From b12bf551ec2ec2dc69399aa3b83e4c785d941bdb Mon Sep 17 00:00:00 2001 From: thisgun Date: Fri, 24 Apr 2026 09:20:20 +0000 Subject: [PATCH] =?UTF-8?q?[security]XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?= =?UTF-8?q?=EB=B0=8F=20token=20=EC=B6=94=EA=B0=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/popular_list.php | 2 ++ adm/shop_admin/itemformupdate.php | 26 ++++++++++++++++++++++++++ adm/sms_admin/form_list.php | 2 +- adm/sms_admin/form_update.php | 2 ++ adm/sms_admin/form_write.php | 3 +++ adm/sms_admin/member_update.php | 4 +++- adm/sms_admin/member_update_run.php | 2 ++ plugin/okname/find_hpcert2.php | 9 +++++---- plugin/okname/find_ipin2.php | 9 +++++---- plugin/social/unlink.php | 2 +- 10 files changed, 50 insertions(+), 11 deletions(-) diff --git a/adm/popular_list.php b/adm/popular_list.php index da83d1caa..e2d16888b 100644 --- a/adm/popular_list.php +++ b/adm/popular_list.php @@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, 'r'); // 체크된 자료 삭제 if (isset($_POST['chk']) && is_array($_POST['chk'])) { + check_admin_token(); + for ($i = 0; $i < count($_POST['chk']); $i++) { $pp_id = (int) $_POST['chk'][$i]; diff --git a/adm/shop_admin/itemformupdate.php b/adm/shop_admin/itemformupdate.php index 52ee641ee..2b468a90b 100644 --- a/adm/shop_admin/itemformupdate.php +++ b/adm/shop_admin/itemformupdate.php @@ -365,6 +365,32 @@ $it_explan = isset($_POST['it_explan']) ? $_POST['it_explan'] : ''; if ($it_name == "") alert("상품명을 입력해 주십시오."); +// 스킨 경로 검증 +$it_skin = isset($_POST['it_skin']) ? strip_tags(clean_xss_attributes($_POST['it_skin'])) : ''; +$it_mobile_skin = isset($_POST['it_mobile_skin']) ? strip_tags(clean_xss_attributes($_POST['it_mobile_skin'])) : ''; + +$check_files = array(); +if( !empty($it_skin) ) $check_files[] = $it_skin; +if( !empty($it_mobile_skin) ) $check_files[] = $it_mobile_skin; + +foreach( $check_files as $file ){ + if( empty($file) ) continue; + + if( preg_match('#\.+(\/|\\\)#', $file) ){ + alert('스킨파일명에 포함될수 없는 문자가 들어있습니다.'); + } + + if( ! is_include_path_check($file) ){ + alert('오류 : 데이터폴더가 포함된 path 또는 잘못된 path 를 포함할수 없습니다.'); + } + + $file_ext = pathinfo($file, PATHINFO_EXTENSION); + + if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) || ! preg_match('/^.*\.(php|htm|html)$/i', $file) ) { + alert('스킨 파일 경로의 확장자는 php, htm, html 만 허용합니다.'); + } +} + $sql_common = " ca_id = '$ca_id', ca_id2 = '$ca_id2', ca_id3 = '$ca_id3', diff --git a/adm/sms_admin/form_list.php b/adm/sms_admin/form_list.php index 4322c2b7c..dbfcb5a62 100644 --- a/adm/sms_admin/form_list.php +++ b/adm/sms_admin/form_list.php @@ -65,7 +65,7 @@ function book_all_checked(chk) function book_del(fo_no) { if (confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n그래도 삭제하시겠습니까?")) - location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=&fg_no=&st=&sv="; + location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=&fg_no=&st=&sv=&token="; } function multi_update(sel) diff --git a/adm/sms_admin/form_update.php b/adm/sms_admin/form_update.php index c086cb059..7662c32b8 100644 --- a/adm/sms_admin/form_update.php +++ b/adm/sms_admin/form_update.php @@ -4,6 +4,8 @@ include_once("./_common.php"); auth_check_menu($auth, $sub_menu, "w"); +check_admin_token(); + $fo_name = isset($_REQUEST['fo_name']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_name'])) : ''; $fo_content = isset($_REQUEST['fo_content']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_content'])) : ''; $fo_receipt = isset($_REQUEST['fo_receipt']) ? clean_xss_tags($_REQUEST['fo_receipt'], 1, 1) : ''; diff --git a/adm/sms_admin/form_write.php b/adm/sms_admin/form_write.php index 102263449..4123674ca 100644 --- a/adm/sms_admin/form_write.php +++ b/adm/sms_admin/form_write.php @@ -4,6 +4,8 @@ include_once("./_common.php"); auth_check_menu($auth, $sub_menu, "w"); +$token = get_token(); + $g5['title'] = "이모티콘 "; $fo_no = isset($_REQUEST['fo_no']) ? (int) $_REQUEST['fo_no'] : 0; @@ -34,6 +36,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php'); +
diff --git a/adm/sms_admin/member_update.php b/adm/sms_admin/member_update.php index 0008c794f..6b6b5caa7 100644 --- a/adm/sms_admin/member_update.php +++ b/adm/sms_admin/member_update.php @@ -4,6 +4,8 @@ include_once("./_common.php"); auth_check_menu($auth, $sub_menu, "r"); +$token = get_token(); + $g5['title'] = "회원정보 업데이트"; include_once(G5_ADMIN_PATH.'/admin.head.php'); @@ -37,7 +39,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php'); $( "#mb_update_form" ).submit(function( e ) { e.preventDefault(); $("#res_msg").html('업데이트 중입니다. 잠시만 기다려 주십시오...'); - var params = { mtype : 'json' }; + var params = { mtype : 'json', token : '' }; $.ajax({ url: $(this).attr("action"), cache:false, diff --git a/adm/sms_admin/member_update_run.php b/adm/sms_admin/member_update_run.php index aeea60f48..bb8603b5b 100644 --- a/adm/sms_admin/member_update_run.php +++ b/adm/sms_admin/member_update_run.php @@ -26,6 +26,8 @@ if( $mtype == "json" ){ auth_check_menu($auth, $sub_menu, "w"); } +check_admin_token(); + $count = 0; $hp_yes = 0; $hp_no = 0; diff --git a/plugin/okname/find_hpcert2.php b/plugin/okname/find_hpcert2.php index 0e0bc5fa3..ad0181a0f 100644 --- a/plugin/okname/find_hpcert2.php +++ b/plugin/okname/find_hpcert2.php @@ -125,18 +125,19 @@ if (empty($row['mb_id'])) { // ci로 등록된 계정이 없다면 $mb_dupinfo = $md5_ci; } -$md5_cert_no = md5($cert_no); -$hash_data = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no); +$cert_type = 'hp'; +$md5_cert_no = md5($req_num); +$hash_data = md5($mb_name.$cert_type.$mb_birth.$phone_no.$md5_cert_no); // 성인인증결과 $adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME)); -$adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0; +$adult = ((int)$mb_birth <= (int)$adult_day) ? 1 : 0; set_session("ss_cert_type", $cert_type); set_session("ss_cert_no", $md5_cert_no); set_session("ss_cert_hash", $hash_data); set_session("ss_cert_adult", $adult); -set_session("ss_cert_birth", $birth_day); +set_session("ss_cert_birth", $mb_birth); set_session('ss_cert_sex', ($field[9] == 1 ? 'M' : 'F')); set_session('ss_cert_dupinfo', $mb_dupinfo); set_session('ss_cert_mb_id', $row['mb_id']); diff --git a/plugin/okname/find_ipin2.php b/plugin/okname/find_ipin2.php index f617791c0..b28f6388a 100644 --- a/plugin/okname/find_ipin2.php +++ b/plugin/okname/find_ipin2.php @@ -99,18 +99,19 @@ if (empty($row['mb_id'])) { // ci로 등록된 계정이 없다면 $mb_dupinfo = $md5_ci; } -$md5_cert_no = md5($cert_no); -$hash_data = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no); +$cert_type = 'ipin'; +$md5_cert_no = md5($req_num); +$hash_data = md5($mb_name.$cert_type.$mb_birth.$md5_cert_no); // 성인인증결과 $adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME)); -$adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0; +$adult = ((int)$mb_birth <= (int)$adult_day) ? 1 : 0; set_session("ss_cert_type", $cert_type); set_session("ss_cert_no", $md5_cert_no); set_session("ss_cert_hash", $hash_data); set_session("ss_cert_adult", $adult); -set_session("ss_cert_birth", $birth_day); +set_session("ss_cert_birth", $mb_birth); set_session('ss_cert_sex', ($field[9] == 1 ? 'M' : 'F')); set_session('ss_cert_dupinfo', $mb_dupinfo); set_session('ss_cert_mb_id', $row['mb_id']); diff --git a/plugin/social/unlink.php b/plugin/social/unlink.php index ca4b4cdfe..525c643d4 100644 --- a/plugin/social/unlink.php +++ b/plugin/social/unlink.php @@ -26,7 +26,7 @@ if($mp_no){ $sql = "SELECT * from {$g5['social_profile_table']} where mb_id= '".$mb_id."' and mp_no= $mp_no"; $row = sql_fetch($sql); } else if($provider){ - $sql = "SELECT * from {$g5['social_profile_table']} where mb_id= '".$mb_id."' and provider= '".$provider."'"; + $sql = "SELECT * from {$g5['social_profile_table']} where mb_id= '".$mb_id."' and provider= '".sql_real_escape_string($provider)."'"; $row = sql_fetch($sql); }