St0p Blog

 Dim s_List, s_Url s_List = "" Dim oFSO, oUploadFolder, oUploadFiles, oUploadFile, sFileName 'Response.Write sCurrDir 'On Error Resume Next Set oFSO = Server . CreateObject ( "Scripting.FileSystemObject" ) Set oUploadFolder = oFSO. GetFolder ( Server . MapPath ( sCurrDir ) ) '注意一下sCurrDir变量,这个值等下我们可以用到 If Err. Number > 0 Then s_List = "" Exit Function End If If sDir <> "" Then If InstrRev ( sDir, "/" ) > 1 Then s_Url = Left ( sDir, InstrRev ( sDir, "/" ) - 1 ) Else s_Url = "" End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'>" & _ "<td><img border=0 src='../sysimage/file/parentfolder.gif'></td>" & _ "<td>..</td>" & _ "<td>&nbsp;</td>" & _ "</tr>" End If 'Response.Write sDir&"!"&s_List Dim oSubFolder For Each oSubFolder In oUploadFolder. SubFolders 'Response.Write oUploadFolder.SubFolders If sDir = "" Then s_Url = oSubFolder. Name Else s_Url = sDir & "/" & oSubFolder. Name End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'>" & _ "<td><img border=0 src='../sysimage/file/closedfolder.gif'></td>" & _ "<td noWrap>" & oSubFolder. Name & "</td>" & _ "<td>&nbsp;</td>" & _ "</tr>" Next 'Response.Write s_List Set oUploadFiles = oUploadFolder. Files For Each oUploadFile In oUploadFiles 'Response.Write oUploadFile.Name sFileName = oUploadFile. Name If CheckValidExt ( sFileName ) = True Then '这行让人有点郁闷,检测了所有允许的文件后缀,如不允许就无法列出,不然就不只列出目录名和图片文件了 If sDir = "" Then s_Url = sContentPath & sFileName Else s_Url = sContentPath & sDir & "/" & sFileName End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' url='" & s_Url & "'>" & _ "<td>" & FileName2Pic ( sFileName ) & "</td>" & _ "<td noWrap>" & sFileName & "</td>" & _ "<td align=right>" & GetSizeUnit ( oUploadFile. size ) & "</td>" & _ "</tr>" End If Next Set oUploadFolder = Nothing Set oUploadFiles = Nothing 'Response.Write Server.HTMLEncode(s_List)&"!"&s_Url If sDir = "" Then s_Url = "" 's_Url = "/" Else s_Url = "/" & sDir & "" 's_Url = "/" & sDir & "/" End If s_List = s_List & "</table>" s_List = HTML2JS ( s_List ) 'Response.Write Server.HTMLEncode(s_List)&"!"&s_Url s_List = "parent.setDirList(" "" & s_List & "" ", " "" & s_Url & "" ")" GetList = s_List End Function '如果没有下面这步检测的话,应该就可以列出目录中所有的文件了,有点郁闷..现在只能列出允许后缀的文件和目录名 Function CheckValidExt ( s_FileName ) If sAllowExt = "" Then CheckValidExt = True Exit Function End If Dim i, aExt, sExt sExt = LCase ( Mid ( s_FileName, InStrRev ( s_FileName, "." ) + 1 ) ) CheckValidExt = False aExt = Split ( LCase ( sAllowExt ) , "|" ) For i = 0 To UBound ( aExt ) If aExt ( i ) = sExt Then CheckValidExt = True Exit Function End If Next End Function '我们顺着代码往下找,发现sCurrDir的值是通过下面的值得到的 Sub InitParam ( ) sType = UCase ( Trim ( Request . QueryString ( "type" ) ) ) sStyleName = Trim ( Request . QueryString ( "style" ) ) Dim i, aStyleConfig, bValidStyle bValidStyle = False For i = 1 To Ubound ( aStyle ) aStyleConfig = Split ( aStyle ( i ) , "|||" ) If Lcase ( sStyleName ) = Lcase ( aStyleConfig ( 0 ) ) Then bValidStyle = True Exit For End If Next If bValidStyle = False Then OutScript ( "alert('Invalid Style.')" ) End If sBaseUrl = aStyleConfig ( 19 ) 'nAllowBrowse = CLng(aStyleConfig(43)) nAllowBrowse = 1 If nAllowBrowse <> 1 Then OutScript ( "alert('Do not allow browse!')" ) End If sUploadDir = aStyleConfig ( 3 ) If Left ( sUploadDir, 1 ) <> "/" Then Select Case sType Case "REMOTE" sUploadDir = "../../" & sUploadDir & "Image/" Case "FILE" sUploadDir = "../../" & sUploadDir & "Other/" Case "MEDIA" sUploadDir = "../../" & sUploadDir & "Media/" Case "FLASH" sUploadDir = "../../" & sUploadDir & "Flash/" Case Else sUploadDir = "../../" & sUploadDir & "Image/" End Select End If 'sUploadDir =sUploadDir &"/" Select Case sBaseUrl Case "0" 'sContentPath = aStyleConfig(23) Select Case sType Case "REMOTE" sContentPath = "../" & aStyleConfig ( 3 ) & "Image/" Case "FILE" sContentPath = "../" & aStyleConfig ( 3 ) & "Other/" Case "MEDIA" sContentPath = "../" & aStyleConfig ( 3 ) & "Media/" Case "FLASH" sContentPath = "../" & aStyleConfig ( 3 ) & "Flash/" Case Else sContentPath = "../" & aStyleConfig ( 3 ) & "Image/" End Select Case "1" sContentPath = RelativePath2RootPath ( sUploadDir ) Case "2" sContentPath = RootPath2DomainPath ( RelativePath2RootPath ( sUploadDir ) ) End Select Select Case sType Case "REMOTE" sAllowExt = aStyleConfig ( 10 ) Case "FILE" sAllowExt = aStyleConfig ( 6 ) Case "MEDIA" sAllowExt = aStyleConfig ( 9 ) Case "FLASH" sAllowExt = aStyleConfig ( 7 ) Case Else sAllowExt = aStyleConfig ( 8 ) End Select sCurrDir = sUploadDir '注意这里,这个是得到了配置的路径地址 sDir = Trim ( Request ( "dir" ) ) '得到dir变量 sDir = Replace ( sDir, "\" , "/" ) '对dir变量进行过滤 sDir = Replace ( sDir, "../" , "" ) sDir = Replace ( sDir, "./" , "" ) If sDir <> "" Then If CheckValidDir ( Server . Mappath ( sUploadDir & sDir ) ) = True Then sCurrDir = sUploadDir & sDir & "/" '重点就在这里了,看到没有,当sUploadDir & sDir存在的时候,sCurrDir就为sUploadDir & sDir的值了'虽然上面对sDir进行了过滤,不过我们完全可以跳过.具体利用st0p会在下面的利用中给出 Else sDir = "" End If End If End Sub Function GetList () Dim s_List, s_Url s_List = "" Dim oFSO, oUploadFolder, oUploadFiles, oUploadFile, sFileName 'Response.Write sCurrDir' On Error Resume Next Set oFSO = Server. CreateObject ("Scripting.FileSystemObject") Set oUploadFolder = oFSO. GetFolder (Server. MapPath (sCurrDir)) 'Hinweis sCurrDir variabel, dieser Wert können wir den Ist die Zahl Err> 0 Then s_List = "" Exit Function End If If sDir <> "" Then Wenn InstrRev (sDir "/")> 1 Then s_Url = Left (sDir, InstrRev (sDir, "/") - 1) Else s_Url = "" End If s_List = s_List & "<tr onclick = 'doRowClick (this)' onmouseover =" doRowOver (this) "onmouseout = 'doRowOut (this)" isdir =' true 'path =' "& s_Url &" '> "& _" <td> <img border = 0 src = ".. / sysimage / file / parentFolder gif "> </ td>" & _ "<td> .. </ td>" & _ "<td> </ td>" & _ "</ tr>" End If 'das Response.Write sDir & "!" & s_List Dim oSubFolder For Each oSubFolder In oUploadFolder. UnterOrdnerAuflistung 'Response.Write oUploadFolder.SubFolders Wenn sDir = "" Then s_Url = oSubFolder. Name Else s_Url = sDir & "/" & oSubFolder. Name End If s_List = s_List & " <tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'> "& _" <td> <img border = 0 src = ".. / sysimage / file / closedfolder.gif '> </ td>" & _ "<td Pariser Geschaft" & oSubFolder. Name & "</ td>" & _ "<td> </ td> "& _" </ tr> "Next 'Response.Write s_List Set oUploadFiles = oUploadFolder. Dateien für die einzelnen oUploadFile In oUploadFiles' Response.Write oUploadFile.Name sFileName = oUploadFile. Name Wenn CheckValidExt (sFileName) = True Then 'Diese Zeile war ein bisschen deprimiert, um alle erlaubten Datei-Endung, wie nicht nicht in der Lage, List oder Nicht Liste nur den Namen des Verzeichnisses und Bild-Datei des Falls sDir = "" Then s_Url = sContentPath & sFileName Else s_Url = sContentPath auf & erkennen sDir & "/" & sFileName End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' url='" & s_Url & "'> "& _" <td> "& FileName2Pic (sFileName) &" </ td> "& _" <td Pariser Geschaft "& sFileName &" </ td> "& _" <td align=right> "& GetSizeUnit ( oUploadFile. Größe) & "</ td>" & _ "</ tr>" End If Next Set oUploadFolder = Nothing Set oUploadFiles = Nothing 'Response.Write Server.HTMLEncode (s_List) & "!" & s_Url Wenn sDir = "" Dann s_Url = "" 's_Url = "/" Else s_Url = "/" & sDir & ""' s_Url = "/" & sDir & "/" End If s_List = s_List & "</ table>" s_List HTML2JS = ( s_List) 'Response.Write Server.HTMLEncode (s_List) & "!" & s_Url s_List = "parent.setDirList (" "" & s_List & "" "" "" & s_Url & "" ")" GetList = s_List End Function "Wenn Sie nicht Schritt Erkennung, sollte in der Lage, alle Dateien im Verzeichnis auflisten, und ein bisschen deprimiert .. jetzt nur listet die Dateien und Verzeichnisse zu erlauben Suffixnamen Funktion CheckValidExt (s_FileName) Wenn die sAllowExt =" "Then CheckValidExt = True Exit Function End If Dim i, aExt, Sext Sext = LCase (Mid (s_FileName, InStrRev (s_FileName,) + 1) ".") = False CheckValidExt aExt = Split (LCase (sAllowExt), "|") For i = 0 To UBound (aExt) Wenn aExt (i) = Sext Dann CheckValidExt = True Exit Function End If Next End Function 'down Code zu finden sCurrDir Wert des folgenden finden lohnt sich der Sub initParam () = sType UCase (Trim (Request. QueryString ("type"))) sStyleName = Trim (Request. QueryString ("Stil")) Dim i, aStyleConfig, bValidStyle bValidStyle = False For i = 1 To UBound (astyle) aStyleConfig = Split (astyle (i), "| | |") If LCase (sStyleName) = LCase (aStyleConfig (0)) Dann bValidStyle = True Exit For End If Next Wenn bValidStyle = False Then OutScript ("alert ('Ungültige Style.')") End If sBaseUrl = aStyleConfig (19) '= nAllowBrowse CLng (aStyleConfig (43)) = 1 nAllowBrowse Wenn nAllowBrowse <> 1 Then OutScript ("alert (' Nicht suchen! ')") End If sUploadDir = aStyleConfig (3) Wenn Left (sUploadDir, 1) <> "/" Dann Select Case sType Case "REMOTE" sUploadDir = ".. / .. /" & sUploadDir & "Image /" Case "FILE" sUploadDir = ".. / .. / "& sUploadDir &" Sonstiges / "Case" MEDIA "sUploadDir =" .. / .. / "& sUploadDir &" Media / "Case" FLASH "sUploadDir =" .. / .. / "& sUploadDir &" Flash / " Case Else sUploadDir = ".. / .. /" & sUploadDir & "image /" End Select End If 'sUploadDir = sUploadDir & "/" Select Case sBaseUrl Fall "0"' = sContentPath aStyleConfig (23) Select Case sType Case " REMOTE "sContentPath =" .. / "& aStyleConfig (3) und" Image / "Case" FILE "sContentPath =" .. / "& aStyleConfig (3) &" Sonstiges / "Case" MEDIA "sContentPath =" .. / "& aStyleConfig (3) und" Medien / "Case" FLASH "sContentPath =" .. / "& aStyleConfig (3) &" Flash / "Case Else sContentPath =" .. / "& aStyleConfig (3) und" Image / "End Select Case" 1 "= sContentPath RelativePath2RootPath (sUploadDir) Case" 2 "= sContentPath RootPath2DomainPath (RelativePath2RootPath (sUploadDir)) End Select Select Case sType Case" REMOTE "sAllowExt = aStyleConfig (10) Case" FILE "sAllowExt = aStyleConfig (6 ) Case "MEDIA" sAllowExt = aStyleConfig (9) Rechtssache "FLASH" sAllowExt = aStyleConfig (7) Case Else sAllowExt = aStyleConfig (8) End Select sCurrDir sUploadDir = 'Hinweis, das ist der Pfad zur Konfigurationsdatei Adresse sDir = Trim ( Request ("dir")) 'erhalten Sie die Variable sDir dir = Replace (sDir, "\", "/")' dir den Filter sDir variable = Replace (sDir ".. /", "") sDir = Replace ( die sDir, ". /", "") Wenn sDir <> "" Then Wenn CheckValidDir (Server. MapPath (sUploadDir & sDir)) = True Then sCurrDir = sUploadDir & sDir & "/" 'auf hier zu konzentrieren, siehe Nein, als wenn sUploadDir & sDir, sCurrDir auf den Wert der sUploadDir & sDir "Obwohl auf dem Gesicht des sDir gefiltert, aber wir können übersprungen werden. spezifische Verwendung St0p die Else sDir in der nachfolgenden Verwendung = gegeben werden "End If End If End Sub 

 <HEAD> <meta Http-equiv='Content-Type' content='text/html; charset=utf-8'> <TITLE> eWebEditor </ TITLE> </ head> <body> <script language = JavaScript> parent.setDirList ("<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='../..'> <td > <img border=0 src='../sysimage/file/parentfolder.gif'> </ a> · .. </ a> · </ td> </ tr> <tr onclick = 'doRowClick (this)' onmouseover = "doRowOver (this)" onmouseout = 'doRowOut (this) "isdir =' true 'path =" .. / .. / .. / logfiles'> <td> <img border = 0 src = ".. / sysimage / file / closedfolder.gif '> </ td> <td Pariser Geschaft Logfiles </ a> · </ td> </ tr> <tr onclick =' doRowClick (dies ) 'onmouseover = "doRowOver (this)" onmouseout =' doRowOut (this) "isdir = 'true' path =" .. / .. / .. / www '> <td> <img border = 0 src ='. . / sysimage / file / closedfolder.gif '> </ td> <td Pariser Geschaft www </ a> · </ td> </ tr> </ table> "," / .. / .. / .. ") </ script> </ body> </ html>