From 3d2d3b99483e3f5a46a82a1dc86ea3c4b117b1ad Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 22 Aug 2017 16:46:36 +0900
Subject: [PATCH] =?UTF-8?q?=EC=98=A4=ED=94=88=20=EB=A6=AC=EB=8B=A4?=
 =?UTF-8?q?=EC=9D=B4=EB=A0=89=ED=8A=B8=20=EC=9C=A0=EC=A0=80=20=ED=8C=A8?=
 =?UTF-8?q?=EC=8A=A4=EC=9B=8C=EB=93=9C=20Leak=20=EC=B7=A8=EC=95=BD?=
 =?UTF-8?q?=EC=A0=90=20=EC=88=98=EC=A0=95=20adm1nkyj@UpRoot=EB=8B=98?=
 =?UTF-8?q?=EC=9D=B4=20=EC=95=8C=EB=A0=A4=EC=A3=BC=EC=8B=AC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/common.lib.php | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/lib/common.lib.php b/lib/common.lib.php
index 2062c4d05..72801dc7f 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -2988,15 +2988,32 @@ function check_url_host($url, $msg='', $return_url=G5_URL)
 
     $p = @parse_url($url);
     $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
+    $is_host_check = false;
 
     if(stripos($url, 'http:') !== false) {
         if(!isset($p['scheme']) || !$p['scheme'] || !isset($p['host']) || !$p['host'])
             alert('url 정보가 올바르지 않습니다.', $return_url);
     }
 
-    if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host'])) {
+    //php 5.6.29 이하 버전에서는 parse_url 버그가 존재함
+    if ( (isset($p['host']) && $p['host']) && version_compare(PHP_VERSION, '5.6.29') < 0) {
+        $bool_ch = false;
+        foreach( array('user','host') as $key) {
+            if ( isset( $p[ $key ] ) && strpbrk( $p[ $key ], ':/?#@' ) ) {
+                $bool_ch = true;
+            }
+        }
+        if( $bool_ch ){
+            $regex = '/https?\:\/\/'.$host.'/i';
+            if( ! preg_match($regex, $url) ){
+                $is_host_check = true;
+            }
+        }
+    }
+
+    if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host']) || $is_host_check) {
         //if ($p['host'].(isset($p['port']) ? ':'.$p['port'] : '') != $_SERVER['HTTP_HOST']) {
-        if ($p['host'] != $host) {
+        if ( ($p['host'] != $host) || $is_host_check ) {
             echo '<script>'.PHP_EOL;
             echo 'alert("url에 타 도메인을 지정할 수 없습니다.");'.PHP_EOL;
             echo 'document.location.href = "'.$return_url.'";'.PHP_EOL;