5.0.13 버전 패치 적용

adm/board_form.php

@@ -708,7 +708,7 @@ $frm_submit .= '</div>';
         <tr>
             <th scope="row"><label for="bo_comment_min">최소 댓글수 제한</label></th>
             <td>
-                <?php echo help('댓글 입력시 최소 글자수, 최대 글자수를 설정. 0을 입력하면 검사하지 않음') ?>
+                <?php echo help('댓글 입력시 최소 글자수를 설정. 0을 입력하면 검사하지 않음') ?>
                 <input type="text" name="bo_comment_min" value="<?php echo $board['bo_comment_min'] ?>" id="bo_comment_min" class="numeric frm_input" size="4">
             </td>
             <td class="td_grpset">
@@ -721,7 +721,7 @@ $frm_submit .= '</div>';
         <tr>
             <th scope="row"><label for="bo_comment_max">최대 댓글수 제한</label></th>
             <td>
-                <?php echo help('댓글 입력시 최소 글자수, 최대 글자수를 설정. 0을 입력하면 검사하지 않음') ?>
+                <?php echo help('댓글 입력시 최대 글자수를 설정. 0을 입력하면 검사하지 않음') ?>
                 <input type="text" name="bo_comment_max" value="<?php echo $board['bo_comment_max'] ?>" id="bo_comment_max" class="numeric frm_input" size="4">
             </td>
             <td class="td_grpset">

adm/config_form.php

@@ -213,14 +213,7 @@ if (!$config['cf_icode_server_ip'])   $config['cf_icode_server_ip'] = '211.172.2
 if (!$config['cf_icode_server_port']) $config['cf_icode_server_port'] = '7295';
 
 if ($config['cf_icode_id'] && $config['cf_icode_pw']) {
-    $res = get_sock('http://www.icodekorea.com/res/userinfo.php?userid='.$config['cf_icode_id'].'&userpw='.$config['cf_icode_pw']);
-    $res = explode(';', $res);
-    $userinfo = array(
-        'code'      => $res[0], // 결과코드
-        'coin'      => $res[1], // 고객 잔액 (충전제만 해당)
-        'gpay'      => $res[2], // 고객의 건수 별 차감액 표시 (충전제만 해당)
-        'payment'   => $res[3]  // 요금제 표시, A:충전제, C:정액제
-    );
+    $userinfo = get_icode_userinfo($config['cf_icode_id'], $config['cf_icode_pw']);
 }
 ?>
 

adm/index.php

@@ -176,7 +176,7 @@ $colspan = 5;
                 $comment_link = "";
                 $row2 = sql_fetch(" select * from $tmp_write_table where wr_id = '{$row['wr_id']}' ");
 
-                $name = get_sideview($row2['mb_id'], cut_str($row2['wr_name'], $config['cf_cut_name']), $row2['wr_email'], $row2['wr_homepage']);
+                $name = get_sideview($row2['mb_id'], get_text(cut_str($row2['wr_name'], $config['cf_cut_name'])), $row2['wr_email'], $row2['wr_homepage']);
                 // 당일인 경우 시간으로 표시함
                 $datetime = substr($row2['wr_datetime'],0,10);
                 $datetime2 = $row2['wr_datetime'];
@@ -193,7 +193,7 @@ $colspan = 5;
                 $row2 = sql_fetch(" select * from {$tmp_write_table} where wr_id = '{$row['wr_parent']}' ");
                 $row3 = sql_fetch(" select mb_id, wr_name, wr_email, wr_homepage, wr_datetime from {$tmp_write_table} where wr_id = '{$row['wr_id']}' ");
 
-                $name = get_sideview($row3['mb_id'], cut_str($row3['wr_name'], $config['cf_cut_name']), $row3['wr_email'], $row3['wr_homepage']);
+                $name = get_sideview($row3['mb_id'], get_text(cut_str($row3['wr_name'], $config['cf_cut_name'])), $row3['wr_email'], $row3['wr_homepage']);
                 // 당일인 경우 시간으로 표시함
                 $datetime = substr($row3['wr_datetime'],0,10);
                 $datetime2 = $row3['wr_datetime'];

adm/sms_admin/config.php

@@ -11,14 +11,7 @@ if (!$config['cf_icode_server_port']) $config['cf_icode_server_port'] = '7295';
 
 if ($config['cf_icode_id'] && $config['cf_icode_pw'])
 {
-    $res = get_sock('http://www.icodekorea.com/res/userinfo.php?userid='.$config['cf_icode_id'].'&userpw='.$config['cf_icode_pw']);
-    $res = explode(';', $res);
-    $userinfo = array(
-        'code'      => $res[0], // 결과코드
-        'coin'      => $res[1], // 고객 잔액 (충전제만 해당)
-        'gpay'      => $res[2], // 고객의 건수 별 차감액 표시 (충전제만 해당)
-        'payment'   => $res[3]  // 요금제 표시, A:충전제, C:정액제
-    );
+    $userinfo = get_icode_userinfo($config['cf_icode_id'], $config['cf_icode_pw']);
 }
 
 if (!$config['cf_icode_id'])

adm/sms_admin/config_update.php

@@ -8,14 +8,7 @@ check_demo();
 
 $g5['title'] = "SMS 기본설정";
 
-$res = get_sock("http://www.icodekorea.com/res/userinfo.php?userid=$cf_icode_id&userpw=$cf_icode_pw");
-$res = explode(';', $res);
-$userinfo = array(
-    'code'      => $res[0], // 결과코드
-    'coin'      => $res[1], // 고객 잔액 (충전제만 해당)
-    'gpay'      => $res[2], // 고객의 건수 별 차감액 표시 (충전제만 해당)
-    'payment'   => $res[3]  // 요금제 표시, A:충전제, C:정액제
-);
+$userinfo = get_icode_userinfo($cf_icode_id, $cf_icode_pw);
 
 if ($userinfo['code'] == '202')
     alert('아이코드 아이디와 패스워드가 맞지 않습니다.');

adm/sms_admin/member_update.php

@@ -45,8 +45,13 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
             dataType:"json",
             data:params,
             success: function(data) {
-                $("#datetime").html( data.datetime );
-                $("#res_msg").html( data.res_msg );
+                if(data.error){
+                    alert( data.error );
+                    $("#res_msg").html("");
+                } else {
+                    $("#datetime").html( data.datetime );
+                    $("#res_msg").html( data.res_msg );
+                }
             },
             error: function (xhr, ajaxOptions, thrownError) {
                 alert(xhr.status);

adm/sms_admin/member_update_run.php

@@ -3,6 +3,14 @@ $sub_menu = "900200";
 include_once("./_common.php");
 @include_once(G5_PLUGIN_PATH."/sms5/JSON.php");
 
+if(empty($config['cf_sms_use'])){
+    if( $mtype == "json" ){
+        die("{\"error\":\"환경 설정의 SMS 사용에서 아이코드를 사용설정해 주셔야 실행할수 있습니다.\"}");
+    } else {
+        die("환경 설정의 SMS 사용에서 아이코드를 사용설정해 주셔야 실행할수 있습니다.");
+    }
+}
+
 if( !function_exists('json_encode') ) {
     function json_encode($data) {
         $json = new Services_JSON();

bbs/board.php

@@ -236,7 +236,7 @@ if ($member['mb_level'] >= $board['bo_list_level'] && $board['bo_use_list_view']
 
 include_once('./board_tail.php');
 
-echo "\n<!-- 사용스킨 : {$board_skin_url} -->\n";
+echo "\n<!-- 사용스킨 : ".(G5_IS_MOBEILE ? $board['bo_mobile_skin'] : $board['bo_skin'])." -->\n";
 
 include_once(G5_PATH.'/tail.sub.php');
 ?>

bbs/faq.php

@@ -27,15 +27,6 @@ if (!$fm['fm_id'])
 
 $g5['title'] = $fm['fm_subject'];
 
-if(G5_IS_MOBILE){
-    $faq_skin = $config['cf_mobile_faq_skin'];
-} else {
-    $faq_skin = $config['cf_faq_skin'];
-}
-
-if(!$faq_skin) $faq_skin = 'basic';
-$faq_skin_path = (G5_IS_MOBILE ? G5_MOBILE_PATH : G5_PATH).'/'.G5_SKIN_DIR.'/faq/'.$faq_skin;
-$faq_skin_url = (G5_IS_MOBILE ? G5_MOBILE_URL : G5_URL).'/'.G5_SKIN_DIR.'/faq/'.$faq_skin;
 $skin_file = $faq_skin_path.'/list.skin.php';
 
 include_once('./_head.php');

bbs/poll_update.php

@@ -8,6 +8,7 @@ if (!$po['po_id'])
 if ($member['mb_level'] < $po['po_level'])
     alert_close('권한 '.$po['po_level'].' 이상 회원만 투표에 참여하실 수 있습니다.');
 
+$gb_poll = preg_replace('/[^0-9]/', '', $gb_poll);
 if(!$gb_poll)
     alert_close('항목을 선택하세요.');
 

bbs/qatail.php

@@ -8,7 +8,7 @@ if (G5_IS_MOBILE) {
 } else {
     echo stripslashes($qaconfig['qa_mobile_content_tail']);
     if($qaconfig['qa_include_tail'])
-        @include ($qaconfig['bo_include_tail']);
+        @include ($qaconfig['qa_include_tail']);
     else
         include ('./_tail.php');
 }

bbs/qawrite_update.php

@@ -28,6 +28,7 @@ if(isset($_POST['qa_email']) && $qa_email) {
 $qa_subject = '';
 if (isset($_POST['qa_subject'])) {
     $qa_subject = substr(trim($_POST['qa_subject']),0,255);
+    $qa_subject = preg_replace("#[\\\]+$#", "", $qa_subject);
 }
 if ($qa_subject == '') {
     $msg[] = '<strong>제목</strong>을 입력하세요.';
@@ -36,6 +37,7 @@ if ($qa_subject == '') {
 $qa_content = '';
 if (isset($_POST['qa_content'])) {
     $qa_content = substr(trim($_POST['qa_content']),0,65536);
+    $qa_content = preg_replace("#[\\\]+$#", "", $qa_content);
 }
 if ($qa_content == '') {
     $msg[] = '<strong>내용</strong>을 입력하세요.';
@@ -132,7 +134,7 @@ for ($i=1; $i<=count($_FILES['bf_file']['name']); $i++) {
     $tmp_file  = $_FILES['bf_file']['tmp_name'][$i];
     $filesize  = $_FILES['bf_file']['size'][$i];
     $filename  = $_FILES['bf_file']['name'][$i];
-    $filename  = preg_replace('/(<|>|=)/', '', $filename);
+    $filename  = get_safe_filename($filename);
 
     // 서버에 설정된 값보다 큰파일을 업로드 한다면
     if ($filename) {

bbs/register_form_update.php

@@ -56,6 +56,8 @@ $mb_10          = isset($_POST['mb_10'])            ? trim($_POST['mb_10'])
 if ($w == '' || $w == 'u') {
 
     if ($msg = empty_mb_id($mb_id))         alert($msg, "", true, true); // alert($msg, $url, $error, $post);
+    if ($msg = valid_mb_id($mb_id))         alert($msg, "", true, true);
+    if ($msg = count_mb_id($mb_id))         alert($msg, "", true, true);
 
     if ($w == '' && !$mb_password)
         alert('비밀번호가 넘어오지 않았습니다.');

bbs/search.php

@@ -172,7 +172,6 @@ if ($stx) {
 
             if ($row['wr_is_comment'])
             {
-                $link .= '#c'.$row['wr_id'];
                 $sql2 = " select wr_subject, wr_option from {$tmp_write_table} where wr_id = '{$row['wr_parent']}' ";
                 $row2 = sql_fetch($sql2);
                 //$row['wr_subject'] = $row2['wr_subject'];
@@ -204,7 +203,7 @@ if ($stx) {
 
             $list[$idx][$i]['subject'] = $subject;
             $list[$idx][$i]['content'] = $content;
-            $list[$idx][$i]['name'] = get_sideview($row['mb_id'], cut_str($row['wr_name'], $config['cf_cut_name']), $row['wr_email'], $row['wr_homepage']);
+            $list[$idx][$i]['name'] = get_sideview($row['mb_id'], get_text(cut_str($row['wr_name'], $config['cf_cut_name'])), $row['wr_email'], $row['wr_homepage']);
 
             $k++;
             if ($k >= $rows)

bbs/write.php

@@ -319,7 +319,7 @@ if ($w == '') {
     }
 
     $name = get_text(cut_str($write['wr_name'],20));
-    $email = $write['wr_email'];
+    $email = get_email_address($write['wr_email']);
     $homepage = get_text($write['wr_homepage']);
 
     for ($i=1; $i<=G5_LINK_COUNT; $i++) {
@@ -408,7 +408,7 @@ include_once('./board_head.php');
 
 $action_url = https_url(G5_BBS_DIR)."/write_update.php";
 
-echo '<!-- skin : '.$board_skin_path.' -->';
+echo '<!-- skin : '.(G5_IS_MOBEILE ? $board['bo_mobile_skin'] : $board['bo_skin']).' -->';
 include_once ($board_skin_path.'/write.skin.php');
 
 include_once('./board_tail.php');

bbs/write_update.php

@@ -19,6 +19,7 @@ if ($wr_subject == '') {
 $wr_content = '';
 if (isset($_POST['wr_content'])) {
     $wr_content = substr(trim($_POST['wr_content']),0,65536);
+    $wr_content = preg_replace("#[\\\]+$#", "", $wr_content);
 }
 if ($wr_content == '') {
     $msg[] = '<strong>내용</strong>을 입력하세요.';
@@ -211,7 +212,7 @@ for ($i=0; $i<count($_FILES['bf_file']['name']); $i++) {
     $tmp_file  = $_FILES['bf_file']['tmp_name'][$i];
     $filesize  = $_FILES['bf_file']['size'][$i];
     $filename  = $_FILES['bf_file']['name'][$i];
-    $filename  = preg_replace('/(<|>|=)/', '', $filename);
+    $filename  = get_safe_filename($filename);
 
     // 서버에 설정된 값보다 큰파일을 업로드 한다면
     if ($filename) {
@@ -297,6 +298,7 @@ if ($w == '' || $w == 'r') {
         if (!$wr_name)
             alert('이름은 필히 입력하셔야 합니다.');
         $wr_password = sql_password($wr_password);
+        $wr_email = get_email_address(trim($_POST['wr_email']));
     }
 
     if ($w == 'r') {
@@ -361,7 +363,7 @@ if ($w == '' || $w == 'r') {
     // 쓰기 포인트 부여
     if ($w == '') {
         if ($notice) {
-            $bo_notice = $wr_id.",".$board['bo_notice'];
+            $bo_notice = $wr_id.($board['bo_notice'] ? ",".$board['bo_notice'] : '');
             sql_query(" update {$g5['board_table']} set bo_notice = '{$bo_notice}' where bo_table = '{$bo_table}' ");
         }
 
@@ -417,6 +419,7 @@ if ($w == '' || $w == 'r') {
         $mb_id = "";
         // 비회원의 경우 이름이 누락되는 경우가 있음
         //if (!trim($wr_name)) alert("이름은 필히 입력하셔야 합니다.");
+        $wr_email = get_email_address(trim($_POST['wr_email']));
     }
 
     $sql_password = $wr_password ? " , wr_password = '".sql_password($wr_password)."' " : "";

common.php

@@ -20,8 +20,9 @@ $ext_arr = array ('PHP_SELF', '_ENV', '_GET', '_POST', '_FILES', '_SERVER', '_CO
                   'HTTP_COOKIE_VARS', 'HTTP_SESSION_VARS', 'GLOBALS');
 $ext_cnt = count($ext_arr);
 for ($i=0; $i<$ext_cnt; $i++) {
-    // GET 으로 선언된 전역변수가 있다면 unset() 시킴
-    if (isset($_GET[$ext_arr[$i]])) unset($_GET[$ext_arr[$i]]);
+    // POST, GET 으로 선언된 전역변수가 있다면 unset() 시킴
+    if (isset($_GET[$ext_arr[$i]]))  unset($_GET[$ext_arr[$i]]);
+    if (isset($_POST[$ext_arr[$i]])) unset($_POST[$ext_arr[$i]]);
 }
 //==========================================================================================================================
 
@@ -35,7 +36,10 @@ function g5_path()
     $port = $_SERVER['SERVER_PORT'] != 80 ? ':'.$_SERVER['SERVER_PORT'] : '';
     $http = 'http' . ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ? 's' : '') . '://';
     $user = str_replace(str_replace($document_root, '', $_SERVER['SCRIPT_FILENAME']), '', $_SERVER['SCRIPT_NAME']);
-    $result['url'] = $http.$_SERVER['SERVER_NAME'].$port.$user.$root;
+    $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME'];
+    if(isset($_SERVER['HTTP_HOST']) && preg_match('/:[0-9]+$/', $host))
+        $host = preg_replace('/:[0-9]+$/', '', $host);
+    $result['url'] = $http.$host.$port.$user.$root;
     return $result;
 }
 
@@ -248,7 +252,7 @@ if (isset($_REQUEST['PHPSESSID']) && $_REQUEST['PHPSESSID'] != session_id())
 $qstr = '';
 
 if (isset($_REQUEST['sca']))  {
-    $sca = trim($_REQUEST['sca']);
+    $sca = clean_xss_tags(trim($_REQUEST['sca']));
     if ($sca)
         $qstr .= '&amp;sca=' . urlencode($sca);
 } else {
@@ -327,7 +331,7 @@ if (isset($_REQUEST['wr_id'])) {
 }
 
 if (isset($_REQUEST['bo_table'])) {
-    $bo_table = trim($_REQUEST['bo_table']);
+    $bo_table = preg_replace('/[^a-z0-9_]/i', '', trim($_REQUEST['bo_table']));
     $bo_table = substr($bo_table, 0, 20);
 } else {
     $bo_table = '';
@@ -335,7 +339,7 @@ if (isset($_REQUEST['bo_table'])) {
 
 // URL ENCODING
 if (isset($_REQUEST['url'])) {
-    $url = trim($_REQUEST['url']);
+    $url = strip_tags(trim($_REQUEST['url']));
     $urlencode = urlencode($url);
 } else {
     $url = '';
@@ -348,7 +352,7 @@ if (isset($_REQUEST['url'])) {
 
 if (isset($_REQUEST['gr_id'])) {
     if (!is_array($_REQUEST['gr_id'])) {
-        $gr_id = trim($_REQUEST['gr_id']);
+        $gr_id = preg_replace('/[^a-z0-9_]/i', '', trim($_REQUEST['gr_id']));
     }
 } else {
     $gr_id = '';
@@ -378,7 +382,7 @@ if ($_SESSION['ss_mb_id']) { // 로그인중이라면
 
         $tmp_mb_id = substr(preg_replace("/[^a-zA-Z0-9_]*/", "", $tmp_mb_id), 0, 20);
         // 최고관리자는 자동로그인 금지
-        if ($tmp_mb_id != $config['cf_admin']) {
+        if (strtolower($tmp_mb_id) != strtolower($config['cf_admin'])) {
             $sql = " select mb_password, mb_intercept_date, mb_leave_date, mb_email_certify from {$g5['member_table']} where mb_id = '{$tmp_mb_id}' ";
             $row = sql_fetch($sql);
             $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $row['mb_password']);
@@ -449,9 +453,9 @@ if ($is_admin != 'super') {
             if (empty($pattern[$i]))
                 continue;
 
-            //$pat = "/({$pattern[$i]})/";
             $pattern[$i] = str_replace(".", "\.", $pattern[$i]);
-            $pat = "/^{$pattern[$i]}/";
+            $pattern[$i] = str_replace("+", "[0-9\.]+", $pattern[$i]);
+            $pat = "/^{$pattern[$i]}$/";
             $is_possible_ip = preg_match($pat, $_SERVER['REMOTE_ADDR']);
             if ($is_possible_ip)
                 break;
@@ -469,7 +473,8 @@ if ($is_admin != 'super') {
             continue;
 
         $pattern[$i] = str_replace(".", "\.", $pattern[$i]);
-        $pat = "/^{$pattern[$i]}/";
+        $pattern[$i] = str_replace("+", "[0-9\.]+", $pattern[$i]);
+        $pat = "/^{$pattern[$i]}$/";
         $is_intercept_ip = preg_match($pat, $_SERVER['REMOTE_ADDR']);
         if ($is_intercept_ip)
             die ("접근 불가합니다.");
@@ -491,6 +496,8 @@ if (G5_IS_MOBILE) {
     $search_skin_url    = G5_MOBILE_URL .'/'.G5_SKIN_DIR.'/search/'.$config['cf_mobile_search_skin'];
     $connect_skin_path  = G5_MOBILE_PATH.'/'.G5_SKIN_DIR.'/connect/'.$config['cf_mobile_connect_skin'];
     $connect_skin_url   = G5_MOBILE_URL .'/'.G5_SKIN_DIR.'/connect/'.$config['cf_mobile_connect_skin'];
+    $faq_skin_path      = G5_MOBILE_PATH .'/'.G5_SKIN_DIR.'/faq/'.$config['cf_mobile_faq_skin'];
+    $faq_skin_url       = G5_MOBILE_URL .'/'.G5_SKIN_DIR.'/faq/'.$config['cf_mobile_faq_skin'];
 } else {
     $board_skin_path    = G5_SKIN_PATH.'/board/'.$board['bo_skin'];
     $board_skin_url     = G5_SKIN_URL .'/board/'.$board['bo_skin'];
@@ -502,6 +509,8 @@ if (G5_IS_MOBILE) {
     $search_skin_url    = G5_SKIN_URL .'/search/'.$config['cf_search_skin'];
     $connect_skin_path  = G5_SKIN_PATH.'/connect/'.$config['cf_connect_skin'];
     $connect_skin_url   = G5_SKIN_URL .'/connect/'.$config['cf_connect_skin'];
+    $faq_skin_path      = G5_SKIN_PATH.'/faq/'.$config['cf_faq_skin'];
+    $faq_skin_url       = G5_SKIN_URL.'/faq/'.$config['cf_faq_skin'];
 }
 //==============================================================================
 

extend/sms5.extend.php

@@ -24,7 +24,7 @@ $g5['sms5_form_table']            = $g5['sms5_prefix'] . 'form';
 $g5['sms5_form_group_table']      = $g5['sms5_prefix'] . 'form_group';
 $g5['sms5_member_history_table']  = $g5['sms5_prefix'] . 'member_history';
 
-if ($config['cf_sms_use'] == 'icode') {
+if (!empty($config['cf_sms_use'])) {
 
     $sms5 = sql_fetch("select * from {$g5['sms5_config_table']} ", false);
     if( $sms5['cf_member'] && trim($member['mb_hp']) ) {

js/wrest.js

@@ -208,7 +208,7 @@ function wrestMinLength(fld, css)
 {
     if (!wrestTrim(fld)) return;
 
-    var str = css.split('_'); // minlength_?? <-- str[1]
+    var str = css.split('='); // minlength=?? <-- str[1]
 
     if (wrestFld == null) {
         if (fld.value.length < parseInt(str[1])) {
@@ -305,8 +305,8 @@ function wrestSubmit()
                     case "telnum"       : wrestTelNum(el); break; // 김선용 2006.3 - 전화번호 형식 검사
                     case "imgext"       : wrestImgExt(el); break;
                     default :
-                        // css 가 minlength_ 로 시작한다면 _ 뒤의 숫자는 최소길이값
-                        if (/^minlength\_/.test(css)) {
+                        // css 가 minlength= 로 시작한다면 = 뒤의 숫자는 최소길이값
+                        if (/^minlength\=/.test(css)) {
                             wrestMinLength(el, css); break;
                         } else if (/^extension\=/.test(css)) {
                             wrestExtension(el, css); break;

lib/common.lib.php

@@ -2653,6 +2653,14 @@ function get_search_string($stx)
     return $stx;
 }
 
+// XSS 관련 태그 제거
+function clean_xss_tags($str)
+{
+    $str = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $str);
+
+    return $str;
+}
+
 // unescape nl 얻기
 function conv_unescape_nl($str)
 {
@@ -2688,4 +2696,28 @@ function get_email_address($email)
 
     return $matches[0];
 }
+
+// 파일명에서 특수문자 제거
+function get_safe_filename($name)
+{
+    $pattern = '/["\'<>=#&!%\\\\(\)\*\+\?]/';
+    $name = preg_replace($pattern, '', $name);
+
+    return $name;
+}
+
+// 아이코드 사용자정보
+function get_icode_userinfo($id, $pass)
+{
+    $res = get_sock('http://www.icodekorea.com/res/userinfo.php?userid='.$id.'&userpw='.$pass);
+    $res = explode(';', $res);
+    $userinfo = array(
+        'code'      => $res[0], // 결과코드
+        'coin'      => $res[1], // 고객 잔액 (충전제만 해당)
+        'gpay'      => $res[2], // 고객의 건수 별 차감액 표시 (충전제만 해당)
+        'payment'   => $res[3]  // 요금제 표시, A:충전제, C:정액제
+    );
+
+    return $userinfo;
+}
 ?>

mobile/skin/board/basic/list.skin.php

@@ -2,11 +2,9 @@
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
 
 // 선택옵션으로 인해 셀합치기가 가변적으로 변함
-$colspan = 5;
+$colspan = 2;
 
 if ($is_checkbox) $colspan++;
-if ($is_good) $colspan++;
-if ($is_nogood) $colspan++;
 
 // add_stylesheet('css 구문', 출력순서); 숫자가 작을 수록 먼저 출력됨
 add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0);

mobile/skin/board/basic/view_comment.skin.php

@@ -23,7 +23,7 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
     ?>
     <article id="c_<?php echo $comment_id ?>" <?php if ($cmt_depth) { ?>style="margin-left:<?php echo $cmt_depth ?>px;border-top-color:#e0e0e0"<?php } ?>>
         <header>
-            <h1><?php echo $list[$i]['wr_name'] ?>님의 댓글</h1>
+            <h1><?php echo get_text($list[$i]['wr_name']); ?>님의 댓글</h1>
             <?php echo $list[$i]['name'] ?>
             <?php if ($cmt_depth) { ?><img src="<?php echo $board_skin_url ?>/img/icon_reply.gif" alt="댓글의 댓글" class="icon_reply"><?php } ?>
             <?php if ($is_ip_view) { ?>

mobile/skin/board/gallery/view_comment.skin.php

@@ -23,7 +23,7 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
     ?>
     <article id="c_<?php echo $comment_id ?>" <?php if ($cmt_depth) { ?>style="margin-left:<?php echo $cmt_depth ?>px;border-top-color:#e0e0e0"<?php } ?>>
         <header>
-            <h1><?php echo $list[$i]['wr_name'] ?>님의 댓글</h1>
+            <h1><?php echo get_text($list[$i]['wr_name']); ?>님의 댓글</h1>
             <?php echo $list[$i]['name'] ?>
             <?php if ($cmt_depth) { ?><img src="<?php echo $board_skin_url ?>/img/icon_reply.gif" alt="댓글의 댓글" class="icon_reply"><?php } ?>
             <?php if ($is_ip_view) { ?>

mobile/skin/member/basic/register_form.skin.php

@@ -31,17 +31,17 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
             <th scope="row"><label for="reg_mb_id">아이디<strong class="sound_only">필수</strong></label></th>
             <td>
                 <span class="frm_info">영문자, 숫자, _ 만 입력 가능. 최소 3자이상 입력하세요.</span>
-                <input type="text" name="mb_id" value="<?php echo $member['mb_id'] ?>" id="reg_mb_id" class="frm_input minlength_3 <?php echo $required ?> <?php echo $readonly ?>" maxlength="20" <?php echo $required ?> <?php echo $readonly ?>>
+                <input type="text" name="mb_id" value="<?php echo $member['mb_id'] ?>" id="reg_mb_id" class="frm_input minlength=3 <?php echo $required ?> <?php echo $readonly ?>" maxlength="20" <?php echo $required ?> <?php echo $readonly ?>>
                 <span id="msg_mb_id"></span>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="reg_mb_password">비밀번호<strong class="sound_only">필수</strong></label></th>
-            <td><input type="password" name="mb_password" id="reg_mb_password" class="frm_input minlength_3 <?php echo $required ?>" maxlength="20" <?php echo $required ?>></td>
+            <td><input type="password" name="mb_password" id="reg_mb_password" class="frm_input minlength=3 <?php echo $required ?>" maxlength="20" <?php echo $required ?>></td>
         </tr>
         <tr>
             <th scope="row"><label for="reg_mb_password_re">비밀번호 확인<strong class="sound_only">필수</strong></label></th>
-            <td><input type="password" name="mb_password_re" id="reg_mb_password_re" class="frm_input minlength_3 <?php echo $required ?>" maxlength="20" <?php echo $required ?>></td>
+            <td><input type="password" name="mb_password_re" id="reg_mb_password_re" class="frm_input minlength=3 <?php echo $required ?>" maxlength="20" <?php echo $required ?>></td>
         </tr>
         </table>
     </div>
@@ -52,10 +52,10 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
         <tr>
             <th scope="row"><label for="reg_mb_name">이름<strong class="sound_only">필수</strong></label></th>
             <td>
-                <?php if ($w=="u" && $config['cf_cert_use']) { ?>
+                <?php if ($config['cf_cert_use']) { ?>
                 <span class="frm_info">아이핀 본인확인 후에는 이름이 자동 입력되고 휴대폰 본인확인 후에는 이름과 휴대폰번호가 자동 입력되어 수동으로 입력할수 없게 됩니다.</span>
                 <?php } ?>
-                <input type="text" id="reg_mb_name" name="mb_name" value="<?php echo $member['mb_name'] ?>" <?php echo $required ?> <?php if ($w=='u') echo 'readonly'; ?> class="frm_input nospace <?php echo $required ?> <?php echo $readonly ?>">
+                <input type="text" id="reg_mb_name" name="mb_name" value="<?php echo $member['mb_name'] ?>" <?php echo $required ?> <?php echo $readonly; ?> class="frm_input <?php echo $required ?> <?php echo $readonly ?>">
                 <?php
                 if($config['cf_cert_use']) {
                     if($config['cf_cert_ipin'])

mobile/skin/search/basic/search.skin.php

@@ -106,8 +106,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',
     <?php
     $k=0;
     for ($idx=$table_index, $k=0; $idx<count($search_table) && $k<$rows; $idx++) {
-        $comment_def = "";
-        $comment_href = "";
      ?>
         <h2><a href="./board.php?bo_table=<?php echo $search_table[$idx] ?>&amp;<?php echo $search_query ?>"><?php echo $bo_subject[$idx] ?> 게시판 내 결과</a></h2>
         <ul>
@@ -115,8 +113,13 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',
         for ($i=0; $i<count($list[$idx]) && $k<$rows; $i++, $k++) {
             if ($list[$idx][$i]['wr_is_comment'])
             {
-                $comment_def = "<span class=\"cmt_def\">댓글</span>";
-                $comment_href = "#c_".$list[$idx][$i]['wr_id'];
+                $comment_def = '<span class="cmt_def">댓글</span>';
+                $comment_href = '#c_'.$list[$idx][$i]['wr_id'];
+            }
+            else
+            {
+                $comment_def = '';
+                $comment_href = '';
             }
          ?>
             <li>

plugin/editor/smarteditor2/editor.lib.php

@@ -38,7 +38,7 @@ function editor_html($id, $content, $is_dhtml_editor=true)
     }
 
     $smarteditor_class = $is_dhtml_editor ? "smarteditor2" : "";
-    $html .= "\n<textarea id=\"$id\" name=\"$id\" class=\"$smarteditor_class\" maxlength=\"65536\">$content</textarea>";
+    $html .= "\n<textarea id=\"$id\" name=\"$id\" class=\"$smarteditor_class\" maxlength=\"65536\" style=\"width:100%\">$content</textarea>";
     $html .= "\n<span class=\"sound_only\">웹 에디터 끝</span>";
     return $html;
 }
@@ -48,7 +48,7 @@ function editor_html($id, $content, $is_dhtml_editor=true)
 function get_editor_js($id, $is_dhtml_editor=true)
 {
     if ($is_dhtml_editor) {
-        return "var {$id}_editor_data = oEditors.getById['{$id}'].getIR();\noEditors.getById['{$id}'].exec('UPDATE_CONTENTS_FIELD', []);\n";
+        return "var {$id}_editor_data = oEditors.getById['{$id}'].getIR();\noEditors.getById['{$id}'].exec('UPDATE_CONTENTS_FIELD', []);\nif(jQuery.inArray(document.getElementById('{$id}').value.toLowerCase().replace(/^\s*|\s*$/g, ''), ['&nbsp;','<p>&nbsp;</p>','<p><br></p>','<div><br></div>','<p></p>','<br>','']) != -1){document.getElementById('{$id}').value='';}\n";
     } else {
         return "var {$id}_editor = document.getElementById('{$id}');\n";
     }
@@ -59,7 +59,7 @@ function get_editor_js($id, $is_dhtml_editor=true)
 function chk_editor_js($id, $is_dhtml_editor=true)
 {
     if ($is_dhtml_editor) {
-        return "if (!{$id}_editor_data || {$id}_editor_data == '&nbsp;' || {$id}_editor_data == '<p>&nbsp;</p>' || {$id}_editor_data == '<p><br></p>' || {$id}_editor_data == '<p></p>') { alert(\"내용을 입력해 주십시오.\"); oEditors.getById['{$id}'].exec('FOCUS'); return false; }\n";
+        return "if (!{$id}_editor_data || jQuery.inArray({$id}_editor_data.toLowerCase(), ['&nbsp;','<p>&nbsp;</p>','<p><br></p>','<p></p>','<br>']) != -1) { alert(\"내용을 입력해 주십시오.\"); oEditors.getById['{$id}'].exec('FOCUS'); return false; }\n";
     } else {
         return "if (!{$id}_editor.value) { alert(\"내용을 입력해 주십시오.\"); {$id}_editor.focus(); return false; }\n";
     }

plugin/editor/smarteditor2/js/smarteditor2.js

@@ -6851,8 +6851,10 @@ nhn.husky.SE_EditingArea_WYSIWYG = jindo.$Class({
 		// --[SMARTEDITORSUS-875]
 		
 		var sContent, 
-			oNavigator = this.oApp.oNavigator, 
-			bUnderIE11 = oNavigator.ie && document.documentMode < 11, // IE11미만
+			oNavigator = this.oApp.oNavigator,
+            tmp_htBrowser = jindo.$Agent().navigator(),
+			//bUnderIE11 = oNavigator.ie && document.documentMode < 11, // IE11미만
+            bUnderIE11 = oNavigator.ie && tmp_htBrowser.nativeVersion < 11, // IE11미만
 			sCursorHolder = bUnderIE11 ? "" : "<br>";
 
 		if(this.oApp.applyConverter){

plugin/editor/smarteditor2/photo_uploader/plugin/hp_SE2M_AttachQuickPhoto.js

@@ -32,7 +32,8 @@ nhn.husky.SE2M_AttachQuickPhoto = jindo.$Class({
 	 */
 	$ON_ATTACHPHOTO_OPEN_WINDOW : function(){			
 		this.htPopupOption.sUrl = this.makePopupURL();
-		this.htPopupOption.sProperties = "left=0,top=0,width=640,height=459,scrollbars=yes,location=no,status=0,resizable=no";
+		//this.htPopupOption.sProperties = "left=0,top=0,width=640,height=459,scrollbars=yes,location=no,status=0,resizable=no";
+        this.htPopupOption.sProperties = "left="+(screen.width-640)/2+", top="+(screen.height-459)/2+",width=640,height=459,scrollbars=yes,location=no,status=0,resizable=no";
 
 		this.oPopupWindow = this.oPopupMgr.openWindow(this.htPopupOption);
 		

plugin/editor/smarteditor2/photo_uploader/popup/js/basic.js

@@ -152,7 +152,7 @@ jQuery(function ($) {
         _done : function(e, data){
             var othis = this;
             $.each(data.result.files, function (index, file) {
-                if (file.url) {
+                if (file.url && !file.error) {
                     var ret = othis.get_ratio( file.width, file.height ),
                         node = $(data.context.children()[index]),
                         size_text = file.width+" x "+file.height,

plugin/editor/smarteditor2/photo_uploader/popup/php/UploadHandler.php

@@ -1086,6 +1086,9 @@ class UploadHandler
                     $image_width_height = $this->get_image_size($file_path);
                     $file->width = $image_width_height[0];
                     $file->height = $image_width_height[1];
+                } else {    //로빈아빠님이 알려주심, 이미지 업로드 체크
+                    unlink($file_path);
+                    $file->error = $this->get_error_message('accept_file_types');
                 }
             } else {
                 $file->size = $file_size;

plugin/jquery-ui/datepicker.php

@@ -1,14 +1,10 @@
 <?php
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
+
+add_stylesheet('<link type="text/css" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.4/themes/base/jquery-ui.css" rel="stylesheet" />', 0);
+add_stylesheet('<link type="text/css" href="'.G5_PLUGIN_URL.'/jquery-ui/style.css">', 0);
 ?>
 
-<link type="text/css" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.4/themes/base/jquery-ui.css" rel="stylesheet" />
-<style>
-.ui-datepicker { font:12px dotum; }
-.ui-datepicker select.ui-datepicker-month,
-.ui-datepicker select.ui-datepicker-year { width: 70px;}
-.ui-datepicker-trigger { margin:0 0 -5px 2px; }
-</style>
 <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.4/jquery-ui.min.js"></script>
 <script>
 jQuery(function($){

plugin/jquery-ui/style.css

@@ -0,0 +1,6 @@
+@charset "utf-8";
+
+.ui-datepicker { font:12px dotum; }
+.ui-datepicker select.ui-datepicker-month,
+.ui-datepicker select.ui-datepicker-year { width: 70px;}
+.ui-datepicker-trigger { margin:0 0 -5px 2px; }

plugin/sms5/write.php

@@ -68,5 +68,5 @@ if( G5_IS_MOBILE ){
     $write_skin_page = "/write.skin.php";
 }
 include_once ($sms5_skin_path.$write_skin_page);
-echo PHP_EOL.'<!-- skin : '.$sms5_skin_path.' -->'.PHP_EOL;
+echo PHP_EOL.'<!-- skin : '.$sms5['bo_skin'].' -->'.PHP_EOL;
 ?>

skin/board/basic/view_comment.skin.php

@@ -29,7 +29,7 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
 
     <article id="c_<?php echo $comment_id ?>" <?php if ($cmt_depth) { ?>style="margin-left:<?php echo $cmt_depth ?>px;border-top-color:#e0e0e0"<?php } ?>>
         <header style="z-index:<?php echo $cmt_sv; ?>">
-            <h1><?php echo $list[$i]['wr_name'] ?>님의 댓글</h1>
+            <h1><?php echo get_text($list[$i]['wr_name']); ?>님의 댓글</h1>
             <?php echo $list[$i]['name'] ?>
             <?php if ($cmt_depth) { ?><img src="<?php echo $board_skin_url ?>/img/icon_reply.gif" class="icon_reply" alt="댓글의 댓글"><?php } ?>
             <?php if ($is_ip_view) { ?>

skin/board/gallery/view_comment.skin.php

@@ -29,7 +29,7 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
 
     <article id="c_<?php echo $comment_id ?>" <?php if ($cmt_depth) { ?>style="margin-left:<?php echo $cmt_depth ?>px;border-top-color:#e0e0e0"<?php } ?>>
         <header style="z-index:<?php echo $cmt_sv; ?>">
-            <h1><?php echo $list[$i]['wr_name'] ?>님의 댓글</h1>
+            <h1><?php echo get_text($list[$i]['wr_name']); ?>님의 댓글</h1>
             <?php echo $list[$i]['name'] ?>
             <?php if ($cmt_depth) { ?><img src="<?php echo $board_skin_url ?>/img/icon_reply.gif" class="icon_reply" alt="댓글의 댓글"><?php } ?>
             <?php if ($is_ip_view) { ?>

skin/member/basic/register_form.skin.php

@@ -34,17 +34,17 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
             <th scope="row"><label for="reg_mb_id">아이디<strong class="sound_only">필수</strong></label></th>
             <td>
                 <span class="frm_info">영문자, 숫자, _ 만 입력 가능. 최소 3자이상 입력하세요.</span>
-                <input type="text" name="mb_id" value="<?php echo $member['mb_id'] ?>" id="reg_mb_id" <?php echo $required ?> <?php echo $readonly ?> class="frm_input minlength_3 <?php echo $required ?> <?php echo $readonly ?>" maxlength="20">
+                <input type="text" name="mb_id" value="<?php echo $member['mb_id'] ?>" id="reg_mb_id" <?php echo $required ?> <?php echo $readonly ?> class="frm_input minlength=3 <?php echo $required ?> <?php echo $readonly ?>" maxlength="20">
                 <span id="msg_mb_id"></span>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="reg_mb_password">비밀번호<strong class="sound_only">필수</strong></label></th>
-            <td><input type="password" name="mb_password" id="reg_mb_password" <?php echo $required ?> class="frm_input minlength_3 <?php echo $required ?>" maxlength="20"></td>
+            <td><input type="password" name="mb_password" id="reg_mb_password" <?php echo $required ?> class="frm_input minlength=3 <?php echo $required ?>" maxlength="20"></td>
         </tr>
         <tr>
             <th scope="row"><label for="reg_mb_password_re">비밀번호 확인<strong class="sound_only">필수</strong></label></th>
-            <td><input type="password" name="mb_password_re" id="reg_mb_password_re" <?php echo $required ?> class="frm_input minlength_3 <?php echo $required ?>" maxlength="20"></td>
+            <td><input type="password" name="mb_password_re" id="reg_mb_password_re" <?php echo $required ?> class="frm_input minlength=3 <?php echo $required ?>" maxlength="20"></td>
         </tr>
         </tbody>
         </table>
@@ -57,10 +57,10 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
         <tr>
             <th scope="row"><label for="reg_mb_name">이름<strong class="sound_only">필수</strong></label></th>
             <td>
-                <?php if ($w=="u" && $config['cf_cert_use']) { ?>
+                <?php if ($config['cf_cert_use']) { ?>
                 <span class="frm_info">아이핀 본인확인 후에는 이름이 자동 입력되고 휴대폰 본인확인 후에는 이름과 휴대폰번호가 자동 입력되어 수동으로 입력할수 없게 됩니다.</span>
                 <?php } ?>
-                <input type="text" id="reg_mb_name" name="mb_name" value="<?php echo $member['mb_name'] ?>" <?php echo $required ?> <?php if ($w=='u') echo 'readonly'; ?> class="frm_input nospace <?php echo $required ?> <?php echo $readonly ?>" size="10">
+                <input type="text" id="reg_mb_name" name="mb_name" value="<?php echo $member['mb_name'] ?>" <?php echo $required ?> <?php echo $readonly; ?> class="frm_input <?php echo $required ?> <?php echo $readonly ?>" size="10">
                 <?php
                 if($config['cf_cert_use']) {
                     if($config['cf_cert_ipin'])

skin/search/basic/search.skin.php

@@ -102,8 +102,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',
     <?php
     $k=0;
     for ($idx=$table_index, $k=0; $idx<count($search_table) && $k<$rows; $idx++) {
-        $comment_def = "";
-        $comment_href = "";
      ?>
         <h2><a href="./board.php?bo_table=<?php echo $search_table[$idx] ?>&amp;<?php echo $search_query ?>"><?php echo $bo_subject[$idx] ?> 게시판 내 결과</a></h2>
         <ul>
@@ -111,8 +109,13 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',
         for ($i=0; $i<count($list[$idx]) && $k<$rows; $i++, $k++) {
             if ($list[$idx][$i]['wr_is_comment'])
             {
-                $comment_def = "<span class=\"cmt_def\">댓글 | </span>";
-                $comment_href = "#c_".$list[$idx][$i]['wr_id'];
+                $comment_def = '<span class="cmt_def">댓글 | </span>';
+                $comment_href = '#c_'.$list[$idx][$i]['wr_id'];
+            }
+            else
+            {
+                $comment_def = '';
+                $comment_href = '';
             }
          ?>