버전 5.3.3.1 수정

This commit is contained in:
thisgun committed 2019-07-15 18:38:13 +09:00
commit d6d633196e
11 files changed
+34 -29

No files matched your search

+2 -2
View File
@@ -87,7 +87,7 @@ for($i=0;$i<count($_POST['chk_bn_id']);$i++)
$lf = '';
for ($k=0; $k<count($notice_array); $k++) {
if ((int)$write['wr_id'] != (int)$notice_array[$k])
$bo_notice .= $nl.$notice_array[$k];
$bo_notice .= $lf.$notice_array[$k];
if($bo_notice)
$lf = ',';
@@ -117,7 +117,7 @@ for($i=0;$i<count($_POST['chk_bn_id']);$i++)
// 코멘트 삭제
if (!delete_point($write['mb_id'], $bo_table, $comment_id, '코멘트')) {
insert_point($write['mb_id'], $board['bo_comment_point'] * (-1), "{$board['bo_subject']} {$write[wr_parent]}-{$comment_id} 코멘트삭제");
insert_point($write['mb_id'], $board['bo_comment_point'] * (-1), "{$board['bo_subject']} {$write['wr_parent']}-{$comment_id} 코멘트삭제");
}
// 코멘트 삭제
+2 -2
View File
@@ -5,8 +5,8 @@
********************/
define('G5_VERSION', '그누보드5');
define('G5_GNUBOARD_VER', '5.3.3');
define('G5_YOUNGCART_VER', '5.3.3');
define('G5_GNUBOARD_VER', '5.3.3.1');
define('G5_YOUNGCART_VER', '5.3.3.1');
// 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
define('_GNUBOARD_', true);
+1 -1
View File
@@ -3525,7 +3525,7 @@ function is_include_path_check($path='', $is_input='')
// 장태진 @jtjisgod <jtjisgod@gmail.com> 추가
// 보안 목적 : rar wrapper 차단
if( stripos($path, 'rar:') !== false || stripos($path, 'php:') !== false || stripos($path, 'zlib:') !== false || stripos($path, 'bzip2:') !== false || stripos($path, 'zip:') !== false || stripos($path, 'data:') !== false || stripos($path, 'phar:') !== false ){
if( stripos($path, 'rar:') !== false || stripos($path, 'php:') !== false || stripos($path, 'zlib:') !== false || stripos($path, 'bzip2:') !== false || stripos($path, 'zip:') !== false || stripos($path, 'data:') !== false || stripos($path, 'phar:') !== false || stripos($path, 'file:') !== false ){
return false;
}
+17 -12
View File
@@ -20339,18 +20339,23 @@ nhn.husky.HuskyCore.mixin(nhn.husky.SE2M_TableEditor, {
addCSSClass : function(sClassName, sClassRule){
var oDoc = this.oApp.getWYSIWYGDocument();
if(oDoc.styleSheets[0] && oDoc.styleSheets[0].addRule){
// IE
oDoc.styleSheets[0].addRule("." + sClassName, sClassRule);
}else{
// FF
var elHead = oDoc.getElementsByTagName("HEAD")[0];
var elStyle = oDoc.createElement ("STYLE");
//styleElement.type = "text / css";
elHead.appendChild (elStyle);
elStyle.sheet.insertRule("." + sClassName + " { "+sClassRule+" }", 0);
}
try {
if(oDoc.styleSheets[0] && oDoc.styleSheets[0].addRule){
// IE
oDoc.styleSheets[0].addRule("." + sClassName, sClassRule);
}else{
// FF
var elHead = oDoc.getElementsByTagName("HEAD")[0];
var elStyle = oDoc.createElement ("STYLE");
//styleElement.type = "text / css";
elHead.appendChild (elStyle);
elStyle.sheet.insertRule("." + sClassName + " { "+sClassRule+" }", 0);
}
} catch (e) {
//console.log(e);
}
},
// [SMARTEDITORSUS-1533]
+2 -2
View File
@@ -1,2 +1,2 @@
/* Copyright (C) NAVER corp. Licensed under LGPL v2. @see https://github.com/naver/smarteditor2/blob/master/LICENSE.md */
if(typeof window.nhn=="undefined"){window.nhn={}}if(!nhn.husky){nhn.husky={}}(function(){var b=/^\$(LOCAL|BEFORE|ON|AFTER)_/,c=/^\$(BEFORE|ON|AFTER)_MSG_APP_READY$/,a=[],d={};nhn.husky.HuskyCore=jindo.$Class({name:"HuskyCore",aCallerStack:null,bMobile:jindo.$Agent().navigator().mobile||jindo.$Agent().navigator().msafari,$init:function(e){this.htOptions=e||{};a.push(this);if(this.htOptions.oDebugger){nhn.husky.HuskyCore.getCore=function(){return a};this.htOptions.oDebugger.setApp(this)}this.messageQueue=[];this.oMessageMap={};this.oDisabledMessage={};this.oLazyMessage={};this.aPlugins=[];this.appStatus=nhn.husky.APP_STATUS.NOT_READY;this.aCallerStack=[];this._fnWaitForPluginReady=jindo.$Fn(this._waitForPluginReady,this).bind();this.registerPlugin(this)},setDebugger:function(e){this.htOptions.oDebugger=e;e.setApp(this)},exec:function(g,f,e){if(this.appStatus==nhn.husky.APP_STATUS.NOT_READY){this.messageQueue[this.messageQueue.length]={msg:g,args:f,event:e};return true}this.exec=this._exec;this.exec(g,f,e)},delayedExec:function(j,g,e,f){var h=jindo.$Fn(this.exec,this).bind(j,g,f);setTimeout(h,e)},_exec:function(g,f,e){return(this._exec=this.htOptions.oDebugger?this._execWithDebugger:this._execWithoutDebugger).call(this,g,f,e)},_execWithDebugger:function(h,g,f){this.htOptions.oDebugger.log_MessageStart(h,g);var e=this._doExec(h,g,f);this.htOptions.oDebugger.log_MessageEnd(h,g);return e},_execWithoutDebugger:function(g,f,e){return this._doExec(g,f,e)},_doExec:function(m,j,h){var f=false;if(this.oLazyMessage[m]){var l=this.oLazyMessage[m];this._loadLazyFiles(m,j,h,l.aFilenames,0);return false}if(!this.oDisabledMessage[m]){var g=[];if(j&&j.length){var e=j.length;for(var k=0;k<e;k++){g[k]=j[k]}}if(h){g[g.length]=h}f=this._execMsgStep("BEFORE",m,g);if(f){f=this._execMsgStep("ON",m,g)}if(f){f=this._execMsgStep("AFTER",m,g)}}return f},registerPlugin:function(f){if(!f){throw ("An error occured in registerPlugin(): invalid plug-in")}f.nIdx=this.aPlugins.length;f.oApp=this;this.aPlugins[f.nIdx]=f;if(f.status!=nhn.husky.PLUGIN_STATUS.NOT_READY){f.status=nhn.husky.PLUGIN_STATUS.READY}if(this.appStatus!=nhn.husky.APP_STATUS.NOT_READY){for(var e in f){if(b.test(e)){this.addToMessageMap(e,f)}}}this.exec("MSG_PLUGIN_REGISTERED",[f]);return f.nIdx},disableMessage:function(e,f){this.oDisabledMessage[e]=f},registerBrowserEvent:function(j,k,f,h,e){h=h||[];var g=(e)?jindo.$Fn(this.delayedExec,this).bind(f,h,e):jindo.$Fn(this.exec,this).bind(f,h);return jindo.$Fn(g,this).attach(j,k)},run:function(h){this.htRunOptions=h||{};this._changeAppStatus(nhn.husky.APP_STATUS.WAITING_FOR_PLUGINS_READY);var g=this.messageQueue.length;for(var f=0;f<g;f++){var e=this.messageQueue[f];this.exec(e.msg,e.args,e.event)}this._fnWaitForPluginReady()},acceptLocalBeforeFirstAgain:function(f,e){f._husky_bRun=!e},createMessageMap:function(e){this.oMessageMap[e]=[];var g=this.aPlugins.length;for(var f=0;f<g;f++){this._doAddToMessageMap(e,this.aPlugins[f])}},addToMessageMap:function(e,f){if(!this.oMessageMap[e]){return}this._doAddToMessageMap(e,f)},_changeAppStatus:function(e){this.appStatus=e;if(this.appStatus==nhn.husky.APP_STATUS.READY){this.exec("MSG_APP_READY")}},_execMsgStep:function(e,f,g){return(this._execMsgStep=this.htOptions.oDebugger?this._execMsgStepWithDebugger:this._execMsgStepWithoutDebugger).call(this,e,f,g)},_execMsgStepWithDebugger:function(e,g,h){this.htOptions.oDebugger.log_MessageStepStart(e,g,h);var f=this._execMsgHandler("$"+e+"_"+g,h);this.htOptions.oDebugger.log_MessageStepEnd(e,g,h);return f},_execMsgStepWithoutDebugger:function(e,f,g){return this._execMsgHandler("$"+e+"_"+f,g)},_execMsgHandler:function(f,g){var h;if(!this.oMessageMap[f]){this.createMessageMap(f)}var k=this.oMessageMap[f];var j=k.length;if(j===0){return true}var e=true;if(c.test(f)){for(h=0;h<j;h++){if(this._execHandler(k[h],f,g)===false){e=false;break}}}else{for(h=0;h<j;h++){if(!k[h]._husky_bRun){k[h]._husky_bRun=true;if(typeof k[h].$LOCAL_BEFORE_FIRST=="function"&&this._execHandler(k[h],"$LOCAL_BEFORE_FIRST",[f,g])===false){continue}}if(typeof k[h].$LOCAL_BEFORE_ALL=="function"){if(this._execHandler(k[h],"$LOCAL_BEFORE_ALL",[f,g])===false){continue}}if(this._execHandler(k[h],f,g)===false){e=false;break}}}return e},_execHandler:function(g,f,e){return(this._execHandler=this.htOptions.oDebugger?this._execHandlerWithDebugger:this._execHandlerWithoutDebugger).call(this,g,f,e)},_execHandlerWithDebugger:function(k,h,g){this.htOptions.oDebugger.log_CallHandlerStart(k,h,g);var f;try{this.aCallerStack.push(k);f=k[h].apply(k,g);this.aCallerStack.pop()}catch(j){this.htOptions.oDebugger.handleException(j);f=false}this.htOptions.oDebugger.log_CallHandlerEnd(k,h,g);return f},_execHandlerWithoutDebugger:function(h,g,f){this.aCallerStack.push(h);var e=h[g].apply(h,f);this.aCallerStack.pop();return e},_doAddToMessageMap:function(f,h){if(typeof h[f]!="function"){return}var j=this.oMessageMap[f];for(var g=0,e=j.length;g<e;g++){if(this.oMessageMap[f][g]==h){return}}this.oMessageMap[fLine truncated
/* Copyright (C) NAVER corp. Licensed under LGPL v2. @see https://github.com/naver/smarteditor2/blob/master/LICENSE.md */
void 0===window.nhn&&(window.nhn={}),nhn.husky||(nhn.husky={}),function(){var d=/^\$(LOCAL|BEFORE|ON|AFTER)_/,r=/^\$(BEFORE|ON|AFTER)_MSG_APP_READY$/,c=[],a={};nhn.husky.HuskyCore=jindo.$Class({name:"HuskyCore",aCallerStack:null,bMobile:jindo.$Agent().navigator().mobile||jindo.$Agent().navigator().msafari,$init:function(e){this.htOptions=e||{},c.push(this),this.htOptions.oDebugger&&(nhn.husky.HuskyCore.getCore=function(){return c},this.htOptions.oDebugger.setApp(this)),this.messageQueue=[],this.oMessageMap={},this.oDisabledMessage={},this.oLazyMessage={},this.aPlugins=[],this.appStatus=nhn.husky.APP_STATUS.NOT_READY,this.aCallerStack=[],this._fnWaitForPluginReady=jindo.$Fn(this._waitForPluginReady,this).bind(),this.registerPlugin(this)},setDebugger:function(e){(this.htOptions.oDebugger=e).setApp(this)},exec:function(e,t,i){if(this.appStatus==nhn.husky.APP_STATUS.NOT_READY)return this.messageQueue[this.messageQueue.length]={msg:e,args:t,event:i},!0;this.exec=this._exec,this.exec(e,t,i)},delayedExec:function(e,t,i,n){var o=jindo.$Fn(this.exec,this).bind(e,t,n);setTimeout(o,i)},_exec:function(e,t,i){return(this._exec=this.htOptions.oDebugger?this._execWithDebugger:this._execWithoutDebugger).call(this,e,t,i)},_execWithDebugger:function(e,t,i){this.htOptions.oDebugger.log_MessageStart(e,t);var n=this._doExec(e,t,i);return this.htOptions.oDebugger.log_MessageEnd(e,t),n},_execWithoutDebugger:function(e,t,i){return this._doExec(e,t,i)},_doExec:function(e,t,i){var n=!1;if(this.oLazyMessage[e]){var o=this.oLazyMessage[e];return this._loadLazyFiles(e,t,i,o.aFilenames,0),!1}if(!this.oDisabledMessage[e]){var s=[];if(t&&t.length)for(var r=t.length,a=0;a<r;a++)s[a]=t[a];i&&(s[s.length]=i),(n=this._execMsgStep("BEFORE",e,s))&&(n=this._execMsgStep("ON",e,s)),n&&(n=this._execMsgStep("AFTER",e,s))}return n},registerPlugin:function(e){if(!e)throw"An error occured in registerPlugin(): invalid plug-in";if(e.nIdx=this.aPlugins.length,((e.oApp=this).aPlugins[e.nIdx]=e).status!=nhn.husky.PLUGIN_STATUS.NOT_READY&&(e.status=nhn.husky.PLUGIN_STATUS.READY),this.appStatus!=nhn.husky.APP_STATUS.NOT_READY)for(var t in e)d.test(t)&&this.addToMessageMap(t,e);return this.exec("MSG_PLUGIN_REGISTERED",[e]),e.nIdx},disableMessage:function(e,t){this.oDisabledMessage[e]=t},registerBrowserEvent:function(e,t,i,n,o){n=n||[];var s=o?jindo.$Fn(this.delayedExec,this).bind(i,n,o):jindo.$Fn(this.exec,this).bind(i,n);return jindo.$Fn(s,this).attach(e,t)},run:function(e){this.htRunOptions=e||{},this._changeAppStatus(nhn.husky.APP_STATUS.WAITING_FOR_PLUGINS_READY);for(var t=this.messageQueue.length,i=0;i<t;i++){var n=this.messageQueue[i];this.exec(n.msg,n.args,n.event)}this._fnWaitForPluginReady()},acceptLocalBeforeFirstAgain:function(e,t){e._husky_bRun=!t},createMessageMap:function(e){this.oMessageMap[e]=[];for(var t=this.aPlugins.length,i=0;i<t;i++)this._doAddToMessageMap(e,this.aPlugins[i])},addToMessageMap:function(e,t){this.oMessageMap[e]&&this._doAddToMessageMap(e,t)},_changeAppStatus:function(e){this.appStatus=e,this.appStatus==nhn.husky.APP_STATUS.READY&&this.exec("MSG_APP_READY")},_execMsgStep:function(e,t,i){return(this._execMsgStep=this.htOptions.oDebugger?this._execMsgStepWithDebugger:this._execMsgStepWithoutDebugger).call(this,e,t,i)},_execMsgStepWithDebugger:function(e,t,i){this.htOptions.oDebugger.log_MessageStepStart(e,t,i);var n=this._execMsgHandler("$"+e+"_"+t,i);return this.htOptions.oDebugger.log_MessageStepEnd(e,t,i),n},_execMsgStepWithoutDebugger:function(e,t,i){return this._execMsgHandler("$"+e+"_"+t,i)},_execMsgHandler:function(e,t){var i;this.oMessageMap[e]||this.createMessageMap(e);var n=this.oMessageMap[e],o=n.length;if(0===o)return!0;var s=!0;if(r.test(e)){for(i=0;i<o;i++)if(!1===this._execHandler(n[i],e,t)){s=!1;break}}else for(i=0;i<o;i++)if((n[i]._husky_bRun||(n[i]._husky_bRun=!0,"function"!=typeof n[i].$LOCAL_BEFORE_FIRST||!1!==this._execHandler(n[i],"$LOCAL_BEFORE_FIRST",[e,t])))&&("function"!=typeof n[i].$LOCAL_BEFORE_ALL||!1!==this._execHandler(n[i],"$LOCAL_BEFORE_ALL",[e,t]))&&!1===this._execHandler(n[i],e,t)){s=!1;break}return s},_execHandler:function(e,t,i){return(this._execHandler=this.htOptions.oDebugger?this._execHandlerWithDebugger:this._execHandlerWithoutDebugger).call(this,e,t,i)},_execHandlerWithDebugger:function(e,t,i){var n;this.htOptions.oDebugger.log_CallHandlerStart(e,t,i);try{this.aCallerStack.push(e),n=e[t].apply(e,i),this.aCallerStack.pop()}catch(e){this.htOptions.oDebugger.handleException(e),n=!1}return this.htOptions.oDebugger.log_CallHandlerEnd(e,t,i),n},_execHandlerWithoutDebugger:function(e,t,i){this.aCallerStack.push(e);var n=e[t].apply(e,i);return this.aCallerStack.pop(),n},_doAddToMessageMap:function(e,t){if("function"==typeof t[e]){for(var i=0,n=this.oMessageMap[e].length;i<n;i++)if(this.oMessageMap[e][i]==t)return;this.oMessageMap[e][i]=t}},_waitForPluginReady:function(){for(var e=!0,t=0;t<this.aPlugins.length;t++)if(this.aPlugins[t].status==nhn.husky.PLUGIN_STATUS.NOT_READY){e=!1;break}e?this.Line truncated
+1 -1
View File
@@ -5,7 +5,7 @@ if(!$config['cf_cert_use'] || $config['cf_cert_hp'] != 'kcb')
alert('기본환경설정에서 KCB 휴대폰본인확인 서비스로 설정해 주십시오.');
// key 디렉토리 체크
include_once('./key_dir_check.php');
require_once('./key_dir_check.php');
/**************************************************************************
* okname 생년월일 본인 확인서비스 파라미터
+2 -2
View File
@@ -15,8 +15,8 @@ foreach($check_arrays as $key){
certify_count_check($member['mb_id'], 'hp');
// KISA 취약점 내용(KVE-2018-0291) hpcert1.php의 $cmd 함수에 대한 인자 값은 hpcert_config.php 파일에서 설정되나, 이를 다른 페이지에서 포함한 뒤 호출할 시 임의 값 설정 가능
// 이에 include_once 를 include 로 수정함
include('./hpcert.config.php');
// 이에 include_once 를 require 로 수정함
require('./hpcert.config.php');
/**************************************************************************
okname 실행
**************************************************************************/
+3 -3
View File
@@ -1,7 +1,7 @@
<?php
include_once('./_common.php');
$check_arrays = array('exe', 'keypath', 'memId', 'endPointURL', 'logPath');
$check_arrays = array('exe', 'keypath', 'memId', 'endPointURL', 'endPointUrl', 'logPath');
foreach($check_arrays as $key){
if( isset($_REQUEST[$key]) && $_REQUEST[$key] ){
@@ -12,8 +12,8 @@ foreach($check_arrays as $key){
}
// KISA 취약점 내용(KVE-2018-0291) hpcert1.php의 $cmd 함수에 대한 인자 값은 hpcert_config.php 파일에서 설정되나, 이를 다른 페이지에서 포함한 뒤 호출할 시 임의 값 설정 가능
// 이에 include_once 를 include 로 수정함
include('./hpcert.config.php');
// 이에 include_once 를 require 로 수정함
require('./hpcert.config.php');
/**************************************************************************
파일명 : safe_hs_cert3.php
+1 -1
View File
@@ -5,7 +5,7 @@ if(!$config['cf_cert_use'] || $config['cf_cert_ipin'] != 'kcb')
alert('기본환경설정에서 KCB 아이핀 본인확인 서비스로 설정해 주십시오.');
// key 디렉토리 체크
include_once('./key_dir_check.php');
require_once('./key_dir_check.php');
$exe = '';
// 실행모듈
+2 -2
View File
@@ -15,8 +15,8 @@ foreach($check_arrays as $key){
certify_count_check($member['mb_id'], 'ipin');
// KISA 취약점 내용(KVE-2018-0291) hpcert1.php의 $cmd 함수에 대한 인자 값은 hpcert_config.php 파일에서 설정되나, 이를 다른 페이지에서 포함한 뒤 호출할 시 임의 값 설정 가능
// 이에 include_once 를 include 로 수정함
include('./ipin.config.php');
// 이에 include_once 를 require 로 수정함
require('./ipin.config.php');
$option = "C";// Option
+1 -1
View File
@@ -11,7 +11,7 @@ foreach($check_arrays as $key){
$$key = '';
}
include('./ipin.config.php');
require('./ipin.config.php');
//아이핀팝업에서 조회한 PERSONALINFO이다.
@$encPsnlInfo = $_POST["encPsnlInfo"];