From cd8a9078d522dbd472556f5be0bd1512d27d0f0d Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 14 Aug 2017 17:04:11 +0900
Subject: [PATCH 1/2] =?UTF-8?q?433=20=ED=8F=AC=ED=8A=B8=EB=B2=88=ED=98=B8?=
 =?UTF-8?q?=20=EC=B2=98=EB=A6=AC=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 common.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common.php b/common.php
index da867ec16..d0ed644af 100644
--- a/common.php
+++ b/common.php
@@ -34,7 +34,7 @@ function g5_path()
     $document_root = str_replace($tilde_remove, '', $_SERVER['SCRIPT_FILENAME']);
     $pattern = '/' . preg_quote($document_root, '/') . '/i';
     $root = preg_replace($pattern, '', $result['path']);
-    $port = $_SERVER['SERVER_PORT'] != 80 ? ':'.$_SERVER['SERVER_PORT'] : '';
+    $port = ($_SERVER['SERVER_PORT'] == 80 || $_SERVER['SERVER_PORT'] == 443) ? '' : ':'.$_SERVER['SERVER_PORT'];
     $http = 'http' . ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ? 's' : '') . '://';
     $user = str_replace(preg_replace($pattern, '', $_SERVER['SCRIPT_FILENAME']), '', $_SERVER['SCRIPT_NAME']);
     $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME'];

From d9789a636e42c5d131d445905ed56487750a4607 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 14 Aug 2017 17:23:23 +0900
Subject: [PATCH 2/2] =?UTF-8?q?Stored=20XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90?=
 =?UTF-8?q?=20=EC=88=98=EC=A0=95=20(17-557)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 bbs/qawrite.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bbs/qawrite.php b/bbs/qawrite.php
index d9ffd7b98..5a7a47345 100644
--- a/bbs/qawrite.php
+++ b/bbs/qawrite.php
@@ -76,7 +76,10 @@ if(is_file($skin_file)) {
 
         $content .= get_text($write['qa_content'], 0);
     } else {
-        $content = get_text($write['qa_content'], 0);
+        //$content = get_text($write['qa_content'], 0);
+        
+        // KISA 취약점 권고사항 Stored XSS
+        $content = get_text(html_purifier($write['qa_content']), 0);
     }
 
     $editor_html = editor_html('qa_content', $content, $is_dhtml_editor);