crx349 發表於 2019-6-1 11:07:36

Discuz! 出现“您当前的访问请求当中含有非法字符“解决方法

Discuz! 出现“您当前的访问请求当中含有非法字符“解决方法-一般是在未登录下使用首页搜索功能出现<br />解决方案如下：<br /><br /><br />\source\class\discuz的discuz_application.php<br />查找<br />&nbsp; &nbsp; <ol><li>private function _xss_check() {<br /><li><br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; static $check = array('&quot;', '&gt;', '&lt;', '\'', '(', ')', 'CONTENT-TRANSFER-ENCODING');<br /><li><br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; if(isset($_GET['formhash']) &amp;&amp; $_GET['formhash'] !== formhash()) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;system_error('request_tainting');<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; }<br /><li><br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; if($_SERVER['REQUEST_METHOD'] == 'GET' ) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;$temp = $_SERVER['REQUEST_URI'];<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; } elseif(empty ($_GET['formhash'])) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;$temp = $_SERVER['REQUEST_URI'].file_get_contents('php://input');<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; } else {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;$temp = '';<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; }<br /><li><br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; if(!empty($temp)) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;$temp = strtoupper(urldecode(urldecode($temp)));<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;foreach ($check as $str) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;if(strpos($temp, $str) !== false) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; system_error('request_tainting');<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;}<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;}<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; }<br /><li><br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; return true;<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;}</ol><br /><br /><br />替换为：<br />&nbsp; &nbsp;&nbsp;&nbsp;<ol><li> private function _xss_check() {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; $temp = strtoupper(urldecode(urldecode($_SERVER['REQUEST_URI'])));<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; if(strpos($temp, '&lt;') !== false || strpos($temp, '&quot;') !== false || strpos($temp, 'CONTENT-TRANSFER-ENCODING') !== false) {<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;system_error('request_tainting');<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; }<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; return true;<br /><li>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;}</ol><br /><br /><br />上传覆盖同名文件，后台更新缓存，重新登录退出看看是否解决了。(<font color="Red">特别提醒：这个改变可能降低跨站攻击防护等级，所以非追求极致用户体验时慎用哦</font>)出现<em>, </em>Discuz<em>, </em>当前<em>, </em>访问<em>, </em>请求

jnpar 發表於 2019-6-1 13:14:34

不用这么麻烦的吧，好像直接修改config文件就可以

crx349 發表於 2019-6-1 14:43:43

<br />确实不用那么麻烦 只是你关闭了 xxs防护而已哦

Xianger2120 發表於 2019-6-1 20:48:24

<br />怎么改呢

crx349 發表於 2019-6-1 21:27:08

<br />config/config_global.php<br /><ol><li>$_config['security']['urlxssdefend'] = 0;</ol>

allthebest 發表於 2019-6-1 21:35:51

我不建议让游客使用首页搜索功能<br /><br />这对增加注册会员没半点作用的说<br />

Xianger2120 發表於 2019-6-1 21:39:13

<br />好的，我试试，谢谢啦

站长 發表於 2019-6-16 15:41:53

感谢分享。。

yeejoo 發表於 2019-6-16 16:57:24

<br />这个可以有。

yehui2512 發表於 2019-6-29 21:22:34

收藏了，备用。谢谢！
頁: [1]
查看完整版本: Discuz! 出现“您当前的访问请求当中含有非法字符“解决方法