ecmall2.x修改任意管理员和用户密码

app/find_password.php [php] function set_password() { if (!IS_POST) { ...... } else //POST提交 { if (empty($_POST['new_password']) || empty($_POST['confirm_password'])) { $this->show_warning("unsettled_required"); return ; } if (trim($_POST['new_password']) != trim($_POST['confirm_password'])) { $this->show_warning("password_not_equal"); return ; } $password = trim($_POST['new_password']); $passlen = strlen($password); if ($passlen < 6 || $passlen > 20) { $this->show_warning('password_length_error'); return; } $id = intval($_GET['id']);//虽然是过滤了,但是不影响利用. $word = $this->_rand(); $md5word = md5($word); $ms =& ms(); //连接用户系统 $ms->user->edit($id, '', array('password' => $password), true); //强制修改 !!问题就出在这儿,false是需要验证的,不知道程序员为什么要设置成非验证修改,偷懒也不是这么偷的吧... if ($ms->user->has_error()) { $this->show_warning($ms->user->get_error()); return; } $ret = $this->_password_mod->edit($id, array('activation' => $md5word)); $this->show_message("edit_success", 'login_in', 'index.php?app=member&act=login', 'back_index', 'index.php'); return ; } } [/php] includes/passports/default.passport.php [php] function edit($user_id, $old_password, $items, $force = false) { if (!$force) //为false时需要验证,为ture时直接跳过执行下面的操作 { $info = $this->get($user_id); if (md5($old_password) != $info['password']) { $this->_error('auth_failed'); return false; } } $edit_data = array(); if (isset($items['password'])) { $edit_data['password'] = md5($items['password']); } if (isset($items['email'])) { $edit_data['email'] = $items['email']; } if (empty($edit_data)) { return false; } //编辑本地数据 $this->_local_edit($user_id, $edit_data);//跟进 return true; } [/php] includes/passport.base.php [php] function _local_edit($user_id, $data) { $model_member =& m('member'); $model_member->edit($user_id, $data);\\执行update return true; } [/php] 访问:index.php?app=find_password&act=set_password&id=1 只需要POST提交new_password=123456&confirm_password=123456,当然不要忘了要修改的id,id是通过GET参数获得的. change

发表评论