開(kāi)發(fā)dz插件后臺(tái)提示錯(cuò)誤
Jun 23, 2016 pm 01:49 PM這是php的代碼
<?phpif(!defined('IN_DISCUZ') || !defined('IN_ADMINCP')) { exit('Access Denied');} include template('baoming:fabu'); if($_GET['a'] == 'post'){ if($_GET['submit'] && submitcheck('formhash')) { $arr=array(); $arr['name']=trim($_GET['name']); $arr['jj']=$_GET['jj']; if($arr['name']=='') showmessage('名稱(chēng)不能為空'); if($arr['jj']=='') showmessage('簡(jiǎn)介不能為空'); $arr = daddslashes($arr); $id=DB::insert('bm_post',$arr,true);if($id>0){showmessage('添加失敗');}else{showmessage('添加失敗');} }}?>
模板的
<form id="form" name="form" method="post" action="plugin.php?id=baoming:fabu&a=post" enctype="multipart/form-data"><table width="100%" border="0" cellpadding="0" cellspacing="0" class="a1" style="margin-top:15px;"> <tr> <td width="10"> </td> <td width="100">名稱(chēng):</td> <td><input name="name" id="name" type="text" size="50" /></td> </tr> <tr> <td> </td> <td>簡(jiǎn)介:</td> <td> <label></label> <label> <textarea name="jj" cols="60" rows="4"></textarea> </label></td> </tr> <tr> <td> </td> <td> </td> <td><label> <input type="submit" name="submit" style="height:25px;" value="提交" /> <input type="reset" name="submit2" style="height:25px;" value="重寫(xiě)" /> </label></td> </tr></table><input type="hidden" name="formhash" value="{FORMHASH}" /></form>
錯(cuò)誤提示
Discuz! System Error
您當(dāng)前的訪問(wèn)請(qǐng)求當(dāng)中含有非法字符,已經(jīng)被系統(tǒng)拒絕
PHP Debug
[Line: 0025]admin.php(discuz_application->init)
[Line: 0071]source\class\discuz\discuz_application.php(discuz_application->_init_misc)
[Line: 0552]source\class\discuz\discuz_application.php(discuz_application->_xss_check)
[Line: 0355]source\class\discuz\discuz_application.php(system_error)
[Line: 0023]source\function\function_core.php(discuz_error::system_error)
[Line: 0024]source\class\discuz\discuz_error.php(discuz_error::debug_backtrace)
回復(fù)討論(解決方案)
請(qǐng)貼出你提交后php頁(yè)面獲取的$_SERVER['REQUEST_URI']
應(yīng)該是有特殊字符,<,“,CONTENT-TRANSFER-ENCODING
請(qǐng)貼出你提交后php頁(yè)面獲取的$_SERVER['REQUEST_URI']
應(yīng)該是有特殊字符,<,“,CONTENT-TRANSFER-ENCODING
我在空表單上提交也是提示這個(gè)
這個(gè)說(shuō)不清楚,只能看你的$_SERVER['REQUEST_URI']這個(gè)值
拋出錯(cuò)誤的位置在source\class\discuz\discuz_application.php,里面有個(gè)_xss_check()的私有方法,你自己看一下吧
$_SERVER['REQUEST_URI']這個(gè)值
/admin.php?action=plugins&operation=config&do=23&identifier=baoming&pmod=fabu
X2.5測(cè)試沒(méi)問(wèn)題,請(qǐng)查看你的_xss_check()方法,在source\class\discuz\discuz_application.php
是否如下所示,若不是,請(qǐng)?zhí)鎿Q
private function _xss_check() { $temp = strtoupper(urldecode(urldecode($_SERVER['REQUEST_URI']))); if(strpos($temp, '<') !== false || strpos($temp, '"') !== false || strpos($temp, 'CONTENT-TRANSFER-ENCODING') !== false) { system_error('request_tainting'); } return true; }
是不是這的事
是不是這的事
我檢查了 這里都對(duì)
好像是 formhash 發(fā)送說(shuō)是接受有錯(cuò)誤
應(yīng)該是formhash的問(wèn)題,因?yàn)樵瓉?lái)的_xss_check()方法是要驗(yàn)證formhash
private function _xss_check() { static $check = array('"', '>', '<', '\'', '(', ')', 'CONTENT-TRANSFER-ENCODING'); if(isset($_GET['formhash']) && $_GET['formhash'] !== formhash()) { system_error('request_tainting'); } if($_SERVER['REQUEST_METHOD'] == 'GET' ) { $temp = $_SERVER['REQUEST_URI']; } elseif(empty ($_GET['formhash'])) { $temp = $_SERVER['REQUEST_URI'].file_get_contents('php://input'); } else { $temp = ''; } if(!empty($temp)) { $temp = strtoupper(urldecode(urldecode($temp))); foreach ($check as $str) { if(strpos($temp, $str) !== false) { system_error('request_tainting'); } } } return true;}
所以,讓你改為X2.5的_xss_check()方法試試
在前臺(tái)也得驗(yàn)證formhash,怎么就可以通過(guò),到了后臺(tái)就不行了呢
呃...能力有限,沒(méi)研究過(guò),也沒(méi)遇到過(guò)
而且,根據(jù)discuz的報(bào)錯(cuò),我在X2.5的discuz_application.php的_init_misc方法中沒(méi)有找到執(zhí)行_xss_check()的代碼
不知道你的版本是多少
若是低版本就將discuz_application.php這個(gè)文件覆蓋一下試試
哎??!??我是3.2的
無(wú)論如何非常感謝jam00??結(jié)貼給分
我擦,沒(méi)玩過(guò)這么高大上的版本...我下來(lái)看了一下,還真有,我看看...

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

What should I do if Google Chrome prompts that the content of this tab is being shared? When we use Google Chrome to open a new tab, we sometimes encounter a prompt that the content of this tab is being shared. So what is going on? Let this site provide users with a detailed introduction to the problem of Google Chrome prompting that the content of this tab is being shared. Google Chrome prompts that the content of this tab is being shared. Solution: 1. Open Google Chrome. You can see three dots in the upper right corner of the browser "Customize and control Google Chrome". Click the icon with the mouse to change the icon. 2. After clicking, the menu window of Google Chrome will pop up below, and the mouse will move to "More Tools"

If you encounter an error message when using your printer, such as the operation could not be completed (error 0x00000771), it may be because the printer has been disconnected. In this case, you can solve the problem through the following methods. In this article, we will discuss how to fix this issue on Windows 11/10 PC. The entire error message says: The operation could not be completed (error 0x0000771). The specified printer has been deleted. Fix 0x00000771 Printer Error on Windows PC To fix Printer Error the operation could not be completed (Error 0x0000771), the specified printer has been deleted on Windows 11/10 PC, follow this solution: Restart Print Spool

Table of Contents Solution 1 Solution 21. Delete the temporary files of Windows update 2. Repair damaged system files 3. View and modify registry entries 4. Turn off the network card IPv6 5. Run the WindowsUpdateTroubleshooter tool to repair 6. Turn off the firewall and other related anti-virus software. 7. Close the WidowsUpdate service. Solution 3 Solution 4 "0x8024401c" error occurs during Windows update on Huawei computers Symptom Problem Cause Solution Still not solved? Recently, the web server needs to be updated due to system vulnerabilities. After logging in to the server, the update prompts error code 0x8024401c. Solution 1

The display error is a problem that may occur in the Xiangxiang Fuzhai app. Some users are not sure why the Xiangxiang Fuzhai app displays errors. It may be due to network connection problems, too many background programs, incorrect registration information, etc. Next, This is the editor’s introduction to how to solve app display errors for users. Interested users should come and take a look! Why does the Xiangxiang Fuzhai app display an error answer: network connection problem, too many background programs, incorrect registration information, etc. Details: 1. [Network problem] Solution: Check the device connection network status, reconnect or choose another network connection to use. Can. 2. [Too many background programs] Solution: Close other running programs and release the system, which can speed up the running of the software. 3. [Incorrect registration information

This AI-assisted programming tool has unearthed a large number of useful AI-assisted programming tools in this stage of rapid AI development. AI-assisted programming tools can improve development efficiency, improve code quality, and reduce bug rates. They are important assistants in the modern software development process. Today Dayao will share with you 4 AI-assisted programming tools (and all support C# language). I hope it will be helpful to everyone. https://github.com/YSGStudyHards/DotNetGuide1.GitHubCopilotGitHubCopilot is an AI coding assistant that helps you write code faster and with less effort, so you can focus more on problem solving and collaboration. Git

When users use the Edge browser, they may add some plug-ins to meet more of their needs. But when adding a plug-in, it shows that this plug-in is not supported. How to solve this problem? Today, the editor will share with you three solutions. Come and try it. Method 1: Try using another browser. Method 2: The Flash Player on the browser may be out of date or missing, causing the plug-in to be unsupported. You can download the latest version from the official website. Method 3: Press the "Ctrl+Shift+Delete" keys at the same time. Click "Clear Data" and reopen the browser.

On March 3, 2022, less than a month after the birth of the world's first AI programmer Devin, the NLP team of Princeton University developed an open source AI programmer SWE-agent. It leverages the GPT-4 model to automatically resolve issues in GitHub repositories. SWE-agent's performance on the SWE-bench test set is similar to Devin, taking an average of 93 seconds and solving 12.29% of the problems. By interacting with a dedicated terminal, SWE-agent can open and search file contents, use automatic syntax checking, edit specific lines, and write and execute tests. (Note: The above content is a slight adjustment of the original content, but the key information in the original text is retained and does not exceed the specified word limit.) SWE-A

Go language development mobile application tutorial As the mobile application market continues to boom, more and more developers are beginning to explore how to use Go language to develop mobile applications. As a simple and efficient programming language, Go language has also shown strong potential in mobile application development. This article will introduce in detail how to use Go language to develop mobile applications, and attach specific code examples to help readers get started quickly and start developing their own mobile applications. 1. Preparation Before starting, we need to prepare the development environment and tools. head
