Bloc de st0p

 Dim s_List, s_Url s_List = "" Dim oFSO, oUploadFolder, oUploadFiles, oUploadFile, sFileName 'Response.Write sCurrDir 'On Error Resume Next Set oFSO = Server . CreateObject ( "Scripting.FileSystemObject" ) Set oUploadFolder = oFSO. GetFolder ( Server . MapPath ( sCurrDir ) ) '注意一下sCurrDir变量,这个值等下我们可以用到 If Err. Number > 0 Then s_List = "" Exit Function End If If sDir <> "" Then If InstrRev ( sDir, "/" ) > 1 Then s_Url = Left ( sDir, InstrRev ( sDir, "/" ) - 1 ) Else s_Url = "" End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'>" & _ "<td><img border=0 src='../sysimage/file/parentfolder.gif'></td>" & _ "<td>..</td>" & _ "<td>&nbsp;</td>" & _ "</tr>" End If 'Response.Write sDir&"!"&s_List Dim oSubFolder For Each oSubFolder In oUploadFolder. SubFolders 'Response.Write oUploadFolder.SubFolders If sDir = "" Then s_Url = oSubFolder. Name Else s_Url = sDir & "/" & oSubFolder. Name End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'>" & _ "<td><img border=0 src='../sysimage/file/closedfolder.gif'></td>" & _ "<td noWrap>" & oSubFolder. Name & "</td>" & _ "<td>&nbsp;</td>" & _ "</tr>" Next 'Response.Write s_List Set oUploadFiles = oUploadFolder. Files For Each oUploadFile In oUploadFiles 'Response.Write oUploadFile.Name sFileName = oUploadFile. Name If CheckValidExt ( sFileName ) = True Then '这行让人有点郁闷,检测了所有允许的文件后缀,如不允许就无法列出,不然就不只列出目录名和图片文件了 If sDir = "" Then s_Url = sContentPath & sFileName Else s_Url = sContentPath & sDir & "/" & sFileName End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' url='" & s_Url & "'>" & _ "<td>" & FileName2Pic ( sFileName ) & "</td>" & _ "<td noWrap>" & sFileName & "</td>" & _ "<td align=right>" & GetSizeUnit ( oUploadFile. size ) & "</td>" & _ "</tr>" End If Next Set oUploadFolder = Nothing Set oUploadFiles = Nothing 'Response.Write Server.HTMLEncode(s_List)&"!"&s_Url If sDir = "" Then s_Url = "" 's_Url = "/" Else s_Url = "/" & sDir & "" 's_Url = "/" & sDir & "/" End If s_List = s_List & "</table>" s_List = HTML2JS ( s_List ) 'Response.Write Server.HTMLEncode(s_List)&"!"&s_Url s_List = "parent.setDirList(" "" & s_List & "" ", " "" & s_Url & "" ")" GetList = s_List End Function '如果没有下面这步检测的话,应该就可以列出目录中所有的文件了,有点郁闷..现在只能列出允许后缀的文件和目录名 Function CheckValidExt ( s_FileName ) If sAllowExt = "" Then CheckValidExt = True Exit Function End If Dim i, aExt, sExt sExt = LCase ( Mid ( s_FileName, InStrRev ( s_FileName, "." ) + 1 ) ) CheckValidExt = False aExt = Split ( LCase ( sAllowExt ) , "|" ) For i = 0 To UBound ( aExt ) If aExt ( i ) = sExt Then CheckValidExt = True Exit Function End If Next End Function '我们顺着代码往下找,发现sCurrDir的值是通过下面的值得到的 Sub InitParam ( ) sType = UCase ( Trim ( Request . QueryString ( "type" ) ) ) sStyleName = Trim ( Request . QueryString ( "style" ) ) Dim i, aStyleConfig, bValidStyle bValidStyle = False For i = 1 To Ubound ( aStyle ) aStyleConfig = Split ( aStyle ( i ) , "|||" ) If Lcase ( sStyleName ) = Lcase ( aStyleConfig ( 0 ) ) Then bValidStyle = True Exit For End If Next If bValidStyle = False Then OutScript ( "alert('Invalid Style.')" ) End If sBaseUrl = aStyleConfig ( 19 ) 'nAllowBrowse = CLng(aStyleConfig(43)) nAllowBrowse = 1 If nAllowBrowse <> 1 Then OutScript ( "alert('Do not allow browse!')" ) End If sUploadDir = aStyleConfig ( 3 ) If Left ( sUploadDir, 1 ) <> "/" Then Select Case sType Case "REMOTE" sUploadDir = "../../" & sUploadDir & "Image/" Case "FILE" sUploadDir = "../../" & sUploadDir & "Other/" Case "MEDIA" sUploadDir = "../../" & sUploadDir & "Media/" Case "FLASH" sUploadDir = "../../" & sUploadDir & "Flash/" Case Else sUploadDir = "../../" & sUploadDir & "Image/" End Select End If 'sUploadDir =sUploadDir &"/" Select Case sBaseUrl Case "0" 'sContentPath = aStyleConfig(23) Select Case sType Case "REMOTE" sContentPath = "../" & aStyleConfig ( 3 ) & "Image/" Case "FILE" sContentPath = "../" & aStyleConfig ( 3 ) & "Other/" Case "MEDIA" sContentPath = "../" & aStyleConfig ( 3 ) & "Media/" Case "FLASH" sContentPath = "../" & aStyleConfig ( 3 ) & "Flash/" Case Else sContentPath = "../" & aStyleConfig ( 3 ) & "Image/" End Select Case "1" sContentPath = RelativePath2RootPath ( sUploadDir ) Case "2" sContentPath = RootPath2DomainPath ( RelativePath2RootPath ( sUploadDir ) ) End Select Select Case sType Case "REMOTE" sAllowExt = aStyleConfig ( 10 ) Case "FILE" sAllowExt = aStyleConfig ( 6 ) Case "MEDIA" sAllowExt = aStyleConfig ( 9 ) Case "FLASH" sAllowExt = aStyleConfig ( 7 ) Case Else sAllowExt = aStyleConfig ( 8 ) End Select sCurrDir = sUploadDir '注意这里,这个是得到了配置的路径地址 sDir = Trim ( Request ( "dir" ) ) '得到dir变量 sDir = Replace ( sDir, "\" , "/" ) '对dir变量进行过滤 sDir = Replace ( sDir, "../" , "" ) sDir = Replace ( sDir, "./" , "" ) If sDir <> "" Then If CheckValidDir ( Server . Mappath ( sUploadDir & sDir ) ) = True Then sCurrDir = sUploadDir & sDir & "/" '重点就在这里了,看到没有,当sUploadDir & sDir存在的时候,sCurrDir就为sUploadDir & sDir的值了'虽然上面对sDir进行了过滤,不过我们完全可以跳过.具体利用st0p会在下面的利用中给出 Else sDir = "" End If End If End Sub GetList function () Dim s_List, s_Url s_List = "" Dim oFSO, oUploadFolder, oUploadFiles, oUploadFile, 'Response.Write sCurrDir' sFileName On Error Resume Next setembre oFSO Server =. CreateObject ("Scripting.FileSystemObject") setembre = oUploadFolder oFSO. GetFolder (Server. MapPath (sCurrDir)) 'variable nota sCurrDir, aquest valor es pot utilitzar el Si l'error Número> 0 Then s_List = "" Exit Function End If If SDIR <> "" Llavors, si InstrRev (SDIR "/")> 1 Llavors s_Url = Esquerra (SDIR, InStrRev (SDIR, "/") - 1) Else s_Url = "" End If s_List s_List = & "<tr onclick = 'doRowClick (aquest)" onMouseOver =' doRowOver (this) "onmouseout = 'doRowOut (aquest)' isdir = 'true' path = '" & s_Url & "'>" & _ "<td> <img border = 0 src =" .. / sysimage / arxiu / ParentFolder gif "> </ td>" & _ "<td> .. </ td>" & _ "<td> </ td>" & _ "</ tr>" End If 'Response.Write el SDIR i "!" i oSubFolder s_List Dim For Each oSubFolder En oUploadFolder. oUploadFolder.SubFolders subcarpetes 'Response.Write Si SDIR = "" Then s_Url = oSubFolder. Nom vendes s_Url = SDIR & "/" End i oSubFolder. Nom Si s_List s_List = & " onclick = 'doRowClick (this)' <tr onmouseout='doRowOut(this)' onmouseover='doRowOver(this)' isdir='true' path='" i s_Url i "'> "& _" <td> <img border = 0 src = ".. / sysimage / arxiu / closedfolder.gif '> </ td>" & _ "<td nowrap>" i oSubFolder. Nom & "</ td>" & _ "<td> </ td> "& _" </ tr> "Següent" Response.Write setembre s_List oUploadFiles = oUploadFolder. fitxers per a cada oUploadFile En oUploadFiles 'sFileName Response.Write oUploadFile.Name = oUploadFile. Nom Si CheckValidExt (sFileName) = True Then "Aquesta línia estava una mica deprimit, per detectar totes les sufix d'arxiu permès, com no, no serà capaç d'enumerar o anunciï no només el nom del directori i d'arxiu d'imatge de la Si SDIR =" "Then s_Url = sContentPath i sFileName vendes s_Url = sContentPath a & SDIR & "/" & Final sFileName Si s_List s_List = & "onMouseOver = 'doRowOver (this)' <tr onclick='doRowClick(this)' onmouseout='doRowOut(this)' url='" i s_Url i "'> "& _" <td> "i FileName2Pic (sFileName) &" </ td> "& _" <td nowrap> "i sFileName &" </ td> "& _" <td align=right> "i GetSizeUnit ( oUploadFile. mida) & "</ td>" & _ "</ tr>" End If oUploadFolder següent grup = oUploadFiles setembre = Nothing Response.Write Server.HTMLEncode Nada '(s_List) & "!" i s_Url Si SDIR = "" Després s_Url = "" 's_Url = "/" Else s_Url = "/" & SDIR & ""' s_Url = "/" & SDIR & "/" End If s_List s_List = & "</ table>" s_List HTML2JS = ( s_List) 'Response.Write Server.HTMLEncode (s_List) & "!" i s_Url s_List = "parent.setDirList (" "" & s_List & "" "" "" & s_Url & "" ")" = GetList s_List End Function "Si no pas de detecció, ha de ser capaç d'enumerar tots els fitxers al directori, i una mica deprimida .. ara només mostra els arxius i directoris per permetre sufix de nom de la funció CheckValidExt (s_FileName) Si el sAllowExt =" "Then CheckValidExt = Sortir True End Function Si Dim i, AexT, sisena 6 = LCase (Mid (s_FileName, InStrRev (s_FileName,) + 1) ".") = False CheckValidExt AexT = split (LCase (sAllowExt), "|") For i = 0 To UBound (AexT) Si AexT (i) = sext Després CheckValidExt = True End Function Exit If End Function Next 'pel codi per trobar el valor trobat sCurrDir de la següent val la pena el Sub initParam () = sType Ucase (Trim (Request. cadena de consulta ("tipus"))) sStyleName = Trim (Request. cadena de consulta ("estil")) Dim i, aStyleConfig, bValidStyle bValidStyle = False For i = 1 To UBound (Astyle) Split aStyleConfig = (Astyle (i), "| | |") Si LCase (sStyleName) = LCase (aStyleConfig (0)) Després bValidStyle = Sortir Per Veritable End If Next Si bValidStyle = False Then OutScript ("alert ('estil no vàlid.')") End If sBaseUrl = aStyleConfig (19) 'nAllowBrowse = CLng (aStyleConfig (43)) = 1 Si nAllowBrowse nAllowBrowse <> 1 Then OutScript ("alert (' No permeti a veure! ')") End If sUploadDir aStyleConfig = (3) Si l'esquerra (sUploadDir, 1) <> "/" i després seleccioneu sType Case "REMOT" sUploadDir = ".. / .. /" i sUploadDir i "Imatge /" Case "FILE" sUploadDir = ".. / .. / "& sUploadDir i" Altres / "Case" MITJANA "sUploadDir =" .. / .. / "i sUploadDir i" Mitjans de Comunicació / "Case" FLASH "sUploadDir =" .. / .. / "i sUploadDir i" Flash / " Case Else sUploadDir = ".. / .. /" i sUploadDir i "Imatge /" End Select If 'sUploadDir sUploadDir = & "/" Select Case sBaseUrl cas "0"' = sContentPath aStyleConfig (23) Select Case sType cas " A DISTÀNCIA "sContentPath =" .. / "i aStyleConfig (3) i" Imatge / "Case" FILE "sContentPath =" .. / "i aStyleConfig (3) i" Altres / "Case" MITJANA "sContentPath =" / .. "& aStyleConfig (3) i" Mitjans de Comunicació / "Case" "sContentPath =" FLASH .. / "i aStyleConfig (3) i" Flash / "sContentPath Case Else =" .. / "aStyleConfig i (3) i" d'imatge / "End Select Case" 1 "= sContentPath RelativePath2RootPath (sUploadDir) Cas" 2 "= sContentPath RootPath2DomainPath (RelativePath2RootPath (sUploadDir)) End Select sType Select Case" REMOT "sAllowExt = aStyleConfig (10) Cas" FILE "sAllowExt = aStyleConfig (6 ) Cas "MITJANA" sAllowExt = aStyleConfig (9) Cas "FLASH" sAllowExt aStyleConfig = (7) Case Else sAllowExt = aStyleConfig (8) End Select sCurrDir = Nota sUploadDir ', aquest és el camí a la configuració d'adreces SDIR = Trim ( Request ("dir")) 'obtenir la variable dir SDIR = Replace (SDIR, "\", "/")' variable dir el SDIR filter = Replace (SDIR ".. /", "") SDIR = Replace ( el SDIR, ". /", "") Si SDIR <> "" Llavors, si CheckValidDir (Server. MapPath (sUploadDir i SDIR)) = True Then sCurrDir = sUploadDir i SDIR & "/" 'se centren en aquí, consulteu No, quan al sUploadDir i SDIR, sCurrDir sobre el valor de sUploadDir i SDIR "Encara que a la cara de SDIR filtrada, però pot passar. st0p ús específic del SDIR això es donarà en el següent ús de = "End If End If End Sub 

 <HTML> <HEAD> <meta Http-equiv='Content-Type' content='text/html; charset=utf-8'> <TITLE> eWebEditor </ title> </ head> <script language = javascript> parent.setDirList ("onclick = 'doRowClick (this)' <tr onmouseout='doRowOut(this)' onmouseover='doRowOver(this)' isdir='true' path='../..'> <td > <img border=0 src='../sysimage/file/parentfolder.gif'> </ td> .. </ td> </ td> </ tr> <tr onclick = 'doRowClick (aquest) "onMouseOver =' doRowOver (this)" onmouseout = 'doRowOut (aquest)' isdir = 'true' path = ".. / .. / .. / fitxers de registre"> <td> <img = frontera 0 src = ".. / sysimage / arxiu / closedfolder.gif '> </ td> <td nowrap> arxius de registre </ td> </ td> </ tr> <tr onclick =' doRowClick (això ) "onMouseOver = 'doRowOver (this)" onmouseout =' doRowOut (aquest) 'isdir =' true 'path = ".. / .. / .. / www"> <td> <img border = 0 src ='. . / sysimage / arxiu / closedfolder.gif '> </ td> <td nowrap> www </ td> </ td> </ tr> </ table> "," / .. / .. / .. ") </ script> </ body> </ html>