diff --git a/adm/admin.lib.php b/adm/admin.lib.php index 5363b6d40..e0fd39dee 100644 --- a/adm/admin.lib.php +++ b/adm/admin.lib.php @@ -379,6 +379,47 @@ function get_sanitize_input($s, $is_html=false){ return $s; } +function check_log_folder($log_path){ + + if( is_writable($log_path) ){ + + // 아파치 서버인 경우 웹에서 해당 폴더 접근 막기 + $htaccess_file = $log_path.'/.htaccess'; + if ( !file_exists( $htaccess_file ) ) { + if ( $handle = @fopen( $htaccess_file, 'w' ) ) { + fwrite( $handle, 'Order deny,allow' . "\n" ); + fwrite( $handle, 'Deny from all' . "\n" ); + fclose( $handle ); + } + } + + // 아파치 서버인 경우 해당 디렉토리 파일 목록 안보이게 하기 + $index_file = $log_path . '/index.php'; + if ( !file_exists( $index_file ) ) { + if ( $handle = @fopen( $index_file, 'w' ) ) { + fwrite( $handle, '' ); + fclose( $handle ); + } + } + } + + // txt 파일과 log 파일을 조회하여 30일이 지난 파일은 삭제합니다. + $txt_files = glob($log_path.'/*.txt'); + $log_files = glob($log_path.'/*.log'); + + $del_files = array_merge($txt_files, $log_files); + + if( $del_files && is_array($del_files) ){ + foreach ($del_files as $del_file) { + $filetime = filemtime($del_file); + // 30일이 지난 파일을 삭제 + if($filetime && $filetime < (G5_SERVER_TIME - 2592000)) { + @unlink($del_file); + } + } + } +} + // POST로 넘어온 토큰과 세션에 저장된 토큰 비교 function check_admin_token() { @@ -435,7 +476,7 @@ function admin_check_xss_params($params){ if ( empty($value) ) continue; if( is_array($value) ){ - admin_check_xss_params($params); + admin_check_xss_params($value); } else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/onload=.*/ius', $value)) ){ alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.'); die(); diff --git a/adm/board_copy_update.php b/adm/board_copy_update.php index fede12b88..f94af52a8 100644 --- a/adm/board_copy_update.php +++ b/adm/board_copy_update.php @@ -38,43 +38,43 @@ $sql = " insert into {$g5['board_table']} bo_subject = '$target_subject', bo_device = '{$board['bo_device']}', bo_admin = '{$board['bo_admin']}', - bo_list_level = '{$board[bo_list_level]}', - bo_read_level = '{$board[bo_read_level]}', - bo_write_level = '{$board[bo_write_level]}', - bo_reply_level = '{$board[bo_reply_level]}', - bo_comment_level = '{$board[bo_comment_level]}', - bo_upload_level = '{$board[bo_upload_level]}', - bo_download_level = '{$board[bo_download_level]}', - bo_html_level = '{$board[bo_html_level]}', - bo_link_level = '{$board[bo_link_level]}', - bo_count_modify = '{$board[bo_count_modify]}', - bo_count_delete = '{$board[bo_count_delete]}', - bo_read_point = '{$board[bo_read_point]}', - bo_write_point = '{$board[bo_write_point]}', - bo_comment_point = '{$board[bo_comment_point]}', - bo_download_point = '{$board[bo_download_point]}', - bo_use_category = '{$board[bo_use_category]}', + bo_list_level = '{$board['bo_list_level']}', + bo_read_level = '{$board['bo_read_level']}', + bo_write_level = '{$board['bo_write_level']}', + bo_reply_level = '{$board['bo_reply_level']}', + bo_comment_level = '{$board['bo_comment_level']}', + bo_upload_level = '{$board['bo_upload_level']}', + bo_download_level = '{$board['bo_download_level']}', + bo_html_level = '{$board['bo_html_level']}', + bo_link_level = '{$board['bo_link_level']}', + bo_count_modify = '{$board['bo_count_modify']}', + bo_count_delete = '{$board['bo_count_delete']}', + bo_read_point = '{$board['bo_read_point']}', + bo_write_point = '{$board['bo_write_point']}', + bo_comment_point = '{$board['bo_comment_point']}', + bo_download_point = '{$board['bo_download_point']}', + bo_use_category = '{$board['bo_use_category']}', bo_category_list = '{$board['bo_category_list']}', - bo_use_sideview = '{$board[bo_use_sideview]}', - bo_use_file_content = '{$board[bo_use_file_content]}', - bo_use_secret = '{$board[bo_use_secret]}', - bo_use_dhtml_editor = '{$board[bo_use_dhtml_editor]}', - bo_use_rss_view = '{$board[bo_use_rss_view]}', - bo_use_good = '{$board[bo_use_good]}', - bo_use_nogood = '{$board[bo_use_nogood]}', - bo_use_name = '{$board[bo_use_name]}', - bo_use_signature = '{$board[bo_use_signature]}', - bo_use_ip_view = '{$board[bo_use_ip_view]}', + bo_use_sideview = '{$board['bo_use_sideview']}', + bo_use_file_content = '{$board['bo_use_file_content']}', + bo_use_secret = '{$board['bo_use_secret']}', + bo_use_dhtml_editor = '{$board['bo_use_dhtml_editor']}', + bo_use_rss_view = '{$board['bo_use_rss_view']}', + bo_use_good = '{$board['bo_use_good']}', + bo_use_nogood = '{$board['bo_use_nogood']}', + bo_use_name = '{$board['bo_use_name']}', + bo_use_signature = '{$board['bo_use_signature']}', + bo_use_ip_view = '{$board['bo_use_ip_view']}', bo_use_list_view = '{$board['bo_use_list_view']}', - bo_use_list_content = '{$board[bo_use_list_content]}', - bo_table_width = '{$board[bo_table_width]}', - bo_subject_len = '{$board[bo_subject_len]}', - bo_mobile_subject_len = '{$board[bo_mobile_subject_len]}', - bo_page_rows = '{$board[bo_page_rows]}', - bo_mobile_page_rows = '{$board[bo_mobile_page_rows]}', - bo_new = '{$board[bo_new]}', - bo_hot = '{$board[bo_hot]}', - bo_image_width = '{$board[bo_image_width]}', + bo_use_list_content = '{$board['bo_use_list_content']}', + bo_table_width = '{$board['bo_table_width']}', + bo_subject_len = '{$board['bo_subject_len']}', + bo_mobile_subject_len = '{$board['bo_mobile_subject_len']}', + bo_page_rows = '{$board['bo_page_rows']}', + bo_mobile_page_rows = '{$board['bo_mobile_page_rows']}', + bo_new = '{$board['bo_new']}', + bo_hot = '{$board['bo_hot']}', + bo_image_width = '{$board['bo_image_width']}', bo_skin = '{$board['bo_skin']}', bo_mobile_skin = '{$board['bo_mobile_skin']}', bo_include_head = '{$board['bo_include_head']}', @@ -84,20 +84,21 @@ $sql = " insert into {$g5['board_table']} bo_mobile_content_head = '".addslashes($board['bo_mobile_content_head'])."', bo_mobile_content_tail = '".addslashes($board['bo_mobile_content_tail'])."', bo_insert_content = '".addslashes($board['bo_insert_content'])."', - bo_gallery_cols = '{$board[bo_gallery_cols]}', - bo_gallery_width = '{$board[bo_gallery_width]}', - bo_gallery_height = '{$board[bo_gallery_height]}', - bo_mobile_gallery_width = '{$board[bo_mobile_gallery_width]}', - bo_mobile_gallery_height = '{$board[bo_mobile_gallery_height]}', - bo_upload_size = '{$board[bo_upload_size]}', - bo_reply_order = '{$board[bo_reply_order]}', - bo_use_search = '{$board[bo_use_search]}', - bo_order = '{$board[bo_order]}', + bo_gallery_cols = '{$board['bo_gallery_cols']}', + bo_gallery_width = '{$board['bo_gallery_width']}', + bo_gallery_height = '{$board['bo_gallery_height']}', + bo_mobile_gallery_width = '{$board['bo_mobile_gallery_width']}', + bo_mobile_gallery_height = '{$board['bo_mobile_gallery_height']}', + bo_upload_size = '{$board['bo_upload_size']}', + bo_reply_order = '{$board['bo_reply_order']}', + bo_use_search = '{$board['bo_use_search']}', + bo_order = '{$board['bo_order']}', bo_notice = '{$board['bo_notice']}', - bo_upload_count = '{$board[bo_upload_count]}', - bo_use_email = '{$board[bo_use_email]}', - bo_use_cert = '{$board[bo_use_cert]}', - bo_use_sns = '{$board[bo_use_sns]}', + bo_upload_count = '{$board['bo_upload_count']}', + bo_use_email = '{$board['bo_use_email']}', + bo_use_cert = '{$board['bo_use_cert']}', + bo_use_sns = '{$board['bo_use_sns']}', + bo_use_captcha = '{$board['bo_use_captcha']}', bo_sort_field = '{$board['bo_sort_field']}', bo_1_subj = '".addslashes($board['bo_1_subj'])."', bo_2_subj = '".addslashes($board['bo_2_subj'])."', diff --git a/adm/config_form.php b/adm/config_form.php index a2445f6da..848780e52 100644 --- a/adm/config_form.php +++ b/adm/config_form.php @@ -1458,16 +1458,29 @@ if($config['cf_cert_use']) { $log_path = G5_LGXPAY_PATH.'/lgdacom/log'; if(!is_dir($log_path)) { - echo ''.PHP_EOL; - } else { - if(!is_writable($log_path)) { + + if( is_writable(G5_LGXPAY_PATH.'/lgdacom/') ){ + // 디렉토리가 없다면 생성합니다. (퍼미션도 변경하구요.) + @mkdir($log_path, G5_DIR_PERMISSION); + @chmod($log_path, G5_DIR_PERMISSION); + } + + if(!is_dir($log_path)){ echo ''.PHP_EOL; } } + + if(is_dir($log_path) && is_writable($log_path)) { + if( function_exists('check_log_folder') ){ + check_log_folder($log_path); + } + } else if (is_dir($log_path)) { + echo ''.PHP_EOL; + } } } diff --git a/adm/sms_admin/emoticon_move_update.php b/adm/sms_admin/emoticon_move_update.php index aa1227f6a..8fe03b539 100644 --- a/adm/sms_admin/emoticon_move_update.php +++ b/adm/sms_admin/emoticon_move_update.php @@ -6,6 +6,8 @@ auth_check($auth[$sub_menu], "r"); if(!count($_POST['chk_fg_no'])) alert('이모티콘을 이동할 그룹을 한개 이상 선택해 주십시오.', $url); +$fo_no_list = preg_replace('/[^a-zA-Z0-9\, ]/', '', $fo_no_list); + $sql = "select * from {$g5['sms5_form_table']} where fo_no in ($fo_no_list) order by fo_no desc "; $result = sql_query($sql); $save = array(); diff --git a/adm/sms_admin/history_num.php b/adm/sms_admin/history_num.php index 530cfcdcd..f53dfb407 100644 --- a/adm/sms_admin/history_num.php +++ b/adm/sms_admin/history_num.php @@ -16,6 +16,10 @@ if ($st && trim($sv)) else $sql_search = ""; +if( isset($st) && !in_array($st, array('hs_name', 'hs_hp', 'bk_no')) ){ + $st = ''; +} + $total_res = sql_fetch("select count(*) as cnt from {$g5['sms5_history_table']} where 1 $sql_search"); $total_count = $total_res['cnt']; diff --git a/adm/sms_admin/history_view.php b/adm/sms_admin/history_view.php index 2fd9d1b0c..498d7fe03 100644 --- a/adm/sms_admin/history_view.php +++ b/adm/sms_admin/history_view.php @@ -8,6 +8,10 @@ $colspan = 10; $st = isset($st) ? strip_tags($st) : ''; $ssv = isset($ssv) ? strip_tags($ssv) : ''; +if( $st && !in_array($st, array('hs_name', 'hs_hp', 'bk_no')) ){ + $st = ''; +} + auth_check($auth[$sub_menu], "r"); $g5['title'] = "문자전송 상세내역"; diff --git a/adm/sms_admin/num_book_move.php b/adm/sms_admin/num_book_move.php index 0097f9150..f69248d89 100644 --- a/adm/sms_admin/num_book_move.php +++ b/adm/sms_admin/num_book_move.php @@ -31,8 +31,8 @@ for ($i=0; $row=sql_fetch_array($result); $i++)