From b34f577fbdb055934a7ddcad4f12312337e5e03f Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Wed, 27 Dec 2017 18:10:40 +0900
Subject: [PATCH 1/2] =?UTF-8?q?iframe=20=ED=97=88=EC=9A=A9=20=EB=AA=A9?=
 =?UTF-8?q?=EB=A1=9D=EC=9D=98=20=EC=9E=98=EB=AA=BB=EB=90=9C=20=EC=A0=95?=
 =?UTF-8?q?=EA=B7=9C=EC=8B=9D=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 plugin/htmlpurifier/extend.video.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugin/htmlpurifier/extend.video.php b/plugin/htmlpurifier/extend.video.php
index 8ba346a47..96cb5b846 100644
--- a/plugin/htmlpurifier/extend.video.php
+++ b/plugin/htmlpurifier/extend.video.php
@@ -22,8 +22,8 @@ if( !class_exists('HTMLPurifier_Filter_Iframevideo') ){
 		public function preFilter($html, $config, $context)
 		{
 			if (strstr($html, '<iframe')) {
-				$html = preg_replace_callback('/<iframe.*?src="https?:\/\/www\.youtube\.com\/embed\/([^"]*)[^>]*>(.*?)?\/iframe>/si', array($this, 'trust_url_match'), $html);
-				$html = preg_replace_callback('/<iframe.*?src="https?:\/\/player\.vimeo.com\/video\/([^"]*)[^>]*>(.*?)?\/iframe>/si', array($this, 'trust_url_match'), $html);
+				$html = preg_replace_callback('/<iframe.*?src="https?:\/\/www\.youtube\.com\/embed\/([^"]*)[^>]*>(.*?)?\/iframe>/i', array($this, 'trust_url_match'), $html);
+				$html = preg_replace_callback('/<iframe.*?src="https?:\/\/player\.vimeo.com\/video\/([^"]*)[^>]*>(.*?)?\/iframe>/i', array($this, 'trust_url_match'), $html);
 				//$html = preg_replace('#<iframe#i', '<img class="Iframevideo"', $html);
 				//$html = preg_replace('#</iframe>#i', '</img>', $html);
 			}

From fc976f2bedd6c7484844ab6de95236863b228496 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Fri, 5 Jan 2018 10:19:47 +0900
Subject: [PATCH 2/2] =?UTF-8?q?=EA=B4=80=EB=A6=AC=EC=9E=90=20=EC=84=A4?=
 =?UTF-8?q?=EB=AC=B8=EC=A1=B0=EC=82=AC=20=ED=8E=98=EC=9D=B4=EC=A7=80=20?=
 =?UTF-8?q?=ED=95=84=ED=84=B0=EA=B5=AC=EB=AC=B8=20=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/poll_form_update.php | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/adm/poll_form_update.php b/adm/poll_form_update.php
index a3cba14ad..2d01fe6dd 100644
--- a/adm/poll_form_update.php
+++ b/adm/poll_form_update.php
@@ -10,6 +10,40 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
+$check_keys = array(
+'po_subject',
+'po_poll1',
+'po_poll2',
+'po_poll3',
+'po_poll4',
+'po_poll5',
+'po_poll6',
+'po_poll7',
+'po_poll8',
+'po_poll9',
+'po_cnt1',
+'po_cnt2',
+'po_cnt3',
+'po_cnt4',
+'po_cnt5',
+'po_cnt6',
+'po_cnt7',
+'po_cnt8',
+'po_cnt9',
+'po_etc',
+'po_level',
+'po_point',
+'po_id'
+);
+
+foreach( $_POST as $key=>$value ){
+    if( empty($value) ) continue;
+
+    if( in_array($key, $check_keys) ) {
+        $_POST[$key] = strip_tags($value);
+    }
+}
+
 if ($w == '')
 {
     $sql = " insert {$g5['poll_table']}