gper/Gnuboard5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[security] 주문 관련 필드 출력 시 get_text 인코딩 적용

Browse Source 
영카트 주문자명/받는분/입금자명(od_name, od_b_name, od_deposit_name)
이 일부 출력 지점에서 인코딩 없이 노출되어, 저장된 값이 HTML/속성
컨텍스트에서 그대로 렌더링되던 문제 수정. 다음 출력에 get_text() 적용:

- adm/shop_admin/orderform.php, sale1today.php (관리자 주문 화면)
- shop/orderinquiryview.php (PC/모바일/테마 주문조회)
- shop/{inicis,kcp,lg,nicepay,toss}/taxsave_form.php (현금영수증 발행 폼)
- shop/mail/orderupdate{1,2,3}.mail.php, ordermail.mail.php (주문 메일)

비회원 주문 시 입력값이 관리자 화면에서 실행될 수 있는 경로를 차단.
폼 value 의 엔티티는 브라우저 제출 시 디코딩되므로 PG 전송값 및
정상 표시에는 영향 없음.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thisgun
2026-05-29 06:25:12 +00:00
co-authored by Claude Opus 4.8
parent 3e75ccea65
commit 1fa4467cd1
14 changed files with 20 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
adm/shop_admin/orderform.php
+1 -1
View File
@@ -382,7 +382,7 @@ add_javascript(G5_POSTCODE_JS, 0); //다음 주소 js
<input type="hidden" name="sel_field" value="<?php echo $sel_field; ?>"> <input type="hidden" name="sel_field" value="<?php echo $sel_field; ?>">
<input type="hidden" name="search" value="<?php echo $search; ?>"> <input type="hidden" name="search" value="<?php echo $search; ?>">
<input type="hidden" name="page" value="<?php echo $page; ?>"> <input type="hidden" name="page" value="<?php echo $page; ?>">
<input type="hidden" name="od_name" value="<?php echo $od['od_name']; ?>"> <input type="hidden" name="od_name" value="<?php echo get_text($od['od_name']); ?>">
<input type="hidden" name="od_hp" value="<?php echo $od['od_hp']; ?>"> <input type="hidden" name="od_hp" value="<?php echo $od['od_hp']; ?>">
<input type="hidden" name="od_tno" value="<?php echo $od['od_tno']; ?>"> <input type="hidden" name="od_tno" value="<?php echo $od['od_tno']; ?>">
<input type="hidden" name="od_escrow" value="<?php echo $od['od_escrow']; ?>"> <input type="hidden" name="od_escrow" value="<?php echo $od['od_escrow']; ?>">
adm/shop_admin/sale1today.php
+1 -1
View File
@@ -87,7 +87,7 @@ $result = sql_query($sql);
?> ?>
<tr> <tr>
<td class="td_alignc"><a href="./orderform.php?od_id=<?php echo $row['od_id']; ?>"><?php echo $row['od_id']; ?></a></td> <td class="td_alignc"><a href="./orderform.php?od_id=<?php echo $row['od_id']; ?>"><?php echo $row['od_id']; ?></a></td>
<td class="td_name"><?php echo $href; ?><?php echo $row['od_name']; ?></a></td> <td class="td_name"><?php echo $href; ?><?php echo get_text($row['od_name']); ?></a></td>
<td class="td_numsum"><?php echo number_format($row['orderprice']); ?></td> <td class="td_numsum"><?php echo number_format($row['orderprice']); ?></td>
<td class="td_numincome"><?php echo number_format($row['couponprice']); ?></td> <td class="td_numincome"><?php echo number_format($row['couponprice']); ?></td>
<td class="td_numincome"><?php echo number_format($receipt_bank); ?></td> <td class="td_numincome"><?php echo number_format($receipt_bank); ?></td>
mobile/shop/orderinquiryview.php
+1 -1
View File
@@ -666,7 +666,7 @@ if($od['od_pg'] == 'lg') {
</tr> </tr>
<tr> <tr>
<th scope="col"><label for="req_name">입금자명</label></th> <th scope="col"><label for="req_name">입금자명</label></th>
<td><input type="text" name="req_name" value="<?php echo $od['od_deposit_name']; ?>"></td> <td><input type="text" name="req_name" value="<?php echo get_text($od['od_deposit_name']); ?>"></td>
</tr> </tr>
<tr> <tr>
<th scope="col"><label for="noti_url">입금통보 URL</label></th> <th scope="col"><label for="noti_url">입금통보 URL</label></th>
shop/inicis/taxsave_form.php
+1 -1
View File
@@ -102,7 +102,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
</tr> </tr>
<tr> <tr>
<th scope="row">주문자 이름</th> <th scope="row">주문자 이름</th>
<td><?php echo $od_name; ?></td> <td><?php echo get_text($od_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row">주문자 E-Mail</th> <th scope="row">주문자 E-Mail</th>
shop/kcp/taxsave_form.php
+2 -2
View File
@@ -137,7 +137,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
</tr> </tr>
<tr> <tr>
<th scope="row">주문자 이름</th> <th scope="row">주문자 이름</th>
<td><?php echo $od_name; ?></td> <td><?php echo get_text($od_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row">주문자 E-Mail</th> <th scope="row">주문자 E-Mail</th>
@@ -160,7 +160,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
<input type="hidden" name="corp_type" value="0"> <!-- 사업자 구분 - 0:직접판매 , 1:입점몰판매 --> <input type="hidden" name="corp_type" value="0"> <!-- 사업자 구분 - 0:직접판매 , 1:입점몰판매 -->
<input type="hidden" name="ordr_idxx"> <input type="hidden" name="ordr_idxx">
<input type="hidden" name="good_name" value="<?php echo addslashes($goods_name); ?>"> <input type="hidden" name="good_name" value="<?php echo addslashes($goods_name); ?>">
<input type="hidden" name="buyr_name" value="<?php echo $od_name; ?>"> <input type="hidden" name="buyr_name" value="<?php echo get_text($od_name); ?>">
<input type="hidden" name="buyr_mail" value="<?php echo $od_email; ?>"> <input type="hidden" name="buyr_mail" value="<?php echo $od_email; ?>">
<input type="hidden" name="buyr_tel1" value="<?php echo $od_tel; ?>"> <input type="hidden" name="buyr_tel1" value="<?php echo $od_tel; ?>">
<input type="hidden" name="trad_time" value="<?php echo $trad_time; ?>"> <input type="hidden" name="trad_time" value="<?php echo $trad_time; ?>">
shop/lg/taxsave_form.php
+1 -1
View File
@@ -102,7 +102,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
</tr> </tr>
<tr> <tr>
<th scope="row">주문자 이름</th> <th scope="row">주문자 이름</th>
<td><?php echo $od_name; ?></td> <td><?php echo get_text($od_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row">주문자 E-Mail</th> <th scope="row">주문자 E-Mail</th>
shop/mail/ordermail.mail.php
+1 -1
View File
@@ -87,7 +87,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
</tr> </tr>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">입금자명</th> <th scope="row" style="<?php echo $th_st; ?>">입금자명</th>
<td style="<?php echo $td_st; ?>"><?php echo $bank_list['od_deposit_name']; ?></td> <td style="<?php echo $td_st; ?>"><?php echo get_text($bank_list['od_deposit_name']); ?></td>
</tr> </tr>
</tbody> </tbody>
</table> </table>
shop/mail/orderupdate1.mail.php
+3 -3
View File
@@ -115,7 +115,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
</tr> </tr>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">입금자 이름</th> <th scope="row" style="<?php echo $th_st; ?>">입금자 이름</th>
<td style="<?php echo $td_st; ?>"><?php echo $od_deposit_name; ?></td> <td style="<?php echo $td_st; ?>"><?php echo get_text($od_deposit_name); ?></td>
</tr> </tr>
<?php } ?> <?php } ?>
@@ -136,7 +136,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
<tbody> <tbody>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">이름</th> <th scope="row" style="<?php echo $th_st; ?>">이름</th>
<td style="<?php echo $td_st; ?>"><?php echo $od_name; ?></td> <td style="<?php echo $td_st; ?>"><?php echo get_text($od_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">전화번호</th> <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
@@ -169,7 +169,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
<tbody> <tbody>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">이 름</th> <th scope="row" style="<?php echo $th_st; ?>">이 름</th>
<td style="<?php echo $td_st; ?>"><?php echo $od_b_name; ?></td> <td style="<?php echo $td_st; ?>"><?php echo get_text($od_b_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">전화번호</th> <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
shop/mail/orderupdate2.mail.php
+3 -3
View File
@@ -115,7 +115,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
</tr> </tr>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">입금자 이름</th> <th scope="row" style="<?php echo $th_st; ?>">입금자 이름</th>
<td style="<?php echo $td_st; ?>"><?php echo $od_deposit_name; ?></td> <td style="<?php echo $td_st; ?>"><?php echo get_text($od_deposit_name); ?></td>
</tr> </tr>
<?php } ?> <?php } ?>
@@ -136,7 +136,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
<tbody> <tbody>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">이름</th> <th scope="row" style="<?php echo $th_st; ?>">이름</th>
<td style="<?php echo $td_st; ?>"><?php echo $od_name; ?></td> <td style="<?php echo $td_st; ?>"><?php echo get_text($od_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">전화번호</th> <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
@@ -169,7 +169,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
<tbody> <tbody>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">이 름</th> <th scope="row" style="<?php echo $th_st; ?>">이 름</th>
<td style="<?php echo $td_st; ?>"><?php echo $od_b_name; ?></td> <td style="<?php echo $td_st; ?>"><?php echo get_text($od_b_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">전화번호</th> <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
shop/mail/orderupdate3.mail.php
+2 -2
View File
@@ -59,7 +59,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
<tbody> <tbody>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">이름</th> <th scope="row" style="<?php echo $th_st; ?>">이름</th>
<td style="<?php echo $td_st; ?>"><?php echo $od_name; ?></td> <td style="<?php echo $td_st; ?>"><?php echo get_text($od_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">전화번호</th> <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
@@ -93,7 +93,7 @@ $ft_a_st = 'display:block;padding:30px 0;background:#484848;color:#fff;text-alig
<tbody> <tbody>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">이 름</th> <th scope="row" style="<?php echo $th_st; ?>">이 름</th>
<td style="<?php echo $td_st; ?>"><?php echo $od_b_name; ?></td> <td style="<?php echo $td_st; ?>"><?php echo get_text($od_b_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row" style="<?php echo $th_st; ?>">전화번호</th> <th scope="row" style="<?php echo $th_st; ?>">전화번호</th>
shop/nicepay/taxsave_form.php
+1 -1
View File
@@ -102,7 +102,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
</tr> </tr>
<tr> <tr>
<th scope="row">주문자 이름</th> <th scope="row">주문자 이름</th>
<td><?php echo $od_name; ?></td> <td><?php echo get_text($od_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row">주문자 E-Mail</th> <th scope="row">주문자 E-Mail</th>
shop/orderinquiryview.php
+1 -1
View File
@@ -726,7 +726,7 @@ if($od['od_pg'] == 'lg') {
</tr> </tr>
<tr> <tr>
<th scope="col"><label for="req_name">입금자명</label></th> <th scope="col"><label for="req_name">입금자명</label></th>
<td><input type="text" name="req_name" value="<?php echo $od['od_deposit_name']; ?>"></td> <td><input type="text" name="req_name" value="<?php echo get_text($od['od_deposit_name']); ?>"></td>
</tr> </tr>
<tr> <tr>
<th scope="col"><label for="noti_url">입금통보 URL</label></th> <th scope="col"><label for="noti_url">입금통보 URL</label></th>
shop/toss/taxsave_form.php
+1 -1
View File
@@ -102,7 +102,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
</tr> </tr>
<tr> <tr>
<th scope="row">주문자 이름</th> <th scope="row">주문자 이름</th>
<td><?php echo $od_name; ?></td> <td><?php echo get_text($od_name); ?></td>
</tr> </tr>
<tr> <tr>
<th scope="row">주문자 E-Mail</th> <th scope="row">주문자 E-Mail</th>
theme/basic/shop/orderinquiryview.php
+1 -1
View File
@@ -656,7 +656,7 @@ if($od['od_pg'] == 'lg') {
</tr> </tr>
<tr> <tr>
<th scope="col"><label for="req_name">입금자명</label></th> <th scope="col"><label for="req_name">입금자명</label></th>
<td><input type="text" name="req_name" value="<?php echo $od['od_deposit_name']; ?>"></td> <td><input type="text" name="req_name" value="<?php echo get_text($od['od_deposit_name']); ?>"></td>
</tr> </tr>
<tr> <tr>
<th scope="col"><label for="noti_url">입금통보 URL</label></th> <th scope="col"><label for="noti_url">입금통보 URL</label></th>