PJBlog 170版本重要安全补丁（2009-04-22）所有PJ170用户必须更新此补丁

[全站通告] 想快速节省您的时间并可接受付费的朋友，可扫右边二维码加博主微信-非诚勿扰！

4.22补丁：

增加 Checkxss()重要函数。

代码安全由安全小组测试通过。

升级包请下载后直接覆盖

'==============================================
'补丁修改方法
'==============================================
Action.asp
request("cname") 改成 Checkxss(request.QueryString("cname"))
request("mainurl") 改成 Checkxss(request.QueryString("mainurl"))
request("main") 改成 Checkxss(request.QueryString("main"))
common/function.asp中增加函数
[code]

'*************************************
'防XSS注入函数 更新于2009-04-21 by evio
'与checkstr()相比, checkxss更加安全
'*************************************
Function Checkxss(byVal ChkStr)
Dim Str
Str = ChkStr
If IsNull(Str) Then
CheckStr = ""
Exit Function
End If
Str = Replace(Str, "&", "&")
Str = Replace(Str, "'", "´")
Str = Replace(Str, """", """)
Str = Replace(Str, "<", "&lt;") Str = Replace(Str, ">", "&gt;")
Str = Replace(Str, "/", "&#47;")
Str = Replace(Str, "*", "&#42;")
Dim re
Set re = New RegExp
re.IgnoreCase = True
re.Global = True
re.Pattern = "(w)(here)"
Str = re.Replace(Str, "$1here")
re.Pattern = "(s)(elect)"
Str = re.Replace(Str, "$1elect")
re.Pattern = "(i)(nsert)"
Str = re.Replace(Str, "$1nsert")
re.Pattern = "(c)(reate)"
Str = re.Replace(Str, "$1reate")
re.Pattern = "(d)(rop)"
Str = re.Replace(Str, "$1rop")
re.Pattern = "(a)(lter)"
Str = re.Replace(Str, "$1lter")
re.Pattern = "(d)(elete)"
Str = re.Replace(Str, "$1elete")
re.Pattern = "(u)(pdate)"
Str = re.Replace(Str, "$1pdate")
re.Pattern = "(\s)(or)"
Str = re.Replace(Str, "$1or")
re.Pattern = "(\n)"
Str = re.Replace(Str, "$1or")
'----------------------------------
re.Pattern = "(java)(script)"
Str = re.Replace(Str, "$1script")
re.Pattern = "(j)(script)"
Str = re.Replace(Str, "$1script")
re.Pattern = "(vb)(script)"
Str = re.Replace(Str, "$1script")
'----------------------------------
If Instr(Str, "expression") > 0 Then
Str = Replace(Str, "expression", "e&shy;xpression", 1, -1, 0) '防止xss注入
End If
Set re = Nothing
Checkxss = Str
End Function
[/code]

class/cls_logAction.asp中找到

[code]
oldcname = request.form("oldcname")
oldcate = request.form("oldcate")
oldctype = request.form("oldtype")
[/code]
改成
[code]
oldcname = Checkxss(request.form("oldcname"))
oldcate = Checkxss(request.form("oldcate"))
oldctype = Checkxss(request.form("oldtype"))
[/code]
GetArticle.asp
blog_postFile = request("blog_postFile") 改成 blog_postFile = Cint(Checkxss(request.QueryString("blog_postFile")))

官方下载地址

问题未解决？付费解决问题加Q或微信 2589053300 (即Q号又微信号)右上方扫一扫可加博主微信

所写所说，是心之所感，思之所悟，行之所得；文当无敷衍，落笔求简洁。 以所舍，求所获；有所依，方所成！