nowindex current PAGE number

$ Page = new page (array ('Total' => $ conut, 'perpage' => 6, 'nowindex '=> $ nowindex ));

// Total number of pages

$ Page-> totalpage = ceil ($ count/6 );

// Paging connection address

$ Page-> url = "index. php? Controller = Admincp & action = liulan & page = ";

$ Fy = $ page-> show (1 );

// Var_dump ($ liulan );

$ This-> smarty-> assign ('lily', $ liulan );

$ This-> smarty-> assign ('page', $ fy );

$ This-> smarty-> display ("./admin_back/adminliulan.html ");

}

 

 

 

Very beautiful functions. However, permission verification is not a problem during the call. Leading to international problems.

 

Test method:

 

A http://www.bkjia.com/index. php? Controller = Admincp & action = liulan & page = 1

 

By: http://t.qq.com/MakeBug http://hi.baidu.com/micropoor