From 8182cac90d2ee2f9da06469ecba759170e782ee3 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 16 Sep 2019 10:36:10 +0900 Subject: [PATCH 1/3] =?UTF-8?q?XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/sms_admin/ajax.sms_write_form.php | 13 ++++++++----- plugin/sms5/ajax.sms_emoticon.php | 15 ++++++++++----- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/adm/sms_admin/ajax.sms_write_form.php b/adm/sms_admin/ajax.sms_write_form.php index e82a01cef..82a02b22a 100644 --- a/adm/sms_admin/ajax.sms_write_form.php +++ b/adm/sms_admin/ajax.sms_write_form.php @@ -74,10 +74,13 @@ while($res = sql_fetch_array($qry)) "; } -$arr_ajax_msg['error'] = ""; -$arr_ajax_msg['list_text'] = $list_text; -$arr_ajax_msg['page'] = $page; -$arr_ajax_msg['total_count'] = $total_count; -$arr_ajax_msg['total_page'] = $total_page; +$arr_ajax_msg = array( +'error'=>'', +'list_text'=>$list_text, +'page'=>$page, +'total_count'=>$total_count, +'total_page'=>$total_page +); + die( json_encode($arr_ajax_msg) ); ?> \ No newline at end of file diff --git a/plugin/sms5/ajax.sms_emoticon.php b/plugin/sms5/ajax.sms_emoticon.php index 7299bc157..12d6431e8 100644 --- a/plugin/sms5/ajax.sms_emoticon.php +++ b/plugin/sms5/ajax.sms_emoticon.php @@ -18,6 +18,8 @@ if (is_numeric($fg_no)) else $sql_group = ""; +$sv = isset($sv) ? get_search_string($sv) : ''; + if ($st == 'all') { $sql_search = "and (fo_name like '%{$sv}%' or fo_content like '%{$sv}%')"; } else if ($st == 'name') { @@ -61,10 +63,13 @@ for($k=0;$res = sql_fetch_array($qry);$k++) $list_text[$k]['fo_name'] = cut_str($res['fo_name'],20); } -$arr_ajax_msg['error'] = ""; -$arr_ajax_msg['list_text'] = $list_text; -$arr_ajax_msg['page'] = $page; -$arr_ajax_msg['total_count'] = $total_count; -$arr_ajax_msg['total_page'] = $total_page; +$arr_ajax_msg = array( +'error'=>'', +'list_text'=>$list_text, +'page'=>$page, +'total_count'=>$total_count, +'total_page'=>$total_page +); + die( json_encode($arr_ajax_msg) ); ?> \ No newline at end of file From 47bee3d294929505bb0ef23003aabd52ab10f664 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 16 Sep 2019 11:15:18 +0900 Subject: [PATCH 2/3] =?UTF-8?q?=ED=83=88=ED=87=B4=ED=95=9C=20=ED=9A=8C?= =?UTF-8?q?=EC=9B=90=EC=9D=B4=20=EB=B9=84=EB=B0=80=EB=B2=88=ED=98=B8?= =?UTF-8?q?=EB=A5=BC=20=EC=B0=BE=EA=B8=B0=20=ED=95=A0=EC=88=98=20=EC=9E=88?= =?UTF-8?q?=EB=8A=94=20=EC=98=A4=EB=A5=98=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/password_lost2.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bbs/password_lost2.php b/bbs/password_lost2.php index fade9a22f..9e7bfd437 100644 --- a/bbs/password_lost2.php +++ b/bbs/password_lost2.php @@ -21,9 +21,9 @@ $row = sql_fetch($sql); if ($row['cnt'] > 1) alert('동일한 메일주소가 2개 이상 존재합니다.\\n\\n관리자에게 문의하여 주십시오.'); -$sql = " select mb_no, mb_id, mb_name, mb_nick, mb_email, mb_datetime from {$g5['member_table']} where mb_email = '$email' "; +$sql = " select mb_no, mb_id, mb_name, mb_nick, mb_email, mb_datetime, mb_leave_date from {$g5['member_table']} where mb_email = '$email' "; $mb = sql_fetch($sql); -if (!$mb['mb_id']) +if (!$mb['mb_id'] || $mb['mb_leave_date']) alert('존재하지 않는 회원입니다.'); else if (is_admin($mb['mb_id'])) alert('관리자 아이디는 접근 불가합니다.'); From d72a3b5a73f097511f24941a2ec6dac42338ff29 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 16 Sep 2019 11:39:25 +0900 Subject: [PATCH 3/3] =?UTF-8?q?=EB=B2=84=EC=A0=84=205.3.3.3=20=EC=88=98?= =?UTF-8?q?=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- config.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config.php b/config.php index 51854fc9e..c228aa5d1 100644 --- a/config.php +++ b/config.php @@ -5,7 +5,7 @@ ********************/ define('G5_VERSION', '그누보드5'); -define('G5_GNUBOARD_VER', '5.3.3.2'); +define('G5_GNUBOARD_VER', '5.3.3.3'); // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음 define('_GNUBOARD_', true);