= Trim(Request.QueryString("style")) sCusDir = Trim(Request.QueryString("cusdir")) Dim i, aStyleConfig, bValidStyle bValidStyle = False For i = 1 To Ubound(aStyle) aStyleConfig = Split(aStyle(i), "|||") If Lcase(sStyleName) = Lcase(aStyleConfig(0)) Then bValidStyle = True Exit For End If Next If bValidStyle = False Then OutScript("alert('Invalid Style.')") End If sBaseUrl = aStyleConfig(19) nAllowBrowse = CLng(aStyleConfig(43)) nCusDirFlag = Clng(aStyleConfig(61)) If nAllowBrowse <> 1 Then OutScript("alert('Do not allow browse!')") End If If nCusDirFlag <> 1 Then sCusDir = "" Else sCusDir = Replace(sCusDir, "", "/") If Left(sCusDir, 1) = "/" Or Left(sCusDir, 1) = "." Or Right(sCusDir, 1) = "." Or InStr(sCusDir, "./") > 0 Or InStr(sCusDir, "/.") > 0 Or InStr(sCusDir, "//") > 0 Then sCusDir = "" Else If Right(sCusDir, 1) <> "/" Then sCusDir = sCusDir & "/" End If End If End If sUploadDir = aStyleConfig(3) If Left(sUploadDir, 1) <> "/" Then sUploadDir = "../" & sUploadDir End If Select Case sBaseUrl Case "0" sContentPath = aStyleConfig(23) Case "1" sContentPath = RelativePath2RootPath(sUploadDir) Case "2" sContentPath = RootPath2DomainPath(RelativePath2RootPath(sUploadDir)) End Select sUploadDir = sUploadDir & sCusDir sContentPath = sContentPath & sCusDir Select Case sType Case "FILE" sAllowExt = "" Case "MEDIA" sAllowExt = "rm|mp3|wav|mid|midi|ra|avi|mpg|mpeg|asf|asx|wma|mov" Case "FLASH" sAllowExt = "swf" Case Else sAllowExt = "bmp|jpg|jpeg|png|gif" End Select sCurrDir = sUploadDir sDir = Trim(Request("dir"))'1.假设dir= ../'2.假设dir=...//'3.假设dir=...../// sDir = Replace(sDir, "", "/") '过滤1 sDir = Replace(sDir, "../", "") '过滤2'1.到这里就被过滤了 sDir = Replace(sDir, "./", "") '过滤3'2到这里也被功率了'3到这里就成../了。比较有趣的饶过！好象不少cms这样过滤过。[/color] If sDir <> "" Then If CheckValidDir(Server.Mappath(sUploadDir & sDir)) = True Then sCurrDir = sUploadDir & sDir & "/" Else sDir = "" End If End IfEnd Sub
