DedeCms V5.6漏洞 变量未初始化 导致鸡助漏洞

if($mid == 0) //必须绕过 。
{
showmsg(参数不正确，高级自定义搜索必须指定模型id, javascript);
exit();
}
$query = "select maintable, mainfields, addontable, addonfields, template from dede_advancedsearch where mid=$mid";
$searchinfo = $dsql->GetOne($query);
if(!is_array($searchinfo)) //囧啊，绕过有难度 。
{
showmsg(自定义搜索模型不存在,-1); exit();
}
$template = $searchinfo[template] != ? $searchinfo[template] : advancedsearch.htm;
if(empty($sql)) //人品问题，成功绕过！{
..............
}else{
$sql = urldecode($sql);
$query = $sql;
}
$sql = urlencode($sql);
$dlist = new DataListCP();
$dlist->pageSize = 20;
$dlist->SetParameter("sql", $sql);
$dlist->SetParameter("mid", $mid);
...............
$dlist->SetTemplate($templatefile);
$dlist->SetSource($query);
.............<*参考
*>