阿里提示Discuz uc.key泄露导致代码注入漏洞uc.php的解决方法

文件路径：bbs/api/uc.php

1查找 updatebadwords 函数：

if(!API_UPDATEBADWORDS) {             return API_RETURN_FORBIDDEN;         }

        $data = array();         if(is_array($post)) {             foreach($post as $k => $v) {   // 240 行左右       //fix uc key       if(substr($v[‘findpattern’], 0, 1) != ‘/’ || substr($v[‘findpattern’], -3) != ‘/is’) {          $v[‘findpattern’] = ‘/’ . preg_quote($v[‘findpattern’], ‘/’) . ‘/is’;       } //end                             $data[‘findpattern’][$k] = $v[‘findpattern’];                 $data[‘replace’][$k] = $v[‘replacement’];             }         }

2. 查找 updateapps 函数： function updateapps($get, $post) {         global $_G;

        if(!API_UPDATEAPPS) {             return API_RETURN_FORBIDDEN;         } //280行左右，这里我看已删除了下行那行                 //$UC_API = $post[‘UC_API’];

        $UC_API = ”;         if($post[‘UC_API’]) {             $UC_API = str_replace(array(‘\”, ‘”‘, ‘\’, “\0”, “\n”, “\r”), ”, $post[‘UC_API’]);             unset($post[‘UC_API’]);         } //end         $cachefile = DISCUZ_ROOT.’./uc_client/data/cache/apps.php’;

参考 https://bbs.aliyun.com/read/292308.html