Jump to content

huayan889

uniGUI Subscriber
  • Posts

    99
  • Joined

  • Last visited

Posts posted by huayan889

  1. 3 hours ago, azago said:

    Sorry but I only use only and always Delphi (for thirty years ...) and I don't know C ++

    anyway in Delphi

    First Page

    UniSession.AddJS (uHTMLPDF.JSName + '.iframe.contentWindow.document.'  + 'getElementById ("firstPage").click()');
     

    Last page

    UniSession.AddJS (uHTMLPDF.JSName + '.iframe.contentWindow.document.' + 'getElementById ("lastPage").click()');
     

    Next page

    UniSession.AddJS (uHTMLPDF.JSName + '.iframe.contentWindow.document.' + 'getElementById ("next").click()');
     

    Previous Page

    UniSession.AddJS (uHTMLPDF.JSName + '.iframe.contentWindow.document.' + 'getElementById ("previous").click()');


    i used unigui for a document solution

    image.thumb.png.f1f2600b9db1f848cb376e55f1c7b4b8.png

     

    Angelo
     

    how use code to print pdf ?

  2. 需然用AWS能扫出这漏洞,经验证后发现unigui本身就没实现HEAD、DELETEPUT、TRACE和OPTION这些功能,但默认返回200,安全工具根据返回状态判断命令执行成功。知道原因后解决起来很简单,当执行HEAD、DELETE、PUT、TRACE和OPTION等命令时直接返回405就可以。
    However, AWS can be used to scan this vulnerability. After verification, it is found that unigui does not implement the functions of head, delete put, trace and option, but it returns 200 by default. The security tool judges that the command is executed successfully according to the return status. It is very easy to solve the problem after knowing the cause. When executing the commands such as head, delete, put, trace and option, you can directly return 405.

  3. 使用HyperServer后同样会出现“做安全扫描时发现有“启用了不安全的 HTTP 方法”的问题,官方能否可以参考这个方法修复一下?
    After using hyperserver, there will also be the problem that "unsafe HTTP method is enabled" during security scanning. Can the official refer to this method to fix it?

    procedure TUniServerModule.UniGUIServerModuleHTTPCommand(
      ARequestInfo: TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo;
      var Handled: Boolean);
    begin
      if (ARequestInfo.CommandType =hcHEAD) or
       (ARequestInfo.CommandType =hcPUT) or
       (ARequestInfo.CommandType =hcTRACE) or
       (ARequestInfo.CommandType =hcOPTION) or
       (ARequestInfo.CommandType =hcDELETE) then
      begin
          Handled := false;
          AResponseInfo.ResponseNo:=405;
          AResponseInfo.CloseConnection:=true;
      end;
    end;

  4. 使用HyperServer后同样会出现“做安全扫描时发现有“启用了不安全的 HTTP 方法”的问题,官方能否可以参考这个方法修复一下?

    procedure TUniServerModule.UniGUIServerModuleHTTPCommand(
      ARequestInfo: TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo;
      var Handled: Boolean);
    begin
      if (ARequestInfo.CommandType =hcHEAD) or
       (ARequestInfo.CommandType =hcPUT) or
       (ARequestInfo.CommandType =hcTRACE) or
       (ARequestInfo.CommandType =hcOPTION) or
       (ARequestInfo.CommandType =hcDELETE) then
      begin
          Handled := false;
          AResponseInfo.ResponseNo:=405;
          AResponseInfo.CloseConnection:=true;
      end;
    end;
  5. 终于找到解决方法了,需然用AWS能扫出这漏洞,经验证后发现unigui本身就没实现HEAD、DELETEPUT、TRACE和OPTION这些功能,但默认返回200,安全工具根据返回状态判断命令执行成功。
    知道原因后解决起来很简单,当执行HEAD、DELETE、PUT、TRACE和OPTION等命令时直接返回405就可以。
    procedure TUniServerModule.UniGUIServerModuleHTTPCommand(
      ARequestInfo: TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo;
      var Handled: Boolean);
    begin
      if (ARequestInfo.CommandType =hcHEAD) or
       (ARequestInfo.CommandType =hcPUT) or
       (ARequestInfo.CommandType =hcTRACE) or
       (ARequestInfo.CommandType =hcOPTION) or
       (ARequestInfo.CommandType =hcDELETE) then
      begin
          Handled := false;
          AResponseInfo.ResponseNo:=405;
          AResponseInfo.CloseConnection:=true;
          AResponseInfo.CharSet := 'UTF-8';
          AResponseInfo.ContentType := 'Text';
          AResponseInfo.ContentText := '本软件不支持HEAD,DELETE,PUT,TRACE,OPTION等命令!';
      end;
    end;
  6. 使用1.90.0.1535编译的应用做安全扫描时发现有“启用了不安全的 HTTP 方法”,这个漏洞的影响是:可能会在 Web 服务器上上载、修改或删除 Web 页面、脚本和。如果使用 Tomcat修复很简单,直接修改 的 web.xml 就可以,但unigui不清楚怎样修复?

    <security-constraint>
     <web-resource-collection>
     <web-resource-name>fortune</web-resource-name>
     <url-pattern>/*</url-pattern>
     <http-method>PUT</http-method>
     <http-method>DELETE</http-method>
     <http-method>HEAD</http-method>
     <http-method>OPTIONS</http-method>
     <http-method>TRACE</http-method>
     </web-resource-collection>
     <auth-constraint></auth-constraint>
     </security-constraint>
     

    1.png

    2.png

    3.png

    4.png

    31.png

  7. procedure TMainmForm.UnimFormCreate(Sender: TObject);

    begin

     

      UnimVideo1.Urls.Clear;

      UnimVideo1.Url :='files/0622v2.mp4';

       UnimVideo1.Play;

    end;

     

     

     

    procedure TMainmForm.UnimVideo1Ended(Sender: TObject);

    begin

      UnimVideo1.Url := 'files/small.mp4';

      UnimVideo1.Play;

    end;

    //This is modified, but the play is still the last one,Player list cannot be changed

×
×
  • Create New...