Dedecms Dream soft_add.php File burst template SQL Injection Vulnerability Repair scheme

Aliyun always reported dedecms soft_add.php files exist SQL injection vulnerabilities, not repair feel annoyed, so try to repair, here to fix the loophole, hope to help the students also have this confusion!

involving files and their paths

File: soft_add.php

File path:/member/soft_add.php

Repair method

Find the following sentence: (line 154th)

The code is as follows	Copy Code
$urls. = "{dede:link islocal= ' 1′text= ' {$servermsg 1} '} $softurl 1 {/dede:link}\r\n"; Replace with: if (Preg_match ("#}" (. *?) {/dede:link} {dede: #sim ", $servermsg 1)!= 1) {$urls. =" {dede:link islocal= ' 1′text= ' {$servermsg 1} '} $softurl 1 {/dede:link}\r\n ";}

Saving again detects that the vulnerability has been fixed. Please note back up the file, make comments in the modified place