admin/ajax.php

这里只显示每个文件的开头 60 行。登录后可以解锁完整代码。

微信扫码关注公众号，代码整理好后第一时间通知你。

<?php
require '../function/conn.php';
require '../function/function.php';
require '../function/mobile.php';

$action = $_GET["action"];
$typex = $_GET["type"];
$D_domain = splitx($_SERVER["HTTP_HOST"] . $_SERVER["PHP_SELF"], $C_admin, 0);

if ($_GET["lang"] != "") {
    $_SESSION["i"] = $_GET["lang"];
}

switch($typex){
case "download":
Header("Location:http://www.s-cms.cn/scms/product.csv");
break;
case "login":
$username=Replace_Text($_POST["user"]);
$pwd=Replace_Text($_POST["password"]);
$emailcode=t($_POST["emailcode"]);

if($_SESSION["CmsCode"]!=xcode($_POST["vcode"],'DECODE',$_SESSION["CmsCode"],0) || $_POST["vcode"]=="" || $_SESSION["CmsCode"]==""){//滑动验证码不正确
    die("vcode_error");
}else{
    $_SESSION["CmsCode"]="refresh";
    $sql="select * from ".TABLE."log where L_action='登录后台成功' and L_user='".$username."' order by L_id desc limit 1";
    $result = mysqli_query($conn, $sql);
    $row = mysqli_fetch_assoc($result);
    if(mysqli_num_rows($result) > 0) {
        $L_ip=$row["L_ip"];//获取到该管理员上次登录成功的IP
    }else{
        $L_ip="0.0.0.0";//此次为该管理员首次登录
    }

    $sql="select * from ".TABLE."admin where A_del=0 and A_login='".$username."' and A_pwd='".strtoupper(md5($pwd))."'";
    $result = mysqli_query($conn, $sql);
    $row = mysqli_fetch_assoc($result);
    if(mysqli_num_rows($result) > 0) {//帐号密码正确
        $A_email=$row["A_email"];

        if(($A_email=="XXXXX@qq.com" || $A_email=="" || strpos($A_email,"@")===false) && ($emailcode=="" || $emailcode=="undefined")){//管理员邮箱有误
            mysqli_query($conn, "update ".TABLE."config set C_test='123456'");
            die("ip_error2");
        }else{
            if(!checkip($L_ip) && $S_data[0]["S_login2"]==1){//IP验证未通过 && 开启了二次验证
                if($emailcode=="" || $emailcode=="undefined"){//没有传入邮箱验证码
                    $code=rand(111111, 999999);
                    mysqli_query($conn, "update ".TABLE."config set C_test='".$code."'");
                    $info=sendmail("邮箱验证码[".$code."]", "您[IP：".getip()."]正在进行登录[".$_SERVER["HTTP_HOST"]."]后台的操作，邮箱验证码为：<b>".$code."</b>，请在后台登录界面填写。", $A_email);
                    if($info=="success"){
                    	die("ip_error|***".substr($A_email,3));
                    }else{
                        //$check="success";
                    	die($info);
                    }
                    if(strpos($C_smsuse,"2")!==false){
                        sendmobile("【".$C_smssign."】您的验证码为".$code."；1分钟内有效,请尽快验证！",$C_sms);
                    }