From c00c73465af0526e09cedaf1856d3a7c73ea7264 Mon Sep 17 00:00:00 2001 From: thisgun Date: Thu, 16 Apr 2026 02:15:29 +0000 Subject: [PATCH] =?UTF-8?q?[security]=EB=B9=84=ED=9A=8C=EC=9B=90=20?= =?UTF-8?q?=EC=A3=BC=EB=AC=B8/=EA=B0=9C=EC=9D=B8=EA=B2=B0=EC=A0=9C=20?= =?UTF-8?q?=EC=A1=B0=ED=9A=8C=20uid=EB=A5=BC=20HMAC-SHA256=EC=9C=BC?= =?UTF-8?q?=EB=A1=9C=20=EA=B0=95=ED=99=94?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/shop_admin/orderlist.php | 2 +- lib/shop.lib.php | 27 +++++++++++++++++++++++++-- mobile/shop/orderformupdate.php | 2 +- mobile/shop/orderinquiry.php | 2 +- mobile/shop/orderinquiry.sub.php | 2 +- mobile/shop/personalpayformupdate.php | 4 ++-- mobile/shop/personalpayresult.php | 3 ++- shop/orderformupdate.php | 2 +- shop/orderinquiry.php | 2 +- shop/orderinquiry.sub.php | 2 +- shop/orderinquirycancel.php | 2 +- shop/orderinquiryview.php | 3 ++- shop/personalpayformupdate.php | 3 +-- shop/personalpayresult.php | 3 ++- 14 files changed, 42 insertions(+), 17 deletions(-) diff --git a/adm/shop_admin/orderlist.php b/adm/shop_admin/orderlist.php index 4ea3fc7ad..abddc6510 100644 --- a/adm/shop_admin/orderlist.php +++ b/adm/shop_admin/orderlist.php @@ -350,7 +350,7 @@ if( function_exists('pg_setting_check') ){ if($default['de_escrow_use'] && $row['od_escrow']) $od_paytype .= '에스크로'; - $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']); + $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']); $invoice_time = is_null_time($row['od_invoice_time']) ? G5_TIME_YMDHIS : $row['od_invoice_time']; $delivery_company = $row['od_delivery_company'] ? $row['od_delivery_company'] : $default['de_delivery_company']; diff --git a/lib/shop.lib.php b/lib/shop.lib.php index 04732c741..24abe01f5 100644 --- a/lib/shop.lib.php +++ b/lib/shop.lib.php @@ -3,6 +3,29 @@ // 쇼핑몰 라이브러리 모음 시작 //============================================================================== +/** + * 쇼핑몰 주문/개인결제 조회용 식별자(uid)를 생성한다. + * + * 결정적(deterministic) 생성 방식은 유지되므로 여러 파일에서 독립적으로 호출해도 + * 동일한 값을 얻을 수 있어 기존 검증 구조를 그대로 사용 가능하다. + * + * @param string $type 'order' 또는 'personalpay' 등 네임스페이스 구분자 + * @param string $id 주문번호 / 개인결제번호 등 + * @param string $time 생성 시각 (od_time / pp_time) + * @param string $ip 생성 시 IP (od_ip / pp_ip) + * @return string 64자 hex + */ +function get_shop_uid($type, $id, $time, $ip) +{ + $key = (defined('G5_TOKEN_ENCRYPTION_KEY') && G5_TOKEN_ENCRYPTION_KEY) + ? G5_TOKEN_ENCRYPTION_KEY + : (defined('G5_TABLE_PREFIX') ? G5_TABLE_PREFIX : ''); + + $payload = $type . '|' . $id . '|' . $time . '|' . $ip; + + return hash_hmac('sha256', $payload, $key); +} + /* 간편 사용법 : 상품유형을 1~5 사이로 지정합니다. $disp = new item_list(1); @@ -2332,7 +2355,7 @@ function exists_inicis_shop_order($oid, $pp=array(), $od_time='', $od_ip='') set_session('ss_personalpay_id', ''); set_session('ss_personalpay_hash', ''); - $uid = md5($pp['pp_id'].$pp['pp_time'].$od_ip); + $uid = get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $od_ip); set_session('ss_personalpay_uid', $uid); goto_url(G5_SHOP_URL.'/personalpayresult.php?pp_id='.$pp['pp_id'].'&uid='.$uid.'&ini_noti=1'); @@ -2346,7 +2369,7 @@ function exists_inicis_shop_order($oid, $pp=array(), $od_time='', $od_ip='') if( $oid == get_session('ss_order_id') ){ // orderview 에서 사용하기 위해 session에 넣고 - $uid = md5($oid.$od_time.$od_ip); + $uid = get_shop_uid('order', $oid, $od_time, $od_ip); set_session('ss_orderview_uid', $uid); goto_url(G5_SHOP_URL.'/orderinquiryview.php?od_id='.$oid.'&uid='.$uid.'&ini_noti=1'); } else { diff --git a/mobile/shop/orderformupdate.php b/mobile/shop/orderformupdate.php index be6a73fed..78a823b18 100644 --- a/mobile/shop/orderformupdate.php +++ b/mobile/shop/orderformupdate.php @@ -964,7 +964,7 @@ if($config['cf_sms_use'] && ($default['de_sms_use2'] || $default['de_sms_use3']) // orderview 에서 사용하기 위해 session에 넣고 -$uid = md5($od_id.G5_TIME_YMDHIS.$REMOTE_ADDR); +$uid = function_exists('get_shop_uid') ? get_shop_uid('order', $od_id, G5_TIME_YMDHIS, $REMOTE_ADDR) : md5($od_id.G5_TIME_YMDHIS.$REMOTE_ADDR); set_session('ss_orderview_uid', $uid); // 주문 정보 임시 데이터 삭제 diff --git a/mobile/shop/orderinquiry.php b/mobile/shop/orderinquiry.php index a346ae3a6..ca85a38ad 100644 --- a/mobile/shop/orderinquiry.php +++ b/mobile/shop/orderinquiry.php @@ -68,7 +68,7 @@ if (!$is_member) } if ($row['od_id']) { - $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']); + $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']); set_session('ss_orderview_uid', $uid); goto_url(G5_SHOP_URL.'/orderinquiryview.php?od_id='.$row['od_id'].'&uid='.$uid); } diff --git a/mobile/shop/orderinquiry.sub.php b/mobile/shop/orderinquiry.sub.php index 600dd04d5..5de89641e 100644 --- a/mobile/shop/orderinquiry.sub.php +++ b/mobile/shop/orderinquiry.sub.php @@ -70,7 +70,7 @@ if(defined('G5_THEME_MSHOP_PATH')) { if($row['od_delivery_company'] && $row['od_invoice']) $od_invoice = ' '.get_text($row['od_delivery_company']).' '.get_text($row['od_invoice']).''; - $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']); + $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']); ?>
  • diff --git a/mobile/shop/personalpayformupdate.php b/mobile/shop/personalpayformupdate.php index fda4492e8..eeb77edd0 100644 --- a/mobile/shop/personalpayformupdate.php +++ b/mobile/shop/personalpayformupdate.php @@ -47,7 +47,7 @@ $hash_data = md5($pp_id.$good_mny.$pp['pp_time']); if($pp['pp_tno']){ if( $default['de_pg_service'] == 'inicis' && ($pp_id === get_session('ss_personalpay_id') && $hash_data === get_session('ss_personalpay_hash')) ){ - $uid = md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']); + $uid = function_exists('get_shop_uid') ? get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $_SERVER['REMOTE_ADDR']) : md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']); set_session('ss_personalpay_uid', $uid); goto_url(G5_SHOP_URL.'/personalpayresult.php?pp_id='.$pp['pp_id'].'&uid='.$uid); @@ -311,7 +311,7 @@ sql_query($sql); set_session('ss_personalpay_id', ''); set_session('ss_personalpay_hash', ''); -$uid = md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']); +$uid = function_exists('get_shop_uid') ? get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $_SERVER['REMOTE_ADDR']) : md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']); set_session('ss_personalpay_uid', $uid); $is_noti_pay = isset($is_noti_pay) ? $is_noti_pay : false; diff --git a/mobile/shop/personalpayresult.php b/mobile/shop/personalpayresult.php index 856abf3bc..b68b80595 100644 --- a/mobile/shop/personalpayresult.php +++ b/mobile/shop/personalpayresult.php @@ -3,7 +3,8 @@ include_once('./_common.php'); $sql = "select * from {$g5['g5_shop_personalpay_table']} where pp_id = '$pp_id' "; $pp = sql_fetch($sql); -if (! (isset($pp['pp_id']) && $pp['pp_id']) || (md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']) != get_session('ss_personalpay_uid'))) { +$pp_uid = function_exists('get_shop_uid') ? get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $_SERVER['REMOTE_ADDR']) : md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']); +if (! (isset($pp['pp_id']) && $pp['pp_id']) || ($pp_uid != get_session('ss_personalpay_uid'))) { if( isset($_GET['ini_noti']) && $pp['pp_tno'] ){ alert("해당 개인결제는 정상적으로 결제되었습니다.", G5_SHOP_URL."/personalpay.php"); } else { diff --git a/shop/orderformupdate.php b/shop/orderformupdate.php index 7f472b735..a63af34b7 100644 --- a/shop/orderformupdate.php +++ b/shop/orderformupdate.php @@ -918,7 +918,7 @@ if($config['cf_sms_use'] && ($default['de_sms_use2'] || $default['de_sms_use3']) // SMS END -------------------------------------------------------- // orderview 에서 사용하기 위해 session에 넣고 -$uid = md5($od_id.G5_TIME_YMDHIS.$REMOTE_ADDR); +$uid = function_exists('get_shop_uid') ? get_shop_uid('order', $od_id, G5_TIME_YMDHIS, $REMOTE_ADDR) : md5($od_id.G5_TIME_YMDHIS.$REMOTE_ADDR); set_session('ss_orderview_uid', $uid); // 주문 정보 임시 데이터 삭제 diff --git a/shop/orderinquiry.php b/shop/orderinquiry.php index 28a137fad..ad37d81e9 100644 --- a/shop/orderinquiry.php +++ b/shop/orderinquiry.php @@ -73,7 +73,7 @@ if (!$is_member) } if ($row['od_id']) { - $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']); + $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']); set_session('ss_orderview_uid', $uid); goto_url(G5_SHOP_URL.'/orderinquiryview.php?od_id='.$row['od_id'].'&uid='.$uid); } diff --git a/shop/orderinquiry.sub.php b/shop/orderinquiry.sub.php index 6dbc58955..a9d063251 100644 --- a/shop/orderinquiry.sub.php +++ b/shop/orderinquiry.sub.php @@ -40,7 +40,7 @@ if(defined('G5_THEME_SHOP_PATH')) { $result = sql_query($sql); for ($i=0; $row=sql_fetch_array($result); $i++) { - $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']); + $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']); switch($row['od_status']) { case '주문': diff --git a/shop/orderinquirycancel.php b/shop/orderinquirycancel.php index 1adc43721..92899ce5b 100644 --- a/shop/orderinquirycancel.php +++ b/shop/orderinquirycancel.php @@ -25,7 +25,7 @@ $sql = " select SUM(IF(ct_status = '주문', 1, 0)) as od_count2, where od_id = '$od_id' "; $ct = sql_fetch($sql); -$uid = md5($od['od_id'].$od['od_time'].$od['od_ip']); +$uid = function_exists('get_shop_uid') ? get_shop_uid('order', $od['od_id'], $od['od_time'], $od['od_ip']) : md5($od['od_id'].$od['od_time'].$od['od_ip']); if($od['od_cancel_price'] > 0 || $ct['od_count1'] != $ct['od_count2']) { alert("취소할 수 있는 주문이 아닙니다.", G5_SHOP_URL."/orderinquiryview.php?od_id=$od_id&uid=$uid"); diff --git a/shop/orderinquiryview.php b/shop/orderinquiryview.php index 9388041e2..8deb5d5ca 100644 --- a/shop/orderinquiryview.php +++ b/shop/orderinquiryview.php @@ -23,7 +23,8 @@ if($is_member && !$is_admin) $sql .= " and mb_id = '{$member['mb_id']}' "; $od = sql_fetch($sql); -if (! (isset($od['od_id']) && $od['od_id']) || (!$is_member && md5($od['od_id'].$od['od_time'].$od['od_ip']) != get_session('ss_orderview_uid'))) { +$uid = function_exists('get_shop_uid') ? get_shop_uid('order', $od['od_id'], $od['od_time'], $od['od_ip']) : md5($od['od_id'].$od['od_time'].$od['od_ip']); +if (! (isset($od['od_id']) && $od['od_id']) || (!$is_member && $uid != get_session('ss_orderview_uid'))) { alert("조회하실 주문서가 없습니다.", G5_SHOP_URL); } diff --git a/shop/personalpayformupdate.php b/shop/personalpayformupdate.php index fc2f98fd0..0cc910fe6 100644 --- a/shop/personalpayformupdate.php +++ b/shop/personalpayformupdate.php @@ -2,7 +2,6 @@ include_once('./_common.php'); include_once(G5_LIB_PATH.'/mailer.lib.php'); - $page_return_url = G5_SHOP_URL.'/personalpayform.php?pp_id='.get_session('ss_personalpay_id'); $pp_id = $_POST['pp_id'] = isset($_POST['pp_id']) ? preg_replace('/[^0-9]/', '', $_POST['pp_id']) : 0; @@ -286,7 +285,7 @@ if($pp_receipt_price > 0 && $pp['pp_id'] && $pp['od_id']) { set_session('ss_personalpay_id', ''); set_session('ss_personalpay_hash', ''); -$uid = md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']); +$uid = function_exists('get_shop_uid') ? get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $_SERVER['REMOTE_ADDR']) : md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']); set_session('ss_personalpay_uid', $uid); goto_url(G5_SHOP_URL.'/personalpayresult.php?pp_id='.$pp['pp_id'].'&uid='.$uid); diff --git a/shop/personalpayresult.php b/shop/personalpayresult.php index 150eb4eae..2c8c8bf75 100644 --- a/shop/personalpayresult.php +++ b/shop/personalpayresult.php @@ -10,7 +10,8 @@ if (G5_IS_MOBILE) { $sql = "select * from {$g5['g5_shop_personalpay_table']} where pp_id = '$pp_id' "; $pp = sql_fetch($sql); -if (! (isset($pp['pp_id']) && $pp['pp_id']) || (md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']) != get_session('ss_personalpay_uid'))) { +$pp_uid = function_exists('get_shop_uid') ? get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $_SERVER['REMOTE_ADDR']) : md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']); +if (! (isset($pp['pp_id']) && $pp['pp_id']) || ($pp_uid != get_session('ss_personalpay_uid'))) { alert("조회하실 개인결제 내역이 없습니다.", G5_SHOP_URL); }