From 2541664ae2193589b2f2a159e255c4133565d9e0 Mon Sep 17 00:00:00 2001 From: thisgun Date: Fri, 12 Oct 2018 09:15:12 +0900 Subject: [PATCH 01/10] =?UTF-8?q?KVE-2018-0291=20=EC=B6=94=EA=B0=80=20?= =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- plugin/okname/ipin1.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/plugin/okname/ipin1.php b/plugin/okname/ipin1.php index 864995786..f448c216d 100644 --- a/plugin/okname/ipin1.php +++ b/plugin/okname/ipin1.php @@ -4,7 +4,9 @@ include_once('./_common.php'); // 금일 인증시도 회수 체크 certify_count_check($member['mb_id'], 'ipin'); -include_once('./ipin.config.php'); +// KISA 취약점 내용(KVE-2018-0291) hpcert1.php의 $cmd 함수에 대한 인자 값은 hpcert_config.php 파일에서 설정되나, 이를 다른 페이지에서 포함한 뒤 호출할 시 임의 값 설정 가능 +// 이에 include_once 를 include 로 수정함 +include('./ipin.config.php'); $option = "C";// Option From 784f63189625f2ee427e9a53b4a65b1759dd1464 Mon Sep 17 00:00:00 2001 From: thisgun Date: Wed, 17 Oct 2018 16:29:50 +0900 Subject: [PATCH 02/10] =?UTF-8?q?get=5Fselected=20get=5Fchecked=20?= =?UTF-8?q?=ED=95=A8=EC=88=98=20=EB=B9=84=EA=B5=90=EB=AC=B8=20=EC=BD=94?= =?UTF-8?q?=EB=93=9C=20=EB=8B=A4=EC=8B=9C=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lib/common.lib.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/lib/common.lib.php b/lib/common.lib.php index b9d16cc64..65f555a0d 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -2070,12 +2070,20 @@ function abs_ip2long($ip='') function get_selected($field, $value) { + if( is_int($value) ){ + return ((int) $field===$value) ? ' selected="selected"' : ''; + } + return ($field===$value) ? ' selected="selected"' : ''; } function get_checked($field, $value) { + if( is_int($value) ){ + return ((int) $field===$value) ? ' checked="checked"' : ''; + } + return ($field===$value) ? ' checked="checked"' : ''; } From aa7ffdf093272e96ac479589afc09c19848869b7 Mon Sep 17 00:00:00 2001 From: thisgun Date: Wed, 17 Oct 2018 18:01:42 +0900 Subject: [PATCH 03/10] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C5=20?= =?UTF-8?q?=EB=8B=A4=EC=A4=91=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98?= =?UTF-8?q?=EC=A0=95=20adm1nkyj(=20http://adm1nkyj.kr/=20)=20=EC=A0=9C?= =?UTF-8?q?=EB=B3=B4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/contentformupdate.php | 5 +++-- bbs/content.php | 2 ++ bbs/view_image.php | 3 +-- g4_import_run.php | 1 + 4 files changed, 7 insertions(+), 4 deletions(-) diff --git a/adm/contentformupdate.php b/adm/contentformupdate.php index dff780a39..69f82f0b0 100644 --- a/adm/contentformupdate.php +++ b/adm/contentformupdate.php @@ -20,6 +20,7 @@ if ($w == "" || $w == "u") $co_row = sql_fetch($sql); } +$co_id = preg_replace('/[^a-z0-9_]/i', '', $co_id); $co_subject = strip_tags($co_subject); $co_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_head, 0, 255)); $co_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_tail, 0, 255)); @@ -59,12 +60,12 @@ if( $co_include_tail ){ } } -if( $co_include_head && ! is_include_path_check($co_include_head) ){ +if( $co_include_head && ! is_include_path_check($co_include_head, 1) ){ $co_include_head = ''; $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.'; } -if( $co_include_tail && ! is_include_path_check($co_include_tail) ){ +if( $co_include_tail && ! is_include_path_check($co_include_tail, 1) ){ $co_include_tail = ''; $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.'; } diff --git a/bbs/content.php b/bbs/content.php index f9551ed80..366e11e54 100644 --- a/bbs/content.php +++ b/bbs/content.php @@ -1,6 +1,8 @@ 관리자 모드에서 게시판관리->내용 관리를 먼저 확인해 주세요.'); diff --git a/bbs/view_image.php b/bbs/view_image.php index 779f83a30..6bcd005e2 100644 --- a/bbs/view_image.php +++ b/bbs/view_image.php @@ -4,8 +4,7 @@ include_once('./_common.php'); $g5['title'] = '이미지 크게보기'; include_once(G5_PATH.'/head.sub.php'); -$filename = $_GET['fn']; -$bo_table = $_GET['bo_table']; +$filename = preg_replace('/[^A-Za-z0-9 _ .-]/', '', $_GET['fn']); if(strpos($filename, 'data/editor')) { $editor_file = strstr($filename, 'editor'); diff --git a/g4_import_run.php b/g4_import_run.php index 259832777..6681df0e8 100644 --- a/g4_import_run.php +++ b/g4_import_run.php @@ -71,6 +71,7 @@ document.onkeydown = noRefresh ; Date: Wed, 17 Oct 2018 18:32:58 +0900 Subject: [PATCH 04/10] =?UTF-8?q?5.3.1.9=20=EB=B2=84=EC=A0=84=20=EC=88=98?= =?UTF-8?q?=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- config.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config.php b/config.php index 57cadaacb..c7356a38d 100644 --- a/config.php +++ b/config.php @@ -5,7 +5,7 @@ ********************/ define('G5_VERSION', '그누보드5'); -define('G5_GNUBOARD_VER', '5.3.1.8'); +define('G5_GNUBOARD_VER', '5.3.1.9'); // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음 define('_GNUBOARD_', true); From c8d41381c9c2df7ef15b00d2ea40fba11b7f9a6f Mon Sep 17 00:00:00 2001 From: thisgun Date: Wed, 17 Oct 2018 19:39:00 +0900 Subject: [PATCH 05/10] =?UTF-8?q?=EC=9D=B4=EB=AF=B8=EC=A7=80=20=EC=83=81?= =?UTF-8?q?=EC=84=B8=20=EB=B3=B4=EA=B8=B0=20=ED=8E=98=EC=9D=B4=EC=A7=80=20?= =?UTF-8?q?=ED=99=95=EC=9E=A5=EC=9E=90=20=EC=B2=B4=ED=81=AC=20=EC=B6=94?= =?UTF-8?q?=EA=B0=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/view_image.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/bbs/view_image.php b/bbs/view_image.php index 6bcd005e2..bc7f8e63e 100644 --- a/bbs/view_image.php +++ b/bbs/view_image.php @@ -4,7 +4,13 @@ include_once('./_common.php'); $g5['title'] = '이미지 크게보기'; include_once(G5_PATH.'/head.sub.php'); -$filename = preg_replace('/[^A-Za-z0-9 _ .-]/', '', $_GET['fn']); +$filename = preg_replace('/[^A-Za-z0-9 _ .-\/]/', '', $_GET['fn']); + +$extension = pathinfo($filename, PATHINFO_EXTENSION); + +if ( ! preg_match('/(jpg|jpeg|png|gif|bmp)$/i', $extension) ){ + alert_close('확장자가 이미지인것만 요청할수 있습니다.'); +} if(strpos($filename, 'data/editor')) { $editor_file = strstr($filename, 'editor'); From d930b36d6102e675a52f278ca3731830993207b9 Mon Sep 17 00:00:00 2001 From: thisgun Date: Thu, 18 Oct 2018 18:44:24 +0900 Subject: [PATCH 06/10] =?UTF-8?q?LGU=20=EB=B3=B8=EC=9D=B8=EA=B2=B0?= =?UTF-8?q?=EC=A0=9C=20=EB=AA=A8=EB=B0=94=EC=9D=BC=EC=97=90=EC=84=9C=20?= =?UTF-8?q?=EC=B6=9C=EB=A0=A5=EC=95=88=EB=90=98=EB=8A=94=20=EB=AC=B8?= =?UTF-8?q?=EC=A0=9C=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- js/certify.js | 7 ++++++- mobile/skin/member/basic/register_form.skin.php | 16 ++++++++++------ .../skin/member/basic/register_form.skin.php | 16 ++++++++++------ 3 files changed, 26 insertions(+), 13 deletions(-) diff --git a/js/certify.js b/js/certify.js index d98c59785..bcf4f9ed8 100644 --- a/js/certify.js +++ b/js/certify.js @@ -1,6 +1,11 @@ // 본인확인 인증창 호출 -function certify_win_open(type, url) +function certify_win_open(type, url, event) { + + if (typeof event == "undefined") { + event = window.event; + } + if(type == 'kcb-ipin') { var popupWindow = window.open( url, "kcbPop", "left=200, top=100, status=0, width=450, height=550" ); diff --git a/mobile/skin/member/basic/register_form.skin.php b/mobile/skin/member/basic/register_form.skin.php index 7719e0deb..bcd18bfd5 100644 --- a/mobile/skin/member/basic/register_form.skin.php +++ b/mobile/skin/member/basic/register_form.skin.php @@ -52,7 +52,7 @@ add_stylesheet('', if($config['cf_cert_use']) { if($config['cf_cert_ipin']) echo ''.PHP_EOL; - if($config['cf_cert_hp'] && $config['cf_cert_hp'] != 'lg') + if($config['cf_cert_hp']) echo ''.PHP_EOL; echo ''.PHP_EOL; @@ -106,7 +106,7 @@ add_stylesheet('',
  • - " maxlength="255" placeholder="홈페이지"> + " maxlength="255" placeholder="홈페이지">
    • @@ -272,19 +272,19 @@ add_stylesheet('', // 아이핀인증 - $("#win_ipin_cert").click(function() { + $("#win_ipin_cert").click(function(e) { if(!cert_confirm()) return false; var url = "/ipin1.php"; - certify_win_open('kcb-ipin', url); + certify_win_open('kcb-ipin', url, e); return; }); // 휴대폰인증 - $("#win_hp_cert").click(function() { + $("#win_hp_cert").click(function(e) { if(!cert_confirm()) return false; @@ -298,6 +298,10 @@ add_stylesheet('', $cert_url = G5_KCPCERT_URL.'/kcpcert_form.php'; $cert_type = 'kcp-hp'; break; + case 'lg': + $cert_url = G5_LGXPAY_URL.'/AuthOnlyReq.php'; + $cert_type = 'lg-hp'; + break; default: echo 'alert("기본환경설정에서 휴대폰 본인확인 설정을 해주십시오");'; echo 'return false;'; @@ -305,7 +309,7 @@ add_stylesheet('', } ?> - certify_win_open("", ""); + certify_win_open("", "", e); return; }); diff --git a/theme/basic/mobile/skin/member/basic/register_form.skin.php b/theme/basic/mobile/skin/member/basic/register_form.skin.php index 3e11894c1..6f9137059 100644 --- a/theme/basic/mobile/skin/member/basic/register_form.skin.php +++ b/theme/basic/mobile/skin/member/basic/register_form.skin.php @@ -52,7 +52,7 @@ add_stylesheet('', if($config['cf_cert_use']) { if($config['cf_cert_ipin']) echo ''.PHP_EOL; - if($config['cf_cert_hp'] && $config['cf_cert_hp'] != 'lg') + if($config['cf_cert_hp']) echo ''.PHP_EOL; echo ''.PHP_EOL; @@ -106,7 +106,7 @@ add_stylesheet('',
  • - " maxlength="255" placeholder="홈페이지"> + " maxlength="255" placeholder="홈페이지">
    • @@ -272,19 +272,19 @@ add_stylesheet('', // 아이핀인증 - $("#win_ipin_cert").click(function() { + $("#win_ipin_cert").click(function(e) { if(!cert_confirm()) return false; var url = "/ipin1.php"; - certify_win_open('kcb-ipin', url); + certify_win_open('kcb-ipin', url, e); return; }); // 휴대폰인증 - $("#win_hp_cert").click(function() { + $("#win_hp_cert").click(function(e) { if(!cert_confirm()) return false; @@ -298,6 +298,10 @@ add_stylesheet('', $cert_url = G5_KCPCERT_URL.'/kcpcert_form.php'; $cert_type = 'kcp-hp'; break; + case 'lg': + $cert_url = G5_LGXPAY_URL.'/AuthOnlyReq.php'; + $cert_type = 'lg-hp'; + break; default: echo 'alert("기본환경설정에서 휴대폰 본인확인 설정을 해주십시오");'; echo 'return false;'; @@ -305,7 +309,7 @@ add_stylesheet('', } ?> - certify_win_open("", ""); + certify_win_open("", "", e); return; }); From 798951f4c61cf19d38cfb34c40ef7734c40f5b08 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 22 Oct 2018 14:33:02 +0900 Subject: [PATCH 07/10] =?UTF-8?q?=EC=9D=B4=EB=AF=B8=EC=A7=80=20=EB=B3=B4?= =?UTF-8?q?=EA=B8=B0=20=EC=9E=98=EB=AA=BB=EB=90=9C=20=EC=A0=95=EA=B7=9C?= =?UTF-8?q?=EC=8B=9D=20=EC=BD=94=EB=93=9C=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/view_image.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bbs/view_image.php b/bbs/view_image.php index bc7f8e63e..196df9f4c 100644 --- a/bbs/view_image.php +++ b/bbs/view_image.php @@ -4,12 +4,12 @@ include_once('./_common.php'); $g5['title'] = '이미지 크게보기'; include_once(G5_PATH.'/head.sub.php'); -$filename = preg_replace('/[^A-Za-z0-9 _ .-\/]/', '', $_GET['fn']); +$filename = preg_replace('/[^A-Za-z0-9 _ .\-\/]/', '', $_GET['fn']); $extension = pathinfo($filename, PATHINFO_EXTENSION); if ( ! preg_match('/(jpg|jpeg|png|gif|bmp)$/i', $extension) ){ - alert_close('확장자가 이미지인것만 요청할수 있습니다.'); + alert_close('이미지 확장자가 아닙니다.'); } if(strpos($filename, 'data/editor')) { From c82c937fbb3f092b52c895561eec73499a739389 Mon Sep 17 00:00:00 2001 From: thisgun Date: Fri, 26 Oct 2018 11:54:53 +0900 Subject: [PATCH 08/10] =?UTF-8?q?get=5Freal=5Fclient=5Fip=20=ED=95=A8?= =?UTF-8?q?=EC=88=98=EC=97=90=20=ED=95=84=ED=84=B0=EB=A7=81=20=EC=BD=94?= =?UTF-8?q?=EB=93=9C=20=EC=B6=94=EA=B0=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lib/common.lib.php | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/common.lib.php b/lib/common.lib.php index 65f555a0d..c12ff17e3 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -3423,10 +3423,13 @@ function is_use_email_certify(){ function get_real_client_ip(){ - if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])) - return $_SERVER['HTTP_X_FORWARDED_FOR']; + $real_ip = $_SERVER['REMOTE_ADDR']; - return $_SERVER['REMOTE_ADDR']; + if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\z/', $_SERVER['HTTP_X_FORWARDED_FOR']) ){ + $real_ip = $_SERVER['HTTP_X_FORWARDED_FOR']; + } + + return preg_replace('/[^0-9.]/', '', $real_ip); } function get_call_func_cache($func, $args=array()){ From a45241f4bc46aee1ab2cc0749f6444b043681edf Mon Sep 17 00:00:00 2001 From: thisgun Date: Tue, 30 Oct 2018 09:42:48 +0900 Subject: [PATCH 09/10] =?UTF-8?q?XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/board_form_update.php | 3 +++ adm/boardgroup_form.php | 2 +- adm/config_form.php | 2 +- adm/config_form_update.php | 2 ++ adm/menu_list.php | 14 ++++++++++++++ adm/menu_list_update.php | 4 ++-- bbs/board_head.php | 4 ++-- bbs/board_tail.php | 4 ++-- bbs/password.php | 8 ++++---- 9 files changed, 31 insertions(+), 12 deletions(-) diff --git a/adm/board_form_update.php b/adm/board_form_update.php index 912887760..2222baadb 100644 --- a/adm/board_form_update.php +++ b/adm/board_form_update.php @@ -72,6 +72,9 @@ $bo_category_list = str_replace($src_char, $dst_char, $bo_category_list); //https://github.com/gnuboard/gnuboard5/commit/f5f4925d4eb28ba1af728e1065fc2bdd9ce1da58 에 따른 조치 $str_bo_category_list = isset($_POST['bo_category_list']) ? preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $_POST['bo_category_list']) : ''; +$_POST['bo_subject'] = strip_tags($_POST['bo_subject']); +$_POST['bo_mobile_subject'] = strip_tags($_POST['bo_mobile_subject']); + $sql_common = " gr_id = '{$_POST['gr_id']}', bo_subject = '{$_POST['bo_subject']}', bo_mobile_subject = '{$_POST['bo_mobile_subject']}', diff --git a/adm/boardgroup_form.php b/adm/boardgroup_form.php index 73e162d98..c9e8338bd 100644 --- a/adm/boardgroup_form.php +++ b/adm/boardgroup_form.php @@ -117,7 +117,7 @@ include_once('./admin.head.php'); - + diff --git a/adm/config_form.php b/adm/config_form.php index 00915fe7d..e4daee961 100644 --- a/adm/config_form.php +++ b/adm/config_form.php @@ -1317,7 +1317,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) { - + diff --git a/adm/config_form_update.php b/adm/config_form_update.php index 03179c345..126786382 100644 --- a/adm/config_form_update.php +++ b/adm/config_form_update.php @@ -26,6 +26,8 @@ if(!$_POST['cf_cert_use']) { $cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',', $_POST['cf_social_servicelist']) : ''; +$_POST['cf_title'] = strip_tags($_POST['cf_title']); + $sql = " update {$g5['config_table']} set cf_title = '{$_POST['cf_title']}', cf_admin = '{$_POST['cf_admin']}', diff --git a/adm/menu_list.php b/adm/menu_list.php index ffe88aee7..4a6c25127 100644 --- a/adm/menu_list.php +++ b/adm/menu_list.php @@ -196,6 +196,20 @@ function base_convert(number, frombase, tobase) { function fmenulist_submit(f) { + + var me_links = document.getElementsByName('me_link[]'); + var reg = /^javascript/; + + for (i=0; i diff --git a/adm/menu_list_update.php b/adm/menu_list_update.php index f05e2ec22..4244d3343 100644 --- a/adm/menu_list_update.php +++ b/adm/menu_list_update.php @@ -23,8 +23,8 @@ for ($i=0; $i<$count; $i++) $code = $_POST['code'][$i]; $me_name = $_POST['me_name'][$i]; - $me_link = $_POST['me_link'][$i]; - + $me_link = preg_match('/^javascript/', $_POST['me_link'][$i]) ? G5_URL : strip_tags($_POST['me_link'][$i]); + if(!$code || !$me_name || !$me_link) continue; diff --git a/bbs/board_head.php b/bbs/board_head.php index 04b60450f..a62706a28 100644 --- a/bbs/board_head.php +++ b/bbs/board_head.php @@ -5,13 +5,13 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가 if (G5_IS_MOBILE) { // 모바일의 경우 설정을 따르지 않는다. include_once(G5_BBS_PATH.'/_head.php'); - echo stripslashes($board['bo_mobile_content_head']); + echo html_purifier(stripslashes($board['bo_mobile_content_head'])); } else { if(is_include_path_check($board['bo_include_head'])) { //파일경로 체크 @include ($board['bo_include_head']); } else { //파일경로가 올바르지 않으면 기본파일을 가져옴 include_once(G5_BBS_PATH.'/_head.php'); } - echo stripslashes($board['bo_content_head']); + echo html_purifier(stripslashes($board['bo_content_head'])); } ?> \ No newline at end of file diff --git a/bbs/board_tail.php b/bbs/board_tail.php index 57b81b46e..436e2cc3b 100644 --- a/bbs/board_tail.php +++ b/bbs/board_tail.php @@ -3,11 +3,11 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가 // 게시판 관리의 하단 파일 경로 if (G5_IS_MOBILE) { - echo stripslashes($board['bo_mobile_content_tail']); + echo html_purifier(stripslashes($board['bo_mobile_content_tail'])); // 모바일의 경우 설정을 따르지 않는다. include_once(G5_BBS_PATH.'/_tail.php'); } else { - echo stripslashes($board['bo_content_tail']); + echo html_purifier(stripslashes($board['bo_content_tail'])); if(is_include_path_check($board['bo_include_tail'])) { //파일경로 체크 @include ($board['bo_include_tail']); } else { //파일경로가 올바르지 않으면 기본파일을 가져옴 diff --git a/bbs/password.php b/bbs/password.php index e5e0a4d4e..646f3b645 100644 --- a/bbs/password.php +++ b/bbs/password.php @@ -43,8 +43,8 @@ switch ($w) { include_once(G5_PATH.'/head.sub.php'); -//if ($board['bo_include_head']) { @include ($board['bo_include_head']); } -//if ($board['bo_content_head']) { echo stripslashes($board['bo_content_head']); } +//if ($board['bo_include_head'] && is_include_path_check($board['bo_content_head'])) { @include ($board['bo_include_head']); } +//if ($board['bo_content_head']) { echo html_purifier(stripslashes($board['bo_content_head'])); } /* 비밀글의 제목을 가져옴 지운아빠 2013-01-29 */ $sql = " select wr_subject from {$write_table} @@ -57,8 +57,8 @@ $g5['title'] = get_text($row['wr_subject']); include_once($member_skin_path.'/password.skin.php'); -//if ($board['bo_content_tail']) { echo stripslashes($board['bo_content_tail']); } -//if ($board['bo_include_tail']) { @include ($board['bo_include_tail']); } +//if ($board['bo_content_tail']) { echo html_purifier(stripslashes($board['bo_content_tail'])); } +//if ($board['bo_include_tail'] && is_include_path_check($board['bo_content_tail'])) { @include ($board['bo_include_tail']); } include_once(G5_PATH.'/tail.sub.php'); ?> From 26f6edfd0b7f1bf1464d08c1da82f6eba0c45b10 Mon Sep 17 00:00:00 2001 From: thisgun Date: Tue, 30 Oct 2018 16:02:50 +0900 Subject: [PATCH 10/10] =?UTF-8?q?=EC=86=8C=EC=85=9C=20=EB=A1=9C=EA=B7=B8?= =?UTF-8?q?=EC=9D=B8=ED=95=9C=20=EA=B3=84=EC=A0=95=EC=9D=80=20=ED=9A=8C?= =?UTF-8?q?=EC=9B=90=20=ED=83=88=ED=87=B4=EB=A5=BC=20=EB=AA=BB=ED=95=98?= =?UTF-8?q?=EB=8A=94=20=EC=98=A4=EB=A5=98=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/member_confirm.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bbs/member_confirm.php b/bbs/member_confirm.php index 685dec86c..722a78302 100644 --- a/bbs/member_confirm.php +++ b/bbs/member_confirm.php @@ -11,16 +11,16 @@ else $urlencode = urlencode($_SERVER[REQUEST_URI]); */ +$url = clean_xss_tags($_GET['url']); + //소셜 로그인 한 경우 -if( function_exists('social_member_comfirm_redirect') ){ +if( function_exists('social_member_comfirm_redirect') && (! $url || $url === 'register_form.php') ){ social_member_comfirm_redirect(); } $g5['title'] = '회원 비밀번호 확인'; include_once('./_head.sub.php'); -$url = clean_xss_tags($_GET['url']); - // url 체크 check_url_host($url, '', G5_URL, true);