It is terrible and shameful to have loopholes and do nothing!

　Security issue:

　Do you have permission to perform CURD? Because the parameters are in the address bar and can be modified (or the parameters are in the html page, you can use firebug to modify the source code), so before performing CURD, you must first check whether the operator Own this record, for example: query whether this record belongs to this operator based on the store ID and passed parameters. If it does not, it will prompt (illegal operation, has been recorded!, to achieve the purpose of warning)

For example:

/* * 校验是否有权限进行CURD */publicfunction check_rbac($theme_id){ $model=M(); $adm_session = es_session::get(md5(conf("BI_AUTH_KEY")), 1); $location_id=$adm_session['supplier_locations']; $map=array('id'=>$theme_id,'location_id'=>$location_id); $result=$model->where($map)->getField('id'); if(empty($result)){ $this->error('非法操作，已被记录！'); } }

The above has introduced that it is terrible and shameful to have loopholes and do nothing! , including relevant content, I hope it will be helpful to friends who are interested in PHP tutorials.