微擎1.5.4任意用戶刪除漏洞涉及文件display.ctrl.php
web/source/founder/display.ctrl.php
修復(fù)方案
查找到以下代碼:
$founders = explode(',', $_W['config']['setting']['founder']); 14行下面加一行
在這個14行代碼下面 增加如下代碼:
$identity = uni_permission($_W['uid']); if ($identity != ACCOUNT_MANAGE_NAME_FOUNDER && $identity != ACCOUNT_MANAGE_NAME_VICE_FOUNDER) { itoast('非法訪問!', referer(), 'error'); }