POST TIME:2017-11-08 21:56
为了让大家的CMS更安全，有需要的手工在config_base.php里加上
打开
config_base.php
找到
| 1 | //禁止用户提交某些特殊变量 |
| 2 | $ckvs = Array('_GET','_POST','_COOKIE','_FILES'); |
| 3 | foreach($ckvs as $ckv){ |
| 4 | if(is_array($$ckv)){ |
| 5 | foreach($$ckv AS $key => $value) |
| 6 | if(eregi("^(cfg_|globals)",$key)) unset(${$ckv}[$key]); |
| 7 | } |
| 8 | } |
改为下面代码
| 01 | //把get、post、cookie里的<? 替换成 <? |
| 02 | $ckvs = Array('_GET','_POST','_COOKIE'); |
| 03 | foreach($ckvs as $ckv){ |
| 04 | if(is_array($$ckv)){ |
| 05 | foreach($$ckv AS $key => $value) |
| 06 | if(!empty($value)){ |
| 07 | ${$ckv}[$key] = str_replace('<'.'?','&'.'lt;'.'?',$value); |
| 08 | ${$ckv}[$key] = str_replace('?'.'>','?'.'&'.'gt;',${$ckv}[$key]); |
| 09 | } |
| 10 | if(eregi("^cfg_|globals",$key)) unset(${$ckv}[$key]); |
| 11 | } |
| 12 | } |
| 13 | //检测上传的文件中是否有PHP代码，有直接退出处理 |
| 14 | if (is_array($_FILES)) { |
| 15 | foreach($_FILES AS $name => $value){ |
| 16 | ${$name} = $value['tmp_name']; |
| 17 | $fp = @fopen(${$name},'r'); |
| 18 | $fstr = @fread($fp,filesize(${$name})); |
| 19 | @fclose($fp); |
| 20 | if($fstr!='' && ereg("<\?",$fstr)){ |
| 21 | echo "你上传的文件中含有危险内容，程序终止处理！"; |
| 22 | exit(); |
| 23 | } |
| 24 | } |
| 25 | } |
|
|
|
|||||||||||||||
| 全国咨询热线 | |||||||||||||||||
| 400-1100-266 | |||||||||||||||||
| 在线客服( QQ：340506921 ) | |||||||||||||||||
 |
|||||||||||||||||
