通达OA 2011-2013 通杀GETSHELL

 // inc/conn.php[/color]

function exequery( $C, $Q, $LOG = FALSE ){

        if ( !$LOG ){

                $POS = stripos( $Q, "union" ); //检测union

                if ( $POS !== FALSE && stripos( $Q, "select", $POS ) !== FALSE ){ //union存在再检测select

                        exit( );

                }

                $POS = stripos( $Q, "into" ); //检测into outfile

                if ( $POS !== FALSE && ( stripos( $Q, "outfile", $POS ) !== FALSE || stripos( $Q, "dumpfile", $POS ) !== FALSE ) ){

                        exit( );

                }

        }

        if ( gettype( $C ) != "resource" ){

                printerror( _( "无效的数据库连接" )."<br><b>"._( "SQL语句:" )."</b> ".$Q, $LOG );

                return FALSE;

        }

        $cursor = @mysql_query( $Q, $C );

        if ( !$cursor ){

                printerror( "<b>"._( "SQL语句:" )."</b> ".$Q, $LOG );

        }

        return $cursor;

}

 //  general\crm\studio\modules\EntityRelease\CreateIndexFile.php[/color]

function createIndex( $ENTITY_NAME, $APP_PATH ){

        global $ROOT_PATH;

        $filePath = $ROOT_PATH."general/".$APP_PATH;

        if ( !file_exists( $filePath ) ){

                mkdir( $filePath, 448 );

        }

        $fileName = $filePath."/index.php";

        $file = fopen( $fileName, "w" );

        $fileContent = createindexcontent( $ENTITY_NAME );  //关键

        fwrite( $file, $fileContent );

        fclose( $file );

        createopjs( $filePath );

}

  // general\crm\studio\modules\EntityRelease\CreateIndexFile.php[/color]

function createIndexContent( $ENTITY_NAME ){

        $fileStr .= createindexphpheader( $ENTITY_NAME );

        $fileStr .= createindexhtml( );

        return $fileStr;

}

  // general\crm\studio\modules\EntityRelease\CreateIndexFile.php

function createIndexPHPHeader( $ENTITY_NAME ){[/color]

$fileStr .= "<?php\r\n\tinclude_once(\"general/crm/apps/crm/header.php\");\r\n\tinclude_once(\$g_CRM_PATH.\"/include/interface/list.interface.php\");\r\n\tinclude_once(\$g_STUDIO_PATH.\"/include/utility.ui.php\");\r\n\tinclude_once(\$g_PLATFORM_PATH.\"/base/auth.func.php\");\r\n\tinclude_once(\$g_STUDIO_PATH.\"/include/entity.class.php\");\r\n\tinclude_once(\$g_STUDIO_PATH.\"/include/entityAction.php\");\r\n\tinclude_once(\$g_STUDIO_PATH.\"/include/conditional.php\");\r\n\tinclude_once(\"inc/utility_org.php\");\r\n\tinclude_once(\"inc/utility_file.php\");\r\n\tinclude_once(\$g_CRM_PATH.\"/include/general.func.php\");\r\n\t[/color][color=#ff0000][b]\$ENTITY = \"".$ENTITY_NAME."\";[/b][/color][color=#0000ff]\r\n\tif(\$USER_VIEW == \"\"){\r\n\t\t\$USER_VIEW = getDefaultUView(\$ENTITY, \$LOGIN_USER_ID); //创建默认视图未处理\r\n\t}\r\n\t\$ModuleInfoArr = getModuleInfo(\$ENTITY);\r\n\t\$FieldDetialInfoARR = FieldDetialInfo(\$USER_VIEW);\r\n\t\$WHERE_CLAUSE = getWhereSQL(\$_SERVER['QUERY_STRING']);\r\n\t\$MODULE_ACTION = getModuleActionStr(\$ENTITY, \$USER_VIEW);\r\n\t\$MODULE_NORMAL_STR = getModuleNormalSearchStr(\$ENTITY);\r\n\t\$views = getUserViewList(\$ENTITY, \$LOGIN_USER_ID, \$LOGIN_DEPT_ID, \$LOGIN_USER_PRIV);\r\n\t\$VIEW_OPTION_TMPL = getViewSelOptionTmpl(\$views, \$USER_VIEW);\r\n\t\$PAGE_SIZE = \$_GET[\"PAGE_SIZE\"] == \"\" ? 10 : \$_GET[\"PAGE_SIZE\"];\r\n\t\$query = getViewQueryCountSQL(\$USER_VIEW, \$ENTITY, \$WHERE_CLAUSE, \$EXTENSION_AUTHORITY_CLAUSE);\r\n\t\$cursor = exequery(\$connection, \$query);\r\n\tif(\$result = mysql_fetch_array(\$cursor)){\r\n\t\t\$TOTAL_SIZE = \$result[0];\r\n\t}\r\n\t\$TOTAL_PAGE = ceil(\$TOTAL_SIZE/\$PAGE_SIZE);\r\n\tif(\$CUR_PAGE < 1){ \$CUR_PAGE = 1; }\r\n\tif(\$CUR_PAGE > \$TOTAL_PAGE){ \$CUR_PAGE = \$TOTAL_PAGE; }\r\n\t\$query = getViewQuerySQL(\$USER_VIEW, \$ENTITY, \$PAGE_SIZE, \$CUR_PAGE, \$ORDERFIELD, \$ORDERTYPE, \r\n\t\$WHERE_CLAUSE, \$CONFIGARR, \$EXTENSION_AUTHORITY_CLAUSE);\r\n\t\$cursor = exequery(\$connection, \$query);\r\n\r\n\t\$LIST_VIEW_DATA_HEAD_TMPL = getListViewHeaderTmpl(\$FieldDetialInfoARR, \$ORDERFIELD, \$ORDERTYPE, \$CONFIGARR);\r\n\t\$colorSchema = getColorSchema(\$USER_VIEW);\r\n\t\$LIST_VIEW_DATA_BODY_TMPL = getListViewDataBodyTmpl(\$cursor, \$FieldDetialInfoARR, \$colorSchema, \$PAGE_SIZE);\r\n\t\$QuickLinkStr = getModuleQuickLinkStr();\r\n\t\$RevisionHistoryStr = getModuleRevisionHistoryStr(\$ENTITY, \$EXTENSION_AUTHORITY_CLAUSE);\r\n\t\$FastNewStr = getModuleFastNewStr(\$ENTITY);\r\n?>\r\n";[/color]

return $fileStr;