st0p blogas

 Dim s_List, s_Url s_List = "" Dim oFSO, oUploadFolder, oUploadFiles, oUploadFile, sFileName 'Response.Write sCurrDir 'On Error Resume Next Set oFSO = Server . CreateObject ( "Scripting.FileSystemObject" ) Set oUploadFolder = oFSO. GetFolder ( Server . MapPath ( sCurrDir ) ) '注意一下sCurrDir变量,这个值等下我们可以用到 If Err. Number > 0 Then s_List = "" Exit Function End If If sDir <> "" Then If InstrRev ( sDir, "/" ) > 1 Then s_Url = Left ( sDir, InstrRev ( sDir, "/" ) - 1 ) Else s_Url = "" End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'>" & _ "<td><img border=0 src='../sysimage/file/parentfolder.gif'></td>" & _ "<td>..</td>" & _ "<td>&nbsp;</td>" & _ "</tr>" End If 'Response.Write sDir&"!"&s_List Dim oSubFolder For Each oSubFolder In oUploadFolder. SubFolders 'Response.Write oUploadFolder.SubFolders If sDir = "" Then s_Url = oSubFolder. Name Else s_Url = sDir & "/" & oSubFolder. Name End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'>" & _ "<td><img border=0 src='../sysimage/file/closedfolder.gif'></td>" & _ "<td noWrap>" & oSubFolder. Name & "</td>" & _ "<td>&nbsp;</td>" & _ "</tr>" Next 'Response.Write s_List Set oUploadFiles = oUploadFolder. Files For Each oUploadFile In oUploadFiles 'Response.Write oUploadFile.Name sFileName = oUploadFile. Name If CheckValidExt ( sFileName ) = True Then '这行让人有点郁闷,检测了所有允许的文件后缀,如不允许就无法列出,不然就不只列出目录名和图片文件了 If sDir = "" Then s_Url = sContentPath & sFileName Else s_Url = sContentPath & sDir & "/" & sFileName End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' url='" & s_Url & "'>" & _ "<td>" & FileName2Pic ( sFileName ) & "</td>" & _ "<td noWrap>" & sFileName & "</td>" & _ "<td align=right>" & GetSizeUnit ( oUploadFile. size ) & "</td>" & _ "</tr>" End If Next Set oUploadFolder = Nothing Set oUploadFiles = Nothing 'Response.Write Server.HTMLEncode(s_List)&"!"&s_Url If sDir = "" Then s_Url = "" 's_Url = "/" Else s_Url = "/" & sDir & "" 's_Url = "/" & sDir & "/" End If s_List = s_List & "</table>" s_List = HTML2JS ( s_List ) 'Response.Write Server.HTMLEncode(s_List)&"!"&s_Url s_List = "parent.setDirList(" "" & s_List & "" ", " "" & s_Url & "" ")" GetList = s_List End Function '如果没有下面这步检测的话,应该就可以列出目录中所有的文件了,有点郁闷..现在只能列出允许后缀的文件和目录名 Function CheckValidExt ( s_FileName ) If sAllowExt = "" Then CheckValidExt = True Exit Function End If Dim i, aExt, sExt sExt = LCase ( Mid ( s_FileName, InStrRev ( s_FileName, "." ) + 1 ) ) CheckValidExt = False aExt = Split ( LCase ( sAllowExt ) , "|" ) For i = 0 To UBound ( aExt ) If aExt ( i ) = sExt Then CheckValidExt = True Exit Function End If Next End Function '我们顺着代码往下找,发现sCurrDir的值是通过下面的值得到的 Sub InitParam ( ) sType = UCase ( Trim ( Request . QueryString ( "type" ) ) ) sStyleName = Trim ( Request . QueryString ( "style" ) ) Dim i, aStyleConfig, bValidStyle bValidStyle = False For i = 1 To Ubound ( aStyle ) aStyleConfig = Split ( aStyle ( i ) , "|||" ) If Lcase ( sStyleName ) = Lcase ( aStyleConfig ( 0 ) ) Then bValidStyle = True Exit For End If Next If bValidStyle = False Then OutScript ( "alert('Invalid Style.')" ) End If sBaseUrl = aStyleConfig ( 19 ) 'nAllowBrowse = CLng(aStyleConfig(43)) nAllowBrowse = 1 If nAllowBrowse <> 1 Then OutScript ( "alert('Do not allow browse!')" ) End If sUploadDir = aStyleConfig ( 3 ) If Left ( sUploadDir, 1 ) <> "/" Then Select Case sType Case "REMOTE" sUploadDir = "../../" & sUploadDir & "Image/" Case "FILE" sUploadDir = "../../" & sUploadDir & "Other/" Case "MEDIA" sUploadDir = "../../" & sUploadDir & "Media/" Case "FLASH" sUploadDir = "../../" & sUploadDir & "Flash/" Case Else sUploadDir = "../../" & sUploadDir & "Image/" End Select End If 'sUploadDir =sUploadDir &"/" Select Case sBaseUrl Case "0" 'sContentPath = aStyleConfig(23) Select Case sType Case "REMOTE" sContentPath = "../" & aStyleConfig ( 3 ) & "Image/" Case "FILE" sContentPath = "../" & aStyleConfig ( 3 ) & "Other/" Case "MEDIA" sContentPath = "../" & aStyleConfig ( 3 ) & "Media/" Case "FLASH" sContentPath = "../" & aStyleConfig ( 3 ) & "Flash/" Case Else sContentPath = "../" & aStyleConfig ( 3 ) & "Image/" End Select Case "1" sContentPath = RelativePath2RootPath ( sUploadDir ) Case "2" sContentPath = RootPath2DomainPath ( RelativePath2RootPath ( sUploadDir ) ) End Select Select Case sType Case "REMOTE" sAllowExt = aStyleConfig ( 10 ) Case "FILE" sAllowExt = aStyleConfig ( 6 ) Case "MEDIA" sAllowExt = aStyleConfig ( 9 ) Case "FLASH" sAllowExt = aStyleConfig ( 7 ) Case Else sAllowExt = aStyleConfig ( 8 ) End Select sCurrDir = sUploadDir '注意这里,这个是得到了配置的路径地址 sDir = Trim ( Request ( "dir" ) ) '得到dir变量 sDir = Replace ( sDir, "\" , "/" ) '对dir变量进行过滤 sDir = Replace ( sDir, "../" , "" ) sDir = Replace ( sDir, "./" , "" ) If sDir <> "" Then If CheckValidDir ( Server . Mappath ( sUploadDir & sDir ) ) = True Then sCurrDir = sUploadDir & sDir & "/" '重点就在这里了,看到没有,当sUploadDir & sDir存在的时候,sCurrDir就为sUploadDir & sDir的值了'虽然上面对sDir进行了过滤,不过我们完全可以跳过.具体利用st0p会在下面的利用中给出 Else sDir = "" End If End If End Sub Funkcija GetList () Dim s_List s_Url s_List = ", Dim oFSO, oUploadFolder, oUploadFiles, oUploadFile, sFileName Response.Write sCurrDir" On Error Resume Next Set oFSO = Serveris. CreateObject ("Scripting.FileSystemObject). Nustatyti oUploadFolder = oFSO. GetFolder (. Server. MapPath (sCurrDir)) pastaba sCurrDir, kintamasis, tai vertė, mes galime naudoti, Jei klaidos skaičius> 0 Tada s_List. = "Išeiti Funkcijos pabaiga jei jei sDir <>" "Tada, jei InstrRev [sDir "/")> 1, Tada s_Url = kairieji (sDir InstrRev (sDir, "/") - 1.), kita s_Url = "" Pabaiga Jei s_List = s_List & "<tr onclick =" doRowClick () "onmouseover =" doRowOver () "onmouseout = 'doRowOut ()" isdir = "true" kelias =' "& s_Url &" "& _" <td> <img border = 0 src = ".. / sysimage / failas / parentfolder gif "> </ td>" & _ "<td> .. </ td>" & _ "<td> </ td>" & _ "</ tr>" Pabaiga Jei "Response.Write sDir" & ! "" & s_List Dim oSubFolder Dėl, Each In oUploadFolder oSubFolder. poaplankius "Response.Write oUploadFolder.SubFolders Jei sDir =" "Tada s_Url = oSubFolder pavadinimas, kita s_Url = sDir ir" / "& oSubFolder. Vardas pabaiga, Jei s_List = s_List &" <tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'> "& _" <td> <img border = 0 src = ".. / sysimage / failas / closedfolder.gif"> </ td> "& _" <td noWrap> "& oSubFolder pavadinimas" </ td> "& _" <td> </ td> "& _" </ tr> "Next" Response.Write s_List Set oUploadFiles = oUploadFolder. Failai For Each oUploadFile, oUploadFiles "Response.Write oUploadFile.Name sFileName = oUploadFile. Vardas Jei CheckValidExt (sFileName) = True Tada "Ši linija buvo šiek tiek prislėgtas, aptikti visą leistiną failo priesaga, pvz., ne taip negali būti į sąrašą arba sudaryti sąrašą ne tik kad katalogo pavadinimą ir vaizdo failo, jei sDir =" "Tada s_Url = sContentPath & sFileName kita s_Url = sContentPath & sDir ir "/" & sFileName pabaiga Jei s_List = s_List ir "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' url='" & s_Url & "'>" "& _" <td> "ir FileName2Pic (sFileName) &" </ td> "& _" <td noWrap> "ir sFileName &" </ td> "& _" <td align=right> "& GetSizeUnit ( oUploadFile. dydis) ir "</ td>" & _ "</ tr>" End If Kitas Nustatyti oUploadFolder = Nieko Nustatyti oUploadFiles, = nieko "Response.Write Server.HTMLEncode (s_List) &"! "& s_Url Jei sDir =" " Tada s_Url = "" "s_Url =" / "Kitas s_Url =" / "& sDir &" "'s_Url =" / "& sDir &" / "Pabaiga Jei s_List = s_List ir" </ table> "s_List = HTML2JS ( s_List) Response.Write Server.HTMLEncode (s_List) & "" & s_Url s_List = "parent.setDirList (" "" & s_List & "" "" "" & s_Url & "") "GetList = s_List End Function "Jei nenorite dėti aptikimą, turėtų būti galima į sąrašą visus failus į katalogą, ir šiek tiek prislėgtas .. dabar tik išvardyti failus ir katalogus, kad priesaga vardas Funkcija CheckValidExt (s_FileName), Jei sAllowExt =", Tada CheckValidExt = Tiesa Išeiti Funkcijos pabaiga jei Dim i, aExt, sExt sExt = LCase (Vidutinės (s_FileName, InStrRev (s_FileName,) + 1). ") CheckValidExt = False aExt = Splitas (LCase (sAllowExt)," | "), i = 0 Norėdami UBound (aExt) Jei aExt (i) = sExt Tada CheckValidExt = True išėjimo funkciją pabaiga Jei Kitas End Function "žemyn kodas rasti rasti sCurrDir vertę toliau verta pakomisės InitParam straipsnio) style = UCase (Trim (Request. eilutės užklausos ("tipas"))) sStyleName = Trim (Request. eilutės užklausos ("stilius")) Dim i, aStyleConfig, bValidStyle bValidStyle = False i = 1 - Norėdami Ubound (astyle) aStyleConfig = Splitas (astyle (i) "| | |") Jei (sStyleName) Lcase = Lcase (aStyleConfig (0)) Tada bValidStyle = True End If Kitas išvežimo, Jei bValidStyle = False. Tada OutScript ("alert ('Neteisingas Stilius".) ") End If sBaseUrl = aStyleConfig (19), "nAllowBrowse = CLng (aStyleConfig (43)) nAllowBrowse = 1 Jei nAllowBrowse <> 1. Tada OutScript (" alert ("Negalima leisti naršyti!") ") Pabaigos, Jei sUploadDir = aStyleConfig (3) Jei Kairė (sUploadDir 1) <> "/", tada pasirinkite minėto style Byla "REMOTE" sUploadDir, = ".. / .. /" & sUploadDir ir "Vaizdo /" Byla "File" sUploadDir = ".. / .. / "& sUploadDir ir" Kita / "byla" Media "sUploadDir =" .. / .. / "& sUploadDir & Žiniasklaida /" Byla "Flash" sUploadDir = ".. / .. /" & sUploadDir ir "Flash" / " Byla kita sUploadDir = ".. / .. /" & sUploadDir & "Paveikslėlio /" End Pasirinkite pabaiga Jei "sUploadDir = sUploadDir ir" / "Pasirinkite Byla sBaseUrl Byla" 0 "sContentPath = aStyleConfig (23) Pasirinkite Byla style Byla" NUOTOLINIS "sContentPath =" .. / "& aStyleConfig (3) &" Paveikslėlio / "Byla" FAILO "sContentPath, =" .. / "& aStyleConfig (3) ir" Kita / "byla" Media "sContentPath =" .. / "& aStyleConfig (3) &" Žiniasklaida / "Byla" FLASH "sContentPath, =" .. / "& aStyleConfig (3) ir" Flash "/" Byla kita sContentPath = ".. /" & aStyleConfig (3) & "Vaizdo / "End Select Case" 1 "sContentPath =" 2 "RelativePath2RootPath (sUploadDir) Byla sContentPath = RootPath2DomainPath (RelativePath2RootPath (sUploadDir)) pabaiga Pasirinkite Pasirinkite Case Case style" REMOTE "sAllowExt, = aStyleConfig (10) Byla" File "sAllowExt = aStyleConfig (6 ) Byla "MEDIA" sAllowExt = aStyleConfig (9) Byla "Flash" sAllowExt = aStyleConfig (7) Byla, kita sAllowExt = aStyleConfig (8) pabaiga Pasirinkite sCurrDir = "Pastaba sUploadDir, tai yra kelias į konfigūracijos adresu sDir = Trim ( Prašymas (rež "))" gauti kintamą sDir dir = Replace (sDir, "\", "/") ", rež kintamasis = Pakeisti filtras sDir (sDir" .. / "," ") sDir = Replace ( sDir "/", "") Jei sDir <> "" Tada, jei CheckValidDir (Server. Mappath (sUploadDir & sDir)) = True Tada sCurrDir = sUploadDir & sDir & "/" "sutelkti dėmesį į čia, žr. Ne, kai kada, sCurrDir vertės sUploadDir & sDir "Nors sDir veido filtruota sUploadDir & sDir, bet mes galima praleisti. specialiam naudojimui st0p, kita sDir bus pateikta toliau naudoti = "End If End If End Sub 

 <HTML> <HEAD> <meta Http-equiv='Content-Type' content='text/html; charset=utf-8'> <TITLE> eWebEditor </ TITLE> </ head> <body> <scenarijų kalba = "javascript"> parent.setDirList ("<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='../..'> <Td > <img border=0 src='../sysimage/file/parentfolder.gif'> </ td> <td> .. </ td> <td> </ td> </ tr> <tr onclick = "doRowClick ()" onmouseover = "doRowOver ()" onmouseout = "doRowOut ()" isdir = "true" kelias = ".. / .. / .. / LogFiles"> <td> <img border = 0 src = ".. / sysimage / failas / closedfolder.gif"> </ td> <td noWrap> LogFiles </ td> <td> </ td> </ tr> <tr onclick = "doRowClick (tai ) "onmouseover =" doRowOver () "onmouseout = 'doRowOut ()" isdir = "true" kelias = ".. / .. / .. / www"> <td> <img sienos = 0 src = ". / sysimage / failas / closedfolder.gif "> </ td> <td noWrap> www </ td> <td> </ td> </ tr> </ table>", "/ .. / .. / .. ") </ script> </ body> </ html>