ecshop購物車訂單XSS漏洞修復
//打開文件
flow.php
查找
$order['from_ad'] = !empty($_SESSION['from_ad']) ? $_SESSION['from_ad'] : '0'; //$order['referer'] = !empty($_SESSION['referer']) ? addslashes($_SESSION['referer']) : '';
替換為
/* 購物車訂單XSS by tbadc.com begin */
//$order['from_ad'] = !empty($_SESSION['from_ad']) ? $_SESSION['from_ad'] : '0';
//$order['referer'] = !empty($_SESSION['referer']) ? addslashes($_SESSION['referer']) : '';
$order['from_ad'] = !empty($_SESSION['from_ad']) && preg_match('/^-?[1-9]\d*$/', $_REQUEST['id']) ? $_SESSION['from_ad'] : '0';
//$order['referer'] = !empty($_SESSION['referer']) && preg_match('/^-?[1-9]\d*$/', $_REQUEST['id']) ? addslashes($_SESSION['referer']) : '';
/* 購物車訂單XSS by tbadc.com end */
壓縮包flow_bak.php是備份文件，不用理。
