gper/Gnuboard5
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'master' of github.com:gnuboard/g5 into pbkdf2

Browse Source
This commit is contained in:
thisgun committed 2018-10-11 11:07:30 +09:00
2 parents 352cf06944 26f6edfd0b
commit a5bd3841dd
20 files changed
+91 -37
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

adm/board_form_update.php
+3
View File
@@ -72,6 +72,9 @@ $bo_category_list = str_replace($src_char, $dst_char, $bo_category_list);
//https://github.com/gnuboard/gnuboard5/commit/f5f4925d4eb28ba1af728e1065fc2bdd9ce1da58 에 따른 조치
$str_bo_category_list = isset($_POST['bo_category_list']) ? preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $_POST['bo_category_list']) : '';
$_POST['bo_subject'] = strip_tags($_POST['bo_subject']);
$_POST['bo_mobile_subject'] = strip_tags($_POST['bo_mobile_subject']);
$sql_common = " gr_id = '{$_POST['gr_id']}',
bo_subject = '{$_POST['bo_subject']}',
bo_mobile_subject = '{$_POST['bo_mobile_subject']}',
adm/boardgroup_form.php
+1 -1
View File
@@ -117,7 +117,7 @@ include_once('./admin.head.php');
<label for="gr_<?php echo $i ?>_subj">여분필드 <?php echo $i ?> 제목</label>
<input type="text" name="gr_<?php echo $i ?>_subj" value="<?php echo get_text($group['gr_'.$i.'_subj']) ?>" id="gr_<?php echo $i ?>_subj" class="frm_input">
<label for="gr_<?php echo $i ?>">여분필드 <?php echo $i ?> 내용</label>
<input type="text" name="gr_<?php echo $i ?>" value="<?php echo $gr['gr_'.$i] ?>" id="gr_<?php echo $i ?>" class="frm_input">
<input type="text" name="gr_<?php echo $i ?>" value="<?php echo get_sanitize_input($gr['gr_'.$i]); ?>" id="gr_<?php echo $i ?>" class="frm_input">
</td>
</tr>
<?php } ?>
adm/config_form.php
+1 -1
View File
@@ -1317,7 +1317,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
<label for="cf_<?php echo $i ?>_subj">여분필드<?php echo $i ?> 제목</label>
<input type="text" name="cf_<?php echo $i ?>_subj" value="<?php echo get_text($config['cf_'.$i.'_subj']) ?>" id="cf_<?php echo $i ?>_subj" class="frm_input" size="30">
<label for="cf_<?php echo $i ?>">여분필드<?php echo $i ?> 값</label>
<input type="text" name="cf_<?php echo $i ?>" value="<?php echo $config['cf_'.$i] ?>" id="cf_<?php echo $i ?>" class="frm_input" size="30">
<input type="text" name="cf_<?php echo $i ?>" value="<?php echo get_sanitize_input($config['cf_'.$i]); ?>" id="cf_<?php echo $i ?>" class="frm_input" size="30">
</td>
</tr>
<?php } ?>
adm/config_form_update.php
+2
View File
@@ -26,6 +26,8 @@ if(!$_POST['cf_cert_use']) {
$cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',', $_POST['cf_social_servicelist']) : '';
$_POST['cf_title'] = strip_tags($_POST['cf_title']);
$sql = " update {$g5['config_table']}
set cf_title = '{$_POST['cf_title']}',
cf_admin = '{$_POST['cf_admin']}',
adm/contentformupdate.php
+3 -2
View File
@@ -20,6 +20,7 @@ if ($w == "" || $w == "u")
$co_row = sql_fetch($sql);
}
$co_id = preg_replace('/[^a-z0-9_]/i', '', $co_id);
$co_subject = strip_tags($co_subject);
$co_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_head, 0, 255));
$co_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_tail, 0, 255));
@@ -59,12 +60,12 @@ if( $co_include_tail ){
}
}
if( $co_include_head && ! is_include_path_check($co_include_head) ){
if( $co_include_head && ! is_include_path_check($co_include_head, 1) ){
$co_include_head = '';
$error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.';
}
if( $co_include_tail && ! is_include_path_check($co_include_tail) ){
if( $co_include_tail && ! is_include_path_check($co_include_tail, 1) ){
$co_include_tail = '';
$error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
}
adm/menu_list.php
+14
View File
@@ -196,6 +196,20 @@ function base_convert(number, frombase, tobase) {
function fmenulist_submit(f)
{
var me_links = document.getElementsByName('me_link[]');
var reg = /^javascript/;
for (i=0; i<me_links.length; i++){
if( reg.test(me_links[i].value) ){
alert('링크에 자바스크립트문을 입력할수 없습니다.');
me_links[i].focus();
return false;
}
}
return true;
}
</script>
adm/menu_list_update.php
+2 -2
View File
@@ -23,8 +23,8 @@ for ($i=0; $i<$count; $i++)
$code = $_POST['code'][$i];
$me_name = $_POST['me_name'][$i];
$me_link = $_POST['me_link'][$i];
$me_link = preg_match('/^javascript/', $_POST['me_link'][$i]) ? G5_URL : strip_tags($_POST['me_link'][$i]);
if(!$code || !$me_name || !$me_link)
continue;
bbs/board_head.php
+2 -2
View File
@@ -5,13 +5,13 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
if (G5_IS_MOBILE) {
// 모바일의 경우 설정을 따르지 않는다.
include_once(G5_BBS_PATH.'/_head.php');
echo stripslashes($board['bo_mobile_content_head']);
echo html_purifier(stripslashes($board['bo_mobile_content_head']));
} else {
if(is_include_path_check($board['bo_include_head'])) { //파일경로 체크
@include ($board['bo_include_head']);
} else { //파일경로가 올바르지 않으면 기본파일을 가져옴
include_once(G5_BBS_PATH.'/_head.php');
}
echo stripslashes($board['bo_content_head']);
echo html_purifier(stripslashes($board['bo_content_head']));
}
?>
bbs/board_tail.php
+2 -2
View File
@@ -3,11 +3,11 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
// 게시판 관리의 하단 파일 경로
if (G5_IS_MOBILE) {
echo stripslashes($board['bo_mobile_content_tail']);
echo html_purifier(stripslashes($board['bo_mobile_content_tail']));
// 모바일의 경우 설정을 따르지 않는다.
include_once(G5_BBS_PATH.'/_tail.php');
} else {
echo stripslashes($board['bo_content_tail']);
echo html_purifier(stripslashes($board['bo_content_tail']));
if(is_include_path_check($board['bo_include_tail'])) { //파일경로 체크
@include ($board['bo_include_tail']);
} else { //파일경로가 올바르지 않으면 기본파일을 가져옴
bbs/content.php
+2
View File
@@ -1,6 +1,8 @@
<?php
include_once('./_common.php');
$co_id = preg_replace('/[^a-z0-9_]/i', '', $co_id);
//dbconfig파일에 $g5['content_table'] 배열변수가 있는지 체크
if( !isset($g5['content_table']) ){
die('<meta charset="utf-8">관리자 모드에서 게시판관리->내용 관리를 먼저 확인해 주세요.');
bbs/member_confirm.php
+3 -3
View File
@@ -11,16 +11,16 @@ else
$urlencode = urlencode($_SERVER[REQUEST_URI]);
*/
$url = clean_xss_tags($_GET['url']);
//소셜 로그인 한 경우
if( function_exists('social_member_comfirm_redirect') ){
if( function_exists('social_member_comfirm_redirect') && (! $url || $url === 'register_form.php') ){
social_member_comfirm_redirect();
}
$g5['title'] = '회원 비밀번호 확인';
include_once('./_head.sub.php');
$url = clean_xss_tags($_GET['url']);
// url 체크
check_url_host($url, '', G5_URL, true);
bbs/password.php
+4 -4
View File
@@ -43,8 +43,8 @@ switch ($w) {
include_once(G5_PATH.'/head.sub.php');
//if ($board['bo_include_head']) { @include ($board['bo_include_head']); }
//if ($board['bo_content_head']) { echo stripslashes($board['bo_content_head']); }
//if ($board['bo_include_head'] && is_include_path_check($board['bo_content_head'])) { @include ($board['bo_include_head']); }
//if ($board['bo_content_head']) { echo html_purifier(stripslashes($board['bo_content_head'])); }
/* 비밀글의 제목을 가져옴 지운아빠 2013-01-29 */
$sql = " select wr_subject from {$write_table}
@@ -57,8 +57,8 @@ $g5['title'] = get_text($row['wr_subject']);
include_once($member_skin_path.'/password.skin.php');
//if ($board['bo_content_tail']) { echo stripslashes($board['bo_content_tail']); }
//if ($board['bo_include_tail']) { @include ($board['bo_include_tail']); }
//if ($board['bo_content_tail']) { echo html_purifier(stripslashes($board['bo_content_tail'])); }
//if ($board['bo_include_tail'] && is_include_path_check($board['bo_content_tail'])) { @include ($board['bo_include_tail']); }
include_once(G5_PATH.'/tail.sub.php');
?>
bbs/view_image.php
+7 -2
View File
@@ -4,8 +4,13 @@ include_once('./_common.php');
$g5['title'] = '이미지 크게보기';
include_once(G5_PATH.'/head.sub.php');
$filename = $_GET['fn'];
$bo_table = $_GET['bo_table'];
$filename = preg_replace('/[^A-Za-z0-9 _ .\-\/]/', '', $_GET['fn']);
$extension = pathinfo($filename, PATHINFO_EXTENSION);
if ( ! preg_match('/(jpg|jpeg|png|gif|bmp)$/i', $extension) ){
alert_close('이미지 확장자가 아닙니다.');
}
if(strpos($filename, 'data/editor')) {
$editor_file = strstr($filename, 'editor');
config.php
+1 -1
View File
@@ -5,7 +5,7 @@
********************/
define('G5_VERSION', '그누보드5');
define('G5_GNUBOARD_VER', '5.3.1.8');
define('G5_GNUBOARD_VER', '5.3.1.9');
// 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
define('_GNUBOARD_', true);
g4_import_run.php
+1
View File
@@ -71,6 +71,7 @@ document.onkeydown = noRefresh ;
<?php
flush();
$g4 = array();
// g4의 confing.php
require('./'.$g4_config_file);
js/certify.js
+6 -1
View File
@@ -1,6 +1,11 @@
// 본인확인 인증창 호출
function certify_win_open(type, url)
function certify_win_open(type, url, event)
{
if (typeof event == "undefined") {
event = window.event;
}
if(type == 'kcb-ipin')
{
var popupWindow = window.open( url, "kcbPop", "left=200, top=100, status=0, width=450, height=550" );
lib/common.lib.php
+14 -3
View File
@@ -2072,12 +2072,20 @@ function abs_ip2long($ip='')
function get_selected($field, $value)
{
if( is_int($value) ){
return ((int) $field===$value) ? ' selected="selected"' : '';
}
return ($field===$value) ? ' selected="selected"' : '';
}
function get_checked($field, $value)
{
if( is_int($value) ){
return ((int) $field===$value) ? ' checked="checked"' : '';
}
return ($field===$value) ? ' checked="checked"' : '';
}
@@ -3449,10 +3457,13 @@ function is_use_email_certify(){
function get_real_client_ip(){
if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
return $_SERVER['HTTP_X_FORWARDED_FOR'];
$real_ip = $_SERVER['REMOTE_ADDR'];
return $_SERVER['REMOTE_ADDR'];
if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\z/', $_SERVER['HTTP_X_FORWARDED_FOR']) ){
$real_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
return preg_replace('/[^0-9.]/', '', $real_ip);
}
function get_call_func_cache($func, $args=array()){
mobile/skin/member/basic/register_form.skin.php
+10 -6
View File
@@ -52,7 +52,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
if($config['cf_cert_use']) {
if($config['cf_cert_ipin'])
echo '<button type="button" id="win_ipin_cert" class="btn_frmline btn">아이핀 본인확인</button>'.PHP_EOL;
if($config['cf_cert_hp'] && $config['cf_cert_hp'] != 'lg')
if($config['cf_cert_hp'])
echo '<button type="button" id="win_hp_cert" class="btn_frmline btn">휴대폰 본인확인</button>'.PHP_EOL;
echo '<noscript>본인확인을 위해서는 자바스크립트 사용이 가능해야합니다.</noscript>'.PHP_EOL;
@@ -106,7 +106,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
<?php if ($config['cf_use_homepage']) { ?>
<li>
<label for="reg_mb_homepage" class="sound_only">홈페이지<?php if ($config['cf_req_homepage']){ ?><strong>필수</strong><?php } ?></label>
<input type="url" name="mb_homepage" value="<?php echo get_text($member['mb_homepage']) ?>" id="reg_mb_homepage" class="frm_input full_input <?php echo $config['cf_req_homepage']?"required":""; ?>" maxlength="255" <?php echo $config['cf_req_homepage']?"required":""; ?> placeholder="홈페이지">
<input type="text" name="mb_homepage" value="<?php echo get_text($member['mb_homepage']) ?>" id="reg_mb_homepage" class="frm_input full_input <?php echo $config['cf_req_homepage']?"required":""; ?>" maxlength="255" <?php echo $config['cf_req_homepage']?"required":""; ?> placeholder="홈페이지">
</li>
<?php } ?>
@@ -272,19 +272,19 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
<?php if($config['cf_cert_use'] && $config['cf_cert_ipin']) { ?>
// 아이핀인증
$("#win_ipin_cert").click(function() {
$("#win_ipin_cert").click(function(e) {
if(!cert_confirm())
return false;
var url = "<?php echo G5_OKNAME_URL; ?>/ipin1.php";
certify_win_open('kcb-ipin', url);
certify_win_open('kcb-ipin', url, e);
return;
});
<?php } ?>
<?php if($config['cf_cert_use'] && $config['cf_cert_hp']) { ?>
// 휴대폰인증
$("#win_hp_cert").click(function() {
$("#win_hp_cert").click(function(e) {
if(!cert_confirm())
return false;
@@ -298,6 +298,10 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
$cert_url = G5_KCPCERT_URL.'/kcpcert_form.php';
$cert_type = 'kcp-hp';
break;
case 'lg':
$cert_url = G5_LGXPAY_URL.'/AuthOnlyReq.php';
$cert_type = 'lg-hp';
break;
default:
echo 'alert("기본환경설정에서 휴대폰 본인확인 설정을 해주십시오");';
echo 'return false;';
@@ -305,7 +309,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
}
?>
certify_win_open("<?php echo $cert_type; ?>", "<?php echo $cert_url; ?>");
certify_win_open("<?php echo $cert_type; ?>", "<?php echo $cert_url; ?>", e);
return;
});
<?php } ?>
plugin/okname/ipin1.php
+3 -1
View File
@@ -4,7 +4,9 @@ include_once('./_common.php');
// 금일 인증시도 회수 체크
certify_count_check($member['mb_id'], 'ipin');
include_once('./ipin.config.php');
// KISA 취약점 내용(KVE-2018-0291) hpcert1.php의 $cmd 함수에 대한 인자 값은 hpcert_config.php 파일에서 설정되나, 이를 다른 페이지에서 포함한 뒤 호출할 시 임의 값 설정 가능
// 이에 include_once 를 include 로 수정함
include('./ipin.config.php');
$option = "C";// Option
theme/basic/mobile/skin/member/basic/register_form.skin.php
+10 -6
View File
@@ -52,7 +52,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
if($config['cf_cert_use']) {
if($config['cf_cert_ipin'])
echo '<button type="button" id="win_ipin_cert" class="btn_frmline btn">아이핀 본인확인</button>'.PHP_EOL;
if($config['cf_cert_hp'] && $config['cf_cert_hp'] != 'lg')
if($config['cf_cert_hp'])
echo '<button type="button" id="win_hp_cert" class="btn_frmline btn">휴대폰 본인확인</button>'.PHP_EOL;
echo '<noscript>본인확인을 위해서는 자바스크립트 사용이 가능해야합니다.</noscript>'.PHP_EOL;
@@ -106,7 +106,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
<?php if ($config['cf_use_homepage']) { ?>
<li>
<label for="reg_mb_homepage" class="sound_only">홈페이지<?php if ($config['cf_req_homepage']){ ?><strong>필수</strong><?php } ?></label>
<input type="url" name="mb_homepage" value="<?php echo get_text($member['mb_homepage']) ?>" id="reg_mb_homepage" class="frm_input full_input <?php echo $config['cf_req_homepage']?"required":""; ?>" maxlength="255" <?php echo $config['cf_req_homepage']?"required":""; ?> placeholder="홈페이지">
<input type="text" name="mb_homepage" value="<?php echo get_text($member['mb_homepage']) ?>" id="reg_mb_homepage" class="frm_input full_input <?php echo $config['cf_req_homepage']?"required":""; ?>" maxlength="255" <?php echo $config['cf_req_homepage']?"required":""; ?> placeholder="홈페이지">
</li>
<?php } ?>
@@ -272,19 +272,19 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
<?php if($config['cf_cert_use'] && $config['cf_cert_ipin']) { ?>
// 아이핀인증
$("#win_ipin_cert").click(function() {
$("#win_ipin_cert").click(function(e) {
if(!cert_confirm())
return false;
var url = "<?php echo G5_OKNAME_URL; ?>/ipin1.php";
certify_win_open('kcb-ipin', url);
certify_win_open('kcb-ipin', url, e);
return;
});
<?php } ?>
<?php if($config['cf_cert_use'] && $config['cf_cert_hp']) { ?>
// 휴대폰인증
$("#win_hp_cert").click(function() {
$("#win_hp_cert").click(function(e) {
if(!cert_confirm())
return false;
@@ -298,6 +298,10 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
$cert_url = G5_KCPCERT_URL.'/kcpcert_form.php';
$cert_type = 'kcp-hp';
break;
case 'lg':
$cert_url = G5_LGXPAY_URL.'/AuthOnlyReq.php';
$cert_type = 'lg-hp';
break;
default:
echo 'alert("기본환경설정에서 휴대폰 본인확인 설정을 해주십시오");';
echo 'return false;';
@@ -305,7 +309,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
}
?>
certify_win_open("<?php echo $cert_type; ?>", "<?php echo $cert_url; ?>");
certify_win_open("<?php echo $cert_type; ?>", "<?php echo $cert_url; ?>", e);
return;
});
<?php } ?>