From 31871ee3e61c2f93fa134c0b9aba335f00e14d6a Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Fri, 29 May 2026 09:16:29 +0000
Subject: [PATCH] =?UTF-8?q?[security]=20=EC=A3=BC=EB=AC=B8=EC=9E=90=20?=
 =?UTF-8?q?=ED=9C=B4=EB=8C=80=ED=8F=B0=20=EC=B6=9C=EB=A0=A5=20=EC=9D=B8?=
 =?UTF-8?q?=EC=BD=94=EB=94=A9=20=EB=B0=8F=20=EB=A6=AC=EB=8B=A4=EC=9D=B4?=
 =?UTF-8?q?=EB=A0=89=ED=8A=B8=20URL=20=ED=98=B8=EC=8A=A4=ED=8A=B8=20?=
 =?UTF-8?q?=EA=B2=80=EC=A6=9D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- adm/shop_admin/orderform.php: 주문상세 hidden 의 od_hp 출력에
  get_text() 적용 (인접한 od_name 과 동일 처리, 누락분 보완)
- bbs/member_cert_refresh_update.php: 본인확인 갱신 후 이동 URL 에
  check_url_host() 적용
- plugin/social/includes/functions.php: 소셜 로그인/연동 후 이동
  URL 2곳에 동일하게 check_url_host() 적용

login_check.php 등 기존 코드와 동일한 호스트 검증 패턴으로,
같은 도메인/상대경로 복귀는 그대로 동작하고 타 도메인 이동만 차단.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 adm/shop_admin/orderform.php         | 2 +-
 bbs/member_cert_refresh_update.php   | 7 ++++++-
 plugin/social/includes/functions.php | 2 ++
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/adm/shop_admin/orderform.php b/adm/shop_admin/orderform.php
index 6ceb5db12..0b8a771f0 100644
--- a/adm/shop_admin/orderform.php
+++ b/adm/shop_admin/orderform.php
@@ -383,7 +383,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
     <input type="hidden" name="search" value="<?php echo $search; ?>">
     <input type="hidden" name="page" value="<?php echo $page; ?>">
     <input type="hidden" name="od_name" value="<?php echo get_text($od['od_name']); ?>">
-    <input type="hidden" name="od_hp" value="<?php echo $od['od_hp']; ?>">
+    <input type="hidden" name="od_hp" value="<?php echo get_text($od['od_hp']); ?>">
     <input type="hidden" name="od_tno" value="<?php echo $od['od_tno']; ?>">
     <input type="hidden" name="od_escrow" value="<?php echo $od['od_escrow']; ?>">
     <input type="hidden" name="od_pg" value="<?php echo $od['od_pg']; ?>">
diff --git a/bbs/member_cert_refresh_update.php b/bbs/member_cert_refresh_update.php
index 1d276b267..7dc023b3e 100644
--- a/bbs/member_cert_refresh_update.php
+++ b/bbs/member_cert_refresh_update.php
@@ -87,4 +87,9 @@ run_event('cert_refresh_update_after', $mb_id);
 
 //===============================================================
 
-(empty($url))? goto_url(G5_URL) : goto_url($url);
\ No newline at end of file
+if ($url) {
+    check_url_host($url, '', G5_URL, true);
+    goto_url($url);
+} else {
+    goto_url(G5_URL);
+}
\ No newline at end of file
diff --git a/plugin/social/includes/functions.php b/plugin/social/includes/functions.php
index 2234ca597..a4cd8ef2f 100644
--- a/plugin/social/includes/functions.php
+++ b/plugin/social/includes/functions.php
@@ -593,6 +593,7 @@ function social_check_login_before($p_service=''){
                             $params = array('provider'=>$provider_name);
 
                             $url = replaceQueryParams($url, $params);
+                            check_url_host($url, '', G5_URL, true);
                             goto_url($url);
                         } else {
                             goto_url(G5_URL);
@@ -772,6 +773,7 @@ function social_member_comfirm_redirect(){
             $params = array('provider'=>$provider_name);
 
             $url = replaceQueryParams($url, $params);
+            check_url_host($url, '', G5_URL, true);
             goto_url($url);
 
         }