/2018-HITCTF-Final/web2/html/main/source/plugin/wechat/login.inc.php

https://github.com/SniperOJ/Attack-Defense-Challenges · PHP · 139 lines · 124 code · 9 blank · 6 comment · 40 complexity · c5f28e9fdbd4f904809309fca0e78075 MD5 · raw file

  1. <?php
  2. /**
  3. * [Discuz!] (C)2001-2099 Comsenz Inc.
  4. * This is NOT a freeware, use is subject to license terms
  5. *
  6. * $Id: login.inc.php 34989 2014-09-24 07:22:03Z nemohou $
  7. */
  8. if (!defined('IN_DISCUZ')) {
  9. exit('Access Denied');
  10. }
  11. if(!$_G['wechat']['setting']) {
  12. $_G['wechat']['setting'] = unserialize($_G['setting']['mobilewechat']);
  13. }
  14. if(!$_G['wechat']['setting']['wechat_qrtype']) {
  15. showmessage('undefined_action');
  16. }
  17. if(!$_G['wechat']['setting']['wsq_siteid']) {
  18. showmessage('wechat:wechat_login_closed');
  19. }
  20. require_once DISCUZ_ROOT . './source/plugin/wechat/wsq.class.php';
  21. $ac = !empty($_GET['ac']) ? $_GET['ac'] : 'login';
  22. if($ac == 'login') {
  23. $qrauth = $_G['cookie']['qrauth'] ? authcode(base64_decode($_G['cookie']['qrauth']), 'DECODE', $_G['config']['security']['authkey']) : '';
  24. if($_G['uid'] && !$qrauth) {
  25. $showtip = true;
  26. if(in_array('qqconnect', $_G['setting']['plugins']['available'])) {
  27. $connect = C::t('#qqconnect#common_member_connect')->fetch($_G['uid']);
  28. if($connect['conisregister']) {
  29. $showtip = false;
  30. }
  31. }
  32. if($showtip) {
  33. dsetcookie('qrauth', '', -1);
  34. showmessage('wechat:wechat_member_bind_qrauth_lost');
  35. }
  36. }
  37. $url = wsq::qrconnectUrl($_G['uid'], dreferer());
  38. dheader('location: '.$url);
  39. } elseif($ac == 'callback') {
  40. if(!wsq::checksign($_GET) || $_G['uid'] && $_GET['siteuid'] != $_G['uid']) {
  41. showmessage('wechat:wechat_member_auth_fail');
  42. }
  43. require_once libfile('function/member');
  44. if($_GET['siteuid'] && ($member = getuserbyuid($_GET['siteuid'], 1))) {
  45. setloginstatus($member, 1296000);
  46. if(!C::t('#wechat#common_member_wechatmp')->fetch($member['uid'])) {
  47. C::t('#wechat#common_member_wechatmp')->insert(array('uid' => $_G['uid'], 'openid' => $_GET['openid'], 'status' => $_G['cookie']['qrauth'] ? 1: 0), false, true);
  48. }
  49. dheader('location: '.($_GET['referer'] ? $_GET['referer'] : $_G['siteurl']));
  50. } else {
  51. require_once DISCUZ_ROOT . './source/plugin/wechat/wechat.class.php';
  52. require_once DISCUZ_ROOT . './source/plugin/wechat/wechat.lib.class.php';
  53. $defaultusername = WeChatEmoji::clear($_GET['nickname']);
  54. if(!$_G['wechat']['setting']['wechat_allowfastregister']) {
  55. redirectregister($defaultusername);
  56. }
  57. loaducenter();
  58. $user = uc_get_user($defaultusername);
  59. if(!empty($user)) {
  60. $defaultusername = cutstr($defaultusername, 7, '').'_'.random(5);
  61. }
  62. $uid = WeChat::register($defaultusername, 1, 8);
  63. if(!$uid) {
  64. redirectregister($defaultusername);
  65. }
  66. C::t('#wechat#common_member_wechatmp')->insert(array('uid' => $uid, 'openid' => $_GET['openid'], 'status' => 0), false, true);
  67. $url = wsq::userregisterUrl($uid, $_GET['openid'], $_GET['openidsign'], $_GET['referer']);
  68. dheader('location: '.$url);
  69. }
  70. } elseif($ac == 'regcallback' && $_G['uid']) {
  71. list($openid, $openidsign, $qrreferer) = explode("\t", authcode(base64_decode($_GET['auth']), 'DECODE'));
  72. if(!$openid) {
  73. showmessage('wechat:wechat_member_auth_fail');
  74. }
  75. C::t('#wechat#common_member_wechatmp')->insert(array('uid' => $_G['uid'], 'openid' => $openid, 'status' => 1), false, true);
  76. $url = wsq::userregisterUrl($_G['uid'], $openid, $openidsign, $qrreferer);
  77. dheader('location: '.$url);
  78. } elseif($ac == 'regverify' && $_G['uid']) {
  79. if(!wsq::checksign($_GET)) {
  80. showmessage('wechat:wechat_member_auth_fail');
  81. }
  82. if($_GET['code']) {
  83. showmessage('wechat:wechat_member_register_faild');
  84. }
  85. $member = C::t('#wechat#common_member_wechatmp')->fetch($_G['uid']);
  86. if(!$member) {
  87. showmessage('wechat:wechat_member_register_faild');
  88. }
  89. $groupid = $_G['wechat']['setting']['wechat_newusergroupid'] ? $_G['wechat']['setting']['wechat_newusergroupid'] : $_G['setting']['newusergroupid'];
  90. C::t('common_member')->update($_G['uid'], array('groupid' => $groupid));
  91. dheader('location: '.($_G['referer'] ? $_GET['referer'] : $_G['siteurl']));
  92. } elseif($ac == 'wxlogin') {
  93. unset($_GET['mapifrom'], $_GET['charset']);
  94. if(wsq::checksign($_GET)) {
  95. $member = getuserbyuid($_GET['siteuid'], 1);
  96. if($member) {
  97. require_once libfile('function/member');
  98. setloginstatus($member, 1296000);
  99. }
  100. }
  101. } elseif($ac == 'wxregverify') {
  102. if(!wsq::checksign($_GET)) {
  103. showmessage('wechat:wechat_member_auth_fail');
  104. }
  105. $member = getuserbyuid($_GET['siteuid'], 1);
  106. if($member) {
  107. require_once libfile('function/member');
  108. setloginstatus($member, 1296000);
  109. }
  110. if($_G['cookie']['wxnewuser']) {
  111. $groupid = $_G['wechat']['setting']['wechat_newusergroupid'] ? $_G['wechat']['setting']['wechat_newusergroupid'] : $_G['setting']['newusergroupid'];
  112. C::t('common_member')->update($_G['uid'], array('groupid' => $groupid));
  113. dsetcookie('wxnewuser', '', -1);
  114. }
  115. dheader('location: '.($_GET['referer'] ? $_GET['referer'] : $_G['siteurl']));
  116. } else {
  117. showmessage('undefined_action');
  118. }
  119. function redirectregister($username) {
  120. global $_G;
  121. $defaultusername = substr($username, 0, 15);
  122. loaducenter();
  123. $user = uc_get_user($defaultusername);
  124. if(!empty($user)) {
  125. $defaultusername = cutstr($defaultusername, 7, '').'_'.random(5);
  126. }
  127. $auth = urlencode(base64_encode(authcode($_GET['openid']."\t".$_GET['openidsign']."\t".$_GET['referer'], 'ENCODE')));
  128. $referer = urlencode($_G['siteurl'].'plugin.php?id=wechat:login&ac=regcallback&auth='.$auth);
  129. dheader('location: '.$_G['siteurl'].'member.php?mod='.$_G['setting']['regname'].'&referer='.$referer.'&defaultusername='.urlencode($defaultusername));
  130. }