From 2894c269ea52ac97624a5cdbb1fa60d69931830d Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Thu, 16 Apr 2026 02:21:23 +0000
Subject: [PATCH] =?UTF-8?q?[security]=EC=9D=B4=EB=A9=94=EC=9D=BC=20?=
 =?UTF-8?q?=EC=9D=B8=EC=A6=9D=20=ED=8E=98=EC=9D=B4=EC=A7=80=20=EC=A0=91?=
 =?UTF-8?q?=EA=B7=BC=20=ED=86=A0=ED=81=B0=EC=9D=84=20HMAC-SHA256=EC=9C=BC?=
 =?UTF-8?q?=EB=A1=9C=20=EA=B0=95=ED=99=94?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 bbs/login_check.php    |  2 +-
 bbs/register_email.php |  4 ++--
 lib/common.lib.php     | 19 +++++++++++++++++++
 3 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/bbs/login_check.php b/bbs/login_check.php
index 6d15b1f5a..254771e14 100644
--- a/bbs/login_check.php
+++ b/bbs/login_check.php
@@ -54,7 +54,7 @@ if ($mb['mb_leave_date'] && $mb['mb_leave_date'] <= date("Ymd", G5_SERVER_TIME))
 
 // 메일인증 설정이 되어 있다면
 if ( is_use_email_certify() && !preg_match("/[1-9]/", $mb['mb_email_certify'])) {
-    $ckey = md5($mb['mb_ip'].$mb['mb_datetime']);
+    $ckey = function_exists('get_email_cert_key') ? get_email_cert_key($mb_id, $mb['mb_datetime']) : md5($mb['mb_ip'].$mb['mb_datetime']);
     confirm("{$mb['mb_email']} 메일로 메일인증을 받으셔야 로그인 가능합니다. 다른 메일주소로 변경하여 인증하시려면 취소를 클릭하시기 바랍니다.", G5_URL, G5_BBS_URL.'/register_email.php?mb_id='.$mb_id.'&ckey='.$ckey);
 }
 
diff --git a/bbs/register_email.php b/bbs/register_email.php
index 54ab2f6f7..1aa9d9c5c 100644
--- a/bbs/register_email.php
+++ b/bbs/register_email.php
@@ -18,9 +18,9 @@ if (substr($mb['mb_email_certify'],0,1)!=0) {
 }
 
 $ckey = isset($_GET['ckey']) ? trim($_GET['ckey']) : '';
-$key  = md5($mb['mb_ip'].$mb['mb_datetime']);
+$key  = function_exists('get_email_cert_key') ? get_email_cert_key($mb_id, $mb['mb_datetime']) : md5($mb['mb_ip'].$mb['mb_datetime']);
 
-if(!$ckey || $ckey != $key)
+if(!$ckey || $ckey !== $key)
     alert('올바른 방법으로 이용해 주십시오.', G5_URL);
 ?>
 
diff --git a/lib/common.lib.php b/lib/common.lib.php
index c709c794d..106873660 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -2467,6 +2467,25 @@ function check_token()
     return true;
 }
 
+/**
+ * 이메일 미인증 회원의 메일주소 변경 페이지 접근 토큰을 생성한다.
+ *
+ * HMAC-SHA256 + 서버 시크릿(G5_TOKEN_ENCRYPTION_KEY)
+ * @param string $mb_id
+ * @param string $mb_datetime
+ * @return string 64자 hex
+ */
+function get_email_cert_key($mb_id, $mb_datetime)
+{
+    $key = (defined('G5_TOKEN_ENCRYPTION_KEY') && G5_TOKEN_ENCRYPTION_KEY)
+         ? G5_TOKEN_ENCRYPTION_KEY
+         : (defined('G5_TABLE_PREFIX') ? G5_TABLE_PREFIX : '');
+
+    $payload = 'email_cert|' . $mb_id . '|' . $mb_datetime;
+
+    return hash_hmac('sha256', $payload, $key);
+}
+
 /**
  * CSRF 방지용 Origin/Referer 검증 (OWASP 권장 패턴).
  *