Modificare il file: \Galleria\download_script.asp

<%@Language="VBScript"%> <%Option Explicit%> <%Response.Buffer = True%> <% 'script from http://www.xefteri.com/articles/show.cfm?id=7 On Error Resume Next Dim strPath strPath = CStr(Request.QueryString("file")) '-- do some basic error checking for the QueryString '-- Fare un errore di fondo controllo per la querystring If strPath = "" Then Response.Clear Response.Write("File non specificato.") Response.End ElseIf InStr(strPath, "..") > 0 Then Response.Clear Response.Write("Percorso errato della cartella.") Response.End ElseIf Len(strPath) > 1024 Then Response.Clear Response.Write("Percorso cartella troppo a lungo.") Response.End '-- prohibit downloads based on extensions, add more as necessary; highly recommended to prohibit script downloads by direct URL input. '-- vietare download basati su estensioni, aggiungi più, se necessario; altamente raccomandato di vietare script download diretto URL input. ElseIf InStr(strPath, ".asp") > 0 Then Response.Clear Response.Write("Tipo di file illegale.") Response.End ElseIf InStr(strPath, ".php") > 0 Then Response.Clear Response.Write("Tipo di file illegale.") Response.End Else Call DownloadFile(strPath) End If Private Sub DownloadFile(file) '--declare variables Dim strAbsFile Dim strFileExtension Dim objFSO Dim objFile Dim objStream '-- set absolute file location strAbsFile = Server.MapPath(file) '-- create FSO object to check if file exists and get properties Set objFSO = Server.CreateObject("Scripting.FileSystemObject") '-- check to see if the file exists If objFSO.FileExists(strAbsFile) Then Set objFile = objFSO.GetFile(strAbsFile) '-- first clear the response, and then set the appropriate headers Response.Clear '-- the filename you give it will be the one that is shown ' to the users by default when they save Response.AddHeader "Content-Disposition", "attachment; filename=" & objFile.Name Response.AddHeader "Content-Length", objFile.Size Response.ContentType = "application/octet-stream" Set objStream = Server.CreateObject("ADODB.Stream") objStream.Open '-- set as binary objStream.Type = 1 Response.CharSet = "UTF-8" '-- load into the stream the file objStream.LoadFromFile(strAbsFile) '-- send the stream in the response Response.BinaryWrite(objStream.Read) objStream.Close Set objStream = Nothing Set objFile = Nothing Else 'objFSO.FileExists(strAbsFile) Response.Clear Response.Write("No such file exists.") End If Set objFSO = Nothing End Sub %>

[Íàçàä]