Summary of fckeditor vulnerabilities

1. Construct the test.html upload page locally

FCKeditor-Connectors Tests function BuildBaseUrl (command) {var sUrl = document.getElementById ('cmbConnector'). Value +'? Command=' + command +'& Type=' + document.getElementById ('cmbType'). Value +' & CurrentFolder=' + encodeURIComponent (document.getElementById ('txtFolder'). Value); return sUrl;} function SetFrameUrl (url) {document.getElementById (' eRunningFrame'). Src = url; document.getElementById ('eUrl') [xss_clean] = url } function GetFolders () {SetFrameUrl (BuildBaseUrl ('GetFolders')); return false;} function GetFoldersAndFiles () {SetFrameUrl (BuildBaseUrl (' GetFoldersAndFiles')); return false;} function CreateFolder () {var sFolder = prompt ('Type the folder name:',' Test Folder'); if (! SFolder) return false; var sUrl = BuildBaseUrl ('CreateFolder'); sUrl + =' & NewFolderName=' + encodeURIComponent (sFolder); SetFrameUrl (sUrl); return false;} function OnUploadCompleted (errorNumber, fileName) {switch (errorNumber) {case 0: alert ('File uploaded with no errors'); break; case 201: GetFoldersAndFiles () Alert ('A file with the same name is already available. The uploaded file has been renamed to "+ fileName +'"); break; case 202: alert ('Invalid file'); break; default: alert (' Error on file upload. Error number:'+ errorNumber); break;} this.frames.frmUpload = this; function SetAction () {var sUrl = BuildBaseUrl ('FileUpload'); document.getElementById (' eUrl') [xss_clean] = sUrl; document.getElementById ('frmUpload'). Action = sUrl } Connector: ASP ASP.Net ColdFusion Lasso Perl PHP Python Current Folder Resource Type File Image Flash Media Invalid Type (for testing) Get Folders and Files URL:

Second, page summary

1. View the editor version

FCKeditor/_whatsnew.html

-

2. Version version 2.2

Add one after the uploaded file in Apache+linux environment. Break through! The test passed.

-

3.Version