|
Server : Microsoft-IIS/10.0 System : Windows NT EBS-6136 10.0 build 17763 (Windows Server 2016) i586 User : jxgj ( 0) PHP Version : 7.0.33 Disable Function : passthru,exec,system,shell_exec,proc_open,popen,pcntl_exec,socket_bind,stream_socket_server Directory : D:/tmp_aspnet/root/1628da1e/54dd077c/ |
?#pragma checksum "D:\wwwroot\bxty\wwwroot\im\ashx\ImIndex.ashx" "{406ea660-64cf-4c82-b6f0-42d48172a799}" "FE2C82C7356ABD22680F9AF58EF620CB"
#line 1 "D:\wwwroot\bxty\wwwroot\im\ashx\ImIndex.ashx"
using System;
using System.Web;
using System.Data;
using System.IO;
using System.Text.RegularExpressions;
using System.Net;
using System.Collections.Specialized;
using System.Collections.Generic;
using Zhucao.IM.Web.DataChanageCenter;
public class ImIndex : IHttpHandler
{
public void ProcessRequest(HttpContext context)
{
context.Response.ContentType = "text/plain";
if (HttpContext.Current.Request.UrlReferrer == null)
{
System.Collections.Specialized.NameValueCollection head = HttpContext.Current.Request.Headers;
System.Collections.IEnumerator iem = head.GetEnumerator();
//ArrayList value = new ArrayList();
string headstr = "";
for (int i = 0; iem.MoveNext(); i++)
{
string key = head.GetKey(i);
headstr += key + ":" + head.Get(key) + ",";
//value.Add(head.Get(key));
}
//if (CheckCode(cookiesstr) || CheckCode(referrestr) || CheckCode(headstr))
if (context.Request["callback"] != null || context.Request["jsoncallback"] != null || CheckCode(headstr))
{
HttpContext.Current.Response.Write("页面如同开幼差了！");
HttpContext.Current.Response.End();
}
try
{
string getkeys = "";
//预防post步骤注入
if (System.Web.HttpContext.Current.Request.Form != null)
{
for (int i = 0; i < System.Web.HttpContext.Current.Request.Form.Count; i++)
{
getkeys = System.Web.HttpContext.Current.Request.Form.Keys[i];
if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.Form[getkeys], 1))
{
//RecordeWrite();
//System.Web.HttpContext.Current.Response.Redirect("/Error/assault.htm");
System.Web.HttpContext.Current.Response.Write("页面如同开幼差了！");
System.Web.HttpContext.Current.Response.End();
}
}
}
//预防get步骤注入
if (System.Web.HttpContext.Current.Request.QueryString != null)
{
for (int i = 0; i < System.Web.HttpContext.Current.Request.QueryString.Count; i++)
{
getkeys = System.Web.HttpContext.Current.Request.QueryString.Keys[i];
if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.QueryString[getkeys], 2))
{
//RecordeWrite();
//System.Web.HttpContext.Current.Response.Redirect("/Error/assault.htm");
System.Web.HttpContext.Current.Response.Write("页面如同开幼差了！");
System.Web.HttpContext.Current.Response.End();
}
}
}
//预防cookie步骤注入
if (System.Web.HttpContext.Current.Request.Cookies != null)
{
for (int i = 0; i < System.Web.HttpContext.Current.Request.Cookies.Count; i++)
{
getkeys = System.Web.HttpContext.Current.Request.Cookies.AllKeys[i];
if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.Cookies[getkeys].Value, 3))
{
//RecordeWrite();
//System.Web.HttpContext.Current.Response.Redirect("/Error/assault.htm");
System.Web.HttpContext.Current.Response.Write("页面如同开幼差了！");
System.Web.HttpContext.Current.Response.End();
}
}
}
}
catch
{
}
}
try
{
//string method = context.Request.Form["method"];
string method = context.Request["method"];
string jsoncallback = context.Request["jsoncallback"];
if (string.IsNullOrEmpty(jsoncallback))
jsoncallback = "";
switch (method)
{
case "getinfo":
//string type = context.Request.Form["type"] == null ? "0" : context.Request.Form["type"];
string type = context.Request["type"] == null ? "0" : context.Request["type"];
string strHtml = GetHtml(type);
//context.Response.Write(strHtml);
context.Response.Write(jsoncallback + "({\"retValue\":\"" + HttpUtility.UrlEncode(strHtml) + "\"})");
context.Response.End();
break;
case "getservice":
List<string> list = Zhucao.IM.Web.DataChanageCenter.OnLineUsers.Instance.GetOnlineService();
System.Text.StringBuilder str = new System.Text.StringBuilder();
if (list.Count > 0)
{
str.AppendLine("<p><br/><strong>请选择必要征询的客服</strong><br/><br/>");
int i = 0;
foreach (string l in list)
{
if (i % 3 == 0)
{
str.AppendLine("<span>");
}
str.AppendLine("<label style=\"cursor:pointer;text-decoration:underline\" onclick=\"ChooseService('" + l + "');\"><font color=\"blue\">" + l + "</font></label>");
if ((i + 1) % 3 == 0)
{
str.AppendLine("</span>");
}
i++;
}
str.AppendLine("</p>");
//context.Response.Write(str.ToString());
context.Response.Write(jsoncallback + "({\"retValue\":\"" + HttpUtility.UrlEncode(str.ToString()) + "\"})");
//context.Response.End();
}
else
{
//context.Response.Write("");
context.Response.Write(jsoncallback + "({\"retValue\":\"\"})");
}
break;
case "getshareinfo":
string query = "<Company pagesize=\"1\" needitem=\"CompanyName,Company_gk\" orderby=\"ID desc\" />";
System.Data.DataSet ds = (System.Data.DataSet)BusinessRules.CFactory.CGetData(query);
if (ds.Tables.Count > 0)
{
if (ds.Tables[0].Rows.Count > 0)
{
DataRow dr = ds.Tables[0].Rows[0];
//context.Response.Write(dr["CompanyName"].ToString() + "|" + dr["Company_gk"].ToString());
context.Response.Write(jsoncallback + "({\"retValue\":\"" + HttpUtility.UrlEncode(dr["CompanyName"].ToString() + "|" + dr["Company_gk"].ToString()) + "\"})");
}
}
else
{
//context.Response.Write("");
context.Response.Write(jsoncallback + "({\"retValue\":\"\"})");
}
//context.Response.Write("筑巢软件（江苏）有限公司|搜索引擎全网推广,搜索引擎竞价伴侣,筑巢工业淘宝首选筑巢系统,筑巢系统提供的多关键词,多搜索引擎覆盖推广快率快,排名不变,易操作,是中国当先的一站式网络推广软件。");
break;
default:
//context.Response.Write("");
context.Response.Write(jsoncallback + "({\"retValue\":\"\"})");
break;
}
context.Response.End();
}
catch (Exception err)
{
//context.Response.Write("({\"retValue\":\"页面开幼差了\"})");
}
}
/// <summary>
/// Im主页面展示信息
/// </summary>
/// <param name="type"></param>
/// <returns></returns>
private string GetHtml(string type)
{
string strHtml = "";
switch (type)
{
case "0":
strHtml = GetZhuChaoInfo();
break;
case "1":
strHtml = GetImInfo();
break;
default:
break;
}
return strHtml;
}
/// <summary>
/// 获取筑巢企业信息
/// </summary>
/// <returns></returns>
private string GetZhuChaoInfo()
{
System.Text.StringBuilder str = new System.Text.StringBuilder();
if (true)
{
string query = "<Company pagesize=\"1\" needitem=\"CID,rName,zw,Phone,Mobile,QQ,Email\" orderby=\"ID desc\" />";
System.Data.DataSet ds = (System.Data.DataSet)BusinessRules.CFactory.CGetData(query);
if (ds.Tables.Count > 0)
{
if (ds.Tables[0].Rows.Count > 0)
{
DataRow dr = ds.Tables[0].Rows[0];
if (dr["QQ"].ToString() != "")
{
str.AppendLine("<p><strong>在线QQ</strong></p>");
foreach (string q in dr["QQ"].ToString().Split(new char[] { ',', '，', '|',' ' },StringSplitOptions.RemoveEmptyEntries))
{
str.AppendLine("<p id=\"ico_onlineqq\"><a target='_blank' style=\"text-decoration: none;display: block;width: 78px;height: 24px;margin: 0 auto;margin-top: 8px;cursor: pointer;background-image:url('http://wpa.qq.com/pa?p=1:" + q + ":51');\" href='http://wpa.qq.com/msgrd?v=3&uin=" + q + "&site=qq&menu=yes'></a></p>");
}
//str.AppendLine("<p><strong>在线QQ</strong></p><p id=\"ico_onlineqq\"><a target='_blank' class=\"qq\" style='text-decoration: none;' href='http://wpa.qq.com/msgrd?v=3&uin=" + dr["QQ"].ToString() + "&site=qq&menu=yes'></a></p>");
}
//在线客服
List<string> list = Zhucao.IM.Web.DataChanageCenter.OnLineUsers.Instance.GetOnlineService();
if (list.Count > 0)
{
str.AppendLine("<p><strong>在线客服</strong>");
int i = 0;
foreach (string l in list)
{
if (i % 3 == 0)
{
str.AppendLine("<span>");
}
str.AppendLine("<label style=\"cursor:pointer;text-decoration:underline\" onclick=\"lightshow('" + l + "');\"><font color=\"blue\">" + l + "</font></label>");
if ((i + 1) % 3 == 0)
{
str.AppendLine("</span>");
}
i++;
}
str.AppendLine("</p>");
}
if (dr["Phone"].ToString() != "")
{
//str.AppendLine("<p><strong>联系电话</strong><span>" + dr["Phone"].ToString() + "</span></p>");
str.AppendLine("<p><strong>联系电话</strong></p>");
foreach (string p in dr["Phone"].ToString().Split(new char[] { ',', '，', '|', ' ' }, StringSplitOptions.RemoveEmptyEntries))
{
str.AppendLine("<p style=\"margin-top: 1px;\"><span>" + p + "</span></p>");
}
}
if (dr["Mobile"].ToString() != "")
{
//str.AppendLine("<p><strong>联系手机</strong><span>" + dr["Mobile"].ToString() + "</span></p>");
str.AppendLine("<p><strong>联系手机</strong></p>");
foreach (string m in dr["Mobile"].ToString().Split(new char[] { ',', '，', '|', ' ' }, StringSplitOptions.RemoveEmptyEntries))
{
str.AppendLine("<p style=\"margin-top: 1px;\"><span>" + m + "</span></p>");
}
}
str.AppendLine("<p><img alt=\"分享\" width=\"100px\" height=\"27px\" style=\"cursor:pointer\" src=\"/im/images/share.gif\" onclick=\"OpenShare();\"/></p>");
}
}
}
//else
//{
// //str.AppendLine("<p><strong>在线QQ</strong></p><p id=\"ico_onlineqq\"><a target='_blank' class=\"qq\" style='text-decoration: none;' href='http://wpa.qq.com/msgrd?v=3&uin=645045611&site=qq&menu=yes'></a></p>");
// string qqlist = "645045611,270978376";
// if (qqlist != "")
// {
// str.AppendLine("<p><strong>在线QQ</strong></p>");
// foreach (string q in qqlist.Split(new char[] { ',', '，', '|' }))
// {
// str.AppendLine("<p id=\"ico_onlineqq\"><a target='_blank' style=\"text-decoration: none;display: block;width: 78px;height: 24px;margin: 0 auto;margin-top: 8px;cursor: pointer;background-image:url('http://wpa.qq.com/pa?p=1:" + q + ":51');\" href='http://wpa.qq.com/msgrd?v=3&uin=" + q + "&site=qq&menu=yes'></a></p>");
// }
// }
// //str.AppendLine("<p><strong>在线客服</strong><span><a target='_blank' href=\"http://www.m.nmwfxd.com\"><font color=\"blue\">客服1</font></a> <a target='_blank' href=\"http://www.m.nmwfxd.com\"><font color=\"blue\">客服2</font></a> <a target='_blank' href=\"http://www.m.nmwfxd.com\"><font color=\"blue\">客服3</font></a></span><span><a target='_blank' href=\"http://www.m.nmwfxd.com\"><font color=\"blue\">客服1</font></a> <a target='_blank' href=\"http://www.m.nmwfxd.com\"><font color=\"blue\">客服2</font></a> <a target='_blank' href=\"http://www.m.nmwfxd.com\"><font color=\"blue\">客服3</font></a></span></p>");
// List<string> list = Zhucao.IM.Web.DataChanageCenter.OnLineUsers.Instance.GetOnlineService();
// if (list.Count > 0)
// {
// str.AppendLine("<p><strong>在线客服</strong>");
// int i = 0;
// foreach (string l in list)
// {
// if (i % 3 == 0)
// {
// str.AppendLine("<span>");
// }
// str.AppendLine("<label style=\"cursor:pointer;text-decoration:underline\" onclick=\"lightshow('" + l + "');\"><font color=\"blue\">" + l + "</font></label>");
// if ((i + 1) % 3 == 0)
// {
// str.AppendLine("</span>");
// }
// i++;
// }
// str.AppendLine("</p>");
// }
// str.AppendLine("<p><strong>联系电话</strong></p>");
// str.AppendLine("<p style=\"margin-top: 1px;\"><span>0519-1212351</p>"); str.AppendLine("<p style=\"margin-top: 1px;\"><span>0519-1212351</p>");
// str.AppendLine("<p><strong>联系手机</strong><span>475676576576757</span></p>");
// str.AppendLine("<p><img alt=\"分享\" width=\"100px\" height=\"27px\" style=\"cursor:pointer\" src=\"/im/images/share.gif\" onclick=\"OpenShare();\"/></p>");
//}
return str.ToString();
}
/// <summary>
/// 获取非筑巢公司IM主界面信息
/// </summary>
/// <returns></returns>
private string GetImInfo()
{
string file = HttpContext.Current.Server.MapPath("../ImInfo.htm");
System.Text.StringBuilder sb = new System.Text.StringBuilder(ReadFromFile(file));
System.Text.StringBuilder str = new System.Text.StringBuilder();
List<string> list = Zhucao.IM.Web.DataChanageCenter.OnLineUsers.Instance.GetOnlineService();
if (list.Count > 0)
{
str.AppendLine("<p><strong>在线客服</strong>");
int i = 0;
foreach (string l in list)
{
if (i % 3 == 0)
{
str.AppendLine("<span>");
}
str.AppendLine("<label style=\"cursor:pointer;text-decoration:underline\" onclick=\"lightshow('" + l + "');\"><font color=\"blue\">" + l + "</font></label>");
if ((i + 1) % 3 == 0)
{
str.AppendLine("</span>");
}
i++;
}
str.AppendLine("</p>");
}
sb.Replace("[online]", str.ToString());
return sb.ToString();
}
/// <summary>
/// 读取文件
/// </summary>
/// <param name="file"></param>
/// <returns></returns>
private string ReadFromFile(string file)
{
if (File.Exists(file))
{
using (FileStream stream = new FileStream(file, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
{
using (StreamReader reader = new StreamReader(stream, System.Text.Encoding.Default))
{
return reader.ReadToEnd();
}
}
}
return string.Empty;
}
public bool IsReusable
{
get
{
return false;
}
}
protected bool CheckCode(string strtemp)
{
if (string.IsNullOrEmpty(strtemp))
return true;
else
strtemp = HttpUtility.UrlDecode(HttpUtility.UrlDecode(strtemp));
System.Text.RegularExpressions.Regex reg = new System.Text.RegularExpressions.Regex(@"[\&\$\^#\!~\%\@\+\]\[]", System.Text.RegularExpressions.RegexOptions.IgnoreCase | System.Text.RegularExpressions.RegexOptions.Multiline);
return reg.IsMatch(strtemp);
}
/// <summary>
/// 分析用户要求是否正常
/// </summary>
/// <param name="Str">传入用户提交数据</param>
/// <param name="type">注入的方式</param>
/// <returns>返回是否含有SQL注入式攻击代码</returns>
protected bool ProcessSqlStr(string Str, int type)
{
string SqlStr = "";
if (type == 1) //Post步骤提交
{
SqlStr = "script|iframe|xp_loginconfig|xp_fixeddrives|Xp_regremovemultistring|Xp_regread|Xp_regwrite|xp_cmdshell|xp_dirtree|exec|insert|select|delete|update|count(|asc(|chr(|substring(|mid(|master|truncate|char(|declare|replace(|varchar(|cast(";
}
else if (type == 2) //Get步骤提交
{
SqlStr = "[1]|[2]|[3]|[4]|[5]|[6]|[7]|[8]|[9]|[10]|[11]|+|[12]|CR|[13]|LF|[14]|[15]|[16]|[17]|document|[18]|eval|.|";
SqlStr+= "*|'|script|iframe|xp_loginconfig|xp_fixeddrives|Xp_regremovemultistring|Xp_regread|Xp_regwrite|xp_cmdshell|xp_dirtree|exec|insert|select|delete|update|count(|*|asc(|chr(|substring(|mid(|master|truncate|char(|declare|and|or|=|%|replace(|;|varchar(|cast(|!|$|(|)|,|;|~|^|\"";
}
else if (type == 3) //Cookie提交
{
SqlStr = "script|iframe|xp_loginconfig|xp_fixeddrives|Xp_regremovemultistring|Xp_regread|Xp_regwrite|xp_cmdshell|xp_dirtree|exec|insert|select|delete|update|count(|asc(|chr(|substring(|mid(|master|truncate|char(|declare";
}
else //默认Post步骤提交
{
SqlStr = "script|iframe|xp_loginconfig|xp_fixeddrives|Xp_regremovemultistring|Xp_regread|Xp_regwrite|xp_cmdshell|xp_dirtree|exec|insert|select|delete|update|count(|asc(|chr(|substring(|mid(|master|truncate|char(|declare|replace(";
}
bool ReturnValue = true;
try
{
if (Str != "")
{
string[] anySqlStr = SqlStr.ToUpper().Split('|'); ;
foreach (string ss in anySqlStr)
{
if (Str.ToUpper().IndexOf(ss) >= 0)
{
ReturnValue = false;
}
}
}
}
catch
{
ReturnValue = false;
}
return ReturnValue;
}
}
#line default
#line hidden