gper/Gnuboard5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'g54' of github.com:gnuboard/g5 into 54

Browse Source
This commit is contained in:
thisgun
2019-06-24 17:30:45 +09:00
parent 2bd6a639d4 e632542c75
commit b8ba893090
44 changed files with 194 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files
adm/admin.lib.php
+1 -1
View File
@@ -477,7 +477,7 @@ function admin_check_xss_params($params){
if( is_array($value) ){
admin_check_xss_params($value);
} else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/onload=.*/ius', $value)) ){
} else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/[onload|onerror]=.*/ius', $value)) ){
alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.');
die();
}
adm/board_form.php
+4 -4
View File
@@ -869,7 +869,7 @@ $pg_anchor = '<ul class="anchor">
<tr>
<th scope="row"><label for="bo_content_head">상단 내용</label></th>
<td>
<?php echo editor_html("bo_content_head", get_text($board['bo_content_head'], 0)); ?>
<?php echo editor_html("bo_content_head", get_text(html_purifier($board['bo_content_head']), 0)); ?>
</td>
<td class="td_grpset">
<input type="checkbox" name="chk_grp_content_head" value="1" id="chk_grp_content_head">
@@ -881,7 +881,7 @@ $pg_anchor = '<ul class="anchor">
<tr>
<th scope="row"><label for="bo_content_tail">하단 내용</label></th>
<td>
<?php echo editor_html("bo_content_tail", get_text($board['bo_content_tail'], 0)); ?>
<?php echo editor_html("bo_content_tail", get_text(html_purifier($board['bo_content_tail']), 0)); ?>
</td>
<td class="td_grpset">
<input type="checkbox" name="chk_grp_content_tail" value="1" id="chk_grp_content_tail">
@@ -893,7 +893,7 @@ $pg_anchor = '<ul class="anchor">
<tr>
<th scope="row"><label for="bo_mobile_content_head">모바일 상단 내용</label></th>
<td>
<?php echo editor_html("bo_mobile_content_head", get_text($board['bo_mobile_content_head'], 0)); ?>
<?php echo editor_html("bo_mobile_content_head", get_text(html_purifier($board['bo_mobile_content_head']), 0)); ?>
</td>
<td class="td_grpset">
<input type="checkbox" name="chk_grp_mobile_content_head" value="1" id="chk_grp_mobile_content_head">
@@ -905,7 +905,7 @@ $pg_anchor = '<ul class="anchor">
<tr>
<th scope="row"><label for="bo_mobile_content_tail">모바일 하단 내용</label></th>
<td>
<?php echo editor_html("bo_mobile_content_tail", get_text($board['bo_mobile_content_tail'], 0)); ?>
<?php echo editor_html("bo_mobile_content_tail", get_text(html_purifier($board['bo_mobile_content_tail']), 0)); ?>
</td>
<td class="td_grpset">
<input type="checkbox" name="chk_grp_mobile_content_tail" value="1" id="chk_grp_mobile_content_tail">
adm/board_list_update.php
+14 -12
View File
@@ -29,19 +29,21 @@ if ($_POST['act_button'] == "선택수정") {
alert('최고관리자가 아닌 경우 다른 관리자의 게시판('.$board_table[$k].')은 수정이 불가합니다.');
}
$p_bo_subject = is_array($_POST['bo_subject']) ? strip_tags($_POST['bo_subject'][$k]) : '';
$sql = " update {$g5['board_table']}
set gr_id = '".sql_real_escape_string($_POST['gr_id'][$k])."',
bo_subject = '".sql_real_escape_string($_POST['bo_subject'][$k])."',
bo_device = '".sql_real_escape_string($_POST['bo_device'][$k])."',
bo_skin = '".sql_real_escape_string($_POST['bo_skin'][$k])."',
bo_mobile_skin = '".sql_real_escape_string($_POST['bo_mobile_skin'][$k])."',
bo_read_point = '".sql_real_escape_string($_POST['bo_read_point'][$k])."',
bo_write_point = '".sql_real_escape_string($_POST['bo_write_point'][$k])."',
bo_comment_point = '".sql_real_escape_string($_POST['bo_comment_point'][$k])."',
bo_download_point = '".sql_real_escape_string($_POST['bo_download_point'][$k])."',
bo_use_search = '".sql_real_escape_string($_POST['bo_use_search'][$k])."',
bo_use_sns = '".sql_real_escape_string($_POST['bo_use_sns'][$k])."',
bo_order = '".sql_real_escape_string($_POST['bo_order'][$k])."'
set gr_id = '".sql_real_escape_string(strip_tags($_POST['gr_id'][$k]))."',
bo_subject = '".$p_bo_subject."',
bo_device = '".sql_real_escape_string(strip_tags($_POST['bo_device'][$k]))."',
bo_skin = '".sql_real_escape_string(strip_tags($_POST['bo_skin'][$k]))."',
bo_mobile_skin = '".sql_real_escape_string(strip_tags($_POST['bo_mobile_skin'][$k]))."',
bo_read_point = '".sql_real_escape_string(strip_tags($_POST['bo_read_point'][$k]))."',
bo_write_point = '".sql_real_escape_string(strip_tags($_POST['bo_write_point'][$k]))."',
bo_comment_point = '".sql_real_escape_string(strip_tags($_POST['bo_comment_point'][$k]))."',
bo_download_point = '".sql_real_escape_string(strip_tags($_POST['bo_download_point'][$k]))."',
bo_use_search = '".sql_real_escape_string(strip_tags($_POST['bo_use_search'][$k]))."',
bo_use_sns = '".sql_real_escape_string(strip_tags($_POST['bo_use_sns'][$k]))."',
bo_order = '".sql_real_escape_string(strip_tags($_POST['bo_order'][$k]))."'
where bo_table = '".sql_real_escape_string($_POST['board_table'][$k])."' ";
sql_query($sql);
adm/boardgroup_list_update.php
+3 -2
View File
@@ -19,7 +19,8 @@ for ($i=0; $i<$count; $i++)
{
$k = $_POST['chk'][$i];
$gr_id = preg_replace('/[^a-z0-9_]/i', '', $_POST['group_id'][$k]);
$gr_subject = sql_real_escape_string(strip_tags($_POST['gr_subject'][$k]));
$gr_subject = is_array($_POST['gr_subject']) ? strip_tags($_POST['gr_subject'][$k]) : '';
$gr_admin = is_array($_POST['gr_admin']) ? strip_tags($_POST['gr_admin'][$k]) : '';
if($_POST['act_button'] == '선택수정') {
$sql = " update {$g5['group_table']}
@@ -30,7 +31,7 @@ for ($i=0; $i<$count; $i++)
gr_order = '".sql_real_escape_string($_POST['gr_order'][$k])."'
where gr_id = '{$gr_id}' ";
if ($is_admin != 'super')
$sql .= " and gr_admin = '{$_POST['gr_admin'][$k]}' ";
$sql .= " and gr_admin = '{$gr_admin}' ";
sql_query($sql);
} else if($_POST['act_button'] == '선택삭제') {
$row = sql_fetch(" select count(*) as cnt from {$g5['board_table']} where gr_id = '$gr_id' ");
adm/config_form.php
+1 -1
View File
@@ -1339,7 +1339,7 @@ include_once('_rewrite_config_form.php');
<label for="cf_<?php echo $i ?>_subj">여분필드<?php echo $i ?> 제목</label>
<input type="text" name="cf_<?php echo $i ?>_subj" value="<?php echo get_text($config['cf_'.$i.'_subj']) ?>" id="cf_<?php echo $i ?>_subj" class="frm_input" size="30">
<label for="cf_<?php echo $i ?>">여분필드<?php echo $i ?> 값</label>
<input type="text" name="cf_<?php echo $i ?>" value="<?php echo get_sanitize_input($config['cf_'.$i]); ?>" id="cf_<?php echo $i ?>" class="frm_input" size="30">
<input type="text" name="cf_<?php echo $i ?>" value="<?php echo get_sanitize_input($config['cf_'.$i]); ?>" id="cf_<?php echo $i ?>" class="frm_input extra-value-input" size="30">
</td>
</tr>
<?php } ?>
adm/config_form_update.php
+2 -2
View File
@@ -28,11 +28,11 @@ $cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',',
$_POST['cf_title'] = strip_tags($_POST['cf_title']);
$check_keys = array('cf_lg_mid', 'cf_lg_mert_key', 'cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key');
$check_keys = array('cf_lg_mid', 'cf_lg_mert_key', 'cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret');
foreach( $check_keys as $key ){
if ( isset($_POST[$key]) && $_POST[$key] ){
$_POST[$key] = preg_replace('/[^a-z0-9_\-]/i', '', $_POST[$key]);
$_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
}
}
adm/contentform.php
+5 -2
View File
@@ -35,6 +35,7 @@ if(!sql_query(" select co_skin from {$g5['content_table']} limit 1 ", false)) {
$html_title = "내용";
$g5['title'] = $html_title.' 관리';
$readonly = '';
if ($w == "u")
{
@@ -86,11 +87,11 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
</tr>
<tr>
<th scope="row">내용</th>
<td><?php echo editor_html('co_content', get_text($co['co_content'], 0)); ?></td>
<td><?php echo editor_html('co_content', get_text(html_purifier($co['co_content']), 0)); ?></td>
</tr>
<tr>
<th scope="row">모바일 내용</th>
<td><?php echo editor_html('co_mobile_content', get_text($co['co_mobile_content'], 0)); ?></td>
<td><?php echo editor_html('co_mobile_content', get_text(html_purifier($co['co_mobile_content']), 0)); ?></td>
</tr>
<tr>
<th scope="row"><label for="co_skin">스킨 디렉토리<strong class="sound_only">필수</strong></label></th>
@@ -104,6 +105,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
<?php echo get_mobile_skin_select('content', 'co_mobile_skin', 'co_mobile_skin', $co['co_mobile_skin'], 'required'); ?>
</td>
</tr>
<!--
<tr>
<th scope="row"><label for="co_tag_filter_use">태그 필터링 사용</label></th>
<td>
@@ -114,6 +116,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
</select>
</td>
</tr>
-->
<tr>
<th scope="row"><label for="co_include_head">상단 파일 경로</label></th>
<td>
adm/contentformupdate.php
+1
View File
@@ -24,6 +24,7 @@ $co_id = preg_replace('/[^a-z0-9_]/i', '', $co_id);
$co_subject = strip_tags($co_subject);
$co_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_head, 0, 255));
$co_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_tail, 0, 255));
$co_tag_filter_use = isset($_POST['co_tag_filter_use']) ? (int) $_POST['co_tag_filter_use'] : 1;
// 관리자가 자동등록방지를 사용해야 할 경우
if (($co_row['co_include_head'] !== $co_include_head || $co_row['co_include_tail'] !== $co_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
adm/css/admin.css
+2 -2
View File
@@ -404,8 +404,8 @@ tfoot th {}
#anc_bo_extra label {display:inline-block;width:100px}
#anc_bo_extra input {margin-right:10px}
/* 게시판 여분필드 값 input style 로빈아빠님 제안 */
#anc_bo_extra input.extra-value-input {width:calc(100% - 370px);}
/* 환경설정 및 게시판 여분필드 값 input style 로빈아빠님 제안 */
#anc_bo_extra input.extra-value-input, #anc_cf_extra input.extra-value-input{width:calc(100% - 370px);}
/* 접속자집계 목록 */
.tbl_visit_list td {text-align:center}
adm/faqform.php
+2 -2
View File
@@ -54,11 +54,11 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
</tr>
<tr>
<th scope="row">질문</th>
<td><?php echo editor_html('fa_subject', get_text($fa['fa_subject'], 0)); ?></td>
<td><?php echo editor_html('fa_subject', get_text(html_purifier($fa['fa_subject']), 0)); ?></td>
</tr>
<tr>
<th scope="row">답변</th>
<td><?php echo editor_html('fa_content', get_text($fa['fa_content'], 0)); ?></td>
<td><?php echo editor_html('fa_content', get_text(html_purifier($fa['fa_content']), 0)); ?></td>
</tr>
</tbody>
</table>
adm/faqmasterform.php
+4 -4
View File
@@ -117,25 +117,25 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
<tr>
<th scope="row">상단 내용</th>
<td>
<?php echo editor_html('fm_head_html', get_text($fm['fm_head_html'], 0)); ?>
<?php echo editor_html('fm_head_html', get_text(html_purifier($fm['fm_head_html']), 0)); ?>
</td>
</tr>
<tr>
<th scope="row">하단 내용</th>
<td>
<?php echo editor_html('fm_tail_html', get_text($fm['fm_tail_html'], 0)); ?>
<?php echo editor_html('fm_tail_html', get_text(html_purifier($fm['fm_tail_html']), 0)); ?>
</td>
</tr>
<tr>
<th scope="row">모바일상단 내용</th>
<td>
<?php echo editor_html('fm_mobile_head_html', get_text($fm['fm_mobile_head_html'], 0)); ?>
<?php echo editor_html('fm_mobile_head_html', get_text(html_purifier($fm['fm_mobile_head_html']), 0)); ?>
</td>
</tr>
<tr>
<th scope="row">모바일하단 내용</th>
<td>
<?php echo editor_html('fm_mobile_tail_html', get_text($fm['fm_mobile_tail_html'], 0)); ?>
<?php echo editor_html('fm_mobile_tail_html', get_text(html_purifier($fm['fm_mobile_tail_html']), 0)); ?>
</td>
</tr>
</tbody>
adm/mail_form.php
+1 -1
View File
@@ -44,7 +44,7 @@ include_once('./admin.head.php');
</tr>
<tr>
<th scope="row"><label for="ma_content">메일 내용<strong class="sound_only">필수</strong></label></th>
<td><?php echo editor_html("ma_content", get_text($ma['ma_content'], 0)); ?></td>
<td><?php echo editor_html("ma_content", get_text(html_purifier($ma['ma_content']), 0)); ?></td>
</tr>
</tbody>
</table>
adm/member_form_update.php
+22 -19
View File
@@ -120,6 +120,28 @@ else if ($w == 'u')
if ($row['mb_id'])
alert('이미 존재하는 이메일입니다.\\nＩＤ : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
if ($mb_password)
$sql_password = " , mb_password = '".get_encrypt_string($mb_password)."' ";
else
$sql_password = "";
if ($passive_certify)
$sql_certify = " , mb_email_certify = '".G5_TIME_YMDHIS."' ";
else
$sql_certify = "";
$sql = " update {$g5['member_table']}
set {$sql_common}
{$sql_password}
{$sql_certify}
where mb_id = '{$mb_id}' ";
sql_query($sql);
}
else
alert('제대로 된 값이 넘어오지 않았습니다.');
if( $w == '' || $w == 'u' ){
$mb_dir = substr($mb_id,0,2);
$mb_icon_img = get_mb_icon_name($mb_id).'.gif';
@@ -212,26 +234,7 @@ else if ($w == 'u')
}
}
}
if ($mb_password)
$sql_password = " , mb_password = '".get_encrypt_string($mb_password)."' ";
else
$sql_password = "";
if ($passive_certify)
$sql_certify = " , mb_email_certify = '".G5_TIME_YMDHIS."' ";
else
$sql_certify = "";
$sql = " update {$g5['member_table']}
set {$sql_common}
{$sql_password}
{$sql_certify}
where mb_id = '{$mb_id}' ";
sql_query($sql);
}
else
alert('제대로 된 값이 넘어오지 않았습니다.');
run_event('admin_member_form_update', $w, $mb_id);
adm/menu_list.php
+1 -1
View File
@@ -76,7 +76,7 @@ $colspan = 7;
<td class="td_category<?php echo $sub_menu_class; ?>">
<input type="hidden" name="code[]" value="<?php echo substr($row['me_code'], 0, 2) ?>">
<label for="me_name_<?php echo $i; ?>" class="sound_only"><?php echo $sub_menu_info; ?> 메뉴<strong class="sound_only"> 필수</strong></label>
<input type="text" name="me_name[]" value="<?php echo $me_name; ?>" id="me_name_<?php echo $i; ?>" required class="required tbl_input full_input">
<input type="text" name="me_name[]" value="<?php echo get_sanitize_input($me_name); ?>" id="me_name_<?php echo $i; ?>" required class="required tbl_input full_input">
</td>
<td>
<label for="me_link_<?php echo $i; ?>" class="sound_only">링크<strong class="sound_only"> 필수</strong></label>
adm/menu_list_update.php
+11 -9
View File
@@ -20,9 +20,11 @@ $count = count($_POST['code']);
for ($i=0; $i<$count; $i++)
{
$_POST = array_map_deep('trim', $_POST);
$_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags($_POST['me_link'][$i], 1) : '';
$code = $_POST['code'][$i];
$me_name = $_POST['me_name'][$i];
$code = is_array($_POST['code']) ? strip_tags($_POST['code'][$i]) : '';
$me_name = is_array($_POST['me_name']) ? strip_tags($_POST['me_name'][$i]) : '';
$me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : strip_tags($_POST['me_link'][$i]);
if(!$code || !$me_name || !$me_link)
@@ -56,13 +58,13 @@ for ($i=0; $i<$count; $i++)
// 메뉴 등록
$sql = " insert into {$g5['menu_table']}
set me_code = '$me_code',
me_name = '$me_name',
me_link = '$me_link',
me_target = '{$_POST['me_target'][$i]}',
me_order = '{$_POST['me_order'][$i]}',
me_use = '{$_POST['me_use'][$i]}',
me_mobile_use = '{$_POST['me_mobile_use'][$i]}' ";
set me_code = '".$me_code."',
me_name = '".$me_name."',
me_link = '".$me_link."',
me_target = '".sql_real_escape_string(strip_tags($_POST['me_target'][$i]))."',
me_order = '".sql_real_escape_string(strip_tags($_POST['me_order'][$i]))."',
me_use = '".sql_real_escape_string(strip_tags($_POST['me_use'][$i]))."',
me_mobile_use = '".sql_real_escape_string(strip_tags($_POST['me_mobile_use'][$i]))."' ";
sql_query($sql);
}
adm/newwinform.php
+1 -1
View File
@@ -114,7 +114,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
</tr>
<tr>
<th scope="row"><label for="nw_content">내용</label></th>
<td><?php echo editor_html('nw_content', get_text($nw['nw_content'], 0)); ?></td>
<td><?php echo editor_html('nw_content', get_text(html_purifier($nw['nw_content']), 0)); ?></td>
</tr>
</tbody>
</table>
adm/qa_config.php
+4 -4
View File
@@ -282,25 +282,25 @@ if(!isset($qaconfig['qa_include_head'])) {
<tr>
<th scope="row"><label for="qa_content_head">상단 내용</label></th>
<td>
<?php echo editor_html("qa_content_head", get_text($qaconfig['qa_content_head'], 0)); ?>
<?php echo editor_html("qa_content_head", get_text(html_purifier($qaconfig['qa_content_head']), 0)); ?>
</td>
</tr>
<tr>
<th scope="row"><label for="qa_content_tail">하단 내용</label></th>
<td>
<?php echo editor_html("qa_content_tail", get_text($qaconfig['qa_content_tail'], 0)); ?>
<?php echo editor_html("qa_content_tail", get_text(html_purifier($qaconfig['qa_content_tail']), 0)); ?>
</td>
</tr>
<tr>
<th scope="row"><label for="qa_mobile_content_head">모바일 상단 내용</label></th>
<td>
<?php echo editor_html("qa_mobile_content_head", get_text($qaconfig['qa_mobile_content_head'], 0)); ?>
<?php echo editor_html("qa_mobile_content_head", get_text(html_purifier($qaconfig['qa_mobile_content_head']), 0)); ?>
</td>
</tr>
<tr>
<th scope="row"><label for="qa_mobile_content_tail">모바일 하단 내용</label></th>
<td>
<?php echo editor_html("qa_mobile_content_tail", get_text($qaconfig['qa_mobile_content_tail'], 0)); ?>
<?php echo editor_html("qa_mobile_content_tail", get_text(html_purifier($qaconfig['qa_mobile_content_tail']), 0)); ?>
</td>
</tr>
<tr>
adm/sms_admin/history_view.php
+4 -4
View File
@@ -131,22 +131,22 @@ function all_send()
<tr>
<td><?php echo $re_vnum--?></td>
<!-- <td><input type=checkbox></td> -->
<!-- <td><?php echo $res[wr_message]; ?></span></td>-->
<!-- <td><?php echo $res[wr_reply]; ?></td>-->
<!-- <td><?php echo $res['wr_message']; ?></span></td>-->
<!-- <td><?php echo $res['wr_reply']; ?></td>-->
<td><?php echo $res['wr_datetime']?></td>
<td><?php echo number_format($res['wr_total'])?></td>
<td><?php echo number_format($res['wr_success'])?></td>
<td><?php echo number_format($res['wr_failure'])?></td>
<td class="td_mng">
<a href="./history_view.php?page=<?php echo $page?>&amp;st=<?php echo $st?>&amp;sv=<?php echo $sv?>&amp;wr_no=<?php echo $res['wr_no']?>&amp;wr_renum=<?php echo $res['wr_renum']?>" class="btn btn_03">수정</a>
<!-- <a href="./history_del.php?page=<?php echo $page?>&amp;st=<?php echo $st?>&amp;sv=<?php echo $sv?>&amp;wr_no=<?php echo $res[wr_no]?>&amp;wr_renum=<?php echo $res[wr_renum]?>">삭제</a> -->
<!-- <a href="./history_del.php?page=<?php echo $page?>&amp;st=<?php echo $st?>&amp;sv=<?php echo $sv?>&amp;wr_no=<?php echo $res['wr_no']?>&amp;wr_renum=<?php echo $res['wr_renum']?>">삭제</a> -->
</td>
</tr>
<?php } ?>
</tbody>
</table>
<?php } ?>
</div>
<?php } ?>
<?php
if( $write['wr_memo'] ){
adm/visit_list.php
+1 -1
View File
@@ -73,7 +73,7 @@ $result = sql_query($sql);
}
$title = str_replace(array('<', '>', '&'), array("&lt;", "&gt;", "&amp;"), $referer);
$link = '<a href="'.$row['vi_referer'].'" target="_blank">';
$link = '<a href="'.get_text($row['vi_referer']).'" target="_blank">';
$link = str_replace('&', "&amp;", $link);
$link2 = '</a>';
}
adm/visit_search.php
+1 -1
View File
@@ -92,7 +92,7 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'">처음</a>'; //페이지 처
}
$title = str_replace(array("<", ">"), array("&lt;", "&gt;"), $referer);
$link = '<a href="'.$row['vi_referer'].'" target="_blank" title="'.$title.'">';
$link = '<a href="'.get_text($row['vi_referer']).'" target="_blank" title="'.$title.'">';
}
if ($is_admin == 'super')
bbs/alert.php
+2 -2
View File
@@ -31,8 +31,8 @@ include_once(G5_PATH.'/head.sub.php');
$msg = isset($msg) ? strip_tags($msg) : '';
$msg2 = str_replace("\\n", "<br>", $msg);
$url = clean_xss_tags($url);
if (!$url) $url = clean_xss_tags($_SERVER['HTTP_REFERER']);
$url = clean_xss_tags($url, 1);
if (!$url) $url = clean_xss_tags($_SERVER['HTTP_REFERER'], 1);
$url = preg_replace("/[\<\>\'\"\\\'\\\"\(\)]/", "", $url);
$url = preg_replace('/\r\n|\r|\n|[^\x20-\x7e]/','', $url);
bbs/board.php
+1 -1
View File
@@ -19,7 +19,7 @@ if (!$bo_table) {
$g5['board_title'] = ((G5_IS_MOBILE && $board['bo_mobile_subject']) ? $board['bo_mobile_subject'] : $board['bo_subject']);
// wr_id 값이 있으면 글읽기
if (isset($wr_id) && $wr_id) {
if ((isset($wr_id) && $wr_id) || (isset($wr_seo_title) && $wr_seo_title)) {
// 글이 없을 경우 해당 게시판 목록으로 이동
if (!$write['wr_id']) {
$msg = '글이 존재하지 않습니다.\\n\\n글이 삭제되었거나 이동된 경우입니다.';
bbs/confirm.php
+5 -5
View File
@@ -5,11 +5,11 @@ include_once(G5_PATH.'/head.sub.php');
$pattern1 = "/[\<\>\'\"\\\'\\\"\(\)]/";
$pattern2 = "/\r\n|\r|\n|[^\x20-\x7e]/";
$url1 = preg_replace($pattern1, "", clean_xss_tags($url1));
$url1 = preg_replace($pattern1, "", clean_xss_tags($url1, 1));
$url1 = preg_replace($pattern2, "", $url1);
$url2 = preg_replace($pattern1, "", clean_xss_tags($url2));
$url2 = preg_replace($pattern1, "", clean_xss_tags($url2, 1));
$url2 = preg_replace($pattern2, "", $url2);
$url3 = preg_replace($pattern1, "", clean_xss_tags($url3));
$url3 = preg_replace($pattern1, "", clean_xss_tags($url3, 1));
$url3 = preg_replace($pattern2, "", $url3);
// url 체크
@@ -31,12 +31,12 @@ if (confirm(conf)) {
<article id="confirm_check">
<header>
<hgroup>
<h1><?php echo $header; ?></h1> <!-- 수행 중이던 작업 내용 -->
<h1><?php echo get_text(strip_tags($header)); ?></h1> <!-- 수행 중이던 작업 내용 -->
<h2>아래 내용을 확인해 주세요.</h2>
</hgroup>
</header>
<p>
<?php echo $msg; ?>
<?php echo get_text(strip_tags($msg)); ?>
</p>
<a href="<?php echo $url1; ?>">확인</a>
bbs/content.php
+2
View File
@@ -35,6 +35,8 @@ if ($co['co_include_head'] && is_include_path_check($co['co_include_head']))
else
include_once('./_head.php');
// KVE-2019-0828 취약점 내용
$co['co_tag_filter_use'] = 1;
$str = conv_content($co['co_content'], $co['co_html'], $co['co_tag_filter_use']);
// $src 를 $dst 로 변환
bbs/download.php
+5 -1
View File
@@ -25,8 +25,12 @@ if (!$file['bf_file'])
// JavaScript 불가일 때
if($js != 'on' && $board['bo_download_point'] < 0) {
$msg = $file['bf_source'].' 파일을 다운로드 하시면 포인트가 차감('.number_format($board['bo_download_point']).'점)됩니다.\\n포인트는 게시물당 한번만 차감되며 다음에 다시 다운로드 하셔도 중복하여 차감하지 않습니다.\\n그래도 다운로드 하시겠습니까?';
$url1 = G5_BBS_URL.'/download.php?'.clean_query_string($_SERVER['QUERY_STRING']).'&amp;js=on';
$url1 = G5_BBS_URL.'/download.php?'.clean_query_string($_SERVER['QUERY_STRING'], false).'&js=on';
$url2 = clean_xss_tags($_SERVER['HTTP_REFERER']);
if( $url2 && stripos($url2, $_SERVER['REQUEST_URI']) !== false ){
$url2 = G5_BBS_URL.'/board.php?'.clean_query_string($_SERVER['QUERY_STRING'], false);
}
//$url1 = 확인link, $url2=취소link
// 특정주소로 이동시키려면 $url3 이용
bbs/login.php
+1 -1
View File
@@ -8,7 +8,7 @@ if( function_exists('social_check_login_before') ){
$g5['title'] = '로그인';
include_once('./_head.sub.php');
$url = $_GET['url'];
$url = strip_tags($_GET['url']);
// url 체크
check_url_host($url);
bbs/move_update.php
+8 -2
View File
@@ -1,6 +1,8 @@
<?php
include_once('./_common.php');
$act = isset($act) ? strip_tags($act) : '';
// 게시판 관리자 이상 복사, 이동 가능
if ($is_admin != 'board' && $is_admin != 'group' && $is_admin != 'super')
alert_close('게시판 관리자 이상 접근이 가능합니다.');
@@ -125,7 +127,7 @@ while ($row = sql_fetch_array($result))
// 제이프로님 코드제안 적용
$copy_file_name = ($bo_table !== $move_bo_table) ? $row3['bf_file'] : $row2['wr_id'].'_copy_'.$insert_id.'_'.$row3['bf_file'];
@copy($src_dir.'/'.$row3['bf_file'], $dst_dir.'/'.$copy_file_name);
@chmod($dst_dir.'/'.$row3['bf_file'], G5_FILE_PERMISSION);
@chmod($dst_dir.'/'.$copy_file_name, G5_FILE_PERMISSION);
}
$sql = " insert into {$g5['board_file_table']}
@@ -197,8 +199,12 @@ if ($sw == 'move')
for ($i=0; $i<count($save); $i++)
{
if( isset($save[$i]['bf_file']) && $save[$i]['bf_file'] ){
for ($k=0; $k<count($save[$i]['bf_file']); $k++)
for ($k=0; $k<count($save[$i]['bf_file']); $k++) {
@unlink($save[$i]['bf_file'][$k]);
// 썸네일 파일 삭제, 먼지손 님 코드 제안
delete_board_thumbnail($bo_table, basename($save[$i]['bf_file'][$k]));
}
}
sql_query(" delete from $write_table where wr_parent = '{$save[$i]['wr_id']}' ");
bbs/view_image.php
+2 -2
View File
@@ -12,10 +12,10 @@ if ( ! preg_match('/(jpg|jpeg|png|gif|bmp)$/i', $extension) ){
alert_close('이미지 확장자가 아닙니다.');
}
if(strpos($filename, 'data/editor')) {
if(strpos($filename, G5_DATA_DIR.'/editor')) {
$editor_file = strstr($filename, 'editor');
$filepath = G5_DATA_PATH.'/'.$editor_file;
} else if(strpos($filename, 'data/qa')) {
} else if(strpos($filename, G5_DATA_DIR.'/qa')) {
$editor_file = strstr($filename, 'qa');
$filepath = G5_DATA_PATH.'/'.$editor_file;
} else {
bbs/visit_insert.inc.php
+2 -2
View File
@@ -13,8 +13,8 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
$remote_addr = escape_trim($_SERVER['REMOTE_ADDR']);
$referer = "";
if (isset($_SERVER['HTTP_REFERER']))
$referer = escape_trim(clean_xss_tags($_SERVER['HTTP_REFERER']));
$user_agent = escape_trim(clean_xss_tags($_SERVER['HTTP_USER_AGENT']));
$referer = escape_trim(clean_xss_tags(strip_tags($_SERVER['HTTP_REFERER'])));
$user_agent = escape_trim(clean_xss_tags(strip_tags($_SERVER['HTTP_USER_AGENT'])));
$vi_browser = '';
$vi_os = '';
$vi_device = '';
extend/sms5.extend.php
+2
View File
@@ -23,6 +23,8 @@ $g5['sms5_book_group_table'] = $g5['sms5_prefix'] . 'book_group';
$g5['sms5_form_table'] = $g5['sms5_prefix'] . 'form';
$g5['sms5_form_group_table'] = $g5['sms5_prefix'] . 'form_group';
$sms5 = array();
if (!empty($config['cf_sms_use'])) {
$sms5 = sql_fetch("select * from {$g5['sms5_config_table']} ", false);
head.sub.php
+3
View File
@@ -19,6 +19,9 @@ else {
$g5_head_title .= " | ".$config['cf_title'];
}
$g5['title'] = strip_tags($g5['title']);
$g5_head_title = strip_tags($g5_head_title);
// 현재 접속자
// 게시판 제목에 ' 포함되면 오류 발생
$g5['lo_location'] = addslashes($g5['title']);
install/ajax.install.check.php
+1 -1
View File
@@ -19,7 +19,7 @@ $mysql_host = safe_install_string_check($_POST['mysql_host'], 'json');
$mysql_user = safe_install_string_check($_POST['mysql_user'], 'json');
$mysql_pass = safe_install_string_check($_POST['mysql_pass'], 'json');
$mysql_db = safe_install_string_check($_POST['mysql_db'], 'json');
$table_prefix= safe_install_string_check($_POST['table_prefix']);
$table_prefix= safe_install_string_check(preg_replace('/[^a-zA-Z0-9_]/', '_', $_POST['table_prefix']));
$tmp_str = isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '';
$ajax_token = md5($tmp_str.$_SERVER['REMOTE_ADDR'].$_SERVER['DOCUMENT_ROOT']);
install/install_config.php
+1 -1
View File
@@ -168,7 +168,7 @@ function frm_install_submit(f)
alert('TABLE명 접두사'+reg_msg); f.table_prefix.focus(); return false;
}
if(/^[a-z][a-z0-9]/i.test(f.admin_id.value) == false) {
if(/^[a-z]+[a-z0-9]{2,19}$/i.test(f.admin_id.value) == false) {
alert('최고관리자 회원 ID는 첫자는 반드시 영문자 그리고 영문자와 숫자로만 만드셔야 합니다.');
f.admin_id.focus();
return false;
install/install_db.php
+4
View File
@@ -33,6 +33,10 @@ $admin_pass = $_POST['admin_pass'];
$admin_name = $_POST['admin_name'];
$admin_email = $_POST['admin_email'];
if (preg_match("/[^0-9a-z_]+/i", $admin_id)) {
die('<div class="ins_inner"><p>관리자 아이디는 영문자, 숫자, _ 만 입력하세요.</p><div class="inner_btn"><a href="./install_config.php">뒤로가기</a></div></div>');
}
$dblink = sql_connect($mysql_host, $mysql_user, $mysql_pass, $mysql_db);
if (!$dblink) {
?>
lib/common.lib.php
+21 -4
View File
@@ -2859,6 +2859,11 @@ function module_exec_check($exe, $type)
} else {
// 바이너리 파일인지
if($is_linux) {
if ( !function_exists('exec') ) {
alert('exec 함수실행이 불가능하므로 사용할수 없습니다.');
}
$search = false;
$isbinary = true;
$executable = true;
@@ -2989,13 +2994,17 @@ function get_search_string($stx)
}
// XSS 관련 태그 제거
function clean_xss_tags($str)
function clean_xss_tags($str, $check_entities=0)
{
$str_len = strlen($str);
$i = 0;
while($i <= $str_len){
$result = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $str);
if( $check_entities ){
$result = str_replace(array('&colon;', '&lpar;', '&rpar;', '&NewLine;', '&Tab;'), '', $result);
}
if((string)$result === (string)$str) break;
@@ -3561,7 +3570,7 @@ function get_head_title($title){
global $g5;
if( isset($g5['board_title']) && $g5['board_title'] ){
$title = $g5['board_title'];
$title = strip_tags($g5['board_title']);
}
return $title;
@@ -3637,6 +3646,11 @@ function get_call_func_cache($func, $args=array()){
function is_include_path_check($path='', $is_input='')
{
if( $path ){
if( strlen($path) > 255 ){
return false;
}
if ($is_input){
// 장태진 @jtjisgod <jtjisgod@gmail.com> 추가
// 보안 목적 : rar wrapper 차단
@@ -3692,14 +3706,17 @@ function is_include_path_check($path='', $is_input='')
if( preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $replace_path) ){
return false;
}
if( preg_match('/\.\.\//i', $replace_path) && preg_match('/plugin\//i', $replace_path) && preg_match('/okname\//i', $replace_path) ){
if( (preg_match('/\.\.\//i', $replace_path) || preg_match('/^\/.*/i', $replace_path)) && preg_match('/plugin\//i', $replace_path) && preg_match('/okname\//i', $replace_path) ){
return false;
}
if( substr_count($replace_path, './') > 5 ){
return false;
}
}
$extension = pathinfo($path, PATHINFO_EXTENSION);
if($extension && preg_match('/(jpg|jpeg|png|gif|bmp|conf)$/i', $extension)) {
if($extension && preg_match('/(jpg|jpeg|png|gif|bmp|conf|php\-x)$/i', $extension)) {
return false;
}
}
lib/latest.lib.php
-1
View File
@@ -47,7 +47,6 @@ function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time=
$board = get_board_db($bo_table, true);
$bo_subject = get_text($board['bo_subject']);
$board['bo_use_sideview'] = 0; // not use sideview
$tmp_write_table = $g5['write_prefix'] . $bo_table; // 게시판 테이블 전체이름
$sql = " select * from {$tmp_write_table} where wr_is_comment = 0 order by wr_num limit 0, {$rows} ";
lib/uri.lib.php
+7 -7
View File
@@ -304,13 +304,13 @@ function get_nginx_conf_rules($return_string=false){
$rules[] = $add_rules;
}
$rules[] = "rewrite ^{$base_path}content/([0-9a-zA-Z_]+)$ {$base_path}bbs/content.php?co_id=$1&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}content/([^/]+)/$ {$base_path}bbs/content.php?co_seo_title=$1&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}rss/([0-9a-zA-Z_]+)$ {$base_path}bbs/rss.php?bo_table=$1 break;";
$rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)$ {$base_path}bbs/board.php?bo_table=$1&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/write$ {$base_path}bbs/write.php?bo_table=$1&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/([^/]+)/$ {$base_path}bbs/board.php?bo_table=$1&wr_seo_title=$2&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/([0-9]+)$ {$base_path}bbs/board.php?bo_table=$1&wr_id=$2&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}content/([0-9a-zA-Z_]+)$ {$base_path}".G5_BBS_DIR."/content.php?co_id=$1&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}content/([^/]+)/$ {$base_path}".G5_BBS_DIR."/content.php?co_seo_title=$1&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}rss/([0-9a-zA-Z_]+)$ {$base_path}".G5_BBS_DIR."/rss.php?bo_table=$1 break;";
$rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)$ {$base_path}".G5_BBS_DIR."/board.php?bo_table=$1&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/write$ {$base_path}".G5_BBS_DIR."/write.php?bo_table=$1&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/([^/]+)/$ {$base_path}".G5_BBS_DIR."/board.php?bo_table=$1&wr_seo_title=$2&rewrite=1 break;";
$rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/([0-9]+)$ {$base_path}".G5_BBS_DIR."/board.php?bo_table=$1&wr_id=$2&rewrite=1 break;";
$rules[] = '}';
$rules[] = '#### '.G5_VERSION.' nginx rules END #####';
plugin/okname/hpcert1.php
+8 -2
View File
@@ -1,8 +1,14 @@
<?php
include_once('./_common.php');
if( isset($_REQUEST['exe']) && isset($exe) && $exe ){
die('bad request');
$check_arrays = array('exe', 'svcTxSeqno', 'name', 'birthday', 'gender', 'ntvFrnrTpCd', 'mblTelCmmCd', 'mbphnNo', 'rsv1', 'rsv2', 'rsv3', 'returnMsg', 'returnUrl', 'inTpBit', 'hsCertMsrCd', 'hsCertRqstCausCd', 'memId', 'clientIp', 'clientDomain', 'endPointURL', 'logPath');
foreach($check_arrays as $key){
if( isset($_REQUEST[$key]) && $_REQUEST[$key] ){
die('bad request');
}
$$key = '';
}
// 금일 인증시도 회수 체크
plugin/okname/hpcert2.php
+8 -2
View File
@@ -1,8 +1,14 @@
<?php
include_once('./_common.php');
if( isset($_REQUEST['exe']) && isset($exe) && $exe ){
die('bad request');
$check_arrays = array('exe', 'keypath', 'memId', 'endPointURL', 'logPath');
foreach($check_arrays as $key){
if( isset($_REQUEST[$key]) && $_REQUEST[$key] ){
die('bad request');
}
$$key = '';
}
// KISA 취약점 내용(KVE-2018-0291) hpcert1.php의 $cmd 함수에 대한 인자 값은 hpcert_config.php 파일에서 설정되나, 이를 다른 페이지에서 포함한 뒤 호출할 시 임의 값 설정 가능
plugin/okname/ipin1.php
+8 -2
View File
@@ -1,8 +1,14 @@
<?php
include_once('./_common.php');
if( isset($_REQUEST['exe']) && isset($exe) && $exe ){
die('bad request');
$check_arrays = array('exe', 'keypath', 'memid', 'reserved1', 'reserved2', 'EndPointURL', 'logpath', 'option');
foreach($check_arrays as $key){
if( isset($_REQUEST[$key]) && $_REQUEST[$key] ){
die('bad request');
}
$$key = '';
}
// 금일 인증시도 회수 체크
plugin/okname/ipin2.php
+8 -2
View File
@@ -1,8 +1,14 @@
<?php
include_once('./_common.php');
if( isset($_REQUEST['exe']) && isset($exe) && $exe ){
die('bad request');
$check_arrays = array('exe', 'keypath', 'memid', 'EndPointURL', 'cpubkey', 'csig', 'encdata', 'logpath', 'option');
foreach($check_arrays as $key){
if( isset($_REQUEST[$key]) && $_REQUEST[$key] ){
die('bad request');
}
$$key = '';
}
include('./ipin.config.php');
plugin/sms5/sms5.lib.php
+6 -6
View File
@@ -164,8 +164,8 @@ if($config['cf_sms_type'] == 'LMS') {
}
function Init() {
$this->Data = ""; // 발송하기 위한 패킷내용이 배열로 들어간다.
$this->Result = ""; // 발송결과값이 배열로 들어간다.
$this->Data = array(); // 발송하기 위한 패킷내용이 배열로 들어간다.
$this->Result = array(); // 발송결과값이 배열로 들어간다.
}
function Add($strDest, $strCallBack, $strCaller, $strSubject, $strURL, $strData, $strDate="", $nCount) {
@@ -260,7 +260,7 @@ if($config['cf_sms_type'] == 'LMS') {
$this->Result[] = "$phone:$code";
$this->Log[] = $puts;
}
$this->Data = "";
$this->Data = array();
return true;
exit;
}
@@ -284,7 +284,7 @@ if($config['cf_sms_type'] == 'LMS') {
}
fclose($fsocket);
$this->Data = "";
$this->Data = array();
return true;
}
}
@@ -431,7 +431,7 @@ if($config['cf_sms_type'] == 'LMS') {
$this->Result[] = "$phone:$code";
$this->Log[] = $puts;
}
$this->Data = "";
$this->Data = array();
return true;
exit;
}
@@ -463,7 +463,7 @@ if($config['cf_sms_type'] == 'LMS') {
if ($count++%1000 == 0) sleep(5);
}
fclose($fsocket);
$this->Data = "";
$this->Data = array();
return true;
}
}
plugin/syndi/ping.php
+1 -1
View File
@@ -29,7 +29,7 @@ $feed_updated = date('Y-m-d\TH:i:s\+09:00', G5_SERVER_TIME);
$find = array('&amp;', '&nbsp;'); # 찾아서
$replace = array('&', ' '); # 바꾼다
$content = str_replace( $find, $replace, $write['wr_content'] );
$content = str_replace( $find, $replace, html_purifier($write['wr_content']) );
$summary = str_replace( $find, $replace, strip_tags($write['wr_content']) );
Header("Content-type: text/xml");
theme/basic/head.sub.php
+3
View File
@@ -13,6 +13,9 @@ else {
$g5_head_title .= " | ".$config['cf_title'];
}
$g5['title'] = strip_tags($g5['title']);
$g5_head_title = strip_tags($g5_head_title);
// 현재 접속자
// 게시판 제목에 ' 포함되면 오류 발생
$g5['lo_location'] = addslashes($g5['title']);