dedecms aspcms_tempfun.php,ASPCMSSQL注入及修复(AspCms_ContentFun.asp)

'die debugmode

dim action : action=getForm("action","get")

dim ContentID, LanguageID, SortID, GroupID, Exclusive, Title, Title2, TitleColor, IsOutLink, OutLink, Author, ContentSource, ContentTag, Content, ContentStatus, IsTop, IsRecommend, IsImageNews, IsHeadline, IsFeatured, ContentOrder, IsGenerated, Visits, AddTime, ImagePath, IndexImage, DownURL, PageTitle, PageKeywords, PageDesc, PageFileName, spec, EditTime,DownGroupID,IsNoComment,Star,Timeing,TimeStatus,VideoGroupID,CHvalue,SpecCategory

'SpecCategory用于判断是哪个类型的自定义参数

dim sortType, keyword, page, psize, order, ordsc, sortTypeName

sortType=getForm("sortType","get")

if isnul(sortType) then sortType=0

sortid=getForm("sortid","post")

if isnul(sortid) then sortid=getForm("sortid","get")

keyword=getForm("keyword","post")

if isnul(keyword) then keyword=getForm("keyword","get")

page=getForm("page","get")

psize=getForm("psize","get")

order=getForm("order","get")

ordsc=getForm("ordsc","get")

DownGroupID=getForm("DownGroupID","post")

VideoGroupID=getForm("VideoGroupID","post")

select case sortType

case "2"

sortTypeName ="文章"

SpecCategory = "C"

case "3"

sortTypeName ="产品"

SpecCategory = "P"

case "4"

sortTypeName ="下载"

SpecCategory = "DL"

case "5"

sortTypeName ="招聘"

SpecCategory = "HR"

case "6"

sortTypeName ="相册"

SpecCategory = "FO"

case "8"

sortTypeName = "视频"

SpecCategory = "VI"

end select

'单篇1,文章2,产品3,下载4,招聘5,相册6,链接7，视频8

Select case action

case "add" : addContent

case "edit" : editContent

case "move" : moveContent

case "copy" : copyContent

case "rpost" : rpostContent

case "del" : delContent

case "recovery" : Recovery

case "tdel" : trueDelContent

case "on" : onOff "on", "Content", "ContentID", "ContentStatus", "", getPageName()&"?sortType="&sortType&"&sortid="&sortid&"&keyword="&keyword&"&page="&page&"&psize="&psize&"&order="&order&"&ordsc="&ordsc

case "off" : onOff "off", "Content", "ContentID", "ContentStatus", "", getPageName()&"?sortType="&sortType&"&sortid="&sortid&"&keyword="&keyword&"&page="&page&"&psize="&psize&"&order="&order&"&ordsc="&ordsc

case "order" : UpdateOrder

End Select