|
diff --git a/adm/board_form_update.php b/adm/board_form_update.php
index 7b9378f07..2f4816af6 100644
--- a/adm/board_form_update.php
+++ b/adm/board_form_update.php
@@ -18,29 +18,29 @@ $_POST['bo_include_head'] = preg_replace("#[\\\]+$#", "", substr($_POST['bo_incl
$_POST['bo_include_tail'] = preg_replace("#[\\\]+$#", "", substr($_POST['bo_include_tail'], 0, 255));
if ($file = $_POST['bo_include_head']) {
- $purl = parse_url($file);
- $file = $purl['path'];
- if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
+ $file_ext = pathinfo($file, PATHINFO_EXTENSION);
+
+ if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) ) {
alert('상단 파일 경로의 확장자는 php, html 만 허용합니다.');
}
$_POST['bo_include_head'] = $file;
}
if ($file = $_POST['bo_include_tail']) {
- $purl = parse_url($file);
- $file = $purl['path'];
- if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
+ $file_ext = pathinfo($file, PATHINFO_EXTENSION);
+
+ if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) ) {
alert('하단 파일 경로의 확장자는 php, html 만 허용합니다.');
}
$_POST['bo_include_tail'] = $file;
}
if(!is_include_path_check($_POST['bo_include_head'], 1)) {
- alert('/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.');
+ alert('상단 파일 경로에 포함시킬수 없는 문자열이 있습니다.');
}
if(!is_include_path_check($_POST['bo_include_tail'], 1)) {
- alert('/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.');
+ alert('하단 파일 경로에 포함시킬수 없는 문자열이 있습니다.');
}
$board_path = G5_DATA_PATH.'/file/'.$bo_table;
@@ -60,6 +60,8 @@ $f = @fopen($file, 'w');
$src_char = array('&', '=');
$dst_char = array('&', '〓');
$bo_category_list = str_replace($src_char, $dst_char, $bo_category_list);
+//https://github.com/gnuboard/gnuboard5/commit/f5f4925d4eb28ba1af728e1065fc2bdd9ce1da58 에 따른 조치
+$str_bo_category_list = isset($_POST['bo_category_list']) ? preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $_POST['bo_category_list']) : '';
$sql_common = " gr_id = '{$_POST['gr_id']}',
bo_subject = '{$_POST['bo_subject']}',
@@ -82,7 +84,7 @@ $sql_common = " gr_id = '{$_POST['gr_id']}',
bo_comment_point = '{$_POST['bo_comment_point']}',
bo_download_point = '{$_POST['bo_download_point']}',
bo_use_category = '{$_POST['bo_use_category']}',
- bo_category_list = '{$_POST['bo_category_list']}',
+ bo_category_list = '{$str_bo_category_list}',
bo_use_sideview = '{$_POST['bo_use_sideview']}',
bo_use_file_content = '{$_POST['bo_use_file_content']}',
bo_use_secret = '{$_POST['bo_use_secret']}',
@@ -110,13 +112,20 @@ $sql_common = " gr_id = '{$_POST['gr_id']}',
bo_image_width = '{$_POST['bo_image_width']}',
bo_skin = '{$_POST['bo_skin']}',
bo_mobile_skin = '{$_POST['bo_mobile_skin']}',
- bo_include_head = '{$_POST['bo_include_head']}',
+ ";
+
+// 최고 관리자인 경우에만 수정가능
+if ($is_admin === 'super'){
+$sql_common .= " bo_include_head = '{$_POST['bo_include_head']}',
bo_include_tail = '{$_POST['bo_include_tail']}',
bo_content_head = '{$_POST['bo_content_head']}',
bo_content_tail = '{$_POST['bo_content_tail']}',
bo_mobile_content_head = '{$_POST['bo_mobile_content_head']}',
bo_mobile_content_tail = '{$_POST['bo_mobile_content_tail']}',
- bo_insert_content = '{$_POST['bo_insert_content']}',
+ ";
+}
+
+$sql_common .= " bo_insert_content = '{$_POST['bo_insert_content']}',
bo_gallery_cols = '{$_POST['bo_gallery_cols']}',
bo_gallery_width = '{$_POST['bo_gallery_width']}',
bo_gallery_height = '{$_POST['bo_gallery_height']}',
@@ -301,12 +310,17 @@ if (is_checked('chk_grp_comment_min')) $grp_fields .= " , bo_comment_mi
if (is_checked('chk_grp_comment_max')) $grp_fields .= " , bo_comment_max = '{$bo_comment_max}' ";
if (is_checked('chk_grp_upload_count')) $grp_fields .= " , bo_upload_count = '{$bo_upload_count}' ";
if (is_checked('chk_grp_upload_size')) $grp_fields .= " , bo_upload_size = '{$bo_upload_size}' ";
-if (is_checked('chk_grp_include_head')) $grp_fields .= " , bo_include_head = '{$bo_include_head}' ";
-if (is_checked('chk_grp_include_tail')) $grp_fields .= " , bo_include_tail = '{$bo_include_tail}' ";
-if (is_checked('chk_grp_content_head')) $grp_fields .= " , bo_content_head = '{$bo_content_head}' ";
-if (is_checked('chk_grp_content_tail')) $grp_fields .= " , bo_content_tail = '{$bo_content_tail}' ";
-if (is_checked('chk_grp_mobile_content_head')) $grp_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' ";
-if (is_checked('chk_grp_mobile_content_tail')) $grp_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' ";
+
+//최고관리자만 수정가능
+if ($is_admin === 'super'){
+ if (is_checked('chk_grp_include_head')) $grp_fields .= " , bo_include_head = '{$bo_include_head}' ";
+ if (is_checked('chk_grp_include_tail')) $grp_fields .= " , bo_include_tail = '{$bo_include_tail}' ";
+ if (is_checked('chk_grp_content_head')) $grp_fields .= " , bo_content_head = '{$bo_content_head}' ";
+ if (is_checked('chk_grp_content_tail')) $grp_fields .= " , bo_content_tail = '{$bo_content_tail}' ";
+ if (is_checked('chk_grp_mobile_content_head')) $grp_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' ";
+ if (is_checked('chk_grp_mobile_content_tail')) $grp_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' ";
+}
+
if (is_checked('chk_grp_insert_content')) $grp_fields .= " , bo_insert_content = '{$bo_insert_content}' ";
if (is_checked('chk_grp_use_search')) $grp_fields .= " , bo_use_search = '{$bo_use_search}' ";
if (is_checked('chk_grp_order')) $grp_fields .= " , bo_order = '{$bo_order}' ";
@@ -385,12 +399,17 @@ if (is_checked('chk_all_comment_min')) $all_fields .= " , bo_comment_mi
if (is_checked('chk_all_comment_max')) $all_fields .= " , bo_comment_max = '{$bo_comment_max}' ";
if (is_checked('chk_all_upload_count')) $all_fields .= " , bo_upload_count = '{$bo_upload_count}' ";
if (is_checked('chk_all_upload_size')) $all_fields .= " , bo_upload_size = '{$bo_upload_size}' ";
-if (is_checked('chk_all_include_head')) $all_fields .= " , bo_include_head = '{$bo_include_head}' ";
-if (is_checked('chk_all_include_tail')) $all_fields .= " , bo_include_tail = '{$bo_include_tail}' ";
-if (is_checked('chk_all_content_head')) $all_fields .= " , bo_content_head = '{$bo_content_head}' ";
-if (is_checked('chk_all_content_tail')) $all_fields .= " , bo_content_tail = '{$bo_content_tail}' ";
-if (is_checked('chk_all_mobile_content_head')) $all_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' ";
-if (is_checked('chk_all_mobile_content_tail')) $all_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' ";
+
+//최고관리자만 수정가능
+if ($is_admin === 'super'){
+ if (is_checked('chk_all_include_head')) $all_fields .= " , bo_include_head = '{$bo_include_head}' ";
+ if (is_checked('chk_all_include_tail')) $all_fields .= " , bo_include_tail = '{$bo_include_tail}' ";
+ if (is_checked('chk_all_content_head')) $all_fields .= " , bo_content_head = '{$bo_content_head}' ";
+ if (is_checked('chk_all_content_tail')) $all_fields .= " , bo_content_tail = '{$bo_content_tail}' ";
+ if (is_checked('chk_all_mobile_content_head')) $all_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' ";
+ if (is_checked('chk_all_mobile_content_tail')) $all_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' ";
+}
+
if (is_checked('chk_all_insert_content')) $all_fields .= " , bo_insert_content = '{$bo_insert_content}' ";
if (is_checked('chk_all_use_search')) $all_fields .= " , bo_use_search = '{$bo_use_search}' ";
if (is_checked('chk_all_order')) $all_fields .= " , bo_order = '{$bo_order}' ";
diff --git a/adm/board_list_update.php b/adm/board_list_update.php
index a26e521d6..90a1c5d33 100644
--- a/adm/board_list_update.php
+++ b/adm/board_list_update.php
@@ -8,6 +8,8 @@ if (!count($_POST['chk'])) {
alert($_POST['act_button']." 하실 항목을 하나 이상 체크하세요.");
}
+check_admin_token();
+
if ($_POST['act_button'] == "선택수정") {
auth_check($auth[$sub_menu], 'w');
@@ -19,7 +21,7 @@ if ($_POST['act_button'] == "선택수정") {
if ($is_admin != 'super') {
$sql = " select count(*) as cnt from {$g5['board_table']} a, {$g5['group_table']} b
- where a.gr_id = '{$_POST['gr_id'][$k]}'
+ where a.gr_id = '".sql_real_escape_string($_POST['gr_id'][$k])."'
and a.gr_id = b.gr_id
and b.gr_admin = '{$member['mb_id']}' ";
$row = sql_fetch($sql);
@@ -28,19 +30,20 @@ if ($_POST['act_button'] == "선택수정") {
}
$sql = " update {$g5['board_table']}
- set gr_id = '{$_POST['gr_id'][$k]}',
- bo_subject = '{$_POST['bo_subject'][$k]}',
- bo_device = '{$_POST['bo_device'][$k]}',
- bo_skin = '{$_POST['bo_skin'][$k]}',
- bo_mobile_skin = '{$_POST['bo_mobile_skin'][$k]}',
- bo_read_point = '{$_POST['bo_read_point'][$k]}',
- bo_write_point = '{$_POST['bo_write_point'][$k]}',
- bo_comment_point = '{$_POST['bo_comment_point'][$k]}',
- bo_download_point = '{$_POST['bo_download_point'][$k]}',
- bo_use_search = '{$_POST['bo_use_search'][$k]}',
- bo_use_sns = '{$_POST['bo_use_sns'][$k]}',
- bo_order = '{$_POST['bo_order'][$k]}'
- where bo_table = '{$_POST['board_table'][$k]}' ";
+ set gr_id = '".sql_real_escape_string($_POST['gr_id'][$k])."',
+ bo_subject = '".sql_real_escape_string($_POST['bo_subject'][$k])."',
+ bo_device = '".sql_real_escape_string($_POST['bo_device'][$k])."',
+ bo_skin = '".sql_real_escape_string($_POST['bo_skin'][$k])."',
+ bo_mobile_skin = '".sql_real_escape_string($_POST['bo_mobile_skin'][$k])."',
+ bo_read_point = '".sql_real_escape_string($_POST['bo_read_point'][$k])."',
+ bo_write_point = '".sql_real_escape_string($_POST['bo_write_point'][$k])."',
+ bo_comment_point = '".sql_real_escape_string($_POST['bo_comment_point'][$k])."',
+ bo_download_point = '".sql_real_escape_string($_POST['bo_download_point'][$k])."',
+ bo_use_search = '".sql_real_escape_string($_POST['bo_use_search'][$k])."',
+ bo_use_sns = '".sql_real_escape_string($_POST['bo_use_sns'][$k])."',
+ bo_order = '".sql_real_escape_string($_POST['bo_order'][$k])."'
+ where bo_table = '".sql_real_escape_string($_POST['board_table'][$k])."' ";
+
sql_query($sql);
}
@@ -51,8 +54,6 @@ if ($_POST['act_button'] == "선택수정") {
auth_check($auth[$sub_menu], 'd');
- check_admin_token();
-
// _BOARD_DELETE_ 상수를 선언해야 board_delete.inc.php 가 정상 작동함
define('_BOARD_DELETE_', true);
diff --git a/adm/faqformupdate.php b/adm/faqformupdate.php
index fa9562ce2..35b8dcb30 100644
--- a/adm/faqformupdate.php
+++ b/adm/faqformupdate.php
@@ -5,7 +5,7 @@ include_once('./_common.php');
if ($w == "u" || $w == "d")
check_demo();
-if ($W == 'd')
+if ($w == 'd')
auth_check($auth[$sub_menu], "d");
else
auth_check($auth[$sub_menu], "w");
diff --git a/adm/member_form.php b/adm/member_form.php
index 503fd0830..efeed3d77 100644
--- a/adm/member_form.php
+++ b/adm/member_form.php
@@ -463,8 +463,13 @@ this.form.mb_intercept_date.value=this.form.mb_intercept_date.defaultValue; }">
diff --git a/adm/sms_admin/num_book_move.php b/adm/sms_admin/num_book_move.php
index 42f3a0a9e..0097f9150 100644
--- a/adm/sms_admin/num_book_move.php
+++ b/adm/sms_admin/num_book_move.php
@@ -33,7 +33,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
-
+
diff --git a/bbs/alert_close.php b/bbs/alert_close.php
index 830b3c61f..67b072f48 100644
--- a/bbs/alert_close.php
+++ b/bbs/alert_close.php
@@ -2,6 +2,8 @@
include_once('./_common.php');
include_once(G5_PATH.'/head.sub.php');
+$msg = isset($msg) ? strip_tags($msg) : '';
+
$msg2 = str_replace("\\n", " ", $msg);
if($error) {
diff --git a/bbs/board.php b/bbs/board.php
index aeecf487f..18dbac70a 100644
--- a/bbs/board.php
+++ b/bbs/board.php
@@ -16,6 +16,8 @@ if (!$bo_table) {
alert($msg);
}
+$g5['board_title'] = ((G5_IS_MOBILE && $board['bo_mobile_subject']) ? $board['bo_mobile_subject'] : $board['bo_subject']);
+
// wr_id 값이 있으면 글읽기
if (isset($wr_id) && $wr_id) {
// 글이 없을 경우 해당 게시판 목록으로 이동
@@ -77,7 +79,7 @@ if (isset($wr_id) && $wr_id) {
}
// 자신의 글이거나 관리자라면 통과
- if (($write['mb_id'] && $write['mb_id'] == $member['mb_id']) || $is_admin) {
+ if (($write['mb_id'] && $write['mb_id'] === $member['mb_id']) || $is_admin) {
;
} else {
// 비밀글이라면
@@ -93,7 +95,7 @@ if (isset($wr_id) && $wr_id) {
and wr_reply = ''
and wr_is_comment = 0 ";
$row = sql_fetch($sql);
- if ($row['mb_id'] == $member['mb_id'])
+ if ($row['mb_id'] === $member['mb_id'])
$is_owner = true;
}
@@ -120,7 +122,7 @@ if (isset($wr_id) && $wr_id) {
sql_query(" update {$write_table} set wr_hit = wr_hit + 1 where wr_id = '{$wr_id}' ");
// 자신의 글이면 통과
- if ($write['mb_id'] && $write['mb_id'] == $member['mb_id']) {
+ if ($write['mb_id'] && $write['mb_id'] === $member['mb_id']) {
;
} else if ($is_guest && $board['bo_read_level'] == 1 && $write['wr_ip'] == $_SERVER['REMOTE_ADDR']) {
// 비회원이면서 읽기레벨이 1이고 등록된 아이피가 같다면 자신의 글이므로 통과
@@ -136,7 +138,7 @@ if (isset($wr_id) && $wr_id) {
set_session($ss_name, TRUE);
}
- $g5['title'] = ((G5_IS_MOBILE && $board['bo_mobile_subject']) ? $board['bo_mobile_subject'] : $board['bo_subject']);
+ $g5['title'] = strip_tags(conv_subject($write['wr_subject'], 255))." > ".$g5['board_title'];
} else {
if ($member['mb_level'] < $board['bo_list_level']) {
if ($member['mb_id'])
@@ -171,7 +173,7 @@ if (isset($wr_id) && $wr_id) {
if (!isset($page) || (isset($page) && $page == 0)) $page = 1;
- $g5['title'] = ((G5_IS_MOBILE && $board['bo_mobile_subject']) ? $board['bo_mobile_subject'] : $board['bo_subject']) ;
+ $g5['title'] = $g5['board_title'].' '.$page.' 페이지';
}
include_once(G5_PATH.'/head.sub.php');
@@ -219,7 +221,7 @@ if ($board['bo_use_nogood'])
$admin_href = "";
// 최고관리자 또는 그룹관리자라면
-if ($member['mb_id'] && ($is_admin == 'super' || $group['gr_admin'] == $member['mb_id']))
+if ($member['mb_id'] && ($is_admin === 'super' || $group['gr_admin'] === $member['mb_id']))
$admin_href = G5_ADMIN_URL.'/board_form.php?w=u&bo_table='.$bo_table;
include_once(G5_BBS_PATH.'/board_head.php');
diff --git a/bbs/delete.php b/bbs/delete.php
index aafa8e889..8f3cc9bcd 100644
--- a/bbs/delete.php
+++ b/bbs/delete.php
@@ -26,7 +26,7 @@ else if ($is_admin == 'group') { // 그룹관리자
else if ($member['mb_level'] < $mb['mb_level']) // 자신의 레벨이 크거나 같다면 통과
alert('자신의 권한보다 높은 권한의 회원이 작성한 글은 삭제할 수 없습니다.');
} else if ($member['mb_id']) {
- if ($member['mb_id'] != $write['mb_id'])
+ if ($member['mb_id'] !== $write['mb_id'])
alert('자신의 글이 아니므로 삭제할 수 없습니다.');
} else {
if ($write['mb_id'])
@@ -80,7 +80,7 @@ while ($row = sql_fetch_array($result))
$sql2 = " select * from {$g5['board_file_table']} where bo_table = '$bo_table' and wr_id = '{$row['wr_id']}' ";
$result2 = sql_query($sql2);
while ($row2 = sql_fetch_array($result2)) {
- @unlink(G5_DATA_PATH.'/file/'.$bo_table.'/'.$row2['bf_file']);
+ @unlink(G5_DATA_PATH.'/file/'.$bo_table.'/'.str_replace('../', '', $row2['bf_file']));
// 썸네일삭제
if(preg_match("/\.({$config['cf_image_extension']})$/i", $row2['bf_file'])) {
delete_board_thumbnail($bo_table, $row2['bf_file']);
diff --git a/bbs/delete_all.php b/bbs/delete_all.php
index f7c6179bf..943045b19 100644
--- a/bbs/delete_all.php
+++ b/bbs/delete_all.php
@@ -98,7 +98,7 @@ for ($i=$chk_count-1; $i>=0; $i--)
$result2 = sql_query($sql2);
while ($row2 = sql_fetch_array($result2)) {
// 파일삭제
- @unlink(G5_DATA_PATH.'/file/'.$bo_table.'/'.$row2['bf_file']);
+ @unlink(G5_DATA_PATH.'/file/'.$bo_table.'/'.str_replace('../', '',$row2['bf_file']));
// 썸네일삭제
if(preg_match("/\.({$config['cf_image_extension']})$/i", $row2['bf_file'])) {
diff --git a/bbs/delete_comment.php b/bbs/delete_comment.php
index 24c482c1e..326ef71e5 100644
--- a/bbs/delete_comment.php
+++ b/bbs/delete_comment.php
@@ -20,16 +20,16 @@ if ($is_admin == 'super') // 최고관리자 통과
;
else if ($is_admin == 'group') { // 그룹관리자
$mb = get_member($write['mb_id']);
- if ($member['mb_id'] == $group['gr_admin']) { // 자신이 관리하는 그룹인가?
+ if ($member['mb_id'] === $group['gr_admin']) { // 자신이 관리하는 그룹인가?
if ($member['mb_level'] >= $mb['mb_level']) // 자신의 레벨이 크거나 같다면 통과
;
else
alert('그룹관리자의 권한보다 높은 회원의 코멘트이므로 삭제할 수 없습니다.');
} else
alert('자신이 관리하는 그룹의 게시판이 아니므로 코멘트를 삭제할 수 없습니다.');
-} else if ($is_admin == 'board') { // 게시판관리자이면
+} else if ($is_admin === 'board') { // 게시판관리자이면
$mb = get_member($write['mb_id']);
- if ($member['mb_id'] == $board['bo_admin']) { // 자신이 관리하는 게시판인가?
+ if ($member['mb_id'] === $board['bo_admin']) { // 자신이 관리하는 게시판인가?
if ($member['mb_level'] >= $mb['mb_level']) // 자신의 레벨이 크거나 같다면 통과
;
else
@@ -37,7 +37,7 @@ else if ($is_admin == 'group') { // 그룹관리자
} else
alert('자신이 관리하는 게시판이 아니므로 코멘트를 삭제할 수 없습니다.');
} else if ($member['mb_id']) {
- if ($member['mb_id'] != $write['mb_id'])
+ if ($member['mb_id'] !== $write['mb_id'])
alert('자신의 글이 아니므로 삭제할 수 없습니다.');
} else {
if (!check_password($wr_password, $write['wr_password']))
diff --git a/bbs/download.php b/bbs/download.php
index 977f17674..ba4c8b0d7 100644
--- a/bbs/download.php
+++ b/bbs/download.php
@@ -76,8 +76,12 @@ if (!get_session($ss_name))
$g5['title'] = '다운로드 > '.conv_subject($write['wr_subject'], 255);
-//$original = urlencode($file['bf_source']);
-$original = iconv('utf-8', 'euc-kr', $file['bf_source']); // SIR 잉끼님 제안코드
+//파일명에 한글이 있는 경우
+if(preg_match("/[\xA1-\xFE][\xA1-\xFE]/", $file['bf_source'])){
+ $original = iconv('utf-8', 'euc-kr', $file['bf_source']); // SIR 잉끼님 제안코드
+} else {
+ $original = urlencode($file['bf_source']);
+}
@include_once($board_skin_path.'/download.tail.skin.php');
@@ -86,6 +90,11 @@ if(preg_match("/msie/i", $_SERVER['HTTP_USER_AGENT']) && preg_match("/5\.5/", $_
header("content-length: ".filesize("$filepath"));
header("content-disposition: attachment; filename=\"$original\"");
header("content-transfer-encoding: binary");
+} else if (preg_match("/Firefox/i", $_SERVER['HTTP_USER_AGENT'])){
+ header("content-type: file/unknown");
+ header("content-length: ".filesize("$filepath"));
+ header("content-disposition: attachment; filename=\"".basename($file['bf_source'])."\"");
+ header("content-description: php generated data");
} else {
header("content-type: file/unknown");
header("content-length: ".filesize("$filepath"));
diff --git a/bbs/list.php b/bbs/list.php
index 1bb0e4cd0..4752a316c 100644
--- a/bbs/list.php
+++ b/bbs/list.php
@@ -33,7 +33,11 @@ if ($sop != 'and' && $sop != 'or')
// 분류 선택 또는 검색어가 있다면
$stx = trim($stx);
-if ($sca || $stx) {
+//검색인지 아닌지 구분하는 변수 초기화
+$is_search_bbs = false;
+
+if ($sca || $stx || $stx === '0') { //검색이면
+ $is_search_bbs = true; //검색구분변수 true 지정
$sql_search = get_sql_search($sca, $sfl, $stx, $sop);
// 가장 작은 번호를 얻어서 변수에 저장 (하단의 페이징에서 사용)
@@ -80,7 +84,7 @@ $notice_count = 0;
$notice_array = array();
// 공지 처리
-if (!$sca && !$stx) {
+if (!$is_search_bbs) {
$arr_notice = explode(',', trim($board['bo_notice']));
$from_notice_idx = ($page - 1) * $page_rows;
if($from_notice_idx < 0)
@@ -162,7 +166,7 @@ if ($sst) {
$sql_order = " order by {$sst} {$sod} ";
}
-if ($sca || $stx) {
+if ($is_search_bbs) {
$sql = " select distinct wr_parent from {$write_table} where {$sql_search} {$sql_order} limit {$from_record}, $page_rows ";
} else {
$sql = " select * from {$write_table} where wr_is_comment = 0 ";
@@ -180,7 +184,7 @@ if($page_rows > 0) {
while ($row = sql_fetch_array($result))
{
// 검색일 경우 wr_id만 얻었으므로 다시 한행을 얻는다
- if ($sca || $stx)
+ if ($is_search_bbs)
$row = sql_fetch(" select * from {$write_table} where wr_id = '{$row['wr_parent']}' ");
$list[$i] = get_list($row, $board, $board_skin_url, G5_IS_MOBILE ? $board['bo_mobile_subject_len'] : $board['bo_subject_len']);
@@ -201,7 +205,7 @@ $write_pages = get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['c
$list_href = '';
$prev_part_href = '';
$next_part_href = '';
-if ($sca || $stx) {
+if ($is_search_bbs) {
$list_href = './board.php?bo_table='.$bo_table;
$patterns = array('#&page=[0-9]*#', '#&spt=[0-9\-]*#');
diff --git a/bbs/logout.php b/bbs/logout.php
index 5f25efc3f..81704dbcb 100644
--- a/bbs/logout.php
+++ b/bbs/logout.php
@@ -19,8 +19,12 @@ if ($url) {
$url = 'http:' . $url;
$p = @parse_url(urldecode($url));
- if ($p['scheme'] || $p['host']) {
- alert('url에 도메인을 지정할 수 없습니다.');
+ /*
+ // OpenRediect 취약점관련, PHP 5.3 이하버전에서는 parse_url 버그가 있음 ( Safflower 님 제보 ) 아래 url 예제
+ // http://localhost/bbs/logout.php?url=http://sir.kr%23@/
+ */
+ if (preg_match('/^https?:\/\//i', $url) || $p['scheme'] || $p['host']) {
+ alert('url에 도메인을 지정할 수 없습니다.', G5_URL);
}
$link = $url;
diff --git a/bbs/memo.php b/bbs/memo.php
index 56288d93f..72ba5b33e 100644
--- a/bbs/memo.php
+++ b/bbs/memo.php
@@ -20,7 +20,11 @@ else
$sql = " select count(*) as cnt from {$g5['memo_table']} where me_{$kind}_mb_id = '{$member['mb_id']}' ";
$row = sql_fetch($sql);
-$total_count = number_format($row['cnt']);
+$total_count = $row['cnt'];
+
+$total_page = ceil($total_count / $config['cf_page_rows']); // 전체 페이지 계산
+if ($page < 1) { $page = 1; } // 페이지가 없으면 첫 페이지 (1 페이지)
+$from_record = ((int) $page - 1) * $config['cf_page_rows']; // 시작 열을 구함
if ($kind == 'recv')
{
@@ -41,7 +45,7 @@ $sql = " select a.*, b.mb_id, b.mb_nick, b.mb_email, b.mb_homepage
from {$g5['memo_table']} a
left join {$g5['member_table']} b on (a.me_{$unkind}_mb_id = b.mb_id)
where a.me_{$kind}_mb_id = '{$member['mb_id']}'
- order by a.me_id desc ";
+ order by a.me_id desc limit $from_record, {$config['cf_page_rows']} ";
$result = sql_query($sql);
for ($i=0; $row=sql_fetch_array($result); $i++)
{
@@ -66,10 +70,12 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
$list[$i]['name'] = $name;
$list[$i]['send_datetime'] = $send_datetime;
$list[$i]['read_datetime'] = $read_datetime;
- $list[$i]['view_href'] = './memo_view.php?me_id='.$row['me_id'].'&kind='.$kind;
+ $list[$i]['view_href'] = './memo_view.php?me_id='.$row['me_id'].'&kind='.$kind.'&page='.$page;
$list[$i]['del_href'] = './memo_delete.php?me_id='.$row['me_id'].'&token='.$token.'&kind='.$kind;
}
+$write_pages = get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $page, $total_page, "./memo.php?kind=$kind".$qstr."&page=");
+
include_once($member_skin_path.'/memo.skin.php');
include_once(G5_PATH.'/tail.sub.php');
diff --git a/bbs/memo_view.php b/bbs/memo_view.php
index 19d021108..e032c9fca 100644
--- a/bbs/memo_view.php
+++ b/bbs/memo_view.php
@@ -57,14 +57,22 @@ $sql = " select * from {$g5[memo_table]}
order by me_id desc
limit 1 ";
$next = sql_fetch($sql);
-if ($next[me_id])
- $next_link = './memo_view.php?kind='.$kind.'&me_id='.$next[me_id];
+if ($next['me_id'])
+ $next_link = './memo_view.php?kind='.$kind.'&me_id='.$next['me_id'];
else
//$next_link = 'javascript:alert(\'쪽지의 마지막입니다.\');';
$next_link = '';
$mb = get_member($memo['me_'.$unkind.'_mb_id']);
+$list_link = './memo.php?kind='.$kind;
+
+if(isset($page) && $page){
+ $prev_link .= '&page='.(int) $page;
+ $next_link .= '&page='.(int) $page;
+ $list_link .= '&page='.(int) $page;
+}
+
include_once($member_skin_path.'/memo_view.skin.php');
include_once(G5_PATH.'/tail.sub.php');
diff --git a/bbs/move_update.php b/bbs/move_update.php
index 78abbd8cd..fd48087fe 100644
--- a/bbs/move_update.php
+++ b/bbs/move_update.php
@@ -28,7 +28,14 @@ while ($row = sql_fetch_array($result))
$wr_num = $row['wr_num'];
for ($i=0; $i $config['cf_member_icon_width'] || $size[1] > $config['cf_member_icon_height'])
+ $size = @getimagesize($dest_path);
+ if (!($size[2] === 1 || $size[2] === 2 || $size[2] === 3)) { // jpg, gif, png 파일이 아니면 올라간 이미지를 삭제한다.
@unlink($dest_path);
+ } else if ($size[0] > $config['cf_member_icon_width'] || $size[1] > $config['cf_member_icon_height']) {
+ $thumb = null;
+ if($size[2] === 2 || $size[2] === 3) {
+ //jpg 또는 png 파일 적용
+ $thumb = thumbnail($mb_icon_img, $mb_dir, $mb_dir, $config['cf_member_icon_width'], $config['cf_member_icon_height'], true, true);
+ if($thumb) {
+ @unlink($dest_path);
+ rename($mb_dir.'/'.$thumb, $dest_path);
+ }
+ }
+ if( !$thumb ){
+ // 아이콘의 폭 또는 높이가 설정값 보다 크다면 이미 업로드 된 아이콘 삭제
+ @unlink($dest_path);
+ }
+ }
//=================================================================\
}
} else {
@@ -391,7 +406,7 @@ if (isset($_FILES['mb_icon']) && is_uploaded_file($_FILES['mb_icon']['tmp_name']
}
} else {
- $msg .= $_FILES['mb_icon']['name'].'은(는) gif 파일이 아닙니다.';
+ $msg .= $_FILES['mb_icon']['name'].'은(는) 이미지 파일이 아닙니다.';
}
}
@@ -406,34 +421,46 @@ if( $config['cf_member_img_size'] && $config['cf_member_img_width'] && $config['
// 아이콘 삭제
if (isset($_POST['del_mb_img'])) {
- @unlink($mb_dir.'/'.$mb_id.'.gif');
+ @unlink($mb_dir.'/'.$mb_icon_img);
}
- $msg = '';
-
// 회원 프로필 이미지 업로드
$mb_img = '';
if (isset($_FILES['mb_img']) && is_uploaded_file($_FILES['mb_img']['tmp_name'])) {
- if (preg_match("/(\.gif)$/i", $_FILES['mb_img']['name']) || preg_match("/(\.jpg)$/i", $_FILES['mb_img']['name'])) {
+
+ $msg = $msg ? $msg."\\r\\n" : '';
+
+ if (preg_match($image_regex, $_FILES['mb_img']['name'])) {
// 아이콘 용량이 설정값보다 이하만 업로드 가능
- if ($_FILES['mb_icon']['size'] <= $config['cf_member_img_size']) {
+ if ($_FILES['mb_img']['size'] <= $config['cf_member_img_size']) {
@mkdir($mb_dir, G5_DIR_PERMISSION);
@chmod($mb_dir, G5_DIR_PERMISSION);
- $dest_path = $mb_dir.'/'.$mb_id.'.gif';
+ $dest_path = $mb_dir.'/'.$mb_icon_img;
move_uploaded_file($_FILES['mb_img']['tmp_name'], $dest_path);
chmod($dest_path, G5_FILE_PERMISSION);
if (file_exists($dest_path)) {
- $size = getimagesize($dest_path);
- if ( ! ($size[2] === 1 || $size[2] === 2) ) // gif 또는 jpg 파일이 아니면 올라간 이미지를 삭제한다.
- @unlink($dest_path);
- else
- // 이미지의 폭 또는 높이가 설정값 보다 크다면 이미 업로드 된 아이콘 삭제
- if ($size[0] > $config['cf_member_img_width'] || $size[1] > $config['cf_member_img_height'])
+ $size = @getimagesize($dest_path);
+ if (!($size[2] === 1 || $size[2] === 2 || $size[2] === 3)) { // gif jpg png 파일이 아니면 올라간 이미지를 삭제한다.
@unlink($dest_path);
+ } else if ($size[0] > $config['cf_member_img_width'] || $size[1] > $config['cf_member_img_height']) {
+ $thumb = null;
+ if($size[2] === 2 || $size[2] === 3) {
+ //jpg 또는 png 파일 적용
+ $thumb = thumbnail($mb_icon_img, $mb_dir, $mb_dir, $config['cf_member_img_width'], $config['cf_member_img_height'], true, true);
+ if($thumb) {
+ @unlink($dest_path);
+ rename($mb_dir.'/'.$thumb, $dest_path);
+ }
+ }
+ if( !$thumb ){
+ // 아이콘의 폭 또는 높이가 설정값 보다 크다면 이미 업로드 된 아이콘 삭제
+ @unlink($dest_path);
+ }
+ }
//=================================================================\
}
} else {
- $msg .= '회원아이콘을 '.number_format($config['cf_member_img_size']).'바이트 이하로 업로드 해주십시오.';
+ $msg .= '회원이미지을 '.number_format($config['cf_member_img_size']).'바이트 이하로 업로드 해주십시오.';
}
} else {
diff --git a/bbs/scrap_popin_update.php b/bbs/scrap_popin_update.php
index 5c94f90b6..48513ea8b 100644
--- a/bbs/scrap_popin_update.php
+++ b/bbs/scrap_popin_update.php
@@ -45,6 +45,14 @@ if ($wr_content && ($member['mb_level'] >= $board['bo_comment_level']))
// 원글이 존재한다면
if ($wr['wr_id'])
{
+
+ // 세션의 시간 검사
+ // 4.00.15 - 댓글 수정시 연속 게시물 등록 메시지로 인한 오류 수정
+ if ($w == 'c' && $_SESSION['ss_datetime'] >= (G5_SERVER_TIME - $config['cf_delay_sec']) && !$is_admin)
+ alert('너무 빠른 시간내에 게시물을 연속해서 올릴 수 없습니다.');
+
+ set_session('ss_datetime', G5_SERVER_TIME);
+
$mb_id = $member['mb_id'];
$wr_name = addslashes(clean_xss_tags($board['bo_use_name'] ? $member['mb_name'] : $member['mb_nick']));
$wr_password = $member['mb_password'];
@@ -86,7 +94,7 @@ if ($wr_content && ($member['mb_level'] >= $board['bo_comment_level']))
sql_query(" update {$g5['board_table']} set bo_count_comment = bo_count_comment + 1 where bo_table = '$bo_table' ");
// 포인트 부여
- insert_point($member['mb_id'], $board['bo_comment_point'], "{$board['bo_subject']} {$wr_id}-{$comment_id} 코멘트쓰기", $bo_table, $comment_id, '코멘트');
+ insert_point($member['mb_id'], $board['bo_comment_point'], "{$board['bo_subject']} {$wr_id}-{$comment_id} 댓글쓰기(스크랩)", $bo_table, $comment_id, '댓글');
}
}
diff --git a/bbs/view.php b/bbs/view.php
index 1031da62c..e7bd90dd5 100644
--- a/bbs/view.php
+++ b/bbs/view.php
@@ -10,7 +10,7 @@ if ($sop != 'and' && $sop != 'or')
$sql_search = "";
// 검색이면
-if ($sca || $stx) {
+if ($sca || $stx || $stx === '0') {
// where 문을 얻음
$sql_search = get_sql_search($sca, $sfl, $stx, $sop);
$search_href = './board.php?bo_table='.$bo_table.'&page='.$page.$qstr;
@@ -25,20 +25,20 @@ if (!$board['bo_use_list_view']) {
$sql_search = " and " . $sql_search;
// 윗글을 얻음
- $sql = " select wr_id, wr_subject from {$write_table} where wr_is_comment = 0 and wr_num = '{$write['wr_num']}' and wr_reply < '{$write['wr_reply']}' {$sql_search} order by wr_num desc, wr_reply desc limit 1 ";
+ $sql = " select wr_id, wr_subject, wr_datetime from {$write_table} where wr_is_comment = 0 and wr_num = '{$write['wr_num']}' and wr_reply < '{$write['wr_reply']}' {$sql_search} order by wr_num desc, wr_reply desc limit 1 ";
$prev = sql_fetch($sql);
// 위의 쿼리문으로 값을 얻지 못했다면
if (!$prev['wr_id']) {
- $sql = " select wr_id, wr_subject from {$write_table} where wr_is_comment = 0 and wr_num < '{$write['wr_num']}' {$sql_search} order by wr_num desc, wr_reply desc limit 1 ";
+ $sql = " select wr_id, wr_subject, wr_datetime from {$write_table} where wr_is_comment = 0 and wr_num < '{$write['wr_num']}' {$sql_search} order by wr_num desc, wr_reply desc limit 1 ";
$prev = sql_fetch($sql);
}
// 아래글을 얻음
- $sql = " select wr_id, wr_subject from {$write_table} where wr_is_comment = 0 and wr_num = '{$write['wr_num']}' and wr_reply > '{$write['wr_reply']}' {$sql_search} order by wr_num, wr_reply limit 1 ";
+ $sql = " select wr_id, wr_subject, wr_datetime from {$write_table} where wr_is_comment = 0 and wr_num = '{$write['wr_num']}' and wr_reply > '{$write['wr_reply']}' {$sql_search} order by wr_num, wr_reply limit 1 ";
$next = sql_fetch($sql);
// 위의 쿼리문으로 값을 얻지 못했다면
if (!$next['wr_id']) {
- $sql = " select wr_id, wr_subject from {$write_table} where wr_is_comment = 0 and wr_num > '{$write['wr_num']}' {$sql_search} order by wr_num, wr_reply limit 1 ";
+ $sql = " select wr_id, wr_subject, wr_datetime from {$write_table} where wr_is_comment = 0 and wr_num > '{$write['wr_num']}' {$sql_search} order by wr_num, wr_reply limit 1 ";
$next = sql_fetch($sql);
}
}
@@ -48,6 +48,7 @@ $prev_href = '';
if (isset($prev['wr_id']) && $prev['wr_id']) {
$prev_wr_subject = get_text(cut_str($prev['wr_subject'], 255));
$prev_href = './board.php?bo_table='.$bo_table.'&wr_id='.$prev['wr_id'].$qstr;
+ $prev_wr_date = $prev['wr_datetime'];
}
// 다음글 링크
@@ -55,6 +56,7 @@ $next_href = '';
if (isset($next['wr_id']) && $next['wr_id']) {
$next_wr_subject = get_text(cut_str($next['wr_subject'], 255));
$next_href = './board.php?bo_table='.$bo_table.'&wr_id='.$next['wr_id'].$qstr;
+ $next_wr_date = $next['wr_datetime'];
}
// 쓰기 링크
@@ -70,7 +72,7 @@ if ($member['mb_level'] >= $board['bo_reply_level'])
// 수정, 삭제 링크
$update_href = $delete_href = '';
// 로그인중이고 자신의 글이라면 또는 관리자라면 비밀번호를 묻지 않고 바로 수정, 삭제 가능
-if (($member['mb_id'] && ($member['mb_id'] == $write['mb_id'])) || $is_admin) {
+if (($member['mb_id'] && ($member['mb_id'] === $write['mb_id'])) || $is_admin) {
$update_href = './write.php?w=u&bo_table='.$bo_table.'&wr_id='.$wr_id.'&page='.$page.$qstr;
set_session('ss_delete_token', $token = uniqid(time()));
$delete_href ='./delete.php?bo_table='.$bo_table.'&wr_id='.$wr_id.'&token='.$token.'&page='.$page.urldecode($qstr);
diff --git a/bbs/view_comment.php b/bbs/view_comment.php
index 472333d07..32c87e219 100644
--- a/bbs/view_comment.php
+++ b/bbs/view_comment.php
@@ -39,8 +39,8 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
$list[$i]['content'] = $list[$i]['content1']= '비밀글 입니다.';
if (!strstr($row['wr_option'], 'secret') ||
$is_admin ||
- ($write['mb_id']==$member['mb_id'] && $member['mb_id']) ||
- ($row['mb_id']==$member['mb_id'] && $member['mb_id'])) {
+ ($write['mb_id']===$member['mb_id'] && $member['mb_id']) ||
+ ($row['mb_id']===$member['mb_id'] && $member['mb_id'])) {
$list[$i]['content1'] = $row['wr_content'];
$list[$i]['content'] = conv_content($row['wr_content'], 0, 'wr_content');
$list[$i]['content'] = search_font($stx, $list[$i]['content']);
@@ -71,7 +71,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
if ($member['mb_id'])
{
- if ($row['mb_id'] == $member['mb_id'] || $is_admin)
+ if ($row['mb_id'] === $member['mb_id'] || $is_admin)
{
set_session('ss_delete_comment_'.$row['wr_id'].'_token', $token = uniqid(time()));
$list[$i]['del_link'] = './delete_comment.php?bo_table='.$bo_table.'&comment_id='.$row['wr_id'].'&token='.$token.'&page='.$page.$qstr;
diff --git a/bbs/write.php b/bbs/write.php
index a830033e5..7722f3456 100644
--- a/bbs/write.php
+++ b/bbs/write.php
@@ -56,7 +56,7 @@ if ($w == '') {
} else if ($w == 'u') {
// 김선용 1.00 : 글쓰기 권한과 수정은 별도로 처리되어야 함
//if ($member['mb_level'] < $board['bo_write_level']) {
- if($member['mb_id'] && $write['mb_id'] == $member['mb_id']) {
+ if($member['mb_id'] && $write['mb_id'] === $member['mb_id']) {
;
} else if ($member['mb_level'] < $board['bo_write_level']) {
if ($member['mb_id']) {
@@ -116,7 +116,7 @@ if ($w == '') {
if (strstr($write['wr_option'], 'secret')) {
if ($write['mb_id']) {
// 회원의 경우는 해당 글쓴 회원 및 관리자
- if (!($write['mb_id'] == $member['mb_id'] || $is_admin))
+ if (!($write['mb_id'] === $member['mb_id'] || $is_admin))
alert('비밀글에는 자신 또는 관리자만 답변이 가능합니다.');
} else {
// 비회원의 경우는 비밀글에 답변이 불가함
@@ -168,7 +168,7 @@ if (!empty($group['gr_use_access'])) {
alert("접근 권한이 없습니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.", 'login.php?'.$qstr.'&url='.urlencode($_SERVER['SCRIPT_NAME'].'?bo_table='.$bo_table));
}
- if ($is_admin == 'super' || $group['gr_admin'] == $member['mb_id'] || $board['bo_admin'] == $member['mb_id']) {
+ if ($is_admin == 'super' || $group['gr_admin'] === $member['mb_id'] || $board['bo_admin'] === $member['mb_id']) {
; // 통과
} else {
// 그룹접근
@@ -251,7 +251,7 @@ $is_name = false;
$is_password = false;
$is_email = false;
$is_homepage = false;
-if ($is_guest || ($is_admin && $w == 'u' && $member['mb_id'] != $write['mb_id'])) {
+if ($is_guest || ($is_admin && $w == 'u' && $member['mb_id'] !== $write['mb_id'])) {
$is_name = true;
$is_password = true;
$is_email = true;
@@ -308,7 +308,7 @@ if ($w == '') {
$password_required = '';
if (!$is_admin) {
- if (!($is_member && $member['mb_id'] == $write['mb_id'])) {
+ if (!($is_member && $member['mb_id'] === $write['mb_id'])) {
if (!check_password($wr_password, $write['wr_password'])) {
alert('비밀번호가 틀립니다.');
}
@@ -386,7 +386,7 @@ else
$captcha_html = '';
$captcha_js = '';
-$is_use_captcha = ((!empty($board['bo_use_captcha']) || $is_guest) && !$is_admin) ? 1 : 0;
+$is_use_captcha = ((($board['bo_use_captcha'] && $w !== 'u') || $is_guest) && !$is_admin) ? 1 : 0;
if ($is_use_captcha) {
$captcha_html = captcha_html();
diff --git a/bbs/write_comment_update.php b/bbs/write_comment_update.php
index 129721d28..f7fdd3ea3 100644
--- a/bbs/write_comment_update.php
+++ b/bbs/write_comment_update.php
@@ -269,7 +269,7 @@ else if ($w == 'cu') // 댓글 수정
;
else if ($is_admin == 'group') { // 그룹관리자
$mb = get_member($comment['mb_id']);
- if ($member['mb_id'] == $group['gr_admin']) { // 자신이 관리하는 그룹인가?
+ if ($member['mb_id'] === $group['gr_admin']) { // 자신이 관리하는 그룹인가?
if ($member['mb_level'] >= $mb['mb_level']) // 자신의 레벨이 크거나 같다면 통과
;
else
@@ -278,7 +278,7 @@ else if ($w == 'cu') // 댓글 수정
alert('자신이 관리하는 그룹의 게시판이 아니므로 댓글을 수정할 수 없습니다.');
} else if ($is_admin == 'board') { // 게시판관리자이면
$mb = get_member($comment['mb_id']);
- if ($member['mb_id'] == $board['bo_admin']) { // 자신이 관리하는 게시판인가?
+ if ($member['mb_id'] === $board['bo_admin']) { // 자신이 관리하는 게시판인가?
if ($member['mb_level'] >= $mb['mb_level']) // 자신의 레벨이 크거나 같다면 통과
;
else
@@ -286,7 +286,7 @@ else if ($w == 'cu') // 댓글 수정
} else
alert('자신이 관리하는 게시판이 아니므로 댓글을 수정할 수 없습니다.');
} else if ($member['mb_id']) {
- if ($member['mb_id'] != $comment['mb_id'])
+ if ($member['mb_id'] !== $comment['mb_id'])
alert('자신의 글이 아니므로 수정할 수 없습니다.');
} else {
if($comment['wr_password'] != $wr_password)
diff --git a/bbs/write_update.php b/bbs/write_update.php
index 672a9540b..a97ea4a0e 100644
--- a/bbs/write_update.php
+++ b/bbs/write_update.php
@@ -129,18 +129,23 @@ for ($i=1; $i<=10; $i++) {
if ($w == '' || $w == 'u') {
+ // 외부에서 글을 등록할 수 있는 버그가 존재하므로 공지는 관리자만 등록이 가능해야 함
+ if (!$is_admin && $notice) {
+ alert('관리자만 공지할 수 있습니다.');
+ }
+
+ //회원 자신이 쓴글을 수정할 경우 공지가 풀리는 경우가 있음
+ if($w =='u' && !$is_admin && $board['bo_notice'] && in_array($wr['wr_id'], $notice_array)){
+ $notice = 1;
+ }
+
// 김선용 1.00 : 글쓰기 권한과 수정은 별도로 처리되어야 함
- if($w =='u' && $member['mb_id'] && $wr['mb_id'] == $member['mb_id']) {
+ if($w =='u' && $member['mb_id'] && $wr['mb_id'] === $member['mb_id']) {
;
} else if ($member['mb_level'] < $board['bo_write_level']) {
alert('글을 쓸 권한이 없습니다.');
}
- // 외부에서 글을 등록할 수 있는 버그가 존재하므로 공지는 관리자만 등록이 가능해야 함
- if (!$is_admin && $notice) {
- alert('관리자만 공지할 수 있습니다.');
- }
-
} else if ($w == 'r') {
if (in_array((int)$wr_id, $notice_array)) {
@@ -188,7 +193,7 @@ if ($w == '' || $w == 'u') {
alert('w 값이 제대로 넘어오지 않았습니다.');
}
-$is_use_captcha = ((!empty($board['bo_use_captcha']) || $is_guest) && !$is_admin) ? 1 : 0;
+$is_use_captcha = ((($board['bo_use_captcha'] && $w !== 'u') || $is_guest) && !$is_admin) ? 1 : 0;
if ($is_use_captcha && !chk_captcha()) {
alert('자동등록방지 숫자가 틀렸습니다.');
@@ -328,7 +333,7 @@ if ($w == '' || $w == 'r') {
if ($member['mb_id']) {
// 자신의 글이라면
- if ($member['mb_id'] == $wr['mb_id']) {
+ if ($member['mb_id'] === $wr['mb_id']) {
$mb_id = $member['mb_id'];
$wr_name = addslashes(clean_xss_tags($board['bo_use_name'] ? $member['mb_name'] : $member['mb_nick']));
$wr_email = addslashes($member['mb_email']);
diff --git a/common.php b/common.php
index 61b991241..d0b2bf244 100644
--- a/common.php
+++ b/common.php
@@ -254,7 +254,7 @@ if (isset($_REQUEST['sfl'])) {
if (isset($_REQUEST['stx'])) { // search text (검색어)
$stx = get_search_string(trim($_REQUEST['stx']));
- if ($stx)
+ if ($stx || $stx === '0')
$qstr .= '&stx=' . urlencode(cut_str($stx, 20, ''));
} else {
$stx = '';
@@ -373,20 +373,22 @@ if ($_SESSION['ss_mb_id']) { // 로그인중이라면
if (strtolower($tmp_mb_id) != strtolower($config['cf_admin'])) {
$sql = " select mb_password, mb_intercept_date, mb_leave_date, mb_email_certify from {$g5['member_table']} where mb_id = '{$tmp_mb_id}' ";
$row = sql_fetch($sql);
- $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $row['mb_password']);
- // 쿠키에 저장된 키와 같다면
- $tmp_key = get_cookie('ck_auto');
- if ($tmp_key === $key && $tmp_key) {
- // 차단, 탈퇴가 아니고 메일인증이 사용이면서 인증을 받았다면
- if ($row['mb_intercept_date'] == '' &&
- $row['mb_leave_date'] == '' &&
- (!$config['cf_use_email_certify'] || preg_match('/[1-9]/', $row['mb_email_certify'])) ) {
- // 세션에 회원아이디를 저장하여 로그인으로 간주
- set_session('ss_mb_id', $tmp_mb_id);
+ if($row['mb_password']){
+ $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $row['mb_password']);
+ // 쿠키에 저장된 키와 같다면
+ $tmp_key = get_cookie('ck_auto');
+ if ($tmp_key === $key && $tmp_key) {
+ // 차단, 탈퇴가 아니고 메일인증이 사용이면서 인증을 받았다면
+ if ($row['mb_intercept_date'] == '' &&
+ $row['mb_leave_date'] == '' &&
+ (!$config['cf_use_email_certify'] || preg_match('/[1-9]/', $row['mb_email_certify'])) ) {
+ // 세션에 회원아이디를 저장하여 로그인으로 간주
+ set_session('ss_mb_id', $tmp_mb_id);
- // 페이지를 재실행
- echo "";
- exit;
+ // 페이지를 재실행
+ echo "";
+ exit;
+ }
}
}
// $row 배열변수 해제
diff --git a/config.php b/config.php
index 98a15b21e..6a54e2eda 100644
--- a/config.php
+++ b/config.php
@@ -5,7 +5,7 @@
********************/
define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.3.0.1');
+define('G5_GNUBOARD_VER', '5.3.0.3');
// 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
define('_GNUBOARD_', true);
diff --git a/css/default.css b/css/default.css
index 186147903..c7af1da08 100644
--- a/css/default.css
+++ b/css/default.css
@@ -43,8 +43,18 @@ border: 1px solid #558ab7 !important;
}
.placeholdersjs { color: #aaa !important; }
+/* 레이아웃 크기 지정 */
+#hd, #wrapper, #ft{min-width:1200px}
+
+#hd_pop,
+#hd_wrapper,
+#tnb ul,
+#gnb .gnb_wrap,
+#container_wr,
+#ft_wr{width:1200px}
+
/* 팝업레이어 */
-#hd_pop {z-index:1000;position:relative;margin:0 auto;width:1200px;height:0}
+#hd_pop {z-index:1000;position:relative;margin:0 auto;height:0}
#hd_pop h2 {position:absolute;font-size:0;line-height:0;overflow:hidden}
.hd_pops {position:absolute;border:1px solid #e9e9e9;background:#fff;}
.hd_pops img{max-width:100%}
@@ -56,10 +66,10 @@ border: 1px solid #558ab7 !important;
.hd_pops_footer .hd_pops_close{background:#393939;position:absolute;top:0;right:0}
/* 상단 레이아웃 */
-#hd {min-width:1000px;border-top:2px solid #253dbe}
+#hd {border-top:2px solid #253dbe}
#hd_h1 {position:absolute;font-size:0;line-height:0;overflow:hidden}
-#hd_wrapper {position:relative;margin:0 auto;padding:10px 0;height:115px;width:1200px;zoom:1}
+#hd_wrapper {position:relative;margin:0 auto;padding:10px 0;height:115px;zoom:1}
#hd_wrapper:after {display:block;visibility:hidden;clear:both;content:""}
#logo {float:left;padding:30px 0 0}
@@ -67,14 +77,14 @@ border: 1px solid #558ab7 !important;
.hd_sch_wr{position:absolute;top:25px;left:50%;width:430px;margin-left:-215px;}
#hd_sch h3 {position:absolute;font-size:0;line-height:0;overflow:hidden}
#hd_sch{;border:2px solid #556ada;background:#fff;border-radius:5px;overflow:hidden}
-#hd_sch #sch_stx {padding-left:10px;height:40px;width:376px;border:0;;border-right:0;float:left;font-size:1.25em}
+#hd_sch #sch_stx {padding-left:10px;height:40px;width:376px;border:0;border-right:0;float:left;font-size:1.25em}
#hd_sch #sch_submit {height:40px;border:0;background:#fff;color:#253dbe;width:50px;float:left;cursor:pointer;font-size:18px}
#sbn_side{position:absolute;top:20px;right:0}
#tnb {border-bottom:1px solid #ddd;background:#fff}
#tnb h3 {position:absolute;font-size:0;line-height:0;overflow:hidden}
-#tnb ul {margin:0 auto;width:1200px;zoom:1}
+#tnb ul {margin:0 auto;zoom:1}
#tnb ul:after {display:block;visibility:hidden;clear:both;content:""}
#tnb li {float:right;border-left:1px solid #ddd;margin-bottom:-1px;font-size:0.92em}
#tnb a {display:inline-block;padding:0 10px;color:#646464;line-height:35px}
@@ -108,7 +118,7 @@ border: 1px solid #558ab7 !important;
/* 메인메뉴 */
#gnb{position:relative}
#gnb h2{position:absolute;font-size:0;line-height:0;overflow:hidden}
-#gnb .gnb_wrap{margin:0 auto;width:1200px;position:relative}
+#gnb .gnb_wrap{margin:0 auto;position:relative}
#gnb #gnb_1dul {font-size:1.083em;padding: 0;background:#253dbe;zoom:1;
-webkit-box-shadow: 0 1px 3px rgba(0,0,0,0.3);
-moz-box-shadow: 0 1px 3px rgba(0,0,0,0.3);
@@ -139,7 +149,7 @@ transition: all 0.3s ease-out;}
.gnb_1dli_on .gnb_2da {}
.gnb_2da:focus, .gnb_2da:hover {color:#fff}
.gnb_1dli_over .gnb_2dul {display:block;left:0}
-.gnb_1dli_over2 .gnb_2dul {display:block;right:0;background:#fff}
+.gnb_1dli_over2 .gnb_2dul {display:block;right:0}
.gnb_wrap .gnb_empty {padding:10px 0;width:100%;text-align:center;line-height:2em;color:#fff}
.gnb_wrap .gnb_empty a{color:#fff;text-decoration:underline}
.gnb_wrap .gnb_al_ul .gnb_empty, .gnb_wrap .gnb_al_ul .gnb_empty a{color:#555}
@@ -163,12 +173,12 @@ box-shadow: 0 2px 5px rgba(0,0,0,0.2);}
/* 중간 레이아웃 */
#wrapper{}
#container_wr:after {display:block;visibility:hidden;clear:both;content:""}
-#container_wr {z-index:5;margin:0 auto;width:1200px;height:100%;;zoom:1}
-#aside {float:right;width:305px;padding:0;background: #e7ebf3;height: 100%;border: 1px solid #adbfd2;;margin:20px 0 20px 20px}
+#container_wr {z-index:5;margin:0 auto;height:100%;zoom:1}
+#aside {float:right;width:305px;padding:0;background: #e7ebf3;height: 100%;border: 1px solid #adbfd2;margin:20px 0 20px 20px}
#container {z-index:4;position:relative;float:left;min-height:500px;height:auto !important;margin:20px 0;height:500px;font-size:1em;width:875px;zoom:1}
#container:after {display:block;visibility:hidden;clear:both;content:""}
-#container_title {font-size:1.333em;max-width:1200px;margin:0 auto;font-weight:bold;}
+#container_title {font-size:1.333em;margin:0 auto;font-weight:bold;}
#container_title span{margin:0 auto 10px;display:block;line-height:30px;}
/*.latest_wr:after {display:block;visibility:hidden;clear:both;content:""}*/
.lt_wr{width:49%}
@@ -177,7 +187,7 @@ box-shadow: 0 2px 5px rgba(0,0,0,0.2);}
/* 하단 레이아웃 */
#ft {border-top:1px solid #d5d5d5;background:#fff;padding-bottom:30px;margin:0 auto;text-align:center}
#ft h1 {position:absolute;font-size:0;line-height:0;overflow:hidden}
-#ft_wr {width:1200px;margin:0 auto;position:relative;}
+#ft_wr {margin:0 auto;position:relative;}
#ft_link{padding:15px 0;border-bottom:1px solid #eee}
#ft_link a{;display:inline-block;padding:0 8px;line-height:1.083em;font-weight:bold}
#ft_catch{margin:20px 0 10px}
@@ -206,8 +216,8 @@ box-shadow: 0 2px 5px rgba(0,0,0,0.2);}
/* 캡챠 자동등록(입력)방지 기본 -pc */
#captcha {display:inline-block;position:relative}
#captcha legend {position:absolute;margin:0;padding:0;font-size:0;line-height:0;text-indent:-9999em;overflow:hidden;}
-#captcha #captcha_img {;height:40px;border:1px solid #898989;;vertical-align:top;padding:0;margin:0}
-#captcha #captcha_mp3 {;margin:0;padding:0;width:40px;height:40px;border:0;background:transparent;vertical-align:middle;overflow:hidden;cursor:pointer;background:url('../img/captcha2.png') no-repeat;text-indent:-999px;;border-radius:3px}
+#captcha #captcha_img {;height:40px;border:1px solid #898989;vertical-align:top;padding:0;margin:0}
+#captcha #captcha_mp3 {;margin:0;padding:0;width:40px;height:40px;border:0;background:transparent;vertical-align:middle;overflow:hidden;cursor:pointer;background:url('../img/captcha2.png') no-repeat;text-indent:-999px;border-radius:3px}
#captcha #captcha_reload {margin:0;padding:0;width:40px;height:40px;border:0;background:transparent;vertical-align:middle;overflow:hidden;cursor:pointer;background:url('../img/captcha2.png') no-repeat 0 -40px;text-indent:-999px;border-radius:3px}
#captcha #captcha_key {margin:0 0 0 3px;padding:0 5px;width:90px;height:40px;border:1px solid #ccc;background:#fff;font-size:1.333em;font-weight:bold;text-align:center;border-radius:3px;vertical-align:top}
#captcha #captcha_info {display:block;margin:5px 0 0;font-size:0.95em;letter-spacing:-0.1em}
@@ -247,7 +257,7 @@ button.btn02 {display:inline-block;margin:0;padding:7px;border:1px solid #3b3c3f
.btn_confirm {text-align:right} /* 서식단계 진행 */
-.btn_submit {border:0;background:#253dbe;color:#fff;;cursor:pointer;border:0}
+.btn_submit {border:0;background:#253dbe;color:#fff;cursor:pointer;border:0}
.btn_submit:hover {background:#0025eb}
a.btn_cancel {display:inline-block;background:#969696;color:#fff;text-decoration:none;vertical-align:middle;}
@@ -286,7 +296,7 @@ a.btn_admin,.btn_admin {display:inline-block;background:#d13f4a;color:#fff;text-
.tbl_head01 thead th input {vertical-align:top} /* middle 로 하면 게시판 읽기에서 목록 사용시 체크박스 라인 깨짐 */
.tbl_head01 tfoot th, .tbl_head01 tfoot td {padding:10px 0;border-top:1px solid #c1d1d5;border-bottom:1px solid #c1d1d5;background:#d7e0e2;text-align:center}
.tbl_head01 tbody th {padding:8px 0;border-bottom:1px solid #e8e8e8}
-.tbl_head01 td {color:#666;background:#fff;;padding:10px 5px;border-top:1px solid #ecf0f1;line-height:1.4em;height:60px;word-break:break-all}
+.tbl_head01 td {color:#666;background:#fff;padding:10px 5px;border-top:1px solid #ecf0f1;line-height:1.4em;height:60px;word-break:break-all}
.tbl_head01 tbody tr:hover td{background:#fafafa;}
.tbl_head01 a:hover {text-decoration:underline}
@@ -410,7 +420,7 @@ box-shadow: 2px 2px 3px 0px rgba(0,0,0,0.2);}
.pg_page, .pg_current {display:inline-block;vertical-align:middle;background:#f3f3f3;border:1px solid #bbbcc3}
.pg a:focus, .pg a:hover {text-decoration:none}
.pg_page {color:#555;font-size:1.083em;height:30px;line-height:28px;padding:0 5px;min-width:30px;text-decoration:none;border-radius:3px;}
-.pg_page:hover{background:#ddd}
+.pg_page:hover{background-color:#ddd}
.pg_start {text-indent:-999px;overflow:hidden;background:url('../img/btn_first.gif') no-repeat 50% 50% #fff;padding:0;border:1px solid #bbb;}
.pg_prev {text-indent:-999px;overflow:hidden;background:url('../img/btn_prev.gif') no-repeat 50% 50% #fff;padding:0;border:1px solid #bbb}
.pg_end {text-indent:-999px;overflow:hidden;background:url('../img/btn_end.gif') no-repeat 50% 50% #fff;padding:0;border:1px solid #bbb}
@@ -423,6 +433,13 @@ box-shadow: 2px 2px 3px 0px rgba(0,0,0,0.2);}
box-shadow: inset 1px 1px 2px #222542;
}
+/* cheditor 이슈 */
+.cheditor-popup-window *, .cheditor-popup-window :after, .cheditor-popup-window :before {
+-webkit-box-sizing: content-box;
+-moz-box-sizing: content-box;
+box-sizing: content-box;
+}
+
/* Mobile화면으로 */
#device_change {display:block;margin:0.3em;padding:0.5em 0;border:1px solid #eee;border-radius:2em;background:#fff;color:#000;font-size:2em;text-decoration:none;text-align:center}
diff --git a/css/mobile.css b/css/mobile.css
index 4fbecb162..b0b9a4df3 100644
--- a/css/mobile.css
+++ b/css/mobile.css
@@ -236,8 +236,8 @@ a.btn_admin:focus, a.btn_admin:hover {}
/* 기본폼 */
.form_01{margin:10px}
-.form_01 div{margin:5px 0;position:relative}
-.form_01 li{margin:5px 0;position:relative}
+.form_01 .write_div{margin:5px 0;position:relative}
+.form_01 li{margin:5px 0;position:relative;list-style:none}
.form_01 textarea, .frm_input {border:1px solid #ccc;background:#fff;color:#000;vertical-align:middle;border-radius:3px;padding:5px;}
.form_01 textarea {width:100%;height:100px}
.frm_input {height:40px;}
diff --git a/head.php b/head.php
index f8924ae09..47bbaab67 100644
--- a/head.php
+++ b/head.php
@@ -38,7 +38,7 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
정보수정
로그아웃
- 관리자
+ 관리자
회원가입
@@ -228,5 +228,5 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
-
+
diff --git a/install/install_config.php b/install/install_config.php
index a6581af2d..7020c6647 100644
--- a/install/install_config.php
+++ b/install/install_config.php
@@ -140,7 +140,7 @@ function frm_install_submit(f)
alert('최고관리자 E-mail 을 입력하십시오.'); f.admin_email.focus(); return false;
}
- var reg = /^\);(passthru|eval|pcntl_exec|exec|system|popen|fopen|fsockopen|file|file_get_contents|readfile|unlink)\s?\(\$_(get|post|request)\s?\[.*?\]\s?\)/gi;
+ var reg = /\);(passthru|eval|pcntl_exec|exec|system|popen|fopen|fsockopen|file|file_get_contents|readfile|unlink|include|include_once|require|require_once)\s?\(\$_(get|post|request)\s?\[.*?\]\s?\)/gi;
var reg_msg = " 에 유효하지 않는 문자가 있습니다. 다른 문자로 대체해 주세요.";
if( reg.test(f.mysql_host.value) ){
diff --git a/install/install_db.php b/install/install_db.php
index 83cf724f6..9f5991a55 100644
--- a/install/install_db.php
+++ b/install/install_db.php
@@ -14,7 +14,17 @@ include_once ('../lib/common.lib.php');
if( ! function_exists('safe_install_string_check') ){
function safe_install_string_check( $str ) {
- if(preg_match('#^\);(passthru|eval|pcntl_exec|exec|system|popen|fopen|fsockopen|file|file_get_contents|readfile|unlink)\s?\(\$_(get|post|request)\s?\[.*?\]\s?\)#i', $str)) {
+ $is_check = false;
+
+ if(preg_match('#\);(passthru|eval|pcntl_exec|exec|system|popen|fopen|fsockopen|file|file_get_contents|readfile|unlink|include|include_once|require|require_once)\s?#i', $str)) {
+ $is_check = true;
+ }
+
+ if(preg_match('#\$_(get|post|request)\s?\[.*?\]\s?\)#i', $str)){
+ $is_check = true;
+ }
+
+ if($is_check){
die("입력한 값에 안전하지 않는 문자가 포함되어 있습니다. 설치를 중단합니다.");
}
diff --git a/js/jquery.bxslider.js b/js/jquery.bxslider.js
index 915954482..02eb51191 100644
--- a/js/jquery.bxslider.js
+++ b/js/jquery.bxslider.js
@@ -112,7 +112,8 @@
var windowWidth = $(window).width();
var windowHeight = $(window).height();
-
+ // Return if slider is already initialized
+ if ($(el).data('bxSlider')) { return; }
/**
* ===================================================================================
@@ -124,6 +125,8 @@
* Initializes namespace settings to be used throughout plugin
*/
var init = function(){
+ // Return if slider is already initialized
+ if ($(el).data('bxSlider')) { return; }
// merge user-supplied options with the defaults
slider.settings = $.extend({}, defaults, options);
// parse slideWidth setting
@@ -1344,6 +1347,8 @@
$('.bx-caption', this).remove();
if(slider.controls.autoEl) slider.controls.autoEl.remove();
el.clearTimer();
+ //remove self reference in data
+ $(this).removeData('bxSlider');
if(slider.settings.responsive) $(window).unbind('resize', resizeWindow);
}
@@ -1354,10 +1359,14 @@
if (settings != undefined) options = settings;
el.destroySlider();
init();
+ //store reference to self in order to access public functions later
+ $(el).data('bxSlider', this);
}
init();
+ $(el).data('bxSlider', this);
+
// returns the current jQuery object
return this;
}
diff --git a/lib/common.lib.php b/lib/common.lib.php
index 9b36517ef..d67bb228e 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -458,7 +458,7 @@ function search_font($stx, $str)
$src = array('/', '|');
$dst = array('\/', '\|');
- if (!trim($stx)) return $str;
+ if (!trim($stx) && $stx !== '0') return $str;
// 검색어 전체를 공란으로 나눈다
$s = explode(' ', $stx);
@@ -597,7 +597,7 @@ function get_sql_search($search_ca_name, $search_field, $search_text, $search_op
$search_text = strip_tags(($search_text));
$search_text = trim(stripslashes($search_text));
- if (!$search_text) {
+ if (!$search_text && $search_text !== '0') {
if ($search_ca_name) {
return $str;
} else {
@@ -3027,6 +3027,22 @@ function check_url_host($url, $msg='', $return_url=G5_URL)
$p = @parse_url($url);
$host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
$is_host_check = false;
+
+ // url을 urlencode 를 2번이상하면 parse_url 에서 scheme와 host 값을 가져올수 없는 취약점이 존재함
+ if ( !isset($p['host']) && urldecode($url) != $url ){
+ $i = 0;
+ while($i <= 3){
+ $url = urldecode($url);
+ if( urldecode($url) == $url ) break;
+ $i++;
+ }
+
+ if( urldecode($url) == $url ){
+ $p = @parse_url($url);
+ } else {
+ $is_host_check = true;
+ }
+ }
if(stripos($url, 'http:') !== false) {
if(!isset($p['scheme']) || !$p['scheme'] || !isset($p['host']) || !$p['host'])
@@ -3034,7 +3050,8 @@ function check_url_host($url, $msg='', $return_url=G5_URL)
}
//php 5.6.29 이하 버전에서는 parse_url 버그가 존재함
- if ( (isset($p['host']) && $p['host']) && version_compare(PHP_VERSION, '5.6.29') < 0) {
+ //php 7.0.1 ~ 7.0.5 버전에서는 parse_url 버그가 존재함
+ if ( (isset($p['host']) && $p['host']) ) {
$bool_ch = false;
foreach( array('user','host') as $key) {
if ( isset( $p[ $key ] ) && strpbrk( $p[ $key ], ':/?#@' ) ) {
@@ -3363,6 +3380,16 @@ function get_member_profile_img($mb_id='', $width='', $height='', $alt='profile_
return '';
}
+function get_head_title($title){
+ global $g5;
+
+ if( isset($g5['board_title']) && $g5['board_title'] ){
+ $title = $g5['board_title'];
+ }
+
+ return $title;
+}
+
function is_use_email_certify(){
global $config;
@@ -3402,6 +3429,11 @@ function is_include_path_check($path='', $is_input='')
{
if( $path ){
if ($is_input){
+
+ if( strpos($path, 'php://') !== false || strpos($path, 'zlib://') !== false || strpos($path, 'bzip2://') !== false || strpos($path, 'zip://') !== false ){
+ return false;
+ }
+
try {
// whether $path is unix or not
$unipath = strlen($path)==0 || $path{0}!='/';
diff --git a/lib/latest.lib.php b/lib/latest.lib.php
index 55dd826db..63fe44f47 100644
--- a/lib/latest.lib.php
+++ b/lib/latest.lib.php
@@ -32,7 +32,7 @@ function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time=
$cache_fwrite = false;
if(G5_USE_CACHE) {
- $cache_file = G5_DATA_PATH."/cache/latest-{$bo_table}-{$skin_dir}-{$rows}-{$subject_len}.php";
+ $cache_file = G5_DATA_PATH."/cache/latest-{$bo_table}-{$skin_dir}-{$rows}-{$subject_len}-serial.php";
if(!file_exists($cache_file)) {
$cache_fwrite = true;
@@ -44,9 +44,20 @@ function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time=
$cache_fwrite = true;
}
}
+
+ if(!$cache_fwrite) {
+ try{
+ $file_contents = file_get_contents($cache_file);
+ $file_ex = explode("\n\n", $file_contents);
+ $caches = unserialize(base64_decode($file_ex[1]));
- if(!$cache_fwrite)
- include($cache_file);
+ $list = (is_array($caches) && isset($caches['list'])) ? $caches['list'] : array();
+ $bo_subject = (is_array($caches) && isset($caches['bo_subject'])) ? $caches['bo_subject'] : '';
+ } catch(Exception $e){
+ $cache_fwrite = true;
+ $list = array();
+ }
+ }
}
}
@@ -61,14 +72,31 @@ function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time=
$sql = " select * from {$tmp_write_table} where wr_is_comment = 0 order by wr_num limit 0, {$rows} ";
$result = sql_query($sql);
for ($i=0; $row = sql_fetch_array($result); $i++) {
+ try {
+ unset($row['wr_password']); //패스워드 저장 안함( 아예 삭제 )
+ } catch (Exception $e) {
+ }
+ $row['wr_email'] = ''; //이메일 저장 안함
+ if (strstr($row['wr_option'], 'secret')){ // 비밀글일 경우 내용, 링크, 파일 저장 안함
+ $row['wr_content'] = $row['wr_link1'] = $row['wr_link2'] = '';
+ $row['file'] = array('count'=>0);
+ }
$list[$i] = get_list($row, $board, $latest_skin_url, $subject_len);
}
if($cache_fwrite) {
$handle = fopen($cache_file, 'w');
- $cache_content = "";
+ $caches = array(
+ 'list' => $list,
+ 'bo_subject' => sql_escape_string($bo_subject),
+ );
+ $cache_content = "\n\n";
+ $cache_content .= base64_encode(serialize($caches)); //serialize
+
fwrite($handle, $cache_content);
fclose($handle);
+
+ @chmod($cache_file, 0640);
}
}
diff --git a/mobile/head.php b/mobile/head.php
index 82ad5bda7..03d1c2d3b 100644
--- a/mobile/head.php
+++ b/mobile/head.php
@@ -207,4 +207,4 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
-
+
diff --git a/mobile/skin/board/basic/style.css b/mobile/skin/board/basic/style.css
index b3ee89749..3dde42f44 100644
--- a/mobile/skin/board/basic/style.css
+++ b/mobile/skin/board/basic/style.css
@@ -178,6 +178,7 @@ box-shadow: 0 0 8px rgba(65,98,255,0.8);}
#bo_v_img {margin:0 0 10px;width:100%;overflow:hidden;zoom:1}
#bo_v_img:after {display:block;visibility:hidden;clear:both;content:""}
+#bo_v_img a.view_image{display:block}
#bo_v_img img {margin-bottom:15px;max-width:100%;height:auto}
#bo_v_con {min-height:200px;margin-bottom:20px;width:100%;font-size:1.250em;line-height:1.7em;word-break:break-all;overflow:hidden}
diff --git a/mobile/skin/board/basic/view.skin.php b/mobile/skin/board/basic/view.skin.php
index 3d8f29ad0..a2b4fb77b 100644
--- a/mobile/skin/board/basic/view.skin.php
+++ b/mobile/skin/board/basic/view.skin.php
@@ -75,7 +75,7 @@ add_stylesheet(' ', 0
?>
-
+
diff --git a/mobile/skin/board/basic/view_comment.skin.php b/mobile/skin/board/basic/view_comment.skin.php
index 09e4c0b5e..06dd49ea2 100644
--- a/mobile/skin/board/basic/view_comment.skin.php
+++ b/mobile/skin/board/basic/view_comment.skin.php
@@ -84,7 +84,7 @@ var char_max = parseInt(); // 최대
?>
|