gper/Gnuboard5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[KVE-2026-1122]취약점 수정 - 주문·관리자·결제·소셜 등 사용자 입력 처리 보완

Browse Source 
- 쿠폰/희망배송일/검색어/계정/결제 콜백 등 입력값을 SQL 컨텍스트에 맞게 재처리
- dt_data·PG 응답 등 비-GPC 값과 소셜 provider 입력 정제 보완

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thisgun
2026-06-23 00:36:35 +00:00
co-authored by Claude Opus 4.8
parent 1cade844fb
commit 935ea84c7c
46 changed files with 211 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
adm/board_copy_update.php
+1 -1
View File
@@ -12,7 +12,7 @@ $bo_table = isset($_POST['bo_table']) ? substr(preg_replace('/[^a-z0-9_]/i
$target_table = isset($_POST['target_table']) ? trim($_POST['target_table']) : '';
$target_subject = isset($_POST['target_subject']) ? trim($_POST['target_subject']) : '';
$target_subject = strip_tags(clean_xss_attributes($target_subject));
$target_subject = addslashes(strip_tags(clean_xss_attributes(stripslashes($target_subject))));
$file_copy = array();
adm/board_form_update.php
+2 -2
View File
@@ -12,8 +12,8 @@ check_admin_token();
$gr_id = isset($_POST['gr_id']) ? preg_replace('/[^a-z0-9_]/i', '', (string)$_POST['gr_id']) : '';
$bo_admin = isset($_POST['bo_admin']) ? preg_replace('/[^a-z0-9_\, \|\#]/i', '', $_POST['bo_admin']) : '';
$bo_subject = isset($_POST['bo_subject']) ? strip_tags(clean_xss_attributes($_POST['bo_subject'])) : '';
$bo_mobile_subject = isset($_POST['bo_mobile_subject']) ? strip_tags(clean_xss_attributes($_POST['bo_mobile_subject'])) : '';
$bo_subject = isset($_POST['bo_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['bo_subject'])))) : '';
$bo_mobile_subject = isset($_POST['bo_mobile_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['bo_mobile_subject'])))) : '';
if (!$gr_id) {
alert('그룹 ID는 반드시 선택하세요.');
adm/board_list_update.php
+1 -1
View File
@@ -46,7 +46,7 @@ if ($act_button === "선택수정") {
}
}
$p_bo_subject = is_array($_POST['bo_subject']) ? strip_tags(clean_xss_attributes($_POST['bo_subject'][$k])) : '';
$p_bo_subject = is_array($_POST['bo_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['bo_subject'][$k])))) : '';
$sql = " update {$g5['board_table']}
set gr_id = '" . sql_real_escape_string($post_gr_id) . "',
adm/boardgroup_form_update.php
+1 -1
View File
@@ -39,7 +39,7 @@ for ($i = 1; $i <= 10; $i++) {
foreach ($check_keys as $key => $value) {
if ($key === 'gr_subject') {
$posts[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
$posts[$key] = isset($_POST[$key]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$key])))) : '';
} else {
$posts[$key] = isset($_POST[$key]) ? $_POST[$key] : '';
}
adm/boardgroup_list_update.php
+2 -2
View File
@@ -21,7 +21,7 @@ if (!$chk_count) {
for ($i = 0; $i < $chk_count; $i++) {
$k = isset($post_chk[$i]) ? (int) $post_chk[$i] : 0;
$gr_id = preg_replace('/[^a-z0-9_]/i', '', $post_group_id[$k]);
$gr_subject = isset($_POST['gr_subject'][$k]) ? strip_tags(clean_xss_attributes($_POST['gr_subject'][$k])) : '';
$gr_subject = isset($_POST['gr_subject'][$k]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['gr_subject'][$k])))) : '';
$gr_admin = isset($_POST['gr_admin'][$k]) ? strip_tags(clean_xss_attributes($_POST['gr_admin'][$k])) : '';
$gr_device = isset($_POST['gr_device'][$k]) ? clean_xss_tags($_POST['gr_device'][$k], 1, 1, 10) : '';
$gr_use_access = isset($_POST['gr_use_access'][$k]) ? (int) $_POST['gr_use_access'][$k] : 0;
@@ -36,7 +36,7 @@ for ($i = 0; $i < $chk_count; $i++) {
gr_order = '" . $gr_order . "'
where gr_id = '{$gr_id}' ";
if ($is_admin != 'super') {
$sql .= " and gr_admin = '{$gr_admin}' ";
$sql .= " and gr_admin = '" . sql_real_escape_string($gr_admin) . "' ";
}
sql_query($sql);
} elseif ($act_button == '선택삭제') {
adm/config_form_update.php
+3 -3
View File
@@ -13,8 +13,8 @@ if ($is_admin != 'super') {
$sql = " select * from {$g5['config_table']} limit 1";
$ori_config = sql_fetch($sql);
$cf_title = isset($_POST['cf_title']) ? strip_tags(clean_xss_attributes($_POST['cf_title'])) : '';
$cf_admin = isset($_POST['cf_admin']) ? clean_xss_tags($_POST['cf_admin'], 1, 1) : '';
$cf_title = isset($_POST['cf_title']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['cf_title'])))) : '';
$cf_admin = isset($_POST['cf_admin']) ? safe_replace_regex($_POST['cf_admin']) : '';
$mb = get_member($cf_admin);
@@ -173,7 +173,7 @@ foreach ($check_keys as $k => $v) {
if (in_array($k, array('cf_analytics', 'cf_add_meta', 'cf_add_script', 'cf_stipulation', 'cf_privacy'))) {
$_POST[$k] = isset($_POST[$k]) ? $_POST[$k] : '';
} else {
$_POST[$k] = isset($_POST[$k]) ? strip_tags(clean_xss_attributes($_POST[$k])) : '';
$_POST[$k] = isset($_POST[$k]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$k])))) : '';
}
}
}
adm/contentformupdate.php
+1 -1
View File
@@ -26,7 +26,7 @@ if ($w == "" || $w == "u") {
}
$co_id = isset($_REQUEST['co_id']) ? preg_replace('/[^a-z0-9_]/i', '', $_REQUEST['co_id']) : '';
$co_subject = isset($_POST['co_subject']) ? strip_tags(clean_xss_attributes($_POST['co_subject'])) : '';
$co_subject = isset($_POST['co_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['co_subject'])))) : '';
$co_include_head = isset($_POST['co_include_head']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['co_include_head'], 0, 255)) : '';
$co_include_tail = isset($_POST['co_include_tail']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['co_include_tail'], 0, 255)) : '';
adm/faqmasterformupdate.php
+1 -1
View File
@@ -20,7 +20,7 @@ check_admin_token();
$fm_id = isset($_REQUEST['fm_id']) ? (int) $_REQUEST['fm_id'] : 0;
$fm_himg_del = isset($_POST['fm_himg_del']) ? (int) $_POST['fm_himg_del'] : 0;
$fm_timg_del = isset($_POST['fm_timg_del']) ? (int) $_POST['fm_timg_del'] : 0;
$fm_subject = isset($_POST['fm_subject']) ? strip_tags(clean_xss_attributes($_POST['fm_subject'])) : '';
$fm_subject = isset($_POST['fm_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['fm_subject'])))) : '';
$fm_head_html = isset($_POST['fm_head_html']) ? $_POST['fm_head_html'] : '';
$fm_tail_html = isset($_POST['fm_tail_html']) ? $_POST['fm_tail_html'] : '';
$fm_mobile_head_html = isset($_POST['fm_mobile_head_html']) ? $_POST['fm_mobile_head_html'] : '';
adm/mail_update.php
+1 -1
View File
@@ -11,7 +11,7 @@ auth_check_menu($auth, $sub_menu, 'w');
check_admin_token();
$ma_id = isset($_POST['ma_id']) ? (int) $_POST['ma_id'] : 0;
$ma_subject = isset($_POST['ma_subject']) ? strip_tags(clean_xss_attributes($_POST['ma_subject'])) : '';
$ma_subject = isset($_POST['ma_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['ma_subject'])))) : '';
$ma_content = isset($_POST['ma_content']) ? $_POST['ma_content'] : '';
if ($w == '') {
adm/member_list_exel.lib.php
+2 -2
View File
@@ -247,8 +247,8 @@ function member_export_build_where($params)
} else {
// 수신동의기간 직접 입력 - custom_period
$date_start = isset($params['agree_date_start']) ? $params['agree_date_start'] : '';
$date_end = isset($params['agree_date_end']) ? $params['agree_date_end'] : '';
$date_start = isset($params['agree_date_start']) ? sql_escape_string(trim($params['agree_date_start'])) : '';
$date_end = isset($params['agree_date_end']) ? sql_escape_string(trim($params['agree_date_end'])) : '';
if ($date_start && $date_end) {
$emailDateCond = "mb_mailling_date BETWEEN '{$date_start} 00:00:00' AND '{$date_end} 23:59:59'";
adm/menu_list_update.php
+1 -1
View File
@@ -30,7 +30,7 @@ for ($i = 0; $i < $count; $i++) {
$code = is_array($_POST['code']) ? strip_tags($_POST['code'][$i]) : '';
$me_name = is_array($_POST['me_name']) ? strip_tags($_POST['me_name'][$i]) : '';
$me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : strip_tags(clean_xss_attributes($_POST['me_link'][$i]));
$me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['me_link'][$i]))));
if (!$code || !$me_name || !$me_link) {
continue;
adm/newwinformupdate.php
+2 -2
View File
@@ -16,7 +16,7 @@ if ($w == 'd') {
check_admin_token();
$nw_subject = isset($_POST['nw_subject']) ? strip_tags(clean_xss_attributes($_POST['nw_subject'])) : '';
$nw_subject = isset($_POST['nw_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['nw_subject'])))) : '';
$posts = array();
$check_keys = array(
@@ -37,7 +37,7 @@ foreach ($check_keys as $key => $val) {
if ($val === 'int') {
$posts[$key] = isset($_POST[$key]) ? (int) $_POST[$key] : 0;
} elseif ($val === 'str') {
$posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : 0;
$posts[$key] = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : 0;
} else {
$posts[$key] = isset($_POST[$key]) ? trim($_POST[$key]) : 0;
}
adm/poll_form_update.php
+7 -2
View File
@@ -43,11 +43,16 @@ foreach ($_POST as $key => $value) {
}
if (in_array($key, $check_keys)) {
$_POST[$key] = strip_tags(clean_xss_attributes($value));
if (preg_match('/^po_cnt[1-9]$/', $key) || in_array($key, array('po_level', 'po_point', 'po_id'), true)) {
$_POST[$key] = (int) $value;
} else {
$_POST[$key] = addslashes(strip_tags(clean_xss_attributes(stripslashes($value))));
}
}
}
$po_id = isset($_POST['po_id']) ? $_POST['po_id'] : '';
$po_id = isset($_POST['po_id']) ? (int) $_POST['po_id'] : 0;
$_POST['po_use'] = isset($_POST['po_use']) ? (int) $_POST['po_use'] : 0;
if ($w == '') {
$sql = " insert {$g5['poll_table']}
adm/qa_config_update.php
+1 -1
View File
@@ -15,7 +15,7 @@ $qaconfig = get_qa_config();
$check_keys = array('qa_title', 'qa_category', 'qa_skin', 'qa_mobile_skin', 'qa_use_email', 'qa_req_email', 'qa_use_hp', 'qa_req_hp', 'qa_use_sms', 'qa_send_number', 'qa_admin_hp', 'qa_admin_email', 'qa_subject_len', 'qa_mobile_subject_len', 'qa_page_rows', 'qa_mobile_page_rows', 'qa_image_width', 'qa_upload_size');
foreach ($check_keys as $key) {
$$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
$$key = $_POST[$key] = isset($_POST[$key]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$key])))) : '';
}
$qa_include_head = isset($qa_include_head) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_head, 0, 255)) : '';
adm/shop_admin/bannerformupdate.php
+7 -7
View File
@@ -20,14 +20,14 @@ $bn_bimg = isset($_FILES['bn_bimg']['tmp_name']) ? $_FILES['bn_bimg']['tmp_
$bn_bimg_name = isset($_FILES['bn_bimg']['name']) ? $_FILES['bn_bimg']['name'] : '';
$bn_id = isset($_REQUEST['bn_id']) ? preg_replace('/[^0-9]/', '', $_REQUEST['bn_id']) : 0;
$bn_bimg_del = (isset($_POST['bn_bimg_del']) && $_POST['bn_bimg_del']) ? preg_replace('/[^0-9]/', '', $_POST['bn_id']) : 0;
$bn_url = isset($_POST['bn_url']) ? strip_tags(clean_xss_attributes($bn_url)) : '';
$bn_alt = isset($_POST['bn_alt']) ? strip_tags(clean_xss_attributes($bn_alt)) : '';
$bn_device = isset($_POST['bn_device']) ? clean_xss_tags($_POST['bn_device'], 1, 1) : '';
$bn_position = isset($_POST['bn_position']) ? clean_xss_tags($_POST['bn_position'], 1, 1) : '';
$bn_url = isset($_POST['bn_url']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['bn_url'])))) : '';
$bn_alt = isset($_POST['bn_alt']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['bn_alt'])))) : '';
$bn_device = isset($_POST['bn_device']) ? safe_replace_regex($_POST['bn_device']) : '';
$bn_position = isset($_POST['bn_position']) ? addslashes(clean_xss_tags(stripslashes($_POST['bn_position']), 1, 1)) : '';
$bn_border = isset($_POST['bn_border']) ? (int) $_POST['bn_border'] : 0;
$bn_new_win = isset($_POST['bn_new_win']) ? (int) $_POST['bn_new_win'] : 0;
$bn_begin_time = isset($_POST['bn_begin_time']) ? clean_xss_tags($_POST['bn_begin_time'], 1, 1) : '';
$bn_end_time = isset($_POST['bn_end_time']) ? clean_xss_tags($_POST['bn_end_time'], 1, 1) : '';
$bn_begin_time = isset($_POST['bn_begin_time']) ? safe_replace_regex($_POST['bn_begin_time'], 'time') : '';
$bn_end_time = isset($_POST['bn_end_time']) ? safe_replace_regex($_POST['bn_end_time'], 'time') : '';
$bn_order = isset($_POST['bn_order']) ? (int) $_POST['bn_order'] : 0;
if ($bn_bimg_del) @unlink(G5_DATA_PATH."/banner/$bn_id");
@@ -99,4 +99,4 @@ if ($w == "" || $w == "u")
goto_url("./bannerform.php?w=u&amp;bn_id=$bn_id");
} else {
goto_url("./bannerlist.php");
}
}
adm/shop_admin/categoryformupdate.php
+1 -1
View File
@@ -75,7 +75,7 @@ foreach( $check_str_keys as $key=>$val ){
if( $val === 'int' ){
$value = isset($_POST[$key]) ? (int) $_POST[$key] : 0;
} else {
$value = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
$value = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : '';
}
$$key = $_POST[$key] = $value;
}
adm/shop_admin/categorylistupdate.php
+1 -1
View File
@@ -62,7 +62,7 @@ for ($i=0; $i<$post_ca_id_count; $i++)
}
}
$p_ca_name = is_array($_POST['ca_name']) ? strip_tags(clean_xss_attributes($_POST['ca_name'][$i])) : '';
$p_ca_name = is_array($_POST['ca_name']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['ca_name'][$i])))) : '';
$posts = array();
adm/shop_admin/configformupdate.php
+3 -3
View File
@@ -247,9 +247,9 @@ $check_sanitize_keys = array(
foreach( $check_sanitize_keys as $key ){
if( in_array($key, array('de_bank_account')) ){
$$key = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1, 0, 0) : '';
$$key = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1, 0, 0)) : '';
} else {
$$key = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
$$key = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : '';
}
}
@@ -480,4 +480,4 @@ if( $warning_msg ){
alert($warning_msg, "./configform.php");
} else {
goto_url("./configform.php");
}
}
adm/shop_admin/couponform.php
+2 -2
View File
@@ -4,7 +4,7 @@ include_once('./_common.php');
auth_check_menu($auth, $sub_menu, "w");
$cp_id = isset($_REQUEST['cp_id']) ? clean_xss_tags($_REQUEST['cp_id'], 1, 1) : '';
$cp_id = isset($_REQUEST['cp_id']) ? safe_replace_regex($_REQUEST['cp_id'], 'cp_id') : '';
$cp = array(
'cp_method'=>'',
'cp_subject'=>'',
@@ -292,4 +292,4 @@ function form_check(f)
</script>
<?php
include_once (G5_ADMIN_PATH.'/admin.tail.php');
include_once (G5_ADMIN_PATH.'/admin.tail.php');
adm/shop_admin/couponformupdate.php
+4 -2
View File
@@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, "w");
check_admin_token();
$cp_id = isset($_REQUEST['cp_id']) ? safe_replace_regex($_REQUEST['cp_id'], 'cp_id') : '';
$_POST = array_map('trim', $_POST);
$check_sanitize_keys = array(
@@ -25,7 +27,7 @@ $check_sanitize_keys = array(
);
foreach( $check_sanitize_keys as $key ){
$$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
$$key = $_POST[$key] = isset($_POST[$key]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$key])))) : '';
}
if(!$_POST['cp_subject'])
@@ -264,4 +266,4 @@ if ($w == '' && (isset($_POST['cp_sms_send']) || isset($_POST['cp_email_send']))
}
}
goto_url('./couponlist.php');
goto_url('./couponlist.php');
adm/shop_admin/couponzoneformupdate.php
+4 -2
View File
@@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, "w");
check_admin_token();
$cz_id = isset($_REQUEST['cz_id']) ? (int) $_REQUEST['cz_id'] : 0;
@mkdir(G5_DATA_PATH."/coupon", G5_DIR_PERMISSION);
@chmod(G5_DATA_PATH."/coupon", G5_DIR_PERMISSION);
@@ -28,7 +30,7 @@ $check_sanitize_keys = array(
);
foreach( $check_sanitize_keys as $key ){
$$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
$$key = $_POST[$key] = isset($_POST[$key]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$key])))) : '';
}
if(!$_POST['cz_subject'])
@@ -150,4 +152,4 @@ if($_FILES['cp_img']['tmp_name']) {
sql_query($sql);
}
goto_url('./couponzonelist.php?'.$qstr);
goto_url('./couponzonelist.php?'.$qstr);
adm/shop_admin/inorderform.php
+9 -7
View File
@@ -20,6 +20,8 @@ if (!$od['od_id']) {
// 주문정보
$data = unserialize(base64_decode($od['dt_data']));
$data_od_cp_id = isset($data['od_cp_id']) ? safe_replace_regex($data['od_cp_id'], 'cp_id') : '';
$data_sc_cp_id = isset($data['sc_cp_id']) ? safe_replace_regex($data['sc_cp_id'], 'cp_id') : '';
$sql_common = " from {$g5['g5_shop_cart_table']} where od_id = '{$od['cart_id']}' and ct_status = '쇼핑' and ct_select = '1' ";
@@ -38,8 +40,8 @@ if($od['mb_id']) {
$it_cp_cnt = (isset($data['cp_id']) && is_array($data['cp_id'])) ? count($data['cp_id']) : 0;
$arr_it_cp_prc = array();
for($i=0; $i<$it_cp_cnt; $i++) {
$cid = $data['cp_id'][$i];
$it_id = $data['it_id'][$i];
$cid = isset($data['cp_id'][$i]) ? safe_replace_regex($data['cp_id'][$i], 'cp_id') : '';
$it_id = isset($data['it_id'][$i]) ? safe_replace_regex($data['it_id'][$i], 'it_id') : '';
$sql = " select cp_id, cp_method, cp_target, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
where cp_id = '$cid'
@@ -98,10 +100,10 @@ if($od['mb_id']) {
$tot_od_price -= $tot_it_cp_price;
// 주문쿠폰
if(isset($data['od_cp_id']) && $data['od_cp_id']) {
if($data_od_cp_id) {
$sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
where cp_id = '{$data['od_cp_id']}'
where cp_id = '$data_od_cp_id'
and mb_id IN ( '{$od['mb_id']}', '전체회원' )
and cp_method = '2' ";
$cp = sql_fetch($sql);
@@ -134,10 +136,10 @@ $od_send_cost = get_sendcost($od['cart_id']);
$tot_sc_cp_price = 0;
if($od['mb_id'] && $od_send_cost > 0) {
// 배송쿠폰
if($data['sc_cp_id']) {
if($data_sc_cp_id) {
$sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
where cp_id = '{$data['sc_cp_id']}'
where cp_id = '$data_sc_cp_id'
and mb_id IN ( '{$od['mb_id']}', '전체회원' )
and cp_method = '3' ";
$cp = sql_fetch($sql);
@@ -571,4 +573,4 @@ function del_confirm()
</script>
<?php
include_once(G5_ADMIN_PATH.'/admin.tail.php');
include_once(G5_ADMIN_PATH.'/admin.tail.php');
adm/shop_admin/inorderformupdate.php
+16 -14
View File
@@ -30,6 +30,8 @@ if($w == 'd') {
// 주문정보
$data = unserialize(base64_decode($od['dt_data']));
$data_od_cp_id = isset($data['od_cp_id']) ? safe_replace_regex($data['od_cp_id'], 'cp_id') : '';
$data_sc_cp_id = isset($data['sc_cp_id']) ? safe_replace_regex($data['sc_cp_id'], 'cp_id') : '';
$sql_common = " from {$g5['g5_shop_cart_table']} where od_id = '{$od['cart_id']}' and ct_status = '쇼핑' ";
@@ -53,8 +55,8 @@ if($od['mb_id']) {
$it_cp_cnt = (isset($data['cp_id']) && is_array($data['cp_id'])) ? count($data['cp_id']) : 0;
$arr_it_cp_prc = array();
for($i=0; $i<$it_cp_cnt; $i++) {
$cid = $data['cp_id'][$i];
$it_id = $data['it_id'][$i];
$cid = isset($data['cp_id'][$i]) ? safe_replace_regex($data['cp_id'][$i], 'cp_id') : '';
$it_id = isset($data['it_id'][$i]) ? safe_replace_regex($data['it_id'][$i], 'it_id') : '';
$sql = " select cp_id, cp_method, cp_target, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
where cp_id = '$cid'
@@ -113,10 +115,10 @@ if($od['mb_id']) {
$tot_od_price -= $tot_it_cp_price;
// 주문쿠폰
if(isset($data['od_cp_id']) && $data['od_cp_id']) {
if($data_od_cp_id) {
$sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
where cp_id = '{$data['od_cp_id']}'
where cp_id = '$data_od_cp_id'
and mb_id IN ( '{$od['mb_id']}', '전체회원' )
and cp_method = '2' ";
$cp = sql_fetch($sql);
@@ -149,10 +151,10 @@ $od_send_cost = get_sendcost($od['cart_id']);
$tot_sc_cp_price = 0;
if($od['mb_id'] && $od_send_cost > 0) {
// 배송쿠폰
if($data['sc_cp_id']) {
if($data_sc_cp_id) {
$sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
where cp_id = '{$data['sc_cp_id']}'
where cp_id = '$data_sc_cp_id'
and mb_id IN ( '{$od['mb_id']}', '전체회원' )
and cp_method = '3' ";
$cp = sql_fetch($sql);
@@ -240,10 +242,10 @@ $od_receipt_point = $od_temp_point;
$od_receipt_time = $od['dt_time'];
$od_misu = 0;
$od_status = '입금';
$od_bank_account = isset($data['od_bank_account']) ? clean_xss_tags($data['od_bank_account'], 1, 1) : '';
$od_bank_account = isset($data['od_bank_account']) ? addslashes(clean_xss_tags(stripslashes($data['od_bank_account']), 1, 1)) : '';
$od_tno = '';
$od_app_no = '';
$od_hope_date = isset($data['od_hope_date']) ? clean_xss_tags($data['od_hope_date'], 1, 1) : '';
$od_hope_date = isset($data['od_hope_date']) ? addslashes(clean_xss_tags(stripslashes($data['od_hope_date']), 1, 1)) : '';
// 주문서에 입력
$sql = " insert {$g5['g5_shop_order_table']}
@@ -321,8 +323,8 @@ if ($od['mb_id'] && $od_receipt_point)
if($od['mb_id']) {
$it_cp_cnt = (isset($data['cp_id']) && is_array($data['cp_id'])) ? count($data['cp_id']) : 0;
for($i=0; $i<$it_cp_cnt; $i++) {
$cid = $data['cp_id'][$i];
$cp_it_id = $data['it_id'][$i];
$cid = isset($data['cp_id'][$i]) ? safe_replace_regex($data['cp_id'][$i], 'cp_id') : '';
$cp_it_id = isset($data['it_id'][$i]) ? safe_replace_regex($data['it_id'][$i], 'it_id') : '';
$cp_prc = isset($arr_it_cp_prc[$cp_it_id]) ? (int) $arr_it_cp_prc[$cp_it_id] : 0;
if(trim($cid)) {
@@ -346,9 +348,9 @@ if($od['mb_id']) {
sql_query($sql);
}
if(isset($data['od_cp_id']) && $data['od_cp_id']) {
if($data_od_cp_id) {
$sql = " insert into {$g5['g5_shop_coupon_log_table']}
set cp_id = '{$data['od_cp_id']}',
set cp_id = '$data_od_cp_id',
mb_id = '{$od['mb_id']}',
od_id = '$od_id',
cp_price = '$tot_od_cp_price',
@@ -356,9 +358,9 @@ if($od['mb_id']) {
sql_query($sql);
}
if(isset($data['sc_cp_id']) && $data['sc_cp_id']) {
if($data_sc_cp_id) {
$sql = " insert into {$g5['g5_shop_coupon_log_table']}
set cp_id = '{$data['sc_cp_id']}',
set cp_id = '$data_sc_cp_id',
mb_id = '{$od['mb_id']}',
od_id = '$od_id',
cp_price = '$tot_sc_cp_price',
adm/shop_admin/itemeventformupdate.php
+2 -2
View File
@@ -33,7 +33,7 @@ $ev_mobile_list_row = isset($_POST['ev_mobile_list_row']) ? (int) $_POST['ev_mob
$ev_use = isset($_POST['ev_use']) ? (int) $_POST['ev_use'] : 0;
$ev_subject_strong = isset($_POST['ev_subject_strong']) ? (int) $_POST['ev_subject_strong'] : 0;
$ev_subject = isset($_POST['ev_subject']) ? clean_xss_tags($_POST['ev_subject'], 1, 1) : '';
$ev_subject = isset($_POST['ev_subject']) ? addslashes(clean_xss_tags(stripslashes($_POST['ev_subject']), 1, 1)) : '';
$ev_head_html = isset($_POST['ev_head_html']) ? $_POST['ev_head_html'] : '';
$ev_tail_html = isset($_POST['ev_tail_html']) ? $_POST['ev_tail_html'] : '';
@@ -129,4 +129,4 @@ if ($w == "" || $w == "u")
else
{
goto_url("./itemevent.php");
}
}
adm/shop_admin/itemformupdate.php
+5 -5
View File
@@ -319,7 +319,7 @@ for($i=0; $i<$count_ii_article; $i++) {
}
$it_info_value = addslashes(serialize($value_array));
$it_name = isset($_POST['it_name']) ? strip_tags(clean_xss_attributes(trim($_POST['it_name']))) : '';
$it_name = isset($_POST['it_name']) ? addslashes(strip_tags(clean_xss_attributes(trim(stripslashes($_POST['it_name']))))) : '';
// KVE-2019-0708
$check_sanitize_keys = array(
@@ -356,7 +356,7 @@ $check_sanitize_keys = array(
);
foreach( $check_sanitize_keys as $key ){
$$key = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
$$key = isset($_POST[$key]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$key])))) : '';
}
$it_basic = preg_replace('#<script(.*?)>(.*?)<\/script>#is', '', $it_basic);
@@ -366,8 +366,8 @@ if ($it_name == "")
alert("상품명을 입력해 주십시오.");
// 스킨 경로 검증
$it_skin = isset($_POST['it_skin']) ? strip_tags(clean_xss_attributes($_POST['it_skin'])) : '';
$it_mobile_skin = isset($_POST['it_mobile_skin']) ? strip_tags(clean_xss_attributes($_POST['it_mobile_skin'])) : '';
$it_skin = isset($_POST['it_skin']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['it_skin'])))) : '';
$it_mobile_skin = isset($_POST['it_mobile_skin']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['it_mobile_skin'])))) : '';
$check_files = array();
if( !empty($it_skin) ) $check_files[] = $it_skin;
@@ -410,7 +410,7 @@ $sql_common = " ca_id = '$ca_id',
it_type5 = '$it_type5',
it_basic = '$it_basic',
it_explan = '$it_explan',
it_explan2 = '".strip_tags(trim(clean_xss_attributes($it_explan)))."',
it_explan2 = '".addslashes(strip_tags(trim(clean_xss_attributes(stripslashes($it_explan)))))."',
it_mobile_explan = '$it_mobile_explan',
it_cust_price = '$it_cust_price',
it_price = '$it_price',
adm/shop_admin/itemlistupdate.php
+2 -2
View File
@@ -29,7 +29,7 @@ if ($post_act_button == "선택수정") {
$p_ca_id = (isset($_POST['ca_id']) && is_array($_POST['ca_id'])) ? strip_tags($_POST['ca_id'][$k]) : '';
$p_ca_id2 = (isset($_POST['ca_id2']) && is_array($_POST['ca_id2'])) ? strip_tags($_POST['ca_id2'][$k]) : '';
$p_ca_id3 = (isset($_POST['ca_id3']) && is_array($_POST['ca_id3'])) ? strip_tags($_POST['ca_id3'][$k]) : '';
$p_it_name = (isset($_POST['it_name']) && is_array($_POST['it_name'])) ? strip_tags(clean_xss_attributes($_POST['it_name'][$k])) : '';
$p_it_name = (isset($_POST['it_name']) && is_array($_POST['it_name'])) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['it_name'][$k])))) : '';
$p_it_cust_price = (isset($_POST['it_cust_price']) && is_array($_POST['it_cust_price'])) ? strip_tags($_POST['it_cust_price'][$k]) : '';
$p_it_price = (isset($_POST['it_price']) && is_array($_POST['it_price'])) ? strip_tags($_POST['it_price'][$k]) : '';
$p_it_stock_qty = (isset($_POST['it_stock_qty']) && is_array($_POST['it_stock_qty'])) ? strip_tags($_POST['it_stock_qty'][$k]) : '';
@@ -89,4 +89,4 @@ if ($post_act_button == "선택수정") {
}
}
goto_url("./itemlist.php?sca=$sca&amp;sst=$sst&amp;sod=$sod&amp;sfl=$sfl&amp;stx=$stx&amp;page=$page");
goto_url("./itemlist.php?sca=$sca&amp;sst=$sst&amp;sod=$sod&amp;sfl=$sfl&amp;stx=$stx&amp;page=$page");
adm/shop_admin/itemuseformupdate.php
+4 -2
View File
@@ -18,8 +18,10 @@ foreach($check_keys as $key){
if( in_array($key, array('is_content', 'is_reply_content')) ){
$posts[$key] = isset($_POST[$key]) ? $_POST[$key] : '';
} else if( $key === 'is_id' ) {
$posts[$key] = isset($_POST[$key]) ? (int) $_POST[$key] : 0;
} else {
$posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
$posts[$key] = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : '';
}
}
@@ -46,4 +48,4 @@ if ($w == "u")
else
{
alert();
}
}
adm/shop_admin/orderformreceiptupdate.php
+2 -2
View File
@@ -35,7 +35,7 @@ $check_keys = array(
$posts = array();
foreach($check_keys as $key){
$posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
$posts[$key] = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : '';
}
$od_send_mail = $posts['od_send_mail'];
@@ -175,4 +175,4 @@ if($posts['od_tno'] && $posts['od_escrow'] == 1)
$qstr = "sort1=$sort1&amp;sort2=$sort2&amp;sel_field=$sel_field&amp;search=$search&amp;page=$page";
goto_url("./orderform.php?od_id=$od_id&amp;$qstr");
goto_url("./orderform.php?od_id=$od_id&amp;$qstr");
adm/shop_admin/orderformupdate.php
+18 -18
View File
@@ -4,7 +4,7 @@ include_once('./_common.php');
check_admin_token();
$od_shop_memo = isset($_POST['od_shop_memo']) ? strip_tags($_POST['od_shop_memo']) : '';
$od_shop_memo = isset($_POST['od_shop_memo']) ? addslashes(strip_tags(stripslashes($_POST['od_shop_memo']))) : '';
$od_id = isset($_POST['od_id']) ? safe_replace_regex($_POST['od_id'], 'od_id') : '';
$search = isset($_REQUEST['search']) ? get_search_string($_REQUEST['search']) : '';
@@ -17,22 +17,22 @@ if(isset($_POST['mod_type']) && $_POST['mod_type'] === 'info') {
$od_zip2 = isset($_POST['od_zip']) ? preg_replace('/[^0-9]/', '', substr($_POST['od_zip'], 3)) : '';
$od_b_zip1 = isset($_POST['od_b_zip']) ? preg_replace('/[^0-9]/', '', substr($_POST['od_b_zip'], 0, 3)) : '';
$od_b_zip2 = isset($_POST['od_b_zip']) ? preg_replace('/[^0-9]/', '', substr($_POST['od_b_zip'], 3)) : '';
$od_email = isset($_POST['od_email']) ? strip_tags(clean_xss_attributes($_POST['od_email'])) : '';
$od_name = isset($_POST['od_name']) ? clean_xss_tags($_POST['od_name'], 1, 1) : '';
$od_tel = isset($_POST['od_tel']) ? clean_xss_tags($_POST['od_tel'], 1, 1) : '';
$od_hp = isset($_POST['od_hp']) ? clean_xss_tags($_POST['od_hp'], 1, 1) : '';
$od_addr1 = isset($_POST['od_addr1']) ? clean_xss_tags($_POST['od_addr1'], 1, 1) : '';
$od_addr2 = isset($_POST['od_addr2']) ? clean_xss_tags($_POST['od_addr2'], 1, 1) : '';
$od_addr3 = isset($_POST['od_addr3']) ? clean_xss_tags($_POST['od_addr3'], 1, 1) : '';
$od_addr_jibeon = isset($_POST['od_addr_jibeon']) ? clean_xss_tags($_POST['od_addr_jibeon'], 1, 1) : '';
$od_b_name = isset($_POST['od_b_name']) ? clean_xss_tags($_POST['od_b_name'], 1, 1) : '';
$od_b_tel = isset($_POST['od_b_tel']) ? clean_xss_tags($_POST['od_b_tel'], 1, 1) : '';
$od_b_hp = isset($_POST['od_b_hp']) ? clean_xss_tags($_POST['od_b_hp'], 1, 1) : '';
$od_b_addr1 = isset($_POST['od_b_addr1']) ? clean_xss_tags($_POST['od_b_addr1'], 1, 1) : '';
$od_b_addr2 = isset($_POST['od_b_addr2']) ? clean_xss_tags($_POST['od_b_addr2'], 1, 1) : '';
$od_b_addr3 = isset($_POST['od_b_addr3']) ? clean_xss_tags($_POST['od_b_addr3'], 1, 1) : '';
$od_b_addr_jibeon = isset($_POST['od_b_addr_jibeon']) ? clean_xss_tags($_POST['od_b_addr_jibeon'], 1, 1) : '';
$od_hope_date = isset($_POST['od_hope_date']) ? clean_xss_tags($_POST['od_hope_date'], 1, 1) : '';
$od_email = isset($_POST['od_email']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['od_email'])))) : '';
$od_name = isset($_POST['od_name']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_name']), 1, 1)) : '';
$od_tel = isset($_POST['od_tel']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_tel']), 1, 1)) : '';
$od_hp = isset($_POST['od_hp']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_hp']), 1, 1)) : '';
$od_addr1 = isset($_POST['od_addr1']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_addr1']), 1, 1)) : '';
$od_addr2 = isset($_POST['od_addr2']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_addr2']), 1, 1)) : '';
$od_addr3 = isset($_POST['od_addr3']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_addr3']), 1, 1)) : '';
$od_addr_jibeon = isset($_POST['od_addr_jibeon']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_addr_jibeon']), 1, 1)) : '';
$od_b_name = isset($_POST['od_b_name']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_name']), 1, 1)) : '';
$od_b_tel = isset($_POST['od_b_tel']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_tel']), 1, 1)) : '';
$od_b_hp = isset($_POST['od_b_hp']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_hp']), 1, 1)) : '';
$od_b_addr1 = isset($_POST['od_b_addr1']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_addr1']), 1, 1)) : '';
$od_b_addr2 = isset($_POST['od_b_addr2']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_addr2']), 1, 1)) : '';
$od_b_addr3 = isset($_POST['od_b_addr3']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_addr3']), 1, 1)) : '';
$od_b_addr_jibeon = isset($_POST['od_b_addr_jibeon']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_addr_jibeon']), 1, 1)) : '';
$od_hope_date = isset($_POST['od_hope_date']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_hope_date']), 1, 1)) : '';
$sql = " update {$g5['g5_shop_order_table']}
set od_name = '$od_name',
@@ -66,4 +66,4 @@ sql_query($sql);
$qstr = "sort1=$sort1&amp;sort2=$sort2&amp;sel_field=$sel_field&amp;search=$search&amp;page=$page";
goto_url("./orderform.php?od_id=$od_id&amp;$qstr");
goto_url("./orderform.php?od_id=$od_id&amp;$qstr");
adm/shop_admin/personalpayformupdate.php
+4 -4
View File
@@ -4,7 +4,7 @@ include_once('./_common.php');
check_admin_token();
$pp_name = isset($_POST['pp_name']) ? strip_tags(clean_xss_attributes($_POST['pp_name'])) : '';
$pp_name = isset($_POST['pp_name']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['pp_name'])))) : '';
$pp_id = isset($_REQUEST['pp_id']) ? preg_replace('/[^0-9]/', '', $_REQUEST['pp_id']) : 0;
$pp_price = isset($_POST['pp_price']) ? preg_replace('/[^0-9]/', '', $_REQUEST['pp_price']) : 0;
@@ -40,8 +40,8 @@ if($w == 'd') {
$post_pp_content = isset($_POST['pp_content']) ? $_POST['pp_content'] : '';
$post_pp_receipt_price = isset($_POST['pp_receipt_price']) ? (int) $_POST['pp_receipt_price'] : 0;
$post_pp_settle_case = isset($_POST['pp_settle_case']) ? clean_xss_tags($_POST['pp_settle_case'], 1, 1) : '';
$post_pp_receipt_time = isset($_POST['pp_receipt_time']) ? clean_xss_tags($_POST['pp_receipt_time'], 1, 1) : '';
$post_pp_settle_case = isset($_POST['pp_settle_case']) ? addslashes(clean_xss_tags(stripslashes($_POST['pp_settle_case']), 1, 1)) : '';
$post_pp_receipt_time = isset($_POST['pp_receipt_time']) ? safe_replace_regex($_POST['pp_receipt_time'], 'time') : '';
$post_pp_shop_memo = isset($_POST['pp_shop_memo']) ? $_POST['pp_shop_memo'] : '';
$post_pp_use = isset($_POST['pp_use']) ? (int) $_POST['pp_use'] : 0;
@@ -79,4 +79,4 @@ if($w == '') {
if($popup == 'yes')
alert_close('개인결제가 추가됐습니다.');
else
goto_url('./personalpayform.php?w=u&amp;pp_id='.$pp_id.'&amp;'.$qstr);
goto_url('./personalpayform.php?w=u&amp;pp_id='.$pp_id.'&amp;'.$qstr);
adm/shop_admin/sendcostupdate.php
+2 -2
View File
@@ -22,7 +22,7 @@ if($w == 'd') {
sql_query(" delete from {$g5['g5_shop_sendcost_table']} where sc_id = '$sc_id' ");
}
} else {
$sc_name = isset($_POST['sc_name']) ? trim(strip_tags(clean_xss_attributes($_POST['sc_name']))) : '';
$sc_name = isset($_POST['sc_name']) ? addslashes(trim(strip_tags(clean_xss_attributes(stripslashes($_POST['sc_name']))))) : '';
$sc_zip1 = isset($_POST['sc_zip1']) ? preg_replace('/[^0-9]/', '', $_POST['sc_zip1']) : '';
$sc_zip2 = isset($_POST['sc_zip2']) ? preg_replace('/[^0-9]/', '', $_POST['sc_zip2']) : '';
$sc_price = isset($_POST['sc_price']) ? preg_replace('/[^0-9]/', '', $_POST['sc_price']) : '';
@@ -43,4 +43,4 @@ if($w == 'd') {
sql_query($sql);
}
goto_url('./sendcostlist.php?page='.$page);
goto_url('./sendcostlist.php?page='.$page);
adm/sms_admin/form_list.php
+5 -4
View File
@@ -22,13 +22,14 @@ else
$st = clean_xss_tags($st);
$sv = clean_xss_tags($sv);
$sql_sv = sql_real_escape_string(stripslashes($sv));
if ($st == 'all') {
$sql_search = "and (fo_name like '%{$sv}%' or fo_content like '%{$sv}%')";
$sql_search = "and (fo_name like '%{$sql_sv}%' or fo_content like '%{$sql_sv}%')";
} else if ($st == 'name') {
$sql_search = "and fo_name like '%{$sv}%'";
$sql_search = "and fo_name like '%{$sql_sv}%'";
} else if ($st == 'content') {
$sql_search = "and fo_content like '%{$sv}%'";
$sql_search = "and fo_content like '%{$sql_sv}%'";
} else {
$sql_search = '';
}
@@ -238,4 +239,4 @@ function select_copy(sw, f) {
<?php
echo get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $page, $total_page, $_SERVER['SCRIPT_NAME']."?fg_no=$fg_no&amp;st=$st&amp;sv=$sv&amp;page=");
include_once(G5_ADMIN_PATH.'/admin.tail.php');
include_once(G5_ADMIN_PATH.'/admin.tail.php');
adm/sms_admin/form_update.php
+5 -3
View File
@@ -6,8 +6,10 @@ auth_check_menu($auth, $sub_menu, "w");
check_admin_token();
$fo_name = isset($_REQUEST['fo_name']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_name'])) : '';
$fo_content = isset($_REQUEST['fo_content']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_content'])) : '';
$fo_no = isset($_REQUEST['fo_no']) ? (int) $_REQUEST['fo_no'] : 0;
$fg_no = isset($_REQUEST['fg_no']) ? (int) $_REQUEST['fg_no'] : 0;
$fo_name = isset($_REQUEST['fo_name']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_REQUEST['fo_name'])))) : '';
$fo_content = isset($_REQUEST['fo_content']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_REQUEST['fo_content'])))) : '';
$fo_receipt = isset($_REQUEST['fo_receipt']) ? clean_xss_tags($_REQUEST['fo_receipt'], 1, 1) : '';
$get_fg_no = '';
@@ -81,4 +83,4 @@ else // 등록
}
$go_url = './form_list.php?page='.$page.'&amp;fg_no='.$get_fg_no;
goto_url($go_url);
goto_url($go_url);
adm/sms_admin/num_book_file_download.php
+2 -1
View File
@@ -3,6 +3,7 @@ $sub_menu = "900900";
include_once("./_common.php");
$bg_no = isset($_REQUEST['bg_no']) ? clean_xss_tags($_REQUEST['bg_no'], 1, 1) : '';
$bg_no = ($bg_no === 'all') ? 'all' : (int) $bg_no;
$no_hp = isset($_REQUEST['no_hp']) ? clean_xss_tags($_REQUEST['no_hp'], 1, 1) : '';
auth_check_menu($auth, $sub_menu, "r");
@@ -66,4 +67,4 @@ header("Cache-Control: max-age=0");
$writer = PHPExcel_IOFactory::createWriter($excel, 'Excel5');
$writer->save('php://output');
exit;
exit;
adm/sms_admin/num_book_file_upload.php
+1 -1
View File
@@ -4,7 +4,7 @@ include_once("./_common.php");
auth_check_menu($auth, $sub_menu, "w");
$upload_bg_no = isset($_REQUEST['upload_bg_no']) ? clean_xss_tags($_REQUEST['upload_bg_no'], 1, 1) : '';
$upload_bg_no = isset($_REQUEST['upload_bg_no']) ? (int) $_REQUEST['upload_bg_no'] : 0;
$confirm = isset($_REQUEST['confirm']) ? clean_xss_tags($_REQUEST['confirm'], 1, 1) : '';
if (!$upload_bg_no)
adm/sms_admin/num_group_update.php
+5 -5
View File
@@ -13,7 +13,7 @@ if ($w == 'u') // 업데이트
// 실제 번호를 넘김
$k = $post_chk[$i];
$bg_no = isset($_POST['bg_no'][$k]) ? (int) $_POST['bg_no'][$k] : 0;
$bg_name = isset($_POST['bg_name'][$k]) ? strip_tags(clean_xss_attributes($_POST['bg_name'][$k])) : '';
$bg_name = isset($_POST['bg_name'][$k]) ? strip_tags(clean_xss_attributes(stripslashes($_POST['bg_name'][$k]))) : '';
if (!is_numeric($bg_no))
alert('그룹 고유번호가 없습니다.');
@@ -65,16 +65,16 @@ else if ($w == 'em') // 비우기
}
else // 등록
{
$bg_name = isset($_REQUEST['bg_name']) ? strip_tags(clean_xss_attributes($_REQUEST['bg_name'])) : '';
$bg_name = isset($_REQUEST['bg_name']) ? strip_tags(clean_xss_attributes(stripslashes($_REQUEST['bg_name']))) : '';
if (!strlen(trim($bg_name)))
alert('그룹명을 입력해주세요');
$res = sql_fetch("select bg_name from {$g5['sms5_book_group_table']} where bg_name='$bg_name'");
$res = sql_fetch("select bg_name from {$g5['sms5_book_group_table']} where bg_name='".sql_real_escape_string($bg_name)."'");
if ($res)
alert('같은 그룹명이 존재합니다.');
sql_query("insert into {$g5['sms5_book_group_table']} set bg_name='$bg_name'");
sql_query("insert into {$g5['sms5_book_group_table']} set bg_name='".sql_real_escape_string($bg_name)."'");
}
goto_url('./num_group.php');
goto_url('./num_group.php');
adm/sms_admin/sms_write_overlap_check.php
+1 -1
View File
@@ -8,7 +8,7 @@ $list = $hps = array();
$overlap = 0;
$send_list = isset($_REQUEST['send_list']) ? clean_xss_tags($_REQUEST['send_list'], 1, 1) : '';
$send_list = isset($_REQUEST['send_list']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['send_list']), 1, 1)) : '';
if( !$send_list ){
die("넘어온 데이터 값이 없습니다.");
adm/sms_admin/sms_write_send.php
+2 -2
View File
@@ -25,8 +25,8 @@ if ( ! (($config['cf_icode_id'] && $config['cf_icode_pw']) || $config['cf_icode_
}
$wr_reply = isset($_REQUEST['wr_reply']) ? preg_replace('#[^0-9\-]#', '', trim($_REQUEST['wr_reply'])) : '';
$wr_message = isset($_REQUEST['wr_message']) ? clean_xss_tags(trim($_REQUEST['wr_message']), 1, 1, 0, 0) : '';
$send_list = isset($_REQUEST['send_list']) ? clean_xss_tags(trim($_REQUEST['send_list']), 1, 1) : '';
$wr_message = isset($_REQUEST['wr_message']) ? addslashes(clean_xss_tags(stripslashes(trim($_REQUEST['wr_message'])), 1, 1, 0, 0)) : '';
$send_list = isset($_REQUEST['send_list']) ? addslashes(clean_xss_tags(stripslashes(trim($_REQUEST['send_list'])), 1, 1)) : '';
$wr_by = isset($_REQUEST['wr_by']) ? clean_xss_tags(trim($_REQUEST['wr_by']), 1, 1) : '';
$wr_bm = isset($_REQUEST['wr_bm']) ? clean_xss_tags(trim($_REQUEST['wr_bm']), 1, 1) : '';
mobile/shop/orderformupdate.php
+16 -14
View File
@@ -78,8 +78,10 @@ if(!isset($check_tmp['od_other_pay_type'])){
$od_other_pay_type = '';
$od_temp_point = isset($_POST['od_temp_point']) ? (int) $_POST['od_temp_point'] : 0;
$od_hope_date = isset($_POST['od_hope_date']) ? clean_xss_tags($_POST['od_hope_date'], 1, 1) : '';
$od_hope_date = isset($_POST['od_hope_date']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_hope_date']), 1, 1)) : '';
$ad_default = isset($_POST['ad_default']) ? (int) $_POST['ad_default'] : 0;
$post_od_cp_id = isset($_POST['od_cp_id']) ? safe_replace_regex($_POST['od_cp_id'], 'cp_id') : '';
$post_sc_cp_id = isset($_POST['sc_cp_id']) ? safe_replace_regex($_POST['sc_cp_id'], 'cp_id') : '';
$error = "";
// 장바구니 상품 재고 검사
@@ -141,7 +143,7 @@ if($is_member) {
$it_cp_cnt = (isset($_POST['cp_id']) && is_array($_POST['cp_id'])) ? count($_POST['cp_id']) : 0;
$arr_it_cp_prc = array();
for($i=0; $i<$it_cp_cnt; $i++) {
$cid = isset($_POST['cp_id'][$i]) ? $_POST['cp_id'][$i] : '';
$cid = isset($_POST['cp_id'][$i]) ? safe_replace_regex($_POST['cp_id'][$i], 'cp_id') : '';
$it_id = isset($_POST['it_id'][$i]) ? safe_replace_regex($_POST['it_id'][$i], 'it_id') : '';
$sql = " select cp_id, cp_method, cp_target, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
@@ -207,10 +209,10 @@ if($is_member) {
$tot_od_price -= $tot_it_cp_price;
// 주문쿠폰
if(isset($_POST['od_cp_id']) && $_POST['od_cp_id']) {
if($post_od_cp_id) {
$sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
where cp_id = '{$_POST['od_cp_id']}'
where cp_id = '$post_od_cp_id'
and mb_id IN ( '{$member['mb_id']}', '전체회원' )
and cp_start <= '".G5_TIME_YMD."'
and cp_end >= '".G5_TIME_YMD."'
@@ -253,10 +255,10 @@ $send_cost = get_sendcost($tmp_cart_id);
$tot_sc_cp_price = 0;
if($is_member && $send_cost > 0) {
// 배송쿠폰
if(isset($_POST['sc_cp_id']) && $_POST['sc_cp_id']) {
if($post_sc_cp_id) {
$sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
where cp_id = '{$_POST['sc_cp_id']}'
where cp_id = '$post_sc_cp_id'
and mb_id IN ( '{$member['mb_id']}', '전체회원' )
and cp_start <= '".G5_TIME_YMD."'
and cp_end >= '".G5_TIME_YMD."'
@@ -800,7 +802,7 @@ $coupon_duplicate = false;
if($is_member) {
$it_cp_cnt = (isset($_POST['cp_id']) && is_array($_POST['cp_id'])) ? count($_POST['cp_id']) : 0;
for($i=0; $i<$it_cp_cnt; $i++) {
$cid = isset($_POST['cp_id'][$i]) ? clean_xss_tags($_POST['cp_id'][$i], 1, 1) : '';
$cid = isset($_POST['cp_id'][$i]) ? safe_replace_regex($_POST['cp_id'][$i], 'cp_id') : '';
$cp_it_id = isset($_POST['it_id'][$i]) ? safe_replace_regex($_POST['it_id'][$i], 'it_id') : '';
$cp_prc = isset($arr_it_cp_prc[$cp_it_id]) ? (int) $arr_it_cp_prc[$cp_it_id] : 0;
@@ -838,13 +840,13 @@ if($is_member) {
sql_query($sql);
}
if(!$coupon_duplicate && isset($_POST['od_cp_id']) && $_POST['od_cp_id']) {
if(!$coupon_duplicate && $post_od_cp_id) {
// 쿠폰 이중사용 방지: INSERT 직전 재확인
if(is_used_coupon($member['mb_id'], $_POST['od_cp_id'])) {
if(is_used_coupon($member['mb_id'], $post_od_cp_id)) {
$coupon_duplicate = true;
} else {
$sql = " insert into {$g5['g5_shop_coupon_log_table']}
set cp_id = '{$_POST['od_cp_id']}',
set cp_id = '$post_od_cp_id',
mb_id = '{$member['mb_id']}',
od_id = '$od_id',
cp_price = '$tot_od_cp_price',
@@ -857,13 +859,13 @@ if($is_member) {
}
}
if(!$coupon_duplicate && isset($_POST['sc_cp_id']) && $_POST['sc_cp_id']) {
if(!$coupon_duplicate && $post_sc_cp_id) {
// 쿠폰 이중사용 방지: INSERT 직전 재확인
if(is_used_coupon($member['mb_id'], $_POST['sc_cp_id'])) {
if(is_used_coupon($member['mb_id'], $post_sc_cp_id)) {
$coupon_duplicate = true;
} else {
$sql = " insert into {$g5['g5_shop_coupon_log_table']}
set cp_id = '{$_POST['sc_cp_id']}',
set cp_id = '$post_sc_cp_id',
mb_id = '{$member['mb_id']}',
od_id = '$od_id',
cp_price = '$tot_sc_cp_price',
@@ -1082,4 +1084,4 @@ if( $is_noti_pay ){
return;
}
goto_url(G5_SHOP_URL.'/orderinquiryview.php?od_id='.$od_id.'&amp;uid='.$uid);
goto_url(G5_SHOP_URL.'/orderinquiryview.php?od_id='.$od_id.'&amp;uid='.$uid);
plugin/social/includes/functions.php
+1
View File
@@ -368,6 +368,7 @@ function social_escape_request($request){
function social_get_request_provider(){
$provider_name = isset($_REQUEST['provider']) ? ucfirst(social_escape_request($_REQUEST['provider'])) : '';
$provider_name = preg_replace('/[^a-z0-9_]/i', '', $provider_name); // 허용 문자만 유지
return $provider_name;
}
shop/inicis/inistdpay_return.php
+3 -3
View File
@@ -35,13 +35,13 @@ $var_datas = array();
foreach($data as $key=>$value) {
if(is_array($value)) {
foreach($value as $k=>$v) {
$_POST[$key][$k] = $params[$key][$k] = clean_xss_tags(strip_tags($v));
$_POST[$key][$k] = $params[$key][$k] = addslashes(clean_xss_tags(strip_tags(stripslashes($v))));
}
} else {
if(in_array($key, array('od_memo'))){
$_POST[$key] = $params[$key] = clean_xss_tags(strip_tags($value), 0, 0, 0, 0);
$_POST[$key] = $params[$key] = addslashes(clean_xss_tags(strip_tags(stripslashes($value)), 0, 0, 0, 0));
} else {
$_POST[$key] = $params[$key] = clean_xss_tags(strip_tags($value));
$_POST[$key] = $params[$key] = addslashes(clean_xss_tags(strip_tags(stripslashes($value))));
}
}
}
shop/inicis/taxsave_result.php
+2 -1
View File
@@ -150,7 +150,8 @@ if (isset($ini_result['resultCode']) && $ini_result['resultCode'] == '00') {
$cash['ApplDate'] = $ini_result['authDate'];
$cash['ApplTime'] = $ini_result['authTime'];
$cash['CSHR_Type'] = $ini_result['authUseOpt'];
$cash_info = serialize($cash);
$cash_info = sql_real_escape_string(serialize($cash));
$cash_no = sql_real_escape_string($cash_no);
if($tx == 'personalpay') {
$sql = " update {$g5['g5_shop_personalpay_table']}
shop/kakaopay/inicis_kk_return.php
+2 -2
View File
@@ -42,10 +42,10 @@ $var_datas = array();
foreach($data as $key=>$value) {
if(is_array($value)) {
foreach($value as $k=>$v) {
$_POST[$key][$k] = $params[$key][$k] = clean_xss_tags(strip_tags($v));
$_POST[$key][$k] = $params[$key][$k] = addslashes(clean_xss_tags(strip_tags(stripslashes($v))));
}
} else {
$_POST[$key] = $params[$key] = clean_xss_tags(strip_tags($value));
$_POST[$key] = $params[$key] = addslashes(clean_xss_tags(strip_tags(stripslashes($value))));
}
}
shop/orderformupdate.php
+17 -15
View File
@@ -54,8 +54,10 @@ if(!isset($check_tmp['od_other_pay_type'])){
$od_other_pay_type = '';
$od_temp_point = isset($_POST['od_temp_point']) ? (int) $_POST['od_temp_point'] : 0;
$od_hope_date = isset($_POST['od_hope_date']) ? clean_xss_tags($_POST['od_hope_date'], 1, 1) : '';
$od_hope_date = isset($_POST['od_hope_date']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_hope_date']), 1, 1)) : '';
$ad_default = ! empty($_POST['ad_default']) ? (int) $_POST['ad_default'] : 0;
$post_od_cp_id = isset($_POST['od_cp_id']) ? safe_replace_regex($_POST['od_cp_id'], 'cp_id') : '';
$post_sc_cp_id = isset($_POST['sc_cp_id']) ? safe_replace_regex($_POST['sc_cp_id'], 'cp_id') : '';
$error = "";
// 장바구니 상품 재고 검사
@@ -116,7 +118,7 @@ if($is_member) {
$it_cp_cnt = (isset($_POST['cp_id']) && is_array($_POST['cp_id'])) ? count($_POST['cp_id']) : 0;
$arr_it_cp_prc = array();
for($i=0; $i<$it_cp_cnt; $i++) {
$cid = isset($_POST['cp_id'][$i]) ? clean_xss_tags($_POST['cp_id'][$i], 1, 1) : '';
$cid = isset($_POST['cp_id'][$i]) ? safe_replace_regex($_POST['cp_id'][$i], 'cp_id') : '';
$it_id = isset($_POST['it_id'][$i]) ? safe_replace_regex($_POST['it_id'][$i], 'it_id') : '';
$sql = " select cp_id, cp_method, cp_target, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
@@ -182,10 +184,10 @@ if($is_member) {
$tot_od_price -= $tot_it_cp_price;
// 주문쿠폰
if(isset($_POST['od_cp_id']) && $_POST['od_cp_id']) {
if($post_od_cp_id) {
$sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
where cp_id = '{$_POST['od_cp_id']}'
where cp_id = '$post_od_cp_id'
and mb_id IN ( '{$member['mb_id']}', '전체회원' )
and cp_start <= '".G5_TIME_YMD."'
and cp_end >= '".G5_TIME_YMD."'
@@ -228,10 +230,10 @@ $send_cost = get_sendcost($tmp_cart_id);
$tot_sc_cp_price = 0;
if($is_member && $send_cost > 0) {
// 배송쿠폰
if(isset($_POST['sc_cp_id']) && $_POST['sc_cp_id']) {
if($post_sc_cp_id) {
$sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
from {$g5['g5_shop_coupon_table']}
where cp_id = '{$_POST['sc_cp_id']}'
where cp_id = '$post_sc_cp_id'
and mb_id IN ( '{$member['mb_id']}', '전체회원' )
and cp_start <= '".G5_TIME_YMD."'
and cp_end >= '".G5_TIME_YMD."'
@@ -755,8 +757,8 @@ $coupon_duplicate = false;
if($is_member) {
$it_cp_cnt = (isset($_POST['cp_id']) && is_array($_POST['cp_id'])) ? count($_POST['cp_id']) : 0;
for($i=0; $i<$it_cp_cnt; $i++) {
$cid = isset($_POST['cp_id'][$i]) ? clean_xss_tags($_POST['cp_id'][$i], 1, 1) : '';
$cp_it_id = isset($_POST['it_id'][$i]) ? clean_xss_tags($_POST['it_id'][$i], 1, 1) : '';
$cid = isset($_POST['cp_id'][$i]) ? safe_replace_regex($_POST['cp_id'][$i], 'cp_id') : '';
$cp_it_id = isset($_POST['it_id'][$i]) ? safe_replace_regex($_POST['it_id'][$i], 'it_id') : '';
$cp_prc = isset($arr_it_cp_prc[$cp_it_id]) ? (int) $arr_it_cp_prc[$cp_it_id] : 0;
if(trim($cid)) {
@@ -793,13 +795,13 @@ if($is_member) {
sql_query($sql);
}
if(!$coupon_duplicate && isset($_POST['od_cp_id']) && $_POST['od_cp_id']) {
if(!$coupon_duplicate && $post_od_cp_id) {
// 쿠폰 이중사용 방지: INSERT 직전 재확인
if(is_used_coupon($member['mb_id'], $_POST['od_cp_id'])) {
if(is_used_coupon($member['mb_id'], $post_od_cp_id)) {
$coupon_duplicate = true;
} else {
$sql = " insert into {$g5['g5_shop_coupon_log_table']}
set cp_id = '{$_POST['od_cp_id']}',
set cp_id = '$post_od_cp_id',
mb_id = '{$member['mb_id']}',
od_id = '$od_id',
cp_price = '$tot_od_cp_price',
@@ -812,13 +814,13 @@ if($is_member) {
}
}
if(!$coupon_duplicate && isset($_POST['sc_cp_id']) && $_POST['sc_cp_id']) {
if(!$coupon_duplicate && $post_sc_cp_id) {
// 쿠폰 이중사용 방지: INSERT 직전 재확인
if(is_used_coupon($member['mb_id'], $_POST['sc_cp_id'])) {
if(is_used_coupon($member['mb_id'], $post_sc_cp_id)) {
$coupon_duplicate = true;
} else {
$sql = " insert into {$g5['g5_shop_coupon_log_table']}
set cp_id = '{$_POST['sc_cp_id']}',
set cp_id = '$post_sc_cp_id',
mb_id = '{$member['mb_id']}',
od_id = '$od_id',
cp_price = '$tot_sc_cp_price',
@@ -1052,4 +1054,4 @@ goto_url(G5_SHOP_URL.'/orderinquiryview.php?od_id='.$od_id.'&amp;uid='.$uid);
document.onkeydown = noRefresh ;
</script>
</head>
</html>
</html>
shop/settle_nicepay_common.php
+17 -17
View File
@@ -15,28 +15,28 @@ $pg_allow_ips = array(
// PG 사에서 보냈는지 IP로 체크
if (in_array($_SERVER['REMOTE_ADDR'], $pg_allow_ips)) {
$PayMethod = isset($_POST['PayMethod']) ? clean_xss_tags($_POST['PayMethod']) : ''; //지불수단
$M_ID = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : ''; //상점ID
$MallUserID = isset($_POST['MallUserID']) ? clean_xss_tags($_POST['MallUserID']) : ''; //회원사 ID
$PayMethod = isset($_POST['PayMethod']) ? addslashes(clean_xss_tags(stripslashes($_POST['PayMethod']))) : ''; //지불수단
$M_ID = isset($_POST['MID']) ? addslashes(clean_xss_tags(stripslashes($_POST['MID']))) : ''; //상점ID
$MallUserID = isset($_POST['MallUserID']) ? addslashes(clean_xss_tags(stripslashes($_POST['MallUserID']))) : ''; //회원사 ID
$Amt = isset($_POST['Amt']) ? (int) $_POST['Amt'] : 0; //금액
$name = isset($_POST['name']) ? clean_xss_tags($_POST['name']) : ''; //구매자명
$GoodsName = isset($_POST['GoodsName']) ? clean_xss_tags($_POST['GoodsName']) : ''; //상품명
$TID = isset($_POST['TID']) ? clean_xss_tags($_POST['TID']) : ''; //거래번호
$name = isset($_POST['name']) ? addslashes(clean_xss_tags(stripslashes($_POST['name']))) : ''; //구매자명
$GoodsName = isset($_POST['GoodsName']) ? addslashes(clean_xss_tags(stripslashes($_POST['GoodsName']))) : ''; //상품명
$TID = isset($_POST['TID']) ? addslashes(clean_xss_tags(stripslashes($_POST['TID']))) : ''; //거래번호
$MOID = isset($_POST['MOID']) ? addslashes(clean_xss_tags(stripslashes($_POST['MOID']))) : ''; //주문번호
$AuthDate = isset($_POST['AuthDate']) ? clean_xss_tags($_POST['AuthDate']) : ''; //입금일시 (yyMMddHHmmss) 12 자리
$ResultCode = isset($_POST['ResultCode']) ? clean_xss_tags($_POST['ResultCode']) : ''; //결과코드 ('4110' 경우 입금통보)
$ResultMsg = isset($_POST['ResultMsg']) ? clean_xss_tags($_POST['ResultMsg']) : ''; //결과메시지
$AuthDate = isset($_POST['AuthDate']) ? addslashes(clean_xss_tags(stripslashes($_POST['AuthDate']))) : ''; //입금일시 (yyMMddHHmmss) 12 자리
$ResultCode = isset($_POST['ResultCode']) ? addslashes(clean_xss_tags(stripslashes($_POST['ResultCode']))) : ''; //결과코드 ('4110' 경우 입금통보)
$ResultMsg = isset($_POST['ResultMsg']) ? addslashes(clean_xss_tags(stripslashes($_POST['ResultMsg']))) : ''; //결과메시지
$VbankNum = isset($_POST['VbankNum']) ? addslashes(clean_xss_tags(stripslashes($_POST['VbankNum']))) : ''; //가상계좌번호
$FnCd = isset($_POST['FnCd']) ? clean_xss_tags($_POST['FnCd']) : ''; //가상계좌 은행코드
$VbankName = isset($_POST['VbankName']) ? clean_xss_tags($_POST['VbankName']) : ''; //가상계좌 은행명
$VbankInputName = isset($_POST['VbankInputName']) ? clean_xss_tags($_POST['VbankInputName']) : ''; //입금자 명
$CancelDate = isset($_POST['CancelDate']) ? clean_xss_tags($_POST['CancelDate']) : ''; //취소일시
$FnCd = isset($_POST['FnCd']) ? addslashes(clean_xss_tags(stripslashes($_POST['FnCd']))) : ''; //가상계좌 은행코드
$VbankName = isset($_POST['VbankName']) ? addslashes(clean_xss_tags(stripslashes($_POST['VbankName']))) : ''; //가상계좌 은행명
$VbankInputName = isset($_POST['VbankInputName']) ? addslashes(clean_xss_tags(stripslashes($_POST['VbankInputName']))) : ''; //입금자 명
$CancelDate = isset($_POST['CancelDate']) ? addslashes(clean_xss_tags(stripslashes($_POST['CancelDate']))) : ''; //취소일시
//가상계좌채번시 현금영수증 자동발급신청이 되었을경우 전달되며
//RcptTID 에 값이 있는경우만 발급처리 됨
$RcptTID = isset($_POST['RcptTID']) ? clean_xss_tags($_POST['RcptTID']) : ''; //현금영수증 거래번호
$RcptType = isset($_POST['RcptType']) ? clean_xss_tags($_POST['RcptType']) : ''; //현금 영수증 구분(0:미발행, 1:소득공제용, 2:지출증빙용)
$RcptAuthCode = isset($_POST['RcptAuthCode']) ? clean_xss_tags($_POST['RcptAuthCode']) : ''; //현금영수증 승인번호
$RcptTID = isset($_POST['RcptTID']) ? addslashes(clean_xss_tags(stripslashes($_POST['RcptTID']))) : ''; //현금영수증 거래번호
$RcptType = isset($_POST['RcptType']) ? addslashes(clean_xss_tags(stripslashes($_POST['RcptType']))) : ''; //현금 영수증 구분(0:미발행, 1:소득공제용, 2:지출증빙용)
$RcptAuthCode = isset($_POST['RcptAuthCode']) ? addslashes(clean_xss_tags(stripslashes($_POST['RcptAuthCode']))) : ''; //현금영수증 승인번호
// 입금통보 코드가 4110 성공이면
if ($ResultCode === '4110') {
@@ -170,4 +170,4 @@ if (in_array($_SERVER['REMOTE_ADDR'], $pg_allow_ips)) {
}
}
}
shop/settle_toss_common.php
+20 -15
View File
@@ -127,7 +127,7 @@ if (!$orderResult || $order_info['secret'] !== $TOSS_SECRET) {
$paymentKey = isset($order_info["paymentKey"]) ? clean_xss_tags($order_info["paymentKey"]) : ''; // 결제 키
$customerName = isset($order_info["virtualAccount"]["customerName"]) ? clean_xss_tags($order_info["virtualAccount"]["customerName"]) : ''; // 주문자명 (가상계좌 발급 시 고객명)
$depositorName = isset($order_info["virtualAccount"]["depositorName"]) ? clean_xss_tags($order_info["virtualAccount"]["depositorName"]) : ''; // 입금자명 (실제 입금자 입력 이름)
$totalAmount = isset($order_info["totalAmount"]) ? clean_xss_tags($order_info["totalAmount"]) : ''; // 입금 금액 (결제 총액)
$totalAmount = isset($order_info["totalAmount"]) ? (int) $order_info["totalAmount"] : 0; // 입금 금액 (결제 총액)
$bankCode = isset($order_info["virtualAccount"]["bankCode"]) ? clean_xss_tags($order_info["virtualAccount"]["bankCode"]) : ''; // 은행코드 (가상계좌 발급 은행, 예: 11 → 농협)
$accountNumber = isset($order_info["virtualAccount"]["accountNumber"]) ? clean_xss_tags($order_info["virtualAccount"]["accountNumber"]) : ''; // 가상계좌 입금계좌번호
$approvedAt = isset($order_info['approvedAt']) ? clean_xss_tags($order_info['approvedAt']) : ''; //입금일시
@@ -143,6 +143,11 @@ $RcptAuthCode = isset($order_info['cashReceipt']['issueNumber']) ? clean_xss_tag
$RcptType = isset($order_info['cashReceipt']['type']) ? clean_xss_tags($order_info['cashReceipt']['type'] === '소득공제' ? '1' : ($order_info['cashReceipt']['type'] === '지출증빙' ? '2' : '0')) : '0';
$RcptReceiptUrl = isset($order_info['cashReceipt']['receiptUrl']) ? clean_xss_tags($order_info['cashReceipt']['receiptUrl']) : ''; // 현금영수증 URL
$paymentKey_sql = sql_real_escape_string($paymentKey);
$depositorName_sql = sql_real_escape_string($depositorName);
$RcptAuthCode_sql = sql_real_escape_string($RcptAuthCode);
$cash_info_sql = sql_real_escape_string(serialize(array('TID'=>$RcptTID, 'ApplNum'=>$RcptAuthCode, 'AuthDate'=>$approvedAt, 'receiptUrl'=>$RcptReceiptUrl)));
$result = false;
/**
@@ -151,7 +156,7 @@ $result = false;
if($TOSS_STATUS == "DONE"){
// 입금결과 처리
$sql = " select pp_id, od_id from {$g5['g5_shop_personalpay_table']} where pp_id = '{$TOSS_ORDERID}' and pp_tno = '{$paymentKey}'";
$sql = " select pp_id, od_id from {$g5['g5_shop_personalpay_table']} where pp_id = '{$TOSS_ORDERID}' and pp_tno = '{$paymentKey_sql}'";
$row = sql_fetch($sql);
if($row['pp_id']) {
@@ -162,15 +167,15 @@ if($TOSS_STATUS == "DONE"){
if ($RcptType) {
$add_update_sql = "
, pp_cash = '1',
pp_cash_no = '".$RcptAuthCode."',
pp_cash_info = '".serialize(array('TID'=>$RcptTID, 'ApplNum'=>$RcptAuthCode, 'AuthDate'=>$approvedAt, 'receiptUrl'=>$RcptReceiptUrl))."'
pp_cash_no = '".$RcptAuthCode_sql."',
pp_cash_info = '".$cash_info_sql."'
";
}
$sql = " update {$g5['g5_shop_personalpay_table']}
set pp_receipt_price = '$totalAmount',
pp_receipt_time = '$receipt_time',
pp_deposit_name = '$depositorName'
pp_deposit_name = '$depositorName_sql'
$add_update_sql
where pp_id = '$TOSS_ORDERID'";
$result = sql_query($sql, false);
@@ -180,14 +185,14 @@ if($TOSS_STATUS == "DONE"){
$sql = " update {$g5['g5_shop_order_table']}
set od_receipt_price = od_receipt_price + '$totalAmount',
od_receipt_time = '$receipt_time',
od_deposit_name = '$depositorName',
od_deposit_name = '$depositorName_sql',
od_shop_memo = concat(od_shop_memo, \"\\n개인결제 ".$row['pp_id']." 로 결제완료 - ".$receipt_time."\")
where od_id = '{$row['od_id']}' ";
$result = sql_query($sql, FALSE);
}
} else {
// 주문내역에 secret 검증 추가
$sql = " select od_id from {$g5['g5_shop_order_table']} where od_id = '$TOSS_ORDERID' and od_tno = '$paymentKey'";
$sql = " select od_id from {$g5['g5_shop_order_table']} where od_id = '$TOSS_ORDERID' and od_tno = '$paymentKey_sql'";
$row = sql_fetch($sql);
if(!$row['od_id']) {
write_toss_log("주문내역 조회 실패", $TOSS_ORDERID, $TOSS_STATUS);
@@ -199,9 +204,9 @@ if($TOSS_STATUS == "DONE"){
$sql = " update {$g5['g5_shop_order_table']}
set od_receipt_price = '$totalAmount',
od_receipt_time = '$receipt_time',
od_deposit_name = '$depositorName'
od_deposit_name = '$depositorName_sql'
where od_id = '$TOSS_ORDERID'
and od_tno = '$paymentKey'";
and od_tno = '$paymentKey_sql'";
$result = sql_query($sql, FALSE);
}
@@ -228,8 +233,8 @@ if($TOSS_STATUS == "DONE"){
if ($RcptType) {
$add_update_sql = "
, od_cash = '1',
od_cash_no = '".$RcptAuthCode."',
od_cash_info = '".serialize(array('TID'=>$RcptTID, 'ApplNum'=>$RcptAuthCode, 'AuthDate'=>$approvedAt, 'receiptUrl'=>$RcptReceiptUrl))."'
od_cash_no = '".$RcptAuthCode_sql."',
od_cash_info = '".$cash_info_sql."'
";
}
@@ -257,7 +262,7 @@ if($TOSS_STATUS == "DONE"){
elseif($TOSS_STATUS == "WAITING_FOR_DEPOSIT")
{
// 개인결제 정보 조회
$sql = " select pp_id, od_id, pp_name, pp_hp, pp_tel from {$g5['g5_shop_personalpay_table']} where pp_id = '{$TOSS_ORDERID}' and pp_tno = '{$paymentKey}'";
$sql = " select pp_id, od_id, pp_name, pp_hp, pp_tel from {$g5['g5_shop_personalpay_table']} where pp_id = '{$TOSS_ORDERID}' and pp_tno = '{$paymentKey_sql}'";
$row = sql_fetch($sql);
if($row['pp_id']) {
@@ -268,7 +273,7 @@ elseif($TOSS_STATUS == "WAITING_FOR_DEPOSIT")
pp_cash = 0,
pp_cash_no = '',
pp_cash_info = ''
where pp_id = '{$TOSS_ORDERID}' and pp_tno = '{$paymentKey}'";
where pp_id = '{$TOSS_ORDERID}' and pp_tno = '{$paymentKey_sql}'";
$result = sql_query($sql, FALSE);
if($row['od_id']) {
@@ -281,7 +286,7 @@ elseif($TOSS_STATUS == "WAITING_FOR_DEPOSIT")
}
} else {
// 일반 주문 롤백 전에 데이터 존재 확인
$sql = " select od_id, od_name, od_hp, od_tel from {$g5['g5_shop_order_table']} where od_id = '{$TOSS_ORDERID}' and od_tno = '{$paymentKey}'";
$sql = " select od_id, od_name, od_hp, od_tel from {$g5['g5_shop_order_table']} where od_id = '{$TOSS_ORDERID}' and od_tno = '{$paymentKey_sql}'";
$row = sql_fetch($sql);
if(empty($row['od_id'])) {
write_toss_log("주문 데이터가 존재하지 않음", $TOSS_ORDERID, $TOSS_STATUS);
@@ -298,7 +303,7 @@ elseif($TOSS_STATUS == "WAITING_FOR_DEPOSIT")
od_cash = 0,
od_cash_no = '',
od_cash_info = ''
where od_id = '{$TOSS_ORDERID}' and od_tno = '{$paymentKey}' ";
where od_id = '{$TOSS_ORDERID}' and od_tno = '{$paymentKey_sql}' ";
$result = sql_query($sql, FALSE);
}