防止Dedecms入侵、漏洞问题的4点安全防范建议
<p style='margin: 0px; padding: 5px 0px; outline: none; font-size: 14px; line-height: 30px; font-family: tahoma, arial, "Microsoft YaHei";'>一、最基本的安全设置：修改dedecms默认后台目录/dede/和修改管理员帐号密码；<br>
二、如网站不需要使用会员系统，建议删除/member/文件夹；<br>
三、将/data/文件夹移到Web访问目录外，这条是dedecms官方建议，具体操作方法如下：<br>
1. 将/data/文件夹移至web根目录的上一级目录<br>
2. 修改/include/common.inc.php中DEDEDATA变量，将：define('DEDEDATA', DEDEROOT.'/data'); 改为define('DEDEDATA', DEDEROOT.'/../data');<br>
3. 修改/index.php，删除如下代码（注：如首页生成静态且index.html索引优先于index.php可忽略此条修改。）：<br>
</p>
<div class="msgheader" style='margin: 3px auto 0px; padding: 0px 3px; outline: none; line-height: 21.6px; clear: both; border-width: 1px; border-style: solid; border-color: rgb(0, 153, 204); background: rgb(246, 251, 255); overflow: hidden; font-family: tahoma, arial, "Microsoft YaHei";'>
<div class="right">
<span><u>复制代码</u></span>
</div>
<p>
代码如下:</p>
</div>
<div class="msgborder" id="phpcode2" style='margin: 0px auto 3px; padding: 0px 3px; outline: none; line-height: 25.2px; font-size: 14px; clear: both; border-right: 1px solid rgb(0, 153, 204); background: rgb(221, 237, 251); overflow: hidden; border-left: 1px solid rgb(0, 153, 204); word-break: break-all; border-bottom: 1px solid rgb(0, 153, 204); word-wrap: break-word; font-family: tahoma, arial, "Microsoft YaHei";'>
<br>
if(!file_exists(dirname(__FILE__).'/data/common.inc.php'))<br>
{<br>
header('Location:install/index.php');<br>
exit();<br>
}</div>
<p>
<br style='font-family: tahoma, arial, "Microsoft YaHei"; font-size: 14px;'><span style='font-family: tahoma, arial, "Microsoft YaHei"; font-size: 14px;'>4. 配置tplcache缓存文件目录：登陆后台 > 系统 > 系统基本参数 > 性能选项，将模板缓存目录值改为 /../data/tplcache</span><br style='font-family: tahoma, arial, "Microsoft YaHei"; font-size: 14px;'><span style='font-family: tahoma, arial, "Microsoft YaHei"; font-size: 14px;'>四、/plus/是dedecms漏洞高发目录，隐藏/plus/路径可防范该目录下文件产生的未知漏洞的利用，如需使用该目录下某个文件，可在.htaccess中添加相关规则实现白名单功能。</span></p>
<p style='margin: 0px; padding: 5px 0px; outline: none; font-size: 14px; line-height: 30px; font-family: tahoma, arial, "Microsoft YaHei";'>
</p>
<p style='margin: 0px; padding: 5px 0px; outline: none; font-size: 14px; line-height: 30px; font-family: tahoma, arial, "Microsoft YaHei";'>
示例：假设plus目录名修改为/abcd9com/，网站需要使用后台栏目动态预览（路径：http://域名/plus/list.php?tid=栏目编号）和发布跳转文章（路径：http://域名/plus/view.php?aid=文章编号）的功能，则可在.htaccess添加如下代码：<br>
</p>
<div class="msgheader" style='margin: 3px auto 0px; padding: 0px 3px; outline: none; line-height: 21.6px; clear: both; border-width: 1px; border-style: solid; border-color: rgb(0, 153, 204); background: rgb(246, 251, 255); overflow: hidden; font-family: tahoma, arial, "Microsoft YaHei";'>
<div class="right">
<span><u>复制代码</u></span>
</div>
<p>
代码如下:</p>
</div>
<div class="msgborder" id="phpcode3" style='margin: 0px auto 3px; padding: 0px 3px; outline: none; line-height: 25.2px; font-size: 14px; clear: both; border-right: 1px solid rgb(0, 153, 204); background: rgb(221, 237, 251); overflow: hidden; border-left: 1px solid rgb(0, 153, 204); word-break: break-all; border-bottom: 1px solid rgb(0, 153, 204); word-wrap: break-word; font-family: tahoma, arial, "Microsoft YaHei";'>
<br>
RewriteEngine On<br>
RewriteCond %{QUERY_STRING} ^tid=(\d+)<br>
RewriteRule ^plus/list.php$ /abcd9com/list.php$1 <br>
RewriteCond %{QUERY_STRING} ^aid=(\d+)<br>
RewriteRule ^plus/view.php$ /abcd9com/view.php$1 </div>
頁:
[1]