<!--#include file="../Include/conig.asp"-->
<!--#include file="Admin_check.asp"-->
<%
response.expires = 0 
response.expiresabsolute = now() - 1 
response.addHeader "pragma","no-cache" 
response.addHeader "cache-control","private" 
Response.cachecontrol = "no-cache"
if Instr(session("AdminPurview"),"|123,")=0 then 
  response.write ("<font color='red')>你不具有该管理模块的操作权限，请返回！</font>")
  response.end
end if
'========判断是否具有管理权限 
%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="images/Admin_css.css" type=text/css rel=stylesheet>
<title>SQL安全中心</title></head>
<body>
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#6298E1">
  <tr>
    <td height="24" nowrap="nowrap" background="images/th_bg.gif"><font color="ffffff"><b>SQL通用防注入系统</b></font></td>
  </tr>
  <tr>
    <td height="36" align="center" nowrap="nowrap"  bgcolor="#EBF2F9"><div align="center"><a href="?Action=config"><b>防注设置</b></a>&nbsp;|&nbsp;<a href="?"><b>查看信息</b></a></div></td>
  </tr>
</table>
<br/>
<script language="JavaScript">
<!--
function CheckAll(form)  {
  for (var i=0;i<form.elements.length;i++)    {
    var e = form.elements[i];
    if (e.name != 'chkall')       e.checked = form.chkall.checked; 
   }
  }
function Confirmer()
{
	if (confirm("请确定要删除吗？"))
	{
		return   true;
	}   
	else   
	{
		return   false;
	}
	
}
//-->
</script> 
<%					
URL						= Request.ServerVariables("URL")
Action					= Request("Action")
	Select Case Action
		Case "act"
			Call act()
		Case "lock"
			Call lockIP()
		Case "unlock"
			Call UnLockip()
		Case "config"
			Call config()
		Case "saveconfig"
			Call saveconfig()
		Case Else 
			Call Main()
	end Select
Sub Main()
%>

<table width="99%" border="0" cellpadding="0" cellspacing="0" >
<%

sql="select * from SqlIn order by id desc"
set rs=server.createobject("adodb.recordset")
rs.open sql,conn,1,1
if rs.eof and rs.bof then
	response.write "暂无内容"
else
'分页的实现 
listnum=20
Rs.pagesize=listnum
page=Request("page")
if (page-Rs.pagecount) > 0 then
	page=rs.pagecount
elseif page = "" or page < 1 then
	page = 1
end if
rs.absolutepage=page
'编号的实现
j=rs.recordcount
j=j-(page-1)*listnum
i=0
nn=request("page")
if nn="" then
	n=0
else
	nn=nn-1
n=listnum*nn
end If

Set rsinfo=conn.execute("select * from config")
Kill_IP		= rsinfo("Kill_IP")

%>
<tr align="center">
 <td width="5%" height=30>编号</td>
 <td width="10%" height="30"><font color=red>操作IP</font></td>
 <%
 If Kill_IP Then
 
 %>
 <td width="5%">是否锁定</td>
 <%
 End If %>
 <td>操作页面</td>
 <td width="5%">提交方式</td>
 <td width="10%">提交参数</td>
 <td>提交数据</td>
 <td width="10%">操作时间</td>
 
</tr>
<form action="<%=url%>?Action=act" method=post name=check>
<%do while not rs.eof and i<listnum
n=n+1%>
<tr align="center" >
	<td height="30" bgcolor="#EBF2F9"><input name="ID" type="checkbox" id="ID" value=<%=rs("id")%>></td>

	<td height="30" bgcolor="#EBF2F9" ><%=rs("SqlIn_IP")%></td>

 	 <%
 If Kill_IP Then
 
 %>
	<td height="30" bgcolor="#EBF2F9" >
	<%if rs("Kill_ip")=true then 
			response.write "<font color='red'>已锁定</font>"
		else
			response.write "<font color='green'>已解锁</font>"
		end if
	%></td>
		 <%
 End If %>
    <td height="30" bgcolor="#EBF2F9" ><%=rs("SqlIn_WEB")%></td>
	
	 <td height="30" bgcolor="#EBF2F9" ><%=rs("SqlIn_FS")%></td>
	 <td height="30" bgcolor="#EBF2F9" ><%=N_Replace(rs("SqlIn_CS"))%></td>
	 <td height="30" bgcolor="#EBF2F9" ><%=N_Replace(rs("SqlIn_SJ"))%></td>
	  <td height="30" bgcolor="#EBF2F9" ><%=rs("SqlIn_TIME")%></td>
</tr>
<%rs.movenext 
i=i+1 
j=j-1
loop%>
<%end if%>
</table>
	<table width="99%" border="0" cellpadding="0" cellspacing="0" background="images/th_bg.gif">
	<tr>
		<td height="30">
				  <input name="chkall" type="checkbox" id="chkall" value="select" onClick="CheckAll(this.form)" >全选
				  &nbsp;&nbsp;
				  <select name="act" class="textfield">
					<option value="del" selected>删除所选记录</option>
					<option value="lock">限制记录中IP访问</option>
					<option value="unlock">允许记录中IP访问</option>
		  </select>
				  &nbsp;&nbsp;
				  <input type=submit name=action value="操作" class="button" onClick="return confirm('确定要进行此操作么？')">	
	  </td>
			<td align=right><%=Rs.recordcount%> 条记录&nbsp;&nbsp;<%=listnum%> 条记录/页&nbsp;&nbsp;共 <%=rs.pagecount%> 页 
				  <% if page=1 then %>
				  <%else%>
				  <a href=<%=URL%>><strong>|<<</strong></a>
				  <a href=<%=URL%>?page=<%=page-1%>><strong><<</strong></a>
				  <a href=<%=URL%>?page=<%=page-1%>><b>[<%=page-1%>]</b></a>
				  <%end if%><% if rs.pagecount=1 then%><%else%><b>[<%=page%>]</b><%end if%>
				  <% if rs.pagecount-page <> 0 then %>
				  <a href=<%=URL%>?page=<%=page+1%>><b>[<%=page+1%>]</b></a>
				  <a href=<%=URL%>?page=<%=page+1%>><strong>>></strong></a>
				  <a href=<%=URL%>?page=<%=rs.pagecount%>><strong>>>|</strong></a>
				  <%end if%>		
		</td>
	</tr>
</table>
<%
end Sub

sub config()
	Set rsinfo=conn.execute("select * from config")
	N_In		= rsinfo("N_In")
	Kill_IP		= rsinfo("Kill_IP")			
	WriteSql	= rsinfo("WriteSql")		
	alert_url	= rsinfo("alert_url")
	alert_info	= rsinfo("alert_info")
	kill_info	= rsinfo("kill_info")
	N_type		= rsinfo("N_type")
	Sec_Forms	= rsinfo("Sec_Forms")
	Sec_Form_open = rsinfo("Sec_Form_open")
	rsinfo.close
	Set rsinfo=Nothing 

%>

<table width="98%" border="0" align="center" cellpadding="3" cellspacing="1" bgcolor="#EBF2F9" >
  <tr>
    <td><table width="100%" border="0" cellspacing="0" cellpadding="0">
	<form name="form" method="post" action="<%=url%>?action=saveconfig">
	<tr align="center" >
        <td height="30"  align="right">当前文件磁盘路径：</td>
        <td align="left">&nbsp; <input name="path" type="text" value="<%=server.mappath(".")&"\"%>" class="textfield" size="100"></td>
      </tr>
		<tr align="center" >
        <td height="30"  align="right">需要过滤的关键字：</td>
        <td align="left">&nbsp; <input name="N_In" type="text" value="<%=N_In%>" class="textfield" size="100">
        用&quot;|&quot;分开</td>
      </tr>
      <tr align="center" >
        <td height="30" align="right">是否记录入侵者信息：</td>
        <td align="left">&nbsp; <select name="WriteSql">
          <option value="1" <%if WriteSql=1 Then response.write "selected"%>>是</option>
          <option value="0" <%if WriteSql=0 Then response.write "selected"%>>否</option>
        </select></td>
      </tr>
      <tr align="center" >
        <td height="30" align="right">是否锁定IP：</td>
        <td align="left">&nbsp; <select name="Kill_IP">
          <option value="1" <%if Kill_IP=1 Then response.write "selected"%>>是</option>
          <option value="0" <%if Kill_IP=0 Then response.write "selected"%>>否</option>
        </select></td>
      </tr>
      <tr align="center" >
        <td height="30" align="right">是否启用安全表单：</td>
        <td align="left">&nbsp; <select name="Sec_Form_open">
          <option value="1" <%if Sec_Form_open=1 Then response.write "selected"%>>是</option>
          <option value="0" <%if Sec_Form_open=0 Then response.write "selected"%>>否</option>
        </select>
		慎用这个功能，除非你对确认此页面无需过滤，并确定对安全没影响！
		</td>
      </tr>
	  <tr align="center" >
        <td height="30" align="right">您认为安全的表单：</td>
        <td align="left">&nbsp; 
		<input name="Sec_Forms" type="text" class="textfield" style=" " value="<%=Sec_Forms%>" size="50">
        用&quot;|&quot;分开</td>
      </tr>
      <tr align="center" >
        <td height="30" align="right">出错后的处理方式：</td>
        <td align="left">&nbsp; 
		<select name="N_type" class="textfield">
          <option value="1" <%if N_type=1 Then response.write "selected"%>>直接关闭网页</option>
          <option value="2" <%if N_type=2 Then response.write "selected"%>>警告后关闭</option>
		  <option value="3" <%if N_type=3 Then response.write "selected"%>>跳转到指定页面</option>
		  <option value="4" <%if N_type=4 Then response.write "selected"%>>警告后跳转</option>
        </select></td>
      </tr>
	<tr align="center" >
        <td height="30" align="right">出错后跳转Url：</td>
        <td align="left">&nbsp; <input name="alert_url" type="text" class="textfield" value="<%=alert_url%>">
        注意，这里的都是半角符号，就是英文的！
		</td>
      </tr>
      <tr align="center" >
        <td align="right">警告提示信息：</td>
        <td align="left">&nbsp; <textarea name="alert_info" cols="45" rows="4" class="textfield"><%=alert_info%></textarea>\n\n换行
		</td>
      </tr>
	  <tr align="center" >
        <td align="right">阻止访问提示信息：</td>
        <td align="left">&nbsp; <textarea name="kill_info" cols="45" rows="4" class="textfield"><%=kill_info%></textarea>\n\n换行
		</td>
      </tr>
      <tr align="center" >
        <td height="35" colspan="2"><div align="center">
          <input name="enter_3" type="submit" id="enter_3" value="提交" class="button">
        </div></td>
        </tr>
	  </form>
    </table></td>
  </tr>
</table>
<%
end Sub
Sub act()
	dim id,act
	
	If request.form("id")<>"" Then
		
		id = replace(request.form("id"),"'","''")
		act = Trim(request.form("act"))
		If act="del" Then
			conn.execute("delete from SqlIn where id in ( " & id & ")")
		ElseIf act="lock" Then
			conn.execute("update SqlIn set Kill_ip=true where id in ( " & id & ")")
		ElseIf act="unlock" Then
			sql="update SqlIn set Kill_ip=false where id in ( " & id & ")"
			conn.execute(sql)
		End If
	End If 
	Response.Redirect URL
End sub
Sub saveconfig
	N_In		=replace(request.form("N_In"),"'","''")
	Kill_IP		=request.form("Kill_IP")			
	WriteSql	=request.form("WriteSql")		
	alert_url	=request.form("alert_url")
	alert_info	=request.form("alert_info")
	kill_info	=request.form("kill_info")
	N_type		=request.form("N_type")
	Sec_Forms	=request.form("Sec_Forms")
	Sec_Form_open=request.form("Sec_Form_open")

	sql="update config set N_In='"&N_In&"',Kill_IP="&Kill_IP&",WriteSql="&WriteSql&",alert_url='"&alert_url&"',alert_info='"&alert_info&"',kill_info='"&kill_info&"',N_type="&N_type&",Sec_Forms='"&Sec_Forms&"',Sec_Form_open="&Sec_Form_open&""
	'response.write sql
	conn.execute(sql)
	Application.Lock
	set Application("Neeao_config_info")=nothing
	Application.unlock
	Call main()
End Sub 

Function N_Replace(N_urlString)
	N_urlString = Replace(N_urlString,"'","''")
    N_urlString = Replace(N_urlString, ">", "&gt;")
    N_urlString = Replace(N_urlString, "<", "&lt;")
    N_Replace = N_urlString
End Function
%>
</BODY>
</HTML>