1.product viewpic XSS漏洞 原因： viewpic处未正确转义，形成漏洞，可以跨站脚本攻击 修复方法： 在core\shop\controller\ctl.product.php，找到function viewpic($goodsid, $selected=’def’)，在其下面一行添加 $goodsid = intval($goodsid); 保存，问题解决 2.绕过验证码问题 原因： shopex后台登录的验证码在第一次检验未通过后，并没有清除第一次存在session中验证码，所以可以通过特定的程序来暴力重试破解。 修复方法： 在core/admin/controller/ctl.passport.php中找到

1

$_SESSION``[``'loginmsg'``] = __(“验证码输入错误!”);

在下面添加

1

$_SESSION``[``'RANDOM_CODE'``] = ”;

保存，修复成功

1. product viewpic XSS vulnerability Cause: viewpic does not escape correctly, creating a vulnerability that allows cross-site scripting attacks. Fix: In core\shop\controller\ctl.product.php, find function viewpic($goodsid, $selected=’def’), and on the line below it add $goodsid = intval($goodsid); Save, and the problem is solved. 2. CAPTCHA bypass issue Cause: after the first verification of the CAPTCHA for the shopex admin login fails, the CAPTCHA stored in the session the first time is not cleared, so it can be brute-forced by retrying with a specific program. Fix: In core/admin/controller/ctl.passport.php find

1

$_SESSION``[``'loginmsg'``] = __(“验证码输入错误!”);

and add below it

1

$_SESSION``[``'RANDOM_CODE'``] = ”;

Save, and the fix is complete

本来是装了虚拟机vmware，但是很占内存，软件开多了不方便，而应用的centos软件又不想win系统的那样丰富。怎么办呢？度娘了，于是找到了解决方法 安装wine模拟win系统环境，相当与在centos上安装了一个插件 首先，安装一个第三方软件库，比较丰富的软件，差不多有2万多个 rpm -ivh http://mirrors.yun-idc.com/epel/6/i386/epel-release-6-8.noarch.rpm 因为软件库会更新版本，地址或者名字会有所变动，靠后面的小伙伴如果无法下载，自己在这个网址找找 接下来就是 yum install wine 如果这步报错的话 分别执行以下2个命令 yum clean all yum makecache 接下来重新 yum install wine 在应用程序中你就可以看到红酒杯的图标就是wine了 如果感觉版本地版本较低更改换新版本，那就卸载吧 rpm -qa |grep wine 来查看和wine有关的一般是10个，也有多的，全都删掉

I had originally installed the vmware virtual machine, but it eats up a lot of memory and gets inconvenient once you have several programs open, and the CentOS software available just isn’t as rich as on a win system. So what to do? I turned to Baidu, and found the solution: install wine to emulate a win system environment, roughly equivalent to installing a plugin on CentOS. First, install a third-party software repository with a fairly rich set of packages — 20,000 or so of them. rpm -ivh http://mirrors.yun-idc.com/epel/6/i386/epel-release-6-8.noarch.rpm Because the repository updates its versions, the address or name may change, so if you’re reading this later and can’t download it, go look for it yourself on that site. Next comes yum install wine If this step reports an error, run these 2 commands separately: yum clean all yum makecache Then run yum install wine again In your applications you’ll see a wineglass icon — that’s wine. If you feel the version is too old and want to switch to a newer one, then just uninstall it: rpm -qa |grep wine to check. There are usually 10 wine-related entries, sometimes more — delete them all.

wine配置有一段时间了，又发现有些比较有用的第三方扩展软件playonlinux 因为我装得是centos6.5库软件更新比较慢，这playonlinux单独编译太费劲了，就干脆用rpm吧 下载（注意版本会更新，下载不了上网站看看版本） rpm -ivh http://rpm.playonlinux.com/[playonlinux-yum-4-1.noarch.rpm](http://rpm.playonlinux.com/playonlinux-yum-4-1.noarch.rpm) 安装 yum install playonlinux 等待吧，差不多20多个软件 安装好后在应用程序》最后面那一项（游戏中看到playonlinu就是了） 这个是wine第三方应用，很有用，弥补wine的不足，可以安装好多软件

I had been configuring wine for a while, and then I discovered a rather useful third-party extension called playonlinux. Since I’m running CentOS 6.5, the repo software updates slowly, and compiling playonlinux on its own is too much of a hassle, so I just used the rpm. Download it (note that the version gets updated — if the download fails, check the website for the current version) rpm -ivh http://rpm.playonlinux.com/[playonlinux-yum-4-1.noarch.rpm](http://rpm.playonlinux.com/playonlinux-yum-4-1.noarch.rpm), then install with yum install playonlinux. Just wait — it’s about 20-odd packages. Once installed, it shows up under Applications » the last item (look for playonlinu in the Games section). This is a third-party wine application, very useful — it makes up for wine’s shortcomings and can install lots of software.

最近一直在弄网站优化这块，百度统计测试网站响应速度已100%跑满，只剩百度站长页面优化跑到92分卡住了。我对那些不愿意花时间来做优化的同行想说句“加油哦，我已经做到了”。大家遇到问题百度一下会发现好多贴吧或者博客说你没必要去管百度统计里面的优化，什么合并域名啊，合并js、css的都不行、没必要、影响不大。如果确实影响不大，百度难道自己有问题，故意个给你测评误导你。

I’ve been working on website optimization lately. The response speed test in Baidu Analytics is already fully maxed out at 100%, and only the Baidu Webmaster page optimization is stuck at 92 points. To the peers who aren’t willing to spend time on optimization, I’d like to say, “Keep at it — I’ve already done it.” When you run into a problem and search Baidu, you’ll find plenty of forum posts or blogs saying you don’t need to bother with the optimizations in Baidu Analytics — that merging domains, merging js and css, none of it works, isn’t necessary, barely makes a difference. If it really barely made a difference, does Baidu itself have a problem, deliberately evaluating you wrong to mislead you?

最近发现老版本的ChromeGAE不能翻墙了，很郁闷，谷歌站长又不能用了。 无奈百度了一下，找到最新的翻墙软件，感觉还可以吧。在这分享一下。 效果还是不错的 O(∩∩)O哈哈~ [](http://img03.taobaocdn.com/imgextra/i3/809419769/TB2sOtWaVXXXXbmXXXXXXXXXXXX_!!809419769.jpg) 下载地址：http://pan.baidu.com/s/1hqy1KaS

recently I found that the older version of ChromeGAE could no longer get past the firewall, which was pretty frustrating, and the Google webmaster tools stopped working too. With no other option I searched on Baidu and found the latest circumvention software, and it seems decent. Sharing it here. The results are actually pretty good O(∩∩)O haha~ [](http://img03.taobaocdn.com/imgextra/i3/809419769/TB2sOtWaVXXXXbmXXXXXXXXXXXX_!!809419769.jpg) Download link: http://pan.baidu.com/s/1hqy1KaS

很给力，哈哈。终于不用再操心了。。！

Pretty impressive, haha. Finally, nothing more to worry about..!

群里有网友说不知道phpstudy怎配置多站点，其实这个不难，我当初配置的不是集成环境，集成环境和不是集成环境都一样的配置 首先我们要找到apache配置文件 E:\phpStudy\Apache\conf\httpd.conf 然后打开文件查找httpd-vhosts.conf 于是我们查找到

Someone in the group said they didn’t know how to configure multiple sites with phpstudy. Actually this isn’t hard — the setup I did back then wasn’t an integrated environment, and the configuration is the same for integrated and non-integrated environments alike. First we need to find the Apache configuration file E:\phpStudy\Apache\conf\httpd.conf, then open the file and search for httpd-vhosts.conf. So we find