1

DSWeb/Areas/Account/Controllers/Chfee_bankdataController.cs

@@ -325,6 +325,13 @@ namespace DSWeb.Areas.Account.Controllers
                 jsonRespose.Message = "上传文件发生未知错误，请重新上传";
                 return new ContentResult() { Content = JsonConvert.Serialize(jsonRespose) };
             }
+            String fileExt = Path.GetExtension(file.FileName).ToLower();
+            if (fileExt == ".asp" || fileExt == ".aspx")
+            {
+                jsonRespose.Success = false;
+                jsonRespose.Message = "不允许上传ASP或ASPX文件";
+                return new ContentResult() { Content = JsonConvert.Serialize(jsonRespose) };
+            }
 
             var path = Server.MapPath("../../UploadFiles/ImpBsExcel");
 

DSWeb/Areas/Account/Controllers/Chfee_payapplicationController.cs

@@ -1524,6 +1524,14 @@ namespace DSWeb.Areas.Account.Controllers
                 }
                 string fileOriginalName = Path.GetFileNameWithoutExtension(imgFile.FileName);
                 String fileExt = Path.GetExtension(imgFile.FileName).ToLower();
+
+                if (fileExt == ".asp" || fileExt == ".aspx")
+                {
+                    jsonRespose.Success = false;
+                    jsonRespose.Message = "不允许上传ASP或ASPX文件";
+                    return new ContentResult() { Content = JsonConvert.Serialize(jsonRespose) };
+                }
+
                 String newFileName = DateTime.Now.ToString("yyyyMMddHHmmss_ffff", DateTimeFormatInfo.InvariantInfo) + idx.ToString() + fileExt;
                 String filePath = dirPath + newFileName;
                 imgFile.SaveAs(filePath);

DSWeb/Areas/Import/Controllers/ImportTradeController.cs

@@ -931,7 +931,13 @@ namespace DSWeb.Areas.Import.Controllers
                 jsonRespose.Message = "上传文件发生未知错误，请重新上传";
                 return new ContentResult() { Content = JsonConvert.Serialize(jsonRespose) };
             }
-
+            String fileExt = Path.GetExtension(file.FileName).ToLower();
+            if (fileExt == ".asp" || fileExt == ".aspx")
+            {
+                jsonRespose.Success = false;
+                jsonRespose.Message = "不允许上传ASP或ASPX文件";
+                return new ContentResult() { Content = JsonConvert.Serialize(jsonRespose) };
+            }
             var path = "";
             var FTPPATH = "";
             var COMPANYID = Convert.ToString(Session["COMPANYID"]);

DSWeb/Areas/MvcContainer/Controllers/MsOpCtnBsCardController.cs

@@ -1014,6 +1014,14 @@ namespace DSWeb.MvcContainer.Controllers
                 return new ContentResult() { Content = JsonConvert.Serialize(jsonRespose) };
             }
 
+            String fileExt = Path.GetExtension(file.FileName).ToLower();
+            if (fileExt == ".asp" || fileExt == ".aspx")
+            {
+                jsonRespose.Success = false;
+                jsonRespose.Message = "不允许上传ASP或ASPX文件";
+                return new ContentResult() { Content = JsonConvert.Serialize(jsonRespose) };
+            }
+
             var path = Server.MapPath("../../UploadFiles/MsOpFiles/" + BSNO);
 
             if (!Directory.Exists(path))

DSWeb/Areas/MvcShipping/Controllers/MsOpReceiptController.cs

@@ -449,7 +449,13 @@ namespace DSWeb.MvcShipping.Controllers
                         jsonRespose.Message = "上传文件发生未知错误，请重新上传";
                         return new ContentResult() { Content = JsonConvert.Serialize(jsonRespose) };
                     }
-
+                    String fileExt = Path.GetExtension(file.FileName).ToLower();
+                    if (fileExt == ".asp" || fileExt == ".aspx")
+                    {
+                        jsonRespose.Success = false;
+                        jsonRespose.Message = "不允许上传ASP或ASPX文件";
+                        return new ContentResult() { Content = JsonConvert.Serialize(jsonRespose) };
+                    }
                     var path = Server.MapPath("../../UploadFiles/MsOpFiles/" + CUSTNO);
 
                     if (!Directory.Exists(path))