From 1fa4467cd1a4cefb81e6e6a74da9a5333d91e345 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Fri, 29 May 2026 06:25:12 +0000
Subject: [PATCH] =?UTF-8?q?[security]=20=EC=A3=BC=EB=AC=B8=20=EA=B4=80?=
 =?UTF-8?q?=EB=A0=A8=20=ED=95=84=EB=93=9C=20=EC=B6=9C=EB=A0=A5=20=EC=8B=9C?=
 =?UTF-8?q?=20get=5Ftext=20=EC=9D=B8=EC=BD=94=EB=94=A9=20=EC=A0=81?=
 =?UTF-8?q?=EC=9A=A9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

영카트 주문자명/받는분/입금자명(od_name, od_b_name, od_deposit_name)
이 일부 출력 지점에서 인코딩 없이 노출되어, 저장된 값이 HTML/속성
컨텍스트에서 그대로 렌더링되던 문제 수정. 다음 출력에 get_text() 적용:

- adm/shop_admin/orderform.php, sale1today.php (관리자 주문 화면)
- shop/orderinquiryview.php (PC/모바일/테마 주문조회)
- shop/{inicis,kcp,lg,nicepay,toss}/taxsave_form.php (현금영수증 발행 폼)
- shop/mail/orderupdate{1,2,3}.mail.php, ordermail.mail.php (주문 메일)

비회원 주문 시 입력값이 관리자 화면에서 실행될 수 있는 경로를 차단.
폼 value 의 엔티티는 브라우저 제출 시 디코딩되므로 PG 전송값 및
정상 표시에는 영향 없음.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 adm/shop_admin/orderform.php          | 2 +-
 adm/shop_admin/sale1today.php         | 2 +-
 mobile/shop/orderinquiryview.php      | 2 +-
 shop/inicis/taxsave_form.php          | 2 +-
 shop/kcp/taxsave_form.php             | 4 ++--
 shop/lg/taxsave_form.php              | 2 +-
 shop/mail/ordermail.mail.php          | 2 +-
 shop/mail/orderupdate1.mail.php       | 6 +++---
 shop/mail/orderupdate2.mail.php       | 6 +++---
 shop/mail/orderupdate3.mail.php       | 4 ++--
 shop/nicepay/taxsave_form.php         | 2 +-
 shop/orderinquiryview.php             | 2 +-
 shop/toss/taxsave_form.php            | 2 +-
 theme/basic/shop/orderinquiryview.php | 2 +-
 14 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/adm/shop_admin/orderform.php b/adm/shop_admin/orderform.php
index 0af495290..6ceb5db12 100644
--- a/adm/shop_admin/orderform.php
+++ b/adm/shop_admin/orderform.php
@@ -382,7 +382,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
     <input type="hidden" name="sel_field" value="<?php echo $sel_field; ?>">
     <input type="hidden" name="search" value="<?php echo $search; ?>">
     <input type="hidden" name="page" value="<?php echo $page; ?>">
-    <input type="hidden" name="od_name" value="<?php echo $od['od_name']; ?>">
+    <input type="hidden" name="od_name" value="<?php echo get_text($od['od_name']); ?>">
     <input type="hidden" name="od_hp" value="<?php echo $od['od_hp']; ?>">
     <input type="hidden" name="od_tno" value="<?php echo $od['od_tno']; ?>">
     <input type="hidden" name="od_escrow" value="<?php echo $od['od_escrow']; ?>">
diff --git a/adm/shop_admin/sale1today.php b/adm/shop_admin/sale1today.php
index 47214ed75..f96b249aa 100644
--- a/adm/shop_admin/sale1today.php
+++ b/adm/shop_admin/sale1today.php
@@ -87,7 +87,7 @@ $result = sql_query($sql);
     ?>
         <tr>
             <td class="td_alignc"><a href="./orderform.php?od_id=<?php echo $row['od_id']; ?>"><?php echo $row['od_id']; ?></a></td>
-            <td class="td_name"><?php echo $href; ?><?php echo $row['od_name']; ?></a></td>
+            <td class="td_name"><?php echo $href; ?><?php echo get_text($row['od_name']); ?></a></td>
             <td class="td_numsum"><?php echo number_format($row['orderprice']); ?></td>
             <td class="td_numincome"><?php echo number_format($row['couponprice']); ?></td>
             <td class="td_numincome"><?php echo number_format($receipt_bank); ?></td>
diff --git a/mobile/shop/orderinquiryview.php b/mobile/shop/orderinquiryview.php
index 185ad2534..f040e5cd3 100644
--- a/mobile/shop/orderinquiryview.php
+++ b/mobile/shop/orderinquiryview.php
@@ -666,7 +666,7 @@ if($od['od_pg'] == 'lg') {
         </tr>
         <tr>
             <th scope="col"><label for="req_name">입금자명</label></th>
-            <td><input type="text" name="req_name" value="<?php echo $od['od_deposit_name']; ?>"></td>
+            <td><input type="text" name="req_name" value="<?php echo get_text($od['od_deposit_name']); ?>"></td>
         </tr>
         <tr>
             <th scope="col"><label for="noti_url">입금통보 URL</label></th>
diff --git a/shop/inicis/taxsave_form.php b/shop/inicis/taxsave_form.php
index fd9d66a65..af3cd9e1a 100644
--- a/shop/inicis/taxsave_form.php
+++ b/shop/inicis/taxsave_form.php
@@ -102,7 +102,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
             </tr>
             <tr>
                 <th scope="row">주문자 이름</th>
-                <td><?php echo $od_name; ?></td>
+                <td><?php echo get_text($od_name); ?></td>
             </tr>
             <tr>
                 <th scope="row">주문자 E-Mail</th>
diff --git a/shop/kcp/taxsave_form.php b/shop/kcp/taxsave_form.php
index 9f782a91e..13895b565 100644
--- a/shop/kcp/taxsave_form.php
+++ b/shop/kcp/taxsave_form.php
@@ -137,7 +137,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
             </tr>
             <tr>
                 <th scope="row">주문자 이름</th>
-                <td><?php echo $od_name; ?></td>
+                <td><?php echo get_text($od_name); ?></td>
             </tr>
             <tr>
                 <th scope="row">주문자 E-Mail</th>
@@ -160,7 +160,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
         <input type="hidden" name="corp_type" value="0"> <!-- 사업자 구분 - 0:직접판매 , 1:입점몰판매 -->
         <input type="hidden" name="ordr_idxx">
         <input type="hidden" name="good_name" value="<?php echo addslashes($goods_name); ?>">
-        <input type="hidden" name="buyr_name" value="<?php echo $od_name; ?>">
+        <input type="hidden" name="buyr_name" value="<?php echo get_text($od_name); ?>">
         <input type="hidden" name="buyr_mail" value="<?php echo $od_email; ?>">
         <input type="hidden" name="buyr_tel1" value="<?php echo $od_tel; ?>">
         <input type="hidden" name="trad_time" value="<?php echo $trad_time; ?>">
diff --git a/shop/lg/taxsave_form.php b/shop/lg/taxsave_form.php
index 621ab0513..77c00091f 100644
--- a/shop/lg/taxsave_form.php
+++ b/shop/lg/taxsave_form.php
@@ -102,7 +102,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
             </tr>
             <tr>
                 <th scope="row">주문자 이름</th>
-                <td><?php echo $od_name; ?></td>
+                <td><?php echo get_text($od_name); ?></td>
             </tr>
             <tr>
                 <th scope="row">주문자 E-Mail</th>
diff --git a/shop/mail/ordermail.mail.php b/shop/mail/ordermail.mail.php
index 06bc1d756..ae3647e6f 100644
--- a/shop/mail/ordermail.mail.php
+++ b/shop/mail/ordermail.mail.php
@@ -87,7 +87,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
         </tr>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">입금자명</th>
-            <td style="<?php echo $td_st; ?>"><?php echo $bank_list['od_deposit_name']; ?></td>
+            <td style="<?php echo $td_st; ?>"><?php echo get_text($bank_list['od_deposit_name']); ?></td>
         </tr>
         </tbody>
         </table>
diff --git a/shop/mail/orderupdate1.mail.php b/shop/mail/orderupdate1.mail.php
index 4bc8772c2..6cb5dfd2a 100644
--- a/shop/mail/orderupdate1.mail.php
+++ b/shop/mail/orderupdate1.mail.php
@@ -115,7 +115,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
         </tr>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">입금자 이름</th>
-            <td style="<?php echo $td_st; ?>"><?php echo $od_deposit_name; ?></td>
+            <td style="<?php echo $td_st; ?>"><?php echo get_text($od_deposit_name); ?></td>
         </tr>
         <?php } ?>
 
@@ -136,7 +136,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
         <tbody>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">이름</th>
-            <td style="<?php echo $td_st; ?>"><?php echo $od_name; ?></td>
+            <td style="<?php echo $td_st; ?>"><?php echo get_text($od_name); ?></td>
         </tr>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
@@ -169,7 +169,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
         <tbody>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">이 름</th>
-            <td style="<?php echo $td_st; ?>"><?php echo $od_b_name; ?></td>
+            <td style="<?php echo $td_st; ?>"><?php echo get_text($od_b_name); ?></td>
         </tr>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
diff --git a/shop/mail/orderupdate2.mail.php b/shop/mail/orderupdate2.mail.php
index 02f4b839d..2a8fdb3dd 100644
--- a/shop/mail/orderupdate2.mail.php
+++ b/shop/mail/orderupdate2.mail.php
@@ -115,7 +115,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
         </tr>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">입금자 이름</th>
-            <td style="<?php echo $td_st; ?>"><?php echo $od_deposit_name; ?></td>
+            <td style="<?php echo $td_st; ?>"><?php echo get_text($od_deposit_name); ?></td>
         </tr>
         <?php } ?>
 
@@ -136,7 +136,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
         <tbody>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">이름</th>
-            <td style="<?php echo $td_st; ?>"><?php echo $od_name; ?></td>
+            <td style="<?php echo $td_st; ?>"><?php echo get_text($od_name); ?></td>
         </tr>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
@@ -169,7 +169,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
         <tbody>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">이 름</th>
-            <td style="<?php echo $td_st; ?>"><?php echo $od_b_name; ?></td>
+            <td style="<?php echo $td_st; ?>"><?php echo get_text($od_b_name); ?></td>
         </tr>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
diff --git a/shop/mail/orderupdate3.mail.php b/shop/mail/orderupdate3.mail.php
index 9a500f932..61077459e 100644
--- a/shop/mail/orderupdate3.mail.php
+++ b/shop/mail/orderupdate3.mail.php
@@ -59,7 +59,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
         <tbody>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">이름</th>
-            <td style="<?php echo $td_st; ?>"><?php echo $od_name; ?></td>
+            <td style="<?php echo $td_st; ?>"><?php echo get_text($od_name); ?></td>
         </tr>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
@@ -93,7 +93,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
         <tbody>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">이 름</th>
-            <td style="<?php echo $td_st; ?>"><?php echo $od_b_name; ?></td>
+            <td style="<?php echo $td_st; ?>"><?php echo get_text($od_b_name); ?></td>
         </tr>
         <tr>
             <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
diff --git a/shop/nicepay/taxsave_form.php b/shop/nicepay/taxsave_form.php
index 78b6c1ced..fa6e249be 100644
--- a/shop/nicepay/taxsave_form.php
+++ b/shop/nicepay/taxsave_form.php
@@ -102,7 +102,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
             </tr>
             <tr>
                 <th scope="row">주문자 이름</th>
-                <td><?php echo $od_name; ?></td>
+                <td><?php echo get_text($od_name); ?></td>
             </tr>
             <tr>
                 <th scope="row">주문자 E-Mail</th>
diff --git a/shop/orderinquiryview.php b/shop/orderinquiryview.php
index 29275a7f2..ad4fc510b 100644
--- a/shop/orderinquiryview.php
+++ b/shop/orderinquiryview.php
@@ -726,7 +726,7 @@ if($od['od_pg'] == 'lg') {
         </tr>
         <tr>
             <th scope="col"><label for="req_name">입금자명</label></th>
-            <td><input type="text" name="req_name" value="<?php echo $od['od_deposit_name']; ?>"></td>
+            <td><input type="text" name="req_name" value="<?php echo get_text($od['od_deposit_name']); ?>"></td>
         </tr>
         <tr>
             <th scope="col"><label for="noti_url">입금통보 URL</label></th>
diff --git a/shop/toss/taxsave_form.php b/shop/toss/taxsave_form.php
index b20f10b2f..7584f3faf 100644
--- a/shop/toss/taxsave_form.php
+++ b/shop/toss/taxsave_form.php
@@ -102,7 +102,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
             </tr>
             <tr>
                 <th scope="row">주문자 이름</th>
-                <td><?php echo $od_name; ?></td>
+                <td><?php echo get_text($od_name); ?></td>
             </tr>
             <tr>
                 <th scope="row">주문자 E-Mail</th>
diff --git a/theme/basic/shop/orderinquiryview.php b/theme/basic/shop/orderinquiryview.php
index 28a871885..223a42ff6 100644
--- a/theme/basic/shop/orderinquiryview.php
+++ b/theme/basic/shop/orderinquiryview.php
@@ -656,7 +656,7 @@ if($od['od_pg'] == 'lg') {
         </tr>
         <tr>
             <th scope="col"><label for="req_name">입금자명</label></th>
-            <td><input type="text" name="req_name" value="<?php echo $od['od_deposit_name']; ?>"></td>
+            <td><input type="text" name="req_name" value="<?php echo get_text($od['od_deposit_name']); ?>"></td>
         </tr>
         <tr>
             <th scope="col"><label for="noti_url">입금통보 URL</label></th>