gper/Gnuboard5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[security]XSS 취약점 및 token 추가

Browse Source
This commit is contained in:
thisgun
2026-05-26 03:29:51 +00:00
parent 65a419e9cd
commit b12bf551ec
10 changed files with 50 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
adm/popular_list.php
+2
View File
@@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, 'r');
// 체크된 자료 삭제
if (isset($_POST['chk']) && is_array($_POST['chk'])) {
check_admin_token();
for ($i = 0; $i < count($_POST['chk']); $i++) {
$pp_id = (int) $_POST['chk'][$i];
adm/shop_admin/itemformupdate.php
+26
View File
@@ -365,6 +365,32 @@ $it_explan = isset($_POST['it_explan']) ? $_POST['it_explan'] : '';
if ($it_name == "")
alert("상품명을 입력해 주십시오.");
// 스킨 경로 검증
$it_skin = isset($_POST['it_skin']) ? strip_tags(clean_xss_attributes($_POST['it_skin'])) : '';
$it_mobile_skin = isset($_POST['it_mobile_skin']) ? strip_tags(clean_xss_attributes($_POST['it_mobile_skin'])) : '';
$check_files = array();
if( !empty($it_skin) ) $check_files[] = $it_skin;
if( !empty($it_mobile_skin) ) $check_files[] = $it_mobile_skin;
foreach( $check_files as $file ){
if( empty($file) ) continue;
if( preg_match('#\.+(\/|\\\)#', $file) ){
alert('스킨파일명에 포함될수 없는 문자가 들어있습니다.');
}
if( ! is_include_path_check($file) ){
alert('오류 : 데이터폴더가 포함된 path 또는 잘못된 path 를 포함할수 없습니다.');
}
$file_ext = pathinfo($file, PATHINFO_EXTENSION);
if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) || ! preg_match('/^.*\.(php|htm|html)$/i', $file) ) {
alert('스킨 파일 경로의 확장자는 php, htm, html 만 허용합니다.');
}
}
$sql_common = " ca_id = '$ca_id',
ca_id2 = '$ca_id2',
ca_id3 = '$ca_id3',
adm/sms_admin/form_list.php
+1 -1
View File
@@ -65,7 +65,7 @@ function book_all_checked(chk)
function book_del(fo_no)
{
if (confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n그래도 삭제하시겠습니까?"))
location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=<?php echo $page?>&fg_no=<?php echo $fg_no?>&st=<?php echo get_text($st); ?>&sv=<?php echo get_text($sv); ?>";
location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=<?php echo $page?>&fg_no=<?php echo $fg_no?>&st=<?php echo get_text($st); ?>&sv=<?php echo get_text($sv); ?>&token=<?php echo $token; ?>";
}
function multi_update(sel)
adm/sms_admin/form_update.php
+2
View File
@@ -4,6 +4,8 @@ include_once("./_common.php");
auth_check_menu($auth, $sub_menu, "w");
check_admin_token();
$fo_name = isset($_REQUEST['fo_name']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_name'])) : '';
$fo_content = isset($_REQUEST['fo_content']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_content'])) : '';
$fo_receipt = isset($_REQUEST['fo_receipt']) ? clean_xss_tags($_REQUEST['fo_receipt'], 1, 1) : '';
adm/sms_admin/form_write.php
+3
View File
@@ -4,6 +4,8 @@ include_once("./_common.php");
auth_check_menu($auth, $sub_menu, "w");
$token = get_token();
$g5['title'] = "이모티콘 ";
$fo_no = isset($_REQUEST['fo_no']) ? (int) $_REQUEST['fo_no'] : 0;
@@ -34,6 +36,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
<input type="hidden" name="page" value="<?php echo $page?>">
<input type="hidden" name="fo_no" value="<?php echo $write['fo_no']; ?>">
<input type="hidden" name="get_fg_no" value="<?php echo $fg_no?>">
<input type="hidden" name="token" value="<?php echo $token; ?>">
<div class="tbl_frm01 tbl_wrap">
<table>
adm/sms_admin/member_update.php
+3 -1
View File
@@ -4,6 +4,8 @@ include_once("./_common.php");
auth_check_menu($auth, $sub_menu, "r");
$token = get_token();
$g5['title'] = "회원정보 업데이트";
include_once(G5_ADMIN_PATH.'/admin.head.php');
@@ -37,7 +39,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
$( "#mb_update_form" ).submit(function( e ) {
e.preventDefault();
$("#res_msg").html('업데이트 중입니다. 잠시만 기다려 주십시오...');
var params = { mtype : 'json' };
var params = { mtype : 'json', token : '<?php echo $token; ?>' };
$.ajax({
url: $(this).attr("action"),
cache:false,
adm/sms_admin/member_update_run.php
+2
View File
@@ -26,6 +26,8 @@ if( $mtype == "json" ){
auth_check_menu($auth, $sub_menu, "w");
}
check_admin_token();
$count = 0;
$hp_yes = 0;
$hp_no = 0;
plugin/okname/find_hpcert2.php
+5 -4
View File
@@ -125,18 +125,19 @@ if (empty($row['mb_id'])) { // ci로 등록된 계정이 없다면
$mb_dupinfo = $md5_ci;
}
$md5_cert_no = md5($cert_no);
$hash_data = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no);
$cert_type = 'hp';
$md5_cert_no = md5($req_num);
$hash_data = md5($mb_name.$cert_type.$mb_birth.$phone_no.$md5_cert_no);
// 성인인증결과
$adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME));
$adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0;
$adult = ((int)$mb_birth <= (int)$adult_day) ? 1 : 0;
set_session("ss_cert_type", $cert_type);
set_session("ss_cert_no", $md5_cert_no);
set_session("ss_cert_hash", $hash_data);
set_session("ss_cert_adult", $adult);
set_session("ss_cert_birth", $birth_day);
set_session("ss_cert_birth", $mb_birth);
set_session('ss_cert_sex', ($field[9] == 1 ? 'M' : 'F'));
set_session('ss_cert_dupinfo', $mb_dupinfo);
set_session('ss_cert_mb_id', $row['mb_id']);
plugin/okname/find_ipin2.php
+5 -4
View File
@@ -99,18 +99,19 @@ if (empty($row['mb_id'])) { // ci로 등록된 계정이 없다면
$mb_dupinfo = $md5_ci;
}
$md5_cert_no = md5($cert_no);
$hash_data = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no);
$cert_type = 'ipin';
$md5_cert_no = md5($req_num);
$hash_data = md5($mb_name.$cert_type.$mb_birth.$md5_cert_no);
// 성인인증결과
$adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME));
$adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0;
$adult = ((int)$mb_birth <= (int)$adult_day) ? 1 : 0;
set_session("ss_cert_type", $cert_type);
set_session("ss_cert_no", $md5_cert_no);
set_session("ss_cert_hash", $hash_data);
set_session("ss_cert_adult", $adult);
set_session("ss_cert_birth", $birth_day);
set_session("ss_cert_birth", $mb_birth);
set_session('ss_cert_sex', ($field[9] == 1 ? 'M' : 'F'));
set_session('ss_cert_dupinfo', $mb_dupinfo);
set_session('ss_cert_mb_id', $row['mb_id']);
plugin/social/unlink.php
+1 -1
View File
@@ -26,7 +26,7 @@ if($mp_no){
$sql = "SELECT * from {$g5['social_profile_table']} where mb_id= '".$mb_id."' and mp_no= $mp_no";
$row = sql_fetch($sql);
} else if($provider){
$sql = "SELECT * from {$g5['social_profile_table']} where mb_id= '".$mb_id."' and provider= '".$provider."'";
$sql = "SELECT * from {$g5['social_profile_table']} where mb_id= '".$mb_id."' and provider= '".sql_real_escape_string($provider)."'";
$row = sql_fetch($sql);
}