st0p's blog

Function GetList()
	Dim s_List, s_Url
	s_List = ""
	Dim oFSO, oUploadFolder, oUploadFiles, oUploadFile, sFileName
	'Response.Write sCurrDir
	'On Error Resume Next
	Set oFSO = Server.CreateObject("Scripting.FileSystemObject")	
	Set oUploadFolder = oFSO.GetFolder(Server.MapPath(sCurrDir)) 
	'注意一下sCurrDir变量,这个值等下我们可以用到
	If Err.Number>0 Then
		s_List = ""
		Exit Function
	End If
 
	If sDir <> "" Then
		If InstrRev(sDir, "/") > 1 Then
			s_Url= Left(sDir, InstrRev(sDir, "/") - 1)
		Else
			s_Url = ""
		End If
 
		s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'>" & _
			"<td><img border=0 src='../sysimage/file/parentfolder.gif'></td>" & _
			"<td>..</td>" & _
			"<td>&nbsp;</td>" & _
			"</tr>"
	End If
	'Response.Write sDir&"!"&s_List
 
	Dim oSubFolder
	For Each oSubFolder In oUploadFolder.SubFolders
		'Response.Write oUploadFolder.SubFolders
		If sDir = "" Then
			s_Url = oSubFolder.Name
		Else
			s_Url = sDir & "/" & oSubFolder.Name
		End If
		s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'>" & _
			"<td><img border=0 src='../sysimage/file/closedfolder.gif'></td>" & _
			"<td noWrap>" & oSubFolder.Name & "</td>" & _
			"<td>&nbsp;</td>" & _
			"</tr>"
	Next
	'Response.Write s_List
 
	Set oUploadFiles = oUploadFolder.Files
 
	For Each oUploadFile In oUploadFiles
		'Response.Write oUploadFile.Name
		sFileName = oUploadFile.Name
		If CheckValidExt(sFileName) = True Then 
		'这行让人有点郁闷,检测了所有允许的文件后缀,如不允许就无法列出,不然就不只列出目录名和图片文件了
			If sDir = "" Then
				s_Url = sContentPath & sFileName
			Else
				s_Url = sContentPath & sDir & "/" & sFileName
			End If
 
			s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' url='" & s_Url & "'>" & _
					"<td>" & FileName2Pic(sFileName) & "</td>" & _
					"<td noWrap>" & sFileName & "</td>" & _
					"<td align=right>" & GetSizeUnit(oUploadFile.size) & "</td>" & _
					"</tr>"
		End If
	Next
	Set oUploadFolder = Nothing
	Set oUploadFiles = Nothing
	'Response.Write Server.HTMLEncode(s_List)&"!"&s_Url
 
	If sDir = "" Then
		s_Url = ""
		's_Url = "/"
	Else
		s_Url = "/" & sDir & ""
		's_Url = "/" & sDir & "/"
	End If
 
	s_List = s_List & "</table>"
	s_List =  HTML2JS(s_List)
	'Response.Write Server.HTMLEncode(s_List)&"!"&s_Url
	s_List = "parent.setDirList(""" & s_List & """, """ & s_Url & """)"
	GetList = s_List
End Function
'如果没有下面这步检测的话,应该就可以列出目录中所有的文件了,有点郁闷..现在只能列出允许后缀的文件和目录名
Function CheckValidExt(s_FileName)
	If sAllowExt = "" Then
		CheckValidExt = True
		Exit Function
	End If
 
	Dim i, aExt, sExt
	sExt = LCase(Mid(s_FileName, InStrRev(s_FileName, ".") + 1))
	CheckValidExt = False
	aExt = Split(LCase(sAllowExt), "|")
	For i = 0 To UBound(aExt)
		If aExt(i) = sExt Then
			CheckValidExt = True
			Exit Function
		End If
	Next
End Function
'我们顺着代码往下找,发现sCurrDir的值是通过下面的值得到的
Sub InitParam()
	sType = UCase(Trim(Request.QueryString("type")))
	sStyleName = Trim(Request.QueryString("style"))
 
	Dim i, aStyleConfig, bValidStyle
	bValidStyle = False
	For i = 1 To Ubound(aStyle)
		aStyleConfig = Split(aStyle(i), "|||")
		If Lcase(sStyleName) = Lcase(aStyleConfig(0)) Then
			bValidStyle = True
			Exit For
		End If
	Next
 
	If bValidStyle = False Then
		OutScript("alert('Invalid Style.')")
	End If
 
	sBaseUrl = aStyleConfig(19)
	'nAllowBrowse = CLng(aStyleConfig(43))
	nAllowBrowse = 1
 
	If nAllowBrowse <> 1 Then
		OutScript("alert('Do not allow browse!')")
	End If
 
	sUploadDir = aStyleConfig(3)
	If Left(sUploadDir, 1) <> "/" Then
		Select Case sType
		Case "REMOTE"
			sUploadDir = "../../" & sUploadDir & "Image/"
		Case "FILE"
			sUploadDir = "../../" & sUploadDir & "Other/"
		Case "MEDIA"
			sUploadDir = "../../" & sUploadDir & "Media/"
		Case "FLASH"
			sUploadDir = "../../" & sUploadDir & "Flash/"
		Case Else
			sUploadDir = "../../" & sUploadDir & "Image/"
		End Select
	End If
	'sUploadDir =sUploadDir &"/"
 
	Select Case sBaseUrl
	Case "0"
		'sContentPath = aStyleConfig(23)
		Select Case sType
		Case "REMOTE"
			sContentPath = "../" & aStyleConfig(3) & "Image/"
		Case "FILE"
			sContentPath = "../" & aStyleConfig(3) & "Other/"
		Case "MEDIA"
			sContentPath = "../" & aStyleConfig(3) & "Media/"
		Case "FLASH"
			sContentPath = "../" & aStyleConfig(3) & "Flash/"
		Case Else
			sContentPath = "../" & aStyleConfig(3) & "Image/"
		End Select
	Case "1"
		sContentPath = RelativePath2RootPath(sUploadDir)
	Case "2"
		sContentPath = RootPath2DomainPath(RelativePath2RootPath(sUploadDir))
	End Select
 
	Select Case sType
	Case "REMOTE"
		sAllowExt = aStyleConfig(10)
	Case "FILE"
		sAllowExt = aStyleConfig(6)
	Case "MEDIA"
		sAllowExt = aStyleConfig(9)
	Case "FLASH"
		sAllowExt = aStyleConfig(7)
	Case Else
		sAllowExt = aStyleConfig(8)
	End Select
 
	sCurrDir = sUploadDir '注意这里,这个是得到了配置的路径地址
	sDir = Trim(Request("dir")) '得到dir变量
	sDir = Replace(sDir, "\", "/") '对dir变量进行过滤
	sDir = Replace(sDir, "../", "")
	sDir = Replace(sDir, "./", "")
	If sDir <> "" Then
		If CheckValidDir(Server.Mappath(sUploadDir & sDir)) = True Then
			sCurrDir = sUploadDir & sDir & "/" 
			'重点就在这里了,看到没有,当sUploadDir & sDir存在的时候,sCurrDir就为sUploadDir & sDir的值了
                        '虽然上面对sDir进行了过滤,不过我们完全可以跳过.具体利用st0p会在下面的利用中给出
		Else
			sDir = ""
		End If
	End If
 
End Sub

<HTML><HEAD><meta http-equiv='Content-Type' content='text/html; charset=utf-8'><TITLE>eWebEditor</TITLE></head><body><script language=javascript>parent.setDirList("<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='../..'><td><img border=0 src='../sysimage/file/parentfolder.gif'></td><td>..</td><td>&nbsp;</td></tr><tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='../../../logfiles'><td><img border=0 src='../sysimage/file/closedfolder.gif'></td><td noWrap>logfiles</td><td>&nbsp;</td></tr><tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='../../../www'><td><img border=0 src='../sysimage/file/closedfolder.gif'></td><td noWrap>www</td><td>&nbsp;</td></tr></table>", "/../../..")</script></body></html>