From 0037f72cce7f3645731adda34595c38b973c3c72 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Thu, 16 Apr 2026 03:23:00 +0000
Subject: [PATCH] =?UTF-8?q?[security]KVE-2026-0678=20=EC=82=AC=EC=9A=A9?=
 =?UTF-8?q?=EC=9E=90=20=EC=98=81=EC=97=AD=20CSRF=20=EB=B0=A9=EC=96=B4=20?=
 =?UTF-8?q?=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 bbs/board_list_update.php |  2 ++
 bbs/memo_form_update.php  |  2 ++
 bbs/poll_etc_update.php   |  2 ++
 bbs/poll_update.php       |  2 ++
 lib/common.lib.php        | 41 +++++++++++++++++++++++++++++----------
 5 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/bbs/board_list_update.php b/bbs/board_list_update.php
index df04f7f37..77b0014d4 100644
--- a/bbs/board_list_update.php
+++ b/bbs/board_list_update.php
@@ -1,6 +1,8 @@
 <?php
 include_once('./_common.php');
 
+if (function_exists('check_request_origin')) check_request_origin(G5_BBS_URL);
+
 $count = (isset($_POST['chk_wr_id']) && is_array($_POST['chk_wr_id'])) ? count($_POST['chk_wr_id']) : 0;
 $post_btn_submit = isset($_POST['btn_submit']) ? clean_xss_tags($_POST['btn_submit'], 1, 1) : '';
 
diff --git a/bbs/memo_form_update.php b/bbs/memo_form_update.php
index a531c31df..6996be3fd 100644
--- a/bbs/memo_form_update.php
+++ b/bbs/memo_form_update.php
@@ -2,6 +2,8 @@
 include_once('./_common.php');
 include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 
+if (function_exists('check_request_origin')) check_request_origin(G5_BBS_URL);
+
 if ($is_guest)
     alert('회원만 이용하실 수 있습니다.');
 
diff --git a/bbs/poll_etc_update.php b/bbs/poll_etc_update.php
index dcda10a22..860887fdb 100644
--- a/bbs/poll_etc_update.php
+++ b/bbs/poll_etc_update.php
@@ -2,6 +2,8 @@
 include_once('./_common.php');
 include_once(G5_LIB_PATH.'/mailer.lib.php');
 
+if (function_exists('check_request_origin')) check_request_origin(G5_BBS_URL);
+
 if ($w == '')
 {
     $po_id   = isset($_POST['po_id']) ? (int) $_POST['po_id'] : '';
diff --git a/bbs/poll_update.php b/bbs/poll_update.php
index 66b2aee3f..0d7ebe39a 100644
--- a/bbs/poll_update.php
+++ b/bbs/poll_update.php
@@ -1,6 +1,8 @@
 <?php
 include_once('./_common.php');
 
+if (function_exists('check_request_origin')) check_request_origin(G5_BBS_URL);
+
 $po_id = isset($_POST['po_id']) ? preg_replace('/[^0-9]/', '', $_POST['po_id']) : 0;
 
 $po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '$po_id' ");
diff --git a/lib/common.lib.php b/lib/common.lib.php
index f7510a7af..9dfc98bb7 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -2515,19 +2515,27 @@ function _token()
 
 
 // 불법접근을 막도록 토큰을 생성하면서 토큰값을 리턴
+// HMAC 기반 stateless 방식 — 세션에 저장하지 않으므로 다중 탭 문제 없음
 function get_token()
 {
-    $token = md5(uniqid(rand(), true));
-    set_session('ss_token', $token);
+    $key = (defined('G5_TOKEN_ENCRYPTION_KEY') && G5_TOKEN_ENCRYPTION_KEY)
+         ? G5_TOKEN_ENCRYPTION_KEY
+         : (defined('G5_TABLE_PREFIX') ? G5_TABLE_PREFIX : '');
 
-    return $token;
+    return hash_hmac('sha256', session_id() . '|csrf_token', $key);
 }
 
 
-// POST로 넘어온 토큰과 세션에 저장된 토큰 비교
+// POST로 넘어온 토큰과 HMAC 토큰 비교
 function check_token()
 {
-    set_session('ss_token', '');
+    $token = isset($_POST['token']) ? $_POST['token'] : '';
+
+    if (!$token || $token !== get_token()) {
+        alert('올바른 방법으로 이용해 주십시오.');
+        return false;
+    }
+
     return true;
 }
 
@@ -2601,6 +2609,12 @@ function check_request_origin($redirect_url = '')
         return true;
     }
 
+    // GET 요청은 검증하지 않음 (CSRF는 상태 변경 요청에만 의미 있음)
+    $method = isset($_SERVER['REQUEST_METHOD']) ? $_SERVER['REQUEST_METHOD'] : '';
+    if ($method === 'GET' || $method === 'HEAD') {
+        return true;
+    }
+
     if (!$redirect_url) {
         $redirect_url = defined('G5_URL') ? G5_URL : '/';
     }
@@ -2619,13 +2633,20 @@ function check_request_origin($redirect_url = '')
         alert('올바른 경로로 접근해 주십시오.', $redirect_url);
     }
 
-    // 현재 서버 호스트 (포트 분리)
-    $server_host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
-    $colon = strpos($server_host, ':');
-    if ($colon !== false) {
-        $server_host = substr($server_host, 0, $colon);
+    // config.php의 G5_URL에서 호스트 추출 (HTTP_HOST보다 신뢰할 수 있음)
+    $server_host = defined('G5_URL') ? @parse_url(G5_URL, PHP_URL_HOST) : '';
+    if (!$server_host) {
+        $server_host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
+        $colon = strpos($server_host, ':');
+        if ($colon !== false) {
+            $server_host = substr($server_host, 0, $colon);
+        }
     }
 
+    // www. 접두사 제거하여 비교 (www.example.com == example.com)
+    $source_host = preg_replace('/^www\./i', '', $source_host);
+    $server_host = preg_replace('/^www\./i', '', $server_host);
+
     if (!$server_host || strcasecmp($source_host, $server_host) !== 0) {
         alert('올바른 경로로 접근해 주십시오.', $redirect_url);
     }