xinhu_gitee/webmain/webmainAction.php

<?php 
/**
	网址管理后台控制处理
*/
require(ROOT_PATH.'/include/Action.php');

class Action extends mainAction
{
	public $adminid		= 0;
	public $adminuser	= '';
	public $adminname	= '';
	public $admintoken	= '';
	public $companyid	= 0;
	public $loadci		= 0;
	public $flow;
	
	protected $ajaxbool 	= 'false';

	public function getlogin($lx=0)
	{
		$this->ajaxbool		= $this->rock->jm->gettoken('ajaxbool', 'false');
		$this->adminid		= (int)$this->getsession('adminid',0);
		$this->adminuser	= $this->getsession('adminuser');
		$this->adminname	= $this->getsession('adminname');
		$this->admintoken	= $this->getsession('admintoken');
		$this->companyid	= $this->getsession('companyid');
		$this->setNowUser($this->adminid, $this->adminname, $this->adminuser);
		$agid	 = $this->rock->get('agentid');
		if($agid!='')$this->rock->savesession(array('wxqyagentid' => $agid));
		$platsign= $this->rock->get('platsign');
		if($platsign!='')$this->rock->savesession(array('platsign' => $platsign));
		$olaizhi= $this->rock->get('olaizhi');
		if($olaizhi!='')$this->rock->savesession(array('olaizhi' => $olaizhi));
		if($lx==0)$this->logincheck();
	}

	public function setNowUser($uid, $uname, $user='')
	{
		$this->rock->adminid	= $uid;
		$this->rock->adminname	= $uname;
		$this->rock->adminuser	= $user;
	}
	
	public function pannouser()
	{
		$nots = getconfig('notuserids');
		if($nots && contain(','.$nots.',',','.$this->adminid.','))exit('无效用户登录');
	}
	
	//免登录验证，用于订阅报表的
	private function loginsubscribe()
	{
		$subscribe_key 	= $this->post('subscribe_key');
		$subscribe_post = $this->post('subscribe_post');
		if(isempt($subscribe_key) || isempt($subscribe_post))return false;
		$url	= $this->rock->nowurl();
		$time 	= time(); $time1 = $time+1;
		$keyarr	= array(md5($url.$time.$subscribe_post),md5($url.$time1.$subscribe_post));
		if(!in_array($subscribe_key, $keyarr))return false;
		$opkey 	= $this->option->getval('subscribe_key');
		if(!in_array($opkey, $keyarr))return false;
		$adminid 		= (int)$this->post('subscribe_adminid','0');
		$this->setNowUser($adminid,'');
		return true;
	}
	
	protected function loginnot($ismo=false)
	{
		if($this->loginsubscribe())return;//免验证
		$uid = (int)$this->getsession('adminid',0);
		if($uid==0){
			$lurl = '?m=login';
			if($this->rock->ismobile() || $ismo)$lurl='?d=we&m=login';
			if(ENTRANCE != 'index')$lurl = 'index.php'.$lurl.'';
			$backurl   = $this->rock->jm->base64encode($this->rock->nowurl());
			if($backurl!='' && M!='index')$lurl = $lurl.'&backurl='.$backurl.'';
			if(!isajax())$this->rock->location($lurl); //不是ajax跳转到登录页面
			echo '没有登录，去<a href="'.$lurl.'">[登录]</a>';
			exit();
		}
	}
	
	protected function logincheck()
	{
		$this->loginnot();
	}
	
	public function initProject()
	{
		$this->getlogin();
		if($this->rock->get('ajaxbool')=='true')return;
		$this->smartydata['adminid']	= $this->adminid;
		$this->smartydata['adminuser']	= $this->adminuser;
		$this->smartydata['adminname']	= $this->adminname;
		$this->smartydata['logintime']	= $this->getsession('logintime');
		$cenghei	= (int)$this->get('cenghei','0');
		if($cenghei==0)$cenghei = $this->getsession('cenghei','0');
		$this->assign('cenghei', $cenghei);
		$this->rock->savesession(array('cenghei' => $cenghei));
	}
	
	private function iszclogin()
	{
		$this->pannouser();
		if($this->loginsubscribe())return;//免验证
		$token = $this->admintoken;
		if(isempt($token))exit('sorry1');
		$lastt = date('Y-m-d H:i:s',time()-24*3600);
		$rs = m('logintoken')->getone("`uid`='$this->adminid' and `token`='$token' and `online`=1 and `moddt`>='$lastt'",'`moddt`');
		if(!$rs)$this->backmsg('登录失效，请重新登录');
	}
	
	public function backmsg($msg='', $demsg='保存成功', $da=array())
	{
		backmsg($msg,$demsg,$da);
	}
	
	public function limitRows($table,$fields='*',$wherea='1=1',$order='',$arr=array())
	{
		$where		= $this->request('where');
		$keywhere	= $this->request('keywhere');
		if(!isempt($where)){
			$where 		= $this->jm->uncrypt($this->rock->iconvsql($where));
			$where  	= $this->db->filterstr($this->rock->covexec($where));
		}
		if(!isempt($keywhere)){
			$keywhere 	= $this->jm->uncrypt($this->rock->iconvsql($keywhere));
			$keywhere  	= $this->db->filterstr($this->rock->covexec($keywhere));
		}
		
		$wherea	  .= " $where $keywhere";
		$order	   = $this->getOrder($order);
		$group	   = '';
		if(isset($arr['group']) && !isempt($arr['group']))$group="GROUP BY ".$arr['group']." ";
		
		$limitall	= false;
		if(isset($arr['all']))$limitall= $arr['all'];
		
		if(isset($arr['sou'])){
			$wherea		= str_replace($arr['sou'],$arr['rep'],$wherea);
			$order		= str_replace($arr['sou'],$arr['rep'],$order);
		}
		$sql		= "select[SQL_CALC] $fields from $table where $wherea $group $order ";
		$total		= 0;
		if($group!=''){
			$sql		= str_replace('[SQL_CALC]', ' SQL_CALC_FOUND_ROWS', $sql);
		}else{
			$sql		= str_replace('[SQL_CALC]','',$sql);
			$total 		= $this->db->rows($table, $wherea);
		}
		if(!$limitall)$sql.=' '.$this->getLimit();
		$rows		= $this->db->getall($sql);
		if($group!='')$total = $this->db->found_rows();
		if(!is_array($rows))$rows = array();
		return array(
			'total'	=> $total,
			'rows'	=> $rows,
			'sql'	=> $this->db->nowsql
		);
	}
	
	public function getLimit()
	{
		$start  = (int)$this->rock->post('start',0);
		$limit  = (int)$this->rock->post('limit',15);
		$str	= '';
		if($limit > 0)$str =" limit $start,$limit";	
		return $str;
	}
	
	public function getOrder($order='')
	{
		$sort  		= $this->rock->iconvsql($this->post('sort'),1);
		$dir  		= strtolower($this->post('dir'));
		$highorder	= $this->rock->iconvsql($this->post('highorder'));
		$asort		= '';
		if($sort != '' && $dir !=''){
			if(!contain('ascdesc',$dir))$dir='desc';
			$sorta	= $sort;
			$asort=' '.$sorta.' '.$dir.'';
		}
		if($asort != '')$order = $asort;
		if($highorder != '')$order = $highorder;
		if($order != '')$order=" order by $order ";
		return $order;
	}

	public function publicdelAjax()
	{
		$this->iszclogin();
		$id		= c('check')->onlynumber($this->rock->post('id'));
		$table	= $this->rock->iconvsql($this->rock->post('table','',1),1);
		$modenum= $this->rock->post('modenum');
		if(getconfig('systype')=='demo')$this->showreturn('', '演示数据禁止删除', 201);
		if($id=='')$this->showreturn('', 'sorry', 201);
		$isadmin= (int)$this->getsession('isadmin');
		$deltba = array('todo','option','menu','wouser');
		if($modenum==''){
			if($isadmin != 1 && $table!='todo')$this->showreturn('','只有管理员才能操作' , 201);
			if(substr($table,0,5)=='flow_' || in_array($table, $deltba)){
				m($table)->delete("`id` in($id)");
			}else{
				$this->showreturn('','未设置删除权限' , 201);
			}
		}else{
			$aid	= explode(',', $id);
			foreach($aid as $mid){
				$msg 	= m('flow')->deletebill($modenum, $mid, '');
				if($msg != 'ok')$this->showreturn('', $msg, 201);
			}
		}
		$this->showreturn('');
	}	
	
	public function publicstoreAjax()
	{
		$this->iszclogin();
		$table			= $this->rock->xssrepstr($this->rock->iconvsql($this->request('tablename_abc','',1),1));
		$fields			= '*';
		$group			= '';
		$order			= $this->rock->iconvsql($this->request('defaultorder'));
		$aftera			= $this->request('storeafteraction');
		$modenum		= $this->post('modenum');
		$atype			= $this->post('atype');
		$execldown		= $this->request('execldown');
		$this->loadci	= (int)$this->request('loadci');
		$where			= '1=1 ';
		$beforea		= $this->request('storebeforeaction');
		$tables 		= $this->T($table);
		
		if($modenum != ''){
			$this->flow = m('flow')->initflow($modenum);
			$nas		= $this->flow->billwhere($this->adminid, $atype);
			$_wehs		= $nas['where'];
			if(!isempt($nas['order']))$order 	= $nas['order'];
			if(!isempt($nas['fields']))$fields 	= $nas['fields'];
			if(!isempt($this->rock->arrvalue($nas, 'group')))$group = $nas['group'];
			if($_wehs!='')$where .= ' '.$_wehs.' ';
			$_tabsk		= $nas['table'];
			if(contain($_tabsk,' ')){
				$tables	= $_tabsk;
			}else{
				$table	= $_tabsk;
				$tables = $this->T($table);
			}
		}
		if($beforea != ''){
			if(method_exists($this, $beforea)){
				$nas	= $this->$beforea($table);
				if(is_array($nas)){
					if(isset($nas['where']))$where .= $nas['where'];
					if(isset($nas['order']))$order = $nas['order'];
					if(isset($nas['fields']))$fields = $nas['fields'];
					if(isset($nas['table']))$tables = $nas['table'];
					if(isset($nas['group']))$group = $nas['group'];
				}else{
					$where .= $nas;
				}
			}
		}
		if($tables==PREFIX)exit('无效的访问');
		$arr	= $this->limitRows($tables, $fields, $where, $order, array(
			'group' => $group
		));
		$total	= $arr['total'];
		$rows	= $arr['rows'];

		$bacarr	= array(
			'totalCount'=> $total,
			'rows'		=> $rows
		);
		if(method_exists($this, $aftera)){
			$narr	= $this->$aftera($table, $rows);
			if(is_array($narr)){
				foreach($narr as $kv=>$vv)$bacarr[$kv]=$vv;
			}
		}
		if($this->flow){
			$rows = $bacarr['rows'];
			foreach($rows as $k=>$rs){
				if(isset($rs['status'])){
					$rs['statustext'] 	= $this->flow->getstatus($rs,'','',1);
					if($rs['status']==5)$rs['ishui'] 		= 1;
				}
				$rows[$k] 				= $this->flow->rsreplace($rs,2, $this);
			}
			$bacarr['rows'] = $this->flow->daochusubtable($rows);
		}
		if($execldown == 'true'){
			$this->exceldown($bacarr);
			return;
		}
		$this->returnjson($bacarr);
	}
	
	
	/**
	*	验证签名
	*/
	public function checksignature($table)
	{
		if(!getconfig('checksign'))return true;//不验证
		$sign = $this->post('sys_signature');
		$time = $this->post('sys_timeature');
		$signs= md5($this->rock->nowurl().$table.$time.'_'.$this->adminid);
		return ($sign==$signs);
	}
	
	/**
	*	公共保存页面
	*/
	public function publicsaveAjax()
	{
		$this->iszclogin();
		$msg	= '';
		$success= false;
		$table	= $this->rock->xssrepstr($this->rock->iconvsql($this->post('tablename_postabc','',1),1));
		$id		= (int)$this->post('id');
		$oldrs  = false;
		if(isempt($table))return returnerror('错误表名');
		if(!$this->checksignature($this->post('tablename_postabc')))return returnerror('无效请求');
		$db		= m($table);
		$where	= "`id`='$id'";
		if($id==0)$where='';
		$modenum 			= $this->post('sysmodenumabc');
		$flow 				= null;
		$msgerrortpl 		= $this->post('msgerrortpl');
		$aftersavea			= $this->post('aftersaveaction', 'publicaftersave');
		$beforesavea		= $this->post('beforesaveaction', 'publicbeforesave');
		$submditfi 			= $this->rock->jm->base64decode($this->post('submitfields_postabc'));
		$editrecord			= $this->post('editrecord_postabc'); //是否保存修改记录
		$fileid 			= $this->post('fileid', '0');
		$isturn 			= (int)$this->post('isturn_postabc', '1');
		$int_type 			= ','.$this->post('int_filestype').',';
		$md5_type 			= ','.$this->post('md5_filestype').',';
		
		if(isempt($submditfi))return returnerror('无效字段');
		
		if($modenum!='')$flow = m('flow')->initflow($modenum);
		$fields	= explode(',', $submditfi);
		
		$uaarr	= array();
		foreach($fields as $field){
			$field	= $this->rock->xssrepstr($field);
			$val	= $this->post(''.$field.'');
			$type	= $this->post(''.$field.'_fieldstype');
			$boa	= true;
			if($this->contain($int_type, ','.$field.',')){
				$val = (int)$val;
			}
			if($this->contain($md5_type, ','.$field.',')){
				if($val=='')$boa=false;
				$val = md5($val);
			}
			if($boa)$uaarr[$field]=$val;
		}
		
		$otherfields		= $this->post('otherfields');
		$addotherfields		= $this->post('add_otherfields');
		$editotherfields	= $this->post('edit_otherfields');
		if($id == 0)$otherfields.=','.$addotherfields.'';
		if($id > 0)$otherfields.=','.$editotherfields.'';
		if($otherfields != ''){
			$otherfields = str_replace(array('{now}','{date}','{admin}','{adminid}'),array($this->now,date('Y-m-d'),$this->adminname,$this->adminid),$otherfields);
			if(contain($otherfields,'{companyid}'))$otherfields = str_replace('{companyid}',m('admin')->getcompanyid(),$otherfields);
			$fiarsse = explode(',', $otherfields);
			foreach($fiarsse as $ffes){
				if($ffes!=''){
					$ssare = explode('=', $ffes);
					$lea	= substr($ssare[1],0,1);
					if($lea == '['){
						$uaarr[$ssare[0]]=$uaarr[substr($ssare[1],1,-1)];
					}else{
						$uaarr[$ssare[0]]=$ssare[1];
					}
				}
			}
		}
		
		$ss 	= '';
		if(!$this->isempt($beforesavea)){
			if(method_exists($this, $beforesavea)){
				$befa = $this->$beforesavea($table, $uaarr, $id);
				if(is_string($befa)){
					$ss = $befa;
				}else{
					if(isset($befa['msg']))$ss=$befa['msg'];
					if(isset($befa['rows'])){
						foreach($befa['rows'] as $bk=>$bv)$uaarr[$bk]=$bv;
					}
				}
			}	
		}
		$msg 	= $ss;	
		$idadd 	= false;
		if($msg == ''){
			if($id>0 && $editrecord=='true')$oldrs = $db->getone($id);
			$sbo	= $db->record($uaarr, $where);
			if($sbo){
				$msg	= '处理成功';
				$success= true;
				if($id == 0){
					$id = $this->db->insert_id();
					$idadd = true;
				}
				if($fileid !='0')m('file')->addfile($fileid,$table,$id, $modenum);
				if(!$this->isempt($aftersavea)){
					if(method_exists($this, $aftersavea)){
						$this->$aftersavea($table, $uaarr, $id, $idadd);
					}
				}
				//保存修改记录
				if($oldrs && $flow!=null){
					$newrs = $db->getone($id);
					m('edit')->recordstr($flow->fieldsarr,$flow->mtable, $id, $oldrs, $newrs, 2);
				}
			}else{
				$msg = 'mysqlerr:'.$this->db->lasterror();
			}
		}
		
		if($msg=='')$msg='处理失败';
		$arr = array('success'=>$success,'msg'=>$msg,'id'=>$id);
		echo json_encode($arr);
	}
	
	public function publicsavevalueAjax()
	{
		$this->iszclogin();
		$table	= $this->rock->xssrepstr($this->rock->iconvsql($this->post('tablename','',1),1));
		if(!$this->checksignature($this->post('tablename')))return '无效请求';
		$noupf	= array('pass','user');
		$id		= c('check')->onlynumber($this->post('id', '0'));
		$fields	= $this->post('fieldname');
		if(in_array(strtolower($fields), $noupf))return 'error';
		$value	= $this->post('value');
		$where	= "`id` in($id)";
		m($table)->record(array($fields=>$value), $where);
		$fiesa  = $this->rock->request('fieldsafteraction');
		if($fiesa!=''){
			if(method_exists($this, $fiesa)){
				$this->$fiesa($table, $fields, $value, $id);
			}	
		}
		echo 'success';
	}
	
	public function exceldown($arr)
	{
		$fields = explode(',', $this->post('excelfields','',1));
		$header = explode(',', $this->post('excelheader','',1));
		$title	= $this->post('exceltitle','',1);
		$rows	= $arr['rows'];
		$exceltype	= $this->post('exceltype','xls'); //保存文件类型
		if(!in_array($exceltype, array('doc','html')))$exceltype = 'xls';
		$headArr	= array();
		for($i=0; $i<count($fields); $i++){
			$headArr[$fields[$i]] = $header[$i];
		}
		$url 		= c('html')->execltable($title, $headArr, $rows, $exceltype);
		$this->returnjson(array(
			'url'		=> $url, 
			'totalCount'=> $arr['totalCount'],
			'downCount' => count($rows)
		));
	}
	
	public function getoptionAjax()
	{
		$num = $this->get('num');
		$arr = m('option')->getdata($num);
		echo json_encode($arr);
	}
	
	public function filejsbase()
	{
		$url = getconfig('rockfile_url');
		if(!$url)return '';
		return '<script src="'.$url.'?m=filejs&key='.getconfig('rockfile_key').'&a=base&optid='.$this->adminid.'&optname='.$this->jm->base64encode($this->adminname).'"></script>'.chr(10).'';
	}
}

class ActionNot extends Action
{
	public function publicsavevalueAjax(){}
	public function publicsaveAjax(){}
	public function publicdelAjax(){}
	public function publicstoreAjax(){}
	public function publictreestoreAjax(){}
	public function getoptionAjax(){}
	protected function logincheck(){}
	
	/**
	*	手机端/单据详情页判断有没有登录就根据cookie登录
	*/
	protected function mweblogin($lx=0, $ismo=false)
	{
		$uid 	= m('login')->autologin((int)$this->get('adminid','0'), $this->get('token'));
		if($uid==0){
			$this->loginnot($ismo);
		}else{
			$this->initProject(); //登录成功
		}
		$this->adminid 		= $uid;
		return $uid;
	}
}