紧急求助:梁无惧上传组件的保存文件名如何不用年月日,而是用原来的文件名???
randomize
ranNum=int(900*rnd)+100
strFileName=year(dtNow) & right( "0 " & month(dtNow),2) & right( "0 " & day(dtNow),2) & right( "0 " & hour(dtNow),2) & right( "0 " & minute(dtNow),2) & right( "0 " & second(dtNow),2) & ranNum & ". " & FileExt
ofile.SaveToFile Server.mappath(SavePath & strFileName) '保存文件
______________________________________________________________________________
完整源文件
<%@language=vbscript codepage=936 %>
<%
option explicit
response.buffer=true
Server.ScriptTimeOut=9999999
%>
<!--#include file= "../conn.asp "-->
<!--#include file= "../inc/function.asp "-->
<!--#include file= "../inc/upfile_class.asp "-->
<%
const upload_type=0 '上传方法：0=无惧无组件上传类，1=FSO上传 2=lyfupload，3=aspupload，4=chinaaspupload
dim ChannelID
dim AdminName
dim EnableUploadFile,MaxFileSize,UpFileType,SavePath,SavePath2
dim objUpload,oFile,FormName,strFileName,FileExt
dim ImgWidth,ImgHeight,AlignType
dim EnableUpload
dim arrUpFileType
dim ranNum,i,strJS,msg,dtNow '这些定义上传变量
AdminName=trim(session( "AdminName ")) '判断seesion值是否正确
UserName=trim(request.Cookies( "asp163 ")( "UserName ")) '判断cookie
msg= " "
FoundErr=false
EnableUpload=false '上面这些定义了，如果seesion和cookie不合法，就出错
dtNow=Now()
%>
<html>
<head>
<meta http-equiv= "Content-Type " content= "text/html; charset=gb2312 ">
<style type= "text/css ">
<!--
BODY{
BACKGROUND-COLOR: #E1F4EE;
font-size:9pt
}
-->
</style>
</head>
<body leftmargin= "2 " topmargin= "0 " marginwidth= "0 " marginheight= "0 ">
<%
if AdminName= " " and UserName= " " then '如果admin和username为空就出错，如果假的不为空的用户名会怎么样呢，但是上面的要注意
response.Write( "请登录后再使用本功能！ ")
else
select case upload_type
case 0
call upload_0() '使用化境无组件上传类
case else
'response.write "本系统未开放插件功能 "
'response.end
end select
end if
call CloseConn()
%>
</body>
</html>
<%
sub upload_0() '使用化境无组件上传类
set objUpload=new upfile_class ' '建立上传对象
objUpload.GetData(104857600) '取得上传数据,限制最大上传100M
if objUpload.err > 0 then '如果出错
select case objUpload.err
case 1
response.write "请先选择你要上传的文件！ "
case 2
response.write "你上传的文件总大小超出了最大限制（100M） "
end select
response.end
end if
'开始了对ChannelID的判断
ChannelID=trim(objUpload.form( "ChannelID "))
if ChannelID= " " then '判断了，如果为空就出错
response.write "频道参数丢失！ "
exit sub '原来平时丢失的原因是因为ID不合要求
end if
ChannelID=Clng(ChannelID)
sqlChannel= "select * from PE_Channel where ChannelID= " & ChannelID
set rsChannel=server.createObject( "adodb.recordset ")
rsChannel.open sqlChannel,conn,1,1
if rsChannel.bof and rsChannel.eof then
response.write "找不到此频道 "
FoundErr=True '变量出错
end if
if rsChannel( "Disabled ")=True then
response.write "此频道已经被禁用！ "
FoundErr=True '上面进行对频道出错的判断和处理
else
EnableUploadFile=rsChannel( "EnableUploadFile ")
MaxFileSize=rsChannel( "MaxFileSize ")
SavePath=strInstallDir & rsChannel( "ChannelDir ") & "/UploadSoftPic/ " '保存的路径
UpFileType=rsChannel( "UpFileType ") '成功上传对大小，路径，类型的处理
end if
rsChannel.close
set rsChannel=nothing
if EnableUploadFile=False then
response.write "本频道未开放文件上传功能 "
FoundErr=True
end if
if FoundErr=True then exit sub
for each FormName in objUpload.file '列出所有上传了的文件
EnableUpload=False
set ofile=objUpload.file(FormName) '生成一个文件对象
if ofile.filesize <100 then
msg= "请先选择你要上传的文件！ "
FoundErr=True
end if
if ofile.filesize> (MaxFileSize*1024) then
msg= "文件大小超过了限制，最大只能上传 " & CStr(MaxFileSize) & "K的文件！ "
FoundErr=true
end if
FileExt=lcase(ofile.FileExt) '判断扩展名
arrUpFileType=split(UpFileType, "| ")
for i=0 to ubound(arrUpFileType)
if FileExt=trim(arrUpFileType(i)) then
EnableUpload=true
exit for
end if
next
if FileExt= "asp " or FileExt= "asa " or FileExt= "aspx " or FileExt= "cer " or FileExt= "cdx " then
EnableUpload=false '哈哈，关键在这里啦，上传漏洞在这里啦
end if
if EnableUpload=false then
msg= "这种文件类型不允许上传！/n/n只允许上传这几种文件类型： " & UpFileType
FoundErr=true
end if
strJS= " <SCRIPT language=javascript> " & vbcrlf
if FoundErr <> true then
if ObjInstalled_FSO=True then
SavePath2=year(dtNow) & right( "0 " & month(dtNow),2) & "/ "
SavePath=SavePath & SavePath2
if not fso.FolderExists(server.mappath(SavePath)) then
fso.createFolder server.mappath(SavePath)
end if
end if
randomize
ranNum=int(900*rnd)+100
strFileName=year(dtNow) & right( "0 " & month(dtNow),2) & right( "0 " & day(dtNow),2) & right( "0 " & hour(dtNow),2) & right( "0 " & minute(dtNow),2) & right( "0 " & second(dtNow),2) & ranNum & ". " & FileExt
ofile.SaveToFile Server.mappath(SavePath & strFileName) '保存文件
msg= "图片上传成功！ "
strJS=strJS & "parent.document.myform.SoftPicUrl.value= 'UploadSoftPic/ " & SavePath2 & strFileName & " '; " & vbcrlf
end if
strJS=strJS & "alert( ' " & msg & " '); " & vbcrlf
strJS=strJS & "history.go(-1); " & vbcrlf
strJS=strJS & " </script> "
response.write strJS
set ofile=nothing
next
set objUpload=nothing
end sub
%>
上面的是动易的上传代码，从上面分析，我们可以看到，它明显存在着上传漏洞。重要的漏洞代
码在于这一句
FileExt=lcase(ofile.FileExt) '判断扩展名
arrUpFileType=split(UpFileType, "| ")
for i=0 to ubound(arrUpFileType)
if FileExt=trim(arrUpFileType(i)) then
EnableUpload=true
exit for
end if
next
if FileExt= "asp " or FileExt= "asa " or FileExt= "aspx " or FileExt= "cer " or FileExt= "cdx " then
EnableUpload=false
[解决办法]
strFileName=year(dtNow) & right( "0 " & month(dtNow),2) & right( "0 " & day(dtNow),2) & right( "0 " & hour(dtNow),2) & right( "0 " & minute(dtNow),2) & right( "0 " & second(dtNow),2) & ranNum & ". " & FileExt
这行代码是生成文件名字的，改成提取回来原来的文件名就可以了。
