From c032ed6647404eed7e6ff622faafda0262e47cbe Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 26 Feb 2018 16:37:05 +0900 Subject: [PATCH 01/17] =?UTF-8?q?=EC=B2=A8=EB=B6=80=ED=8C=8C=EC=9D=BC?= =?UTF-8?q?=EB=AA=85=EC=9D=B4=20=EC=99=B8=EA=B5=AD=EC=96=B4=EC=9D=BC?= =?UTF-8?q?=EC=8B=9C=20=20=EB=8B=A4=EC=9A=B4=EB=A1=9C=EB=93=9C=20=EC=9D=B4?= =?UTF-8?q?=EC=8A=88=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/download.php | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/bbs/download.php b/bbs/download.php index 977f17674..ba4c8b0d7 100644 --- a/bbs/download.php +++ b/bbs/download.php @@ -76,8 +76,12 @@ if (!get_session($ss_name)) $g5['title'] = '다운로드 > '.conv_subject($write['wr_subject'], 255); -//$original = urlencode($file['bf_source']); -$original = iconv('utf-8', 'euc-kr', $file['bf_source']); // SIR 잉끼님 제안코드 +//파일명에 한글이 있는 경우 +if(preg_match("/[\xA1-\xFE][\xA1-\xFE]/", $file['bf_source'])){ + $original = iconv('utf-8', 'euc-kr', $file['bf_source']); // SIR 잉끼님 제안코드 +} else { + $original = urlencode($file['bf_source']); +} @include_once($board_skin_path.'/download.tail.skin.php'); @@ -86,6 +90,11 @@ if(preg_match("/msie/i", $_SERVER['HTTP_USER_AGENT']) && preg_match("/5\.5/", $_ header("content-length: ".filesize("$filepath")); header("content-disposition: attachment; filename=\"$original\""); header("content-transfer-encoding: binary"); +} else if (preg_match("/Firefox/i", $_SERVER['HTTP_USER_AGENT'])){ + header("content-type: file/unknown"); + header("content-length: ".filesize("$filepath")); + header("content-disposition: attachment; filename=\"".basename($file['bf_source'])."\""); + header("content-description: php generated data"); } else { header("content-type: file/unknown"); header("content-length: ".filesize("$filepath")); From a4c3a4b5e97f9d11a4d2bd7f3944b73a7cdc037e Mon Sep 17 00:00:00 2001 From: thisgun Date: Fri, 9 Mar 2018 10:56:30 +0900 Subject: [PATCH 02/17] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C=20UR?= =?UTF-8?q?L=20Redirect=20=EC=B7=A8=EC=95=BD=EC=A0=90(KVE-2017-1052)=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lib/common.lib.php | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/lib/common.lib.php b/lib/common.lib.php index 23f0db8ff..e1a65c8cd 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -3016,6 +3016,22 @@ function check_url_host($url, $msg='', $return_url=G5_URL) $p = @parse_url($url); $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']); $is_host_check = false; + + // url을 urlencode 를 2번이상하면 parse_url 에서 scheme와 host 값을 가져올수 없는 취약점이 존재함 + if ( !isset($p['host']) && urldecode($url) != $url ){ + $i = 0; + while($i <= 3){ + $url = urldecode($url); + if( urldecode($url) == $url ) break; + $i++; + } + + if( urldecode($url) == $url ){ + $p = @parse_url($url); + } else { + $is_host_check = true; + } + } if(stripos($url, 'http:') !== false) { if(!isset($p['scheme']) || !$p['scheme'] || !isset($p['host']) || !$p['host']) From 4aeae4915a548460c3b3c7ab6970384b0c7de7b2 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 12 Mar 2018 09:17:05 +0900 Subject: [PATCH 03/17] =?UTF-8?q?=EC=98=A4=ED=83=80=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/faqformupdate.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/adm/faqformupdate.php b/adm/faqformupdate.php index fa9562ce2..35b8dcb30 100644 --- a/adm/faqformupdate.php +++ b/adm/faqformupdate.php @@ -5,7 +5,7 @@ include_once('./_common.php'); if ($w == "u" || $w == "d") check_demo(); -if ($W == 'd') +if ($w == 'd') auth_check($auth[$sub_menu], "d"); else auth_check($auth[$sub_menu], "w"); From 81b39b59c39cf650d7315091425765c1aaceb518 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 12 Mar 2018 15:00:58 +0900 Subject: [PATCH 04/17] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C=20Re?= =?UTF-8?q?flected=20XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90(KVE-2018-0086)=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/sms_admin/num_book_move.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/adm/sms_admin/num_book_move.php b/adm/sms_admin/num_book_move.php index 1a68adece..9d660228a 100644 --- a/adm/sms_admin/num_book_move.php +++ b/adm/sms_admin/num_book_move.php @@ -33,7 +33,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) - +
From d7b5c9a4bda20d0f6af5a35d37fc8244c326f1ae Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 12 Mar 2018 18:14:19 +0900 Subject: [PATCH 05/17] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C,=20?= =?UTF-8?q?=EC=98=81=EC=B9=B4=ED=8A=B8=20=EB=8B=A4=EC=A4=91=20=EC=B7=A8?= =?UTF-8?q?=EC=95=BD=EC=A0=90=20(18-062,=20092,=20101,=20102)=20=EC=88=98?= =?UTF-8?q?=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/board_form_update.php | 12 ++++++------ adm/board_list_update.php | 33 +++++++++++++++++---------------- adm/qa_config_update.php | 12 ++++++------ adm/sms_admin/emoticon_move.php | 5 +++-- 4 files changed, 32 insertions(+), 30 deletions(-) diff --git a/adm/board_form_update.php b/adm/board_form_update.php index d2cb9e76e..71341fbbe 100644 --- a/adm/board_form_update.php +++ b/adm/board_form_update.php @@ -18,18 +18,18 @@ $_POST['bo_include_head'] = preg_replace("#[\\\]+$#", "", substr($_POST['bo_incl $_POST['bo_include_tail'] = preg_replace("#[\\\]+$#", "", substr($_POST['bo_include_tail'], 0, 255)); if ($file = $_POST['bo_include_head']) { - $purl = parse_url($file); - $file = $purl['path']; - if (!preg_match("/\.(php|htm['l']?)$/i", $file)) { + $file_ext = pathinfo($file, PATHINFO_EXTENSION); + + if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) ) { alert('상단 파일 경로의 확장자는 php, html 만 허용합니다.'); } $_POST['bo_include_head'] = $file; } if ($file = $_POST['bo_include_tail']) { - $purl = parse_url($file); - $file = $purl['path']; - if (!preg_match("/\.(php|htm['l']?)$/i", $file)) { + $file_ext = pathinfo($file, PATHINFO_EXTENSION); + + if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) ) { alert('하단 파일 경로의 확장자는 php, html 만 허용합니다.'); } $_POST['bo_include_tail'] = $file; diff --git a/adm/board_list_update.php b/adm/board_list_update.php index a26e521d6..90a1c5d33 100644 --- a/adm/board_list_update.php +++ b/adm/board_list_update.php @@ -8,6 +8,8 @@ if (!count($_POST['chk'])) { alert($_POST['act_button']." 하실 항목을 하나 이상 체크하세요."); } +check_admin_token(); + if ($_POST['act_button'] == "선택수정") { auth_check($auth[$sub_menu], 'w'); @@ -19,7 +21,7 @@ if ($_POST['act_button'] == "선택수정") { if ($is_admin != 'super') { $sql = " select count(*) as cnt from {$g5['board_table']} a, {$g5['group_table']} b - where a.gr_id = '{$_POST['gr_id'][$k]}' + where a.gr_id = '".sql_real_escape_string($_POST['gr_id'][$k])."' and a.gr_id = b.gr_id and b.gr_admin = '{$member['mb_id']}' "; $row = sql_fetch($sql); @@ -28,19 +30,20 @@ if ($_POST['act_button'] == "선택수정") { } $sql = " update {$g5['board_table']} - set gr_id = '{$_POST['gr_id'][$k]}', - bo_subject = '{$_POST['bo_subject'][$k]}', - bo_device = '{$_POST['bo_device'][$k]}', - bo_skin = '{$_POST['bo_skin'][$k]}', - bo_mobile_skin = '{$_POST['bo_mobile_skin'][$k]}', - bo_read_point = '{$_POST['bo_read_point'][$k]}', - bo_write_point = '{$_POST['bo_write_point'][$k]}', - bo_comment_point = '{$_POST['bo_comment_point'][$k]}', - bo_download_point = '{$_POST['bo_download_point'][$k]}', - bo_use_search = '{$_POST['bo_use_search'][$k]}', - bo_use_sns = '{$_POST['bo_use_sns'][$k]}', - bo_order = '{$_POST['bo_order'][$k]}' - where bo_table = '{$_POST['board_table'][$k]}' "; + set gr_id = '".sql_real_escape_string($_POST['gr_id'][$k])."', + bo_subject = '".sql_real_escape_string($_POST['bo_subject'][$k])."', + bo_device = '".sql_real_escape_string($_POST['bo_device'][$k])."', + bo_skin = '".sql_real_escape_string($_POST['bo_skin'][$k])."', + bo_mobile_skin = '".sql_real_escape_string($_POST['bo_mobile_skin'][$k])."', + bo_read_point = '".sql_real_escape_string($_POST['bo_read_point'][$k])."', + bo_write_point = '".sql_real_escape_string($_POST['bo_write_point'][$k])."', + bo_comment_point = '".sql_real_escape_string($_POST['bo_comment_point'][$k])."', + bo_download_point = '".sql_real_escape_string($_POST['bo_download_point'][$k])."', + bo_use_search = '".sql_real_escape_string($_POST['bo_use_search'][$k])."', + bo_use_sns = '".sql_real_escape_string($_POST['bo_use_sns'][$k])."', + bo_order = '".sql_real_escape_string($_POST['bo_order'][$k])."' + where bo_table = '".sql_real_escape_string($_POST['board_table'][$k])."' "; + sql_query($sql); } @@ -51,8 +54,6 @@ if ($_POST['act_button'] == "선택수정") { auth_check($auth[$sub_menu], 'd'); - check_admin_token(); - // _BOARD_DELETE_ 상수를 선언해야 board_delete.inc.php 가 정상 작동함 define('_BOARD_DELETE_', true); diff --git a/adm/qa_config_update.php b/adm/qa_config_update.php index 47adc9b88..b56dc1f47 100644 --- a/adm/qa_config_update.php +++ b/adm/qa_config_update.php @@ -11,17 +11,17 @@ check_admin_token(); $error_msg = ''; if( $qa_include_head ){ - $purl = parse_url($qa_include_head); - $file = $purl['path']; - if (!preg_match("/\.(php|htm['l']?)$/i", $file)) { + $file_ext = pathinfo($qa_include_head, PATHINFO_EXTENSION); + + if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) ) { alert('상단 파일 경로의 확장자는 php, html 만 허용합니다.'); } } if( $qa_include_tail ){ - $purl = parse_url($qa_include_tail); - $file = $purl['path']; - if (!preg_match("/\.(php|htm['l']?)$/i", $file)) { + $file_ext = pathinfo($qa_include_tail, PATHINFO_EXTENSION); + + if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) ) { alert('하단 파일 경로의 확장자는 php, html 만 허용합니다.'); } } diff --git a/adm/sms_admin/emoticon_move.php b/adm/sms_admin/emoticon_move.php index 592e273ce..075c7b4a4 100644 --- a/adm/sms_admin/emoticon_move.php +++ b/adm/sms_admin/emoticon_move.php @@ -11,7 +11,8 @@ auth_check($auth[$sub_menu], "r"); $g5['title'] = '이모티콘그룹 이동'; include_once(G5_PATH.'/head.sub.php'); -$fo_no_list = implode(',', $_POST['fo_no']); +$list = array(); //배열 변수 초기화 +$fo_no_list = isset($_POST['fo_no']) ? implode(',', $_POST['fo_no']) : ''; $sql = " select * from {$g5['sms5_form_group_table']} order by fg_no "; $result = sql_query($sql); @@ -27,7 +28,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
- +
From 06ad4e534af2790e5071470604dd208c8ab33e01 Mon Sep 17 00:00:00 2001 From: thisgun Date: Tue, 13 Mar 2018 16:11:52 +0900 Subject: [PATCH 06/17] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C=20?= =?UTF-8?q?=EC=98=81=EC=B9=B4=ED=8A=B8=20=EB=8B=A4=EC=A4=91=20=EC=B7=A8?= =?UTF-8?q?=EC=95=BD=EC=A0=90(17-1029,=2017-1047)=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/admin.lib.php | 11 +++++++++++ adm/board_form_update.php | 4 ++-- adm/sms_admin/history_view.php | 15 +++++++++------ bbs/board.php | 8 ++++---- bbs/delete.php | 2 +- bbs/delete_comment.php | 8 ++++---- bbs/view.php | 2 +- bbs/view_comment.php | 6 +++--- bbs/write.php | 10 +++++----- bbs/write_comment_update.php | 6 +++--- bbs/write_update.php | 4 ++-- lib/common.lib.php | 5 +++++ 12 files changed, 50 insertions(+), 31 deletions(-) diff --git a/adm/admin.lib.php b/adm/admin.lib.php index 3a26820ad..deb752fca 100644 --- a/adm/admin.lib.php +++ b/adm/admin.lib.php @@ -355,6 +355,17 @@ function get_admin_token() return $token; } +//input value 에서 xss 공격 filter 역할을 함 ( 반드시 input value='' 타입에만 사용할것 ) +function get_sanitize_input($s, $is_html=false){ + + if(!$is_html){ + $s = strip_tags($s); + } + + $s = htmlspecialchars($s, ENT_QUOTES, 'utf-8'); + + return $s; +} // POST로 넘어온 토큰과 세션에 저장된 토큰 비교 function check_admin_token() diff --git a/adm/board_form_update.php b/adm/board_form_update.php index 71341fbbe..dd49120ba 100644 --- a/adm/board_form_update.php +++ b/adm/board_form_update.php @@ -36,11 +36,11 @@ if ($file = $_POST['bo_include_tail']) { } if(!is_include_path_check($_POST['bo_include_head'], 1)) { - alert('/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.'); + alert('상단 파일 경로에 포함시킬수 없는 문자열이 있습니다.'); } if(!is_include_path_check($_POST['bo_include_tail'], 1)) { - alert('/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.'); + alert('하단 파일 경로에 포함시킬수 없는 문자열이 있습니다.'); } $board_path = G5_DATA_PATH.'/file/'.$bo_table; diff --git a/adm/sms_admin/history_view.php b/adm/sms_admin/history_view.php index 7986d00c2..c745b7058 100644 --- a/adm/sms_admin/history_view.php +++ b/adm/sms_admin/history_view.php @@ -5,6 +5,9 @@ include_once("./_common.php"); $spage_size = 20; $colspan = 10; +$st = isset($st) ? strip_tags($st) : ''; +$ssv = isset($ssv) ? strip_tags($ssv) : ''; + auth_check($auth[$sub_menu], "r"); $g5['title'] = "문자전송 상세내역"; @@ -64,18 +67,18 @@ function all_send() - - - - - + + + + + - + diff --git a/bbs/board.php b/bbs/board.php index 4d734128c..ab37ff8b1 100644 --- a/bbs/board.php +++ b/bbs/board.php @@ -77,7 +77,7 @@ if (isset($wr_id) && $wr_id) { } // 자신의 글이거나 관리자라면 통과 - if (($write['mb_id'] && $write['mb_id'] == $member['mb_id']) || $is_admin) { + if (($write['mb_id'] && $write['mb_id'] === $member['mb_id']) || $is_admin) { ; } else { // 비밀글이라면 @@ -93,7 +93,7 @@ if (isset($wr_id) && $wr_id) { and wr_reply = '' and wr_is_comment = 0 "; $row = sql_fetch($sql); - if ($row['mb_id'] == $member['mb_id']) + if ($row['mb_id'] === $member['mb_id']) $is_owner = true; } @@ -120,7 +120,7 @@ if (isset($wr_id) && $wr_id) { sql_query(" update {$write_table} set wr_hit = wr_hit + 1 where wr_id = '{$wr_id}' "); // 자신의 글이면 통과 - if ($write['mb_id'] && $write['mb_id'] == $member['mb_id']) { + if ($write['mb_id'] && $write['mb_id'] === $member['mb_id']) { ; } else if ($is_guest && $board['bo_read_level'] == 1 && $write['wr_ip'] == $_SERVER['REMOTE_ADDR']) { // 비회원이면서 읽기레벨이 1이고 등록된 아이피가 같다면 자신의 글이므로 통과 @@ -219,7 +219,7 @@ if ($board['bo_use_nogood']) $admin_href = ""; // 최고관리자 또는 그룹관리자라면 -if ($member['mb_id'] && ($is_admin == 'super' || $group['gr_admin'] == $member['mb_id'])) +if ($member['mb_id'] && ($is_admin === 'super' || $group['gr_admin'] === $member['mb_id'])) $admin_href = G5_ADMIN_URL.'/board_form.php?w=u&bo_table='.$bo_table; include_once(G5_BBS_PATH.'/board_head.php'); diff --git a/bbs/delete.php b/bbs/delete.php index aafa8e889..09639a194 100644 --- a/bbs/delete.php +++ b/bbs/delete.php @@ -26,7 +26,7 @@ else if ($is_admin == 'group') { // 그룹관리자 else if ($member['mb_level'] < $mb['mb_level']) // 자신의 레벨이 크거나 같다면 통과 alert('자신의 권한보다 높은 권한의 회원이 작성한 글은 삭제할 수 없습니다.'); } else if ($member['mb_id']) { - if ($member['mb_id'] != $write['mb_id']) + if ($member['mb_id'] !== $write['mb_id']) alert('자신의 글이 아니므로 삭제할 수 없습니다.'); } else { if ($write['mb_id']) diff --git a/bbs/delete_comment.php b/bbs/delete_comment.php index 24c482c1e..326ef71e5 100644 --- a/bbs/delete_comment.php +++ b/bbs/delete_comment.php @@ -20,16 +20,16 @@ if ($is_admin == 'super') // 최고관리자 통과 ; else if ($is_admin == 'group') { // 그룹관리자 $mb = get_member($write['mb_id']); - if ($member['mb_id'] == $group['gr_admin']) { // 자신이 관리하는 그룹인가? + if ($member['mb_id'] === $group['gr_admin']) { // 자신이 관리하는 그룹인가? if ($member['mb_level'] >= $mb['mb_level']) // 자신의 레벨이 크거나 같다면 통과 ; else alert('그룹관리자의 권한보다 높은 회원의 코멘트이므로 삭제할 수 없습니다.'); } else alert('자신이 관리하는 그룹의 게시판이 아니므로 코멘트를 삭제할 수 없습니다.'); -} else if ($is_admin == 'board') { // 게시판관리자이면 +} else if ($is_admin === 'board') { // 게시판관리자이면 $mb = get_member($write['mb_id']); - if ($member['mb_id'] == $board['bo_admin']) { // 자신이 관리하는 게시판인가? + if ($member['mb_id'] === $board['bo_admin']) { // 자신이 관리하는 게시판인가? if ($member['mb_level'] >= $mb['mb_level']) // 자신의 레벨이 크거나 같다면 통과 ; else @@ -37,7 +37,7 @@ else if ($is_admin == 'group') { // 그룹관리자 } else alert('자신이 관리하는 게시판이 아니므로 코멘트를 삭제할 수 없습니다.'); } else if ($member['mb_id']) { - if ($member['mb_id'] != $write['mb_id']) + if ($member['mb_id'] !== $write['mb_id']) alert('자신의 글이 아니므로 삭제할 수 없습니다.'); } else { if (!check_password($wr_password, $write['wr_password'])) diff --git a/bbs/view.php b/bbs/view.php index 1cfe55f67..8f0c40acc 100644 --- a/bbs/view.php +++ b/bbs/view.php @@ -70,7 +70,7 @@ if ($member['mb_level'] >= $board['bo_reply_level']) // 수정, 삭제 링크 $update_href = $delete_href = ''; // 로그인중이고 자신의 글이라면 또는 관리자라면 비밀번호를 묻지 않고 바로 수정, 삭제 가능 -if (($member['mb_id'] && ($member['mb_id'] == $write['mb_id'])) || $is_admin) { +if (($member['mb_id'] && ($member['mb_id'] === $write['mb_id'])) || $is_admin) { $update_href = './write.php?w=u&bo_table='.$bo_table.'&wr_id='.$wr_id.'&page='.$page.$qstr; set_session('ss_delete_token', $token = uniqid(time())); $delete_href ='./delete.php?bo_table='.$bo_table.'&wr_id='.$wr_id.'&token='.$token.'&page='.$page.urldecode($qstr); diff --git a/bbs/view_comment.php b/bbs/view_comment.php index 472333d07..32c87e219 100644 --- a/bbs/view_comment.php +++ b/bbs/view_comment.php @@ -39,8 +39,8 @@ for ($i=0; $row=sql_fetch_array($result); $i++) $list[$i]['content'] = $list[$i]['content1']= '비밀글 입니다.'; if (!strstr($row['wr_option'], 'secret') || $is_admin || - ($write['mb_id']==$member['mb_id'] && $member['mb_id']) || - ($row['mb_id']==$member['mb_id'] && $member['mb_id'])) { + ($write['mb_id']===$member['mb_id'] && $member['mb_id']) || + ($row['mb_id']===$member['mb_id'] && $member['mb_id'])) { $list[$i]['content1'] = $row['wr_content']; $list[$i]['content'] = conv_content($row['wr_content'], 0, 'wr_content'); $list[$i]['content'] = search_font($stx, $list[$i]['content']); @@ -71,7 +71,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) if ($member['mb_id']) { - if ($row['mb_id'] == $member['mb_id'] || $is_admin) + if ($row['mb_id'] === $member['mb_id'] || $is_admin) { set_session('ss_delete_comment_'.$row['wr_id'].'_token', $token = uniqid(time())); $list[$i]['del_link'] = './delete_comment.php?bo_table='.$bo_table.'&comment_id='.$row['wr_id'].'&token='.$token.'&page='.$page.$qstr; diff --git a/bbs/write.php b/bbs/write.php index 4282142de..dde0608da 100644 --- a/bbs/write.php +++ b/bbs/write.php @@ -56,7 +56,7 @@ if ($w == '') { } else if ($w == 'u') { // 김선용 1.00 : 글쓰기 권한과 수정은 별도로 처리되어야 함 //if ($member['mb_level'] < $board['bo_write_level']) { - if($member['mb_id'] && $write['mb_id'] == $member['mb_id']) { + if($member['mb_id'] && $write['mb_id'] === $member['mb_id']) { ; } else if ($member['mb_level'] < $board['bo_write_level']) { if ($member['mb_id']) { @@ -116,7 +116,7 @@ if ($w == '') { if (strstr($write['wr_option'], 'secret')) { if ($write['mb_id']) { // 회원의 경우는 해당 글쓴 회원 및 관리자 - if (!($write['mb_id'] == $member['mb_id'] || $is_admin)) + if (!($write['mb_id'] === $member['mb_id'] || $is_admin)) alert('비밀글에는 자신 또는 관리자만 답변이 가능합니다.'); } else { // 비회원의 경우는 비밀글에 답변이 불가함 @@ -168,7 +168,7 @@ if (!empty($group['gr_use_access'])) { alert("접근 권한이 없습니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.", 'login.php?'.$qstr.'&url='.urlencode($_SERVER['SCRIPT_NAME'].'?bo_table='.$bo_table)); } - if ($is_admin == 'super' || $group['gr_admin'] == $member['mb_id'] || $board['bo_admin'] == $member['mb_id']) { + if ($is_admin == 'super' || $group['gr_admin'] === $member['mb_id'] || $board['bo_admin'] === $member['mb_id']) { ; // 통과 } else { // 그룹접근 @@ -251,7 +251,7 @@ $is_name = false; $is_password = false; $is_email = false; $is_homepage = false; -if ($is_guest || ($is_admin && $w == 'u' && $member['mb_id'] != $write['mb_id'])) { +if ($is_guest || ($is_admin && $w == 'u' && $member['mb_id'] !== $write['mb_id'])) { $is_name = true; $is_password = true; $is_email = true; @@ -308,7 +308,7 @@ if ($w == '') { $password_required = ''; if (!$is_admin) { - if (!($is_member && $member['mb_id'] == $write['mb_id'])) { + if (!($is_member && $member['mb_id'] === $write['mb_id'])) { if (!check_password($wr_password, $write['wr_password'])) { alert('비밀번호가 틀립니다.'); } diff --git a/bbs/write_comment_update.php b/bbs/write_comment_update.php index 129721d28..f7fdd3ea3 100644 --- a/bbs/write_comment_update.php +++ b/bbs/write_comment_update.php @@ -269,7 +269,7 @@ else if ($w == 'cu') // 댓글 수정 ; else if ($is_admin == 'group') { // 그룹관리자 $mb = get_member($comment['mb_id']); - if ($member['mb_id'] == $group['gr_admin']) { // 자신이 관리하는 그룹인가? + if ($member['mb_id'] === $group['gr_admin']) { // 자신이 관리하는 그룹인가? if ($member['mb_level'] >= $mb['mb_level']) // 자신의 레벨이 크거나 같다면 통과 ; else @@ -278,7 +278,7 @@ else if ($w == 'cu') // 댓글 수정 alert('자신이 관리하는 그룹의 게시판이 아니므로 댓글을 수정할 수 없습니다.'); } else if ($is_admin == 'board') { // 게시판관리자이면 $mb = get_member($comment['mb_id']); - if ($member['mb_id'] == $board['bo_admin']) { // 자신이 관리하는 게시판인가? + if ($member['mb_id'] === $board['bo_admin']) { // 자신이 관리하는 게시판인가? if ($member['mb_level'] >= $mb['mb_level']) // 자신의 레벨이 크거나 같다면 통과 ; else @@ -286,7 +286,7 @@ else if ($w == 'cu') // 댓글 수정 } else alert('자신이 관리하는 게시판이 아니므로 댓글을 수정할 수 없습니다.'); } else if ($member['mb_id']) { - if ($member['mb_id'] != $comment['mb_id']) + if ($member['mb_id'] !== $comment['mb_id']) alert('자신의 글이 아니므로 수정할 수 없습니다.'); } else { if($comment['wr_password'] != $wr_password) diff --git a/bbs/write_update.php b/bbs/write_update.php index 5b2b6f945..8788ff705 100644 --- a/bbs/write_update.php +++ b/bbs/write_update.php @@ -140,7 +140,7 @@ if ($w == '' || $w == 'u') { } // 김선용 1.00 : 글쓰기 권한과 수정은 별도로 처리되어야 함 - if($w =='u' && $member['mb_id'] && $wr['mb_id'] == $member['mb_id']) { + if($w =='u' && $member['mb_id'] && $wr['mb_id'] === $member['mb_id']) { ; } else if ($member['mb_level'] < $board['bo_write_level']) { alert('글을 쓸 권한이 없습니다.'); @@ -331,7 +331,7 @@ if ($w == '' || $w == 'r') { if ($member['mb_id']) { // 자신의 글이라면 - if ($member['mb_id'] == $wr['mb_id']) { + if ($member['mb_id'] === $wr['mb_id']) { $mb_id = $member['mb_id']; $wr_name = addslashes(clean_xss_tags($board['bo_use_name'] ? $member['mb_name'] : $member['mb_nick'])); $wr_email = addslashes($member['mb_email']); diff --git a/lib/common.lib.php b/lib/common.lib.php index e1a65c8cd..8c4b1de70 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -3346,6 +3346,11 @@ function is_include_path_check($path='', $is_input='') { if( $path ){ if ($is_input){ + + if( strpos($path, 'php://') !== false || strpos($path, 'zlib://') !== false || strpos($path, 'bzip2://') !== false || strpos($path, 'zip://') !== false ){ + return false; + } + try { // whether $path is unix or not $unipath = strlen($path)==0 || $path{0}!='/'; From b79a46b857231a3f655be780131413637935a10e Mon Sep 17 00:00:00 2001 From: thisgun Date: Wed, 14 Mar 2018 17:57:22 +0900 Subject: [PATCH 07/17] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C5=20O?= =?UTF-8?q?pen=20Redirect+Password=20Hijack=20=EC=B7=A8=EC=95=BD=EC=A0=90(?= =?UTF-8?q?2018-0109)=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lib/common.lib.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/common.lib.php b/lib/common.lib.php index 8c4b1de70..03473b27a 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -3039,7 +3039,8 @@ function check_url_host($url, $msg='', $return_url=G5_URL) } //php 5.6.29 이하 버전에서는 parse_url 버그가 존재함 - if ( (isset($p['host']) && $p['host']) && version_compare(PHP_VERSION, '5.6.29') < 0) { + //php 7.0.1 ~ 7.0.5 버전에서는 parse_url 버그가 존재함 + if ( (isset($p['host']) && $p['host']) ) { $bool_ch = false; foreach( array('user','host') as $key) { if ( isset( $p[ $key ] ) && strpbrk( $p[ $key ], ':/?#@' ) ) { From b95db6a4a7071a09a5ce807139c74e879c5b8945 Mon Sep 17 00:00:00 2001 From: thisgun Date: Thu, 15 Mar 2018 15:41:20 +0900 Subject: [PATCH 08/17] =?UTF-8?q?=EB=AF=B8=EA=B0=80=EC=9E=85=20=EA=B3=84?= =?UTF-8?q?=EC=A0=95=20=EC=84=B8=EC=85=98=20=ED=9A=8D=EB=93=9D=20=EC=B7=A8?= =?UTF-8?q?=EC=95=BD=EC=A0=90=20(18-0013)=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- common.php | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/common.php b/common.php index 68970c9c7..35cd039c5 100644 --- a/common.php +++ b/common.php @@ -369,20 +369,22 @@ if ($_SESSION['ss_mb_id']) { // 로그인중이라면 if (strtolower($tmp_mb_id) != strtolower($config['cf_admin'])) { $sql = " select mb_password, mb_intercept_date, mb_leave_date, mb_email_certify from {$g5['member_table']} where mb_id = '{$tmp_mb_id}' "; $row = sql_fetch($sql); - $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $row['mb_password']); - // 쿠키에 저장된 키와 같다면 - $tmp_key = get_cookie('ck_auto'); - if ($tmp_key === $key && $tmp_key) { - // 차단, 탈퇴가 아니고 메일인증이 사용이면서 인증을 받았다면 - if ($row['mb_intercept_date'] == '' && - $row['mb_leave_date'] == '' && - (!$config['cf_use_email_certify'] || preg_match('/[1-9]/', $row['mb_email_certify'])) ) { - // 세션에 회원아이디를 저장하여 로그인으로 간주 - set_session('ss_mb_id', $tmp_mb_id); + if($row['mb_password']){ + $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $row['mb_password']); + // 쿠키에 저장된 키와 같다면 + $tmp_key = get_cookie('ck_auto'); + if ($tmp_key === $key && $tmp_key) { + // 차단, 탈퇴가 아니고 메일인증이 사용이면서 인증을 받았다면 + if ($row['mb_intercept_date'] == '' && + $row['mb_leave_date'] == '' && + (!$config['cf_use_email_certify'] || preg_match('/[1-9]/', $row['mb_email_certify'])) ) { + // 세션에 회원아이디를 저장하여 로그인으로 간주 + set_session('ss_mb_id', $tmp_mb_id); - // 페이지를 재실행 - echo ""; - exit; + // 페이지를 재실행 + echo ""; + exit; + } } } // $row 배열변수 해제 From 108651c46da35c54d57c000a9b76be1a6ee9bf6e Mon Sep 17 00:00:00 2001 From: thisgun Date: Fri, 16 Mar 2018 12:17:00 +0900 Subject: [PATCH 09/17] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C=20Re?= =?UTF-8?q?flected=20XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90(18-0085,=200132)=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/alert_close.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bbs/alert_close.php b/bbs/alert_close.php index 830b3c61f..10a9acd37 100644 --- a/bbs/alert_close.php +++ b/bbs/alert_close.php @@ -2,6 +2,8 @@ include_once('./_common.php'); include_once(G5_PATH.'/head.sub.php'); +//$msg = isset($msg) ? strip_tags($msg) : ''; + $msg2 = str_replace("\\n", "
", $msg); if($error) { From 6c867f02b4f19cfb1bd6aa484cbee548eb6bf64b Mon Sep 17 00:00:00 2001 From: thisgun Date: Fri, 16 Mar 2018 16:39:07 +0900 Subject: [PATCH 10/17] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C=20SQ?= =?UTF-8?q?L=20Injection=20=EC=B7=A8=EC=95=BD=EC=A0=90=20(18-0075)=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/delete.php | 2 +- bbs/delete_all.php | 2 +- bbs/move_update.php | 9 ++++++++- install/install_config.php | 2 +- install/install_db.php | 12 +++++++++++- 5 files changed, 22 insertions(+), 5 deletions(-) diff --git a/bbs/delete.php b/bbs/delete.php index 09639a194..8f3cc9bcd 100644 --- a/bbs/delete.php +++ b/bbs/delete.php @@ -80,7 +80,7 @@ while ($row = sql_fetch_array($result)) $sql2 = " select * from {$g5['board_file_table']} where bo_table = '$bo_table' and wr_id = '{$row['wr_id']}' "; $result2 = sql_query($sql2); while ($row2 = sql_fetch_array($result2)) { - @unlink(G5_DATA_PATH.'/file/'.$bo_table.'/'.$row2['bf_file']); + @unlink(G5_DATA_PATH.'/file/'.$bo_table.'/'.str_replace('../', '', $row2['bf_file'])); // 썸네일삭제 if(preg_match("/\.({$config['cf_image_extension']})$/i", $row2['bf_file'])) { delete_board_thumbnail($bo_table, $row2['bf_file']); diff --git a/bbs/delete_all.php b/bbs/delete_all.php index f7c6179bf..943045b19 100644 --- a/bbs/delete_all.php +++ b/bbs/delete_all.php @@ -98,7 +98,7 @@ for ($i=$chk_count-1; $i>=0; $i--) $result2 = sql_query($sql2); while ($row2 = sql_fetch_array($result2)) { // 파일삭제 - @unlink(G5_DATA_PATH.'/file/'.$bo_table.'/'.$row2['bf_file']); + @unlink(G5_DATA_PATH.'/file/'.$bo_table.'/'.str_replace('../', '',$row2['bf_file'])); // 썸네일삭제 if(preg_match("/\.({$config['cf_image_extension']})$/i", $row2['bf_file'])) { diff --git a/bbs/move_update.php b/bbs/move_update.php index 78abbd8cd..fd48087fe 100644 --- a/bbs/move_update.php +++ b/bbs/move_update.php @@ -28,7 +28,14 @@ while ($row = sql_fetch_array($result)) $wr_num = $row['wr_num']; for ($i=0; $i Date: Fri, 16 Mar 2018 17:10:54 +0900 Subject: [PATCH 11/17] =?UTF-8?q?1:1=20=EB=AC=B8=EC=9D=98=20=EB=A6=AC?= =?UTF-8?q?=EC=8A=A4=ED=8A=B8=EC=97=90=EC=84=9C=20=EC=82=AD=EC=A0=9C=20?= =?UTF-8?q?=ED=86=A0=ED=81=B0=20=EC=98=A4=EB=A5=98=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/qadelete.php | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/bbs/qadelete.php b/bbs/qadelete.php index a26fff7e1..09e7b82cc 100644 --- a/bbs/qadelete.php +++ b/bbs/qadelete.php @@ -7,7 +7,8 @@ if($is_guest) $delete_token = get_session('ss_qa_delete_token'); set_session('ss_qa_delete_token', ''); -if (!($token && $delete_token == $token)) +//관리자가 아닌경우에는 토큰을 검사합니다. +if (!$is_admin && !($token && $delete_token == $token)) alert('토큰 에러로 삭제 불가합니다.'); $tmp_array = array(); @@ -21,7 +22,7 @@ if(!$count) alert('삭제할 게시글을 하나이상 선택해 주십시오.'); for($i=0; $i<$count; $i++) { - $qa_id = $tmp_array[$i]; + $qa_id = (int) $tmp_array[$i]; $sql = " select qa_id, mb_id, qa_type, qa_status, qa_parent, qa_content, qa_file1, qa_file2 from {$g5['qa_content_table']} @@ -32,7 +33,7 @@ for($i=0; $i<$count; $i++) { continue; // 자신의 글이 아니면 건너뜀 - if($is_admin != 'super' && $row['mb_id'] != $member['mb_id']) + if($is_admin != 'super' && $row['mb_id'] !== $member['mb_id']) continue; // 답변이 달린 글은 삭제못함 From cfc85a327b70b201028312be6caeebb7fa7ad4c2 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 19 Mar 2018 09:40:21 +0900 Subject: [PATCH 12/17] =?UTF-8?q?=EB=B6=84=EB=A5=98=EB=AA=85=20=ED=8C=A8?= =?UTF-8?q?=EC=B9=98=20f5f4925d4eb28ba1af728e1065fc2bdd9ce1da58=20?= =?UTF-8?q?=EC=97=90=20=EB=94=B0=EB=A5=B8=20=EC=B6=94=EA=B0=80=EC=BD=94?= =?UTF-8?q?=EB=93=9C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/board_form.php | 2 +- adm/board_form_update.php | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/adm/board_form.php b/adm/board_form.php index 6855e3cb6..651d686db 100644 --- a/adm/board_form.php +++ b/adm/board_form.php @@ -233,7 +233,7 @@ $frm_submit .= ''; + +
- + > diff --git a/adm/board_form_update.php b/adm/board_form_update.php index dd49120ba..dccf74db3 100644 --- a/adm/board_form_update.php +++ b/adm/board_form_update.php @@ -60,6 +60,8 @@ $f = @fopen($file, 'w'); $src_char = array('&', '='); $dst_char = array('＆', '〓'); $bo_category_list = str_replace($src_char, $dst_char, $bo_category_list); +//https://github.com/gnuboard/gnuboard5/commit/f5f4925d4eb28ba1af728e1065fc2bdd9ce1da58 에 따른 조치 +$str_bo_category_list = isset($_POST['bo_category_list']) ? preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $_POST['bo_category_list']) : ''; $sql_common = " gr_id = '{$_POST['gr_id']}', bo_subject = '{$_POST['bo_subject']}', @@ -82,7 +84,7 @@ $sql_common = " gr_id = '{$_POST['gr_id']}', bo_comment_point = '{$_POST['bo_comment_point']}', bo_download_point = '{$_POST['bo_download_point']}', bo_use_category = '{$_POST['bo_use_category']}', - bo_category_list = '{$_POST['bo_category_list']}', + bo_category_list = '{$str_bo_category_list}', bo_use_sideview = '{$_POST['bo_use_sideview']}', bo_use_file_content = '{$_POST['bo_use_file_content']}', bo_use_secret = '{$_POST['bo_use_secret']}', From c665cc05574f48c9af6300736d1865ae5afb4529 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 19 Mar 2018 10:24:24 +0900 Subject: [PATCH 13/17] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C=20?= =?UTF-8?q?=EA=B4=80=EB=A6=AC=EC=9E=90=20=ED=8E=98=EC=9D=B4=EC=A7=80=20SQL?= =?UTF-8?q?=20Injection=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/auth_list_delete.php | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/adm/auth_list_delete.php b/adm/auth_list_delete.php index 46acecce6..0327c1889 100644 --- a/adm/auth_list_delete.php +++ b/adm/auth_list_delete.php @@ -9,17 +9,24 @@ if ($is_admin != 'super') check_admin_token(); -$count = count($_POST['chk']); +$count = (isset($_POST['chk']) && is_array($_POST['chk'])) ? count($_POST['chk']) : 0; if (!$count) alert($_POST['act_button']." 하실 항목을 하나 이상 체크하세요."); +if ( (isset($_POST['mb_id']) && ! is_array($_POST['mb_id'])) || (isset($_POST['au_menu']) && ! is_array($_POST['au_menu'])) ){ + alert("잘못된 요청입니다."); +} + for ($i=0; $i<$count; $i++) { // 실제 번호를 넘김 $k = $chk[$i]; + + $mb_id = preg_replace('/[^a-zA-Z0-9_]/', '', $_POST['mb_id'][$k]); + $au_menu = preg_replace('/[^a-zA-Z0-9_]/', '', $_POST['au_menu'][$k]); - $sql = " delete from {$g5['auth_table']} where mb_id = '{$_POST['mb_id'][$k]}' and au_menu = '{$_POST['au_menu'][$k]}' "; + $sql = " delete from {$g5['auth_table']} where mb_id = '".$mb_id."' and au_menu = '".$au_menu."' "; sql_query($sql); } From 2a70b016f69cf8f309be38030eedc4a23de3b8e0 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 19 Mar 2018 11:03:25 +0900 Subject: [PATCH 14/17] =?UTF-8?q?=EA=B2=8C=EC=8B=9C=ED=8C=90=20=EC=83=81?= =?UTF-8?q?=EB=8B=A8=20=ED=95=98=EB=8B=A8=20=20=ED=8C=8C=EC=9D=BC=20?= =?UTF-8?q?=EA=B2=BD=EB=A1=9C=20=EB=82=B4=EC=9A=A9=20=EB=93=B1=EC=9D=80=20?= =?UTF-8?q?=EC=8A=88=ED=8D=BC=EA=B4=80=EB=A6=AC=EC=9E=90=EB=A7=8C=20?= =?UTF-8?q?=EC=9E=85=EB=A0=A5=ED=95=A0=EC=88=98=20=EC=9E=88=EA=B2=8C=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/board_form.php | 2 ++ adm/board_form_update.php | 45 +++++++++++++++++++++++++++------------ 2 files changed, 33 insertions(+), 14 deletions(-) diff --git a/adm/board_form.php b/adm/board_form.php index 651d686db..0eb655d1b 100644 --- a/adm/board_form.php +++ b/adm/board_form.php @@ -815,6 +815,7 @@ $frm_submit .= '';
@@ -887,6 +888,7 @@ $frm_submit .= '';
diff --git a/adm/board_form_update.php b/adm/board_form_update.php index dccf74db3..20eae3035 100644 --- a/adm/board_form_update.php +++ b/adm/board_form_update.php @@ -111,13 +111,20 @@ $sql_common = " gr_id = '{$_POST['gr_id']}', bo_image_width = '{$_POST['bo_image_width']}', bo_skin = '{$_POST['bo_skin']}', bo_mobile_skin = '{$_POST['bo_mobile_skin']}', - bo_include_head = '{$_POST['bo_include_head']}', + "; + +// 최고 관리자인 경우에만 수정가능 +if ($is_admin === 'super'){ +$sql_common .= " bo_include_head = '{$_POST['bo_include_head']}', bo_include_tail = '{$_POST['bo_include_tail']}', bo_content_head = '{$_POST['bo_content_head']}', bo_content_tail = '{$_POST['bo_content_tail']}', bo_mobile_content_head = '{$_POST['bo_mobile_content_head']}', bo_mobile_content_tail = '{$_POST['bo_mobile_content_tail']}', - bo_insert_content = '{$_POST['bo_insert_content']}', + "; +} + +$sql_common .= " bo_insert_content = '{$_POST['bo_insert_content']}', bo_gallery_cols = '{$_POST['bo_gallery_cols']}', bo_gallery_width = '{$_POST['bo_gallery_width']}', bo_gallery_height = '{$_POST['bo_gallery_height']}', @@ -301,12 +308,17 @@ if (is_checked('chk_grp_comment_min')) $grp_fields .= " , bo_comment_mi if (is_checked('chk_grp_comment_max')) $grp_fields .= " , bo_comment_max = '{$bo_comment_max}' "; if (is_checked('chk_grp_upload_count')) $grp_fields .= " , bo_upload_count = '{$bo_upload_count}' "; if (is_checked('chk_grp_upload_size')) $grp_fields .= " , bo_upload_size = '{$bo_upload_size}' "; -if (is_checked('chk_grp_include_head')) $grp_fields .= " , bo_include_head = '{$bo_include_head}' "; -if (is_checked('chk_grp_include_tail')) $grp_fields .= " , bo_include_tail = '{$bo_include_tail}' "; -if (is_checked('chk_grp_content_head')) $grp_fields .= " , bo_content_head = '{$bo_content_head}' "; -if (is_checked('chk_grp_content_tail')) $grp_fields .= " , bo_content_tail = '{$bo_content_tail}' "; -if (is_checked('chk_grp_mobile_content_head')) $grp_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' "; -if (is_checked('chk_grp_mobile_content_tail')) $grp_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' "; + +//최고관리자만 수정가능 +if ($is_admin === 'super'){ + if (is_checked('chk_grp_include_head')) $grp_fields .= " , bo_include_head = '{$bo_include_head}' "; + if (is_checked('chk_grp_include_tail')) $grp_fields .= " , bo_include_tail = '{$bo_include_tail}' "; + if (is_checked('chk_grp_content_head')) $grp_fields .= " , bo_content_head = '{$bo_content_head}' "; + if (is_checked('chk_grp_content_tail')) $grp_fields .= " , bo_content_tail = '{$bo_content_tail}' "; + if (is_checked('chk_grp_mobile_content_head')) $grp_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' "; + if (is_checked('chk_grp_mobile_content_tail')) $grp_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' "; +} + if (is_checked('chk_grp_insert_content')) $grp_fields .= " , bo_insert_content = '{$bo_insert_content}' "; if (is_checked('chk_grp_use_search')) $grp_fields .= " , bo_use_search = '{$bo_use_search}' "; if (is_checked('chk_grp_order')) $grp_fields .= " , bo_order = '{$bo_order}' "; @@ -384,12 +396,17 @@ if (is_checked('chk_all_comment_min')) $all_fields .= " , bo_comment_mi if (is_checked('chk_all_comment_max')) $all_fields .= " , bo_comment_max = '{$bo_comment_max}' "; if (is_checked('chk_all_upload_count')) $all_fields .= " , bo_upload_count = '{$bo_upload_count}' "; if (is_checked('chk_all_upload_size')) $all_fields .= " , bo_upload_size = '{$bo_upload_size}' "; -if (is_checked('chk_all_include_head')) $all_fields .= " , bo_include_head = '{$bo_include_head}' "; -if (is_checked('chk_all_include_tail')) $all_fields .= " , bo_include_tail = '{$bo_include_tail}' "; -if (is_checked('chk_all_content_head')) $all_fields .= " , bo_content_head = '{$bo_content_head}' "; -if (is_checked('chk_all_content_tail')) $all_fields .= " , bo_content_tail = '{$bo_content_tail}' "; -if (is_checked('chk_all_mobile_content_head')) $all_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' "; -if (is_checked('chk_all_mobile_content_tail')) $all_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' "; + +//최고관리자만 수정가능 +if ($is_admin === 'super'){ + if (is_checked('chk_all_include_head')) $all_fields .= " , bo_include_head = '{$bo_include_head}' "; + if (is_checked('chk_all_include_tail')) $all_fields .= " , bo_include_tail = '{$bo_include_tail}' "; + if (is_checked('chk_all_content_head')) $all_fields .= " , bo_content_head = '{$bo_content_head}' "; + if (is_checked('chk_all_content_tail')) $all_fields .= " , bo_content_tail = '{$bo_content_tail}' "; + if (is_checked('chk_all_mobile_content_head')) $all_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' "; + if (is_checked('chk_all_mobile_content_tail')) $all_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' "; +} + if (is_checked('chk_all_insert_content')) $all_fields .= " , bo_insert_content = '{$bo_insert_content}' "; if (is_checked('chk_all_use_search')) $all_fields .= " , bo_use_search = '{$bo_use_search}' "; if (is_checked('chk_all_order')) $all_fields .= " , bo_order = '{$bo_order}' "; From 134e504134028bd8ae5fb0d0a1657574b3372113 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 19 Mar 2018 12:30:24 +0900 Subject: [PATCH 15/17] =?UTF-8?q?=EC=B5=9C=EC=8B=A0=EA=B8=80=20=EC=BA=90?= =?UTF-8?q?=EC=8B=9C=20=ED=8C=8C=EC=9D=BC=20=EC=83=9D=EC=84=B1=20=EC=BD=94?= =?UTF-8?q?=EB=93=9C=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lib/latest.lib.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/latest.lib.php b/lib/latest.lib.php index 55dd826db..a37ba466e 100644 --- a/lib/latest.lib.php +++ b/lib/latest.lib.php @@ -61,6 +61,10 @@ function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time= $sql = " select * from {$tmp_write_table} where wr_is_comment = 0 order by wr_num limit 0, {$rows} "; $result = sql_query($sql); for ($i=0; $row = sql_fetch_array($result); $i++) { + try { + unset($row['wr_password']); + } catch (Exception $e) { + } $list[$i] = get_list($row, $board, $latest_skin_url, $subject_len); } From af6d060fa084f1de0ed3bc09e4664b56cdee2473 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 19 Mar 2018 14:16:10 +0900 Subject: [PATCH 16/17] =?UTF-8?q?5.2.9.8.3=20=EB=B2=84=EC=A0=84=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- config.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config.php b/config.php index 9e8782482..826b29242 100644 --- a/config.php +++ b/config.php @@ -5,7 +5,7 @@ ********************/ define('G5_VERSION', '그누보드5'); -define('G5_GNUBOARD_VER', '5.2.9.8.1'); +define('G5_GNUBOARD_VER', '5.2.9.8.3'); // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음 define('_GNUBOARD_', true); From fddd29388b2f9744c08747ec65ec9f325ef303e3 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 19 Mar 2018 16:54:42 +0900 Subject: [PATCH 17/17] =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20(2018-0085,?= =?UTF-8?q?=200132)=20=EC=9D=B4=EC=A0=84=20=EC=9E=98=EB=AA=BB=EB=90=9C=20?= =?UTF-8?q?=EC=BD=94=EB=93=9C=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/alert_close.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bbs/alert_close.php b/bbs/alert_close.php index 10a9acd37..67b072f48 100644 --- a/bbs/alert_close.php +++ b/bbs/alert_close.php @@ -2,7 +2,7 @@ include_once('./_common.php'); include_once(G5_PATH.'/head.sub.php'); -//$msg = isset($msg) ? strip_tags($msg) : ''; +$msg = isset($msg) ? strip_tags($msg) : ''; $msg2 = str_replace("\\n", "
", $msg);