熟悉discuz!的朋友應該知道，discuz!的附件在前臺顯示的都是動態的下載連結，例如：

http://localhost/forum.php?mod=attachment&aid=MTc2NTF8OTVkOTMyODB8MTQ5MTk4MDg1MHwxfDMyMQ%3D%3D

從上面我們看到，引數aid並不是附件表中的aid，難道此次有加密？

我們來研究一下這個aid引數的生成方法：

\source\function\function_core.php

function aidencode($aid, $type = 0, $tid = 0) {
	global $_G;
	$s = !$type ? $aid.'|'.substr(md5($aid.md5($_G['config']['security']['authkey']).TIMESTAMP.$_G['uid']), 0, 8).'|'.TIMESTAMP.'|'.$_G['uid'].'|'.$tid : $aid.'|'.md5($aid.md5($_G['config']['security']['authkey']).TIMESTAMP).'|'.TIMESTAMP;
	return rawurlencode(base64_encode($s));
}
 

\source\module\forum\forum_attachment.php

@list($_GET['aid'], $_GET['k'], $_GET['t'], $_GET['uid'], $_GET['tableid']) = daddslashes(explode('|', base64_decode($_GET['aid'])));