« 感冒了,头有点晕! | (回到Blog入口) | 没有动态网页空间一样可以做BLOG! »

L-Blog1.08F最新日志留言漏洞的修正方法

原文地址为[url=http://www.lccy163.com/blogview.asp?logID=593]http://www.lccy163.com/blogview.asp?logID=593[/url]      
1.08F版的请打开include/ubbcode.asp文件,找到
[code]
Function CheckLinkStr(Str)
    Str = Replace(Str, "document.cookie", ".")

原文地址为[url=http://www.lccy163.com/blogview.asp?logID=593]http://www.lccy163.com/blogview.asp?logID=593[/url]
1.08F版的请打开include/ubbcode.asp文件,找到
[code]
Function CheckLinkStr(Str)
Str = Replace(Str, "document.cookie", ".")
Str = Replace(Str, "document.write", ".")
Str = Replace(Str, "javascript:", "javascript ")
Str = Replace(Str, "vbscript:", "vbscript ")
Str = Replace(Str, "javascript :", "javascript ")
Str = Replace(Str, "vbscript :", "vbscript ")
Str = Replace(Str, "[", "[")
Str = Replace(Str, "]", "]")
Str = Replace(Str, "<", "<")
Str = Replace(Str, ">", ">")
Str = Replace(Str, "{", "{")
Str = Replace(Str, "}", "}")
Str = Replace(Str, "|", "|")
Str = Replace(Str, "script", "script")
Str = Replace(Str, "SCRIPT", "SCRIPT")
Str = Replace(Str, "Script", "Script")
Str = Replace(Str, "script", "Script")
Str = Replace(Str, "object", "object")
Str = Replace(Str, "OBJECT", "OBJECT")
Str = Replace(Str, "Object", "Object")
Str = Replace(Str, "object", "Object")
Str = Replace(Str, "applet", "applet")
Str = Replace(Str, "APPLET", "APPLET")
Str = Replace(Str, "Applet", "Applet")
Str = Replace(Str, "applet", "Applet")
Str = Replace(Str, "embed", "embed")
Str = Replace(Str, "EMBED", "EMBED")
Str = Replace(Str, "Embed", "Embed")
Str = Replace(Str, "embed", "Embed")
Str = Replace(Str, "document", "document")
Str = Replace(Str, "DOCUMENT", "DOCUMENT")
Str = Replace(Str, "Document", "Document")
Str = Replace(Str, "document", "Document")
Str = Replace(Str, "cookie", "cookie")
Str = Replace(Str, "COOKIE", "COOKIE")
Str = Replace(Str, "Cookie", "Cookie")
Str = Replace(Str, "cookie", "Cookie")
Str = Replace(Str, "event", "event")
Str = Replace(Str, "EVENT", "EVENT")
Str = Replace(Str, "Event", "Event")
Str = Replace(Str, "event", "Event")
CheckLinkStr = Str
End Function
[/code]

置换成
[code]
Function CheckLinkStr(Str)
If Len(Str) > 0 Then
Str = Replace(Str, "document.cookie", ".",1,-1,1)
Str = Replace(Str, "document.write", ".",1,-1,1)
Str = Replace(Str, "javascript:", "javascript ",1,-1,1)
Str = Replace(Str, "vbscript:", "vbscript ",1,-1,1)
Str = Replace(Str, "javascript :", "javascript ",1,-1,1)
Str = Replace(Str, "vbscript :", "vbscript ",1,-1,1)
Str = Replace(Str, "[", "[",1,-1,1)
Str = Replace(Str, "]", "]",1,-1,1)
Str = Replace(Str, "<", "<",1,-1,1)
Str = Replace(Str, ">", ">",1,-1,1)
Str = Replace(Str, "{", "{",1,-1,1)
Str = Replace(Str, "}", "}",1,-1,1)
Str = Replace(Str, "|", "|",1,-1,1)
Str = Replace(Str, "script", "script",1,-1,1)
Str = Replace(Str, "SCRIPT", "SCRIPT",1,-1,1)
Str = Replace(Str, "Script", "Script",1,-1,1)
Str = Replace(Str, "script", "Script",1,-1,1)
Str = Replace(Str, "object", "object",1,-1,1)
Str = Replace(Str, "OBJECT", "OBJECT",1,-1,1)
Str = Replace(Str, "Object", "Object",1,-1,1)
Str = Replace(Str, "object", "Object",1,-1,1)
Str = Replace(Str, "applet", "applet",1,-1,1)
Str = Replace(Str, "APPLET", "APPLET",1,-1,1)
Str = Replace(Str, "Applet", "Applet",1,-1,1)
Str = Replace(Str, "applet", "Applet",1,-1,1)
Str = Replace(Str, "embed", "embed",1,-1,1)
Str = Replace(Str, "EMBED", "EMBED",1,-1,1)
Str = Replace(Str, "Embed", "Embed",1,-1,1)
Str = Replace(Str, "embed", "Embed",1,-1,1)
Str = Replace(Str, "document", "document",1,-1,1)
Str = Replace(Str, "DOCUMENT", "DOCUMENT",1,-1,1)
Str = Replace(Str, "Document", "Document",1,-1,1)
Str = Replace(Str, "document", "Document",1,-1,1)
Str = Replace(Str, "cookie", "cookie",1,-1,1)
Str = Replace(Str, "COOKIE", "COOKIE",1,-1,1)
Str = Replace(Str, "Cookie", "Cookie",1,-1,1)
Str = Replace(Str, "cookie", "Cookie",1,-1,1)
Str = Replace(Str, "event", "event",1,-1,1)
Str = Replace(Str, "EVENT", "EVENT",1,-1,1)
Str = Replace(Str, "Event", "Event",1,-1,1)
Str = Replace(Str, "event", "Event",1,-1,1)
End if
CheckLinkStr = Str
End Function
[/code]

保存后上传即可

关于

此页面包含了发表于2006年6月15日 09:46的 Blog 上的单篇日记。

此 Blog 的前一篇日记是 感冒了,头有点晕!

此 Blog 的后一篇日记是 没有动态网页空间一样可以做BLOG!

更多信息可在 主索引 页和 归档 页看到。

Creative Commons License
此 Blog 中的日记遵循以下授权 Creative Commons(创作共用)授权.
Powered by
Movable Type 6.3.2