疯子公流倜傥 發表於 2019-7-13 11:14:19

Discuz!7.X严格限制引用的Flash地址解决方案

经过测试Flash引用时存在过滤不严格的BUG，现给出以下修正方案：<br /><br />&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;1、找到include\discuzcode.func.php文件<br />&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;2、在discuzcode函数中查找<ol><li> if($allowmediacode &amp;&amp; strpos($msglower, '') !== FALSE) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;$message = preg_replace(&quot;/\\s*([^\[\&lt;\r\n]+?)\s*\[\/flash\]/is&quot;, &quot;&lt;script type=&quot;text/javascript&quot; reload=&quot;1&quot;&gt;document.write(AC_FL_RunContent('width', '550', 'height', '400', 'allowNetworking', 'internal', 'allowScriptAccess', 'never', 'src', '\\1', 'quality', 'high', 'bgcolor', '#ffffff', 'wmode', 'transparent', 'allowfullscreen', 'true'));&lt;/script&gt;&quot;, $message);<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; }</ol>换行成<ol><li> if($allowmediacode &amp;&amp; strpos($msglower, '') !== FALSE) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;$message = preg_replace(&quot;/\\s*([^\[\&lt;\r\n]+?)\s*\[\/flash\]/ies&quot;, &quot;parseflash('\\1')&quot;, $message);<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; }</ol><br />3、在该文件中增加以下函数代码<ol><li>function parseflash($url) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;preg_match(&quot;/((https?){1}:\/\/|www\.)[^\[&quot;']+/i&quot;, $url, $matches);<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;$url = $matches;<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;$code = '';<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;if($url) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; $code = &quot;&lt;script type=&quot;text/javascript&quot; reload=&quot;1&quot;&gt;document.write(AC_FL_RunContent('width', '550', 'height', '400', 'allowNetworking', 'internal', 'allowScriptAccess', 'never', 'src', '$url', 'quality', 'high', 'bgcolor', '#ffffff', 'wmode', 'transparent', 'allowfullscreen', 'true'));&lt;/script&gt;&quot;;<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;}<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;return $code;<br /><li>}</ol>修正后可以有效地限制引用的Flash地址<br /><br />+======================================+<br />感谢“360第三方漏洞收集平台（http://webscan.360.cn/）”为本次修正提出安全建议<br />+======================================+<br /><br /><br />Flash<em>, </em>修正<em>, </em>严格<em>, </em>限制<em>, </em>用的

罗永浩 發表於 2019-7-14 20:29:55

支持 辛苦了

金黑网络 發表於 2019-7-17 21:48:34

只是7.X吗

qq546456580 發表於 2022-9-6 21:11:51

这个可以。

qq546456580 發表於 2023-2-25 20:28:09

感谢分享

tuhemm 發表於 2023-2-25 20:35:23

感谢分享

财源滚滚 發表於 2023-3-29 18:08:12

感谢分享
頁: [1]
查看完整版本: Discuz!7.X严格限制引用的Flash地址解决方案