• 重大发现...Discuz!NT2.0还安全吗?


    最近在写Blog程序,由于Sql server空间贵...用Access做了..但对于C#操作Access还是有些不了解..想借鉴一下Discuz!NT..没想到找不到事务处理... 

    看了Access与Sql版的Discuz!NT2.0竟然没有发现事务的身影~?

    难道都不需要事务处理了? 如何保证数据的完整性?是不是太想当然了?

    这算不算对用户的不负责任?

    还是我愚昧找不到保证数据完整性的处理代码? 望高人相助~

     

     附Access与Sql版的删除贴子代码

     

    Access版:

      /// <summary>
      /// 删除指定ID的帖子
      /// </summary>
      /// <param name="pid">帖子ID</param>
      /// <returns>删除数量</returns>
      public static int DeletePost(string posttableid,int pid)
      {
    //   OleDbParameter[] prams = {
    //            Database.MakeInParam("@pid",OleDbType.Integer,4,pid)
    //           };
       #region 存储过程转sql语句 DeletePost
       int fid=0;
       int tid=0;
       int posterid=0;
       int lastforumposterid=0;
       int layer=0;
       DateTime  postdatetime;
       string  poster="";
       int  postcount=0;
       string  title="";
       int lasttid=0;
       //int postid=0;
       int todaycount=0;

       string fidlist = "";

       string strSQL = "";

       DataTable dt=new DataTable();
     
       strSQL = "SELECT [fid], [tid], [posterid],[layer], [postdatetime] FROM [" + BaseConfigFactory.GetTablePrefix + "posts" +posttableid+"] WHERE pid =" + pid;
       DataRow dr=Database.ExecuteDataset(CommandType.Text,strSQL).Tables[0].Rows[0];
       fid=Convert.ToInt32(dr["fid"].ToString());
       tid=Convert.ToInt32(dr["tid"].ToString());
       posterid=Convert.ToInt32(dr["posterid"].ToString());
       layer=Convert.ToInt32(dr["layer"].ToString());
       postdatetime=Convert.ToDateTime(dr["postdatetime"].ToString());

       strSQL = "SELECT iif(([parentidlist] is null),'',[parentidlist]) as [fidlist] FROM [" + BaseConfigFactory.GetTablePrefix + "forums] WHERE [fid] =" + fid;
       fidlist = Database.ExecuteScalarToStr(CommandType.Text,strSQL);
       if (fidlist != "")
       {
        fidlist = string.Concat(fidlist,",",fid.ToString());
       }
       else
       {
        fidlist = fid.ToString();
       }

       if(layer!=0)
       {
        //--只删除一个帖子
        // --更新论坛总的回帖数
        strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "statistics] SET [totalpost]=[totalpost] - 1";
        Database.ExecuteNonQuery(CommandType.Text,strSQL);

        // --更新版块内总的回帖数
      
        if(Convert.ToDateTime(postdatetime).ToShortDateString()==DateTime.Now.ToShortDateString())
        {
         strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "forums] SET  [posts]=[posts] - 1, [todayposts]=[todayposts]-1 WHERE [fid] in ("+fidlist+")";
        } 
        else
        {
         strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "forums] SET  [posts]=[posts] - 1  WHERE [fid] in ("+fidlist+")";
        }
                    Database.ExecuteNonQuery(CommandType.Text,strSQL);

        //--更新用户总的回帖数
        strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "users] SET  [posts] = [posts]-1 WHERE [uid] ="+posterid;
        Database.ExecuteNonQuery(CommandType.Text, strSQL);
     
        //--更新主题总的回帖数
        strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "topics] SET [replies]=[replies] - 1 WHERE [tid]="+tid;
        Database.ExecuteNonQuery(CommandType.Text, strSQL);
     
        //--删除帖子
        strSQL = "DELETE FROM [" + BaseConfigFactory.GetTablePrefix + "posts" +posttableid+"] WHERE [pid]=" + pid;
        Database.ExecuteNonQuery(CommandType.Text, strSQL);
     
       }
       else
       {
        //--删除主题

                    strSQL = "SELECT COUNT([pid]) FROM [" + BaseConfigFactory.GetTablePrefix + "posts" +posttableid+"] WHERE [tid] = "+tid;
        postcount = Convert.ToInt32(Database.ExecuteDataset(CommandType.Text,strSQL).Tables[0].Rows[0][0].ToString());
      
        strSQL = "SELECT COUNT([pid]) FROM [" + BaseConfigFactory.GetTablePrefix + "posts" +posttableid+"] WHERE [tid] ="+tid+"  AND DATEDIFF(\"d\", [postdatetime], now()) = 0";
        todaycount = Convert.ToInt32(Database.ExecuteDataset(CommandType.Text,strSQL).Tables[0].Rows[0][0].ToString());
     
        //--更新主题及帖子总数
                    strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "statistics] SET [totaltopic]=[totaltopic] - 1, [totalpost]=[totalpost] -"+postcount;
        Database.ExecuteNonQuery(CommandType.Text,strSQL);
     
        //--更新版块
                    strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "forums] SET [posts]=[posts] -"+postcount+", [topics]=[topics] - 1,[todayposts]=[todayposts] -"+todaycount+" WHERE [fid] in ("+fidlist+")";
        Database.ExecuteNonQuery(CommandType.Text,strSQL);
     
        //--更新用户总的回帖数
        strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "users] SET [posts] = [posts] - "+postcount+ " WHERE [uid] = "+posterid;
        Database.ExecuteNonQuery(CommandType.Text,strSQL);
      
        strSQL = "DELETE FROM [" + BaseConfigFactory.GetTablePrefix + "posts" +posttableid+"] WHERE [tid] = "+tid;
        Database.ExecuteNonQuery(CommandType.Text,strSQL);
     
        strSQL = "DELETE FROM [" + BaseConfigFactory.GetTablePrefix + "topics] WHERE [tid] = "+tid;
        Database.ExecuteNonQuery(CommandType.Text,strSQL);
     
       }

       if (layer != 0)
       {
        strSQL = "SELECT TOP 1 [pid], [posterid],[postdatetime], [title], [poster] FROM [" + BaseConfigFactory.GetTablePrefix + "posts" +posttableid+"] WHERE [tid]="+tid+" ORDER BY [pid] DESC";
        dt=Database.ExecuteDataset(CommandType.Text,strSQL).Tables[0];
        if(dt.Rows.Count>0)
        {
         dr= dt.Rows[0];
         pid=Convert.ToInt32(dr["pid"].ToString());
         posterid=Convert.ToInt32(dr["posterid"].ToString());
         postdatetime=Convert.ToDateTime(dr["postdatetime"].ToString());
         title=dr["title"].ToString();
         poster=dr["poster"].ToString();
     
         strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "topics] SET [lastposter]='"+poster+"',[lastpost]='"+postdatetime.ToString()+"',[lastpostid]="+pid+",[lastposterid]="+posterid+" WHERE [tid]="+tid;
         Database.ExecuteNonQuery(CommandType.Text,strSQL);
        }

       }


       strSQL = "SELECT [lasttid] FROM [" + BaseConfigFactory.GetTablePrefix + "forums] WHERE [fid] ="+fid;
       lasttid=Convert.ToInt32(Database.ExecuteDataset(CommandType.Text,strSQL).Tables[0].Rows[0][0].ToString());


       if(lasttid == tid)
       {
       
        strSQL = "SELECT TOP 1 [pid], [tid],[posterid], [title], [poster], [postdatetime] FROM [" + BaseConfigFactory.GetTablePrefix + "posts" +posttableid+"] WHERE [fid] = "+fid+" ORDER BY [pid] DESC";
        dt=Database.ExecuteDataset(CommandType.Text,strSQL).Tables[0];
        if(dt.Rows.Count>0)
        {
         dr= dt.Rows[0];
         pid=Convert.ToInt32(dr["pid"].ToString());
         tid=Convert.ToInt32(dr["tid"].ToString());
         if (dr["posterid"] == null)
         {
          lastforumposterid = 0;
         }
         else
         {
          lastforumposterid=Convert.ToInt32(dr["posterid"].ToString());
         }
      
         postdatetime=Convert.ToDateTime(dr["postdatetime"].ToString());
         if (dr["title"] == null)
         {
          title = "";
         }
         else
         {
          title= dr["title"].ToString();
         }
      
         if (dr["poster"] == null)
         {
          poster = "";
         }
         else
         {
          poster=dr["poster"].ToString();
         }
      

         strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "forums] SET [lasttid]="+tid+",[lasttitle]='"+title+"',[lastpost]='"+postdatetime+"',[lastposter]='"+poster+"',[lastposterid]="+lastforumposterid+" WHERE [fid] in ("+fidlist+")";
         Database.ExecuteNonQuery(CommandType.Text,strSQL);

         strSQL = "SELECT TOP 1 [pid], [tid], [posterid], [postdatetime], [title], [poster] FROM [" + BaseConfigFactory.GetTablePrefix + "posts" +posttableid+"] WHERE [posterid]="+posterid +" ORDER BY [pid] DESC";
         dr= Database.ExecuteDataset(CommandType.Text,strSQL).Tables[0].Rows[0];
      
         pid=Convert.ToInt32(dr["pid"].ToString());
         //tid=Convert.ToInt32(dr["tid"].ToString());
         posterid=Convert.ToInt32(dr["posterid"].ToString());
         postdatetime=Convert.ToDateTime(dr["postdatetime"].ToString());
         if (dr["title"] == null)
         {
          title = "";
         }
         else
         {
          title= dr["title"].ToString();
         }
      
         //poster=dr["poster"].ToString();

         //--更新用户
         strSQL = "UPDATE [" + BaseConfigFactory.GetTablePrefix + "users] SET [lastpost] = '"+postdatetime+"',[lastpostid] = "+pid+",[lastposttitle] = '"+title+ "'  WHERE [uid] = "+posterid;
         Database.ExecuteNonQuery(CommandType.Text,strSQL);
        }
      
       }

    #endregion
       return postcount;
       //return Database.ExecuteNonQuery(System.Data.CommandType.StoredProcedure,BaseConfigFactory.GetTablePrefix+"deletepost" + posttableid + "bypid",prams);
      }

     

    Sql版存储过程:

     

     CREATE  PROCEDURE dnt_deletepost1bypid
     @pid int
    AS

     DECLARE @fid int
     DECLARE @tid int
     DECLARE @posterid int
     DECLARE @lastforumposterid int
     DECLARE @layer int
     DECLARE @postdatetime smalldatetime
     DECLARE @poster varchar(50)
     DECLARE @postcount int
     DECLARE @title nchar(60)
     DECLARE @lasttid int
     DECLARE @postid int
     DECLARE @todaycount int
     
     
     SELECT @fid = [fid],@tid = [tid],@posterid = [posterid],@layer = [layer], @postdatetime = [postdatetime] FROM [dnt_posts1] WHERE pid = @pid

     DECLARE @fidlist AS VARCHAR(1000)
     
     SET @fidlist = '';
     
     SELECT @fidlist = ISNULL([parentidlist],'') FROM [dnt_forums] WHERE [fid] = @fid
     IF RTRIM(@fidlist)<>''
      BEGIN
       SET @fidlist = RTRIM(@fidlist) + ',' + CAST(@fid AS VARCHAR(10))
      END
     ELSE
      BEGIN
       SET @fidlist = CAST(@fid AS VARCHAR(10))
      END

     IF @layer<>0

      BEGIN
       UPDATE [dnt_statistics] SET [totalpost]=[totalpost] - 1
       UPDATE [dnt_forums] SET
        [posts]=[posts] - 1,
        [todayposts]=CASE
             WHEN DATEPART(yyyy, @postdatetime)=DATEPART(yyyy,GETDATE()) AND DATEPART(mm, @postdatetime)=DATEPART(mm,GETDATE()) AND DATEPART(dd, @postdatetime)=DATEPART(dd,GETDATE()) THEN [todayposts] - 1
             ELSE [todayposts]
           END      
       WHERE (CHARINDEX(',' + RTRIM([fid]) + ',', ',' +
            (SELECT @fidlist AS [fid]) + ',') > 0)   
       UPDATE [dnt_users] SET   
        [posts] = [posts] - 1
       WHERE [uid] = @posterid
       UPDATE [dnt_topics] SET [replies]=[replies] - 1 WHERE [tid]=@tid
       DELETE FROM [dnt_posts1] WHERE [pid]=@pid
       
      END
     ELSE
      BEGIN
       SELECT @postcount = COUNT([pid]) FROM [dnt_posts1] WHERE [tid] = @tid
       SELECT @todaycount = COUNT([pid]) FROM [dnt_posts1] WHERE [tid] = @tid AND DATEDIFF(d, [postdatetime], GETDATE()) = 0
       UPDATE [dnt_statistics] SET [totaltopic]=[totaltopic] - 1, [totalpost]=[totalpost] - @postcount
        UPDATE [dnt_forums] SET [posts]=[posts] - @postcount, [topics]=[topics] - 1,[todayposts]=[todayposts] - @todaycount WHERE (CHARINDEX(',' + RTRIM([fid]) + ',', ',' +(SELECT @fidlist AS [fid]) + ',') > 0)
       
       UPDATE [dnt_users] SET
        [posts] = [posts] - @postcount     
       WHERE [uid] = @posterid
       DELETE FROM [dnt_posts1] WHERE [tid] = @tid
       DELETE FROM [dnt_topics] WHERE [tid] = @tid
     END 

    IF @layer<>0
      BEGIN
       SELECT TOP 1 @pid = [pid], @posterid = [posterid], @postdatetime = [postdatetime], @title = [title], @poster = [poster] FROM [dnt_posts1] WHERE [tid]=@tid ORDER BY [pid] DESC
       UPDATE [dnt_topics] SET [lastposter]=@poster,[lastpost]=@postdatetime,[lastpostid]=@pid,[lastposterid]=@posterid WHERE [tid]=@tid
      END
     SELECT @lasttid = [lasttid] FROM [dnt_forums] WHERE [fid] = @fid
     IF @lasttid = @tid
      BEGIN
       SELECT TOP 1 @pid = [pid], @tid = [tid],@lastforumposterid = [posterid], @title = [title], @postdatetime = [postdatetime], @poster = [poster] FROM [dnt_posts1] WHERE [fid] = @fid ORDER BY [pid] DESC
          
       UPDATE [dnt_forums] SET    
        [lasttid]=@tid,
        [lasttitle]=ISNULL(@title,''),
        [lastpost]=@postdatetime,
        [lastposter]=ISNULL(@poster,''),
        [lastposterid]=ISNULL(@lastforumposterid,'0')
       WHERE (CHARINDEX(',' + RTRIM([fid]) + ',', ',' +
            (SELECT @fidlist AS [fid]) + ',') > 0)   
       SELECT TOP 1 @pid = [pid], @tid = [tid],@posterid = [posterid], @postdatetime = [postdatetime], @title = [title], @poster = [poster] FROM [dnt_posts1] WHERE [posterid]=@posterid ORDER BY [pid] DESC
       
       UPDATE [dnt_users] SET   
        [lastpost] = @postdatetime,
        [lastpostid] = @pid,
        [lastposttitle] = ISNULL(@title,'')    
       WHERE [uid] = @posterid   
      END


    ~

    不知怎么的,我的电脑无法发表评论..公司和家里都一样.提交没反应.. 

    @怪怪
    像你这样的思想是不是有些投机?

    就像论坛积分互转之类的?难道允许A入账 B没有支出这种情况出现吗?

    @Cat Chen
    个人认为不稳定的产品还是不应该推出来

    @stonezhu

    discuz!NT2.0老早出了.
    http://www.discuznt.com/opensource.html 

    @戏水
    只是觉得,这种问题应该在产品说明中写明.让用户知道..不然就是一种欺骗....存在隐患

  • 相关阅读:
    Spring MVC-表单(Form)标签-单选按钮(RadioButton)示例(转载实践)
    Ubuntu 16.04中VirtualBox 5.1使用U盘/USB设备的方法
    Spring MVC-表单(Form)标签-复选框集合(Checkboxes)示例(转载实践)
    Ubuntu 16.04下减小/释放/清理VirtualBox虚拟硬盘文件的大小
    关注点分离
    谈代码注释
    DelegatingFilterProxy类的作用
    GOPS 2018全球运维大会上海站 参会感悟梳理
    Java switch case
    Android 微信网址分享添加网络图片
  • 原文地址:https://www.cnblogs.com/Randy0528/p/990303.html
Copyright © 2020-2023  润新知