LFI 취약점(16-679) 수정

mobile/shop/event.php

@@ -26,8 +26,10 @@ if ($sort != "")
 else
     $order_by = 'b.it_order, b.it_id desc';
 
-if ($skin)
+if ($skin) {
+    $skin = preg_replace('#\.+/#', '', $skin);
     $ev['ev_skin'] = $skin;
+}
 
 define('G5_SHOP_CSS_URL', G5_MSHOP_SKIN_URL);
 

mobile/shop/listtype.php

@@ -31,6 +31,8 @@ else
 
 if (!$skin)
     $skin = 'list.10.skin.php';
+else
+    $skin = preg_replace('#\.+/#', '', $skin);
 
 define('G5_SHOP_CSS_URL', G5_MSHOP_SKIN_URL);
 

shop/event.php

@@ -40,8 +40,10 @@ if ($sort != "")
 else
     $order_by = 'b.it_order, b.it_id desc';
 
-if ($skin)
+if ($skin) {
+    $skin = preg_replace('#\.+/#', '', $skin);
     $ev['ev_skin'] = $skin;
+}
 
 define('G5_SHOP_CSS_URL', G5_SHOP_SKIN_URL);
 

shop/listtype.php

@@ -35,6 +35,8 @@ else
 
 if (!$skin)
     $skin = 'list.10.skin.php';
+else
+    $skin = preg_replace('#\.+/#', '', $skin);
 
 define('G5_SHOP_CSS_URL', G5_SHOP_SKIN_URL);