萧岑博客似乎没有经过严格审查，存在用户信息严重泄露问题

“萧岑博客”插件把帖子变成博文受到部分站长喜爱，但其模板xcblog.htm  的  “var profile = {echo json_encode($profile);};”语句导致浏览器输出用户栏目完整资料，包括隐藏的、没有启用的和用户自己添加的栏目项和值。其演示站：http://www.zjtchy.com/plugin.php?id=xcblog&uid=1#/

1. <script>
   
2. // 全局参数
   
3. var setting = {"home_paper_num":10,"list_paper_num":20};
   
4. var profile = {"username":"admin","email":"js_mawentao@163.com","uid":"1","realname":"\u5f20\u4e09","gender":"0","birthyear":"0","birthmonth":"0","birthday":"0","constellation":"","zodiac":"","telephone":"","mobile":"13916266074","idcardtype":"\u8eab\u4efd\u8bc1","idcard":"","address":"asdasdas","zipcode":"","nationality":"","birthprovince":"","birthcity":"","birthdist":"","birthcommunity":"","resideprovince":"","residecity":"","residedist":"","residecommunity":"","residesuite":"","graduateschool":"","company":"","education":"","occupation":"","position":"","revenue":"","affectivestatus":"","lookingfor":"","bloodtype":"A","height":"","weight":"","alipay":"","icq":"","qq":"","yahoo":"","msn":"","taobao":"","site":"http:\/\/","bio":"","interest":"","field1":"","field2":"","field3":"","field4":"","field5":"","field6":"","field7":"","field8":"","avatar":"http:\/\/www.zjtchy.com\/uc_server\/avatar.php?uid=1&size=middle"};
   
5. var dz = {

复制代码

确实，不必要的信息可以不显示出来

这应用已经下架，作者在整改了

上线之前不审的么

h3cie 发表于 2018-2-5 16:38
上线之前不审的么

审核不是全能，遗漏总有的。谁能保证每天看上万行代码不出一点纰漏呢