album add.php 修复,dedecms当中的/member/album_add.php SQL注入漏洞

首先用编辑器打开member文件夹下的album_add.php

找到以下代码段://生成文档ID

$arcID = GetIndexKey($arcrank,$typeid,$sortrank,$channelid,$senddate,$mid);

if(empty($arcID))

{

ShowMsg("无法获得主键，因此无法进行后续操作！","-1");

exit();

}

$description = HtmlReplace($description, -1);//2011.06.30 增加html过滤 (by:织梦的鱼)

//保存到主表

$inQuery = "INSERT INTO `#@__archives`(id,typeid,sortrank,flag,ismake,channel,arcrank,click,money,title,shorttitle,

color,writer,source,litpic,pubdate,senddate,mid,description,keywords,mtype)

VALUES ('$arcID','$typeid','$sortrank','$flag','$ismake','$channelid','$arcrank','0','$money','$title','$shorttitle',

'$color','$writer','$source','$litpic','$pubdate','$senddate','$mid','$description','$keywords','$mtypesid'); ";

在保存到主表这一行上方插入一行过滤代码, 解决问题:$mtypesid = intval($mtypesid);