From c38de4c94b64b72c0c2d5c3195e8eabc65cdadef Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Wed, 15 Apr 2026 08:40:51 +0000
Subject: [PATCH] =?UTF-8?q?[security]KVE-2026-0701=20.shtml=20=ED=99=95?=
 =?UTF-8?q?=EC=9E=A5=EC=9E=90=20=ED=95=84=ED=84=B0=20=EB=88=84=EB=9D=BD?=
 =?UTF-8?q?=EC=9C=BC=EB=A1=9C=20=EC=9D=B8=ED=95=9C=20RCE=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- bbs/write_update.php, bbs/qawrite_update.php: 업로드 블랙리스트에 shtml|shtm 추가
- install/install_db.php, data/.htaccess: FilesMatch 정규식에 [Ss]? 추가하여 .shtml 차단

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 bbs/qawrite_update.php | 2 +-
 bbs/write_update.php   | 2 +-
 data/.htaccess         | 5 +++++
 install/install_db.php | 2 +-
 4 files changed, 8 insertions(+), 3 deletions(-)
 create mode 100644 data/.htaccess

diff --git a/bbs/qawrite_update.php b/bbs/qawrite_update.php
index 4c6902936..46756bae3 100644
--- a/bbs/qawrite_update.php
+++ b/bbs/qawrite_update.php
@@ -219,7 +219,7 @@ for ($i=1; $i<=$upload_count; $i++) {
         $upload[$i]['filesize'] = $filesize;
 
         // 아래의 문자열이 들어간 파일은 -x 를 붙여서 웹경로를 알더라도 실행을 하지 못하도록 함
-        $filename = preg_replace("/\.(php|pht|phtm|htm|cgi|pl|exe|jsp|asp|inc|phar)/i", "$0-x", $filename);
+        $filename = preg_replace("/\.(php|pht|phtm|htm|shtml|shtm|cgi|pl|exe|jsp|asp|inc|phar|svg|svgz)/i", "$0-x", $filename);
 
         shuffle($chars_array);
         $shuffle = implode('', $chars_array);
diff --git a/bbs/write_update.php b/bbs/write_update.php
index da487a4ff..80c9da899 100644
--- a/bbs/write_update.php
+++ b/bbs/write_update.php
@@ -577,7 +577,7 @@ if(isset($_FILES['bf_file']['name']) && is_array($_FILES['bf_file']['name'])) {
             $upload[$i]['filesize'] = $filesize;
 
             // 아래의 문자열이 들어간 파일은 -x 를 붙여서 웹경로를 알더라도 실행을 하지 못하도록 함
-            $filename = preg_replace("/\.(php|pht|phtm|htm|cgi|pl|exe|jsp|asp|inc|phar|svg|svgz)/i", "$0-x", $filename);
+            $filename = preg_replace("/\.(php|pht|phtm|htm|shtml|shtm|cgi|pl|exe|jsp|asp|inc|phar|svg|svgz)/i", "$0-x", $filename);
 
             shuffle($chars_array);
             $shuffle = implode('', $chars_array);
diff --git a/data/.htaccess b/data/.htaccess
new file mode 100644
index 000000000..81f095701
--- /dev/null
+++ b/data/.htaccess
@@ -0,0 +1,5 @@
+<FilesMatch "\.(htaccess|htpasswd|[Pp][Hh][Pp]|[Pp][Hh][Tt]|[Ss]?[Pp]?[Hh][Tt][Mm][Ll]?|[Ii][Nn][Cc]|[Cc][Gg][Ii]|[Pp][Ll]|[Pp][Hh][Aa][Rr]|[Ss][Vv][Gg][Zz]?)">
+Order allow,deny
+Deny from all
+</FilesMatch>
+RedirectMatch 403 /session/.*
\ No newline at end of file
diff --git a/install/install_db.php b/install/install_db.php
index 731d6a3f0..4c47e1885 100644
--- a/install/install_db.php
+++ b/install/install_db.php
@@ -660,7 +660,7 @@ fclose($f);
 // data 디렉토리 및 하위 디렉토리에서는 .htaccess .htpasswd .php .phtml .html .htm .inc .cgi .pl .phar 파일을 실행할수 없게함.
 $f = fopen($data_path.'/.htaccess', 'w');
 $str = <<<EOD
-<FilesMatch "\.(htaccess|htpasswd|[Pp][Hh][Pp]|[Pp][Hh][Tt]|[Pp]?[Hh][Tt][Mm][Ll]?|[Ii][Nn][Cc]|[Cc][Gg][Ii]|[Pp][Ll]|[Pp][Hh][Aa][Rr]|[Ss][Vv][Gg][Zz]?)">
+<FilesMatch "\.(htaccess|htpasswd|[Pp][Hh][Pp]|[Pp][Hh][Tt]|[Ss]?[Pp]?[Hh][Tt][Mm][Ll]?|[Ii][Nn][Cc]|[Cc][Gg][Ii]|[Pp][Ll]|[Pp][Hh][Aa][Rr]|[Ss][Vv][Gg][Zz]?)">
 Order allow,deny
 Deny from all
 </FilesMatch>