5.1.9 버전변경

adm/admin.js

@@ -57,12 +57,20 @@ function is_checked(elements_name)
     return checked;
 }
 
-function delete_confirm()
+function delete_confirm(el)
 {
-    if(confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n정말 삭제하시겠습니까?"))
+    if(confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n정말 삭제하시겠습니까?")) {
+        var token = get_ajax_token();
+        var href = el.href.replace(/&token=.+$/g, "");
+        if(!token) {
+            alert("토큰 정보가 올바르지 않습니다.");
+            return false;
+        }
+        el.href = href+"&token="+token;
         return true;
-    else
+    } else {
         return false;
+    }
 }
 
 function delete_confirm2(msg)
@@ -71,4 +79,51 @@ function delete_confirm2(msg)
         return true;
     else
         return false;
-}
+}
+
+function get_ajax_token()
+{
+    var token = "";
+
+    $.ajax({
+        type: "POST",
+        url: g5_admin_url+"/ajax.token.php",
+        cache: false,
+        async: false,
+        dataType: "json",
+        success: function(data) {
+            if(data.error) {
+                alert(data.error);
+                if(data.url)
+                    document.location.href = data.url;
+
+                return false;
+            }
+
+            token = data.token;
+        }
+    });
+
+    return token;
+}
+
+$(function() {
+    $(document).on("click", "form input:submit", function() {
+        var f = this.form;
+        var token = get_ajax_token();
+
+        if(!token) {
+            alert("토큰 정보가 올바르지 않습니다.");
+            return false;
+        }
+
+        var $f = $(f);
+
+        if(typeof f.token === "undefined")
+            $f.prepend('<input type="hidden" name="token" value="">');
+
+        $f.find("input[name=token]").val(token);
+
+        return true;
+    });
+});

adm/admin.lib.php

@@ -346,6 +346,54 @@ function order_select($fld, $sel='')
     return $s;
 }
 
+// 불법접근을 막도록 토큰을 생성하면서 토큰값을 리턴
+function get_admin_token()
+{
+    $token = md5(uniqid(rand(), true));
+    set_session('ss_admin_token', $token);
+
+    return $token;
+}
+
+
+// POST로 넘어온 토큰과 세션에 저장된 토큰 비교
+function check_admin_token()
+{
+    $token = get_session('ss_admin_token');
+    set_session('ss_admin_token', '');
+
+    if(!$token || !$_REQUEST['token'] || $token != $_REQUEST['token'])
+        alert('올바른 방법으로 이용해 주십시오.', G5_URL);
+
+    return true;
+}
+
+// 관리자 페이지 referer 체크
+function admin_referer_check($return=false)
+{
+    $referer = trim($_SERVER['HTTP_REFERER']);
+    if(!$referer) {
+        $msg = '정보가 올바르지 않습니다.';
+
+        if($return)
+            return $msg;
+        else
+            alert($msg, G5_URL);
+    }
+
+    $p = @parse_url($referer);
+    $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
+
+    if($host != $p['host']) {
+        $msg = '올바른 방법으로 이용해 주십시오.';
+
+        if($return)
+            return $msg;
+        else
+            alert($msg, G5_URL);
+    }
+}
+
 // 접근 권한 검사
 if (!$member['mb_id'])
 {

adm/ajax.token.php

@@ -0,0 +1,14 @@
+<?php
+include_once('./_common.php');
+include_once(G5_LIB_PATH.'/json.lib.php');
+
+set_session('ss_admin_token', '');
+
+$error = admin_referer_check(true);
+if($error)
+    die(json_encode(array('error'=>$error, 'url'=>G5_URL)));
+
+$token = get_admin_token();
+
+die(json_encode(array('error'=>'', 'token'=>$token, 'url'=>'')));
+?>

adm/auth_list.php

@@ -5,8 +5,6 @@ include_once('./_common.php');
 if ($is_admin != 'super')
     alert('최고관리자만 접근 가능합니다.');
 
-$token = get_token();
-
 $sql_common = " from {$g5['auth_table']} a left join {$g5['member_table']} b on (a.mb_id=b.mb_id) ";
 
 $sql_search = " where (1) ";
@@ -73,7 +71,7 @@ $colspan = 5;
 <input type="hidden" name="sfl" value="<?php echo $sfl ?>">
 <input type="hidden" name="stx" value="<?php echo $stx ?>">
 <input type="hidden" name="page" value="<?php echo $page ?>">
-<input type="hidden" name="token" value="<?php echo $token ?>">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_head01 tbl_wrap">
     <table>
@@ -168,7 +166,7 @@ echo $pagelist;
 <input type="hidden" name="sst" value="<?php echo $sst ?>">
 <input type="hidden" name="sod" value="<?php echo $sod ?>">
 <input type="hidden" name="page" value="<?php echo $page ?>">
-<input type="hidden" name="token" value="<?php echo $token ?>">
+<input type="hidden" name="token" value="">
 
 <section id="add_admin">
     <h2 class="h2_frm">관리권한 추가</h2>

adm/auth_list_delete.php

@@ -7,7 +7,7 @@ check_demo();
 if ($is_admin != 'super')
     alert('최고관리자만 접근 가능합니다.');
 
-check_token();
+check_admin_token();
 
 $count = count($_POST['chk']);
 

adm/auth_update.php

@@ -9,7 +9,7 @@ $mb = get_member($mb_id);
 if (!$mb['mb_id'])
     alert('존재하는 회원아이디가 아닙니다.');
 
-check_token();
+check_admin_token();
 
 $sql = " insert into {$g5['auth_table']}
             set mb_id   = '{$_POST['mb_id']}',

adm/board_copy.php

@@ -8,11 +8,14 @@ $g5['title'] = '게시판 복사';
 include_once(G5_PATH.'/head.sub.php');
 ?>
 
+<script src="<?php echo G5_ADMIN_URL ?>/admin.js"></script>
+
 <div class="new_win">
     <h1><?php echo $g5['title']; ?></h1>
 
     <form name="fboardcopy" id="fboardcopy" action="./board_copy_update.php" onsubmit="return fboardcopy_check(this);" method="post">
     <input type="hidden" name="bo_table" value="<?php echo $bo_table ?>" id="bo_table">
+    <input type="hidden" name="token" value="">
 
     <div class="tbl_frm01 tbl_wrap">
         <table>

adm/board_copy_update.php

@@ -4,6 +4,8 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'w');
 
+check_admin_token();
+
 $target_table   = trim($_POST['target_table']);
 $target_subject = trim($_POST['target_subject']);
 

adm/board_form.php

@@ -166,6 +166,7 @@ $frm_submit .= '</div>';
 <input type="hidden" name="sst" value="<?php echo $sst ?>">
 <input type="hidden" name="sod" value="<?php echo $sod ?>">
 <input type="hidden" name="page" value="<?php echo $page ?>">
+<input type="hidden" name="token" value="">
 
 <section id="anc_bo_basic">
     <h2 class="h2_frm">게시판 기본 설정</h2>

adm/board_form_update.php

@@ -7,6 +7,8 @@ if ($w == 'u')
 
 auth_check($auth[$sub_menu], 'w');
 
+check_admin_token();
+
 if (!$_POST['gr_id']) { alert('그룹 ID는 반드시 선택하세요.'); }
 if (!$bo_table) { alert('게시판 TABLE명은 반드시 입력하세요.'); }
 if (!preg_match("/^([A-Za-z0-9_]{1,20})$/", $bo_table)) { alert('게시판 TABLE명은 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (20자 이내)'); }

adm/board_list_update.php

@@ -51,7 +51,7 @@ if ($_POST['act_button'] == "선택수정") {
 
     auth_check($auth[$sub_menu], 'd');
 
-    check_token();
+    check_admin_token();
 
     // _BOARD_DELETE_ 상수를 선언해야 board_delete.inc.php 가 정상 작동함
     define('_BOARD_DELETE_', true);

adm/boardgroup_form.php

@@ -38,6 +38,7 @@ include_once('./admin.head.php');
 <input type="hidden" name="sst" value="<?php echo $sst ?>">
 <input type="hidden" name="sod" value="<?php echo $sod ?>">
 <input type="hidden" name="page" value="<?php echo $page ?>">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_frm01 tbl_wrap">
     <table>

adm/boardgroup_form_update.php

@@ -9,6 +9,8 @@ auth_check($auth[$sub_menu], 'w');
 
 if ($is_admin != 'super' && $w == '') alert('최고관리자만 접근 가능합니다.');
 
+check_admin_token();
+
 if (!preg_match("/^([A-Za-z0-9_]{1,10})$/", $_POST['gr_id']))
     alert('그룹 ID는 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (10자 이내)');
 

adm/boardgroup_list.php

@@ -88,7 +88,7 @@ $colspan = 10;
 <input type="hidden" name="sfl" value="<?php echo $sfl ?>">
 <input type="hidden" name="stx" value="<?php echo $stx ?>">
 <input type="hidden" name="page" value="<?php echo $page ?>">
-<input type="hidden" name="token" value="<?php echo $token ?>">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_head01 tbl_wrap">
     <table>

adm/boardgroup_list_update.php

@@ -8,6 +8,8 @@ check_demo();
 
 auth_check($auth[$sub_menu], 'w');
 
+check_admin_token();
+
 $count = count($_POST['chk']);
 
 if(!$count)

adm/boardgroupmember_form.php

@@ -4,8 +4,6 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'w');
 
-$token = get_token();
-
 $mb = get_member($mb_id);
 if (!$mb['mb_id'])
     alert('존재하지 않는 회원입니다.');
@@ -18,7 +16,7 @@ $colspan = 4;
 
 <form name="fboardgroupmember_form" id="fboardgroupmember_form" action="./boardgroupmember_update.php" onsubmit="return boardgroupmember_form_check(this)" method="post">
 <input type="hidden" name="mb_id" value="<?php echo $mb['mb_id'] ?>" id="mb_id">
-<input type="hidden" name="token" value="<?php echo $token ?>" id="token">
+<input type="hidden" name="token" value="" id="token">
 <div class="local_cmd01 local_cmd">
     <p>아이디 <b><?php echo $mb['mb_id'] ?></b>, 이름 <b><?php echo get_text($mb['mb_name']); ?></b>, 닉네임 <b><?php echo $mb['mb_nick'] ?></b></p>
     <label for="gr_id">그룹지정</label>

adm/boardgroupmember_update.php

@@ -28,7 +28,7 @@ if ($w == '')
     }
     else
     {
-        check_token();
+        check_admin_token();
 
         $sql = " insert into {$g5['group_member_table']}
                     set gr_id = '{$_POST['gr_id']}',
@@ -45,7 +45,7 @@ else if ($w == 'd' || $w == 'ld')
     if(!$count)
         alert('삭제할 목록을 하나이상 선택해 주세요.');
 
-    check_token();
+    check_admin_token();
 
     for($i=0; $i<$count; $i++) {
         $gm_id = $_POST['chk'][$i];

adm/config_form.php

@@ -4,8 +4,6 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'r');
 
-$token = get_token();
-
 if ($is_admin != 'super')
     alert('최고관리자만 접근 가능합니다.');
 
@@ -229,7 +227,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
 ?>
 
 <form name="fconfigform" id="fconfigform" method="post" onsubmit="return fconfigform_submit(this);">
-<input type="hidden" name="token" value="<?php echo $token ?>" id="token">
+<input type="hidden" name="token" value="" id="token">
 
 <section id="anc_cf_basic">
     <h2 class="h2_frm">홈페이지 기본환경 설정</h2>

adm/config_form_update.php

@@ -13,7 +13,7 @@ $mb = get_member($cf_admin);
 if (!$mb['mb_id'])
     alert('최고관리자 회원아이디가 존재하지 않습니다.');
 
-check_token();
+check_admin_token();
 
 // 본인확인을 사용할 경우 아이핀, 휴대폰인증 중 하나는 선택되어야 함
 if($_POST['cf_cert_use'] && !$_POST['cf_cert_ipin'] && !$_POST['cf_cert_hp'])

adm/contentform.php

@@ -60,6 +60,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
 <form name="frmcontentform" action="./contentformupdate.php" onsubmit="return frmcontentform_check(this);" method="post" enctype="MULTIPART/FORM-DATA" >
 <input type="hidden" name="w" value="<?php echo $w; ?>">
 <input type="hidden" name="co_html" value="1">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_frm01 tbl_wrap">
     <table>

adm/contentformupdate.php

@@ -10,6 +10,8 @@ if ($w == 'd')
 else
     auth_check($auth[$sub_menu], "w");
 
+check_admin_token();
+
 @mkdir(G5_DATA_PATH."/content", G5_DIR_PERMISSION);
 @chmod(G5_DATA_PATH."/content", G5_DIR_PERMISSION);
 

adm/contentlist.php

@@ -78,7 +78,7 @@ $result = sql_query($sql);
         <td class="td_mng">
             <a href="./contentform.php?w=u&amp;co_id=<?php echo $row['co_id']; ?>"><span class="sound_only"><?php echo htmlspecialchars2($row['co_subject']); ?> </span>수정</a>
             <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=<?php echo $row['co_id']; ?>"><span class="sound_only"><?php echo htmlspecialchars2($row['co_subject']); ?> </span> 보기</a>
-            <a href="./contentformupdate.php?w=d&amp;co_id=<?php echo $row['co_id']; ?>" onclick="return delete_confirm();"><span class="sound_only"><?php echo htmlspecialchars2($row['co_subject']); ?> </span>삭제</a>
+            <a href="./contentformupdate.php?w=d&amp;co_id=<?php echo $row['co_id']; ?>" onclick="return delete_confirm(this);"><span class="sound_only"><?php echo htmlspecialchars2($row['co_subject']); ?> </span>삭제</a>
         </td>
     </tr>
     <?php

adm/faqform.php

@@ -31,6 +31,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
 <input type="hidden" name="w" value="<?php echo $w; ?>">
 <input type="hidden" name="fm_id" value="<?php echo $fm_id; ?>">
 <input type="hidden" name="fa_id" value="<?php echo $fa_id; ?>">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_frm01 tbl_wrap">
     <table>

adm/faqformupdate.php

@@ -10,6 +10,8 @@ if ($W == 'd')
 else
     auth_check($auth[$sub_menu], "w");
 
+check_admin_token();
+
 $sql_common = " fa_subject = '$fa_subject',
                 fa_content = '$fa_content',
                 fa_order = '$fa_order' ";

adm/faqlist.php

@@ -69,7 +69,7 @@ $result = sql_query($sql);
         <td class="td_num"><?php echo $row['fa_order']; ?></td>
         <td class="td_mngsmall">
             <a href="./faqform.php?w=u&amp;fm_id=<?php echo $row['fm_id']; ?>&amp;fa_id=<?php echo $row['fa_id']; ?>"><span class="sound_only"><?php echo stripslashes($row['fa_subject']); ?> </span>수정</a>
-            <a href="javascript:del('./faqformupdate.php?w=d&amp;fm_id=<?php echo $row['fm_id']; ?>&amp;fa_id=<?php echo $row['fa_id']; ?>');"><span class="sound_only"><?php echo stripslashes($row['fa_subject']); ?> </span>삭제</a>
+            <a href="./faqformupdate.php?w=d&amp;fm_id=<?php echo $row['fm_id']; ?>&amp;fa_id=<?php echo $row['fa_id']; ?>" onclick="return delete_confirm(this);"><span class="sound_only"><?php echo stripslashes($row['fa_subject']); ?> </span>삭제</a>
         </td>
     </tr>
 

adm/faqmasterform.php

@@ -36,6 +36,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
 <form name="frmfaqmasterform" action="./faqmasterformupdate.php" onsubmit="return frmfaqmasterform_check(this);" method="post" enctype="MULTIPART/FORM-DATA">
 <input type="hidden" name="w" value="<?php echo $w; ?>">
 <input type="hidden" name="fm_id" value="<?php echo $fm_id; ?>">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_frm01 tbl_wrap">
     <table>

adm/faqmasterformupdate.php

@@ -10,6 +10,8 @@ if ($W == 'd')
 else
     auth_check($auth[$sub_menu], "w");
 
+check_admin_token();
+
 @mkdir(G5_DATA_PATH."/faq", G5_DIR_PERMISSION);
 @chmod(G5_DATA_PATH."/faq", G5_DIR_PERMISSION);
 

adm/faqmasterlist.php

@@ -107,7 +107,7 @@ $result = sql_query($sql);
         <td class="td_mng">
             <a href="./faqmasterform.php?w=u&amp;fm_id=<?php echo $row['fm_id']; ?>"><span class="sound_only"><?php echo stripslashes($row['fm_subject']); ?> </span>수정</a>
             <a href="<?php echo G5_BBS_URL; ?>/faq.php?fm_id=<?php echo $row['fm_id']; ?>"><span class="sound_only"><?php echo stripslashes($row['fm_subject']); ?> </span>보기</a>
-            <a href="./faqmasterformupdate.php?w=d&amp;fm_id=<?php echo $row['fm_id']; ?>" onclick="return delete_confirm();"><span class="sound_only"><?php echo stripslashes($row['fm_subject']); ?> </span>삭제</a>
+            <a href="./faqmasterformupdate.php?w=d&amp;fm_id=<?php echo $row['fm_id']; ?>" onclick="return delete_confirm(this);"><span class="sound_only"><?php echo stripslashes($row['fm_subject']); ?> </span>삭제</a>
         </td>
     </tr>
     <?php

adm/index.php

@@ -84,7 +84,7 @@ $colspan = 12;
             else
             {
                 $s_mod = '<a href="./member_form.php?$qstr&amp;w=u&amp;mb_id='.$row['mb_id'].'">수정</a>';
-                $s_del = '<a href="javascript:del(\'./member_delete.php?'.$qstr.'&amp;w=d&amp;mb_id='.$row['mb_id'].'&amp;url='.$_SERVER['SCRIPT_NAME'].'\');">삭제</a>';
+                $s_del = '<a href="./member_delete.php?'.$qstr.'&amp;w=d&amp;mb_id='.$row['mb_id'].'&amp;url='.$_SERVER['SCRIPT_NAME'].'" onclick="return delete_confirm(this);">삭제</a>';
             }
             $s_grp = '<a href="./boardgroupmember_form.php?mb_id='.$row['mb_id'].'">그룹</a>';
 

adm/mail_delete.php

@@ -6,7 +6,7 @@ check_demo();
 
 auth_check($auth[$sub_menu], 'd');
 
-check_token();
+check_admin_token();
 
 $count = count($_POST['chk']);
 

adm/mail_form.php

@@ -5,8 +5,6 @@ include_once(G5_EDITOR_LIB);
 
 auth_check($auth[$sub_menu], 'r');
 
-$token = get_token();
-
 $html_title = '회원메일';
 
 if ($w == 'u') {
@@ -30,7 +28,7 @@ include_once('./admin.head.php');
 <form name="fmailform" id="fmailform" action="./mail_update.php" onsubmit="return fmailform_check(this);" method="post">
 <input type="hidden" name="w" value="<?php echo $w ?>" id="w">
 <input type="hidden" name="ma_id" value="<?php echo $ma['ma_id'] ?>" id="ma_id">
-<input type="hidden" name="token" value="<?php echo $token ?>" id="token">
+<input type="hidden" name="token" value="" id="token">
 
 <div class="tbl_frm01 tbl_wrap">
     <table>

adm/mail_list.php

@@ -82,7 +82,7 @@ $colspan = 7;
 </div>
 
 <div class="btn_list01 btn_list">
-    <button type="submit">선택삭제</button>
+    <input type="submit" value="선택삭제">
 </div>
 </form>
 

adm/mail_select_list.php

@@ -4,8 +4,6 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'r');
 
-$token = get_token();
-
 $ma_last_option = "";
 
 $sql_common = " from {$g5['member_table']} ";
@@ -69,7 +67,7 @@ include_once('./admin.head.php');
 ?>
 
 <form name="fmailselectlist" id="fmailselectlist" method="post" action="./mail_select_update.php">
-<input type="hidden" name="token" value="<?php echo $token ?>">
+<input type="hidden" name="token" value="">
 <input type="hidden" name="ma_id" value="<?php echo $ma_id ?>">
 
 <div class="tbl_head01 tbl_wrap">

adm/mail_select_update.php

@@ -8,7 +8,7 @@ $html_title = '회원메일 발송';
 
 check_demo();
 
-check_token();
+check_admin_token();
 
 include_once('./admin.head.php');
 include_once(G5_LIB_PATH.'/mailer.lib.php');

adm/mail_update.php

@@ -7,7 +7,7 @@ if ($w == 'u' || $w == 'd')
 
 auth_check($auth[$sub_menu], 'w');
 
-check_token();
+check_admin_token();
 
 if ($w == '')
 {

adm/member_delete.php

@@ -17,7 +17,7 @@ else if (is_admin($mb['mb_id']) == "super")
 else if ($mb['mb_level'] >= $member['mb_level'])
     alert("자신보다 권한이 높거나 같은 회원은 삭제할 수 없습니다.");
 
-check_token();
+check_admin_token();
 
 // 회원자료 삭제
 member_delete($mb['mb_id']);

adm/member_form.php

@@ -4,8 +4,6 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'w');
 
-$token = get_token();
-
 if ($w == '')
 {
     $required_mb_id = 'required';
@@ -144,7 +142,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
 <input type="hidden" name="sst" value="<?php echo $sst ?>">
 <input type="hidden" name="sod" value="<?php echo $sod ?>">
 <input type="hidden" name="page" value="<?php echo $page ?>">
-<input type="hidden" name="token" value="<?php echo $token ?>">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_frm01 tbl_wrap">
     <table>

adm/member_form_update.php

@@ -8,7 +8,7 @@ if ($w == 'u')
 
 auth_check($auth[$sub_menu], 'w');
 
-check_token();
+check_admin_token();
 
 $mb_id = trim($_POST['mb_id']);
 

adm/member_list.php

@@ -114,6 +114,7 @@ $colspan = 16;
 <input type="hidden" name="sfl" value="<?php echo $sfl ?>">
 <input type="hidden" name="stx" value="<?php echo $stx ?>">
 <input type="hidden" name="page" value="<?php echo $page ?>">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_head02 tbl_wrap">
     <table>

adm/member_list_delete.php

@@ -6,7 +6,7 @@ check_demo();
 
 auth_check($auth[$sub_menu], "d");
 
-check_token();
+check_admin_token();
 
 $msg = "";
 for ($i=0; $i<count($chk); $i++)

adm/menu_list.php

@@ -5,8 +5,6 @@ include_once('./_common.php');
 if ($is_admin != 'super')
     alert('최고관리자만 접근 가능합니다.');
 
-$token = get_token();
-
 // 메뉴테이블 생성
 if( !isset($g5['menu_table']) ){
     die('<meta charset="utf-8">dbconfig.php 파일에 <strong>$g5[\'menu_table\'] = G5_TABLE_PREFIX.\'menu\';</strong> 를 추가해 주세요.');
@@ -40,7 +38,7 @@ $colspan = 7;
 </div>
 
 <form name="fmenulist" id="fmenulist" method="post" action="./menu_list_update.php" onsubmit="return fmenulist_submit(this);">
-<input type="hidden" name="token" value="<?php echo $token ?>">
+<input type="hidden" name="token" value="">
 
 <div class="btn_add01 btn_add">
     <button type="button" onclick="return add_menu();">메뉴추가<span class="sound_only"> 새창</span></button>

adm/menu_list_update.php

@@ -7,7 +7,7 @@ check_demo();
 if ($is_admin != 'super')
     alert('최고관리자만 접근 가능합니다.');
 
-check_token();
+check_admin_token();
 
 // 이전 메뉴정보 삭제
 $sql = " delete from {$g5['menu_table']} ";

adm/newwinform.php

@@ -32,6 +32,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
 <form name="frmnewwin" action="./newwinformupdate.php" onsubmit="return frmnewwin_check(this);" method="post">
 <input type="hidden" name="w" value="<?php echo $w; ?>">
 <input type="hidden" name="nw_id" value="<?php echo $nw_id; ?>">
+<input type="hidden" name="token" value="">
 
 <div class="local_desc01 local_desc">
     <p>초기화면 접속 시 자동으로 뜰 팝업레이어를 설정합니다.</p>

adm/newwinformupdate.php

@@ -10,6 +10,8 @@ if ($w == 'd')
 else
     auth_check($auth[$sub_menu], "w");
 
+check_admin_token();
+
 $sql_common = " nw_device = '{$_POST['nw_device']}',
                 nw_begin_time = '{$_POST['nw_begin_time']}',
                 nw_end_time = '{$_POST['nw_end_time']}',

adm/newwinlist.php

@@ -98,7 +98,7 @@ $result = sql_query($sql);
         <td class="td_num"><?php echo $row['nw_height']; ?>px</td>
         <td class="td_mngsmall">
             <a href="./newwinform.php?w=u&amp;nw_id=<?php echo $row['nw_id']; ?>"><span class="sound_only"><?php echo $row['nw_subject']; ?> </span>수정</a>
-            <a href="./newwinformupdate.php?w=d&amp;nw_id=<?php echo $row['nw_id']; ?>" onclick="return delete_confirm();"><span class="sound_only"><?php echo $row['nw_subject']; ?> </span>삭제</a>
+            <a href="./newwinformupdate.php?w=d&amp;nw_id=<?php echo $row['nw_id']; ?>" onclick="return delete_confirm(this);"><span class="sound_only"><?php echo $row['nw_subject']; ?> </span>삭제</a>
         </td>
     </tr>
     <?php

adm/point_list.php

@@ -4,8 +4,6 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'r');
 
-$token = get_token();
-
 $sql_common = " from {$g5['point_table']} ";
 
 $sql_search = " where (1) ";
@@ -100,7 +98,7 @@ else
 <input type="hidden" name="sfl" value="<?php echo $sfl ?>">
 <input type="hidden" name="stx" value="<?php echo $stx ?>">
 <input type="hidden" name="page" value="<?php echo $page ?>">
-<input type="hidden" name="token" value="<?php echo $token ?>">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_head01 tbl_wrap">
     <table>

adm/point_list_delete.php

@@ -6,7 +6,7 @@ check_demo();
 
 auth_check($auth[$sub_menu], 'd');
 
-check_token();
+check_admin_token();
 
 $count = count($_POST['chk']);
 if(!$count)

adm/point_update.php

@@ -4,7 +4,7 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'w');
 
-check_token();
+check_admin_token();
 
 $mb_id = $_POST['mb_id'];
 $po_point = $_POST['po_point'];

adm/poll_delete.php

@@ -6,7 +6,7 @@ check_demo();
 
 auth_check($auth[$sub_menu], 'd');
 
-check_token();
+check_admin_token();
 
 $count = count($_POST['chk']);
 

adm/poll_form.php

@@ -4,8 +4,6 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'w');
 
-$token = get_token();
-
 $html_title = '투표';
 if ($w == '')
     $html_title .= ' 생성';
@@ -28,7 +26,7 @@ include_once('./admin.head.php');
 <input type="hidden" name="sst" value="<?php echo $sst ?>">
 <input type="hidden" name="sod" value="<?php echo $sod ?>">
 <input type="hidden" name="page" value="<?php echo $page ?>">
-<input type="hidden" name="token" value="<?php echo $token ?>">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_frm01 tbl_wrap">
 

adm/poll_form_update.php

@@ -8,7 +8,7 @@ if ($w == 'u' || $w == 'd')
 
 auth_check($auth[$sub_menu], 'w');
 
-check_token();
+check_admin_token();
 
 if ($w == '')
 {

adm/poll_list.php

@@ -4,8 +4,6 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'r');
 
-$token = get_token();
-
 $sql_common = " from {$g5['poll_table']} ";
 
 $sql_search = " where (1) ";
@@ -79,7 +77,7 @@ $colspan = 7;
 <input type="hidden" name="sfl" value="<?php echo $sfl ?>">
 <input type="hidden" name="stx" value="<?php echo $stx ?>">
 <input type="hidden" name="page" value="<?php echo $page ?>">
-<input type="hidden" name="token" value="<?php echo $token ?>">
+<input type="hidden" name="token" value="">
 
 <div class="tbl_head01 tbl_wrap">
     <table>
@@ -134,7 +132,7 @@ $colspan = 7;
 </div>
 
 <div class="btn_list01 btn_list">
-    <button type="submit">선택삭제</button>
+    <input type="submit" value="선택삭제">
 </div>
 </form>
 

adm/qa_config.php

@@ -5,8 +5,6 @@ include_once(G5_EDITOR_LIB);
 
 auth_check($auth[$sub_menu], 'r');
 
-$token = get_token();
-
 $g5['title'] = '1:1문의 설정';
 include_once ('./admin.head.php');
 
@@ -119,7 +117,7 @@ if(!isset($qaconfig['qa_include_head'])) {
 ?>
 
 <form name="fqaconfigform" id="fqaconfigform" method="post" onsubmit="return fqaconfigform_submit(this);" autocomplete="off">
-<input type="hidden" name="token" value="<?php echo $token ?>" id="token">
+<input type="hidden" name="token" value="" id="token">
 
 <section id="anc_cf_qa_config">
     <h2 class="h2_frm">1:1문의 설정</h2>

adm/qa_config_update.php

@@ -6,7 +6,7 @@ check_demo();
 
 auth_check($auth[$sub_menu], 'w');
 
-check_token();
+check_admin_token();
 
 $sql = " update {$g5['qa_config_table']}
             set qa_title                = '{$_POST['qa_title']}',

adm/sms_admin/config_update.php

@@ -6,6 +6,8 @@ auth_check($auth[$sub_menu], "w");
 
 check_demo();
 
+check_admin_token();
+
 $g5['title'] = "SMS 기본설정";
 
 // 회신번호 체크

adm/sms_admin/sms_write_send.php

@@ -4,6 +4,8 @@ include_once("./_common.php");
 
 auth_check($auth[$sub_menu], "w");
 
+check_admin_token();
+
 $g5['title'] = "문자전송중";
 
 $wr_reply   = preg_replace('#[^0-9\-]#', '', trim($wr_reply));

adm/theme_update.php

@@ -5,6 +5,8 @@ include_once('./_common.php');
 if ($is_admin != 'super')
     die('최고관리자만 접근 가능합니다.');
 
+admin_referer_check();
+
 $theme = trim($_POST['theme']);
 $theme_dir = get_theme_dir();
 

bbs/board.php

@@ -130,13 +130,13 @@ if (isset($wr_id) && $wr_id) {
             if ($config['cf_use_point'] && $board['bo_read_point'] && $member['mb_point'] + $board['bo_read_point'] < 0)
                 alert('보유하신 포인트('.number_format($member['mb_point']).')가 없거나 모자라서 글읽기('.number_format($board['bo_read_point']).')가 불가합니다.\\n\\n포인트를 모으신 후 다시 글읽기 해 주십시오.');
 
-            insert_point($member['mb_id'], $board['bo_read_point'], "{$board['bo_subject']} {$wr_id} 글읽기", $bo_table, $wr_id, '읽기');
+            insert_point($member['mb_id'], $board['bo_read_point'], ((G5_IS_MOBILE && $board['bo_mobile_subject']) ? $board['bo_mobile_subject'] : $board['bo_subject']).' '.$wr_id.' 글읽기', $bo_table, $wr_id, '읽기');
         }
 
         set_session($ss_name, TRUE);
     }
 
-    $g5['title'] = strip_tags(conv_subject($write['wr_subject'], 255))." > ".$board['bo_subject'];
+    $g5['title'] = strip_tags(conv_subject($write['wr_subject'], 255))." > ".((G5_IS_MOBILE && $board['bo_mobile_subject']) ? $board['bo_mobile_subject'] : $board['bo_subject']);
 } else {
     if ($member['mb_level'] < $board['bo_list_level']) {
         if ($member['mb_id'])
@@ -171,7 +171,7 @@ if (isset($wr_id) && $wr_id) {
 
     if (!isset($page) || (isset($page) && $page == 0)) $page = 1;
 
-    $g5['title'] = $board['bo_subject']." ".$page." 페이지";
+    $g5['title'] = ((G5_IS_MOBILE && $board['bo_mobile_subject']) ? $board['bo_mobile_subject'] : $board['bo_subject']).' '.$page.' 페이지';
 }
 
 include_once(G5_PATH.'/head.sub.php');

bbs/new.php

@@ -6,7 +6,7 @@ include_once('./_head.php');
 
 $sql_common = " from {$g5['board_new_table']} a, {$g5['board_table']} b, {$g5['group_table']} c where a.bo_table = b.bo_table and b.gr_id = c.gr_id and b.bo_use_search = 1 ";
 
-$gr_id = isset($_GET['gr_id']) ? $_GET['gr_id'] : "";
+$gr_id = isset($_GET['gr_id']) ? substr(preg_replace('#[^a-z0-9_]#i', '', $_GET['gr_id']), 0, 10) : '';
 if ($gr_id) {
     $sql_common .= " and b.gr_id = '$gr_id' ";
 }
@@ -46,7 +46,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
 $group_select .= '</select>';
 
 $list = array();
-$sql = " select a.*, b.bo_subject, c.gr_subject, c.gr_id {$sql_common} {$sql_order} limit {$from_record}, {$rows} ";
+$sql = " select a.*, b.bo_subject, b.bo_mobile_subject, c.gr_subject, c.gr_id {$sql_common} {$sql_order} limit {$from_record}, {$rows} ";
 $result = sql_query($sql);
 for ($i=0; $row=sql_fetch_array($result); $i++) {
     $tmp_write_table = $g5['write_prefix'].$row['bo_table'];
@@ -104,7 +104,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
     $list[$i]['datetime2'] = $datetime2;
 
     $list[$i]['gr_subject'] = $row['gr_subject'];
-    $list[$i]['bo_subject'] = $row['bo_subject'];
+    $list[$i]['bo_subject'] = ((G5_IS_MOBILE && $row['bo_mobile_subject']) ? $row['bo_mobile_subject'] : $row['bo_subject']);
     $list[$i]['wr_subject'] = $row2['wr_subject'];
 }
 

bbs/qawrite_update.php

@@ -339,7 +339,7 @@ if($config['cf_sms_use'] == 'icode' && $qaconfig['qa_use_sms']) {
             // 문의글 등록시 관리자에게 전송
             if(($w == '' || $w == 'r') && trim($qaconfig['qa_admin_hp'])) {
                 $sms_content = $config['cf_title'].' '.$qaconfig['qa_title'].'에 문의글이 등록되었습니다.';
-                $send_number = preg_replace('/[^0-9]/', '', $qa_hp);
+                $send_number = preg_replace('/[^0-9]/', '', $qaconfig['qa_send_number']);
                 $recv_number = preg_replace('/[^0-9]/', '', $qaconfig['qa_admin_hp']);
 
                 if($recv_number) {
@@ -385,7 +385,7 @@ if($config['cf_sms_use'] == 'icode' && $qaconfig['qa_use_sms']) {
         // 문의글 등록시 관리자에게 전송
         if(($w == '' || $w == 'r') && trim($qaconfig['qa_admin_hp'])) {
             $sms_content = $config['cf_title'].' '.$qaconfig['qa_title'].'에 문의글이 등록되었습니다.';
-            $send_number = preg_replace('/[^0-9]/', '', $qa_hp);
+            $send_number = preg_replace('/[^0-9]/', '', $qaconfig['qa_send_number']);
             $recv_number = preg_replace('/[^0-9]/', '', $qaconfig['qa_admin_hp']);
 
             if($recv_number) {

bbs/search.php

@@ -129,13 +129,13 @@ if ($stx) {
             $read_level[]   = $g5_search['read_level'][$i];
             $search_table_count[] = $total_count;
 
-            $sql2 = " select bo_subject from {$g5['board_table']} where bo_table = '{$g5_search['tables'][$i]}' ";
+            $sql2 = " select bo_subject, bo_mobile_subject from {$g5['board_table']} where bo_table = '{$g5_search['tables'][$i]}' ";
             $row2 = sql_fetch($sql2);
             $sch_class = "";
             $sch_all = "";
             if ($onetable == $g5_search['tables'][$i]) $sch_class = "class=sch_on";
             else $sch_all = "class=sch_on";
-            $str_board_list .= '<li><a href="'.$_SERVER['SCRIPT_NAME'].'?'.$search_query.'&amp;gr_id='.$gr_id.'&amp;onetable='.$g5_search['tables'][$i].'" '.$sch_class.'><strong>'.$row2['bo_subject'].'</strong><span class="cnt_cmt">'.$row['cnt'].'</span></a></li>';
+            $str_board_list .= '<li><a href="'.$_SERVER['SCRIPT_NAME'].'?'.$search_query.'&amp;gr_id='.$gr_id.'&amp;onetable='.$g5_search['tables'][$i].'" '.$sch_class.'><strong>'.((G5_IS_MOBILE && $row2['bo_mobile_subject']) ? $row2['bo_mobile_subject'] : $row2['bo_subject']).'</strong><span class="cnt_cmt">'.$row['cnt'].'</span></a></li>';
         }
     }
 
@@ -157,9 +157,9 @@ if ($stx) {
 
     $k=0;
     for ($idx=$table_index; $idx<count($search_table); $idx++) {
-        $sql = " select bo_subject from {$g5['board_table']} where bo_table = '{$search_table[$idx]}' ";
+        $sql = " select bo_subject, bo_mobile_subject from {$g5['board_table']} where bo_table = '{$search_table[$idx]}' ";
         $row = sql_fetch($sql);
-        $bo_subject[$idx] = $row['bo_subject'];
+        $bo_subject[$idx] = ((G5_IS_MOBILE && $row['bo_mobile_subject']) ? $row['bo_mobile_subject'] : $row['bo_subject']);
 
         $tmp_write_table = $g5['write_prefix'] . $search_table[$idx];
 

bbs/write.php

@@ -214,7 +214,7 @@ else
     $write_max = (int)$board['bo_write_max'];
 }
 
-$g5['title'] = $board['bo_subject']." ".$title_msg;
+$g5['title'] = ((G5_IS_MOBILE && $board['bo_mobile_subject']) ? $board['bo_mobile_subject'] : $board['bo_subject']).' '.$title_msg;
 
 $is_notice = false;
 $notice_checked = '';

config.php

@@ -5,7 +5,7 @@
 ********************/
 
 define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.1.7');
+define('G5_GNUBOARD_VER', '5.1.9');
 
 // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
 define('_GNUBOARD_', true);

lib/Excel/reader.php

@@ -258,7 +258,7 @@ class Spreadsheet_Excel_Reader
      */
     function Spreadsheet_Excel_Reader()
     {
-        $this->_ole =& new OLERead();
+        $this->_ole = new OLERead();
         $this->setUTFEncoder('iconv');
     }
 

mobile/skin/board/basic/list.skin.php

@@ -10,14 +10,14 @@ if ($is_checkbox) $colspan++;
 add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0);
 ?>
 
-<h2 id="container_title"><?php echo $board['bo_subject'] ?><span class="sound_only"> 목록</span></h2>
+<h2 id="container_title"><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']) ?><span class="sound_only"> 목록</span></h2>
 
 <!-- 게시판 목록 시작 -->
 <div id="bo_list<?php if ($is_admin) echo "_admin"; ?>">
 
     <?php if ($is_category) { ?>
     <nav id="bo_cate">
-        <h2><?php echo $board['bo_subject'] ?> 카테고리</h2>
+        <h2><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']) ?> 카테고리</h2>
         <ul id="bo_cate_ul">
             <?php echo $category_option ?>
         </ul>

mobile/skin/board/basic/view.skin.php

@@ -8,7 +8,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
 
 <script src="<?php echo G5_JS_URL; ?>/viewimageresize.js"></script>
 
-<div id="bo_v_table"><?php echo $board['bo_subject']; ?></div>
+<div id="bo_v_table"><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']); ?></div>
 
 <article id="bo_v" style="width:<?php echo $width; ?>">
     <header>

mobile/skin/board/gallery/list.skin.php

@@ -8,14 +8,14 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
 
 <script src="<?php echo G5_JS_URL; ?>/jquery.fancylist.js"></script>
 
-<h2 id="container_title"><?php echo $board['bo_subject'] ?><span class="sound_only"> 목록</span></h2>
+<h2 id="container_title"><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']) ?><span class="sound_only"> 목록</span></h2>
 
 <!-- 게시판 목록 시작 -->
 <div id="bo_gall">
 
     <?php if ($is_category) { ?>
     <nav id="bo_cate">
-        <h2><?php echo $board['bo_subject'] ?> 카테고리</h2>
+        <h2><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']) ?> 카테고리</h2>
         <ul id="bo_cate_ul">
             <?php echo $category_option ?>
         </ul>

mobile/skin/board/gallery/view.skin.php

@@ -8,7 +8,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
 
 <script src="<?php echo G5_JS_URL; ?>/viewimageresize.js"></script>
 
-<div id="bo_v_table"><?php echo $board['bo_subject']; ?></div>
+<div id="bo_v_table"><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']); ?></div>
 
 <article id="bo_v" style="width:<?php echo $width; ?>">
     <header>

theme/basic/mobile/skin/board/basic/list.skin.php

@@ -10,14 +10,14 @@ if ($is_checkbox) $colspan++;
 add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0);
 ?>
 
-<h2 id="container_title"><?php echo $board['bo_subject'] ?><span class="sound_only"> 목록</span></h2>
+<h2 id="container_title"><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']) ?><span class="sound_only"> 목록</span></h2>
 
 <!-- 게시판 목록 시작 -->
 <div id="bo_list<?php if ($is_admin) echo "_admin"; ?>">
 
     <?php if ($is_category) { ?>
     <nav id="bo_cate">
-        <h2><?php echo $board['bo_subject'] ?> 카테고리</h2>
+        <h2><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']) ?> 카테고리</h2>
         <ul id="bo_cate_ul">
             <?php echo $category_option ?>
         </ul>

theme/basic/mobile/skin/board/basic/view.skin.php

@@ -8,7 +8,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
 
 <script src="<?php echo G5_JS_URL; ?>/viewimageresize.js"></script>
 
-<div id="bo_v_table"><?php echo $board['bo_subject']; ?></div>
+<div id="bo_v_table"><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']); ?></div>
 
 <article id="bo_v" style="width:<?php echo $width; ?>">
     <header>

theme/basic/mobile/skin/board/gallery/list.skin.php

@@ -8,14 +8,14 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
 
 <script src="<?php echo G5_JS_URL; ?>/jquery.fancylist.js"></script>
 
-<h2 id="container_title"><?php echo $board['bo_subject'] ?><span class="sound_only"> 목록</span></h2>
+<h2 id="container_title"><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']) ?><span class="sound_only"> 목록</span></h2>
 
 <!-- 게시판 목록 시작 -->
 <div id="bo_gall">
 
     <?php if ($is_category) { ?>
     <nav id="bo_cate">
-        <h2><?php echo $board['bo_subject'] ?> 카테고리</h2>
+        <h2><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']) ?> 카테고리</h2>
         <ul id="bo_cate_ul">
             <?php echo $category_option ?>
         </ul>

theme/basic/mobile/skin/board/gallery/view.skin.php

@@ -8,7 +8,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
 
 <script src="<?php echo G5_JS_URL; ?>/viewimageresize.js"></script>
 
-<div id="bo_v_table"><?php echo $board['bo_subject']; ?></div>
+<div id="bo_v_table"><?php echo ($board['bo_mobile_subject'] ? $board['bo_mobile_subject'] : $board['bo_subject']); ?></div>
 
 <article id="bo_v" style="width:<?php echo $width; ?>">
     <header>