<caption>反饋BUG</caption>
| 程序版本: | Discuz! X3.1 |
| 瀏覽器: | IE6 <wbr>IE7 <wbr>IE8 <wbr>IE9 <wbr>IE10 <wbr>firefox <wbr>TT <wbr>360 <wbr>chrome <wbr>maxthon <wbr> |
| 版本狀態(tài): | 老版本升級(jí) |
| 從哪個(gè)版本升級(jí): | - |
| BUG地址: | http://www.discuz.net |
| BUG截圖: | - |
| 測(cè)試用戶名: | - |
| 測(cè)試密碼: | - |
|
然后登陸Discuz網(wǎng)站,接著退出的時(shí)候點(diǎn)了下清除痕跡就報(bào)錯(cuò)如下：
Discuz! System Error您當(dāng)前的訪問請(qǐng)求當(dāng)中含有非法字符，已經(jīng)被系統(tǒng)拒絕 PHP Debug
|
- [Line: 0026]member.php(discuz_application->init)
- [Line: 0071]source/class/discuz/discuz_application.php(discuz_application->_init_misc)
- [Line: 0552]source/class/discuz/discuz_application.php(discuz_application->_xss_check)
- [Line: 0355]source/class/discuz/discuz_application.php(system_error)
- [Line: 0017]source/function/function_core.php(discuz_error::system_error)
- [Line: 0024]source/class/discuz/discuz_error.php(discuz_error::debug_backtrace)
|
www.discuz.net 已經(jīng)將此出錯(cuò)信息詳細(xì)記錄, 由此給您帶來(lái)的訪問不便我們深感歉意.
解決方法：
131122 <wbr> <wbr>source\class\discuz\discuz_application.php <wbr> <wbr> private function _xss_check()
350行左右
private function _xss_check() {
static $check = array('"', '>', '<', ''', '(', ')', 'CONTENT-TRANSFER-ENCODING');
if(isset(
_GET['formhash'] !== formhash()) {
system_error('request_tainting');
}
if($_SERVER['REQUEST_METHOD'] == 'GET' ) {
_SERVER['REQUEST_URI'];
} elseif(empty ($_GET['formhash'])) {
} else {
$temp = '';
}
if(!empty($temp)) {
temp)));
foreach (
str) {
if(strpos(
str) !== false) {
system_error('request_tainting');
}
}
}
return true;
}
復(fù)制代碼
131011 <wbr> <wbr>source\class\discuz\iscuz_application.php <wbr> <wbr> private function _xss_check()
350行左右
private function _xss_check() {
if(strpos(
temp, '"') !== false || strpos($temp, 'CONTENT-TRANSFER-ENCODING') !== false) {
system_error('request_tainting');
}
return true;
}
復(fù)制代碼
暫時(shí)修改回去就ok了
|
