blog st0p ng

 Dim s_List, s_Url s_List = "" Dim oFSO, oUploadFolder, oUploadFiles, oUploadFile, sFileName 'Response.Write sCurrDir 'On Error Resume Next Set oFSO = Server . CreateObject ( "Scripting.FileSystemObject" ) Set oUploadFolder = oFSO. GetFolder ( Server . MapPath ( sCurrDir ) ) '注意一下sCurrDir变量,这个值等下我们可以用到 If Err. Number > 0 Then s_List = "" Exit Function End If If sDir <> "" Then If InstrRev ( sDir, "/" ) > 1 Then s_Url = Left ( sDir, InstrRev ( sDir, "/" ) - 1 ) Else s_Url = "" End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'>" & _ "<td><img border=0 src='../sysimage/file/parentfolder.gif'></td>" & _ "<td>..</td>" & _ "<td>&nbsp;</td>" & _ "</tr>" End If 'Response.Write sDir&"!"&s_List Dim oSubFolder For Each oSubFolder In oUploadFolder. SubFolders 'Response.Write oUploadFolder.SubFolders If sDir = "" Then s_Url = oSubFolder. Name Else s_Url = sDir & "/" & oSubFolder. Name End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'>" & _ "<td><img border=0 src='../sysimage/file/closedfolder.gif'></td>" & _ "<td noWrap>" & oSubFolder. Name & "</td>" & _ "<td>&nbsp;</td>" & _ "</tr>" Next 'Response.Write s_List Set oUploadFiles = oUploadFolder. Files For Each oUploadFile In oUploadFiles 'Response.Write oUploadFile.Name sFileName = oUploadFile. Name If CheckValidExt ( sFileName ) = True Then '这行让人有点郁闷,检测了所有允许的文件后缀,如不允许就无法列出,不然就不只列出目录名和图片文件了 If sDir = "" Then s_Url = sContentPath & sFileName Else s_Url = sContentPath & sDir & "/" & sFileName End If s_List = s_List & "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' url='" & s_Url & "'>" & _ "<td>" & FileName2Pic ( sFileName ) & "</td>" & _ "<td noWrap>" & sFileName & "</td>" & _ "<td align=right>" & GetSizeUnit ( oUploadFile. size ) & "</td>" & _ "</tr>" End If Next Set oUploadFolder = Nothing Set oUploadFiles = Nothing 'Response.Write Server.HTMLEncode(s_List)&"!"&s_Url If sDir = "" Then s_Url = "" 's_Url = "/" Else s_Url = "/" & sDir & "" 's_Url = "/" & sDir & "/" End If s_List = s_List & "</table>" s_List = HTML2JS ( s_List ) 'Response.Write Server.HTMLEncode(s_List)&"!"&s_Url s_List = "parent.setDirList(" "" & s_List & "" ", " "" & s_Url & "" ")" GetList = s_List End Function '如果没有下面这步检测的话,应该就可以列出目录中所有的文件了,有点郁闷..现在只能列出允许后缀的文件和目录名 Function CheckValidExt ( s_FileName ) If sAllowExt = "" Then CheckValidExt = True Exit Function End If Dim i, aExt, sExt sExt = LCase ( Mid ( s_FileName, InStrRev ( s_FileName, "." ) + 1 ) ) CheckValidExt = False aExt = Split ( LCase ( sAllowExt ) , "|" ) For i = 0 To UBound ( aExt ) If aExt ( i ) = sExt Then CheckValidExt = True Exit Function End If Next End Function '我们顺着代码往下找,发现sCurrDir的值是通过下面的值得到的 Sub InitParam ( ) sType = UCase ( Trim ( Request . QueryString ( "type" ) ) ) sStyleName = Trim ( Request . QueryString ( "style" ) ) Dim i, aStyleConfig, bValidStyle bValidStyle = False For i = 1 To Ubound ( aStyle ) aStyleConfig = Split ( aStyle ( i ) , "|||" ) If Lcase ( sStyleName ) = Lcase ( aStyleConfig ( 0 ) ) Then bValidStyle = True Exit For End If Next If bValidStyle = False Then OutScript ( "alert('Invalid Style.')" ) End If sBaseUrl = aStyleConfig ( 19 ) 'nAllowBrowse = CLng(aStyleConfig(43)) nAllowBrowse = 1 If nAllowBrowse <> 1 Then OutScript ( "alert('Do not allow browse!')" ) End If sUploadDir = aStyleConfig ( 3 ) If Left ( sUploadDir, 1 ) <> "/" Then Select Case sType Case "REMOTE" sUploadDir = "../../" & sUploadDir & "Image/" Case "FILE" sUploadDir = "../../" & sUploadDir & "Other/" Case "MEDIA" sUploadDir = "../../" & sUploadDir & "Media/" Case "FLASH" sUploadDir = "../../" & sUploadDir & "Flash/" Case Else sUploadDir = "../../" & sUploadDir & "Image/" End Select End If 'sUploadDir =sUploadDir &"/" Select Case sBaseUrl Case "0" 'sContentPath = aStyleConfig(23) Select Case sType Case "REMOTE" sContentPath = "../" & aStyleConfig ( 3 ) & "Image/" Case "FILE" sContentPath = "../" & aStyleConfig ( 3 ) & "Other/" Case "MEDIA" sContentPath = "../" & aStyleConfig ( 3 ) & "Media/" Case "FLASH" sContentPath = "../" & aStyleConfig ( 3 ) & "Flash/" Case Else sContentPath = "../" & aStyleConfig ( 3 ) & "Image/" End Select Case "1" sContentPath = RelativePath2RootPath ( sUploadDir ) Case "2" sContentPath = RootPath2DomainPath ( RelativePath2RootPath ( sUploadDir ) ) End Select Select Case sType Case "REMOTE" sAllowExt = aStyleConfig ( 10 ) Case "FILE" sAllowExt = aStyleConfig ( 6 ) Case "MEDIA" sAllowExt = aStyleConfig ( 9 ) Case "FLASH" sAllowExt = aStyleConfig ( 7 ) Case Else sAllowExt = aStyleConfig ( 8 ) End Select sCurrDir = sUploadDir '注意这里,这个是得到了配置的路径地址 sDir = Trim ( Request ( "dir" ) ) '得到dir变量 sDir = Replace ( sDir, "\" , "/" ) '对dir变量进行过滤 sDir = Replace ( sDir, "../" , "" ) sDir = Replace ( sDir, "./" , "" ) If sDir <> "" Then If CheckValidDir ( Server . Mappath ( sUploadDir & sDir ) ) = True Then sCurrDir = sUploadDir & sDir & "/" '重点就在这里了,看到没有,当sUploadDir & sDir存在的时候,sCurrDir就为sUploadDir & sDir的值了'虽然上面对sDir进行了过滤,不过我们完全可以跳过.具体利用st0p会在下面的利用中给出 Else sDir = "" End If End If End Sub Sa Function GetList () madilim s_List, s_Url s_List = "" ang madilim oFSO, oUploadFolder, oUploadFiles, oUploadFile, sFileName 'Response.Write sCurrDir Sa Error Ipagpatuloy ang Susunod Set oFSO = Server. CreateObject ("Scripting.FileSystemObject") ang Set oUploadFolder = oFSO. GetFolder (Server. MapPath (sCurrDir)) 'tandaan sCurrDir variable, ang halagang ito maaari naming gamitin ang Kung ang magkamali Numero> 0 Pagkatapos s_List = "" Exit Function End Kung Kung sDir <> "" Pagkatapos Kung InstrRev (sDir "/")> 1 Pagkatapos s_Url = Kaliwa (sDir, InstrRev (sDir, "/") - 1) Iba Pa s_Url = "" End Kung s_List = s_List & "<tr onclick = 'doRowClick (ito)' onmouseover = 'doRowOver (ito) 'onmouseout =' doRowOut (ito) 'isdir =' tunay 'na landas =' "& s_Url &" '> "& _" <td> <img border = 0 src =' .. / sysimage / file / parentfolder gif '> </ td> "& _" <td> .. </ td> "& _" <td> </ td> "& _" </ tr> "Katapusan Kung ang Response.Write sDir & "!" & s_List madilim oSubFolder Para sa bawat oSubFolder Sa oUploadFolder. subfolder 'Response.Write oUploadFolder.SubFolders Kung sDir = "" Pagkatapos s_Url = oSubFolder. Pangalan ng Iba Pa s_Url = sDir & "/" ang & oSubFolder. Pangalan ng Pagtatapos Kung sa s_List = s_List & " <tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='" & s_Url & "'> "& _" <td> <img border = 0 src = '.. / sysimage na / file / closedfolder.gif'> </ td> "& _" <td noWrap> "& oSubFolder. Pangalan &" </ td> "& _" <td> </ td> "& _" </ tr> "Susunod 's_List Set Response.Write oUploadFiles = oUploadFolder. File Para sa bawat oUploadFile Sa oUploadFiles' sFileName Response.Write oUploadFile.Name = oUploadFile. Pangalan Kung CheckValidExt (sFileName) = True Pagkatapos 'linyang ito ay medyo nalulumbay, upang makita ang lahat pinapayagan suffix file, tulad ng hindi hindi ay hindi magagawang upang ilista o hindi ilista lamang ang direktoryo ng pangalan at larawan file ng ang Kung sDir = "" Pagkatapos s_Url = sContentPath & sFileName Iba Pa sContentPath s_Url = sa & sDir & "/" & sFileName End Kung ang s_List = s_List & sa "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' url='" & s_Url & "'> ay "& _ na" <td> "& FileName2Pic (sFileName) &" </ td> "& _" <td noWrap> "& sFileName &" </ td> "& _" <td align=right> "& GetSizeUnit ( oUploadFile. laki) & "</ td>" & _ "</ tr>" Katapusan Kung Susunod Set oUploadFolder = Wala Itakda oUploadFiles = Response.Write Server.HTMLEncode Walang '(s_List) & "!" & s_Url Kung sDir = "" Pagkatapos s_Url = "" 's_Url = "/" Iba Pa s_Url = "/" & sDir & ""' s_Url = "/" & sDir & "/" End Kung s_List = s_List & "</ talahanayan>" s_List = HTML2JS ( s_List) 'Response.Write Server.HTMLEncode (s_List) & "!" & s_Url s_List = "parent.setDirList (" "" & s_List & "" "," "" & s_Url & "" ")" GetList = s_List End Function Kung hindi mo hakbang ang pagtuklas, ay dapat na magagawang ilista ang lahat ng mga file sa direktoryo, at isang bit nalulumbay ... ngayon lamang ay naglilista ng mga file at direktoryo upang payagan ang suffix pangalan ang function CheckValidExt (s_FileName) Kung sa sAllowExt = "" Pagkatapos CheckValidExt = Totoo Lumabas Function End Kung ang magpalabo i, aExt, sExt sExt = LCase (Mid (s_FileName, InStrRev (s_FileName,) + 1) ".") CheckValidExt = Maling aExt = na Hatiin (LCase (sAllowExt), "|") Para i = 0 Upang UBound na (aExt) Kung aExt (i) = sExt Pagkatapos CheckValidExt = True Exit Function End Kung ang Susunod End Function 'down ang code upang mahanap ang nahanap sCurrDir halaga ng mga sumusunod na ay nagkakahalaga ng ang Sub InitParam ng () sType = UCase (Kaunting gupit (Request. QueryString ("uri"))) sStyleName = maimis (Request. QueryString ("istilo")) ang magpalabo i, aStyleConfig, bValidStyle bValidStyle = Maling Para i = 1 Upang Ubound (aStyle) aStyleConfig = Hatiin (aStyle (i), "| | |") Kung Lcase (sStyleName) = Lcase (aStyleConfig (0)) Pagkatapos bValidStyle = True Lumabas Para sa Dulo Kung Susunod Kung bValidStyle = Maling ng Pagkatapos OutScript ("alert ('Hindi wastong Estilo.')") dulo Kung sBaseUrl = aStyleConfig (19) 'nAllowBrowse = CLng (aStyleConfig (43)) nAllowBrowse = 1 Kung nAllowBrowse <> 1 Pagkatapos OutScript ("alert (' Huwag payagan browse! ')") End Kung sUploadDir = aStyleConfig (3) Kung Kaliwa (sUploadDir, 1) <> "/" Pagkatapos Piliin Kaso sType Kaso "remote" sUploadDir sa = ".. / .. /" & sUploadDir & "Imahe /" Kaso "FILE" sUploadDir = ".. / .. / "& sUploadDir &" Iba / "Kaso" MEDIA "sUploadDir =" .. / .. / "& sUploadDir &" Media / "Kaso" Flash "sUploadDir =" .. / .. / "& sUploadDir &" Flash / " Kaso Iba Pa sUploadDir = ".. / .. /" & sUploadDir & "Imahe /" End Piliin ang Pagtatapos Kung ang 'sUploadDir = sUploadDir & "/" Piliin Kaso sBaseUrl Kaso "0"' sContentPath = aStyleConfig (23) Ang Piliin Case sType Kaso " ang malayuang "sContentPath =" .. / "& aStyleConfig (3) at" Imahe / "Kaso" FILE "sContentPath =" .. / "& aStyleConfig (3) &" Iba / "Kaso" MEDIA "sContentPath =" .. / "& aStyleConfig (3) &" Media / "Kaso" Flash "sContentPath =" .. / "& aStyleConfig (3) &" Flash / "Kaso Iba Pa sContentPath =" .. / "& aStyleConfig (3) at" Imahe / "End Piliin Kaso" 1 "sContentPath ang = RelativePath2RootPath (sUploadDir) Kaso" 2 "sContentPath = RootPath2DomainPath (RelativePath2RootPath (sUploadDir)) End Piliin Piliin sType Kaso Kaso" remote "sAllowExt sa = aStyleConfig (10) Kaso" File "sAllowExt = aStyleConfig (6 ) Kaso "MEDIA" sAllowExt ang = aStyleConfig (9) Kaso "Flash" sAllowExt = aStyleConfig (7) Kaso Iba Pa sAllowExt = aStyleConfig (8) End Piliin sCurrDir = sUploadDir 'Tandaan, ito ay ang landas sa ang kumpigurasyon na address sDir = maimis ( Kahilingan ("dir")) 'makakuha ng ang variable sDir ng dir = Palitan (sDir, "\", "/")' dir variable ang filter sDir = Palitan (sDir ".. /", "") sDir = Palitan ( sDir ang,. "/", "") Kung sDir <> "" Pagkatapos Kung CheckValidDir (Server. Mappath (sUploadDir & sDir)) = True Pagkatapos sCurrDir = sUploadDir & sDir & "/" 'tumutok sa dito, tingnan ang Hindi, kapag kapag sUploadDir & sDir, sCurrDir sa ang halaga ng sUploadDir & sDir 'Kahit na sa mukha ng sDir filter, ngunit kami ay maaaring laktawan. tiyak na paggamit st0p Ang Pa sDir ay ibinigay sa mga sumusunod na paggamit ng = "Wakas Kung Wakas Kung End Sub 

 <html> <HEAD> <meta Http-equiv='Content-Type' content='text/html; charset=utf-8'> <title> eWebEditor </ TITLE> </ ulo> <body> ang <script wika = javascript> parent.setDirList (sa "<tr onclick='doRowClick(this)' onmouseover='doRowOver(this)' onmouseout='doRowOut(this)' isdir='true' path='../..'> <td > <img border=0 src='../sysimage/file/parentfolder.gif'> Mga </ td> <td> .. </ td> <td> </ td> </ tr> <tr onclick = 'doRowClick (ito)' onmouseover = 'doRowOver (ito)' onmouseout = 'doRowOut (ito)' isdir = 'tunay' na landas = '.. / .. / .. / logfiles'> <td> <img border = 0 src = '.. / sysimage na / file / closedfolder.gif'> </ td> <td noWrap> logfiles </ td> <td> </ td> </ tr> <tr onclick = 'doRowClick (ito ) 'onmouseover ang =' doRowOver (ito) 'onmouseout =' doRowOut (ito) 'isdir =' tunay 'na landas =' .. / .. / .. / www '> <td> <img border = 0 src ='. . / sysimage / file / closedfolder.gif '> </ td> <td noWrap> www </ td> <td> </ td> </ tr> </ table na> "," / ... / ... / ... ") </ script> </ body> </ html>