[security]비회원 주문/개인결제 조회 uid를 HMAC-SHA256으로 강화

adm/shop_admin/orderlist.php

@@ -350,7 +350,7 @@ if( function_exists('pg_setting_check') ){
         if($default['de_escrow_use'] && $row['od_escrow'])
             $od_paytype .= '<span class="list_escrow">에스크로</span>';
 
-        $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']);
+        $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']);
 
         $invoice_time = is_null_time($row['od_invoice_time']) ? G5_TIME_YMDHIS : $row['od_invoice_time'];
         $delivery_company = $row['od_delivery_company'] ? $row['od_delivery_company'] : $default['de_delivery_company'];

lib/shop.lib.php

@@ -3,6 +3,29 @@
 // 쇼핑몰 라이브러리 모음 시작
 //==============================================================================
 
+/**
+ * 쇼핑몰 주문/개인결제 조회용 식별자(uid)를 생성한다.
+ *
+ * 결정적(deterministic) 생성 방식은 유지되므로 여러 파일에서 독립적으로 호출해도
+ * 동일한 값을 얻을 수 있어 기존 검증 구조를 그대로 사용 가능하다.
+ *
+ * @param string $type 'order' 또는 'personalpay' 등 네임스페이스 구분자
+ * @param string $id   주문번호 / 개인결제번호 등
+ * @param string $time 생성 시각 (od_time / pp_time)
+ * @param string $ip   생성 시 IP (od_ip / pp_ip)
+ * @return string 64자 hex
+ */
+function get_shop_uid($type, $id, $time, $ip)
+{
+    $key = (defined('G5_TOKEN_ENCRYPTION_KEY') && G5_TOKEN_ENCRYPTION_KEY)
+         ? G5_TOKEN_ENCRYPTION_KEY
+         : (defined('G5_TABLE_PREFIX') ? G5_TABLE_PREFIX : '');
+
+    $payload = $type . '|' . $id . '|' . $time . '|' . $ip;
+
+    return hash_hmac('sha256', $payload, $key);
+}
+
 /*
 간편 사용법 : 상품유형을 1~5 사이로 지정합니다.
 $disp = new item_list(1);
@@ -2332,7 +2355,7 @@ function exists_inicis_shop_order($oid, $pp=array(), $od_time='', $od_ip='')
             set_session('ss_personalpay_id', '');
             set_session('ss_personalpay_hash', '');
 
-            $uid = md5($pp['pp_id'].$pp['pp_time'].$od_ip);
+            $uid = get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $od_ip);
             set_session('ss_personalpay_uid', $uid);
             
             goto_url(G5_SHOP_URL.'/personalpayresult.php?pp_id='.$pp['pp_id'].'&uid='.$uid.'&ini_noti=1');
@@ -2346,7 +2369,7 @@ function exists_inicis_shop_order($oid, $pp=array(), $od_time='', $od_ip='')
 
         if( $oid == get_session('ss_order_id') ){
             // orderview 에서 사용하기 위해 session에 넣고
-            $uid = md5($oid.$od_time.$od_ip);
+            $uid = get_shop_uid('order', $oid, $od_time, $od_ip);
             set_session('ss_orderview_uid', $uid);
             goto_url(G5_SHOP_URL.'/orderinquiryview.php?od_id='.$oid.'&uid='.$uid.'&ini_noti=1');
         } else {

mobile/shop/orderformupdate.php

@@ -964,7 +964,7 @@ if($config['cf_sms_use'] && ($default['de_sms_use2'] || $default['de_sms_use3'])
 
 
 // orderview 에서 사용하기 위해 session에 넣고
-$uid = md5($od_id.G5_TIME_YMDHIS.$REMOTE_ADDR);
+$uid = function_exists('get_shop_uid') ? get_shop_uid('order', $od_id, G5_TIME_YMDHIS, $REMOTE_ADDR) : md5($od_id.G5_TIME_YMDHIS.$REMOTE_ADDR);
 set_session('ss_orderview_uid', $uid);
 
 // 주문 정보 임시 데이터 삭제

mobile/shop/orderinquiry.php

@@ -68,7 +68,7 @@ if (!$is_member)
     }
 
     if ($row['od_id']) {
-        $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']);
+        $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']);
         set_session('ss_orderview_uid', $uid);
         goto_url(G5_SHOP_URL.'/orderinquiryview.php?od_id='.$row['od_id'].'&uid='.$uid);
     }

mobile/shop/orderinquiry.sub.php

@@ -70,7 +70,7 @@ if(defined('G5_THEME_MSHOP_PATH')) {
             if($row['od_delivery_company'] && $row['od_invoice'])
                 $od_invoice = '<span class="inv_inv"><i class="fa fa-truck" aria-hidden="true"></i> <strong>'.get_text($row['od_delivery_company']).'</strong> '.get_text($row['od_invoice']).'</span>';
 
-            $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']);
+            $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']);
         ?>
 
         <li>

mobile/shop/personalpayformupdate.php

@@ -47,7 +47,7 @@ $hash_data = md5($pp_id.$good_mny.$pp['pp_time']);
 
 if($pp['pp_tno']){
     if( $default['de_pg_service'] == 'inicis' && ($pp_id === get_session('ss_personalpay_id') && $hash_data === get_session('ss_personalpay_hash')) ){
-        $uid = md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']);
+        $uid = function_exists('get_shop_uid') ? get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $_SERVER['REMOTE_ADDR']) : md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']);
         set_session('ss_personalpay_uid', $uid);
 
         goto_url(G5_SHOP_URL.'/personalpayresult.php?pp_id='.$pp['pp_id'].'&uid='.$uid);
@@ -311,7 +311,7 @@ sql_query($sql);
 set_session('ss_personalpay_id', '');
 set_session('ss_personalpay_hash', '');
 
-$uid = md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']);
+$uid = function_exists('get_shop_uid') ? get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $_SERVER['REMOTE_ADDR']) : md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']);
 set_session('ss_personalpay_uid', $uid);
 
 $is_noti_pay = isset($is_noti_pay) ? $is_noti_pay : false;

mobile/shop/personalpayresult.php

@@ -3,7 +3,8 @@ include_once('./_common.php');
 
 $sql = "select * from {$g5['g5_shop_personalpay_table']} where pp_id = '$pp_id' ";
 $pp = sql_fetch($sql);
-if (! (isset($pp['pp_id']) && $pp['pp_id']) || (md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']) != get_session('ss_personalpay_uid'))) {
+$pp_uid = function_exists('get_shop_uid') ? get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $_SERVER['REMOTE_ADDR']) : md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']);
+if (! (isset($pp['pp_id']) && $pp['pp_id']) || ($pp_uid != get_session('ss_personalpay_uid'))) {
     if( isset($_GET['ini_noti']) && $pp['pp_tno'] ){
         alert("해당 개인결제는 정상적으로 결제되었습니다.", G5_SHOP_URL."/personalpay.php");
     } else {

shop/orderformupdate.php

@@ -918,7 +918,7 @@ if($config['cf_sms_use'] && ($default['de_sms_use2'] || $default['de_sms_use3'])
 // SMS END   --------------------------------------------------------
 
 // orderview 에서 사용하기 위해 session에 넣고
-$uid = md5($od_id.G5_TIME_YMDHIS.$REMOTE_ADDR);
+$uid = function_exists('get_shop_uid') ? get_shop_uid('order', $od_id, G5_TIME_YMDHIS, $REMOTE_ADDR) : md5($od_id.G5_TIME_YMDHIS.$REMOTE_ADDR);
 set_session('ss_orderview_uid', $uid);
 
 // 주문 정보 임시 데이터 삭제

shop/orderinquiry.php

@@ -73,7 +73,7 @@ if (!$is_member)
     }
 
     if ($row['od_id']) {
-        $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']);
+        $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']);
         set_session('ss_orderview_uid', $uid);
         goto_url(G5_SHOP_URL.'/orderinquiryview.php?od_id='.$row['od_id'].'&uid='.$uid);
     }

shop/orderinquiry.sub.php

@@ -40,7 +40,7 @@ if(defined('G5_THEME_SHOP_PATH')) {
     $result = sql_query($sql);
     for ($i=0; $row=sql_fetch_array($result); $i++)
     {
-        $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']);
+        $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']);
 
         switch($row['od_status']) {
             case '주문':

shop/orderinquirycancel.php

@@ -25,7 +25,7 @@ $sql = " select SUM(IF(ct_status = '주문', 1, 0)) as od_count2,
             where od_id = '$od_id' ";
 $ct = sql_fetch($sql);
 
-$uid = md5($od['od_id'].$od['od_time'].$od['od_ip']);
+$uid = function_exists('get_shop_uid') ? get_shop_uid('order', $od['od_id'], $od['od_time'], $od['od_ip']) : md5($od['od_id'].$od['od_time'].$od['od_ip']);
 
 if($od['od_cancel_price'] > 0 || $ct['od_count1'] != $ct['od_count2']) {
     alert("취소할 수 있는 주문이 아닙니다.", G5_SHOP_URL."/orderinquiryview.php?od_id=$od_id&uid=$uid");

shop/orderinquiryview.php

@@ -23,7 +23,8 @@ if($is_member && !$is_admin)
     $sql .= " and mb_id = '{$member['mb_id']}' ";
 $od = sql_fetch($sql);
 
-if (! (isset($od['od_id']) && $od['od_id']) || (!$is_member && md5($od['od_id'].$od['od_time'].$od['od_ip']) != get_session('ss_orderview_uid'))) {
+$uid = function_exists('get_shop_uid') ? get_shop_uid('order', $od['od_id'], $od['od_time'], $od['od_ip']) : md5($od['od_id'].$od['od_time'].$od['od_ip']);
+if (! (isset($od['od_id']) && $od['od_id']) || (!$is_member && $uid != get_session('ss_orderview_uid'))) {
     alert("조회하실 주문서가 없습니다.", G5_SHOP_URL);
 }
 

shop/personalpayformupdate.php

@@ -2,7 +2,6 @@
 include_once('./_common.php');
 include_once(G5_LIB_PATH.'/mailer.lib.php');
 
-
 $page_return_url = G5_SHOP_URL.'/personalpayform.php?pp_id='.get_session('ss_personalpay_id');
 
 $pp_id = $_POST['pp_id'] = isset($_POST['pp_id']) ? preg_replace('/[^0-9]/', '', $_POST['pp_id']) : 0;
@@ -286,7 +285,7 @@ if($pp_receipt_price > 0 && $pp['pp_id'] && $pp['od_id']) {
 set_session('ss_personalpay_id', '');
 set_session('ss_personalpay_hash', '');
 
-$uid = md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']);
+$uid = function_exists('get_shop_uid') ? get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $_SERVER['REMOTE_ADDR']) : md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']);
 set_session('ss_personalpay_uid', $uid);
 
 goto_url(G5_SHOP_URL.'/personalpayresult.php?pp_id='.$pp['pp_id'].'&uid='.$uid);

shop/personalpayresult.php

@@ -10,7 +10,8 @@ if (G5_IS_MOBILE) {
 
 $sql = "select * from {$g5['g5_shop_personalpay_table']} where pp_id = '$pp_id' ";
 $pp = sql_fetch($sql);
-if (! (isset($pp['pp_id']) && $pp['pp_id']) || (md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']) != get_session('ss_personalpay_uid'))) {
+$pp_uid = function_exists('get_shop_uid') ? get_shop_uid('personalpay', $pp['pp_id'], $pp['pp_time'], $_SERVER['REMOTE_ADDR']) : md5($pp['pp_id'].$pp['pp_time'].$_SERVER['REMOTE_ADDR']);
+if (! (isset($pp['pp_id']) && $pp['pp_id']) || ($pp_uid != get_session('ss_personalpay_uid'))) {
     alert("조회하실 개인결제 내역이 없습니다.", G5_SHOP_URL);
 }