From 92f2f9100e0bfa57a14f1d08fde6c04f6e4f4ec9 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Wed, 7 Aug 2019 11:35:15 +0900
Subject: [PATCH] =?UTF-8?q?[KVE-2019-1158,1159]=EC=98=81=EC=B9=B4=ED=8A=B8?=
 =?UTF-8?q?=5FXSS=5F=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 shop/kcp/pp_cli_result.php | 14 +++++++-------
 shop/lg/returnurl.php      |  4 ++--
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/shop/kcp/pp_cli_result.php b/shop/kcp/pp_cli_result.php
index 227540ef1..b0d299018 100644
--- a/shop/kcp/pp_cli_result.php
+++ b/shop/kcp/pp_cli_result.php
@@ -63,13 +63,13 @@ require_once(G5_SHOP_PATH.'/settle_kcp.inc.php');
     $mod_mny    = $_POST[ "mod_mny"    ];                             // 변경 요청 금액
     $rem_mny    = $_POST[ "rem_mny"    ];                             // 변경처리 이전 금액
     /* = -------------------------------------------------------------------------- = */
-    $res_cd     = $_POST[ "res_cd"     ];                             // 응답코드
-    $res_msg    = $_POST[ "res_msg"    ];                             // 응답메시지
-    $cash_no    = $_POST[ "cash_no"    ];                             // 현금영수증 거래번호
-    $receipt_no = $_POST[ "receipt_no" ];                             // 현금영수증 승인번호
-    $app_time   = $_POST[ "app_time"   ];                             // 승인시간(YYYYMMDDhhmmss)
-    $reg_stat   = $_POST[ "reg_stat"   ];                             // 등록 상태 코드
-    $reg_desc   = $_POST[ "reg_desc"   ];                             // 등록 상태 설명
+    $res_cd     = clean_xss_tags(strip_tags($_POST[ "res_cd"     ]));                             // 응답코드
+    $res_msg    = clean_xss_tags(strip_tags($_POST[ "res_msg"    ]));                             // 응답메시지
+    $cash_no    = clean_xss_tags(strip_tags($_POST[ "cash_no"    ]));                             // 현금영수증 거래번호
+    $receipt_no = clean_xss_tags(strip_tags($_POST[ "receipt_no" ]));                             // 현금영수증 승인번호
+    $app_time   = clean_xss_tags(strip_tags($_POST[ "app_time"   ]));                             // 승인시간(YYYYMMDDhhmmss)
+    $reg_stat   = clean_xss_tags(strip_tags($_POST[ "reg_stat"   ]));                             // 등록 상태 코드
+    $reg_desc   = clean_xss_tags(strip_tags($_POST[ "reg_desc"   ]));                             // 등록 상태 설명
     /* ============================================================================== */
 
     $req_tx_name = "";
diff --git a/shop/lg/returnurl.php b/shop/lg/returnurl.php
index daef9660a..cbbb4097f 100644
--- a/shop/lg/returnurl.php
+++ b/shop/lg/returnurl.php
@@ -28,8 +28,8 @@ $payReqMap = $_SESSION['PAYREQ_MAP'];//결제 요청시, Session에 저장했던
 </head>
 <body onload="setLGDResult()">
 <?php
-  $LGD_RESPCODE = $_POST['LGD_RESPCODE'];
-  $LGD_RESPMSG 	= $_POST['LGD_RESPMSG'];
+  $LGD_RESPCODE = clean_xss_tags(strip_tags($_POST['LGD_RESPCODE']));
+  $LGD_RESPMSG 	= clean_xss_tags(strip_tags($_POST['LGD_RESPMSG']));
   $LGD_PAYKEY	= '';
 
   $payReqMap['LGD_RESPCODE'] = $LGD_RESPCODE;