WooYun.org

第一处：\SysManage\Resource\resset\add.asp
	ID= Request.QueryString("ID")
	if ID=empty then
		Response.Write "未指定资源分类"
		Response.End()
	end if
	
	dim objData
	set objData = Server.CreateObject("wsmanage.template")
	strSql = "SQL:select FunctionName from webFunction where ID=" &ID
	strFunctionName = objData.GetOneData(strSql)
	set objData = nothing
第二处：\SysManage\Resource\resset\edit.asp
	ID= Request.QueryString("ID")
	resflagID = Request.QueryString("flagID")
'	Response.Write resflagID
	if ID=empty then
		Response.Write "未指定资源分类设置ID"
		Response.End()
	end if
	
	dim objData
	set objData = Server.CreateObject("wsmanage.template")
	
	dim regUser,sysUser
	strSql="SQL:select UN from resDownRight where UserType='reg' and resFlagID=" &resflagID
	regUser = objData.GetOneData(strSql)
	strSql="SQL:select UN from resDownRight where UserType='sys' and resFlagID=" &resflagID
	sysUser = objData.GetOneData(strSql)
	
	strSql = "SQL:select b.FunctionName, a.bNeedRight, a.AllowedFileType, a.AllowedFileSize, a.SavePath "
	strSql = strSql & " from resFlag a, webFunction b where b.ID=a.resFunID and a.ID="&ID
	
	set Rs = objData.GetRecordSet(strSql)
		
'	set objData = nothing
	
	if Rs.eof then
		Response.Write "该设置项已经被删除"
		Response.End()
	end if