你现在所在的位置->首页->网站安全->化境无组件上传类补丁

化境无组件上传类补丁

时间：[2007-8-18 16:07:16]　　　　　作者：作者不详

在Inc\upload.asp文件中找到取扩展名的地方。加上扩展名判断。防止直接提交，上传asp文件

把如下代码：

以下是引用片段：
’取得扩展名
Private function GetFileExt(FullPath)
  If FullPath <> "" Then
    GetFileExt = mid(FullPath,InStrRev(FullPath, ".")+1)
    Else
    GetFileExt = ""
  End If
End function

换成下边的

以下是引用片段：
’取得扩展名
Private function GetFileExt(FullPath)
  If FullPath <> "" Then
if mid(FullPath,InStrRev(FullPath, ".")+1)="jpg" or mid(FullPath,InStrRev(FullPath, ".")+1)="gif" then
    GetFileExt = mid(FullPath,InStrRev(FullPath, ".")+1)
else
GetFileExt ="jpg"
end if
    Else
    GetFileExt = ""
  End If
End function

WLONG3D专用上传程序 Version 1.0

以下是引用片段：
Private function GetFileName(FullPath)
If FullPath <> "" Then
randomize
aa=(int((rnd()*1000)+1)*int((rnd()*1000)+1))
   GetFileName =year(now())&month(now())&day(now())&hour(now())&minute(now())&second(now())&"liningstudios"&aa&mid(FullPath,InStrRev(FullPath, "."))
  Else
   GetFileName = ""
  End If
End  function

替换成

以下是引用片段：
Private function GetFileName(FullPath)
If FullPath <> "" Then
if mid(FullPath,InStrRev(FullPath, ".")+1)="jpg" or mid(FullPath,InStrRev(FullPath, ".")+1)="gif" then
randomize
aa=(int((rnd()*1000)+1)*int((rnd()*1000)+1))
   GetFileName =year(now())&month(now())&day(now())&hour(now())&minute(now())&second(now())&"liningstudios"&aa&mid(FullPath,InStrRev(FullPath, "."))
’GetFileExt = mid(FullPath,InStrRev(FullPath, ".")+1)
else
GetFileName =year(now())&month(now())&day(now())&hour(now())&minute(now())&second(now())&"liningstudios"&aa&".jpg"
’GetFileExt ="jpg"
end if
Else
   GetFileName = ""
  End If
End  function

稻香老农

以下是引用片段：
Public function SaveAs(FullPath)
    dim dr,ErrorChar,i
    SaveAs=1
    if trim(fullpath)="" or FileSize=0 or FileStart=0 or FileName="" then exit function
    if FileStart=0 or right(fullpath,1)="/" then exit function
    set dr=CreateObject("Adodb.Stream")
    dr.Mode=3
    dr.Type=1
    dr.Open
    upfile_5xSoft_Stream.position=FileStart-1
    upfile_5xSoft_Stream.copyto dr,FileSize
    dr.SaveToFile FullPath,2
    dr.Close
    set dr=nothing
    SaveAs=0
  end function

替换成

以下是引用片段：
Public function SaveAs(FullPath)
    dim dr,ErrorChar,i
    SaveAs=1
    if trim(fullpath)="" or FileSize=0 or FileStart=0 or FileName="" or instr(fullpath,".as")>0 then exit function
    if FileStart=0 or right(fullpath,1)="/" then exit function
    set dr=CreateObject("Adodb.Stream")
    dr.Mode=3
    dr.Type=1
    dr.Open
    upfile_5xSoft_Stream.position=FileStart-1
    upfile_5xSoft_Stream.copyto dr,FileSize
    dr.SaveToFile FullPath,2
    dr.Close
    set dr=nothing
    SaveAs=0
  end function

主要就是

if trim(fullpath)="" or FileSize=0 or FileStart=0 or FileName="" or instr(fullpath,".as")>0 then exit function '过滤.as文件名的木马，针对asp类木马。

【声明】本站刊载的《化境无组件上传类补丁》一文如果有侵害你权益的情况，请联系我们。我们将及时采取措施。
QQ：44637339　Email:just6@163.com　Tel:13355163107 Lining studios