CVE-2018-6656 (Other, published 2018-02-06T14:29Z)
Description: value: Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/zblogcn/zblogphp
Files changed:
.gitignore
Commit message: 删除AppCentre


Vulnerable code:
!/zb_users/plugin/AppCentre
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';

$zbp->Load();

$action = 'root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}

if (!$zbp->CheckPlugin('AppCentre')) {$zbp->ShowError(48);die();}

function rrmdir($dir) {
	if (is_dir($dir)) {
		$objects = scandir($dir);
		foreach ($objects as $object) {
			if ($object != '.' && $object != '..') {
				if (filetype($dir . '/' . $object) == 'dir') {
					rrmdir($dir . '/' . $object);
				} else {
					unlink($dir . '/' . $object);
				}

			}
		}
		reset($objects);
		rmdir($dir);
	}
}

rrmdir($zbp->usersdir . $_GET['type'] . '/' . $_GET['id']);
if ($_GET['type'] == "theme") {
	rrmdir($zbp->usersdir . '/cache/template/' . $_GET['id']);
}

Redirect($_SERVER["HTTP_REFERER"]);
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';

$zbp->Load();

$action = 'root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}

if (!$zbp->CheckPlugin('AppCentre')) {$zbp->ShowError(48);die();}

$type = $_GET['type'];

$id = $_GET['id'];

$app = new App;

if (!$app->LoadInfoByXml($type, $id)) {
	exit;
}

ob_clean();

if (
	function_exists('gzencode') &&
	$zbp->Config('AppCentre')->enablegzipapp &&
	$app->adapted > 140614// 1.3和之前版本不打包为gzba
) {
	header('Content-Disposition:attachment;filename=' . $id . '.gzba');
	echo AppCentre_Pack($app, true);
} else {
	header('Content-Disposition:attachment;filename=' . $id . '.zba');
	echo AppCentre_Pack($app, false);
}
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';

$zbp->Load();

$action = 'root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}
if (!$zbp->CheckPlugin('AppCentre')) {$zbp->ShowError(48);die();}
if (!$zbp->ValidToken(GetVars('token', 'GET'))) {$zbp->ShowError(5, __FILE__, __LINE__);die();}
foreach ($_FILES as $key => $value) {
	if ($_FILES[$key]['error'] == 0) {
		if (is_uploaded_file($_FILES[$key]['tmp_name'])) {
			$tmp_name = $_FILES[$key]['tmp_name'];
			$name = $_FILES[$key]['name'];

			$xml = file_get_contents($tmp_name);
			if (App::UnPack($xml)) {
				$zbp->SetHint('good', '上传APP并解压成功!');
				Redirect($_SERVER["HTTP_REFERER"]);
			} else {
				$zbp->SetHint('bad', $zbp->lang['error']['64']);
				Redirect($_SERVER["HTTP_REFERER"]);
			}
			;
		}
	} else {
		$zbp->SetHint('bad', $zbp->lang['error']['88']);
	}

}

Redirect($_SERVER["HTTP_REFERER"]);
<?php
require '../../../zb_system/function/c_system_base.php';
require '../../../zb_system/function/c_system_admin.php';
require dirname(__FILE__) . '/function.php';
$zbp->Load();

$action = 'root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}
if (!$zbp->CheckPlugin('AppCentre')) {$zbp->ShowError(48);die();}

if (!$zbp->Config('AppCentre')->username || !$zbp->Config('AppCentre')->password) {
	$blogtitle = '应用中心-登录应用商城';
} else {
	$blogtitle = '应用中心-我的应用仓库';
}

if (GetVars('act') == 'login') {

	$s = Server_Open('vaild');
	if ($s) {

		$zbp->Config('AppCentre')->username = GetVars("app_username");
		$zbp->Config('AppCentre')->password = $s;
		$zbp->SaveConfig('AppCentre');

		$zbp->SetHint('good', '您已成功登录APP应用中心.');
		Redirect('./main.php');
		die;
	} else {
		$zbp->SetHint('bad', '用户名或密码错误.');
		Redirect('./client.php');
		die;
	}
}

if (GetVars('act') == 'logout') {
	$zbp->Config('AppCentre')->username = '';
	$zbp->Config('AppCentre')->password = '';
	$zbp->SaveConfig('AppCentre');
	$zbp->SetHint('good', '您已退出APP应用中心.');
	Redirect('./client.php');
	die;
}

require $blogpath . 'zb_system/admin/admin_header.php';
require $blogpath . 'zb_system/admin/admin_top.php';
?>
<div id="divMain">

  <div class="divHeader"><?php echo $blogtitle;?></div>
<div class="SubMenu"><?php AppCentre_SubMenus(9);?></div>
  <div id="divMain2">
<?php if (!$zbp->Config('AppCentre')->username) {?>
            <div class="divHeader2">应用中心账户登录</div>
            <form action="?act=login" method="post">
              <table style="line-height:3em;" width="100%" border="0">
                <tr height="32">
                  <th  align="center">账户登录
                    </td>
                </tr>
                <tr height="32">
                  <td  align="center">用户名:
                    <input type="text" name="app_username" value="" style="width:40%"/></td>
                </tr>
                <tr height="32">
                  <td  align="center">密&nbsp;&nbsp;&nbsp;&nbsp;码:
                    <input type="password" name="app_password" value="" style="width:40%" /></td>
                </tr>
                <tr height="32" align="center">
                  <td align="center"><input type="submit" value="登陆" class="button" /></td>
                </tr>
              </table>
            </form>
<?php } else {

//已登录
	Server_Open('shoplist');

}
?>



	<script type="text/javascript">ActiveLeftMenu("aAppCentre");</script>
	<script type="text/javascript">AddHeaderIcon("<?php echo $bloghost . 'zb_users/plugin/AppCentre/logo.png';?>");</script>
  </div>
</div>

<?php
require $blogpath . 'zb_system/admin/admin_footer.php';
RunTime();
?>
<?php

function AppCentre_SubMenus($id) {
	//m-now
	global $zbp;

	echo '<a href="main.php"><span class="m-left ' . ($id == 1 ? 'm-now' : '') . '">浏览在线应用</span></a>';
	echo '<a href="main.php?method=check"><span class="m-left ' . ($id == 2 ? 'm-now' : '') . '">检查应用更新</span></a>';
	echo '<a href="update.php"><span class="m-left ' . ($id == 3 ? 'm-now' : '') . '">系统更新与校验</span></a>';

	if ($zbp->Config('AppCentre')->username && $zbp->Config('AppCentre')->password) {
		echo '<a href="client.php"><span class="m-left ' . ($id == 9 ? 'm-now' : '') . '">我的应用仓库</span></a>';
	} else {
		echo '<a href="client.php"><span class="m-left ' . ($id == 9 ? 'm-now' : '') . '">登录应用商城</span></a>';
	}

	echo '<a href="setting.php"><span class="m-right ' . ($id == 4 ? 'm-now' : '') . '">设置</span></a>';
	echo '<a href="plugin_edit.php"><span class="m-right ' . ($id == 5 ? 'm-now' : '') . '">新建插件</span></a>';
	echo '<a href="theme_edit.php"><span class="m-right ' . ($id == 6 ? 'm-now' : '') . '">新建主题</span></a>';
}

function AppCentre_GetCheckQueryString() {
	global $zbp;
	$check = '';
	$app = new app;
	if ($app->LoadInfoByXml('theme', $zbp->theme) == true) {
		$check .= $app->id . ':' . $app->modified . ';';
	}
	foreach (explode('|', $zbp->option['ZC_USING_PLUGIN_LIST']) as $id) {
		$app = new app;
		if ($app->LoadInfoByXml('plugin', $id) == true) {
			$check .= $app->id . ':' . $app->modified . ';';
		}
	}
	return $check;
}

function Server_Open($method) {
	global $zbp, $blogversion;

	switch ($method) {
	case 'down':
		Add_Filter_Plugin('Filter_Plugin_Zbp_ShowError', 'ScriptError', PLUGIN_EXITSIGNAL_RETURN);
		header('Content-type: application/x-javascript; Charset=utf-8');
		ob_clean();
		$s = Server_SendRequest(APPCENTRE_URL . '?down=' . GetVars('id', 'GET'));
		if (App::UnPack($s)) {
			$zbp->SetHint('good', '下载APP并解压安装成功!');
		}
		;
		die();
		break;
	case 'search':
		if (trim(GetVars('q', 'GET')) == '') {
			continue;
		}

		$s = Server_SendRequest(APPCENTRE_URL . '?search=' . urlencode(GetVars('q', 'GET')));
		echo str_replace('%bloghost%', $zbp->host . 'zb_users/plugin/AppCentre/main.php', $s);
		break;
	case 'view':
		$s = Server_SendRequest(APPCENTRE_URL . '?' . GetVars('QUERY_STRING', 'SERVER'));
		if (strpos($s, '<!--developer-nologin-->') !== false) {
			if ($zbp->Config('AppCentre')->username || $zbp->Config('AppCentre')->password) {
				$zbp->Config('AppCentre')->username = '';
				$zbp->Config('AppCentre')->password = '';
				$zbp->SaveConfig('AppCentre');
			}
		}
		if (strpos($s, '<!--shop-nologin-->') !== false) {
			if ($zbp->Config('AppCentre')->shop_username || $zbp->Config('AppCentre')->shop_password) {
				$zbp->Config('AppCentre')->shop_username = '';
				$zbp->Config('AppCentre')->shop_password = '';
				$zbp->SaveConfig('AppCentre');
			}
		}
		if (strpos($s, 'app.zblogcn.com') === false) {
			$zbp->ShowHint('bad', '后台访问应用中心故障，不能登录和下载应用，请检查主机空间是否能远程访问app.zblogcn.com。');
		}

		echo str_replace('%bloghost%', $zbp->host . 'zb_users/plugin/AppCentre/main.php', $s);
		break;
	case 'check':
		$s = Server_SendRequest(APPCENTRE_URL . '?check=' . urlencode(AppCentre_GetCheckQueryString())) . '';
		echo str_replace('%bloghost%', $zbp->host . 'zb_users/plugin/AppCentre/main.php', $s);
		break;
	case 'checksilent':
		header('Content-type: application/x-javascript; Charset=utf-8');
		ob_clean();
		$s = Server_SendRequest(APPCENTRE_URL . '?blogsilent=1' . ($zbp->Config('AppCentre')->checkbeta ? '&betablog=1' : '') . '&check=' . urlencode(AppCentre_GetCheckQueryString())) . '';
		if (strpos($s, ';') !== false) {
			$newversion = substr($s, 0, 6);
			$s = str_replace(($newversion . ';'), '', $s);
			if ((int) $newversion > (int) $blogversion) {
				echo '$(".main").prepend("<div class=\'hint\'><p class=\'hint hint_tips\'>提示:Z-BlogPHP有新版本,请用APP应用中心插件的<a href=\'../../zb_users/plugin/AppCentre/update.php\'>“系统更新与校验”</a>升级' . $newversion . '版(' . ($zbp->Config('AppCentre')->checkbeta ? 'Beta' : '') . ').</p></div>");';
			}
		}
		if ($s != 0) {
			echo '$(".main").prepend("<div class=\'hint\'><p class=\'hint hint_tips\'>提示:有' . $s . '个应用需要更新,请在应用中心的<a href=\'../../zb_users/plugin/AppCentre/main.php?method=check\'>“检查应用更新”</a>页升级.</p></div>");';
		}
		die();
		break;
	case 'vaild':
		$data = array();
		$data["username"] = GetVars("app_username");
		$data["password"] = md5(GetVars("app_password"));
		$s = Server_SendRequest(APPCENTRE_URL . '?vaild', $data);
		return $s;
		break;
	case 'submitpre':
		$s = Server_SendRequest(APPCENTRE_URL . '?submitpre=' . urlencode(GetVars('id')));
		return $s;
	case 'submit':
		$app = New App;
		$app->LoadInfoByXml($_GET['type'], $_GET['id']);
		$data["zba"] = $app->Pack();
		$s = Server_SendRequest(APPCENTRE_URL . '?submit=' . urlencode(GetVars('id')), $data);
		return $s;
	case 'shopvaild':
		$data = array();
		$data["shop_username"] = GetVars("shop_username");
		$data["shop_password"] = md5(GetVars("shop_password"));
		$s = Server_SendRequest(APPCENTRE_URL . '?shopvaild', $data);
		return $s;
		break;
	case 'shoplist':
		$s = Server_SendRequest(APPCENTRE_URL . '?shoplist');
		echo str_replace('%bloghost%', $zbp->host . 'zb_users/plugin/AppCentre/main.php', $s);
		break;
	case 'apptype':
		$zbp->Config('AppCentre')->apptype = GetVars("type");
		$zbp->SaveConfig('AppCentre');
		Redirect('main.php');
		break;
	default:
		# code...
		break;
	}

}

function Server_SendRequest($url, $data = array(), $u = '', $c = '') {
	global $zbp;

	$un = $zbp->Config('AppCentre')->username;
	$ps = $zbp->Config('AppCentre')->password;
	$c .= ' apptype=' . urlencode($zbp->Config('AppCentre')->apptype) . '; ';
	$c .= ' app_guestver=' . urlencode('2.0') . '; ';
	$c .= ' app_host=' . urlencode($zbp->host) . '; ';
	$c .= ' app_email=' . urlencode($zbp->user->Email) . '; ';
	$c .= ' app_user=' . urlencode($zbp->user->Name) . '; ';
	if ($un && $ps) {
		$c .= "username=" . urlencode($un) . "; password=" . urlencode($ps);
	}

	$shopun = $zbp->Config('AppCentre')->shop_username;
	$shopps = $zbp->Config('AppCentre')->shop_password;

	if ($shopun && $shopps) {
		if ($c !== '') {
			$c .= '; ';
		}

		$c .= "shop_username=" . urlencode($shopun) . "; shop_password=" . urlencode($shopps);
	}

	$u = 'ZBlogPHP/' . substr(ZC_BLOG_VERSION, -6, 6) . ' ' . GetGuestAgent();

	if (!class_exists('NetworkFactory', false)) {
		if (class_exists('Network')) {
			return Server_SendRequest_Network($url, $data, $u, $c);
		}
	}

	if (function_exists("curl_init") && function_exists('curl_exec')) {
		return Server_SendRequest_CUrl($url, $data, $u, $c);
	}

	if (!ini_get("allow_url_fopen")) {
		return "";
	}

	if ($data) {
//POST
		$data = http_build_query($data);
		$opts = array(
			'http' => array(
				'method' => 'POST',
				'header' => "Content-Type:application/x-www-form-urlencoded\r\n" .
				'Content-Length: ' . strlen($data) . "\r\n" .
				"Cookie: " . $c . "\r\n",
				'user_agent' => $u,
				'content' => $data,
			),
		);
		$content = stream_context_create($opts);
	} else {
//GET
		$opts = array(
			'http' => array(
				'method' => 'GET',
				'header' => "Cookie: " . $c . "\r\n",
				'user_agent' => $u,
			),
		);
		$content = stream_context_create($opts);
	}

	if (function_exists('ini_set')) {
		ini_set('default_socket_timeout', 120);
	}

	if (extension_loaded('zlib')) {
		return file_get_contents('compress.zlib://' . $url, false, $content);
	} else {
		return file_get_contents($url, false, $content);
	}
}

function Server_SendRequest_CUrl($url, $data = array(), $u, $c) {
	global $zbp;

	$ch = curl_init($url);
	if (extension_loaded('zlib')) {
		curl_setopt($ch, CURLOPT_ENCODING, 'gzip');
	}
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_TIMEOUT, 120);
	curl_setopt($ch, CURLOPT_USERAGENT, $u);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
	if (ini_get("safe_mode") == false && ini_get("open_basedir") == false) {
		curl_setopt($ch, CURLOPT_MAXREDIRS, 10);
		curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
	}
	if ($c) {
		curl_setopt($ch, CURLOPT_COOKIE, $c);
	}

	if ($data) {
//POST
		curl_setopt($ch, CURLOPT_POST, 1);
		curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
	} else { //GET
	}

	$r = curl_exec($ch);
	curl_close($ch);

	return $r;
}

function Server_SendRequest_Network($url, $data = array(), $u, $c) {
	global $zbp;

	$ajax = Network::Create();
	if (!$ajax) {
		throw new Exception('主机没有开启访问外部网络功能');
	}

	if ($data) {
//POST
		$ajax->open('POST', $url);
		$ajax->enableGzip();
		$ajax->setTimeOuts(120, 120, 0, 0);
		$ajax->setRequestHeader('User-Agent', $u);
		$ajax->setRequestHeader('Cookie', $c);
		$ajax->send($data);
	} else {
		$ajax->open('GET', $url);
		$ajax->enableGzip();
		$ajax->setTimeOuts(120, 120, 0, 0);
		$ajax->setRequestHeader('User-Agent', $u);
		$ajax->setRequestHeader('Cookie', $c);
		$ajax->send();
	}

	return $ajax->responseText;
}

function AppCentre_CreateOptoinsOfVersion($default) {
	global $zbp;

	$s = null;
	$array = $GLOBALS['zbpvers'];
	krsort($array);
	$i = 0;
	foreach ($array as $key => $value) {
		$i += 1;
		if (($i == 1) or strpos($value, 'Beta') === False) {
			$s .= '<option value="' . $key . '" ' . ($default == $key ? 'selected="selected"' : '') . ' >' . $value . '</option>';
		}

	}
	return $s;
}

function AppCentre_GetHttpContent($url) {

	if (function_exists("GetHttpContent")) {
		return GetHttpContent($url);
	}

	$r = null;
	if (function_exists("curl_init")) {
		$ch = curl_init($url);
		curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
		curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
		curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
		if (ini_get("safe_mode") == false && ini_get("open_basedir") == false) {
			curl_setopt($ch, CURLOPT_MAXREDIRS, 1);
			curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
		}
		$r = curl_exec($ch);
		curl_close($ch);
	} elseif (ini_get("allow_url_fopen")) {
		$r = file_get_contents($url);
	}

	return $r;
}

function AppCentre_crc32_signed($num) {
	$crc = crc32($num);
	if ($crc & 0x80000000) {
		$crc ^= 0xffffffff;
		$crc += 1;
		$crc = -$crc;
	}
	return $crc;
}

$AppCentre_dirs = array();
$AppCentre_files = array();

function AppCentre_GetAllFileDir($dir) {
	global $AppCentre_dirs;
	global $AppCentre_files;
	if (function_exists('scandir')) {
		foreach (scandir($dir) as $d) {
			if (is_dir($dir . $d)) {
				if (substr($d, 0, 1) != '.') {
					AppCentre_GetAllFileDir($dir . $d . '/');
					$AppCentre_dirs[] = $dir . $d . '/';
				}
			} else {
				$AppCentre_files[] = $dir . $d;
			}
		}
	} else {
		if ($handle = opendir($dir)) {
			while (false !== ($file = readdir($handle))) {
				if (substr($file, 0, 1) != '.') {
					if (is_dir($dir . $file)) {
						$AppCentre_dirs[] = $dir . $file . '/';
						AppCentre_GetAllFileDir($dir . $file . '/');
					} else {
						$AppCentre_files[] = $dir . $file;
					}
				}
			}
			closedir($handle);
		}
	}

}

function AppCentre_Pack($app, $gzip) {

	global $zbp;
	global $AppCentre_dirs;
	global $AppCentre_files;

	$AppCentre_dirs = array();
	$AppCentre_files = array();

	$dir = $app->GetDir();
	AppCentre_GetAllFileDir($dir);

	$s = '<?xml version="1.0" encoding="utf-8"?>';
	$s .= '<app version="php" type="' . $app->type . '">';

	$s .= '<id>' . htmlspecialchars($app->id) . '</id>';
	$s .= '<name>' . htmlspecialchars($app->name) . '</name>';
	$s .= '<url>' . htmlspecialchars($app->url) . '</url>';
	$s .= '<note>' . htmlspecialchars($app->note) . '</note>';
	$s .= '<description>' . htmlspecialchars($app->description) . '</description>';

	$s .= '<path>' . htmlspecialchars($app->path) . '</path>';
	$s .= '<include>' . htmlspecialchars($app->include) . '</include>';
	$s .= '<level>' . htmlspecialchars($app->level) . '</level>';

	$s .= '<author>';
	$s .= '<name>' . htmlspecialchars($app->author_name) . '</name>';
	$s .= '<email>' . htmlspecialchars($app->author_email) . '</email>';
	$s .= '<url>' . htmlspecialchars($app->author_url) . '</url>';
	$s .= '</author>';

	$s .= '<source>';
	$s .= '<name>' . htmlspecialchars($app->source_name) . '</name>';
	$s .= '<email>' . htmlspecialchars($app->source_email) . '</email>';
	$s .= '<url>' . htmlspecialchars($app->source_url) . '</url>';
	$s .= '</source>';

	$s .= '<adapted>' . htmlspecialchars($app->adapted) . '</adapted>';
	$s .= '<version>' . htmlspecialchars($app->version) . '</version>';
	$s .= '<pubdate>' . htmlspecialchars($app->pubdate) . '</pubdate>';
	$s .= '<modified>' . htmlspecialchars($app->modified) . '</modified>';
	$s .= '<price>' . htmlspecialchars($app->price) . '</price>';

	$s .= '<advanced>';
	$s .= '<dependency>' . htmlspecialchars($app->advanced_dependency) . '</dependency>';
	$s .= '<rewritefunctions>' . htmlspecialchars($app->advanced_rewritefunctions) . '</rewritefunctions>';
	$s .= '<conflict>' . htmlspecialchars($app->advanced_conflict) . '</conflict>';
	$s .= '</advanced>';

	$s .= '<sidebars>';
	$s .= '<sidebar1>' . htmlspecialchars($app->sidebars_sidebar1) . '</sidebar1>';
	$s .= '<sidebar2>' . htmlspecialchars($app->sidebars_sidebar2) . '</sidebar2>';
	$s .= '<sidebar3>' . htmlspecialchars($app->sidebars_sidebar3) . '</sidebar3>';
	$s .= '<sidebar4>' . htmlspecialchars($app->sidebars_sidebar4) . '</sidebar4>';
	$s .= '<sidebar5>' . htmlspecialchars($app->sidebars_sidebar5) . '</sidebar5>';
	$s .= '</sidebars>';

	foreach ($AppCentre_dirs as $key => $value) {
		$value = preg_replace('/[^(\x20-\x7F)]*/', '', $value);
		$d = $app->id . '/' . str_replace($dir, '', $value);
		$s .= '<folder><path>' . htmlspecialchars($d) . '</path></folder>';
	}
	foreach ($AppCentre_files as $key => $value) {
		$d = $app->id . '/' . str_replace($dir, '', $value);
		$ext = pathinfo($value, PATHINFO_EXTENSION);
		if ($ext == 'php' || $ext == 'inc') {
			$c = base64_encode(RemoveBOM(file_get_contents($value)));
		} else {
			if (strripos($d, '/plugin.xml') !== false) {
				$x = file_get_contents($value);
				$x1 = 'app_host:' . $zbp->host . ';';
				$x2 = 'app_email:' . $zbp->user->Email . ';';
				$x3 = 'app_user:' . $zbp->user->Name . ';';
				$x = str_replace('</plugin>', '</plugin><!-- ' . $x1 . $x2 . $x3 . ' -->', $x);
				$c = base64_encode($x);
			} elseif (strripos($d, '/theme.xml') !== false) {
				$x = file_get_contents($value);
				$x1 = 'app_host:' . $zbp->host . ';';
				$x2 = 'app_email:' . $zbp->user->Email . ';';
				$x3 = 'app_user:' . $zbp->user->Name . ';';
				$x = str_replace('</theme>', '</theme><!-- ' . $x1 . $x2 . $x3 . ' -->', $x);
				$c = base64_encode($x);
			} else {
				$c = base64_encode(file_get_contents($value));
			}

		}
		if (IS_WINDOWS) {
			$d = iconv($zbp->lang['windows_character_set'], 'UTF-8//IGNORE', $d);
		}

		$s .= '<file><path>' . htmlspecialchars($d) . '</path><stream>' . $c . '</stream></file>';
	}

	$s .= '</app>';

	if ($gzip) {
		return gzencode($s, 9, FORCE_GZIP);
	} else {
		return $s;
	}

}
.app-theme{
	float:left;
	float:left;
	width:350px;
	background:#f0f0f0;
	margin:5px 20px 40px 5px;

}


.app-plugin{
	float:left;
	width:350px;
	background:#f0f0f0;
	margin:5px 20px 40px 5px;
	box-shadow: 0 0 10px #aaa;
}

.app-theme-image img{
	width:320px;
	height:240px;
}

.app-plugin-image img{
	width:128px;
	height:128px;
}


.app-plugin-id,.app-theme-id{
	display:none;
}
<?php
#注册插件
RegisterPlugin("AppCentre", "ActivePlugin_AppCentre");
if (!function_exists('GetScheme')) {
	function GetScheme($array) {
		if (array_key_exists('REQUEST_SCHEME', $array)) {
			if (strtolower($array['REQUEST_SCHEME']) == 'https') {
				return 'https://';
			}
		} elseif (array_key_exists('HTTPS', $array)) {
			if (strtolower($array['HTTPS']) == 'on') {
				return 'https://';
			}
		}
		return 'http://';
	}
}
if (!defined('HTTP_SCHEME')) {
	define('HTTP_SCHEME', GetScheme($_SERVER));
}

define('APPCENTRE_URL', HTTP_SCHEME . 'app.zblogcn.com/client/');
define('APPCENTRE_SYSTEM_UPDATE', HTTP_SCHEME . 'update.zblogcn.com/zblogphp/');

define('APPCENTRE_API_URL', HTTP_SCHEME . 'app.zblogcn.com/api/index.php?api=');
define('APPCENTRE_API_APP_ISBUY', 'isbuy');
define('APPCENTRE_API_USER_INFO', 'userinfo');
define('APPCENTRE_API_ORDER_LIST', 'orderlist');
define('APPCENTRE_API_ORDER_DETAIL', 'orderdetail');

function ActivePlugin_AppCentre() {
	global $zbp;
	Add_Filter_Plugin('Filter_Plugin_Admin_LeftMenu', 'AppCentre_AddMenu');
	Add_Filter_Plugin('Filter_Plugin_Admin_ThemeMng_SubMenu', 'AppCentre_AddThemeMenu');
	Add_Filter_Plugin('Filter_Plugin_Admin_PluginMng_SubMenu', 'AppCentre_AddPluginMenu');
	Add_Filter_Plugin('Filter_Plugin_Admin_SiteInfo_SubMenu', 'AppCentre_AddSiteInfoMenu');

	if (method_exists('ZBlogPHP', 'LoadLanguage')) {
		$zbp->LoadLanguage('plugin', 'AppCentre');
	} else {
		if (is_readable($f = $zbp->path . 'zb_users/plugin/AppCentre/language/' . $zbp->option['ZC_BLOG_LANGUAGEPACK'] . '.php')) {
			$zbp->lang['AppCentre'] = require $f;
		} elseif (is_readable($f = $zbp->path . 'zb_users/plugin/AppCentre/language/' . 'zh-cn' . '.php')) {
			$zbp->lang['AppCentre'] = require $f;
		}

	}
}

function InstallPlugin_AppCentre() {
	global $zbp;
	$zbp->Config('AppCentre')->enabledcheck = 1;
	$zbp->Config('AppCentre')->checkbeta = 0;
	$zbp->Config('AppCentre')->enabledevelop = 0;
	$zbp->Config('AppCentre')->enablegzipapp = 0;
	$zbp->SaveConfig('AppCentre');
}

function AppCentre_AddMenu(&$m) {
	global $zbp;
	$m['nav_AppCentre'] = MakeLeftMenu("root", $zbp->lang['AppCentre']['name'], $zbp->host . "zb_users/plugin/AppCentre/main.php", "nav_AppCentre", "aAppCentre", $zbp->host . "zb_users/plugin/AppCentre/images/Cube1.png");
}

function AppCentre_AddSiteInfoMenu() {
	global $zbp;
	if ($zbp->Config('AppCentre')->enabledcheck) {
		$last = (int) $zbp->Config('AppCentre')->lastchecktime;
		if ((time() - $last) > 11 * 60 * 60) {
			echo "<script type='text/javascript'>$(document).ready(function(){  $.getScript('{$zbp->host}zb_users/plugin/AppCentre/main.php?method=checksilent&rnd='); });</script>";
			$zbp->Config('AppCentre')->lastchecktime = time();
			$zbp->SaveConfig('AppCentre');
		}
	}
	if ($zbp->version >= 150101 && (int) $zbp->option['ZC_LAST_VERSION'] < 150101) {
		echo "<script type='text/javascript'>$('.main').prepend('<div class=\"hint\"><p class=\"hint hint_tips\"><a href=\"{$zbp->host}zb_users/plugin/AppCentre/update.php?updatedb\">请点击该链接升级数据库结构</a></p></div>');</script>";
	}

}

function AppCentre_AddThemeMenu() {
	global $zbp;
	echo "<script type='text/javascript'>var app_enabledevelop=" . (int) $zbp->Config('AppCentre')->enabledevelop . ";</script>";
	echo "<script type='text/javascript'>var app_username='" . $zbp->Config('AppCentre')->username . "';</script>";
	echo "<script src='{$zbp->host}zb_users/plugin/AppCentre/theme.js.php' type='text/javascript'></script>";
}

function AppCentre_AddPluginMenu() {
	global $zbp;
	echo "<script type='text/javascript'>var app_enabledevelop=" . (int) $zbp->Config('AppCentre')->enabledevelop . ";</script>";
	echo "<script type='text/javascript'>var app_username='" . $zbp->Config('AppCentre')->username . "';</script>";
	echo "<script src='{$zbp->host}zb_users/plugin/AppCentre/plugin.js.php' type='text/javascript'></script>";
}

//$appid是App在应用中心的发布后的文章ID数字号，非App的ID名称。
function AppCentre_App_Check_ISBUY($appid) {
	global $zbp;
	$postdate = array(
		'email' => $zbp->Config('AppCentre')->shop_username,
		'password' => $zbp->Config('AppCentre')->shop_password,
		'appid' => $appid,
		    );
	$http_post = Network::Create();
	$http_post->open('POST', APPCENTRE_API_URL . APPCENTRE_API_APP_ISBUY);
	$http_post->setRequestHeader('Referer', substr($zbp->host, 0, -1) . $zbp->currenturl);

	$http_post->send($postdate);
	$result = json_decode($http_post->responseText, true);
	return $result;
}
<?php
return array(

'name'=>'App Store',

);
<?php
return array(

'name'=>'应用中心',

);
<?php
return array(

'name'=>'應用市集',

);
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';

$zbp->Load();

$action = 'root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}

if (!$zbp->CheckPlugin('AppCentre')) {$zbp->ShowError(48);die();}

$blogtitle = '应用中心';

if (!$zbp->Config('AppCentre')->HasKey('enabledcheck')) {
	$zbp->Config('AppCentre')->enabledcheck = 1;
	$zbp->Config('AppCentre')->checkbeta = 0;
	$zbp->Config('AppCentre')->enabledevelop = 0;
	$zbp->SaveConfig('AppCentre');
}

if (count($_POST) > 0) {

	$zbp->SetHint('good');
	Redirect('./main.php');
}

require $blogpath . 'zb_system/admin/admin_header.php';
require $blogpath . 'zb_system/admin/admin_top.php';

?>
<div id="divMain">

  <div class="divHeader"><?php echo $blogtitle;?></div>
<div class="SubMenu"><?php AppCentre_SubMenus(GetVars('method', 'GET') == 'check' ? 2 : 1);?></div>
  <div id="divMain2">

<?php
$method = GetVars('method', 'GET');
if (!$method) {
	$method = 'view';
}

Server_Open($method);
?>
	<script type="text/javascript">
		window.plug_list = "<?php echo AddNameInString($option['ZC_USING_PLUGIN_LIST'], $option['ZC_BLOG_THEME'])?>";
		window.signkey = '<?php echo $zbp->GetToken()?>';
	</script>
	<script type="text/javascript">ActiveLeftMenu("aAppCentre");</script>
	<script type="text/javascript">AddHeaderIcon("<?php echo $bloghost . 'zb_users/plugin/AppCentre/logo.png';?>");</script>
  </div>
</div>
<?php
require $blogpath . 'zb_system/admin/admin_footer.php';

RunTime();
?>
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';

$zbp->Load();
ob_clean();
header('Content-Type: application/x-javascript; charset=utf-8');
?>

$(document).ready(function(){ 

$("#divMain2").prepend("<form class='search' name='edit' id='edit' method='post' enctype='multipart/form-data' action='"+bloghost+"zb_users/plugin/AppCentre/app_upload.php?token=<?php echo $zbp->GetToken();?>'><p>本地上传并安装插件zba文件:&nbsp;<input type='file' id='edtFileLoad' name='edtFileLoad' size='40' />&nbsp;&nbsp;&nbsp;&nbsp;<input type='submit' class='button' value='提交' name='B1' />&nbsp;&nbsp;<input class='button' type='reset' value='重置' name='B2' />&nbsp;</p></form>")

if(app_enabledevelop){

$("tr").each(function(){
	$(this).append("<td class='td15' align='center'></td>");
});
$("tr").first().children().last().append("<b>开发者模式</b>");

}

$(".plugin").each(function(){

	var t=$(this).data("pluginid");
	if(t==undefined)t=$(this).find("strong").html();
	var s=""
	s=s+"<a class=\"button\"  href='"+bloghost+"zb_users/plugin/AppCentre/plugin_edit.php?id="+t+"' title='编辑该插件信息'><img height='16' width='16' src='"+bloghost+"zb_users/plugin/AppCentre/images/application_edit.png'/></a>";

	s=s+"&nbsp;&nbsp;&nbsp;&nbsp;<a class=\"button\"  href='"+bloghost+"zb_users/plugin/AppCentre/app_pack.php?type=plugin&id="+t+"' title='导出该插件' target='_blank'><img height='16' width='16' src='"+bloghost+"zb_users/plugin/AppCentre/images/download.png'/></a>";

	if(app_username){
		s=s+"&nbsp;&nbsp;&nbsp;&nbsp;<a class=\"button\" href='"+bloghost+"zb_users/plugin/AppCentre/submit.php?type=plugin&amp;id="+t+"' title='上传应用到官方网站应用中心' target='_blank'><img height='16' width='16' src='"+bloghost+"zb_users/plugin/AppCentre/images/drive-upload.png'/></a>";
	}


	
	if(app_enabledevelop){
	
		$(this).parent().children().last().append(s);

	}

	if(!$(this).hasClass("plugin-on")){
		$(this).parent().children().eq(4).append("&nbsp;&nbsp;&nbsp;&nbsp;<a class=\"button\"  href='"+bloghost+"zb_users/plugin/AppCentre/app_del.php?type=plugin&id="+t+"' title='删除该插件' onclick='return window.confirm(\"单击“确定”继续。单击“取消”停止。\");'><img height='16' width='16' src='"+bloghost+"zb_users/plugin/AppCentre/images/delete.png'/></a>");
	}else{
	};

});



});
<?xml version="1.0" encoding="utf-8"?>
<plugin version="php">
<id>AppCentre</id>
<name>应用中心</name>
<url>http://www.zblogcn.com/</url>
<note>Z-BlogPHP版的资源大本营</note>
<description></description>
<path>main.php</path>
<include>include.php</include>
<level>1</level>
<author>
  <name>zx.asd</name>
  <email>rainbowsoft@gmail.com</email>
  <url>http://www.zblogcn.com/</url>
</author>
<source>
  <name></name>
  <email></email>
  <url></url>
</source>
<adapted>131221</adapted>
<version>2.1</version>
<pubdate>2013-07-07</pubdate>
<modified>2015-12-08</modified>
<price>0</price>
<advanced>
  <dependency></dependency>
  <rewritefunctions></rewritefunctions>
  <conflict></conflict>
</advanced>
<sidebars>
  <sidebar1></sidebar1>
  <sidebar2></sidebar2>
  <sidebar3></sidebar3>
  <sidebar4></sidebar4>
  <sidebar5></sidebar5>
</sidebars>
</plugin>
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';

$zbp->Load();

$action = 'root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}

if (!$zbp->CheckPlugin('AppCentre')) {$zbp->ShowError(48);die();}

$blogtitle = '应用中心-插件编辑';

if (GetVars('id')) {
	$app = $zbp->LoadApp('plugin', GetVars('id'));
	$mt = array();
	$ft = GetFilesInDir($zbp->path . '/zb_users/plugin/' . $app->id . '/', 'php|inc|png');
	foreach ($ft as $f) {
		$mt[] = filemtime($f);
	}
	rsort($mt);
	if (count($mt) == 0) {
		$mt[] = time();
	}

	$app->modified = date('Y-m-d', reset($mt));
} else {
	$app = new App;
	$app->price = 0;
	$app->version = '1.0';
	$app->pubdate = date('Y-m-d', time());
	$app->modified = date('Y-m-d', time());
	$v = array_keys($zbpvers);
	$app->adapted = (string) end($v);
	$app->type = 'plugin';
	$app->author_name = $zbp->user->Name;
	$app->author_email = $zbp->user->Email;
	$app->author_url = $zbp->user->HomePage;
	$app->path = 'main.php';
	$app->include = 'include.php';

}

if (count($_POST) > 0) {

	$app->id = trim($_POST['app_id']);
	if (!CheckRegExp($app->id, "/^[A-Za-z0-9_]{3,30}/")) {$zbp->ShowError('ID名必须是字母数字和下划线组成,长度3-30字符.');die();}
	if (!GetVars('id')) {
		$app2 = $zbp->LoadApp('plugin', $app->id);
		if ($app2->id) {$zbp->ShowError('已存在同名的APP应用.');die();}
		@mkdir($zbp->usersdir . 'plugin/' . $app->id . '/');
		@copy($zbp->usersdir . 'plugin/AppCentre/images/plugin.png', $zbp->usersdir . 'plugin/' . $app->id . '/logo.png');

		if (trim($_POST['app_path'])) {
			$file = file_get_contents('tpl/main.html');
			$file = str_replace("<%appid%>", $app->id, $file);
			$path = $zbp->usersdir . 'plugin/' . $app->id . '/' . trim($_POST['app_path']);
			@file_put_contents($path, $file);
		}
		if (trim($_POST['app_include'])) {
			$file = file_get_contents('tpl/include.html');
			$file = str_replace("<%appid%>", $app->id, $file);
			$path = $zbp->usersdir . 'plugin/' . $app->id . '/include.php';
			@file_put_contents($path, $file);
		}
	}

	$app->name = trim($_POST['app_name']);
	$app->url = trim($_POST['app_url']);
	$app->note = trim($_POST['app_note']);
	$app->adapted = $_POST['app_adapted'];
	$app->version = (float) $_POST['app_version'];
	if ($app->version == 1) {
		$app->version = '1.0';
	}

	$app->pubdate = date('Y-m-d', strtotime($_POST['app_pubdate']));
	$app->modified = date('Y-m-d', time());

	$app->author_name = trim($_POST['app_author_name']);
	$app->author_email = trim($_POST['app_author_email']);
	$app->author_url = trim($_POST['app_author_url']);

	$app->path = trim($_POST['app_path']);
	$app->include = trim($_POST['app_include']);
	$app->level = (int) $_POST['app_level'];
	$app->price = (float) $_POST['app_price'];

	$app->advanced_dependency = trim($_POST['app_advanced_dependency']);
	$app->advanced_rewritefunctions = trim($_POST['app_advanced_rewritefunctions']);
	$app->advanced_conflict = trim($_POST['app_advanced_conflict']);

	$app->description = trim($_POST['app_description']);

	$app->SaveInfoByXml();

	$zbp->SetHint('good', '提交成功！<a href="submit.php?type=plugin&id=' . $app->id . '">现在立刻上传到应用中心！</a>');
	Redirect($_SERVER["HTTP_REFERER"]);
}

require $blogpath . 'zb_system/admin/admin_header.php';
require $blogpath . 'zb_system/admin/admin_top.php';

?>
<div id="divMain">

  <div class="divHeader"><?php echo $blogtitle;?></div>
<div class="SubMenu"><?php AppCentre_SubMenus(GetVars('id', 'GET') == '' ? 5 : '');?></div>
  <div id="divMain2">

<form method="post" action="">
  <table border="1" width="100%" cellspacing="0" cellpadding="0" class="tableBorder tableBorder-thcenter">
    <tr>
      <th width='28%'>&nbsp;</th>
      <th>&nbsp;</th>
    </tr>
    <tr>
      <td><p><b>· 插件ID</b><br/>
          <span class="note">&nbsp;&nbsp;插件ID为插件的目录名,且不能重复.ID名只能用字母数字和下划线的组合.</span></p></td>
      <td><p>&nbsp;
          <input id="app_id" name="app_id" style="width:550px;"  type="text" value="<?php echo $app->id;?>" <?php if ($app->id) {
	echo 'readonly="readonly"';
}
?>  />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 插件名称</b></p></td>
      <td><p>&nbsp;
          <input id="app_name" name="app_name" style="width:550px;"  type="text" value="<?php echo $app->name;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 插件发布页面</b></p></td>
      <td><p>&nbsp;
          <input id="app_url" name="app_url" style="width:550px;"  type="text" value="<?php echo $app->url;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 插件简介</b></p></td>
      <td><p>&nbsp;
          <input id="app_note" name="app_note" style="width:550px;"  type="text" value="<?php echo $app->note;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 适用的最低要求 Z-Blog 版本</b></p></td>
      <td><p>&nbsp;
          <select name="app_adapted" id="app_adapted" style="width:400px;">
<?php echo AppCentre_CreateOptoinsOfVersion($app->adapted);?>
          </select>
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 插件版本号</b></p></td>
      <td><p>&nbsp;
          <input id="app_version" name="app_version" style="width:550px;" type="number" step="0.1" value="<?php echo $app->version;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 插件首发时间</b><br/>
          <span class="note">&nbsp;&nbsp;日期格式为2012-12-12</span></p></td>
      <td><p>&nbsp;
          <input id="app_pubdate" name="app_pubdate" style="width:550px;"  type="text" value="<?php echo $app->pubdate;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 插件最后修改时间</b><br/>
          <span class="note">&nbsp;&nbsp;系统自动检查include.php的最后修改日期</span></p></td>
      <td><p>&nbsp;
          <input id="app_modified" name="app_modified" style="width:550px;"  type="text" value="<?php echo $app->modified;?>" readonly />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 作者名称</b></p></td>
      <td><p>&nbsp;
          <input id="app_author_name" name="app_author_name" style="width:550px;"  type="text" value="<?php echo $app->author_name;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 作者邮箱</b></p></td>
      <td><p>&nbsp;
          <input id="app_author_email" name="app_author_email" style="width:550px;"  type="text" value="<?php echo $app->author_email;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 作者网站</b></p></td>
      <td><p>&nbsp;
          <input id="app_author_url" name="app_author_url" style="width:550px;"  type="text" value="<?php echo $app->author_url;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 插件管理页</b> (可选)<br/>
          <span class="note">&nbsp;&nbsp;习惯命名为main.php</span></p></td>
      <td><p>&nbsp;
          <input id="app_path" name="app_path" style="width:550px;"  type="text" value="<?php echo $app->path;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 插件嵌入页</b> (可选)<br/>
          <span class="note">&nbsp;&nbsp;只能命名为include.php</span></p></td>
      <td><p>&nbsp;
          <input id="app_include" name="app_include" style="width:550px;"  type="text" value="<?php echo $app->include;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 插件管理权限</b> (可选)</p></td>
      <td><p>&nbsp;
          <select name="app_level" id="app_level" style="width:200px;">
<?php echo CreateOptoinsOfMemberLevel(1)?>
          </select>
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 插件定价</b></p></td>
      <td><p>&nbsp;
          <input id="app_price" name="app_price" style="width:550px;"  type="text" value="<?php echo $app->price;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 【高级】依赖插件（以|分隔）</b>(可选)</p></td>
      <td><p>&nbsp;
          <input id="app_advanced_dependency" name="app_advanced_dependency" style="width:550px;"  type="text" value="<?php echo $app->advanced_dependency;?>" />
        </p></td>
    </tr>
    <tr style="display: none">
      <td><p><b>· 【高级】插件重写系统函数列表（以|分隔）</b>(可选)</p></td>
      <td><p>&nbsp;
          <input id="app_advanced_rewritefunctions" name="app_advanced_rewritefunctions" style="width:550px;"  type="text" value="<?php echo $app->advanced_rewritefunctions;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 【高级】插件冲突插件列表（以|分隔）</b>(可选)</p></td>
      <td><p>&nbsp;
          <input id="app_advanced_conflict" name="app_advanced_conflict" style="width:550px;"  type="text" value="<?php echo $app->advanced_conflict;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 详细说明</b> (可选)</p></td>
      <td><p>&nbsp;
          <textarea cols="3" rows="6" id="app_description" name="app_description" style="width:550px;"><?php echo htmlspecialchars($app->description);?></textarea>
        </p></td>
    </tr>
  </table>
  <p> 提示:插件的图标是名为logo.png的<b>128 x 128 px</b>大小的png文件,推荐使用<a href="http://www.syncfusion.com/downloads/metrostudio" target="_blank">Metro Studio</a>软件创建logo,插件的缩略图(可选)是名为screenshot.png的<b>300x240px</b>大小的png文件,放在插件的目录下.</p>
  <p><br/>
    <input type="submit" class="button" value="提交" id="btnPost" onclick='' />
  </p>
  <p>&nbsp;</p>
</form>

	<script type="text/javascript">ActiveLeftMenu("aAppCentre");</script>
	<script type="text/javascript">AddHeaderIcon("<?php echo $bloghost . 'zb_users/plugin/AppCentre/logo.png';?>");</script>
  </div>
</div>
<?php
require $blogpath . 'zb_system/admin/admin_footer.php';

RunTime();
?>
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';
$zbp->Load();

$action = 'root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}

if (!$zbp->CheckPlugin('AppCentre')) {$zbp->ShowError(48);die();}

$blogtitle = '应用中心-设置';

if (GetVars('act') == 'save') {

	$zbp->Config('AppCentre')->enabledcheck = (int) GetVars("app_enabledcheck");
	$zbp->Config('AppCentre')->checkbeta = (int) GetVars("app_checkbeta");
	$zbp->Config('AppCentre')->enabledevelop = (int) GetVars("app_enabledevelop");
	$zbp->Config('AppCentre')->enablegzipapp = (int) GetVars("app_enablegzipapp");
	$zbp->SaveConfig('AppCentre');

	$zbp->SetHint('good');
	Redirect('./setting.php');

}

require $blogpath . 'zb_system/admin/admin_header.php';
require $blogpath . 'zb_system/admin/admin_top.php';
?>
<div id="divMain">

  <div class="divHeader"><?php echo $blogtitle;?></div>
<div class="SubMenu"><?php AppCentre_SubMenus(4);?></div>
  <div id="divMain2">

            <form action="?act=save" method="post">
              <table width="100%" border="0">
                <tr height="32">
                  <th colspan="2" align="center">设置
                    </td>
                </tr>
                <tr height="32">
                  <td width="30%" align="left"><p><b>· 启用自动检查更新</b><br/>
                      <span class="note">&nbsp;&nbsp;在进入后台时会检查应用更新和系统更新 </span></p></td>
                  <td><input id="app_enabledcheck" name="app_enabledcheck" type="text" value="<?php echo $zbp->Config('AppCentre')->enabledcheck;?>" class="checkbox"/></td>
                </tr>
                <tr height="32">
                  <td width="30%" align="left"><p><b>· 检查Beta版程序</b><br/>
                      <span class="note">&nbsp;&nbsp;若打开，则系统将检查最新测试版的Z-Blog更新</span></p></td>
                  <td><input id="app_checkbeta" name="app_checkbeta" type="text" value="<?php echo $zbp->Config('AppCentre')->checkbeta;?>" class="checkbox"/></td>
                </tr>
                <tr height="32">
                  <td width="30%" align="left"><p><b>· 启用开发者模式</b><br/>
                      <span class="note">&nbsp;&nbsp;启用开发者模式可以修改应用信息、导出应用和远程提交应用</span></p></td>
                  <td><input id="app_enabledevelop" name="app_enabledevelop" type="text" value="<?php echo $zbp->Config('AppCentre')->enabledevelop;?>" class="checkbox"/></td>
                </tr>
                <tr height="32">
                  <td width="30%" align="left"><p><b>· 导出经过GZip压缩的应用包</b><br/>
                      <span class="note">&nbsp;&nbsp;1.4以下版本不支持应用压缩包导入及导出</span></p></td>
                  <td><input id="app_enablegzipapp" name="app_enablegzipapp" type="text" value="<?php echo $zbp->Config('AppCentre')->enablegzipapp;?>" class="checkbox"/></td>
                </tr>
              </table>
              <hr/>
              <p>
                <input type="submit" value="提交" class="button" />
              </p>
              <hr/>
            </form>


	<script type="text/javascript">ActiveLeftMenu("aAppCentre");</script>
	<script type="text/javascript">AddHeaderIcon("<?php echo $bloghost . 'zb_users/plugin/AppCentre/logo.png';?>");</script>
  </div>
</div>


<?php
require $blogpath . 'zb_system/admin/admin_footer.php';

RunTime();
?>
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';

$zbp->Load();

$action = 'root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}

if (!$zbp->CheckPlugin('AppCentre')) {$zbp->ShowError(48);die();}

$blogtitle = '应用中心-提交应用';

$s = '';
$t = '';

$app = New App;
$app->LoadInfoByXml($_GET['type'], $_GET['id']);

$t['id'] = $app->id;
$t['author'] = $app->author_name;
$t['modified'] = $app->modified;

$t = json_encode($t);

if ($_SERVER['REQUEST_METHOD'] == 'GET') {
	$s = Server_Open('submitpre');
}

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
	$url = Server_Open('submit');
	if (substr($url, 0, 4) == 'http') {
		Redirect($url);
	} else {
		echo '<script type="text/javascript">alert(\'' . $url . '\')</script>';
	}
}

if (!$s) {
	$s = '{"id":"未提交","author":"未提交","modified":"未提交"}';
}

require $blogpath . 'zb_system/admin/admin_header.php';
require $blogpath . 'zb_system/admin/admin_top.php';

?>
<div id="divMain">

  <div class="divHeader"><?php echo $blogtitle;?></div>
<div class="SubMenu"><?php AppCentre_SubMenus('');?></div>
  <div id="divMain2">


<form method="post" action="">
<table class="tableFull tableBorder tableBorder-thcenter">
<tr><th colspan="2">&nbsp;拟提交发布或更新的应用信息<a href="<?php echo GetVars('type', 'GET') == 'plugin' ? 'plugin' : 'theme'?>_edit.php?id=<?php echo $app->id?>">[编辑]</a></th></tr>

<tr><td class="td30"><p><b>· 应用ID</b></p></td><td><p>&nbsp;<input id="local_app_id" name="local_app_id" style="width:550px;"  type="text" value="" readonly /></p></td></tr>
<tr><td><p><b>· 应用文件名</b></p></td><td><p>&nbsp;<input id="local_app_user" name="local_app_user" style="width:550px;"  type="text" value="" readonly /></p></td></tr>
<tr><td><p><b>· 最后更新日期</b></p></td><td><p>&nbsp;<input id="local_app_date" name="local_app_date" style="width:550px;"  type="text" value="" readonly /></p></td></tr>
</table>


<table class="tableFull tableBorder tableBorder-thcenter">
<tr><th colspan="2">&nbsp;“Z-Blog应用中心”目标应用的相关信息</th></tr>
<tr><td class="td30"><p><b>· 应用发布ID</b></p></td><td><p>&nbsp;<input id="zblog_app_id" name="zblog_app_id" style="width:550px;"  type="text" value="" readonly /></p></td></tr>
<tr><td><p><b>· 应用提交用户</b></p></td><td><p>&nbsp;<input id="zblog_app_user" name="zblog_app_user" style="width:550px;"  type="text" value="" readonly /></p></td></tr>
<tr><td><p><b>· 最后更新日期</b></p></td><td><p>&nbsp;<input id="zblog_app_date" name="zblog_app_date" style="width:550px;"  type="text" value="" readonly /></p></td></tr>
</table>
<script type="text/javascript">
var jsoninfo=eval(<?php echo $t;?>);
$("#local_app_id").val(jsoninfo.id);
$("#local_app_user").val(jsoninfo.author);
$("#local_app_date").val(jsoninfo.modified);

var jsoninfo=eval(<?php echo $s;?>);
$("#zblog_app_id").val(jsoninfo.id);
$("#zblog_app_user").val(jsoninfo.author);
$("#zblog_app_date").val(jsoninfo.modified);
</script>


<p> 提示:金牌开发者、银牌开发者、铜牌开发者和铁牌开发者只能更新和提交自己的应用,白金开发者可以更新和提交所有应用.</p>
<p><br/><input type="submit" class="button" value="提交" id="btnPost" onclick='return confirm("您确定要提交吗？")' /></p><p>&nbsp;</p>


</form>


	<script type="text/javascript">ActiveLeftMenu("aAppCentre");</script>
	<script type="text/javascript">AddHeaderIcon("<?php echo $bloghost . 'zb_users/plugin/AppCentre/logo.png';?>");</script>
  </div>
</div>


<?php
require $blogpath . 'zb_system/admin/admin_footer.php';

RunTime();
?>
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';

$zbp->Load();
?>

$(document).ready(function(){ 

$("#divMain2").prepend("<form class='search' name='edit' id='edit' method='post' enctype='multipart/form-data' action='"+bloghost+"zb_users/plugin/AppCentre/app_upload.php?token=<?php echo $zbp->GetToken();?>'><p>本地上传并安装主题zba文件:&nbsp;<input type='file' id='edtFileLoad' name='edtFileLoad' size='40' />&nbsp;&nbsp;&nbsp;&nbsp;<input type='submit' class='button' value='提交' name='B1' />&nbsp;&nbsp;<input class='button' type='reset' value='重置' name='B2' />&nbsp;</p></form>");



$(".theme").each(function(){
	var t=$(this).find("strong").html();
	var s="<p>";

	if(app_enabledevelop){

	s=s+"<a class=\"button\" href='"+bloghost+"zb_users/plugin/AppCentre/theme_edit.php?id="+t+"' title='编辑该主题信息'><img height='16' width='16' src='"+bloghost+"zb_users/plugin/AppCentre/images/application_edit.png'/></a>&nbsp;&nbsp;&nbsp;&nbsp;";

	s=s+"<a class=\"button\" href='"+bloghost+"zb_users/plugin/AppCentre/app_pack.php?type=theme&id="+t+"' title='导出该主题' target='_blank'><img height='16' width='16' src='"+bloghost+"zb_users/plugin/AppCentre/images/download.png'/></a>&nbsp;&nbsp;&nbsp;&nbsp;";

	}

	if($(this).hasClass("theme-now")){
		s=s+"<a class=\"button\" href='"+bloghost+"zb_system/admin/module_edit.php?source=theme' title='给该主题增加侧栏模块'><img height='16' width='16' src='"+bloghost+"zb_users/plugin/AppCentre/images/bricks.png'/></a>&nbsp;&nbsp;&nbsp;&nbsp;";
	}


	if($(this).hasClass("theme-other")){
		s=s+"<a class=\"button\" href='"+bloghost+"zb_users/plugin/AppCentre/app_del.php?type=theme&id="+t+"' title='删除该主题' onclick='return window.confirm(\"单击“确定”继续。单击“取消”停止。\");'><img height='16' width='16' src='"+bloghost+"zb_users/plugin/AppCentre/images/delete.png'/></a>&nbsp;&nbsp;&nbsp;&nbsp;";
	}

	if(app_enabledevelop&&app_username){
		s=s+"<a class=\"button\" href='"+bloghost+"zb_users/plugin/AppCentre/submit.php?type=theme&amp;id="+t+"' title='上传应用到官方网站应用中心' target='_blank'><img height='16' width='16' src='"+bloghost+"zb_users/plugin/AppCentre/images/drive-upload.png'/></a>";
	}

	s=s+"</p>";
	$(this).append(s);
	
});

});
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';

$zbp->Load();

$action = 'root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}

if (!$zbp->CheckPlugin('AppCentre')) {$zbp->ShowError(48);die();}

$blogtitle = '应用中心-主题编辑';

if (GetVars('id')) {
	$app = $zbp->LoadApp('theme', GetVars('id'));
	$mt = array();
	$ft = GetFilesInDir($zbp->path . '/zb_users/theme/' . $app->id . '/', 'php|inc|png');
	foreach ($ft as $f) {
		$mt[] = filemtime($f);
	}
	$ft = GetFilesInDir($zbp->path . '/zb_users/theme/' . $app->id . '/include/', 'php|inc|png');
	foreach ($ft as $f) {
		$mt[] = filemtime($f);
	}
	$ft = GetFilesInDir($zbp->path . '/zb_users/theme/' . $app->id . '/style/', 'php|inc|png');
	foreach ($ft as $f) {
		$mt[] = filemtime($f);
	}
	$ft = GetFilesInDir($zbp->path . '/zb_users/theme/' . $app->id . '/template/', 'php|inc|png');
	foreach ($ft as $f) {
		$mt[] = filemtime($f);
	}
	$ft = GetFilesInDir($zbp->path . '/zb_users/theme/' . $app->id . '/source/', 'php|inc|png');
	foreach ($ft as $f) {
		$mt[] = filemtime($f);
	}
	rsort($mt);
	if (count($mt) == 0) {
		$mt[] = time();
	}

	$app->modified = date('Y-m-d', reset($mt));
} else {
	$app = new App;
	$app->price = 0;
	$app->version = '1.0';
	$app->pubdate = date('Y-m-d', time());
	$app->modified = date('Y-m-d', time());
	$v = array_keys($zbpvers);
	$app->adapted = (string) end($v);
	$app->type = 'theme';
}

if (count($_POST) > 0) {

	$app->id = trim($_POST['app_id']);
	if (!CheckRegExp($app->id, "/^[A-Za-z0-9_]{3,30}/")) {$zbp->ShowError('ID名必须是字母数字和下划线组成,长度3-30字符.');die();}
	if (!GetVars('id')) {
		$app2 = $zbp->LoadApp('theme', $app->id);
		if ($app2->id) {$zbp->ShowError('已存在同名的APP应用.');die();}
		@mkdir($zbp->usersdir . 'theme/' . $app->id);
		@mkdir($zbp->usersdir . 'theme/' . $app->id . '/style');
		//@mkdir($zbp->usersdir . 'theme/' . $app->id . '/compile');
		@mkdir($zbp->usersdir . 'theme/' . $app->id . '/template');
		@copy($zbp->usersdir . 'plugin/AppCentre/images/theme.png', $zbp->usersdir . 'theme/' . $app->id . '/screenshot.png');
		@file_put_contents($zbp->usersdir . 'theme/' . $app->id . '/style/style.css', '');

		if (trim($_POST['app_path'])) {
			$file = file_get_contents('tpl/main.html');
			$file = str_replace("<%appid%>", $app->id, $file);
			$path = $zbp->usersdir . 'theme/' . $app->id . '/' . trim($_POST['app_path']);
			@file_put_contents($path, $file);
		}
		if (trim($_POST['app_include'])) {
			$file = file_get_contents('tpl/include.html');
			$file = str_replace("<%appid%>", $app->id, $file);
			$path = $zbp->usersdir . 'theme/' . $app->id . '/include.php';
			@file_put_contents($path, $file);
		}
	}

	$app->name = trim($_POST['app_name']);
	$app->url = trim($_POST['app_url']);
	$app->note = trim($_POST['app_note']);
	$app->adapted = $_POST['app_adapted'];
	$app->version = (float) $_POST['app_version'];
	if ($app->version == 1) {
		$app->version = '1.0';
	}

	$app->pubdate = date('Y-m-d', strtotime($_POST['app_pubdate']));
	$app->modified = date('Y-m-d', time());

	$app->author_name = trim($_POST['app_author_name']);
	$app->author_email = trim($_POST['app_author_email']);
	$app->author_url = trim($_POST['app_author_url']);
	$app->source_name = trim($_POST['app_source_name']);
	$app->source_email = trim($_POST['app_source_email']);
	$app->source_url = trim($_POST['app_source_url']);

	$app->path = trim($_POST['app_path']);
	$app->include = trim($_POST['app_include']);
	$app->level = (int) $_POST['app_level'];
	$app->price = (float) $_POST['app_price'];

	$app->advanced_dependency = trim($_POST['app_advanced_dependency']);
	$app->advanced_rewritefunctions = trim($_POST['app_advanced_rewritefunctions']);
	$app->advanced_conflict = trim($_POST['app_advanced_conflict']);

	$app->description = trim($_POST['app_description']);

	if (GetVars('app_sidebars_sidebar1')) {
		$app->sidebars_sidebar1 = $zbp->option['ZC_SIDEBAR_ORDER'];
	} else {
		$app->sidebars_sidebar1 = '';
	}
	if (GetVars('app_sidebars_sidebar2')) {
		$app->sidebars_sidebar2 = $zbp->option['ZC_SIDEBAR2_ORDER'];
	} else {
		$app->sidebars_sidebar2 = '';
	}
	if (GetVars('app_sidebars_sidebar3')) {
		$app->sidebars_sidebar3 = $zbp->option['ZC_SIDEBAR3_ORDER'];
	} else {
		$app->sidebars_sidebar3 = '';
	}
	if (GetVars('app_sidebars_sidebar4')) {
		$app->sidebars_sidebar4 = $zbp->option['ZC_SIDEBAR4_ORDER'];
	} else {
		$app->sidebars_sidebar4 = '';
	}
	if (GetVars('app_sidebars_sidebar5')) {
		$app->sidebars_sidebar5 = $zbp->option['ZC_SIDEBAR5_ORDER'];
	} else {
		$app->sidebars_sidebar5 = '';
	}

	$app->SaveInfoByXml();

	$zbp->SetHint('good', '提交成功！<a href="submit.php?type=theme&id=' . $app->id . '">现在立刻上传到应用中心！</a>');
	Redirect($_SERVER["HTTP_REFERER"]);
}

require $blogpath . 'zb_system/admin/admin_header.php';
require $blogpath . 'zb_system/admin/admin_top.php';

?>
<div id="divMain">

  <div class="divHeader"><?php echo $blogtitle;?></div>
<div class="SubMenu"><?php AppCentre_SubMenus(GetVars('id', 'GET') == '' ? 6 : '');?></div>
  <div id="divMain2">

<form method="post" action="">
  <table border="1" width="100%" cellspacing="0" cellpadding="0" class="tableBorder tableBorder-thcenter">
    <tr>
      <th width='28%'>&nbsp;</th>
      <th>&nbsp;</th>
    </tr>
    <tr>
      <td><p><b>· 主题ID</b><br/>
          <span class="note">&nbsp;&nbsp;主题ID为主题的目录名,且不能重复.ID名只能用字母数字和下划线的组合.</span></p></td>
      <td><p>&nbsp;
          <input id="app_id" name="app_id" style="width:550px;"  type="text" value="<?php echo $app->id;?>" <?php if ($app->id) {
	echo 'readonly="readonly"';
}
?>  />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 主题名称</b></p></td>
      <td><p>&nbsp;
          <input id="app_name" name="app_name" style="width:550px;"  type="text" value="<?php echo $app->name;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 主题发布页面</b></p></td>
      <td><p>&nbsp;
          <input id="app_url" name="app_url" style="width:550px;"  type="text" value="<?php echo $app->url;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 主题简介</b></p></td>
      <td><p>&nbsp;
          <input id="app_note" name="app_note" style="width:550px;"  type="text" value="<?php echo $app->note;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 适用的最低要求 Z-Blog 版本</b></p></td>
      <td><p>&nbsp;
          <select name="app_adapted" id="app_adapted" style="width:400px;">
<?php echo AppCentre_CreateOptoinsOfVersion($app->adapted);?>
          </select>
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 主题版本号</b></p></td>
      <td><p>&nbsp;
          <input id="app_version" name="app_version" style="width:550px;" type="number" step="0.1" value="<?php echo $app->version;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 主题首发时间</b><br/>
          <span class="note">&nbsp;&nbsp;日期格式为2012-12-12</span></p></td>
      <td><p>&nbsp;
          <input id="app_pubdate" name="app_pubdate" style="width:550px;"  type="text" value="<?php echo $app->pubdate;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 主题最后修改时间</b><br/>
          <span class="note">&nbsp;&nbsp;系统自动检查目录内文件的最后修改日期</span></p></td>
      <td><p>&nbsp;
          <input id="app_modified" name="app_modified" style="width:550px;"  type="text" value="<?php echo $app->modified;?>" readonly="readonly" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 作者名称</b></p></td>
      <td><p>&nbsp;
          <input id="app_author_name" name="app_author_name" style="width:550px;"  type="text" value="<?php echo $app->author_name;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 作者邮箱</b></p></td>
      <td><p>&nbsp;
          <input id="app_author_email" name="app_author_email" style="width:550px;"  type="text" value="<?php echo $app->author_email;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 作者网站</b></p></td>
      <td><p>&nbsp;
          <input id="app_author_url" name="app_author_url" style="width:550px;"  type="text" value="<?php echo $app->author_url;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 源作者名称</b> (可选)</p></td>
      <td><p>&nbsp;
          <input id="app_source_name" name="app_source_name" style="width:550px;"  type="text" value="<?php echo $app->source_name;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 源作者邮箱</b> (可选)</p></td>
      <td><p>&nbsp;
          <input id="app_source_email" name="app_source_email" style="width:550px;"  type="text" value="<?php echo $app->source_email;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 源作者网站</b> (可选)</p></td>
      <td><p>&nbsp;
          <input id="app_source_url" name="app_source_url" style="width:550px;"  type="text" value="<?php echo $app->source_url;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 内置插件管理页</b> (可选)<br/>
          <span class="note">&nbsp;&nbsp;习惯命名为main.php</span></p></td>
      <td><p>&nbsp;
          <input id="app_path" name="app_path" style="width:550px;"  type="text" value="<?php echo $app->path;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 内置插件嵌入页</b> (可选)<br/>
          <span class="note">&nbsp;&nbsp;只能命名为include.php</span></p></td>
      <td><p>&nbsp;
          <input id="app_include" name="app_include" style="width:550px;"  type="text" value="<?php echo $app->include;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 内置插件管理权限</b> (可选)</p></td>
      <td><p>&nbsp;
          <select name="app_level" id="app_level" style="width:200px;">
<?php echo CreateOptoinsOfMemberLevel(1)?>
          </select>
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 主题定价</b></p></td>
      <td><p>&nbsp;
          <input id="app_price" name="app_price" style="width:550px;"  type="text" value="<?php echo $app->price;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 【高级】依赖插件（以|分隔）</b>(可选)</p></td>
      <td><p>&nbsp;
          <input id="app_advanced_dependency" name="app_advanced_dependency" style="width:550px;"  type="text" value="<?php echo $app->advanced_dependency;?>" />
        </p></td>
    </tr>
    <tr style="display:none;">
      <td><p><b>· 【高级】内置插件重写系统函数列表（以|分隔）</b>(可选)</p></td>
      <td><p>&nbsp;
          <input id="app_advanced_rewritefunctions" name="app_advanced_rewritefunctions" style="width:550px;"  type="text" value="<?php echo $app->advanced_rewritefunctions;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 【高级】内置插件冲突插件列表（以|分隔）</b>(可选)</p></td>
      <td><p>&nbsp;
          <input id="app_advanced_conflict" name="app_advanced_conflict" style="width:550px;"  type="text" value="<?php echo $app->advanced_conflict;?>" />
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 详细说明</b> (可选)</p></td>
      <td><p>&nbsp;
          <textarea cols="3" rows="6" id="app_description" name="app_description" style="width:550px;"><?php echo htmlspecialchars($app->description);?></textarea>
        </p></td>
    </tr>
    <tr>
      <td><p><b>· 侧栏配置导出</b> (可选)</p></td>
      <td><p>&nbsp;
          <label>
            <input type="checkbox" name="app_sidebars_sidebar1" value="1" <?php if ($app->sidebars_sidebar1) {
	echo 'checked="checked"';
}
?>  />
            侧栏</label>
          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
          <label>
            <input type="checkbox" name="app_sidebars_sidebar2" value="1" <?php if ($app->sidebars_sidebar2) {
	echo 'checked="checked"';
}
?>   />
            侧栏2</label>
          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
          <label>
            <input type="checkbox" name="app_sidebars_sidebar3" value="1" <?php if ($app->sidebars_sidebar3) {
	echo 'checked="checked"';
}
?>   />
            侧栏3</label>
          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
          <label>
            <input type="checkbox" name="app_sidebars_sidebar4" value="1" <?php if ($app->sidebars_sidebar4) {
	echo 'checked="checked"';
}
?>   />
            侧栏4</label>
          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
          <label>
            <input type="checkbox" name="app_sidebars_sidebar5" value="1" <?php if ($app->sidebars_sidebar5) {
	echo 'checked="checked"';
}
?>   />
            侧栏5</label>
          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p></td>
    </tr>
  </table>
  <p> 提示:主题的缩略图是名为screenshot.png的<b>300x240px</b>大小的png文件,放在插件的目录下.</p>
  <p><br/>
    <input type="submit" class="button" value="提交" id="btnPost" onclick='' />
  </p>
  <p>&nbsp;</p>
</form>


	<script type="text/javascript">ActiveLeftMenu("aAppCentre");</script>
	<script type="text/javascript">AddHeaderIcon("<?php echo $bloghost . 'zb_users/plugin/AppCentre/logo.png';?>");</script>
  </div>
</div>
<?php
require $blogpath . 'zb_system/admin/admin_footer.php';

RunTime();
?>
<?php
#注册插件
RegisterPlugin("<%appid%>","ActivePlugin_<%appid%>");

function ActivePlugin_<%appid%>() {}
function InstallPlugin_<%appid%>() {}
function UninstallPlugin_<%appid%>() {}
<?php
require '../../../zb_system/function/c_system_base.php';
require '../../../zb_system/function/c_system_admin.php';
$zbp->Load();
$action='root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}
if (!$zbp->CheckPlugin('<%appid%>')) {$zbp->ShowError(48);die();}

$blogtitle='<%appid%>';
require $blogpath . 'zb_system/admin/admin_header.php';
require $blogpath . 'zb_system/admin/admin_top.php';
?>
<div id="divMain">
  <div class="divHeader"><?php echo $blogtitle;?></div>
  <div class="SubMenu">
  </div>
  <div id="divMain2">
<!--代码-->
  </div>
</div>

<?php
require $blogpath . 'zb_system/admin/admin_footer.php';
RunTime();
?>
<?php
require '../../../zb_system/function/c_system_base.php';

require '../../../zb_system/function/c_system_admin.php';

require dirname(__FILE__) . '/function.php';

$zbp->Load();

$action = 'root';
if (!$zbp->CheckRights($action)) {$zbp->ShowError(6);die();}

if (!$zbp->CheckPlugin('AppCentre')) {$zbp->ShowError(48);die();}

$blogtitle = '应用中心-系统更新与校验';

$checkbegin = false;
$nowxml = '';

function updatedb_14() {
	global $zbp, $table;

	if ($zbp->db->type == 'mysql') {
		$zbp->db->Query("ALTER TABLE " . $table['Post'] . " DROP INDEX  " . $zbp->db->dbpre . "log_TISC ;");
		$zbp->db->Query("ALTER TABLE " . $table['Post'] . " DROP INDEX  " . $zbp->db->dbpre . "log_PT ;");
		$zbp->db->Query("ALTER TABLE " . $table['Post'] . " ADD INDEX  " . $zbp->db->dbpre . "log_TPISC(log_Type,log_PostTime,log_IsTop,log_Status,log_CateID) ;");
		$zbp->db->Query("ALTER TABLE " . $table['Comment'] . " DROP INDEX  " . $zbp->db->dbpre . "comm_PT ;");
		$zbp->db->Query("ALTER TABLE " . $table['Comment'] . " DROP INDEX  " . $zbp->db->dbpre . "comm_RIL ;");
		$zbp->db->Query("ALTER TABLE " . $table['Comment'] . " ADD INDEX  " . $zbp->db->dbpre . "comm_LRI(comm_LogID,comm_RootID,comm_IsChecking) ;");
		$zbp->db->Query("ALTER TABLE " . $table['Comment'] . " ADD INDEX  " . $zbp->db->dbpre . "comm_IsChecking(comm_IsChecking) ;");
		$zbp->db->Query("ALTER TABLE " . $table['Category'] . " ADD INDEX  " . $zbp->db->dbpre . "cate_Order(cate_Order) ;");
		$zbp->db->Query("ALTER TABLE " . $table['Member'] . " ADD INDEX  " . $zbp->db->dbpre . "mem_Alias(mem_Alias) ;");
		$zbp->db->Query("ALTER TABLE " . $table['Member'] . " ADD INDEX  " . $zbp->db->dbpre . "mem_Level(mem_Level) ;");
	} elseif ($zbp->db->type == 'sqlite') {
		$zbp->db->Query("CREATE INDEX " . $zbp->db->dbpre . "cate_Order on " . $table['Category'] . "(cate_Order) ;");
		$zbp->db->Query("CREATE INDEX " . $zbp->db->dbpre . "mem_Alias on " . $table['Member'] . "(mem_Alias) ;");
	}
	if ($zbp->db->type == 'mysql' || $zbp->db->type == 'sqlite') {
		$zbp->db->DelTable($GLOBALS['table']['Config']);
		$s = $zbp->db->sql->CreateTable($GLOBALS['table']['Config'], $GLOBALS['datainfo']['Config']);
		$zbp->db->QueryMulit($s);
		if ($zbp->db->type == 'mysql') {
			$zbp->db->Query("ALTER TABLE " . $GLOBALS['table']['Config'] . " ADD INDEX  " . $zbp->db->dbpre . "conf_Name(conf_Name) ;");
		} elseif ($zbp->db->type == 'sqlite') {
			$zbp->db->Query("CREATE INDEX " . $zbp->db->dbpre . "conf_Name on " . $GLOBALS['table']['Config'] . "(conf_Name) ;");
		}

		array_unshift($zbp->configs, $zbp->configs['system'], $zbp->configs['cache']);
		foreach ($zbp->configs as $c) {
			$c->Save();
		}
	}
	$zbp->option['ZC_LAST_VERSION'] = $zbp->version;
	$zbp->SaveOption();

	$zbp->SetHint('good');
	Redirect('./update.php?ok');return;
}
if (isset($_GET['updatedb'])) {
	if ($zbp->version >= 150101 && (int) $zbp->option['ZC_LAST_VERSION'] < 150101) {
		updatedb_14();
	}

}
if (GetVars('update', 'GET') != '') {
	$url = APPCENTRE_SYSTEM_UPDATE . '?' . GetVars('update', 'GET') . '.xml';
	$f = AppCentre_GetHttpContent($url);
	$xml = simplexml_load_string($f);
	if ($xml) {
		foreach ($xml->children() as $file) {
			$full = $zbp->path . str_replace('\\', '/', $file['name']);
			$dir = dirname($full);
			if (!file_exists($dir . '/')) {
				@mkdir($dir, 0755, true);
			}

			$f = base64_decode($file);
			@file_put_contents($full, $f);
		}
		$zbp->SetHint('good');
	}
	Redirect('./update.php?updatedb');
}

if (GetVars('restore', 'GET') != '') {
	$file = base64_decode(GetVars('restore', 'GET'));
	$url = APPCENTRE_SYSTEM_UPDATE . '?' . substr(ZC_BLOG_VERSION, -6, 6) . '\\' . $file;
	$f = AppCentre_GetHttpContent($url);
	$file = $zbp->path . str_replace('\\', '/', $file);
	$dir = dirname($file);
	if (!file_exists($dir . '/')) {
		@mkdir($dir, 0755, true);
	}

	@file_put_contents($file, $f);
	echo '<img src="' . $zbp->host . 'zb_system/image/admin/ok.png" width="16" alt="" />';
	die();
}

if (GetVars('check', 'GET') == 'now') {
	$r = AppCentre_GetHttpContent(APPCENTRE_SYSTEM_UPDATE . array_search(ZC_BLOG_VERSION, $zbpvers) . '.xml');
	//file_put_contents($zbp->usersdir . 'cache/now.xml', $r);
	$nowxml = $r;
	$checkbegin = true;
}

require $blogpath . 'zb_system/admin/admin_header.php';
require $blogpath . 'zb_system/admin/admin_top.php';

$newversion = AppCentre_GetHttpContent(APPCENTRE_SYSTEM_UPDATE . ($zbp->Config('AppCentre')->checkbeta == true ? '?beta' : ''));

?>
<div id="divMain">

  <div class="divHeader"><?php echo $blogtitle;?></div>
<div class="SubMenu"><?php AppCentre_SubMenus(3);?></div>
  <div id="divMain2">

            <form method="post" action="">

<p>
<?php
if ($zbp->version >= 150101 && (int) $zbp->option['ZC_LAST_VERSION'] < 150101) {
	echo '<input id="updatenow" type="button" onclick="location.href=\'?updatedb\'" value="升级数据库结构" />';
}

?>
			  </p><hr/>

              <table border="1" width="100%" cellspacing="0" cellpadding="0" class="tableBorder tableBorder-thcenter">
                <tr>
                  <th width='50%'>当前版本</th>
                  <th>最新版本</th>
                </tr>
                <tr>
                  <td align='center' id='now'>Z-BlogPHP <?php echo ZC_BLOG_VERSION?></td>
                  <td align='center' id='last'>Z-BlogPHP <?php echo $newversion;?></td>
                </tr>
              </table>
              <p>

<?php

$nowbuild = (int) $blogversion;
$newbuild = (int) substr($newversion, -6, 6);

if ($newbuild - $nowbuild > 0) {
	echo '<input id="updatenow" type="button" onclick="location.href=\'?update=' . $nowbuild . '-' . $newbuild . '\'" value="升级新版程序" />';
}
?>
              </p>
			  <hr/>
              <div class="divHeader">校验当前版本的系统核心文件&nbsp;&nbsp;<span id="checknow"><a href="?check=now" title="开始校验"><img src="images/refresh.png" width="16" alt="校验" /></a></span></div>
			  <!--<div>进度<span id="status">0</span>%；已发现<span id="count">0</span>个修改过的系统文件。<div id="bar"></div></div>-->
              <table border="1" width="100%" cellspacing="0" cellpadding="0" class="tableBorder tableBorder-thcenter">
                <tr>
                  <th width='78%'>文件名</th>
                  <th id="_s">状态</th>
                </tr>
<?php
$i = 0;
//if (file_exists($zbp->usersdir . 'cache/now.xml')) {
if ($nowxml != '') {

	$i = 0;
	libxml_use_internal_errors(true);
	//$xml=simplexml_load_file($zbp->usersdir . 'cache/now.xml');
	$xml = simplexml_load_string($nowxml);
	if ($xml) {
		foreach ($xml->children() as $file) {
			if (file_exists($f = $zbp->path . str_replace('\\', '/', $file['name']))) {
				$f = file_get_contents($f);
				$newcrc32 = substr(strtoupper(dechex(AppCentre_crc32_signed($f))), -8);
				$f = str_replace("\n", "\r\n", $f);
				$newcrc32_2 = substr(strtoupper(dechex(AppCentre_crc32_signed($f))), -8);
			} else {
				$newcrc32 = '';
				$newcrc32_2 = '';
			}
			//echo PHP_INT_SIZE;
			if (($newcrc32 == $file['crc32']) || ($newcrc32_2 == $file['crc32'])) {
				echo '<tr style="display:none;"><td><b>' . str_replace('\\', '/', $file['name']) . '</b></td>';
				$s = '<img src="' . $zbp->host . 'zb_system/image/admin/ok.png" width="16" alt="" />';
			} else {
				$i += 1;
				echo '<tr><td><b>' . str_replace('\\', '/', $file['name']) . '</b></td>';
				$s = '<a href="javascript:void(0)" onclick="restore(\'' . base64_encode($file['name']) . '\',\'file' . md5($file['name']) . '\')" class="resotrefile button" title="还原系统文件"><img src="' . $zbp->host . 'zb_system/image/admin/exclamation.png" width="16" alt=""></a>';
			}
			echo '<td class="tdCenter" id="file' . md5($file['name']) . '">' . $s . '</td></tr>';
		}
	}
	echo '<tr><th colspan="2">' . $i . '个文件不同或被修改过.</tr>';
	//@unlink($zbp->usersdir . 'cache/now.xml');
}
?>

              </table>
<?php if ($i > 0) {?>
              <p>
                <input name="submit" type="button" id="autorestor" onclick="restoreauto();$(this).hide();" value="自动依次更新文件" class="button" />
              </p>
<?php }
?>
              <p> </p>
            </form>
<script type="text/javascript">

$("#autorestor").bind('click', function(){restoresingle();$(this).hide()});

function restoresingle(){
  if($("a.resotrefile").get(0)){
    $("a.resotrefile").get(0).click();
    setTimeout("restoresingle()",1000);
  }
}


function restore(f,id){
	$.get(bloghost+"zb_users/plugin/AppCentre/update.php?restore="+f, function(data){
		//alert(data);
		$('#'+id).html(data);
	});
}
</script>
	<script type="text/javascript">ActiveLeftMenu("aAppCentre");</script>
	<script type="text/javascript">AddHeaderIcon("<?php echo $bloghost . 'zb_users/plugin/AppCentre/logo.png';?>");</script>
  </div>
</div>


<?php
require $blogpath . 'zb_system/admin/admin_footer.php';

RunTime();
?>

Fixed code: