IT博客汇
  • 首页
  • 精华
  • 技术
  • 设计
  • 资讯
  • 扯淡
  • 权利声明
  • 登录 注册

    阿里提示Discuz uc.key泄露导致代码注入漏洞uc.php的解决方法

    C1G发表于 2016-08-23 08:28:56
    love 0

    文件路径:bbs/api/uc.php

    1查找 updatebadwords 函数:

    if(!API_UPDATEBADWORDS) {
                return API_RETURN_FORBIDDEN;
            }

            $data = array();
            if(is_array($post)) {
                foreach($post as $k => $v) {  
    // 240 行左右      
    //fix uc key
          if(substr($v[‘findpattern’], 0, 1) != ‘/’ || substr($v[‘findpattern’], -3) != ‘/is’) {
             $v[‘findpattern’] = ‘/’ . preg_quote($v[‘findpattern’], ‘/’) . ‘/is’;
          }
    //end            
                    $data[‘findpattern’][$k] = $v[‘findpattern’];
                    $data[‘replace’][$k] = $v[‘replacement’];
                }
            }

    2. 查找 updateapps 函数:
    function updateapps($get, $post) {
            global $_G;

            if(!API_UPDATEAPPS) {
                return API_RETURN_FORBIDDEN;
            }
    //280行左右,这里我看已删除了下行那行                
    //$UC_API = $post[‘UC_API’];

            $UC_API = ”;
            if($post[‘UC_API’]) {
                $UC_API = str_replace(array(‘\”, ‘”‘, ‘\\’, “\0”, “\n”, “\r”), ”, $post[‘UC_API’]);
                unset($post[‘UC_API’]);
            }
    //end
            $cachefile = DISCUZ_ROOT.’./uc_client/data/cache/apps.php’;

    参考
    https://bbs.aliyun.com/read/292308.html

    Related Posts

    • 安装discuz启用flash验证码需要的ming库 ( 2012-04-13)
    • discuzX2 读写分离及配置mysql复制 ( 2011-09-28)
    • discuzx强化词语过滤功能 ( 2011-03-15)


沪ICP备19023445号-2号
友情链接