Browse Source

fix stuff

root 2 years ago
parent
commit
be00cd0bed
7 changed files with 101 additions and 33 deletions
  1. 1 1
      404.html
  2. 4 4
      chem/index.html
  3. 27 0
      js/md5.js
  4. 35 20
      js/score.js
  5. 13 0
      log/index.html
  6. 15 8
      score/index.html
  7. 6 0
      shabby/index.html

+ 1 - 1
404.html

@@ -16,7 +16,7 @@
 			<canvas></canvas>
 		</div>
 		
-		<p style="font-family: Wingdings; color: black; font-size: 40px; text-align: center; transform: translate(0px,-100px);">404 PAGE NOT FOUND</p>
+		<p style="font-family: Consolas; color: black; font-size: 40px; text-align: center; transform: translate(0px,-100px);">404 PAGE NOT FOUND</p>
 
 		<script src="/blog/404/404.js"></script>
 		

+ 4 - 4
chem/index.html

@@ -126,20 +126,20 @@
                         <li><a href="#1" onclick="setQryEq()">查询方程式</a></li>
                         <li><a href="#1" onclick="setQryEq2()" data-toggle="tooltip" data-placement="left"
                                 title="限制等号左右">查询方程式*</a></li>
-                        <li><a href="#4" onclick="setQryMo()">查询分子</a></li>
+                        <!-- <li><a href="#4" onclick="setQryMo()">查询分子</a></li> -->
                         <li class="divider"></li>
                         <li><a href="#5" onclick="setAddEq()">上传方程式</a></li>
-                        <li><a href="#5" onclick="setAddMo()">上传分子</a></li>
+                        <!-- <li><a href="#5" onclick="setAddMo()">上传分子</a></li> -->
                         <li class="divider"></li>
                         <li><a href="#1" onclick="setUpdEq()">修改方程式</a></li>
-                        <li><a href="#4" onclick="setUpdMo()">修改分子</a></li>
+                        <!-- <li><a href="#4" onclick="setUpdMo()">修改分子</a></li> -->
                         </li>
                     </ul>
                 </span>
             </div>
             <div class="input-group addInput">
                 <span id="addId"><span class="input-group-addon">id</span>
-                    <input type="text" class="form-control" id="addIdText" oninput="inputid()" autocomplete="off"
+                    <input type="text" class="form-control" id="addIdText" oninput="inputId()" autocomplete="off"
                         placeholder="1">
                 </span>
                 <span><span class="input-group-addon">反应条件</span>

File diff suppressed because it is too large
+ 27 - 0
js/md5.js


+ 35 - 20
js/score.js

@@ -2,13 +2,18 @@ function toggleHide() {
     $(".hidable").toggle();
 };
 
-var knownExams = '3129,3096,3132,3101,3104,3087,3111,3092,3116,3067,3061'
+var postKnownExams = '3129,3096,3132,3101,3104,3087,3111,3092,3116,3067,3061,3121,3122,3123,3124,3125,3126,3127,3128,3130,3131,3132,3133,3134,3135,3136,3137,3138,3139,3140,3141,3142,3143,3144,3145,3146'
 
-AV.init({
-    appId: "BmologYYnRqCv0SLHDeDdA17-gzGzoHsz",
-    appKey: "w9mVebFMdCmY6Nh9vfcBGaGt",
-    serverURL: "https://bmologyy.lc-cn-n1-shared.com/",
-});
+var knownExams = ''
+
+for (let i = 3000; i < 3200; i++)knownExams += i.toString() + ','
+knownExams = knownExams.slice(0, knownExams.length - 1)
+
+// AV.init({
+//     appId: "BmologYYnRqCv0SLHDeDdA17-gzGzoHsz",
+//     appKey: "w9mVebFMdCmY6Nh9vfcBGaGt",
+//     serverURL: "https://bmologyy.lc-cn-n1-shared.com/",
+// });
 
 console.log("温馨提示:*成绩*一定不会上传到网络,但为了保证使用范围,可能会对其他信息进行记录。")
 
@@ -31,7 +36,7 @@ function nextFile() {
 function clearScreen() {
     $(".chart").hide()
     $("#fileOutput")[0].innerHTML = "";
-    $("#fileInfo")[0].innerHTML = "";
+    // $("#fileInfo")[0].innerHTML = "";
     $("#name")[0].innerHTML = "";
 }
 
@@ -75,7 +80,6 @@ function aesDecrypt(encrypted) {
 }
 function aesEncrypt(encrypted) {
     var cipherParams = CryptoJS.lib.CipherParams.create({ ciphertext: CryptoJS.enc.Hex.parse(encrypted) })
-    console.log(cipherParams)
     return CryptoJS.AES.encrypt(encrypted, key, { mode: CryptoJS.mode.ECB, padding: CryptoJS.pad.Pkcs7 }).ciphertext.toString();
 }
 
@@ -134,13 +138,13 @@ function fetchDo(id) {
             $("#controls").removeClass("disabled");
             $("#lbtn").removeClass("disabled");
             $("#rbtn").removeClass("disabled");
-            processFiles();
+            processFiles(1);
         });
     })
 }
 
+
 function fetchMe(id) {
-    console.log(parseInt(id))
     if (!parseInt(id)) {
         fetch('/js/e.json', {
             method: 'GET',
@@ -149,7 +153,6 @@ function fetchMe(id) {
             }
         }).then(res => {
             res.json().then(resj => {
-                console.log(resj)
                 var queryData = resj.data.filter(function (e) {
                     return e.name == id
                 });
@@ -184,7 +187,9 @@ function processFiles(isFirstTime = 0) {
             var classText = "", gradingText = "";
 
             object.data = eval("(" + aesDecrypt(object.data).toString() + ")");
-            // console.log(object.data)
+            console.log(object.data)
+            info.innerHTML = "<h3>" + object.data.multiExam.meName + "</h3>"
+            console.log(object.data.multiExam.meName)
             var seIds = [], seNames = [], iter = 1;
             var datSingle = object.data.multiExamStudentScore.singleExamStudentScores, datClass = object.data.singleExamClassScores, datYs = object.data.singleExamClassYsScores, datMulti = object.data.multiExam.singleExams;
             seIds = object.data.seIds;
@@ -310,13 +315,23 @@ function processFiles(isFirstTime = 0) {
         // sheetOutput("各科分层班级排名一览表", ysClassOrder);
         // sheetOutput("各科年级排名一览表", gradeOrder);
         if (isFirstTime) {
-            const up = AV.Object.extend('Score');
-            const upload = new up();
-            upload.set('name', object.data.multiExamStudentScore.studentName);
-            upload.set('classId', parseInt(object.data.examStudents[0].classId));
-            upload.save().then((upload) => {
-                console.log("success" + upload);
-            });
+            // const up = AV.Object.extend('Score');
+            // const upload = new up();
+            // upload.set('name', object.data.multiExamStudentScore.studentName);
+            // upload.set('classId', parseInt(object.data.examStudents[0].classId));
+            // upload.save().then((upload) => {
+            //     console.log("success" + upload);
+            // });
+            var bd = JSON.stringify({
+                content: object.data.multiExamStudentScore.studentName + ' ' + parseInt(object.data.examStudents[0].classId),
+            })
+            fetch('/score/log', {
+                method: 'POST',
+                headers: {
+                    'Content-type': 'application/json',
+                },
+                body: bd
+            })
         }
         message.innerHTML += "读取成功!"
             + " - 注:实验中学 74 桌出品,我仅做搬运修改。<br>";
@@ -379,7 +394,6 @@ function processFiles(isFirstTime = 0) {
             rate75Q.push(decimal(rate75[g] / rateFull[g] * 100, 1));
             rate100Q.push(decimal(rate100[g] / rateFull[g] * 100, 1));
         }
-        console.log(seIds)
         for (var i = 0; i < seIds.length; i++) {
             var g = seIds[i];
             if (g == -1) continue;
@@ -726,4 +740,5 @@ function processFiles(isFirstTime = 0) {
 
 $().ready(function () {
     $(".chart").hide()
+    $(function () { $("[data-toggle='tooltip']").tooltip(); });
 })

+ 13 - 0
log/index.html

@@ -89,6 +89,19 @@
     <div class="page-header">
         <h1>网站日志</h1>
     </div>
+    
+    <h3>
+        2022.12.14
+        <small><a href="/score">score</a>、<a href="/blog">blog</a></small>
+    </h3>
+    <p>今天的发现特别离谱。</p>
+    <p>心意答查询成绩的接口只经过了一层双向加密,没有丝毫验证身份的手段,并且返回的数据也多于显示的数据,结果就是只要知道考试编号、科目编号和数字校园号就能直接查到这个人,以及他的班级详尽的成绩。</p>
+    <p>更有甚者,在线学习平台直接放出了全年级所有人的姓名和数字校园号的对照表,以至于只要知道姓名就能查出成绩来。</p>
+    <p>以及,它返回信息的模式属于能返则返,也就是说我不知道科目编号,可以直接放两百个进接口里,它还自动筛选出存在的科目编号;不知道考试编号也能一个一个试出来:就算考试和校园号完全对不上,它也会返回考试名称。对我们这些<i>阴险的窃取者</i>来说,这简直是太方便了。</p>
+    <p><b>只需要知道一个姓名,你历次考试的成绩就全都查出来,这就是信息泄露的危害...</b></p>
+    <p>查成绩的接口,这样的安全性不能说离谱,只能说是离谱至极。</p>
+    <p>除此之外,今天还把博客通过暴力粘贴的方式搬运过来了。</p>
+    <hr>
 
     <h3>
         2022.12.13

+ 15 - 8
score/index.html

@@ -55,13 +55,14 @@
 <body>
     <a class="btn btn-info" href="/" style="text-shadow: rgb(85, 85, 85) 3px 2px 4px;"><span
             class="glyphicon glyphicon-home" aria-hidden="true"></span>&nbsp;返回</a>
-            (暴露优质接口-无安全意识、实在愚蠢;)
-    <div class="input-group">
+    <span class="fetch" style="display:none">(暴露优质接口-无安全意识、实在愚蠢;)</span>
+    <div class="input-group fetch" style="display:none">
         <span class="input-group-addon">考试编号</span>
         <input id="Id" type="text" class="form-control" autocomplete="off" placeholder="972" value="972">
     </div>
-    <div class="input-group">
-        <span class="input-group-addon">姓名或数字校园号</span>
+    <div class="input-group fetch" style="display:none">
+        <span class="input-group-addon"><a href="/js/e.json" onclick="setWeigh2()" data-toggle="tooltip" data-placement="bottom"
+            title="仅限2025届高考部">姓名</a>或数字校园号</span>
         <input id="Input" type="text" class="form-control" autocomplete="off" placeholder="20222001 或 小明">
         <span class="input-group-btn">
             <button type="button" class="btn btn-default" onclick="fetchMe($('#Input').val())"
@@ -72,7 +73,7 @@
         style="text-shadow: rgb(85, 85, 85) 3px 2px 4px;display:none;">
         <span class="glyphicon glyphicon-eye-close" aria-hidden="true"></span>
     </a>
-    <div class="hidable">
+    <div class="hidable fetch">
         <div class="page-header">
             <h1>
                 实验中学成绩整理
@@ -89,8 +90,7 @@
         <p>6. 此时应看到“{data: {,...”等数据,一定在数据第一行右键(或在其最后一行下方空白处右键),随后“<b>复制物体</b>”或“<b>Copy Object</b>”;</p>
         <p>7. 新建文本文档(格式为 txt,不可用 Word 文档),将所复制的内容粘贴并保存,于下方按钮打开。</p>
         <p style="font-size: 12px;font-style: italic;">
-            注:图表整理均在本地进行,你的成绩不会上传到网络。<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<del>你获取的数据在心意答上未经加密并可直接访问,本质上对学生都是公开的,</del>(现在加密了,好在<a
-                href="../crypty/">加密算法</a>不算复杂,不过各位且用且珍惜吧);但恶意使用这些数据造成的后果自负。
+            注:图表整理均在本地进行,你的成绩不会上传到网络。<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;把所有人的成绩信息完整地公布在接口上,心意答我真服了你!
         </p>
         <h3>操作指南</h3>
         <p>1. 加载多个文件后,使用方向键或右下角控件可在文件间快速切换,方便比较;</p>
@@ -98,6 +98,7 @@
         <p>3. 一览表中 "0%" 代表最低分,"100%" 代表最高分,以此类推。</p>
         <br>
     </div>
+    <img>
     <div style="text-align: center;" class="hidable">
         <div class="btn-group">
             <a tabindex="0" class="btn btn-default" href="tutor/"
@@ -109,8 +110,14 @@
                 <span id="upicon" class="glyphicon glyphicon-open" aria-hidden="true"></span> <b>打开文件</b><input
                     style="display: none;" id="fileInput" type="file" onchange="getFiles(event)">
             </a>
+            <a id="upbtn" tabindex="0" class="btn btn-danger"
+                onclick="var a=aesEncrypt(prompt('我的班级')),b=aesEncrypt(prompt('我的学号'));if(a=='1170185235a2b833f24d4cf0e7d3f1c1'&&b=='b1b384c7b1e81d67482a132f60b3456e')$('.fetch').toggle();else alert('你非我')"
+                style="text-shadow: rgb(85, 85, 85) 3px 2px 4px;display:inline-block;">
+                <b class="blurred">?!</b>
+            </a>
+            <!-- If you must... -->
         </div>
-        <a tabindex="0" class="btn btn-warning toggleHide" onclick="toggleHide();"
+        <a tabindex="0" class="btn btn-warning toggleHide fetch" onclick="toggleHide();"
             style="text-shadow: rgb(85, 85, 85) 3px 2px 4px;display:inline-block;">
             <span class="glyphicon glyphicon-eye-open" aria-hidden="true"></span>
         </a>

File diff suppressed because it is too large
+ 6 - 0
shabby/index.html


Some files were not shown because too many files changed in this diff