FCKEditor editor Security Configuration

This is intended for hackers who use the editor's upload vulnerability to drive Trojans and programmers who have the Upload Vulnerability.

If your website uses the FckEditor editor and does not have the correct configuration yet, it is easy for others to upload webshells. Below I will share some tips when using Fckeditro.

Environment: vs2005

First, configure the Fckeditor editor in.

For more information about the files downloaded by Fckeditor, see:

Completely disable the fckEditor upload function (including preventing Type vulnerabilities)

In versions earlier than Fckeditor 2.6.3, see fckeditor "editor" filemanager "connectors" aspx "config. upload verification in the ascx file can be directly uploaded without secure authentication. You must manually set this for later versions.
Private bool CheckAuthentication ()
{
// WARNING: do not simply return "true". By doing so, you are allowing
// "Anyone" to upload and list the files in your server. You must implement
// Some kind of session validation here. Even something very simple...
//
// Return (Session ["IsAuthorized"]! = Null & (bool) Session ["IsAuthorized"] = true );
//
//... Where Session ["IsAuthorized"] is set to "true" as soon as
// User logs in your system.

Return false; <-- true
}
Copy code
Returns true.

However, this is not safe.

Refer to thoroughly disabling the fckEditor upload function (including preventing Type vulnerabilities)

Fckeditor can directly enter the vulnerability address in the address bar and upload files.

The solution is to add the Session flag of whether files can be uploaded during user logon. In fact, Fckeditor has been written. Directly add the comment section in the verification function CheckAuthentication ()
Return (Session ["IsAuthorized"]! = Null & (bool) Session ["IsAuthorized"] = true );

Comment out. After successful logon, you can add Session ["IsAuthorized"] = true.

If the website does not browse files uploaded to the server, delete the browser directory in fckeditor "editor" filemanager.