From 928bf61853523af755f1c814a8d3f02f6453011d Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 30 Sep 2019 17:59:02 +0900
Subject: [PATCH] =?UTF-8?q?[KVE-2019-1365]=EC=98=81=EC=B9=B4=ED=8A=B8XSS?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/shop_admin/orderform.php       | 2 +-
 adm/shop_admin/orderformupdate.php | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/adm/shop_admin/orderform.php b/adm/shop_admin/orderform.php
index dadf9eb41..8489d71b1 100644
--- a/adm/shop_admin/orderform.php
+++ b/adm/shop_admin/orderform.php
@@ -876,7 +876,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
 
     <div class="tbl_wrap">
         <label for="od_shop_memo" class="sound_only">상점메모</label>
-        <textarea name="od_shop_memo" id="od_shop_memo" rows="8"><?php echo stripslashes($od['od_shop_memo']); ?></textarea>
+        <textarea name="od_shop_memo" id="od_shop_memo" rows="8"><?php echo html_purifier(stripslashes($od['od_shop_memo'])); ?></textarea>
     </div>
 
     <div class="btn_confirm01 btn_confirm">
diff --git a/adm/shop_admin/orderformupdate.php b/adm/shop_admin/orderformupdate.php
index 5242530d5..8aa5f5989 100644
--- a/adm/shop_admin/orderformupdate.php
+++ b/adm/shop_admin/orderformupdate.php
@@ -4,6 +4,8 @@ include_once('./_common.php');
 
 check_admin_token();
 
+$od_shop_memo = strip_tags($od_shop_memo);
+
 if($_POST['mod_type'] == 'info') {
     $od_zip1   = substr($_POST['od_zip'], 0, 3);
     $od_zip2   = substr($_POST['od_zip'], 3);