国产av日韩一区二区三区精品,成人性爱视频在线观看,国产,欧美,日韩,一区,www.成色av久久成人,2222eeee成人天堂

Table of Contents
回復(fù)討論(解決方案)
Home Backend Development PHP Tutorial 開(kāi)發(fā)dz插件后臺(tái)提示錯(cuò)誤

開(kāi)發(fā)dz插件后臺(tái)提示錯(cuò)誤

Jun 23, 2016 pm 01:49 PM
develop hint plug-in mistake

這是php的代碼

<?phpif(!defined('IN_DISCUZ') || !defined('IN_ADMINCP')) {	exit('Access Denied');}			include template('baoming:fabu');	if($_GET['a'] == 'post'){		if($_GET['submit'] && submitcheck('formhash'))	{		$arr=array();		$arr['name']=trim($_GET['name']);		$arr['jj']=$_GET['jj'];				if($arr['name']=='') showmessage('名稱(chēng)不能為空');		if($arr['jj']=='') showmessage('簡(jiǎn)介不能為空');						$arr = daddslashes($arr);				$id=DB::insert('bm_post',$arr,true);if($id>0){showmessage('添加失敗');}else{showmessage('添加失敗');}			}}?>

模板的
<form id="form" name="form" method="post" action="plugin.php?id=baoming:fabu&a=post" enctype="multipart/form-data"><table width="100%" border="0" cellpadding="0" cellspacing="0" class="a1" style="margin-top:15px;">  <tr>    <td width="10"> </td>    <td width="100">名稱(chēng):</td>    <td><input name="name" id="name" type="text" size="50" /></td>  </tr>    <tr>      <td> </td>      <td>簡(jiǎn)介:</td>      <td>        <label></label>       <label>          <textarea name="jj" cols="60" rows="4"></textarea>      </label></td>    </tr>    <tr>    <td> </td>    <td> </td>    <td><label>      <input type="submit" name="submit" style="height:25px;" value="提交"  />              <input type="reset" name="submit2" style="height:25px;" value="重寫(xiě)" />      </label></td>  </tr></table><input type="hidden" name="formhash" value="{FORMHASH}" /></form>

錯(cuò)誤提示
Discuz! System Error

您當(dāng)前的訪問(wèn)請(qǐng)求當(dāng)中含有非法字符,已經(jīng)被系統(tǒng)拒絕
PHP Debug

[Line: 0025]admin.php(discuz_application->init)
[Line: 0071]source\class\discuz\discuz_application.php(discuz_application->_init_misc)
[Line: 0552]source\class\discuz\discuz_application.php(discuz_application->_xss_check)
[Line: 0355]source\class\discuz\discuz_application.php(system_error)
[Line: 0023]source\function\function_core.php(discuz_error::system_error)
[Line: 0024]source\class\discuz\discuz_error.php(discuz_error::debug_backtrace)


回復(fù)討論(解決方案)

請(qǐng)貼出你提交后php頁(yè)面獲取的$_SERVER['REQUEST_URI']
應(yīng)該是有特殊字符,<,“,CONTENT-TRANSFER-ENCODING

請(qǐng)貼出你提交后php頁(yè)面獲取的$_SERVER['REQUEST_URI']
應(yīng)該是有特殊字符,<,“,CONTENT-TRANSFER-ENCODING



我在空表單上提交也是提示這個(gè)

這個(gè)說(shuō)不清楚,只能看你的$_SERVER['REQUEST_URI']這個(gè)值
拋出錯(cuò)誤的位置在source\class\discuz\discuz_application.php,里面有個(gè)_xss_check()的私有方法,你自己看一下吧

$_SERVER['REQUEST_URI']這個(gè)值

/admin.php?action=plugins&operation=config&do=23&identifier=baoming&pmod=fabu

X2.5測(cè)試沒(méi)問(wèn)題,請(qǐng)查看你的_xss_check()方法,在source\class\discuz\discuz_application.php
是否如下所示,若不是,請(qǐng)?zhí)鎿Q

private function _xss_check() {		$temp = strtoupper(urldecode(urldecode($_SERVER['REQUEST_URI'])));		if(strpos($temp, '<') !== false || strpos($temp, '"') !== false || strpos($temp, 'CONTENT-TRANSFER-ENCODING') !== false) {			system_error('request_tainting');		}		return true;	}



是不是這的事



是不是這的事



我檢查了 這里都對(duì)

好像是 formhash 發(fā)送說(shuō)是接受有錯(cuò)誤

應(yīng)該是formhash的問(wèn)題,因?yàn)樵瓉?lái)的_xss_check()方法是要驗(yàn)證formhash

private function _xss_check() {	static $check = array('"', '>', '<', '\'', '(', ')', 'CONTENT-TRANSFER-ENCODING');	if(isset($_GET['formhash']) && $_GET['formhash'] !== formhash()) {		system_error('request_tainting');	}	if($_SERVER['REQUEST_METHOD'] == 'GET' ) {		$temp = $_SERVER['REQUEST_URI'];	} elseif(empty ($_GET['formhash'])) {		$temp = $_SERVER['REQUEST_URI'].file_get_contents('php://input');	} else {		$temp = '';	}	if(!empty($temp)) {		$temp = strtoupper(urldecode(urldecode($temp)));		foreach ($check as $str) {			if(strpos($temp, $str) !== false) {				system_error('request_tainting');			}		}	}	return true;}


所以,讓你改為X2.5的_xss_check()方法試試

在前臺(tái)也得驗(yàn)證formhash,怎么就可以通過(guò),到了后臺(tái)就不行了呢

呃...能力有限,沒(méi)研究過(guò),也沒(méi)遇到過(guò)
而且,根據(jù)discuz的報(bào)錯(cuò),我在X2.5的discuz_application.php的_init_misc方法中沒(méi)有找到執(zhí)行_xss_check()的代碼
不知道你的版本是多少
若是低版本就將discuz_application.php這個(gè)文件覆蓋一下試試

哎??!??我是3.2的

無(wú)論如何非常感謝jam00??結(jié)貼給分

我擦,沒(méi)玩過(guò)這么高大上的版本...我下來(lái)看了一下,還真有,我看看...

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undress AI Tool

Undress AI Tool

Undress images for free

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Hot Topics

PHP Tutorial
1502
276
What should I do if Google Chrome prompts that the content of this tab is being shared? What should I do if Google Chrome prompts that the content of this tab is being shared? Mar 13, 2024 pm 05:00 PM

What should I do if Google Chrome prompts that the content of this tab is being shared? When we use Google Chrome to open a new tab, we sometimes encounter a prompt that the content of this tab is being shared. So what is going on? Let this site provide users with a detailed introduction to the problem of Google Chrome prompting that the content of this tab is being shared. Google Chrome prompts that the content of this tab is being shared. Solution: 1. Open Google Chrome. You can see three dots in the upper right corner of the browser "Customize and control Google Chrome". Click the icon with the mouse to change the icon. 2. After clicking, the menu window of Google Chrome will pop up below, and the mouse will move to "More Tools"

Unable to complete operation (Error 0x0000771) Printer error Unable to complete operation (Error 0x0000771) Printer error Mar 16, 2024 pm 03:50 PM

If you encounter an error message when using your printer, such as the operation could not be completed (error 0x00000771), it may be because the printer has been disconnected. In this case, you can solve the problem through the following methods. In this article, we will discuss how to fix this issue on Windows 11/10 PC. The entire error message says: The operation could not be completed (error 0x0000771). The specified printer has been deleted. Fix 0x00000771 Printer Error on Windows PC To fix Printer Error the operation could not be completed (Error 0x0000771), the specified printer has been deleted on Windows 11/10 PC, follow this solution: Restart Print Spool

Solution to Windows Update prompt Error 0x8024401c error Solution to Windows Update prompt Error 0x8024401c error Jun 08, 2024 pm 12:18 PM

Table of Contents Solution 1 Solution 21. Delete the temporary files of Windows update 2. Repair damaged system files 3. View and modify registry entries 4. Turn off the network card IPv6 5. Run the WindowsUpdateTroubleshooter tool to repair 6. Turn off the firewall and other related anti-virus software. 7. Close the WidowsUpdate service. Solution 3 Solution 4 "0x8024401c" error occurs during Windows update on Huawei computers Symptom Problem Cause Solution Still not solved? Recently, the web server needs to be updated due to system vulnerabilities. After logging in to the server, the update prompts error code 0x8024401c. Solution 1

Why does the Xiangxiangfuzhai app display an error? Why does the Xiangxiangfuzhai app display an error? Mar 19, 2024 am 08:04 AM

The display error is a problem that may occur in the Xiangxiang Fuzhai app. Some users are not sure why the Xiangxiang Fuzhai app displays errors. It may be due to network connection problems, too many background programs, incorrect registration information, etc. Next, This is the editor’s introduction to how to solve app display errors for users. Interested users should come and take a look! Why does the Xiangxiang Fuzhai app display an error answer: network connection problem, too many background programs, incorrect registration information, etc. Details: 1. [Network problem] Solution: Check the device connection network status, reconnect or choose another network connection to use. Can. 2. [Too many background programs] Solution: Close other running programs and release the system, which can speed up the running of the software. 3. [Incorrect registration information

Four recommended AI-assisted programming tools Four recommended AI-assisted programming tools Apr 22, 2024 pm 05:34 PM

This AI-assisted programming tool has unearthed a large number of useful AI-assisted programming tools in this stage of rapid AI development. AI-assisted programming tools can improve development efficiency, improve code quality, and reduce bug rates. They are important assistants in the modern software development process. Today Dayao will share with you 4 AI-assisted programming tools (and all support C# language). I hope it will be helpful to everyone. https://github.com/YSGStudyHards/DotNetGuide1.GitHubCopilotGitHubCopilot is an AI coding assistant that helps you write code faster and with less effort, so you can focus more on problem solving and collaboration. Git

Share three solutions to why Edge browser does not support this plug-in Share three solutions to why Edge browser does not support this plug-in Mar 13, 2024 pm 04:34 PM

When users use the Edge browser, they may add some plug-ins to meet more of their needs. But when adding a plug-in, it shows that this plug-in is not supported. How to solve this problem? Today, the editor will share with you three solutions. Come and try it. Method 1: Try using another browser. Method 2: The Flash Player on the browser may be out of date or missing, causing the plug-in to be unsupported. You can download the latest version from the official website. Method 3: Press the "Ctrl+Shift+Delete" keys at the same time. Click "Clear Data" and reopen the browser.

Which AI programmer is the best? Explore the potential of Devin, Tongyi Lingma and SWE-agent Which AI programmer is the best? Explore the potential of Devin, Tongyi Lingma and SWE-agent Apr 07, 2024 am 09:10 AM

On March 3, 2022, less than a month after the birth of the world's first AI programmer Devin, the NLP team of Princeton University developed an open source AI programmer SWE-agent. It leverages the GPT-4 model to automatically resolve issues in GitHub repositories. SWE-agent's performance on the SWE-bench test set is similar to Devin, taking an average of 93 seconds and solving 12.29% of the problems. By interacting with a dedicated terminal, SWE-agent can open and search file contents, use automatic syntax checking, edit specific lines, and write and execute tests. (Note: The above content is a slight adjustment of the original content, but the key information in the original text is retained and does not exceed the specified word limit.) SWE-A

Learn how to develop mobile applications using Go language Learn how to develop mobile applications using Go language Mar 28, 2024 pm 10:00 PM

Go language development mobile application tutorial As the mobile application market continues to boom, more and more developers are beginning to explore how to use Go language to develop mobile applications. As a simple and efficient programming language, Go language has also shown strong potential in mobile application development. This article will introduce in detail how to use Go language to develop mobile applications, and attach specific code examples to help readers get started quickly and start developing their own mobile applications. 1. Preparation Before starting, we need to prepare the development environment and tools. head

See all articles