Discuz!uc.key泄露导致代码注入漏洞uc.php的解决办法

解决办法：打开/api/uc.php修改以下3部分内容

1.第一处修改

$data = array();
if (is_array($post)) {
    foreach($post as $k = & gt; $v) {
        //dz uc-key修改开始
        if (substr($v['findpattern'], 0, 1) != '/' || substr($v['findpattern'], -3) != '/is') {
            $v['findpattern'] = '/'.preg_quote($v['findpattern'], '/').
            '/is';
        }
        //end 修改结束
        $data['findpattern'][$k] = $v['findpattern'];
        $data['replace'][$k] = $v['replacement'];
    }
}

2.第二处修改

if (!API_UPDATEAPPS) {
    return API_RETURN_FORBIDDEN;
}
// dz uc-key修改开始
$UC_API = '';
if ($post['UC_API']) {
    $UC_API = str_replace(array('\'', '"', '\\', "\0", "\n", "\r"), '', $post['UC_API']);
    unset($post['UC_API']);
}
// 修改结束
$cachefile = DISCUZ_ROOT.
'./uc_client/data/cache/apps.php';

3.第三处修改

$configfile = substr($configfile, -2) == '?>' ? substr($configfile, 0, -2) : $configfile;
// uc-key 修改开始
$configfile = preg_replace("/define\('UC_API',\s*'.*?'\);/i", "define('UC_API', '".addslashes($UC_API).
    "');", $configfile);
// end 修改结束
if ($fp = @fopen(DISCUZ_ROOT.
        './config/config_ucenter.php', 'w')) {
    @fwrite($fp, trim($configfile));
    @fclose($fp);
}

原文来自：https://mounui.com/38.html

本文地址：https://www.linuxprobe.com/discuzuc-key-php.html编辑：薛鹏旭，审核员：逄增宝

Linux命令大全：https://www.linuxcool.com/

Linux系统大全：https://www.linuxdown.com/

红帽认证RHCE考试心得：https://www.rhce.net/