阿里提示Discuz uc.key泄露导致代码注入漏洞的解决方法

本文

PS：已经过实际修改，不影响登录操作。如果修复后阿里云仍提示漏洞，忽略即可。

首先找到这个文件/api/uc.php

第一处修改

if(!API_UPDATEBADWordS) {return API_RETURN_FORBIDDEN;}$data = array();if(is_array($post)) {	foreach($post as $k => $v) {//dz uc-key修改开始		if(substr($v['findpattern'], 0, 1) != '/' || substr($v['findpattern'], -3) != '/is') {			$v['findpattern'] = '/' . PReg_quote($v['findpattern'], '/') . '/is';		}//end  修改结束          		$data['findpattern'][$k] = $v['findpattern'];		$data['replace'][$k] = $v['replacement'];	}}第二处修改
//$UC_API = $post['UC_API'];//dz uc-key修改开始		$UC_API = '';		if($post['UC_API']) {			$UC_API = str_replace(array('/'', '"', '//', "/0", "/n", "/r"), '', $post['UC_API']);			unset($post['UC_API']);		}//end修改结束		$cachefile = DISCUZ_ROOT.'./uc_client/data/cache/apps.php';第三处修改
//$configfile = preg_replace("/define/('UC_API',/s*'.*?'/);/i", "define('UC_API', '$UC_API');", $configfile);			//uc漏洞修复开始 by lijianjun 20170221			$configfile = preg_replace("/define/('UC_API',/s*'.*?'/);/i", "define('UC_API', '".addslashes($UC_API)."');", $configfile);			//uc漏洞修复结束 by lijianjun 20170221