gper/Gnuboard5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[security]그누보드5 XSS, SQL Injection 취약점 수정

Browse Source
This commit is contained in:
thisgun
2026-04-16 03:46:02 +00:00
parent c38de4c94b
commit f2e7dbc5ed
24 changed files with 49 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
adm/admin.lib.php
+1 -1
View File
@@ -389,7 +389,7 @@ function order_select($fld, $sel = '')
// 불법접근을 막도록 토큰을 생성하면서 토큰값을 리턴 // 불법접근을 막도록 토큰을 생성하면서 토큰값을 리턴
function get_admin_token() function get_admin_token()
{ {
$token = md5(uniqid(rand(), true)); $token = get_random_token_string(16);
set_session('ss_admin_token', $token); set_session('ss_admin_token', $token);
return $token; return $token;
adm/admin.tail.php
+1 -1
View File
@@ -17,7 +17,7 @@ $print_version = ($is_admin == 'super') ? 'Version ' . G5_GNUBOARD_VER : '';
</div> </div>
<footer id="ft"> <footer id="ft">
<p> <p>
Copyright &copy; <?php echo $_SERVER['HTTP_HOST']; ?>. All rights reserved. <?php echo $print_version; ?><br> Copyright &copy; <?php echo htmlspecialchars($_SERVER['HTTP_HOST']); ?>. All rights reserved. <?php echo $print_version; ?><br>
<button type="button" class="scroll_top"><span class="top_img"></span><span class="top_txt">TOP</span></button> <button type="button" class="scroll_top"><span class="top_img"></span><span class="top_txt">TOP</span></button>
</p> </p>
</footer> </footer>
adm/board_form_update.php
+5 -5
View File
@@ -139,7 +139,7 @@ $bo_hot = isset($_POST['bo_hot']) ? (int) $_POST['bo_hot'] : 0;
$bo_image_width = isset($_POST['bo_image_width']) ? (int) $_POST['bo_image_width'] : 0; $bo_image_width = isset($_POST['bo_image_width']) ? (int) $_POST['bo_image_width'] : 0;
$bo_use_search = isset($_POST['bo_use_search']) ? (int) $_POST['bo_use_search'] : 0; $bo_use_search = isset($_POST['bo_use_search']) ? (int) $_POST['bo_use_search'] : 0;
$bo_use_cert = isset($_POST['bo_use_cert']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['bo_use_cert']) : ''; $bo_use_cert = isset($_POST['bo_use_cert']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['bo_use_cert']) : '';
$bo_device = isset($_POST['bo_device']) ? clean_xss_tags($_POST['bo_device'], 1, 1) : ''; $bo_device = isset($_POST['bo_device']) ? addslashes(clean_xss_tags(stripslashes($_POST['bo_device']), 1, 1)) : '';
$bo_list_level = isset($_POST['bo_list_level']) ? (int) $_POST['bo_list_level'] : 0; $bo_list_level = isset($_POST['bo_list_level']) ? (int) $_POST['bo_list_level'] : 0;
$bo_read_level = isset($_POST['bo_read_level']) ? (int) $_POST['bo_read_level'] : 0; $bo_read_level = isset($_POST['bo_read_level']) ? (int) $_POST['bo_read_level'] : 0;
$bo_write_level = isset($_POST['bo_write_level']) ? (int) $_POST['bo_write_level'] : 0; $bo_write_level = isset($_POST['bo_write_level']) ? (int) $_POST['bo_write_level'] : 0;
@@ -155,9 +155,9 @@ $bo_read_point = isset($_POST['bo_read_point']) ? (int) $_POST['bo_read_point']
$bo_write_point = isset($_POST['bo_write_point']) ? (int) $_POST['bo_write_point'] : 0; $bo_write_point = isset($_POST['bo_write_point']) ? (int) $_POST['bo_write_point'] : 0;
$bo_comment_point = isset($_POST['bo_comment_point']) ? (int) $_POST['bo_comment_point'] : 0; $bo_comment_point = isset($_POST['bo_comment_point']) ? (int) $_POST['bo_comment_point'] : 0;
$bo_download_point = isset($_POST['bo_download_point']) ? (int) $_POST['bo_download_point'] : 0; $bo_download_point = isset($_POST['bo_download_point']) ? (int) $_POST['bo_download_point'] : 0;
$bo_select_editor = isset($_POST['bo_select_editor']) ? clean_xss_tags($_POST['bo_select_editor'], 1, 1) : ''; $bo_select_editor = isset($_POST['bo_select_editor']) ? addslashes(clean_xss_tags(stripslashes($_POST['bo_select_editor']), 1, 1)) : '';
$bo_skin = isset($_POST['bo_skin']) ? clean_xss_tags($_POST['bo_skin'], 1, 1) : ''; $bo_skin = isset($_POST['bo_skin']) ? addslashes(clean_xss_tags(stripslashes($_POST['bo_skin']), 1, 1)) : '';
$bo_mobile_skin = isset($_POST['bo_mobile_skin']) ? clean_xss_tags($_POST['bo_mobile_skin'], 1, 1) : ''; $bo_mobile_skin = isset($_POST['bo_mobile_skin']) ? addslashes(clean_xss_tags(stripslashes($_POST['bo_mobile_skin']), 1, 1)) : '';
$bo_content_head = isset($_POST['bo_content_head']) ? $_POST['bo_content_head'] : ''; $bo_content_head = isset($_POST['bo_content_head']) ? $_POST['bo_content_head'] : '';
$bo_content_tail = isset($_POST['bo_content_tail']) ? $_POST['bo_content_tail'] : ''; $bo_content_tail = isset($_POST['bo_content_tail']) ? $_POST['bo_content_tail'] : '';
$bo_mobile_content_head = isset($_POST['bo_mobile_content_head']) ? $_POST['bo_mobile_content_head'] : ''; $bo_mobile_content_head = isset($_POST['bo_mobile_content_head']) ? $_POST['bo_mobile_content_head'] : '';
@@ -176,7 +176,7 @@ $bo_write_min = isset($_POST['bo_write_min']) ? (int) $_POST['bo_write_min'] : 0
$bo_write_max = isset($_POST['bo_write_max']) ? (int) $_POST['bo_write_max'] : 0; $bo_write_max = isset($_POST['bo_write_max']) ? (int) $_POST['bo_write_max'] : 0;
$bo_comment_min = isset($_POST['bo_comment_min']) ? (int) $_POST['bo_comment_min'] : 0; $bo_comment_min = isset($_POST['bo_comment_min']) ? (int) $_POST['bo_comment_min'] : 0;
$bo_comment_max = isset($_POST['bo_comment_max']) ? (int) $_POST['bo_comment_max'] : 0; $bo_comment_max = isset($_POST['bo_comment_max']) ? (int) $_POST['bo_comment_max'] : 0;
$bo_sort_field = isset($_POST['bo_sort_field']) ? clean_xss_tags($_POST['bo_sort_field'], 1, 1) : ''; $bo_sort_field = isset($_POST['bo_sort_field']) ? addslashes(clean_xss_tags(stripslashes($_POST['bo_sort_field']), 1, 1)) : '';
if (strpbrk($bo_skin.$bo_mobile_skin, "?%*:|\"<>") !== false) { if (strpbrk($bo_skin.$bo_mobile_skin, "?%*:|\"<>") !== false) {
alert('스킨 디렉토리명 오류!'); alert('스킨 디렉토리명 오류!');
adm/contentformupdate.php
+2 -2
View File
@@ -35,8 +35,8 @@ $co_timg_del = (isset($_POST['co_timg_del']) && $_POST['co_timg_del']) ? 1 : 0;
$co_html = isset($_POST['co_html']) ? (int) $_POST['co_html'] : 0; $co_html = isset($_POST['co_html']) ? (int) $_POST['co_html'] : 0;
$co_content = isset($_POST['co_content']) ? $_POST['co_content'] : ''; $co_content = isset($_POST['co_content']) ? $_POST['co_content'] : '';
$co_mobile_content = isset($_POST['co_mobile_content']) ? $_POST['co_mobile_content'] : ''; $co_mobile_content = isset($_POST['co_mobile_content']) ? $_POST['co_mobile_content'] : '';
$co_skin = isset($_POST['co_skin']) ? clean_xss_tags($_POST['co_skin'], 1, 1) : ''; $co_skin = isset($_POST['co_skin']) ? addslashes(clean_xss_tags(stripslashes($_POST['co_skin']), 1, 1)) : '';
$co_mobile_skin = isset($_POST['co_mobile_skin']) ? clean_xss_tags($_POST['co_mobile_skin'], 1, 1) : ''; $co_mobile_skin = isset($_POST['co_mobile_skin']) ? addslashes(clean_xss_tags(stripslashes($_POST['co_mobile_skin']), 1, 1)) : '';
// 관리자가 자동등록방지를 사용해야 할 경우 // 관리자가 자동등록방지를 사용해야 할 경우
if (((isset($co_row['co_include_head']) && $co_row['co_include_head'] !== $co_include_head) || (isset($co_row['co_include_tail']) && $co_row['co_include_tail'] !== $co_include_tail)) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()) { if (((isset($co_row['co_include_head']) && $co_row['co_include_head'] !== $co_include_head) || (isset($co_row['co_include_tail']) && $co_row['co_include_tail'] !== $co_include_tail)) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()) {
adm/mail_select_form.php
+1 -1
View File
@@ -80,7 +80,7 @@ require_once './admin.head.php';
<tr> <tr>
<th scope="row"><label for="mb_email">E-mail</label></th> <th scope="row"><label for="mb_email">E-mail</label></th>
<td> <td>
<?php echo help("메일 주소에 단어 포함 (예 : @" . preg_replace('#^(www[^\.]*\.){1}#', '', $_SERVER['HTTP_HOST']) . ")") ?> <?php echo help("메일 주소에 단어 포함 (예 : @" . htmlspecialchars(preg_replace('#^(www[^\.]*\.){1}#', '', $_SERVER['HTTP_HOST'])) . ")") ?>
<input type="text" name="mb_email" value="<?php echo get_sanitize_input($mb_email); ?>" id="mb_email" class="frm_input" size="50"> <input type="text" name="mb_email" value="<?php echo get_sanitize_input($mb_email); ?>" id="mb_email" class="frm_input" size="50">
</td> </td>
</tr> </tr>
adm/mail_select_list.php
+4 -4
View File
@@ -12,10 +12,10 @@ $sql_common = " from {$g5['member_table']} ";
$sql_where = " where (1) "; $sql_where = " where (1) ";
$mb_id1 = isset($_POST['mb_id1']) ? (int) $_POST['mb_id1'] : 1; $mb_id1 = isset($_POST['mb_id1']) ? (int) $_POST['mb_id1'] : 1;
$mb_id1_from = isset($_POST['mb_id1_from']) ? clean_xss_tags($_POST['mb_id1_from'], 1, 1, 30) : ''; $mb_id1_from = isset($_POST['mb_id1_from']) ? addslashes(clean_xss_tags(stripslashes($_POST['mb_id1_from']), 1, 1, 30)) : '';
$mb_id1_to = isset($_POST['mb_id1_to']) ? clean_xss_tags($_POST['mb_id1_to'], 1, 1, 30) : ''; $mb_id1_to = isset($_POST['mb_id1_to']) ? addslashes(clean_xss_tags(stripslashes($_POST['mb_id1_to']), 1, 1, 30)) : '';
$mb_email = isset($_POST['mb_email']) ? clean_xss_tags($_POST['mb_email'], 1, 1, 100) : ''; $mb_email = isset($_POST['mb_email']) ? addslashes(clean_xss_tags(stripslashes($_POST['mb_email']), 1, 1, 100)) : '';
$mb_mailling = isset($_POST['mb_mailling']) ? clean_xss_tags($_POST['mb_mailling'], 1, 1, 100) : ''; $mb_mailling = isset($_POST['mb_mailling']) ? addslashes(clean_xss_tags(stripslashes($_POST['mb_mailling']), 1, 1, 100)) : '';
$mb_level_from = isset($_POST['mb_level_from'])? (int) $_POST['mb_level_from'] : 1; $mb_level_from = isset($_POST['mb_level_from'])? (int) $_POST['mb_level_from'] : 1;
$mb_level_to = isset($_POST['mb_level_to']) ? (int) $_POST['mb_level_to'] : 10; $mb_level_to = isset($_POST['mb_level_to']) ? (int) $_POST['mb_level_to'] : 10;
adm/shop_admin/orderlist.php
+2 -2
View File
@@ -26,8 +26,8 @@ $od_cancel_price = isset($_GET['od_cancel_price']) ? preg_replace('/[^0-9a-z]/i'
$od_refund_price = isset($_GET['od_refund_price']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_refund_price']) : ''; $od_refund_price = isset($_GET['od_refund_price']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_refund_price']) : '';
$od_receipt_point = isset($_GET['od_receipt_point']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_receipt_point']) : ''; $od_receipt_point = isset($_GET['od_receipt_point']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_receipt_point']) : '';
$od_coupon = isset($_GET['od_coupon']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_coupon']) : ''; $od_coupon = isset($_GET['od_coupon']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_coupon']) : '';
$od_settle_case = isset($_GET['od_settle_case']) ? clean_xss_tags($_GET['od_settle_case'], 1, 1) : ''; $od_settle_case = isset($_GET['od_settle_case']) ? addslashes(clean_xss_tags(stripslashes($_GET['od_settle_case']), 1, 1)) : '';
$od_escrow = isset($_GET['od_escrow']) ? clean_xss_tags($_GET['od_escrow'], 1, 1) : ''; $od_escrow = isset($_GET['od_escrow']) ? addslashes(clean_xss_tags(stripslashes($_GET['od_escrow']), 1, 1)) : '';
$tot_itemcount = $tot_orderprice = $tot_receiptprice = $tot_ordercancel = $tot_misu = $tot_couponprice = 0; $tot_itemcount = $tot_orderprice = $tot_receiptprice = $tot_ordercancel = $tot_misu = $tot_couponprice = 0;
$sql_search = ""; $sql_search = "";
adm/sms_admin/config_update.php
+7 -7
View File
@@ -10,14 +10,14 @@ check_admin_token();
$g5['title'] = "SMS 기본설정"; $g5['title'] = "SMS 기본설정";
$cf_phone = isset($_REQUEST['cf_phone']) ? clean_xss_tags($_REQUEST['cf_phone'], 1, 1) : ''; $cf_phone = isset($_REQUEST['cf_phone']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_phone']), 1, 1)) : '';
$cf_sms_use = isset($_REQUEST['cf_sms_use']) ? clean_xss_tags($_REQUEST['cf_sms_use'], 1, 1) : ''; $cf_sms_use = isset($_REQUEST['cf_sms_use']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_sms_use']), 1, 1)) : '';
$cf_sms_type = isset($_REQUEST['cf_sms_type']) ? clean_xss_tags($_REQUEST['cf_sms_type'], 1, 1) : ''; $cf_sms_type = isset($_REQUEST['cf_sms_type']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_sms_type']), 1, 1)) : '';
$cf_icode_id = isset($_REQUEST['cf_icode_id']) ? clean_xss_tags($_REQUEST['cf_icode_id'], 1, 1) : ''; $cf_icode_id = isset($_REQUEST['cf_icode_id']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_icode_id']), 1, 1)) : '';
$cf_icode_pw = isset($_REQUEST['cf_icode_pw']) ? clean_xss_tags($_REQUEST['cf_icode_pw'], 1, 1) : ''; $cf_icode_pw = isset($_REQUEST['cf_icode_pw']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_icode_pw']), 1, 1)) : '';
$cf_icode_server_ip = isset($_REQUEST['cf_icode_server_ip']) ? clean_xss_tags($_REQUEST['cf_icode_server_ip'], 1, 1) : ''; $cf_icode_server_ip = isset($_REQUEST['cf_icode_server_ip']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_icode_server_ip']), 1, 1)) : '';
$cf_icode_server_port = isset($_REQUEST['cf_icode_server_port']) ? clean_xss_tags($_REQUEST['cf_icode_server_port'], 1, 1) : ''; $cf_icode_server_port = isset($_REQUEST['cf_icode_server_port']) ? clean_xss_tags($_REQUEST['cf_icode_server_port'], 1, 1) : '';
$cf_icode_token_key = isset($_REQUEST['cf_icode_token_key']) ? clean_xss_tags($_REQUEST['cf_icode_token_key'], 1, 1) : ''; $cf_icode_token_key = isset($_REQUEST['cf_icode_token_key']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_icode_token_key']), 1, 1)) : '';
// 회신번호 체크 // 회신번호 체크
if(!check_vaild_callback($cf_phone)) if(!check_vaild_callback($cf_phone))
adm/sms_admin/form_list.php
+1 -1
View File
@@ -114,7 +114,7 @@ function multi_update(sel)
<div class="local_sch01 local_sch sms_preset_sch"> <div class="local_sch01 local_sch sms_preset_sch">
<form> <form>
<label for="fg_no" class="sound_only">그룹명</label> <label for="fg_no" class="sound_only">그룹명</label>
<select name="fg_no" id="fg_no" onchange="location.href='<?php echo $_SERVER['SCRIPT_NAME']?>?fg_no='+this.value;"> <select name="fg_no" id="fg_no" onchange="location.href='<?php echo htmlspecialchars($_SERVER['SCRIPT_NAME'])?>?fg_no='+this.value;">
<option value="" <?php echo $fg_no?'':'selected'?>> 전체 </option> <option value="" <?php echo $fg_no?'':'selected'?>> 전체 </option>
<option value="0" <?php echo $fg_no=='0'?'selected':''?>> 미분류 (<?php echo number_format($no_count)?>) </option> <option value="0" <?php echo $fg_no=='0'?'selected':''?>> 미분류 (<?php echo number_format($no_count)?>) </option>
<?php for($i=0; $i<count($group); $i++) {?> <?php for($i=0; $i<count($group); $i++) {?>
adm/sms_admin/num_book.php
+1 -1
View File
@@ -130,7 +130,7 @@ function no_hp_click(val)
<form name="search_form" class="local_sch01 local_sch"> <form name="search_form" class="local_sch01 local_sch">
<label for="bg_no" class="sound_only">그룹명</label> <label for="bg_no" class="sound_only">그룹명</label>
<select name="bg_no" id="bg_no" onchange="location.href='<?php echo $_SERVER['SCRIPT_NAME']?>?bg_no='+this.value;"> <select name="bg_no" id="bg_no" onchange="location.href='<?php echo htmlspecialchars($_SERVER['SCRIPT_NAME'])?>?bg_no='+this.value;">
<option value=""<?php echo get_selected('', $bg_no); ?>> 전체 </option> <option value=""<?php echo get_selected('', $bg_no); ?>> 전체 </option>
<option value="<?php echo $no_group['bg_no']?>"<?php echo get_selected($no_group['bg_no'], $bg_no); ?>> <?php echo $no_group['bg_name']?> (<?php echo number_format($no_group['bg_count'])?> 명) </option> <option value="<?php echo $no_group['bg_no']?>"<?php echo get_selected($no_group['bg_no'], $bg_no); ?>> <?php echo $no_group['bg_name']?> (<?php echo number_format($no_group['bg_count'])?> 명) </option>
<?php for($i=0; $i<count($group); $i++) {?> <?php for($i=0; $i<count($group); $i++) {?>
bbs/register_email_update.php
+2 -2
View File
@@ -45,8 +45,8 @@ $subject = '['.$config['cf_title'].'] 인증확인 메일입니다.';
$mb_name = $mb['mb_name']; $mb_name = $mb['mb_name'];
// 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용 // 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용 (CSPRNG 사용)
$mb_md5 = md5(pack('V*', rand(), rand(), rand(), rand())); $mb_md5 = get_random_token_string(16);
sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '{$esc_mb_id}' "); sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '{$esc_mb_id}' ");
bbs/register_form.php
+1 -1
View File
@@ -6,7 +6,7 @@ include_once(G5_LIB_PATH.'/register.lib.php');
run_event('register_form_before'); run_event('register_form_before');
// 불법접근을 막도록 토큰생성 // 불법접근을 막도록 토큰생성
$token = md5(uniqid(rand(), true)); $token = get_random_token_string(16);
set_session("ss_token", $token); set_session("ss_token", $token);
set_session("ss_cert_no", ""); set_session("ss_cert_no", "");
set_session("ss_cert_hash", ""); set_session("ss_cert_hash", "");
bbs/register_form_update.php
+4 -4
View File
@@ -305,9 +305,9 @@ if ($w == '') {
if ($config['cf_email_mb_member']) { if ($config['cf_email_mb_member']) {
$subject = '['.$config['cf_title'].'] 회원가입을 축하드립니다.'; $subject = '['.$config['cf_title'].'] 회원가입을 축하드립니다.';
// 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용 // 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용 (CSPRNG 사용)
if ($config['cf_use_email_certify']) { if ($config['cf_use_email_certify']) {
$mb_md5 = md5(pack('V*', rand(), rand(), rand(), rand())); $mb_md5 = get_random_token_string(16);
sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' "); sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' ");
$certify_href = G5_BBS_URL.'/email_certify.php?mb_id='.$mb_id.'&amp;mb_md5='.$mb_md5; $certify_href = G5_BBS_URL.'/email_certify.php?mb_id='.$mb_id.'&amp;mb_md5='.$mb_md5;
} }
@@ -590,8 +590,8 @@ if( $config['cf_member_img_size'] && $config['cf_member_img_width'] && $config['
if ($config['cf_use_email_certify'] && $old_email != $mb_email) { if ($config['cf_use_email_certify'] && $old_email != $mb_email) {
$subject = '['.$config['cf_title'].'] 인증확인 메일입니다.'; $subject = '['.$config['cf_title'].'] 인증확인 메일입니다.';
// 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용 // 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용 (CSPRNG 사용)
$mb_md5 = md5(pack('V*', rand(), rand(), rand(), rand())); $mb_md5 = get_random_token_string(16);
sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' "); sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' ");
lib/common.lib.php
+3 -3
View File
@@ -2510,7 +2510,7 @@ function _callback_normalizeString($matches){
// 토큰 생성 // 토큰 생성
function _token() function _token()
{ {
return md5(uniqid(rand(), true)); return get_random_token_string(16);
} }
@@ -2578,7 +2578,7 @@ function _get_token_secret()
{ {
$secret = get_session('ss_token_secret'); $secret = get_session('ss_token_secret');
if (!$secret) { if (!$secret) {
$secret = md5(uniqid(rand(), true)); $secret = get_random_token_string(16);
set_session('ss_token_secret', $secret); set_session('ss_token_secret', $secret);
} }
return $secret; return $secret;
@@ -4395,7 +4395,7 @@ function get_sql_affected_rows($link=null)
// 불법접근을 막도록 토큰을 생성하면서 토큰값을 리턴 // 불법접근을 막도록 토큰을 생성하면서 토큰값을 리턴
function get_write_token($bo_table) function get_write_token($bo_table)
{ {
$token = md5(uniqid(rand(), true)); $token = get_random_token_string(16);
set_session('ss_write_'.$bo_table.'_token', $token); set_session('ss_write_'.$bo_table.'_token', $token);
return $token; return $token;
mobile/shop/itemrecommend.php
+1 -1
View File
@@ -7,7 +7,7 @@ if (!$is_member)
alert_close('회원만 메일을 발송할 수 있습니다.'); alert_close('회원만 메일을 발송할 수 있습니다.');
// 스팸을 발송할 수 없도록 세션에 아무값이나 저장하여 hidden 으로 넘겨서 다음 페이지에서 비교함 // 스팸을 발송할 수 없도록 세션에 아무값이나 저장하여 hidden 으로 넘겨서 다음 페이지에서 비교함
$token = md5(uniqid(rand(), true)); $token = get_random_token_string(16);
set_session("ss_token", $token); set_session("ss_token", $token);
$it = get_shop_item($it_id, true); $it = get_shop_item($it_id, true);
mobile/shop/nicepay/nicepay_result.php
+1 -1
View File
@@ -16,7 +16,7 @@ $txTid = isset($_POST['TxTid']) ? clean_xss_tags($_POST['TxTid']) : ''; //
$authToken = isset($_POST['AuthToken']) ? clean_xss_tags($_POST['AuthToken']) : ''; // authentication TOKEN $authToken = isset($_POST['AuthToken']) ? clean_xss_tags($_POST['AuthToken']) : ''; // authentication TOKEN
$payMethod = isset($_POST['PayMethod']) ? clean_xss_tags($_POST['PayMethod']) : ''; // payment method $payMethod = isset($_POST['PayMethod']) ? clean_xss_tags($_POST['PayMethod']) : ''; // payment method
$mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : ''; // merchant id $mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : ''; // merchant id
$moid = isset($_POST['Moid']) ? clean_xss_tags($_POST['Moid']) : ''; // order number $moid = isset($_POST['Moid']) ? addslashes(clean_xss_tags(stripslashes($_POST['Moid']))) : ''; // order number
$amt = isset($_POST['Amt']) ? (int) preg_replace('/[^0-9]/', '', $_POST['Amt']) : 0; // Amount of payment $amt = isset($_POST['Amt']) ? (int) preg_replace('/[^0-9]/', '', $_POST['Amt']) : 0; // Amount of payment
$reqReserved = isset($_POST['ReqReserved']) ? clean_xss_tags($_POST['ReqReserved']) : ''; // mall custom field $reqReserved = isset($_POST['ReqReserved']) ? clean_xss_tags($_POST['ReqReserved']) : ''; // mall custom field
$netCancelURL = isset($_POST['NetCancelURL']) ? clean_xss_tags($_POST['NetCancelURL']) : ''; // netCancelURL $netCancelURL = isset($_POST['NetCancelURL']) ? clean_xss_tags($_POST['NetCancelURL']) : ''; // netCancelURL
mobile/shop/nicepay/return_url_result.php
+1 -1
View File
@@ -5,7 +5,7 @@ include_once(G5_MSHOP_PATH.'/settle_nicepay.inc.php');
$authResultCode = isset($_POST['AuthResultCode']) ? clean_xss_tags($_POST['AuthResultCode']) : ''; // authentication result code 0000:success $authResultCode = isset($_POST['AuthResultCode']) ? clean_xss_tags($_POST['AuthResultCode']) : ''; // authentication result code 0000:success
$authResultMsg = isset($_POST['AuthResultMsg']) ? clean_xss_tags($_POST['AuthResultMsg']) : ''; // authentication result message $authResultMsg = isset($_POST['AuthResultMsg']) ? clean_xss_tags($_POST['AuthResultMsg']) : ''; // authentication result message
$mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : ''; // merchant id $mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : ''; // merchant id
$moid = isset($_POST['Moid']) ? clean_xss_tags($_POST['Moid']) : ''; // order number $moid = isset($_POST['Moid']) ? addslashes(clean_xss_tags(stripslashes($_POST['Moid']))) : ''; // order number
$sql = " select * from {$g5['g5_shop_order_data_table']} where od_id = '$moid' "; $sql = " select * from {$g5['g5_shop_order_data_table']} where od_id = '$moid' ";
$row = sql_fetch($sql); $row = sql_fetch($sql);
plugin/social/popup.php
+1 -1
View File
@@ -36,7 +36,7 @@ if (isset($_REQUEST['mylink']) && !empty($_REQUEST['mylink'])) {
alert_close('올바른 방법으로 이용해 주십시오.'); alert_close('올바른 방법으로 이용해 주십시오.');
} }
set_session('ss_social_mylink_token', md5(uniqid(rand(), true))); set_session('ss_social_mylink_token', get_random_token_string(16));
} }
} }
plugin/social/register_member.php
+1 -1
View File
@@ -40,7 +40,7 @@ $is_exists_email = $user_email ? exist_mb_email($user_email, '') : false;
$user_name = isset($user_profile->username) ? $user_profile->username : ''; $user_name = isset($user_profile->username) ? $user_profile->username : '';
// 불법접근을 막도록 토큰생성 // 불법접근을 막도록 토큰생성
$token = md5(uniqid(rand(), true)); $token = get_random_token_string(16);
set_session("ss_token", $token); set_session("ss_token", $token);
$g5['title'] = '소셜 회원 가입 - '.social_get_provider_service_name($provider_name); $g5['title'] = '소셜 회원 가입 - '.social_get_provider_service_name($provider_name);
plugin/social/register_member_update.php
+4 -4
View File
@@ -30,7 +30,7 @@ $mb_password = isset($_POST['mb_password']) ? trim($_POST['mb_password']) : '
$mb_password_re = isset($_POST['mb_password_re']) ? trim($_POST['mb_password_re']) : ''; $mb_password_re = isset($_POST['mb_password_re']) ? trim($_POST['mb_password_re']) : '';
$mb_nick = isset($_POST['mb_nick']) ? trim(strip_tags($_POST['mb_nick'])) : ''; $mb_nick = isset($_POST['mb_nick']) ? trim(strip_tags($_POST['mb_nick'])) : '';
$mb_email = isset($_POST['mb_email']) ? trim($_POST['mb_email']) : ''; $mb_email = isset($_POST['mb_email']) ? trim($_POST['mb_email']) : '';
$mb_name = isset($_POST['mb_name']) ? clean_xss_tags(trim(strip_tags($_POST['mb_name']))) : ''; $mb_name = isset($_POST['mb_name']) ? addslashes(clean_xss_tags(trim(strip_tags(stripslashes($_POST['mb_name']))))) : '';
$mb_hp = isset($_POST['mb_hp']) ? trim($_POST['mb_hp']) : ''; $mb_hp = isset($_POST['mb_hp']) ? trim($_POST['mb_hp']) : '';
$mb_email = get_email_address($mb_email); $mb_email = get_email_address($mb_email);
@@ -54,7 +54,7 @@ if( ! $mb_nick || ! $mb_name ){
if( ! isset($mb_password) || ! $mb_password ){ if( ! isset($mb_password) || ! $mb_password ){
$mb_password = md5(pack('V*', rand(), rand(), rand(), rand())); $mb_password = get_random_token_string(16);
} }
@@ -272,8 +272,8 @@ if($result) {
} else { // 메일인증을 사용한다면 } else { // 메일인증을 사용한다면
$subject = '['.$config['cf_title'].'] 인증확인 메일입니다.'; $subject = '['.$config['cf_title'].'] 인증확인 메일입니다.';
// 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용 // 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용 (CSPRNG 사용)
$mb_md5 = md5(pack('V*', rand(), rand(), rand(), rand())); $mb_md5 = get_random_token_string(16);
sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' "); sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' ");
shop/itemrecommend.php
+1 -1
View File
@@ -12,7 +12,7 @@ if (!$is_member)
alert_close('회원만 메일을 발송할 수 있습니다.'); alert_close('회원만 메일을 발송할 수 있습니다.');
// 스팸을 발송할 수 없도록 세션에 아무값이나 저장하여 hidden 으로 넘겨서 다음 페이지에서 비교함 // 스팸을 발송할 수 없도록 세션에 아무값이나 저장하여 hidden 으로 넘겨서 다음 페이지에서 비교함
$token = md5(uniqid(rand(), true)); $token = get_random_token_string(16);
set_session("ss_token", $token); set_session("ss_token", $token);
$sql = " select it_name from {$g5['g5_shop_item_table']} where it_id='$it_id' "; $sql = " select it_name from {$g5['g5_shop_item_table']} where it_id='$it_id' ";
shop/nicepay/nicepay_result.php
+1 -1
View File
@@ -16,7 +16,7 @@ $txTid = isset($_POST['TxTid']) ? clean_xss_tags($_POST['TxTid']) : ''; //
$authToken = isset($_POST['AuthToken']) ? clean_xss_tags($_POST['AuthToken']) : ''; // authentication TOKEN $authToken = isset($_POST['AuthToken']) ? clean_xss_tags($_POST['AuthToken']) : ''; // authentication TOKEN
$payMethod = isset($_POST['PayMethod']) ? clean_xss_tags($_POST['PayMethod']) : ''; // payment method $payMethod = isset($_POST['PayMethod']) ? clean_xss_tags($_POST['PayMethod']) : ''; // payment method
$mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : ''; // merchant id $mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : ''; // merchant id
$moid = isset($_POST['Moid']) ? clean_xss_tags($_POST['Moid']) : ''; // order number $moid = isset($_POST['Moid']) ? addslashes(clean_xss_tags(stripslashes($_POST['Moid']))) : ''; // order number
$amt = isset($_POST['Amt']) ? (int) preg_replace('/[^0-9]/', '', $_POST['Amt']) : 0; // Amount of payment $amt = isset($_POST['Amt']) ? (int) preg_replace('/[^0-9]/', '', $_POST['Amt']) : 0; // Amount of payment
$reqReserved = isset($_POST['ReqReserved']) ? clean_xss_tags($_POST['ReqReserved']) : ''; // mall custom field $reqReserved = isset($_POST['ReqReserved']) ? clean_xss_tags($_POST['ReqReserved']) : ''; // mall custom field
$netCancelURL = isset($_POST['NetCancelURL']) ? clean_xss_tags($_POST['NetCancelURL']) : ''; // netCancelURL $netCancelURL = isset($_POST['NetCancelURL']) ? clean_xss_tags($_POST['NetCancelURL']) : ''; // netCancelURL
shop/orderinquiryview.php
+1 -1
View File
@@ -8,7 +8,7 @@ if( isset($_GET['ini_noti']) && !isset($_GET['uid']) ){
} }
// 불법접속을 할 수 없도록 세션에 아무값이나 저장하여 hidden 으로 넘겨서 다음 페이지에서 비교함 // 불법접속을 할 수 없도록 세션에 아무값이나 저장하여 hidden 으로 넘겨서 다음 페이지에서 비교함
$token = md5(uniqid(rand(), true)); $token = get_random_token_string(16);
set_session("ss_token", $token); set_session("ss_token", $token);
if (!$is_member) { if (!$is_member) {
shop/settle_nicepay_common.php
+2 -2
View File
@@ -22,11 +22,11 @@ if (in_array($_SERVER['REMOTE_ADDR'], $pg_allow_ips)) {
$name = isset($_POST['name']) ? clean_xss_tags($_POST['name']) : ''; //구매자명 $name = isset($_POST['name']) ? clean_xss_tags($_POST['name']) : ''; //구매자명
$GoodsName = isset($_POST['GoodsName']) ? clean_xss_tags($_POST['GoodsName']) : ''; //상품명 $GoodsName = isset($_POST['GoodsName']) ? clean_xss_tags($_POST['GoodsName']) : ''; //상품명
$TID = isset($_POST['TID']) ? clean_xss_tags($_POST['TID']) : ''; //거래번호 $TID = isset($_POST['TID']) ? clean_xss_tags($_POST['TID']) : ''; //거래번호
$MOID = isset($_POST['MOID']) ? clean_xss_tags($_POST['MOID']) : ''; //주문번호 $MOID = isset($_POST['MOID']) ? addslashes(clean_xss_tags(stripslashes($_POST['MOID']))) : ''; //주문번호
$AuthDate = isset($_POST['AuthDate']) ? clean_xss_tags($_POST['AuthDate']) : ''; //입금일시 (yyMMddHHmmss) 12 자리 $AuthDate = isset($_POST['AuthDate']) ? clean_xss_tags($_POST['AuthDate']) : ''; //입금일시 (yyMMddHHmmss) 12 자리
$ResultCode = isset($_POST['ResultCode']) ? clean_xss_tags($_POST['ResultCode']) : ''; //결과코드 ('4110' 경우 입금통보) $ResultCode = isset($_POST['ResultCode']) ? clean_xss_tags($_POST['ResultCode']) : ''; //결과코드 ('4110' 경우 입금통보)
$ResultMsg = isset($_POST['ResultMsg']) ? clean_xss_tags($_POST['ResultMsg']) : ''; //결과메시지 $ResultMsg = isset($_POST['ResultMsg']) ? clean_xss_tags($_POST['ResultMsg']) : ''; //결과메시지
$VbankNum = isset($_POST['VbankNum']) ? clean_xss_tags($_POST['VbankNum']) : ''; //가상계좌번호 $VbankNum = isset($_POST['VbankNum']) ? addslashes(clean_xss_tags(stripslashes($_POST['VbankNum']))) : ''; //가상계좌번호
$FnCd = isset($_POST['FnCd']) ? clean_xss_tags($_POST['FnCd']) : ''; //가상계좌 은행코드 $FnCd = isset($_POST['FnCd']) ? clean_xss_tags($_POST['FnCd']) : ''; //가상계좌 은행코드
$VbankName = isset($_POST['VbankName']) ? clean_xss_tags($_POST['VbankName']) : ''; //가상계좌 은행명 $VbankName = isset($_POST['VbankName']) ? clean_xss_tags($_POST['VbankName']) : ''; //가상계좌 은행명
$VbankInputName = isset($_POST['VbankInputName']) ? clean_xss_tags($_POST['VbankInputName']) : ''; //입금자 명 $VbankInputName = isset($_POST['VbankInputName']) ? clean_xss_tags($_POST['VbankInputName']) : ''; //입금자 명