WooYun.org

public static function createSub($uid, $clienttype = CLIENT_TYPE_MOBILE_WEB, $dinfo = array(), $domain = '.weibo.cn') {
		$params                 = array();
		/* 不支持cookie的情况 不允许renew */
		if (System::isWapRequest() && !user_info_device::supportCookie()) {
			$params['subrenewdisable'] = 1;
			$clienttype = CLIENT_TYPE_MOBILE_APP;
		}
        $ip                     = WapTool::getClientIP();
		$ua = (!empty($_GET['ua']) && !empty($_REQUEST['from'])) ? addslashes($_GET['ua']):$_SERVER['HTTP_USER_AGENT'];
		$dinfo['ua']			= $dinfo['ua'] ? $dinfo['ua'] : $ua;
        $dinfo                  = http_build_query($dinfo);
		$params['clienttype']   = $clienttype;
        $params['entry']        = WAPLOGIN_SSO_ENTRY;
        $params['uid']          = $uid;
        $params['domain']       = $domain;
        $params['ip']           = $ip;
        $params['dinfo']        = $dinfo;
        $params['m'] = md5($uid.$domain.$ip.$dinfo.$clienttype.WAPLOGIN_SSO_PIN);
        $url = WAPLOGIN_SSO_SESS_CREATE_URL . '?' . http_build_query($params);
        $ret = WapLogin::urlRequest($url, 1, 1);
        $ret = json_decode($ret, true);
        if (!$ret || $ret['retcode'] != '20000000' || !$ret['data']['sid']) {
			tttLogToFile('sub_create', date('H:i:s') . '|FAIL|' . self::reqFrom() . '|' . $_SERVER['REQUEST_URI'] . '|' .implode('|', $params) . '|' . json_encode($ret));
			return false;
		}
		tttLogToFile('sub_create', date('H:i:s') . '|SUSS|' . self::reqFrom() . '|' . $_SERVER['REQUEST_URI'] . '|' . implode('|', $params) . '|' . $ret['data']['sid']);
        return $ret['data']['sid'];
    }