WooYun.org

Islogin //判断登录的方法
sub islogin()
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then 
dim t0,t1,t2 
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie 
t1=sdcms.loadcookie("islogin")
t2=sdcms.loadcookie("loginkey")
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
//
sdcms.go "login.asp?act=out"
exit sub
else
dim data
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
if ubound(data)<0 then
sdcms.go "login.asp?act=out"
exit sub
else
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
sdcms.go "login.asp?act=out"
exit sub
else
adminid=data(0,0)
adminname=data(1,0)
admin_page_lever=data(5,0)
admin_cate_array=data(6,0)
admin_cate_lever=data(7,0)
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
if clng(admingroupid)<>0 then
admin_lever_where=" and menuid in("&admin_page_lever&")"
end if
sdcms.setsession "adminid",adminid
sdcms.setsession "adminname",adminname
sdcms.setsession "admingroupid",data(4,0)
end if
end if
end if
else
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
if ubound(data)<0 then
sdcms.go "login.asp?act=out"
exit sub
else
admin_page_lever=data(0,0)
admin_cate_array=data(1,0)
admin_cate_lever=data(2,0)
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
if clng(admingroupid)<>0 then
admin_lever_where=" and menuid in("&admin_page_lever&")"
end if
end if
end if
end sub