5.2.9.3 버전 수정

ip 차단시 접근불가 글씨 깨지는 현상 수정
2017-09-11 11:00:14 +09:00 · 2017-09-11 10:50:58 +09:00 · 2017-09-11 10:47:50 +09:00 · 2017-09-07 10:36:38 +09:00 · 2017-09-07 10:05:35 +09:00 · 2017-09-06 17:07:11 +09:00
610 changed files with 68479 additions and 52234 deletions
@@ -6,7 +6,7 @@ sirgle/
 test.php
 *.key
 *.sh
-cheditor*/
+cheditor5.*/
 ckeditor*/
 log/
 g5_tree/
@@ -2,7 +2,7 @@

 프로그램 명칭 : 그누보드5 ( GNU Board 5 )

-저작자 : (주)에스아이알소프트 http://sir.co.kr
+저작자 : (주)에스아이알소프트 http://sir.kr

 라이센스 (License)

@@ -2,4 +2,8 @@
 define('G5_IS_ADMIN', true);
 include_once ('../common.php');
 include_once(G5_ADMIN_PATH.'/admin.lib.php');
+
+if( isset($token) ){
+    $token = @htmlspecialchars(strip_tags($token), ENT_QUOTES);
+}
 ?>
@@ -1,5 +1,7 @@
 <?php
 if (!defined('_GNUBOARD_')) exit;
+
+$print_version = (defined('G5_IS_SHOP_ADMIN_PAGE') && defined('G5_YOUNGCART_VER')) ? 'Cart Version '.G5_YOUNGCART_VER : 'Version '.G5_GNUBOARD_VER;
 ?>

        <noscript>
@@ -14,14 +16,14 @@ if (!defined('_GNUBOARD_')) exit;

 <footer id="ft">
    <p>
-        Copyright &copy; <?php echo $_SERVER['HTTP_HOST']; ?>. All rights reserved.<br>
+        Copyright &copy; <?php echo $_SERVER['HTTP_HOST']; ?>. All rights reserved. <?php echo $print_version; ?><br>
        <a href="#">상단으로</a>
    </p>
 </footer>

 <!-- <p>실행시간 : <?php echo get_microtime() - $begin_time; ?> -->

-<script src="<?php echo G5_ADMIN_URL ?>/admin.js"></script>
+<script src="<?php echo G5_ADMIN_URL ?>/admin.js?ver=<?php echo G5_JS_VER; ?>"></script>
 <script>
 $(function(){
    var hide_menu = false;
@@ -8,7 +8,7 @@ $g5['title'] = '게시판 복사';
 include_once(G5_PATH.'/head.sub.php');
 ?>

-<script src="<?php echo G5_ADMIN_URL ?>/admin.js"></script>
+<script src="<?php echo G5_ADMIN_URL ?>/admin.js?ver=<?php echo G5_JS_VER; ?>"></script>

 <div class="new_win">
    <h1><?php echo $g5['title']; ?></h1>
@@ -2,6 +2,8 @@
 $sub_menu = '300100';
 include_once('./_common.php');

+check_demo();
+
 auth_check($auth[$sub_menu], 'w');

 check_admin_token();
@@ -35,6 +35,14 @@ if ($file = $_POST['bo_include_tail']) {
    $_POST['bo_include_tail'] = $file;
 }

+if(!is_include_path_check($_POST['bo_include_head'])) {
+    alert('/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.');
+}
+
+if(!is_include_path_check($_POST['bo_include_tail'])) {
+    alert('/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.');
+}
+
 $board_path = G5_DATA_PATH.'/file/'.$bo_table;

 // 게시판 디렉토리 생성
@@ -184,7 +192,7 @@ if ($w == '') {
    // 글수 조정
    /*
        엔피씨님의 팁으로 교체합니다. 130308
-        http://sir.co.kr/bbs/board.php?bo_table=g5_tiptech&wr_id=27207
+        http://sir.kr/g5_tiptech/27207
    */
    if (isset($_POST['proc_count'])) {
        // 원글을 얻습니다.
@@ -63,7 +63,7 @@ $colspan = 15;

 <label for="sfl" class="sound_only">검색대상</label>
 <select name="sfl" id="sfl">
-    <option value="bo_table"<?php echo get_selected($_GET['sfl'], "bo_subject", true); ?>>TABLE</option>
+    <option value="bo_table"<?php echo get_selected($_GET['sfl'], "bo_table", true); ?>>TABLE</option>
    <option value="bo_subject"<?php echo get_selected($_GET['sfl'], "bo_subject"); ?>>제목</option>
    <option value="a.gr_id"<?php echo get_selected($_GET['sfl'], "a.gr_id"); ?>>그룹ID</option>
 </select>
@@ -736,7 +736,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                <select name="cf_cert_hp" id="cf_cert_hp">
                    <?php echo option_selected("",    $config['cf_cert_hp'], "사용안함"); ?>
                    <?php echo option_selected("kcb", $config['cf_cert_hp'], "코리아크레딧뷰로(KCB) 휴대폰 본인확인"); ?>
-                    <?php echo option_selected("kcp", $config['cf_cert_hp'], "한국사이버결제(KCP) 휴대폰 본인확인"); ?>
+                    <?php echo option_selected("kcp", $config['cf_cert_hp'], "NHN KCP 휴대폰 본인확인"); ?>
                    <?php echo option_selected("lg",  $config['cf_cert_hp'], "LG유플러스 휴대폰 본인확인"); ?>
                </select>
            </td>
@@ -745,16 +745,16 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
            <th scope="row" class="cf_cert_service"><label for="cf_cert_kcb_cd">코리아크레딧뷰로<br>KCB 회원사ID</label></th>
            <td class="cf_cert_service">
                <?php echo help('KCB 회원사ID를 입력해 주십시오.<br>서비스에 가입되어 있지 않다면, KCB와 계약체결 후 회원사ID를 발급 받으실 수 있습니다.<br>이용하시려는 서비스에 대한 계약을 아이핀, 휴대폰 본인확인 각각 체결해주셔야 합니다.<br>아이핀 본인확인 테스트의 경우에는 KCB 회원사ID가 필요 없으나,<br>휴대폰 본인확인 테스트의 경우 KCB 에서 따로 발급 받으셔야 합니다.') ?>
-                <input type="text" name="cf_cert_kcb_cd" value="<?php echo $config['cf_cert_kcb_cd'] ?>" id="cf_cert_kcb_cd" class="frm_input" size="20"> <a href="http://sir.co.kr/main/service/b_ipin.php" target="_blank" class="btn_frmline">KCB 아이핀 서비스 신청페이지</a>
-                <a href="http://sir.co.kr/main/service/b_cert.php" target="_blank" class="btn_frmline">KCB 휴대폰 본인확인 서비스 신청페이지</a>
+                <input type="text" name="cf_cert_kcb_cd" value="<?php echo $config['cf_cert_kcb_cd'] ?>" id="cf_cert_kcb_cd" class="frm_input" size="20"> <a href="http://sir.kr/main/service/b_ipin.php" target="_blank" class="btn_frmline">KCB 아이핀 서비스 신청페이지</a>
+                <a href="http://sir.kr/main/service/b_cert.php" target="_blank" class="btn_frmline">KCB 휴대폰 본인확인 서비스 신청페이지</a>
            </td>
        </tr>
        <tr>
-            <th scope="row" class="cf_cert_service"><label for="cf_cert_kcp_cd">한국사이버결제<br>KCP 사이트코드</label></th>
+            <th scope="row" class="cf_cert_service"><label for="cf_cert_kcp_cd">NHN KCP 사이트코드</label></th>
            <td class="cf_cert_service">
                <?php echo help('SM으로 시작하는 5자리 사이트 코드중 뒤의 3자리만 입력해 주십시오.<br>서비스에 가입되어 있지 않다면, 본인확인 서비스 신청페이지에서 서비스 신청 후 사이트코드를 발급 받으실 수 있습니다.') ?>
                <span class="sitecode">SM</span>
-                <input type="text" name="cf_cert_kcp_cd" value="<?php echo $config['cf_cert_kcp_cd'] ?>" id="cf_cert_kcp_cd" class="frm_input" size="3"> <a href="http://sir.co.kr/main/service/p_cert.php" target="_blank" class="btn_frmline">KCP 휴대폰 본인확인 서비스 신청페이지</a>
+                <input type="text" name="cf_cert_kcp_cd" value="<?php echo $config['cf_cert_kcp_cd'] ?>" id="cf_cert_kcp_cd" class="frm_input" size="3"> <a href="http://sir.kr/main/service/p_cert.php" target="_blank" class="btn_frmline">NHN KCP 휴대폰 본인확인 서비스 신청페이지</a>
            </td>
        </tr>
        <tr>
@@ -762,7 +762,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
            <td class="cf_cert_service">
                <?php echo help('LG유플러스 상점아이디 중 si_를 제외한 나머지 아이디만 입력해 주십시오.<br>서비스에 가입되어 있지 않다면, 본인확인 서비스 신청페이지에서 서비스 신청 후 상점아이디를 발급 받으실 수 있습니다.<br><strong>LG유플러스 휴대폰본인확인은 ActiveX 설치가 필요하므로 Internet Explorer 에서만 사용할 수 있습니다.</strong>') ?>
                <span class="sitecode">si_</span>
-                <input type="text" name="cf_lg_mid" value="<?php echo $config['cf_lg_mid'] ?>" id="cf_lg_mid" class="frm_input" size="20"> <a href="http://sir.co.kr/main/service/lg_cert.php" target="_blank" class="btn_frmline">LG유플러스 본인확인 서비스 신청페이지</a>
+                <input type="text" name="cf_lg_mid" value="<?php echo $config['cf_lg_mid'] ?>" id="cf_lg_mid" class="frm_input" size="20"> <a href="http://sir.kr/main/service/lg_cert.php" target="_blank" class="btn_frmline">LG유플러스 본인확인 서비스 신청페이지</a>
            </td>
        </tr>
        <tr>
@@ -1099,7 +1099,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
            <th scope="row">충전 잔액</th>
            <td colspan="3">
                <?php echo number_format($userinfo['coin']); ?> 원.
-                <a href="http://www.icodekorea.com/smsbiz/credit_card_amt.php?icode_id=<?php echo $config['cf_icode_id']; ?>&amp;icode_passwd=<?php echo $config['cf_icode_pw']; ?>" target="_blank" class="btn_frmline" onclick="window.open(this.href,'icode_payment', 'scrollbars=1,resizable=1'); return false;">충전하기</a>
+                <a href="http://www.icodekorea.com/smsbiz/credit_card_amt.php?icode_id=<?php echo $config['cf_icode_id']; ?>&amp;icode_passwd=<?php echo $config['cf_icode_pw']; ?>" target="_blank" class="btn_frmline">충전하기</a>
            </td>
        </tr>
        <?php } ?>
@@ -18,6 +18,18 @@ check_admin_token();
 if ($co_himg_del)  @unlink(G5_DATA_PATH."/content/{$co_id}_h");
 if ($co_timg_del)  @unlink(G5_DATA_PATH."/content/{$co_id}_t");

+$error_msg = '';
+
+if( $co_include_head && ! is_include_path_check($co_include_head) ){
+    $co_include_head = '';
+    $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.';
+}
+
+if( $co_include_tail && ! is_include_path_check($co_include_tail) ){
+    $co_include_tail = '';
+    $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
+}
+
 $sql_common = " co_include_head     = '$co_include_head',
                co_include_tail     = '$co_include_tail',
                co_html             = '$co_html',
@@ -74,7 +86,11 @@ if ($w == "" || $w == "u")
        @chmod($dest_path, G5_FILE_PERMISSION);
    }

-    goto_url("./contentform.php?w=u&amp;co_id=$co_id");
+    if( $error_msg ){
+        alert($error_msg, "./contentform.php?w=u&amp;co_id=$co_id");
+    } else {
+        goto_url("./contentform.php?w=u&amp;co_id=$co_id");
+    }
 }
 else
 {
@@ -311,6 +311,7 @@ tfoot td {font-weight:bold;text-align:center}
 #menu_frm #menu_result {margin:20px 0}

 #menulist .sub_menu_class {padding-left:25px;background:url('../img/sub_menu_ico.gif') 5px 15px no-repeat}
+.exist_menu_link {font-weight:bold;color:red}

 /* 회원관리 목록 */
 .mb_leave_msg {color:#b6b6b6}
@@ -7,6 +7,8 @@ auth_check($auth[$sub_menu], "w");

 $html_title = 'FAQ';

+$fm_id = preg_replace('/[^0-9]/', '', $fm_id);
+
 if ($w == "u")
 {
    $html_title .= ' 수정';
@@ -1,4 +1,4 @@
-<?
+<?php
 $sub_menu = "200100";
 include_once("./_common.php");

@@ -126,6 +126,11 @@ if(!isset($mb['mb_dupinfo'])) {
    sql_query(" ALTER TABLE {$g5['member_table']} ADD `mb_dupinfo` varchar(255) NOT NULL DEFAULT '' AFTER `mb_adult` ", false);
 }

+// 이메일인증 체크 필드추가
+if(!isset($mb['mb_email_certify2'])) {
+    sql_query(" ALTER TABLE {$g5['member_table']} ADD `mb_email_certify2` varchar(255) NOT NULL DEFAULT '' AFTER `mb_email_certify` ", false);
+}
+
 if ($mb['mb_intercept_date']) $g5['title'] = "차단된 ";
 else $g5['title'] .= "";
 $g5['title'] .= '회원 '.$html_title;
@@ -213,7 +218,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
        </td>
    </tr>
    <tr>
-        <th scope="row"><label for="mb_zip1">주소</label></th>
+        <th scope="row">주소</th>
        <td colspan="3" class="td_addr_line">
            <label for="mb_zip" class="sound_only">우편번호</label>
            <input type="text" name="mb_zip" value="<?php echo $mb['mb_zip1'].$mb['mb_zip2']; ?>" id="mb_zip" class="frm_input readonly" size="5" maxlength="6">
@@ -95,6 +95,10 @@ else if ($w == 'u')
    if ($is_admin != 'super' && $mb['mb_level'] >= $member['mb_level'])
        alert('자신보다 권한이 높거나 같은 회원은 수정할 수 없습니다.');

+    if ($is_admin !== 'super' && is_admin($mb['mb_id']) === 'super' ) {
+        alert('최고관리자의 비밀번호를 수정할수 없습니다.');
+    }
+
    if ($_POST['mb_id'] == $member['mb_id'] && $_POST['mb_level'] != $mb['mb_level'])
        alert($mb['mb_id'].' : 로그인 중인 관리자 레벨은 수정 할 수 없습니다.');

@@ -1,4 +1,4 @@
-<?
+<?php
 $sub_menu = "200100";
 include_once("./_common.php");

@@ -43,13 +43,57 @@ $(function() {
        "./menu_form_search.php"
    );

-    $("#me_type").on("change", function() {
-        var type = $(this).val();
+    function link_checks_all_chage(){
+
+        var $links = $(opener.document).find("#menulist input[name='me_link[]']"),
+            $o_link = $(".td_mngsmall input[name='link[]']"),
+            hrefs = [],
+            menu_exist = false;
+           
+        if( $links.length ){
+            $links.each(function( index ) {
+                hrefs.push( $(this).val() );
+            });
+
+            $o_link.each(function( index ) {
+                if( $.inArray( $(this).val(), hrefs ) != -1 ){
+                    $(this).closest("tr").find("td:eq( 0 )").addClass("exist_menu_link");
+                    menu_exist = true;
+                }
+            });
+        }
+
+        if( menu_exist ){
+            $(".menu_exists_tip").show();
+        } else {
+            $(".menu_exists_tip").hide();
+        }
+    }
+
+    function menu_result_change( type ){
+        
+        var dfd = new $.Deferred();

        $("#menu_result").empty().load(
            "./menu_form_search.php",
-            { type : type }
+            { type : type },
+            function(){
+                dfd.resolve('Finished');
+            }
        );
+
+        return dfd.promise();
+    }
+
+    $("#me_type").on("change", function() {
+        var type = $(this).val();
+
+        var promise = menu_result_change( type );
+
+        promise.done(function(message) {
+            link_checks_all_chage(type);
+        });
+
    });

    $(document).on("click", "#add_manual", function() {
@@ -11,7 +11,7 @@ switch($type) {
                    order by gr_order, gr_id ";
        break;
    case 'board':
-        $sql = " select bo_table as id, bo_subject as subject
+        $sql = " select bo_table as id, bo_subject as subject, gr_id
                    from {$g5['board_table']}
                    order by bo_order, bo_table ";
        break;
@@ -32,13 +32,18 @@ if($sql) {

    for($i=0; $row=sql_fetch_array($result); $i++) {
        if($i == 0) {
+
+    $bbs_subject_title = ($type == 'board') ? '게시판제목' : '제목';
 ?>

 <div class="tbl_head01 tbl_wrap">
    <table>
    <thead>
    <tr>
-        <th scope="col">제목</th>
+        <th scope="col"><?php echo $bbs_subject_title; ?></th>
+        <?php if($type == 'board'){ ?>
+            <th scope="col">게시판 그룹</th>
+        <?php } ?>
        <th scope="col">선택</th>
    </tr>
    </thead>
@@ -63,6 +68,12 @@ if($sql) {

    <tr>
        <td><?php echo $row['subject']; ?></td>
+        <?php
+        if($type == 'board'){
+        $group = get_call_func_cache('get_group', array($row['gr_id']));
+        ?>
+        <td><?php echo $group['gr_subject']; ?></td>
+        <?php } ?>
        <td class="td_mngsmall">
            <input type="hidden" name="subject[]" value="<?php echo preg_replace('/[\'\"]/', '', $row['subject']); ?>">
            <input type="hidden" name="link[]" value="<?php echo $link; ?>">
@@ -76,6 +87,10 @@ if($sql) {
    </table>
 </div>

+<div class="local_desc01 menu_exists_tip" style="display:none">
+    <p>* <strong>빨간색</strong>의 제목은 이미 메뉴에 연결되어 경우 표시됩니다.</p>
+</div>
+
 <div class="btn_win02 btn_win">
    <button type="button" class="btn_cancel" onclick="window.close();">창닫기</button>
 </div>
@@ -5,6 +5,8 @@ include_once(G5_EDITOR_LIB);

 auth_check($auth[$sub_menu], "w");

+$nw_id = preg_replace('/[^0-9]/', '', $nw_id);
+
 $html_title = "팝업레이어";
 if ($w == "u")
 {
@@ -4,8 +4,8 @@ include_once('./_common.php');

 auth_check($auth[$sub_menu], 'r');

-if (empty($fr_date)) $fr_date = G5_TIME_YMD;
-if (empty($to_date)) $to_date = G5_TIME_YMD;
+if (empty($fr_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $fr_date) ) $fr_date = G5_TIME_YMD;
+if (empty($to_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $to_date) ) $to_date = G5_TIME_YMD;

 $qstr = "fr_date={$fr_date}{&amp;to_date}={$to_date}";

@@ -8,6 +8,18 @@ auth_check($auth[$sub_menu], 'w');

 check_admin_token();

+$error_msg = '';
+
+if( $qa_include_head && ! is_include_path_check($qa_include_head) ){
+    $qa_include_head = '';
+    $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.';
+}
+
+if( $qa_include_tail && ! is_include_path_check($qa_include_tail) ){
+    $qa_include_tail = '';
+    $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
+}
+
 $sql = " update {$g5['qa_config_table']}
            set qa_title                = '{$_POST['qa_title']}',
                qa_category             = '{$_POST['qa_category']}',
@@ -29,8 +41,8 @@ $sql = " update {$g5['qa_config_table']}
                qa_image_width          = '{$_POST['qa_image_width']}',
                qa_upload_size          = '{$_POST['qa_upload_size']}',
                qa_insert_content       = '{$_POST['qa_insert_content']}',
-                qa_include_head         = '{$_POST['qa_include_head']}',
-                qa_include_tail         = '{$_POST['qa_include_tail']}',
+                qa_include_head         = '{$qa_include_head}',
+                qa_include_tail         = '{$qa_include_tail}',
                qa_content_head         = '{$_POST['qa_content_head']}',
                qa_content_tail         = '{$_POST['qa_content_tail']}',
                qa_mobile_content_head  = '{$_POST['qa_mobile_content_head']}',
@@ -47,5 +59,9 @@ $sql = " update {$g5['qa_config_table']}
                qa_5                    = '{$_POST['qa_5']}' ";
 sql_query($sql);

-goto_url('./qa_config.php');
+if($error_msg){
+    alert($error_msg, './qa_config.php');
+} else {
+    goto_url('./qa_config.php');
+}
 ?>
@@ -19,9 +19,9 @@ include_once('./admin.head.php');
        <p>정보통신망법 23조 2항(주민등록번호의 사용제한)에 따라 기존 주민등록번호 기반의 인증서비스 이용이 불가합니다. 주민등록번호 대체수단으로 최소한의 정보(생년월일, 휴대폰번호, 성별)를 입력받아 본인임을 확인하는 인증수단 입니다</p>

        <ul>
-            <li><a href="http://sir.co.kr/main/service/p_cert.php" target="_blank"><img src="<?php echo G5_ADMIN_URL ?>/img/svc_btn_01.jpg" alt="KCP 휴대폰 본인확인 신청하기"></a></li>
-            <li><a href="http://sir.co.kr/main/service/lg_cert.php" target="_blank"><img src="<?php echo G5_ADMIN_URL ?>/img/svc_btn_02.jpg" alt="LG유플러스 휴대폰대체인증 신청하기"></a></li>
-            <li class="last"><a href="http://sir.co.kr/main/service/b_cert.php" target="_blank"><img src="<?php echo G5_ADMIN_URL ?>/img/svc_btn_03.jpg" alt="OKname 휴대폰 본인확인 신청하기"></a></li>
+            <li><a href="http://sir.kr/main/service/p_cert.php" target="_blank"><img src="<?php echo G5_ADMIN_URL ?>/img/svc_btn_01.jpg" alt="KCP 휴대폰 본인확인 신청하기"></a></li>
+            <li><a href="http://sir.kr/main/service/lg_cert.php" target="_blank"><img src="<?php echo G5_ADMIN_URL ?>/img/svc_btn_02.jpg" alt="LG유플러스 휴대폰대체인증 신청하기"></a></li>
+            <li class="last"><a href="http://sir.kr/main/service/b_cert.php" target="_blank"><img src="<?php echo G5_ADMIN_URL ?>/img/svc_btn_03.jpg" alt="OKname 휴대폰 본인확인 신청하기"></a></li>
        </ul>
    </div>
    <div class="sevice_1">
@@ -30,7 +30,7 @@ include_once('./admin.head.php');
        <p>정부가 주관하는 주민등록번호 대체 수단으로 본인의 개인정보를 아이핀 사이트에 한번만 발급해 놓고, 이후부터는 아이디와 패스워드 만으로
        본인임을 확인하는 인증수단 입니다.</p>

-       <h4><a href="http://sir.co.kr/main/service/b_ipin.php" target="_blank"><img src="<?php echo G5_ADMIN_URL ?>/img/svc_btn_04.jpg" alt="OKname 아이핀 본인확인 신청하기"></a></h4>
+       <h4><a href="http://sir.kr/main/service/b_ipin.php" target="_blank"><img src="<?php echo G5_ADMIN_URL ?>/img/svc_btn_04.jpg" alt="OKname 아이핀 본인확인 신청하기"></a></h4>
    </div>
    <div class="sevice_2">
            <div class="svc_sms">
@@ -40,7 +40,7 @@ include_once('./admin.head.php');
                </div>
                <div class="svc_btn"><a href="http://icodekorea.com/res/join_company_fix_a.php?sellid=sir2" target="_blank"><img src="<?php echo G5_ADMIN_URL ?>/img/svc_btn_05.jpg" alt="아이코드 SMS 서비스 신청하기"></a></div>
            </div>
-            
+
    </div>
 </div>

@@ -12,5 +12,11 @@ if (!strstr($_SERVER['SCRIPT_NAME'], 'install.php')) {
    //$sms5 = sql_fetch("select * from ".$g5['sms5_config_table'] );
 }

+$sv = isset($_REQUEST['sv']) ? get_search_string($_REQUEST['sv']) : '';
+
+if( isset($token) ){
+    $token = @htmlspecialchars(strip_tags($token), ENT_QUOTES);
+}
+
 add_stylesheet('<link rel="stylesheet" href="'.G5_SMS5_ADMIN_URL.'/css/sms5.css">', 0);
 ?>
@@ -83,7 +83,7 @@ if ($config['cf_sms_use'] == 'icode') { // 아이코드 사용
        <th scope="row">충전 잔액</th>
        <td>
            <?php echo number_format($userinfo['coin'])?> 원
-            <input type="button" value="충전하기" class="btn_frmline" onclick="window.open('http://icodekorea.com/company/credit_card_input.php?icode_id=<?php echo $config['cf_icode_id']?>&icode_passwd=<?php echo $config['cf_icode_pw']?>','icode_payment','width=650,height=500')">
+            <a href="http://www.icodekorea.com/smsbiz/credit_card_amt.php?icode_id=<?php echo $config['cf_icode_id']; ?>&amp;icode_passwd=<?php echo $config['cf_icode_pw']; ?>" target="_blank" class="btn_frmline">충전하기</a>
        </td>
    </tr>
    <?php } ?>
@@ -18,6 +18,9 @@ if (is_numeric($fg_no))
 else
    $sql_group = "";

+$st = clean_xss_tags($st);
+$sv = clean_xss_tags($sv);
+
 if ($st == 'all') {
    $sql_search = "and (fo_name like '%{$sv}%' or fo_content like '%{$sv}%')";
 } else if ($st == 'name') {
@@ -60,7 +63,7 @@ function book_all_checked(chk)
 function book_del(fo_no)
 {
    if (confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n그래도 삭제하시겠습니까?"))
-        location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=<?php echo $page?>&fg_no=<?php echo $fg_no?>&st=<?php echo $st?>&sv=<?php echo $sv?>";
+        location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=<?php echo $page?>&fg_no=<?php echo $fg_no?>&st=<?php echo get_text($st); ?>&sv=<?php echo get_text($sv); ?>";
 }

 function multi_update(sel)
@@ -127,7 +130,7 @@ function multi_update(sel)
        <option value="content"<?php echo get_selected('content', $st); ?>>이모티콘</option>
    </select>
    <label for="sv" class="sound_only">검색어<strong class="sound_only"> 필수</strong></label>
-    <input type="text" name="sv" value="<?php echo $sv;?>" id="sv" required class="frm_input required" >
+    <input type="text" name="sv" value="<?php echo get_text($sv) ;?>" id="sv" required class="frm_input required" >
    <input type="submit" value="검색" class="btn_submit">
    </form>
 </div>
@@ -181,7 +184,7 @@ function multi_update(sel)
            <span class="sound_only">등록 </span><?php echo date('Y-m-d', strtotime($res['fo_datetime']))?>
        </div>
        <div class="li_cmd">
-            <a href="./form_write.php?w=u&amp;fo_no=<?php echo $res['fo_no']?>&amp;page=<?php echo $page;?>&amp;fg_no=<?php echo $fg_no;?>&amp;st=<?php echo $st;?>&amp;sv=<?php echo $sv;?>">수정</a>
+            <a href="./form_write.php?w=u&amp;fo_no=<?php echo $res['fo_no']?>&amp;page=<?php echo $page;?>&amp;fg_no=<?php echo $fg_no;?>&amp;st=<?php echo get_text($st);?>&amp;sv=<?php echo get_text($sv);?>">수정</a>
            <a href="javascript:void(book_del('<?php echo $res['fo_no']?>'));">삭제</a>
            <a href="./sms_write.php?fo_no=<?php echo $res['fo_no']?>">보내기</a>
        </div>
@@ -5,8 +5,8 @@ include_once(G5_LIB_PATH.'/visit.lib.php');
 include_once('./admin.head.php');
 include_once(G5_PLUGIN_PATH.'/jquery-ui/datepicker.php');

-if (empty($fr_date)) $fr_date = G5_TIME_YMD;
-if (empty($to_date)) $to_date = G5_TIME_YMD;
+if (empty($fr_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $fr_date) ) $fr_date = G5_TIME_YMD;
+if (empty($to_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $to_date) ) $to_date = G5_TIME_YMD;

 $qstr = "fr_date=".$fr_date."&amp;to_date=".$to_date;
 $query_string = $qstr ? '?'.$qstr : '';
@@ -71,6 +71,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
    </tr>

    <?php
+        $i++;
        }
    } else {
        echo '<tr><td colspan="'.$colspan.'" class="empty_table">자료가 없습니다.</td></tr>';
@@ -72,6 +72,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
    </tr>

    <?php
+        $i++;
        }


@@ -44,7 +44,7 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'">처음</a>'; //페이지 처
    <?php
    $sql_common = " from {$g5['visit_table']} ";
    if ($sfl) {
-        if($sst=='vi_ip' || $sst=='vi_date'){
+        if($sfl=='vi_ip' || $sfl=='vi_date'){
            $sql_search = " where $sfl like '$stx%' ";
        }else{
            $sql_search = " where $sfl like '%$stx%' ";
@@ -14,7 +14,7 @@ add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/plugins/jqplot.categoryAxi
 add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/plugins/jqplot.pointLabels.min.js"></script>', 0);
 add_javascript('<!--[if lt IE 9]><script src="'.G5_PLUGIN_URL.'/jqplot/excanvas.js"></script><![endif]-->', 0);

-if (!($graph == 'line' || $graph == 'bar')) 
+if (!($graph == 'line' || $graph == 'bar'))
    $graph = 'line';

 if ($graph == 'bar') {
@@ -49,7 +49,7 @@ foreach($period_array as $key=>$value) {
        break;
    }
 }
-if (!$is_period) 
+if (!$is_period)
    $period = '오늘';

 $day = $period_array[$period][0];
@@ -64,15 +64,15 @@ if ($period == '오늘') {
    $from = $yesterday;
    $to = $from;
 } else if ($period == '내일') {
-    $from = date('Y-m-d', G5_SERVER_TIME + (86400 * 2)); 
+    $from = date('Y-m-d', G5_SERVER_TIME + (86400 * 2));
    $to = $from;
 } else {
-    $from = date('Y-m-d', G5_SERVER_TIME - (86400 * $period_array[$period][1])); 
+    $from = date('Y-m-d', G5_SERVER_TIME - (86400 * $period_array[$period][1]));
    $to = $yesterday;
 }

 $sql_bo_table = '';
-if ($bo_table) 
+if ($bo_table)
    $sql_bo_table = "and bo_table = '$bo_table'";

 switch ($day) {
@@ -130,7 +130,7 @@ switch ($day) {
    <form>
    <select name="bo_table">
    <option value="">전체게시판</a>
-    <?php 
+    <?php
    $sql = " select bo_table, bo_subject from {$g5['board_table']} order by bo_count_write desc ";
    $result = sql_query($sql);
    for($i=0; $row=sql_fetch_array($result); $i++) {
@@ -179,7 +179,7 @@ $(document).ready(function(){
    var line1 = [<?php echo implode($line1, ','); ?>];
    var line2 = [<?php echo implode($line2, ','); ?>];
    var plot1 = $.jqplot ('chart1', [line1, line2], {
-            seriesDefaults: { 
+            seriesDefaults: {
                <?php if ($graph == 'bar') { ?>
                renderer:$.jqplot.BarRenderer,
                <?php } ?>
@@ -205,6 +205,6 @@ $(document).ready(function(){
 }
 ?>

-<?
+<?php
 include_once ('./admin.tail.php');
 ?>
@@ -0,0 +1,14 @@
+<?php
+include_once('./_common.php');
+include_once(G5_LIB_PATH.'/json.lib.php');
+
+$ss_name = 'ss_comment_token';
+
+set_session($ss_name, '');
+
+$token = _token();
+
+set_session($ss_name, $token);
+
+die(json_encode(array('token'=>$token)));
+?>
@@ -33,6 +33,8 @@ $msg2 = str_replace("\\n", "<br>", $msg);
 $url = clean_xss_tags($url);
 if (!$url) $url = clean_xss_tags($_SERVER['HTTP_REFERER']);

+$url = preg_replace("/[\<\>\'\"\\\'\\\"\(\)]/", "", $url);
+
 // url 체크
 check_url_host($url);

@@ -7,7 +7,11 @@ if (G5_IS_MOBILE) {
    include_once(G5_BBS_PATH.'/_head.php');
    echo stripslashes($board['bo_mobile_content_head']);
 } else {
-    @include ($board['bo_include_head']);
+    if(is_include_path_check($board['bo_include_head'])) {  //파일경로 체크
+        @include ($board['bo_include_head']);
+    } else {    //파일경로가 올바르지 않으면 기본파일을 가져옴
+        include_once(G5_BBS_PATH.'/_head.php');
+    }
    echo stripslashes($board['bo_content_head']);
 }
 ?>
@@ -8,6 +8,10 @@ if (G5_IS_MOBILE) {
    include_once(G5_BBS_PATH.'/_tail.php');
 } else {
    echo stripslashes($board['bo_content_tail']);
-    @include ($board['bo_include_tail']);
+    if(is_include_path_check($board['bo_include_tail'])) {  //파일경로 체크
+        @include ($board['bo_include_tail']);
+    } else {    //파일경로가 올바르지 않으면 기본파일을 가져옴
+        include_once(G5_BBS_PATH.'/_tail.php');
+    }
 }
 ?>
@@ -19,7 +19,7 @@ if (!$co['co_id'])

 $g5['title'] = $co['co_subject'];

-if ($co['co_include_head'])
+if ($co['co_include_head'] && is_include_path_check($co['co_include_head']))
    @include_once($co['co_include_head']);
 else
    include_once('./_head.php');
@@ -85,7 +85,7 @@ if(is_file($skin_file)) {
    echo '<p>'.str_replace(G5_PATH.'/', '', $skin_file).'이 존재하지 않습니다.</p>';
 }

-if ($co['co_include_tail'])
+if ($co['co_include_tail'] && is_include_path_check($co['co_include_tail']))
    @include_once($co['co_include_tail']);
 else
    include_once('./_tail.php');
@@ -1,11 +1,11 @@
 <?php
 include_once('./_common.php');

-if ($is_admin)
-{
-    if (!($token && get_session('ss_delete_token') == $token))
-        alert('토큰 에러로 삭제 불가합니다.');
-}
+$delete_token = get_session('ss_delete_token');
+set_session('ss_delete_token', '');
+
+if (!($token && $delete_token == $token))
+    alert('토큰 에러로 삭제 불가합니다.');

 //$wr = sql_fetch(" select * from $write_table where wr_id = '$wr_id' ");

@@ -134,5 +134,5 @@ if ($count_write > 0 || $count_comment > 0)

 delete_cache_latest($bo_table);

-goto_url('./board.php?bo_table='.$bo_table.'&amp;page='.$page.$qstr);
+goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;page='.$page.$qstr);
 ?>
@@ -156,5 +156,5 @@ if ($count_write > 0 || $count_comment > 0)

 delete_cache_latest($bo_table);

-goto_url('./board.php?bo_table='.$bo_table.'&amp;page='.$page.$qstr);
+goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;page='.$page.$qstr);
 ?>
@@ -2,11 +2,11 @@
 // 코멘트 삭제
 include_once('./_common.php');

-if ($is_admin)
-{
-    if (!($token && get_session("ss_delete_token") == $token))
-        alert('토큰 에러로 삭제 불가합니다.');
-}
+$delete_comment_token = get_session('ss_delete_comment_'.$comment_id.'_token');
+set_session('ss_delete_comment_'.$comment_id.'_token', '');
+
+if (!($token && $delete_comment_token == $token))
+    alert('토큰 에러로 삭제 불가합니다.');

 // 4.1
@include_once($board_skin_path.'/delete_comment.head.skin.php');
@@ -84,5 +84,5 @@ sql_query(" delete from {$g5['board_new_table']} where bo_table = '{$bo_table}'

 delete_cache_latest($bo_table);

-goto_url('./board.php?bo_table='.$bo_table.'&amp;wr_id='.$write['wr_parent'].'&amp;page='.$page. $qstr);
+goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$write['wr_parent'].'&amp;page='.$page. $qstr);
 ?>
@@ -1,20 +1,29 @@
 <?php
 include_once('./_common.php');

-$sql = " select mb_id, mb_email, mb_datetime from {$g5['member_table']} where mb_id = '{$mb_id}' ";
+$mb_id  = trim($_GET['mb_id']);
+$mb_md5 = trim($_GET['mb_md5']);
+
+$sql = " select mb_id, mb_email_certify2 from {$g5['member_table']} where mb_id = '{$mb_id}' ";
 $row = sql_fetch($sql);
 if (!$row['mb_id'])
    alert('존재하는 회원이 아닙니다.', G5_URL);

+// 인증 링크는 한번만 처리가 되게 한다.
+sql_query(" update {$g5['member_table']} set mb_email_certify2 = '' where mb_id = '$mb_id' ");
+
 if ($mb_md5)
 {
-    $tmp_md5 = md5($row['mb_id'].$row['mb_email'].$row['mb_datetime']);
-    if ($mb_md5 == $tmp_md5)
+    if ($mb_md5 == $row['mb_email_certify2'])
    {
        sql_query(" update {$g5['member_table']} set mb_email_certify = '".G5_TIME_YMDHIS."' where mb_id = '{$mb_id}' ");

        alert("메일인증 처리를 완료 하였습니다.\\n\\n지금부터 {$mb_id} 아이디로 로그인 가능합니다.", G5_URL);
    }
+    else
+    {
+        alert('메일인증 요청 정보가 올바르지 않습니다.', G5_URL);
+    }
 }

 alert('제대로 된 값이 넘어오지 않았습니다.', G5_URL);
@@ -28,8 +28,17 @@ if ($sendmail_count > 3)
 $g5['title'] = '메일 쓰기';
 include_once(G5_PATH.'/head.sub.php');

+$email_enc = new str_encrypt();
+$email_dec = $email_enc->decrypt($email);
+
+$email = get_email_address($email_dec);
+if(!$email)
+    alert_close('이메일이 올바르지 않습니다.');
+
+$email = $email_enc->encrypt($email);
+
 if (!$name)
-    $name = base64_decode($email);
+    $name = $email;
 else
    $name = get_text(stripslashes($name), true);

@@ -9,7 +9,8 @@ if (!$config['cf_email_use'])
 if (!$is_member && $config['cf_formmail_is_member'])
    alert_close('회원만 이용하실 수 있습니다.');

-$to = base64_decode($to);
+$email_enc = new str_encrypt();
+$to = $email_enc->decrypt($to);

 if (substr_count($to, "@") > 1)
    alert_close('한번에 한사람에게만 메일을 발송할 수 있습니다.');
@@ -46,7 +46,7 @@ if ($sca || $stx) {
    $sql_search .= " and (wr_num between {$spt} and ({$spt} + {$config['cf_search_part']})) ";

    // 원글만 얻는다. (코멘트의 내용도 검색하기 위함)
-    // 라엘님 제안 코드로 대체 http://sir.co.kr/bbs/board.php?bo_table=g5_bug&wr_id=2922
+    // 라엘님 제안 코드로 대체 http://sir.kr/g5_bug/2922
    $sql = " SELECT COUNT(DISTINCT `wr_parent`) AS `cnt` FROM {$write_table} WHERE {$sql_search} ";
    $row = sql_fetch($sql);
    $total_count = $row['cnt'];
@@ -31,7 +31,8 @@ if ($mb['mb_leave_date'] && $mb['mb_leave_date'] <= date("Ymd", G5_SERVER_TIME))
 }

 if ($config['cf_use_email_certify'] && !preg_match("/[1-9]/", $mb['mb_email_certify'])) {
-    confirm("{$mb['mb_email']} 메일로 메일인증을 받으셔야 로그인 가능합니다. 다른 메일주소로 변경하여 인증하시려면 취소를 클릭하시기 바랍니다.", G5_URL, G5_BBS_URL.'/register_email.php?mb_id='.$mb_id);
+    $ckey = md5($mb['mb_ip'].$mb['mb_datetime']);
+    confirm("{$mb['mb_email']} 메일로 메일인증을 받으셔야 로그인 가능합니다. 다른 메일주소로 변경하여 인증하시려면 취소를 클릭하시기 바랍니다.", G5_URL, G5_BBS_URL.'/register_email.php?mb_id='.$mb_id.'&ckey='.$ckey);
 }

@include_once($member_skin_path.'/login_check.skin.php');
@@ -19,6 +19,8 @@ $url = clean_xss_tags($_GET['url']);
 // url 체크
 check_url_host($url);

+$url = get_text($url);
+
 include_once($member_skin_path.'/member_confirm.skin.php');

 include_once('./_tail.sub.php');
@@ -19,6 +19,8 @@ $save_count_write = 0;
 $save_count_comment = 0;
 $cnt = 0;

+$wr_id_list = preg_replace('/[^0-9\,]/', '', $_POST['wr_id_list']);
+
 $sql = " select distinct wr_num from $write_table where wr_id in ({$wr_id_list}) order by wr_id ";
 $result = sql_query($sql);
 while ($row = sql_fetch_array($result))
@@ -5,34 +5,36 @@ $g5['title'] = '비밀번호 입력';

 switch ($w) {
    case 'u' :
-        $action = './write.php';
-        $return_url = './board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id;
+        $action = G5_HTTP_BBS_URL.'/write.php';
+        $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id;
        break;
    case 'd' :
-        $action = './delete.php';
-        $return_url = './board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id;
+        set_session('ss_delete_token', $token = uniqid(time()));
+        $action = https_url(G5_BBS_DIR).'/delete.php?token='.$token;
+        $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id;
        break;
    case 'x' :
-        $action = './delete_comment.php';
+        set_session('ss_delete_comment_'.$comment_id.'_token', $token = uniqid(time()));
+        $action = https_url(G5_BBS_DIR).'/delete_comment.php?token='.$token;
        $row = sql_fetch(" select wr_parent from $write_table where wr_id = '$comment_id' ");
-        $return_url = './board.php?bo_table='.$bo_table.'&amp;wr_id='.$row['wr_parent'];
+        $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$row['wr_parent'];
        break;
    case 's' :
        // 비밀번호 창에서 로그인 하는 경우 관리자 또는 자신의 글이면 바로 글보기로 감
        if ($is_admin || ($member['mb_id'] == $write['mb_id'] && $write['mb_id']))
-            goto_url('./board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id);
+            goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id);
        else {
-            $action = './password_check.php';
-            $return_url = './board.php?bo_table='.$bo_table;
+            $action = https_url(G5_BBS_DIR).'/password_check.php';
+            $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table;
        }
        break;
    case 'sc' :
        // 비밀번호 창에서 로그인 하는 경우 관리자 또는 자신의 글이면 바로 글보기로 감
        if ($is_admin || ($member['mb_id'] == $write['mb_id'] && $write['mb_id']))
-            goto_url('./board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id);
+            goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id);
        else {
-            $action = './password_check.php';
-            $return_url = './board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id;
+            $action = https_url(G5_BBS_DIR).'/password_check.php';
+            $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id;
        }
        break;
    default :
@@ -31,5 +31,5 @@ if ($w == 's') {
 } else
    alert('w 값이 제대로 넘어오지 않았습니다.');

-goto_url('./board.php?'.$qstr);
+goto_url(G5_HTTP_BBS_URL.'/board.php?'.$qstr);
 ?>
@@ -29,6 +29,10 @@ for($i=0; $i<$count; $i++) {
    if($is_admin != 'super' && $row['mb_id'] != $member['mb_id'])
        continue;

+    // 답변이 달린 글은 삭제못함
+    if($is_admin != 'super' && !$row['qa_type'] && $row['qa_status'])
+        continue;
+
    // 첨부파일 삭제
    for($k=1; $k<=2; $k++) {
        @unlink(G5_DATA_PATH.'/qa/'.$row['qa_file'.$k]);
@@ -9,7 +9,7 @@ if (G5_IS_MOBILE) {
    include_once('./_head.php');
    echo conv_content($qaconfig['qa_mobile_content_head'], 1);
 } else {
-    if($qaconfig['qa_include_head'])
+    if($qaconfig['qa_include_head'] && is_include_path_check($qaconfig['qa_include_head']))
        @include ($qaconfig['qa_include_head']);
    else
        include ('./_head.php');
@@ -110,7 +110,7 @@ if(is_file($skin_file)) {
    $list_href = G5_BBS_URL.'/qalist.php';
    $write_href = G5_BBS_URL.'/qawrite.php';

-    $list_pages = preg_replace('/(\.php)(&amp;|&)/i', '$1?', get_paging(G5_IS_MOBILE ? $qaconfig['qa_mobile_page_rows'] : $qaconfig['qa_page_rows'], $page, $total_page, './qalist.php'.$qstr.'&amp;page='));
+    $list_pages = preg_replace('/(\.php)(&amp;|&)/i', '$1?', get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $page, $total_page, './qalist.php'.$qstr.'&amp;page='));

    $stx = get_text(stripslashes($stx));
    include_once($skin_file);
@@ -7,7 +7,7 @@ if (G5_IS_MOBILE) {
    include_once('./_tail.php');
 } else {
    echo conv_content($qaconfig['qa_content_tail'], 1);
-    if($qaconfig['qa_include_tail'])
+    if($qaconfig['qa_include_tail'] && is_include_path_check($qaconfig['qa_include_tail']))
        @include ($qaconfig['qa_include_tail']);
    else
        include ('./_tail.php');
@@ -76,7 +76,10 @@ if(is_file($skin_file)) {

        $content .= get_text($write['qa_content'], 0);
    } else {
-        $content = get_text($write['qa_content'], 0);
+        //$content = get_text($write['qa_content'], 0);
+        
+        // KISA 취약점 권고사항 Stored XSS
+        $content = get_text(html_purifier($write['qa_content']), 0);
    }

    $editor_html = editor_html('qa_content', $content, $is_dhtml_editor);
@@ -15,16 +15,23 @@ $msg = array();
 // 1:1문의 설정값
 $qaconfig = get_qa_config();

+if(trim($qaconfig['qa_category'])) {
+    if($w != 'a') {
+        $category = explode('|', $qaconfig['qa_category']);
+        if(!in_array($qa_category, $category))
+            alert('분류를 올바르게 지정해 주십시오.');
+    }
+} else {
+    alert('1:1문의 설정에서 분류를 설정해 주십시오');
+}
+
 // e-mail 체크
-if(isset($_POST['qa_email']) && $qa_email) {
+$qa_email = '';
+if(isset($_POST['qa_email']) && $_POST['qa_email'])
    $qa_email = get_email_address(trim($_POST['qa_email']));

-    if($qaconfig['qa_req_email'] && !$qa_email)
-        $msg[] = '이메일을 입력하세요.';
-
-    if (!preg_match("/([0-9a-zA-Z_-]+)@([0-9a-zA-Z_-]+)\.([0-9a-zA-Z_-]+)/", $qa_email))
-        $msg[] = '이메일 주소가 형식에 맞지 않습니다.';
-}
+if($w != 'a' && $qaconfig['qa_req_email'] && !$qa_email)
+    $msg[] = '이메일을 입력하세요.';

 $qa_subject = '';
 if (isset($_POST['qa_subject'])) {
@@ -105,6 +112,18 @@ if($w == 'u' || $w == 'a' || $w == 'r') {
    }
 }

+// 파일개수 체크
+$file_count   = 0;
+$upload_count = count($_FILES['bf_file']['name']);
+
+for ($i=1; $i<=$upload_count; $i++) {
+    if($_FILES['bf_file']['name'][$i] && is_uploaded_file($_FILES['bf_file']['tmp_name'][$i]))
+        $file_count++;
+}
+
+if($file_count > 2)
+    alert('첨부파일을 2개 이하로 업로드 해주십시오.');
+
 // 디렉토리가 없다면 생성합니다. (퍼미션도 변경하구요.)
@mkdir(G5_DATA_PATH.'/qa', G5_DIR_PERMISSION);
@chmod(G5_DATA_PATH.'/qa', G5_DIR_PERMISSION);
@@ -403,7 +422,7 @@ if($w == 'a' && $write['qa_email_recv'] && trim($write['qa_email'])) {
    include_once(G5_LIB_PATH.'/mailer.lib.php');

    $subject = $config['cf_title'].' '.$qaconfig['qa_title'].' 답변 알림 메일';
-    $content = nl2br(conv_unescape_nl($qa_content));
+    $content = nl2br(conv_unescape_nl(stripslashes($qa_content)));

    mailer($config['cf_admin_email_name'], $config['cf_admin_email'], $write['qa_email'], $subject, $content, 1);
 }
@@ -413,7 +432,7 @@ if(($w == '' || $w == 'r') && trim($qaconfig['qa_admin_email'])) {
    include_once(G5_LIB_PATH.'/mailer.lib.php');

    $subject = $config['cf_title'].' '.$qaconfig['qa_title'].' 질문 알림 메일';
-    $content = nl2br(conv_unescape_nl($qa_content));
+    $content = nl2br(conv_unescape_nl(stripslashes($qa_content)));

    mailer($config['cf_admin_email_name'], $qa_email, $qaconfig['qa_admin_email'], $subject, $content, 1);
 }
@@ -6,11 +6,17 @@ $g5['title'] = '메일인증 메일주소 변경';
 include_once('./_head.php');

 $mb_id = substr(clean_xss_tags($_GET['mb_id']), 0, 20);
-$sql = " select mb_email, mb_datetime, mb_email_certify from {$g5['member_table']} where mb_id = '{$mb_id}' ";
+$sql = " select mb_email, mb_datetime, mb_ip, mb_email_certify from {$g5['member_table']} where mb_id = '{$mb_id}' ";
 $mb = sql_fetch($sql);
 if (substr($mb['mb_email_certify'],0,1)!=0) {
    alert("이미 메일인증 하신 회원입니다.", G5_URL);
 }
+
+$ckey = trim($_GET['ckey']);
+$key  = md5($mb['mb_ip'].$mb['mb_datetime']);
+
+if(!$ckey || $ckey != $key)
+    alert('올바른 방법으로 이용해 주십시오.', G5_URL);
 ?>

 <p class="rg_em_p">메일인증을 받지 못한 경우 회원정보의 메일주소를 변경 할 수 있습니다.</p>
@@ -3,12 +3,15 @@ include_once('./_common.php');
 include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 include_once(G5_LIB_PATH.'/mailer.lib.php');

-$mb_id    = trim($_POST['mb_id']);
-$mb_email = trim($_POST['mb_email']);
+$mb_id = substr(clean_xss_tags($_POST['mb_id']), 0, 20);
+$mb_email = get_email_address(trim($_POST['mb_email']));

-$sql = " select mb_name, mb_datetime from {$g5['member_table']} where mb_id = '{$mb_id}' and mb_email_certify <> '' ";
+if(!$mb_id || !$mb_email)
+    alert('올바른 방법으로 이용해 주십시오.', G5_URL);
+
+$sql = " select mb_name from {$g5['member_table']} where mb_id = '{$mb_id}' and substring(mb_email_certify, 1, 1) = '0' ";
 $mb = sql_fetch($sql);
-if ($mb) {
+if (!$mb) {
    alert("이미 메일인증 하신 회원입니다.", G5_URL);
 }

@@ -26,8 +29,12 @@ if ($row['cnt']) {
 $subject = '['.$config['cf_title'].'] 인증확인 메일입니다.';

 $mb_name = $mb['mb_name'];
-$mb_datetime = $mb['mb_datetime'] ? $mb['mb_datetime'] : G5_TIME_YMDHIS;
-$mb_md5 = md5($mb_id.$mb_email.$mb_datetime);
+
+// 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용
+$mb_md5 = md5(pack('V*', rand(), rand(), rand(), rand()));
+
+sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' ");
+
 $certify_href = G5_BBS_URL.'/email_certify.php?mb_id='.$mb_id.'&amp;mb_md5='.$mb_md5;

 ob_start();
@@ -253,8 +253,12 @@ if ($w == '') {
    if ($config['cf_email_mb_member']) {
        $subject = '['.$config['cf_title'].'] 회원가입을 축하드립니다.';

-        $mb_md5 = md5($mb_id.$mb_email.G5_TIME_YMDHIS);
-        $certify_href = G5_BBS_URL.'/email_certify.php?mb_id='.$mb_id.'&amp;mb_md5='.$mb_md5;
+        // 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용
+        if ($config['cf_use_email_certify']) {
+            $mb_md5 = md5(pack('V*', rand(), rand(), rand(), rand()));
+            sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' ");
+            $certify_href = G5_BBS_URL.'/email_certify.php?mb_id='.$mb_id.'&amp;mb_md5='.$mb_md5;
+        }

        ob_start();
        include_once ('./register_form_update_mail1.php');
@@ -396,8 +400,11 @@ if (isset($_FILES['mb_icon']) && is_uploaded_file($_FILES['mb_icon']['tmp_name']
 if ($config['cf_use_email_certify'] && $old_email != $mb_email) {
    $subject = '['.$config['cf_title'].'] 인증확인 메일입니다.';

-    $mb_datetime = $member['mb_datetime'] ? $member['mb_datetime'] : G5_TIME_YMDHIS;
-    $mb_md5 = md5($mb_id.$mb_email.$mb_datetime);
+    // 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용
+    $mb_md5 = md5(pack('V*', rand(), rand(), rand(), rand()));
+
+    sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' ");
+
    $certify_href = G5_BBS_URL.'/email_certify.php?mb_id='.$mb_id.'&amp;mb_md5='.$mb_md5;

    ob_start();
@@ -405,7 +412,7 @@ if ($config['cf_use_email_certify'] && $old_email != $mb_email) {
    $content = ob_get_contents();
    ob_end_clean();

-    mailer($config['cf_title'], $config['cf_admin_email'], $mb_email, $subject, $content, 1);
+    mailer($config['cf_admin_email_name'], $config['cf_admin_email'], $mb_email, $subject, $content, 1);
 }


@@ -10,6 +10,10 @@ if (!$is_member)
    exit;
 }

+// 게시글 존재하는지
+if(!$write['wr_id'])
+    alert_close('스크랩하시려는 게시글이 존재하지 않습니다.');
+
 $sql = " select count(*) as cnt from {$g5['scrap_table']}
            where mb_id = '{$member['mb_id']}'
            and bo_table = '$bo_table'
@@ -54,15 +54,19 @@ if ($stx) {
        $g5_search['read_level'][] = $row['bo_read_level'];
    }

-    $search_query = 'sfl='.urlencode($sfl).'&amp;stx='.urlencode($stx).'&amp;sop='.$sop;
-
-
-    $text_stx = get_text(stripslashes($stx));
-
    $op1 = '';

    // 검색어를 구분자로 나눈다. 여기서는 공백
    $s = explode(' ', strip_tags($stx));
+    
+    if( count($s) > 1 ){
+        $s = array_slice($s, 0, 2);
+        $stx = implode(' ', $s);
+    }
+
+    $text_stx = get_text(stripslashes($stx));
+    
+    $search_query = 'sfl='.urlencode($sfl).'&amp;stx='.urlencode($stx).'&amp;sop='.$sop;

    // 검색필드를 구분자로 나눈다. 여기서는 +
    $field = explode('||', trim($sfl));
@@ -233,4 +237,4 @@ if (!$sop) $sop = 'or';
 include_once($search_skin_path.'/search.skin.php');

 include_once('./_tail.php');
-?>
+?>
@@ -72,12 +72,8 @@ $update_href = $delete_href = '';
 // 로그인중이고 자신의 글이라면 또는 관리자라면 비밀번호를 묻지 않고 바로 수정, 삭제 가능
 if (($member['mb_id'] && ($member['mb_id'] == $write['mb_id'])) || $is_admin) {
    $update_href = './write.php?w=u&amp;bo_table='.$bo_table.'&amp;wr_id='.$wr_id.'&amp;page='.$page.$qstr;
-    $delete_href = './delete.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id.'&amp;page='.$page.urldecode($qstr);
-    if ($is_admin)
-    {
-        set_session("ss_delete_token", $token = uniqid(time()));
-        $delete_href ='./delete.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id.'&amp;token='.$token.'&amp;page='.$page.urldecode($qstr);
-    }
+    set_session('ss_delete_token', $token = uniqid(time()));
+    $delete_href ='./delete.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id.'&amp;token='.$token.'&amp;page='.$page.urldecode($qstr);
 }
 else if (!$write['mb_id']) { // 회원이 쓴 글이 아니라면
    $update_href = './password.php?w=u&amp;bo_table='.$bo_table.'&amp;wr_id='.$wr_id.'&amp;page='.$page.$qstr;
@@ -9,11 +9,6 @@ if ($is_guest && $board['bo_comment_level'] < 2) {

@include_once($board_skin_path.'/view_comment.head.skin.php');

-// 코멘트를 새창으로 여는 경우 세션값이 없으므로 생성한다.
-if ($is_admin && !$token) {
-    set_session("ss_delete_token", $token = uniqid(time()));
-}
-
 $list = array();

 $is_comment_write = false;
@@ -72,10 +67,13 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
    $list[$i]['is_del']  = false;
    if ($is_comment_write || $is_admin)
    {
+        $token = '';
+
        if ($member['mb_id'])
        {
            if ($row['mb_id'] == $member['mb_id'] || $is_admin)
            {
+                set_session('ss_delete_comment_'.$row['wr_id'].'_token', $token = uniqid(time()));
                $list[$i]['del_link']  = './delete_comment.php?bo_table='.$bo_table.'&amp;comment_id='.$row['wr_id'].'&amp;token='.$token.'&amp;page='.$page.$qstr;
                $list[$i]['is_edit']   = true;
                $list[$i]['is_del']    = true;
@@ -120,6 +118,8 @@ else
    $comment_max = (int)$board['bo_comment_max'];
 }

+$comment_action_url = https_url(G5_BBS_DIR)."/write_comment_update.php";
+
 include_once($board_skin_path.'/view_comment.skin.php');

 if (!$member['mb_id']) // 비회원일 경우에만
@@ -337,6 +337,8 @@ if ($w == '') {
    }

    $file = get_file($bo_table, $wr_id);
+    if($file_count < $file['count'])
+        $file_count = $file['count'];
 } else if ($w == 'r') {
    if (strstr($write['wr_option'], 'secret')) {
        $is_secret = true;
@@ -399,6 +401,11 @@ if(!is_mobile() || defined('G5_IS_MOBILE_DHTML_USE') && G5_IS_MOBILE_DHTML_USE)
 if ($config['cf_editor'] && $is_dhtml_editor_use && $board['bo_use_dhtml_editor'] && $member['mb_level'] >= $board['bo_html_level']) {
    $is_dhtml_editor = true;

+    if ( $w == 'u' && (! $is_member || ! $is_admin || $write['mb_id'] !== $member['mb_id']) ){
+        // kisa 취약점 제보 xss 필터 적용
+        $content = get_text(html_purifier($write['wr_content']), 0);
+    }
+
    if(is_file(G5_EDITOR_PATH.'/'.$config['cf_editor'].'/autosave.editor.js'))
        $editor_content_js = '<script src="'.G5_EDITOR_URL.'/'.$config['cf_editor'].'/autosave.editor.js"></script>'.PHP_EOL;
 }
@@ -3,6 +3,12 @@ define('G5_CAPTCHA', true);
 include_once('./_common.php');
 include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');

+// 토큰체크
+$comment_token = trim(get_session('ss_comment_token'));
+set_session('ss_comment_token', '');
+if(!trim($_POST['token']) || !$comment_token || $comment_token != $_POST['token'])
+    alert('올바른 방법으로 이용해 주십시오.');
+
 // 090710
 if (substr_count($wr_content, "&#") > 50) {
    alert('내용에 올바르지 않은 코드가 다수 포함되어 있습니다.');
@@ -77,12 +83,15 @@ if ($w == 'c') // 댓글 입력
    // 댓글 답변
    if ($comment_id)
    {
-        $sql = " select wr_id, wr_comment, wr_comment_reply from $write_table
+        $sql = " select wr_id, wr_parent, wr_comment, wr_comment_reply from $write_table
                    where wr_id = '$comment_id' ";
        $reply_array = sql_fetch($sql);
        if (!$reply_array['wr_id'])
            alert('답변할 댓글이 없습니다.\\n\\n답변하는 동안 댓글이 삭제되었을 수 있습니다.');

+        if($wr['wr_parent'] != $reply_array['wr_parent'])
+            alert('댓글을 등록할 수 없습니다.');
+
        $tmp_comment = $reply_array['wr_comment'];

        if (strlen($reply_array['wr_comment_reply']) == 5)
@@ -328,5 +337,5 @@ else if ($w == 'cu') // 댓글 수정

 delete_cache_latest($bo_table);

-goto_url('./board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr['wr_parent'].'&amp;'.$qstr.'&amp;#c_'.$comment_id);
+goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr['wr_parent'].'&amp;'.$qstr.'&amp;#c_'.$comment_id);
 ?>
@@ -0,0 +1,13 @@
+<?php
+include_once('./_common.php');
+include_once(G5_LIB_PATH.'/json.lib.php');
+
+if(!$bo_table)
+   die(json_encode(array('error'=>'게시판 정보가 올바르지 않습니다.', 'url'=>G5_URL)));
+
+set_session('ss_write_'.$bo_table.'_token', '');
+
+$token = get_write_token($bo_table);
+
+die(json_encode(array('error'=>'', 'token'=>$token, 'url'=>'')));
+?>
@@ -3,10 +3,29 @@ include_once('./_common.php');
 include_once(G5_LIB_PATH.'/naver_syndi.lib.php');
 include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');

+// 토큰체크
+check_write_token($bo_table);
+
 $g5['title'] = '게시글 저장';

 $msg = array();

+if($board['bo_use_category']) {
+    $ca_name = trim($_POST['ca_name']);
+    if(!$ca_name) {
+        $msg[] = '<strong>분류</strong>를 선택하세요.';
+    } else {
+        $categories = array_map('trim', explode("|", $board['bo_category_list'].($is_admin ? '|공지' : '')));
+        if(!empty($categories) && !in_array($ca_name, $categories))
+            $msg[] = '분류를 올바르게 입력하세요.';
+
+        if(empty($categories))
+            $ca_name = '';
+    }
+} else {
+    $ca_name = '';
+}
+
 $wr_subject = '';
 if (isset($_POST['wr_subject'])) {
    $wr_subject = substr(trim($_POST['wr_subject']),0,255);
@@ -66,10 +85,16 @@ if ($w == 'u' || $w == 'r') {
 }

 // 외부에서 글을 등록할 수 있는 버그가 존재하므로 비밀글은 사용일 경우에만 가능해야 함
-if (!$is_admin && !$board['bo_use_secret'] && $secret) {
+if (!$is_admin && !$board['bo_use_secret'] && (stripos($_POST['html'], 'secret') !== false || stripos($_POST['secret'], 'secret') !== false || stripos($_POST['mail'], 'secret') !== false)) {
 	alert('비밀글 미사용 게시판 이므로 비밀글로 등록할 수 없습니다.');
 }

+$secret = '';
+if (isset($_POST['secret']) && $_POST['secret']) {
+    if(preg_match('#secret#', strtolower($_POST['secret']), $matches))
+        $secret = $matches[0];
+}
+
 // 외부에서 글을 등록할 수 있는 버그가 존재하므로 비밀글 무조건 사용일때는 관리자를 제외(공지)하고 무조건 비밀글로 등록
 if (!$is_admin && $board['bo_use_secret'] == 2) {
    $secret = 'secret';
@@ -77,12 +102,14 @@ if (!$is_admin && $board['bo_use_secret'] == 2) {

 $html = '';
 if (isset($_POST['html']) && $_POST['html']) {
-    $html = $_POST['html'];
+    if(preg_match('#html(1|2)#', strtolower($_POST['html']), $matches))
+        $html = $matches[0];
 }

 $mail = '';
 if (isset($_POST['mail']) && $_POST['mail']) {
-    $mail = $_POST['mail'];
+    if(preg_match('#mail#', strtolower($_POST['mail']), $matches))
+        $mail = $matches[0];
 }

 $notice = '';
@@ -391,6 +418,24 @@ if (!$group['gr_use_access'] && $board['bo_read_level'] < 2 && !$secret) {
    naver_syndi_ping($bo_table, $wr_id);
 }

+// 파일개수 체크
+$file_count   = 0;
+$upload_count = count($_FILES['bf_file']['name']);
+
+for ($i=0; $i<$upload_count; $i++) {
+    if($_FILES['bf_file']['name'][$i] && is_uploaded_file($_FILES['bf_file']['tmp_name'][$i]))
+        $file_count++;
+}
+
+if($w == 'u') {
+    $file = get_file($bo_table, $wr_id);
+    if($file_count && (int)$file['count'] > $board['bo_upload_count'])
+        alert('기존 파일을 삭제하신 후 첨부파일을 '.number_format($board['bo_upload_count']).'개 이하로 업로드 해주십시오.');
+} else {
+    if($file_count > $board['bo_upload_count'])
+        alert('첨부파일을 '.number_format($board['bo_upload_count']).'개 이하로 업로드 해주십시오.');
+}
+
 // 디렉토리가 없다면 생성합니다. (퍼미션도 변경하구요.)
@mkdir(G5_DATA_PATH.'/file/'.$bo_table, G5_DIR_PERMISSION);
@chmod(G5_DATA_PATH.'/file/'.$bo_table, G5_DIR_PERMISSION);
@@ -596,7 +641,7 @@ if (!($w == 'u' || $w == 'cu') && $config['cf_email_use'] && $board['bo_use_emai
    else if (strstr($html, 'html2'))
        $tmp_html = 2;

-    $wr_content = conv_content(conv_unescape_nl($wr_content), $tmp_html);
+    $wr_content = conv_content(conv_unescape_nl(stripslashes($wr_content)), $tmp_html);

    $warr = array( ''=>'입력', 'u'=>'수정', 'r'=>'답변', 'c'=>'코멘트', 'cu'=>'코멘트 수정' );
    $str = $warr[$w];
@@ -647,7 +692,7 @@ if (!($w == 'u' || $w == 'cu') && $config['cf_email_use'] && $board['bo_use_emai
 delete_cache_latest($bo_table);

 if ($file_upload_msg)
-    alert($file_upload_msg, G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id.'&amp;page='.$page.$qstr);
+    alert($file_upload_msg, G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id.$qstr);
 else
    goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id.$qstr);
 ?>
@@ -32,13 +32,15 @@ function g5_path()
    $result['path'] = str_replace('\\', '/', dirname(__FILE__));
    $tilde_remove = preg_replace('/^\/\~[^\/]+(.*)$/', '$1', $_SERVER['SCRIPT_NAME']);
    $document_root = str_replace($tilde_remove, '', $_SERVER['SCRIPT_FILENAME']);
-    $root = str_replace($document_root, '', $result['path']);
-    $port = $_SERVER['SERVER_PORT'] != 80 ? ':'.$_SERVER['SERVER_PORT'] : '';
+    $pattern = '/' . preg_quote($document_root, '/') . '/i';
+    $root = preg_replace($pattern, '', $result['path']);
+    $port = ($_SERVER['SERVER_PORT'] == 80 || $_SERVER['SERVER_PORT'] == 443) ? '' : ':'.$_SERVER['SERVER_PORT'];
    $http = 'http' . ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ? 's' : '') . '://';
-    $user = str_replace(str_replace($document_root, '', $_SERVER['SCRIPT_FILENAME']), '', $_SERVER['SCRIPT_NAME']);
+    $user = str_replace(preg_replace($pattern, '', $_SERVER['SCRIPT_FILENAME']), '', $_SERVER['SCRIPT_NAME']);
    $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME'];
    if(isset($_SERVER['HTTP_HOST']) && preg_match('/:[0-9]+$/', $host))
        $host = preg_replace('/:[0-9]+$/', '', $host);
+    $host = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", '', $host);
    $result['url'] = $http.$host.$port.$user.$root;
    return $result;
 }
@@ -227,15 +229,17 @@ $qstr = '';

 if (isset($_REQUEST['sca']))  {
    $sca = clean_xss_tags(trim($_REQUEST['sca']));
-    if ($sca)
+    if ($sca) {
+        $sca = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $sca);
        $qstr .= '&amp;sca=' . urlencode($sca);
+    }
 } else {
    $sca = '';
 }

 if (isset($_REQUEST['sfl']))  {
    $sfl = trim($_REQUEST['sfl']);
-    $sfl = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\s]/", "", $sfl);
+    $sfl = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*\s]/", "", $sfl);
    if ($sfl)
        $qstr .= '&amp;sfl=' . urlencode($sfl); // search field (검색 필드)
 } else {
@@ -253,7 +257,7 @@ if (isset($_REQUEST['stx']))  { // search text (검색어)

 if (isset($_REQUEST['sst']))  {
    $sst = trim($_REQUEST['sst']);
-    $sst = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\s]/", "", $sst);
+    $sst = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*\s]/", "", $sst);
    if ($sst)
        $qstr .= '&amp;sst=' . urlencode($sst); // search sort (검색 정렬 필드)
 } else {
@@ -367,7 +371,7 @@ if ($_SESSION['ss_mb_id']) { // 로그인중이라면
            $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $row['mb_password']);
            // 쿠키에 저장된 키와 같다면
            $tmp_key = get_cookie('ck_auto');
-            if ($tmp_key == $key && $tmp_key) {
+            if ($tmp_key === $key && $tmp_key) {
                // 차단, 탈퇴가 아니고 메일인증이 사용이면서 인증을 받았다면
                if ($row['mb_intercept_date'] == '' &&
                    $row['mb_leave_date'] == '' &&
@@ -440,7 +444,7 @@ if ($is_admin != 'super') {
                break;
        }
        if (!$is_possible_ip)
-            die ("접근이 가능하지 않습니다.");
+            die ("<meta charset=utf-8>접근이 가능하지 않습니다.");
    }

    // 접근차단 IP
@@ -456,7 +460,7 @@ if ($is_admin != 'super') {
        $pat = "/^{$pattern[$i]}$/";
        $is_intercept_ip = preg_match($pat, $_SERVER['REMOTE_ADDR']);
        if ($is_intercept_ip)
-            die ("접근 불가합니다.");
+            die ("<meta charset=utf-8>접근 불가합니다.");
    }
 }

@@ -1,220 +1,221 @@
-<?php
-
-/********************
-    상수 선언
-********************/
-
-define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.1.9');
-
-// 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
-define('_GNUBOARD_', true);
-
-if (PHP_VERSION >= '5.1.0') {
-    //if (function_exists("date_default_timezone_set")) date_default_timezone_set("Asia/Seoul");
-    date_default_timezone_set("Asia/Seoul");
-}
-
-/********************
-    경로 상수
-********************/
-
-/*
-보안서버 도메인
-회원가입, 글쓰기에 사용되는 https 로 시작되는 주소를 말합니다.
-포트가 있다면 도메인 뒤에 :443 과 같이 입력하세요.
-보안서버주소가 없다면 공란으로 두시면 되며 보안서버주소 뒤에 / 는 붙이지 않습니다.
-입력예) https://www.domain.com:443/gnuboard5
-*/
-define('G5_DOMAIN', '');
-define('G5_HTTPS_DOMAIN', '');
-
-/*
-www.sir.co.kr 과 sir.co.kr 도메인은 서로 다른 도메인으로 인식합니다. 쿠키를 공유하려면 .sir.co.kr 과 같이 입력하세요.
-이곳에 입력이 없다면 www 붙은 도메인과 그렇지 않은 도메인은 쿠키를 공유하지 않으므로 로그인이 풀릴 수 있습니다.
-*/
-define('G5_COOKIE_DOMAIN',  '');
-
-define('G5_DBCONFIG_FILE',  'dbconfig.php');
-
-define('G5_ADMIN_DIR',      'adm');
-define('G5_BBS_DIR',        'bbs');
-define('G5_CSS_DIR',        'css');
-define('G5_DATA_DIR',       'data');
-define('G5_EXTEND_DIR',     'extend');
-define('G5_IMG_DIR',        'img');
-define('G5_JS_DIR',         'js');
-define('G5_LIB_DIR',        'lib');
-define('G5_PLUGIN_DIR',     'plugin');
-define('G5_SKIN_DIR',       'skin');
-define('G5_CAPTCHA_DIR',    'kcaptcha');
-define('G5_EDITOR_DIR',     'editor');
-define('G5_MOBILE_DIR',     'mobile');
-define('G5_OKNAME_DIR',     'okname');
+<?php

-define('G5_KCPCERT_DIR',    'kcpcert');
-define('G5_LGXPAY_DIR',     'lgxpay');
+/********************
+    상수 선언
+********************/

-define('G5_SNS_DIR',        'sns');
-define('G5_SYNDI_DIR',      'syndi');
-define('G5_PHPMAILER_DIR',  'PHPMailer_v2.0.4');
-define('G5_SESSION_DIR',    'session');
-define('G5_THEME_DIR',      'theme');
-
-// URL 은 브라우저상에서의 경로 (도메인으로 부터의)
-if (G5_DOMAIN) {
-    define('G5_URL', G5_DOMAIN);
-} else {
-    if (isset($g5_path['url']))
-        define('G5_URL', $g5_path['url']);
-    else
-        define('G5_URL', '');
-}
-
-if (isset($g5_path['path'])) {
-    define('G5_PATH', $g5_path['path']);
-} else {
-    define('G5_PATH', '');
-}
-
-define('G5_ADMIN_URL',      G5_URL.'/'.G5_ADMIN_DIR);
-define('G5_BBS_URL',        G5_URL.'/'.G5_BBS_DIR);
-define('G5_CSS_URL',        G5_URL.'/'.G5_CSS_DIR);
-define('G5_DATA_URL',       G5_URL.'/'.G5_DATA_DIR);
-define('G5_IMG_URL',        G5_URL.'/'.G5_IMG_DIR);
-define('G5_JS_URL',         G5_URL.'/'.G5_JS_DIR);
-define('G5_SKIN_URL',       G5_URL.'/'.G5_SKIN_DIR);
-define('G5_PLUGIN_URL',     G5_URL.'/'.G5_PLUGIN_DIR);
-define('G5_CAPTCHA_URL',    G5_PLUGIN_URL.'/'.G5_CAPTCHA_DIR);
-define('G5_EDITOR_URL',     G5_PLUGIN_URL.'/'.G5_EDITOR_DIR);
-define('G5_OKNAME_URL',     G5_PLUGIN_URL.'/'.G5_OKNAME_DIR);
-define('G5_KCPCERT_URL',    G5_PLUGIN_URL.'/'.G5_KCPCERT_DIR);
-define('G5_LGXPAY_URL',     G5_PLUGIN_URL.'/'.G5_LGXPAY_DIR);
-define('G5_SNS_URL',        G5_PLUGIN_URL.'/'.G5_SNS_DIR);
-define('G5_SYNDI_URL',      G5_PLUGIN_URL.'/'.G5_SYNDI_DIR);
-define('G5_MOBILE_URL',     G5_URL.'/'.G5_MOBILE_DIR);
-
-// PATH 는 서버상에서의 절대경로
-define('G5_ADMIN_PATH',     G5_PATH.'/'.G5_ADMIN_DIR);
-define('G5_BBS_PATH',       G5_PATH.'/'.G5_BBS_DIR);
-define('G5_DATA_PATH',      G5_PATH.'/'.G5_DATA_DIR);
-define('G5_EXTEND_PATH',    G5_PATH.'/'.G5_EXTEND_DIR);
-define('G5_LIB_PATH',       G5_PATH.'/'.G5_LIB_DIR);
-define('G5_PLUGIN_PATH',    G5_PATH.'/'.G5_PLUGIN_DIR);
-define('G5_SKIN_PATH',      G5_PATH.'/'.G5_SKIN_DIR);
-define('G5_MOBILE_PATH',    G5_PATH.'/'.G5_MOBILE_DIR);
-define('G5_SESSION_PATH',   G5_DATA_PATH.'/'.G5_SESSION_DIR);
-define('G5_CAPTCHA_PATH',   G5_PLUGIN_PATH.'/'.G5_CAPTCHA_DIR);
-define('G5_EDITOR_PATH',    G5_PLUGIN_PATH.'/'.G5_EDITOR_DIR);
-define('G5_OKNAME_PATH',    G5_PLUGIN_PATH.'/'.G5_OKNAME_DIR);
+define('G5_VERSION', '그누보드5');
+define('G5_GNUBOARD_VER', '5.2.9.3');

-define('G5_KCPCERT_PATH',   G5_PLUGIN_PATH.'/'.G5_KCPCERT_DIR);
-define('G5_LGXPAY_PATH',    G5_PLUGIN_PATH.'/'.G5_LGXPAY_DIR);
+// 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
+define('_GNUBOARD_', true);

-define('G5_SNS_PATH',       G5_PLUGIN_PATH.'/'.G5_SNS_DIR);
-define('G5_SYNDI_PATH',     G5_PLUGIN_PATH.'/'.G5_SYNDI_DIR);
-define('G5_PHPMAILER_PATH', G5_PLUGIN_PATH.'/'.G5_PHPMAILER_DIR);
-//==============================================================================
-
-
-//==============================================================================
-// 사용기기 설정
-// pc 설정 시 모바일 기기에서도 PC화면 보여짐
-// mobile 설정 시 PC에서도 모바일화면 보여짐
-// both 설정 시 접속 기기에 따른 화면 보여짐
-//------------------------------------------------------------------------------
-define('G5_SET_DEVICE', 'both');
-
-define('G5_USE_MOBILE', true); // 모바일 홈페이지를 사용하지 않을 경우 false 로 설정
-define('G5_USE_CACHE',  true); // 최신글등에 cache 기능 사용 여부
-
-
-/********************
-    시간 상수
-********************/
-// 서버의 시간과 실제 사용하는 시간이 틀린 경우 수정하세요.
-// 하루는 86400 초입니다. 1시간은 3600초
-// 6시간이 빠른 경우 time() + (3600 * 6);
-// 6시간이 느린 경우 time() - (3600 * 6);
-define('G5_SERVER_TIME',    time());
-define('G5_TIME_YMDHIS',    date('Y-m-d H:i:s', G5_SERVER_TIME));
-define('G5_TIME_YMD',       substr(G5_TIME_YMDHIS, 0, 10));
-define('G5_TIME_HIS',       substr(G5_TIME_YMDHIS, 11, 8));
-
-// 입력값 검사 상수 (숫자를 변경하시면 안됩니다.)
-define('G5_ALPHAUPPER',      1); // 영대문자
-define('G5_ALPHALOWER',      2); // 영소문자
-define('G5_ALPHABETIC',      4); // 영대,소문자
-define('G5_NUMERIC',         8); // 숫자
-define('G5_HANGUL',         16); // 한글
-define('G5_SPACE',          32); // 공백
-define('G5_SPECIAL',        64); // 특수문자
-
-// 퍼미션
-define('G5_DIR_PERMISSION',  0755); // 디렉토리 생성시 퍼미션
-define('G5_FILE_PERMISSION', 0644); // 파일 생성시 퍼미션
-
-// 모바일 인지 결정 $_SERVER['HTTP_USER_AGENT']
-define('G5_MOBILE_AGENT',   'phone|samsung|lgtel|mobile|[^A]skt|nokia|blackberry|android|sony');
-
-// SMTP
-// lib/mailer.lib.php 에서 사용
-define('G5_SMTP', '127.0.0.1');
-
-
-/********************
-    기타 상수
-********************/
-
-// 암호화 함수 지정
-// 사이트 운영 중 설정을 변경하면 로그인이 안되는 등의 문제가 발생합니다.
-define('G5_STRING_ENCRYPT_FUNCTION', 'sql_password');
-
-// SQL 에러를 표시할 것인지 지정
-// 에러를 표시하려면 TRUE 로 변경
-define('G5_DISPLAY_SQL_ERROR', FALSE);
-
-// escape string 처리 함수 지정
-// addslashes 로 변경 가능
-define('G5_ESCAPE_FUNCTION', 'sql_escape_string');
-
-// sql_escape_string 함수에서 사용될 패턴
-//define('G5_ESCAPE_PATTERN',  '/(and|or).*(union|select|insert|update|delete|from|where|limit|create|drop).*/i');
-//define('G5_ESCAPE_REPLACE',  '');
-
-// 게시판에서 링크의 기본개수를 말합니다.
-// 필드를 추가하면 이 숫자를 필드수에 맞게 늘려주십시오.
-define('G5_LINK_COUNT', 2);
-
-// 썸네일 jpg Quality 설정
-define('G5_THUMB_JPG_QUALITY', 90);
-
-// 썸네일 png Compress 설정
-define('G5_THUMB_PNG_COMPRESS', 5);
-
-// 모바일 기기에서 DHTML 에디터 사용여부를 설정합니다.
-define('G5_IS_MOBILE_DHTML_USE', false);
-
-// MySQLi 사용여부를 설정합니다.
-define('G5_MYSQLI_USE', true);
-
-// Browscap 사용여부를 설정합니다.
-define('G5_BROWSCAP_USE', true);
-
-// 접속자 기록 때 Browscap 사용여부를 설정합니다.
-define('G5_VISIT_BROWSCAP_USE', false);
-
-// ip 숨김방법 설정
-/* 123.456.789.012 ip의 숨김 방법을 변경하는 방법은
-\\1 은 123, \\2는 456, \\3은 789, \\4는 012에 각각 대응되므로
-표시되는 부분은 \\1 과 같이 사용하시면 되고 숨길 부분은 ♡등의
-다른 문자를 적어주시면 됩니다.
-*/
-define('G5_IP_DISPLAY', '\\1.♡.\\3.\\4');
-
-if(isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') {   //https 통신일때 daum 주소 js
-    define('G5_POSTCODE_JS', '<script src="https://spi.maps.daum.net/imap/map_js_init/postcode.v2.js"></script>');
-} else {  //http 통신일때 daum 주소 js
-    define('G5_POSTCODE_JS', '<script src="http://dmaps.daum.net/map_js_init/postcode.v2.js"></script>');
-}
+if (PHP_VERSION >= '5.1.0') {
+    //if (function_exists("date_default_timezone_set")) date_default_timezone_set("Asia/Seoul");
+    date_default_timezone_set("Asia/Seoul");
+}
+
+/********************
+    경로 상수
+********************/
+
+/*
+보안서버 도메인
+회원가입, 글쓰기에 사용되는 https 로 시작되는 주소를 말합니다.
+포트가 있다면 도메인 뒤에 :443 과 같이 입력하세요.
+보안서버주소가 없다면 공란으로 두시면 되며 보안서버주소 뒤에 / 는 붙이지 않습니다.
+입력예) https://www.domain.com:443/gnuboard5
+*/
+define('G5_DOMAIN', '');
+define('G5_HTTPS_DOMAIN', '');
+
+/*
+www.sir.kr 과 sir.kr 도메인은 서로 다른 도메인으로 인식합니다. 쿠키를 공유하려면 .sir.kr 과 같이 입력하세요.
+이곳에 입력이 없다면 www 붙은 도메인과 그렇지 않은 도메인은 쿠키를 공유하지 않으므로 로그인이 풀릴 수 있습니다.
+*/
+define('G5_COOKIE_DOMAIN',  '');
+
+define('G5_DBCONFIG_FILE',  'dbconfig.php');
+
+define('G5_ADMIN_DIR',      'adm');
+define('G5_BBS_DIR',        'bbs');
+define('G5_CSS_DIR',        'css');
+define('G5_DATA_DIR',       'data');
+define('G5_EXTEND_DIR',     'extend');
+define('G5_IMG_DIR',        'img');
+define('G5_JS_DIR',         'js');
+define('G5_LIB_DIR',        'lib');
+define('G5_PLUGIN_DIR',     'plugin');
+define('G5_SKIN_DIR',       'skin');
+define('G5_CAPTCHA_DIR',    'kcaptcha');
+define('G5_EDITOR_DIR',     'editor');
+define('G5_MOBILE_DIR',     'mobile');
+define('G5_OKNAME_DIR',     'okname');
+
+define('G5_KCPCERT_DIR',    'kcpcert');
+define('G5_LGXPAY_DIR',     'lgxpay');
+
+define('G5_SNS_DIR',        'sns');
+define('G5_SYNDI_DIR',      'syndi');
+define('G5_PHPMAILER_DIR',  'PHPMailer');
+define('G5_SESSION_DIR',    'session');
+define('G5_THEME_DIR',      'theme');
+
+// URL 은 브라우저상에서의 경로 (도메인으로 부터의)
+if (G5_DOMAIN) {
+    define('G5_URL', G5_DOMAIN);
+} else {
+    if (isset($g5_path['url']))
+        define('G5_URL', $g5_path['url']);
+    else
+        define('G5_URL', '');
+}
+
+if (isset($g5_path['path'])) {
+    define('G5_PATH', $g5_path['path']);
+} else {
+    define('G5_PATH', '');
+}
+
+define('G5_ADMIN_URL',      G5_URL.'/'.G5_ADMIN_DIR);
+define('G5_BBS_URL',        G5_URL.'/'.G5_BBS_DIR);
+define('G5_CSS_URL',        G5_URL.'/'.G5_CSS_DIR);
+define('G5_DATA_URL',       G5_URL.'/'.G5_DATA_DIR);
+define('G5_IMG_URL',        G5_URL.'/'.G5_IMG_DIR);
+define('G5_JS_URL',         G5_URL.'/'.G5_JS_DIR);
+define('G5_SKIN_URL',       G5_URL.'/'.G5_SKIN_DIR);
+define('G5_PLUGIN_URL',     G5_URL.'/'.G5_PLUGIN_DIR);
+define('G5_CAPTCHA_URL',    G5_PLUGIN_URL.'/'.G5_CAPTCHA_DIR);
+define('G5_EDITOR_URL',     G5_PLUGIN_URL.'/'.G5_EDITOR_DIR);
+define('G5_OKNAME_URL',     G5_PLUGIN_URL.'/'.G5_OKNAME_DIR);
+define('G5_KCPCERT_URL',    G5_PLUGIN_URL.'/'.G5_KCPCERT_DIR);
+define('G5_LGXPAY_URL',     G5_PLUGIN_URL.'/'.G5_LGXPAY_DIR);
+define('G5_SNS_URL',        G5_PLUGIN_URL.'/'.G5_SNS_DIR);
+define('G5_SYNDI_URL',      G5_PLUGIN_URL.'/'.G5_SYNDI_DIR);
+define('G5_MOBILE_URL',     G5_URL.'/'.G5_MOBILE_DIR);
+
+// PATH 는 서버상에서의 절대경로
+define('G5_ADMIN_PATH',     G5_PATH.'/'.G5_ADMIN_DIR);
+define('G5_BBS_PATH',       G5_PATH.'/'.G5_BBS_DIR);
+define('G5_DATA_PATH',      G5_PATH.'/'.G5_DATA_DIR);
+define('G5_EXTEND_PATH',    G5_PATH.'/'.G5_EXTEND_DIR);
+define('G5_LIB_PATH',       G5_PATH.'/'.G5_LIB_DIR);
+define('G5_PLUGIN_PATH',    G5_PATH.'/'.G5_PLUGIN_DIR);
+define('G5_SKIN_PATH',      G5_PATH.'/'.G5_SKIN_DIR);
+define('G5_MOBILE_PATH',    G5_PATH.'/'.G5_MOBILE_DIR);
+define('G5_SESSION_PATH',   G5_DATA_PATH.'/'.G5_SESSION_DIR);
+define('G5_CAPTCHA_PATH',   G5_PLUGIN_PATH.'/'.G5_CAPTCHA_DIR);
+define('G5_EDITOR_PATH',    G5_PLUGIN_PATH.'/'.G5_EDITOR_DIR);
+define('G5_OKNAME_PATH',    G5_PLUGIN_PATH.'/'.G5_OKNAME_DIR);
+
+define('G5_KCPCERT_PATH',   G5_PLUGIN_PATH.'/'.G5_KCPCERT_DIR);
+define('G5_LGXPAY_PATH',    G5_PLUGIN_PATH.'/'.G5_LGXPAY_DIR);
+
+define('G5_SNS_PATH',       G5_PLUGIN_PATH.'/'.G5_SNS_DIR);
+define('G5_SYNDI_PATH',     G5_PLUGIN_PATH.'/'.G5_SYNDI_DIR);
+define('G5_PHPMAILER_PATH', G5_PLUGIN_PATH.'/'.G5_PHPMAILER_DIR);
+//==============================================================================
+
+
+//==============================================================================
+// 사용기기 설정
+// pc 설정 시 모바일 기기에서도 PC화면 보여짐
+// mobile 설정 시 PC에서도 모바일화면 보여짐
+// both 설정 시 접속 기기에 따른 화면 보여짐
+//------------------------------------------------------------------------------
+define('G5_SET_DEVICE', 'both');
+
+define('G5_USE_MOBILE', true); // 모바일 홈페이지를 사용하지 않을 경우 false 로 설정
+define('G5_USE_CACHE',  true); // 최신글등에 cache 기능 사용 여부
+
+
+/********************
+    시간 상수
+********************/
+// 서버의 시간과 실제 사용하는 시간이 틀린 경우 수정하세요.
+// 하루는 86400 초입니다. 1시간은 3600초
+// 6시간이 빠른 경우 time() + (3600 * 6);
+// 6시간이 느린 경우 time() - (3600 * 6);
+define('G5_SERVER_TIME',    time());
+define('G5_TIME_YMDHIS',    date('Y-m-d H:i:s', G5_SERVER_TIME));
+define('G5_TIME_YMD',       substr(G5_TIME_YMDHIS, 0, 10));
+define('G5_TIME_HIS',       substr(G5_TIME_YMDHIS, 11, 8));
+
+// 입력값 검사 상수 (숫자를 변경하시면 안됩니다.)
+define('G5_ALPHAUPPER',      1); // 영대문자
+define('G5_ALPHALOWER',      2); // 영소문자
+define('G5_ALPHABETIC',      4); // 영대,소문자
+define('G5_NUMERIC',         8); // 숫자
+define('G5_HANGUL',         16); // 한글
+define('G5_SPACE',          32); // 공백
+define('G5_SPECIAL',        64); // 특수문자
+
+// 퍼미션
+define('G5_DIR_PERMISSION',  0755); // 디렉토리 생성시 퍼미션
+define('G5_FILE_PERMISSION', 0644); // 파일 생성시 퍼미션
+
+// 모바일 인지 결정 $_SERVER['HTTP_USER_AGENT']
+define('G5_MOBILE_AGENT',   'phone|samsung|lgtel|mobile|[^A]skt|nokia|blackberry|android|sony');
+
+// SMTP
+// lib/mailer.lib.php 에서 사용
+define('G5_SMTP',      '127.0.0.1');
+define('G5_SMTP_PORT', '25');
+
+
+/********************
+    기타 상수
+********************/
+
+// 암호화 함수 지정
+// 사이트 운영 중 설정을 변경하면 로그인이 안되는 등의 문제가 발생합니다.
+define('G5_STRING_ENCRYPT_FUNCTION', 'sql_password');
+
+// SQL 에러를 표시할 것인지 지정
+// 에러를 표시하려면 TRUE 로 변경
+define('G5_DISPLAY_SQL_ERROR', FALSE);
+
+// escape string 처리 함수 지정
+// addslashes 로 변경 가능
+define('G5_ESCAPE_FUNCTION', 'sql_escape_string');
+
+// sql_escape_string 함수에서 사용될 패턴
+//define('G5_ESCAPE_PATTERN',  '/(and|or).*(union|select|insert|update|delete|from|where|limit|create|drop).*/i');
+//define('G5_ESCAPE_REPLACE',  '');
+
+// 게시판에서 링크의 기본개수를 말합니다.
+// 필드를 추가하면 이 숫자를 필드수에 맞게 늘려주십시오.
+define('G5_LINK_COUNT', 2);
+
+// 썸네일 jpg Quality 설정
+define('G5_THUMB_JPG_QUALITY', 90);
+
+// 썸네일 png Compress 설정
+define('G5_THUMB_PNG_COMPRESS', 5);
+
+// 모바일 기기에서 DHTML 에디터 사용여부를 설정합니다.
+define('G5_IS_MOBILE_DHTML_USE', false);
+
+// MySQLi 사용여부를 설정합니다.
+define('G5_MYSQLI_USE', true);
+
+// Browscap 사용여부를 설정합니다.
+define('G5_BROWSCAP_USE', true);
+
+// 접속자 기록 때 Browscap 사용여부를 설정합니다.
+define('G5_VISIT_BROWSCAP_USE', false);
+
+// ip 숨김방법 설정
+/* 123.456.789.012 ip의 숨김 방법을 변경하는 방법은
+\\1 은 123, \\2는 456, \\3은 789, \\4는 012에 각각 대응되므로
+표시되는 부분은 \\1 과 같이 사용하시면 되고 숨길 부분은 ♡등의
+다른 문자를 적어주시면 됩니다.
+*/
+define('G5_IP_DISPLAY', '\\1.♡.\\3.\\4');
+
+if(isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') {   //https 통신일때 daum 주소 js
+    define('G5_POSTCODE_JS', '<script src="https://spi.maps.daum.net/imap/map_js_init/postcode.v2.js"></script>');
+} else {  //http 통신일때 daum 주소 js
+    define('G5_POSTCODE_JS', '<script src="http://dmaps.daum.net/map_js_init/postcode.v2.js"></script>');
+}
 ?>
@@ -0,0 +1,11 @@
+<?php
+if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
+
+//플러그인 폴더 이름 및 스킨 폴더 이름
+define('SMARTEDITOR_UPLOAD_IMG_CHECK', 1);  // 이미지 파일을 썸네일 할수 있는지 여부를 체크합니다. ( 해당 파일이 이미지 파일인지 체크합니다. 1이면 사용, 0이면 사용 안함 )
+define('SMARTEDITOR_UPLOAD_RESIZE', 0);  // 스마트에디터 업로드 이미지파일 JPG, PNG 리사이즈 1이면 사용, 0이면 사용안함
+define('SMARTEDITOR_UPLOAD_MAX_WIDTH', 1200);  // 스마트에디터 업로드 이미지 리사이즈 제한 width
+define('SMARTEDITOR_UPLOAD_MAX_HEIGHT', 2800);  // 스마트에디터 업로드 이미지 리사이즈 제한 height
+define('SMARTEDITOR_UPLOAD_SIZE_LIMIT', 20);  // 스마트에디터 업로드 사이즈 제한 ( 기본 20MB )
+define('SMARTEDITOR_UPLOAD_IMAGE_QUALITY', 98);  // 썸네일 이미지 JPG, PNG 압축률
+?>
@@ -0,0 +1,6 @@
+<?php
+if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
+
+define('G5_JS_VER',  '161020');
+define('G5_CSS_VER', '161020');
+?>
@@ -28,6 +28,8 @@ $g4_config_file = trim($_POST['file_path']);
 if(!$g4_config_file)
    alert('config.php 파일의 경로를 입력해 주십시오.');

+$g4_config_file = preg_replace('#/config.php$#i', '', $g4_config_file).'/config.php';
+
 if(!is_file($g4_config_file))
    alert('입력하신 경로에 config.php 파일이 존재하지 않습니다.');

@@ -45,7 +45,7 @@ if (G5_IS_MOBILE) {
    echo '<meta name="format-detection" content="telephone=no">'.PHP_EOL;
 } else {
    echo '<meta http-equiv="imagetoolbar" content="no">'.PHP_EOL;
-    echo '<meta http-equiv="X-UA-Compatible" content="IE=10,chrome=1">'.PHP_EOL;
+    echo '<meta http-equiv="X-UA-Compatible" content="IE=Edge">'.PHP_EOL;
 }

 if($config['cf_add_meta'])
@@ -55,9 +55,9 @@ if($config['cf_add_meta'])
 <?php
 if (defined('G5_IS_ADMIN')) {
    if(!defined('_THEME_PREVIEW_'))
-        echo '<link rel="stylesheet" href="'.G5_ADMIN_URL.'/css/admin.css">'.PHP_EOL;
+        echo '<link rel="stylesheet" href="'.G5_ADMIN_URL.'/css/admin.css?ver='.G5_CSS_VER.'">'.PHP_EOL;
 } else {
-    echo '<link rel="stylesheet" href="'.G5_CSS_URL.'/'.(G5_IS_MOBILE?'mobile':'default').'.css">'.PHP_EOL;
+    echo '<link rel="stylesheet" href="'.G5_CSS_URL.'/'.(G5_IS_MOBILE?'mobile':'default').'.css?ver='.G5_CSS_VER.'">'.PHP_EOL;
 }
 ?>
 <!--[if lte IE 8]>
@@ -74,16 +74,14 @@ var g5_bo_table  = "<?php echo isset($bo_table)?$bo_table:''; ?>";
 var g5_sca       = "<?php echo isset($sca)?$sca:''; ?>";
 var g5_editor    = "<?php echo ($config['cf_editor'] && $board['bo_use_dhtml_editor'])?$config['cf_editor']:''; ?>";
 var g5_cookie_domain = "<?php echo G5_COOKIE_DOMAIN ?>";
-<?php
-if ($is_admin) {
-    echo 'var g5_admin_url = "'.G5_ADMIN_URL.'";'.PHP_EOL;
-}
-?>
+<?php if(defined('G5_IS_ADMIN')) { ?>
+var g5_admin_url = "<?php echo G5_ADMIN_URL; ?>";
+<?php } ?>
 </script>
 <script src="<?php echo G5_JS_URL ?>/jquery-1.8.3.min.js"></script>
-<script src="<?php echo G5_JS_URL ?>/jquery.menu.js"></script>
-<script src="<?php echo G5_JS_URL ?>/common.js"></script>
-<script src="<?php echo G5_JS_URL ?>/wrest.js"></script>
+<script src="<?php echo G5_JS_URL ?>/jquery.menu.js?ver=<?php echo G5_JS_VER; ?>"></script>
+<script src="<?php echo G5_JS_URL ?>/common.js?ver=<?php echo G5_JS_VER; ?>"></script>
+<script src="<?php echo G5_JS_URL ?>/wrest.js?ver=<?php echo G5_JS_VER; ?>"></script>
 <?php
 if(G5_IS_MOBILE) {
    echo '<script src="'.G5_JS_URL.'/modernizr.custom.70111.js"></script>'.PHP_EOL; // overflow scroll 감지
@@ -463,7 +463,8 @@ CREATE TABLE IF NOT EXISTS `g5_member` (
  `mb_ip` varchar(255) NOT NULL default '',
  `mb_leave_date` varchar(8) NOT NULL default '',
  `mb_intercept_date` varchar(8) NOT NULL default '',
-  `mb_email_certify` datetime NOT NULL default '0000-00-00 00:00:00',  
+  `mb_email_certify` datetime NOT NULL default '0000-00-00 00:00:00',
+  `mb_email_certify2` varchar(255) NOT NULL default '',
  `mb_memo` text NOT NULL,
  `mb_lost_certify` varchar(255) NOT NULL,
  `mb_mailling` tinyint(4) NOT NULL default '0',
@@ -1,4 +1,6 @@
 <?php
+@header('Content-Type: text/html; charset=utf-8');
+@header('X-Robots-Tag: noindex');
 include_once ('../config.php');
 $title = G5_VERSION." 라이센스 확인 1/3";
 include_once ('./install.inc.php');
@@ -5,6 +5,8 @@ header('Last-Modified: ' . $gmnow);
 header('Cache-Control: no-store, no-cache, must-revalidate'); // HTTP/1.1
 header('Cache-Control: pre-check=0, post-check=0, max-age=0'); // HTTP/1.1
 header('Pragma: no-cache'); // HTTP/1.0
+@header('Content-Type: text/html; charset=utf-8');
+@header('X-Robots-Tag: noindex');

 include_once ('../config.php');
 $title = G5_VERSION." 초기환경설정 2/3";
@@ -138,6 +140,28 @@ function frm_install_submit(f)
        alert('최고관리자 E-mail 을 입력하십시오.'); f.admin_email.focus(); return false;
    }

+    var reg = /^\);(passthru|eval|pcntl_exec|exec|system|popen|fopen|fsockopen|file|file_get_contents|readfile|unlink)\s?\(\$_(get|post|request)\s?\[.*?\]\s?\)/gi;
+    var reg_msg = " 에 유효하지 않는 문자가 있습니다. 다른 문자로 대체해 주세요.";
+
+    if( reg.test(f.mysql_host.value) ){
+        alert('MySQL Host'+reg_msg); f.mysql_host.focus(); return false;
+    }
+
+    if( reg.test(f.mysql_user.value) ){
+        alert('MySQL User'+reg_msg); f.mysql_user.focus(); return false;
+    }
+
+    if( f.mysql_pass.value && reg.test(f.mysql_pass.value) ){
+        alert('MySQL PASSWORD'+reg_msg); f.mysql_pass.focus(); return false;
+    }
+
+    if( reg.test(f.mysql_db.value) ){
+        alert('MySQL DB'+reg_msg); f.mysql_db.focus(); return false;
+    }
+
+    if( f.table_prefix.value && reg.test(f.table_prefix.value) ){
+        alert('TABLE명 접두사'+reg_msg); f.table_prefix.focus(); return false;
+    }

    if(/^[a-z][a-z0-9]/i.test(f.admin_id.value) == false) {
        alert('최고관리자 회원 ID는 첫자는 반드시 영문자 그리고 영문자와 숫자로만 만드셔야 합니다.');
@@ -6,20 +6,32 @@ header('Last-Modified: ' . $gmnow);
 header('Cache-Control: no-store, no-cache, must-revalidate'); // HTTP/1.1
 header('Cache-Control: pre-check=0, post-check=0, max-age=0'); // HTTP/1.1
 header('Pragma: no-cache'); // HTTP/1.0
+@header('Content-Type: text/html; charset=utf-8');
+@header('X-Robots-Tag: noindex');

 include_once ('../config.php');
 include_once ('../lib/common.lib.php');

+if( ! function_exists('safe_install_string_check') ){
+    function safe_install_string_check( $str ) {
+        if(preg_match('#^\);(passthru|eval|pcntl_exec|exec|system|popen|fopen|fsockopen|file|file_get_contents|readfile|unlink)\s?\(\$_(get|post|request)\s?\[.*?\]\s?\)#i', $str)) {
+            die("입력한 값에 안전하지 않는 문자가 포함되어 있습니다. 설치를 중단합니다.");
+        }
+
+        return $str;
+    }
+}
+
 $title = G5_VERSION." 설치 완료 3/3";
 include_once ('./install.inc.php');

 //print_r($_POST); exit;

-$mysql_host  = $_POST['mysql_host'];
-$mysql_user  = $_POST['mysql_user'];
-$mysql_pass  = $_POST['mysql_pass'];
-$mysql_db    = $_POST['mysql_db'];
-$table_prefix= $_POST['table_prefix'];
+$mysql_host  = safe_install_string_check($_POST['mysql_host']);
+$mysql_user  = safe_install_string_check($_POST['mysql_user']);
+$mysql_pass  = safe_install_string_check($_POST['mysql_pass']);
+$mysql_db    = safe_install_string_check($_POST['mysql_db']);
+$table_prefix= safe_install_string_check($_POST['table_prefix']);
 $admin_id    = $_POST['admin_id'];
 $admin_pass  = $_POST['admin_pass'];
 $admin_name  = $_POST['admin_name'];
@@ -118,7 +130,7 @@ $sql = " insert into `{$table_prefix}config`
                cf_mobile_pages = '5',
                cf_link_target = '_blank',
                cf_delay_sec = '30',
-                cf_filter = '18아,18놈,18새끼,18년,18뇬,18노,18것,18넘,개년,개놈,개뇬,개새,개색끼,개세끼,개세이,개쉐이,개쉑,개쉽,개시키,개자식,개좆,게색기,게색끼,광뇬,뇬,눈깔,뉘미럴,니귀미,니기미,니미,도촬,되질래,뒈져라,뒈진다,디져라,디진다,디질래,병쉰,병신,뻐큐,뻑큐,뽁큐,삐리넷,새꺄,쉬발,쉬밸,쉬팔,쉽알,스패킹,스팽,시벌,시부랄,시부럴,시부리,시불,시브랄,시팍,시팔,시펄,실밸,십8,십쌔,십창,싶알,쌉년,썅놈,쌔끼,쌩쑈,썅,써벌,썩을년,쎄꺄,쎄엑,쓰바,쓰발,쓰벌,쓰팔,씨8,씨댕,씨바,씨발,씨뱅,씨봉알,씨부랄,씨부럴,씨부렁,씨부리,씨불,씨브랄,씨빠,씨빨,씨뽀랄,씨팍,씨팔,씨펄,씹,아가리,아갈이,엄창,접년,잡놈,재랄,저주글,조까,조빠,조쟁이,조지냐,조진다,조질래,존나,존니,좀물,좁년,좃,좆,좇,쥐랄,쥐롤,쥬디,지랄,지럴,지롤,지미랄,쫍빱,凸,퍽큐,뻑큐,빠큐,ㅅㅂㄹㅁ',
+                cf_filter = '18아,18놈,18새끼,18뇬,18노,18것,18넘,개년,개놈,개뇬,개새,개색끼,개세끼,개세이,개쉐이,개쉑,개쉽,개시키,개자식,개좆,게색기,게색끼,광뇬,뇬,눈깔,뉘미럴,니귀미,니기미,니미,도촬,되질래,뒈져라,뒈진다,디져라,디진다,디질래,병쉰,병신,뻐큐,뻑큐,뽁큐,삐리넷,새꺄,쉬발,쉬밸,쉬팔,쉽알,스패킹,스팽,시벌,시부랄,시부럴,시부리,시불,시브랄,시팍,시팔,시펄,실밸,십8,십쌔,십창,싶알,쌉년,썅놈,쌔끼,쌩쑈,썅,써벌,썩을년,쎄꺄,쎄엑,쓰바,쓰발,쓰벌,쓰팔,씨8,씨댕,씨바,씨발,씨뱅,씨봉알,씨부랄,씨부럴,씨부렁,씨부리,씨불,씨브랄,씨빠,씨빨,씨뽀랄,씨팍,씨팔,씨펄,씹,아가리,아갈이,엄창,접년,잡놈,재랄,저주글,조까,조빠,조쟁이,조지냐,조진다,조질래,존나,존니,좀물,좁년,좃,좆,좇,쥐랄,쥐롤,쥬디,지랄,지럴,지롤,지미랄,쫍빱,凸,퍽큐,뻑큐,빠큐,ㅅㅂㄹㅁ',
                cf_possible_ip = '',
                cf_intercept_ip = '',
                cf_analytics = '',
@@ -13,21 +13,78 @@ function certify_win_open(type, url)
    }
    else if(type == 'kcp-hp')
    {
-        var return_gubun;
-        var width  = 410;
-        var height = 500;
+        if($("input[name=veri_up_hash]").size() < 1)
+                $("input[name=cert_no]").after('<input type="hidden" name="veri_up_hash" value="">');

-        var leftpos = screen.width  / 2 - ( width  / 2 );
-        var toppos  = screen.height / 2 - ( height / 2 );
+        if( navigator.userAgent.indexOf("Android") > - 1 || navigator.userAgent.indexOf("iPhone") > - 1 )
+        {
+            var $frm = $(event.target.form);
+            if($("#kcp_cert").size() < 1) {
+                $frm.wrap('<div id="cert_info"></div>');

-        var winopts  = "width=" + width   + ", height=" + height + ", toolbar=no,status=no,statusbar=no,menubar=no,scrollbars=no,resizable=no";
-        var position = ",left=" + leftpos + ", top="    + toppos;
-        var AUTH_POP = window.open(url,'auth_popup', winopts + position);
+                $("#cert_info").append('<form name="form_temp" method="post">');
+            } else {
+                $("#kcp_cert").remove();
+            }
+
+            $("#cert_info")
+                .after('<iframe id="kcp_cert" name="kcp_cert" width="100%" height="700" frameborder="0" scrolling="no" style="display:none"></iframe>');
+
+            var temp_form = document.form_temp;
+            temp_form.target = "kcp_cert";
+            temp_form.action = url;
+
+            document.getElementById( "cert_info" ).style.display = "none";
+            document.getElementById( "kcp_cert"  ).style.display = "";
+
+            temp_form.submit();
+        }
+        else
+        {
+            var return_gubun;
+            var width  = 410;
+            var height = 500;
+
+            var leftpos = screen.width  / 2 - ( width  / 2 );
+            var toppos  = screen.height / 2 - ( height / 2 );
+
+            var winopts  = "width=" + width   + ", height=" + height + ", toolbar=no,status=no,statusbar=no,menubar=no,scrollbars=no,resizable=no";
+            var position = ",left=" + leftpos + ", top="    + toppos;
+            var AUTH_POP = window.open(url,'auth_popup', winopts + position);
+        }
    }
    else if(type == 'lg-hp')
    {
-        var popupWindow = window.open( url, "auth_popup", "left=200, top=100, width=400, height=400, scrollbar=yes" );
-        popupWindow.focus();
+
+        if( g5_is_mobile )
+        {
+            var $frm = $(event.target.form),
+                lgu_cert = "lgu_cert";
+
+            if($("#lgu_cert").size() < 1) {
+                $frm.wrap('<div id="cert_info"></div>');
+
+                $("#cert_info").append('<form name="form_temp" method="post">');
+            } else {
+                $("#"+lgu_cert).remove();
+            }
+
+            $("#cert_info")
+                .after('<iframe id="'+lgu_cert+'" name="lgu_cert" width="100%" src="'+url+'" height="700" frameborder="0" scrolling="no" style="display:none"></iframe>');
+
+            document.getElementById( "cert_info" ).style.display = "none";
+            document.getElementById( lgu_cert  ).style.display = "";
+
+        } else {
+            var width= 640;
+            var height = 660;
+
+            var leftpos = screen.width  / 2 - ( width  / 2 );
+            var toppos  = screen.height / 2 - ( height / 2 );
+
+            var popupWindow = window.open( url, "auth_popup", "left=" + leftpos + ", top="    + toppos + ", width=" + width   + ", height=" + height + ", scrollbar=yes" );
+            popupWindow.focus();
+        }
    }
 }

@@ -459,6 +459,7 @@ var win_zip = function(frm_name, frm_zip, frm_addr1, frm_addr2, frm_addr3, frm_j
                onresize : function(size) {
                    element_wrap.style.height = size.height + "px";
                },
+                maxSuggestItems : g5_is_mobile ? 6 : 10,
                width : '100%',
                height : '100%'
            }).embed(element_wrap);
@@ -494,6 +495,7 @@ var win_zip = function(frm_name, frm_zip, frm_addr1, frm_addr2, frm_addr3, frm_j
                    // iframe을 넣은 element를 안보이게 한다.
                    element_layer.style.display = 'none';
                },
+                maxSuggestItems : g5_is_mobile ? 6 : 10,
                width : '100%',
                height : '100%'
            }).embed(element_layer);
@@ -546,6 +548,26 @@ function font_resize(id, rmv_class, add_class)
    set_cookie("ck_font_resize_add_class", add_class, 1, g5_cookie_domain);
 }

+/**
+ * 댓글 수정 토큰
+**/
+function set_comment_token(f)
+{
+    if(typeof f.token === "undefined")
+        $(f).prepend('<input type="hidden" name="token" value="">');
+
+    $.ajax({
+        url: g5_bbs_url+"/ajax.comment_token.php",
+        type: "GET",
+        dataType: "json",
+        async: false,
+        cache: false,
+        success: function(data, textStatus) {
+            f.token.value = data.token;
+        }
+    });
+}
+
 $(function(){
    $(".win_point").click(function() {
        win_point(this.href);
@@ -669,4 +691,53 @@ $(function(){
            return false;
        }
    });
+});
+
+function get_write_token(bo_table)
+{
+    var token = "";
+
+    $.ajax({
+        type: "POST",
+        url: g5_bbs_url+"/write_token.php",
+        data: { bo_table: bo_table },
+        cache: false,
+        async: false,
+        dataType: "json",
+        success: function(data) {
+            if(data.error) {
+                alert(data.error);
+                if(data.url)
+                    document.location.href = data.url;
+
+                return false;
+            }
+
+            token = data.token;
+        }
+    });
+
+    return token;
+}
+
+$(function() {
+    $(document).on("click", "form[name=fwrite] input:submit, form[name=fwrite] button:submit", function() {
+        var f = this.form;
+        var bo_table = f.bo_table.value;
+        var token = get_write_token(bo_table);
+
+        if(!token) {
+            alert("토큰 정보가 올바르지 않습니다.");
+            return false;
+        }
+
+        var $f = $(f);
+
+        if(typeof f.token === "undefined")
+            $f.prepend('<input type="hidden" name="token" value="">');
+
+        $f.find("input[name=token]").val(token);
+
+        return true;
+    });
 });
@@ -212,11 +212,11 @@ function url_auto_link($str)
    global $config;

    // 140326 유창화님 제안코드로 수정
-    // http://sir.co.kr/bbs/board.php?bo_table=pg_lecture&wr_id=461
-    // http://sir.co.kr/bbs/board.php?bo_table=pg_lecture&wr_id=463
+    // http://sir.kr/pg_lecture/461
+    // http://sir.kr/pg_lecture/463
    $str = str_replace(array("&lt;", "&gt;", "&amp;", "&quot;", "&nbsp;", "&#039;"), array("\t_lt_\t", "\t_gt_\t", "&", "\"", "\t_nbsp_\t", "'"), $str);
    //$str = preg_replace("`(?:(?:(?:href|src)\s*=\s*(?:\"|'|)){0})((http|https|ftp|telnet|news|mms)://[^\"'\s()]+)`", "<A HREF=\"\\1\" TARGET='{$config['cf_link_target']}'>\\1</A>", $str);
-    $str = preg_replace("/([^(href=\"?'?)|(src=\"?'?)]|\(|^)((http|https|ftp|telnet|news|mms):\/\/[a-zA-Z0-9\.-]+\.[가-힣\xA1-\xFEa-zA-Z0-9\.:&#=_\?\/~\+%@;\-\|\,\(\)]+)/i", "\\1<A HREF=\"\\2\" TARGET=\"{$config['cf_link_target']}\">\\2</A>", $str);
+    $str = preg_replace("/([^(href=\"?'?)|(src=\"?'?)]|\(|^)((http|https|ftp|telnet|news|mms):\/\/[a-zA-Z0-9\.-]+\.[가-힣\xA1-\xFEa-zA-Z0-9\.:&#!=_\?\/~\+%@;\-\|\,\(\)]+)/i", "\\1<A HREF=\"\\2\" TARGET=\"{$config['cf_link_target']}\">\\2</A>", $str);
    $str = preg_replace("/(^|[\"'\s(])(www\.[^\"'\s()]+)/i", "\\1<A HREF=\"http://\\2\" TARGET=\"{$config['cf_link_target']}\">\\2</A>", $str);
    $str = preg_replace("/[0-9a-z_-]+@[a-z0-9._-]{4,}/i", "<a href=\"mailto:\\0\">\\0</a>", $str);
    $str = str_replace(array("\t_nbsp_\t", "\t_lt_\t", "\t_gt_\t", "'"), array("&nbsp;", "&lt;", "&gt;", "&#039;"), $str);
@@ -628,7 +628,7 @@ function get_sql_search($search_ca_name, $search_field, $search_text, $search_op

            // SQL Injection 방지
            // 필드값에 a-z A-Z 0-9 _ , | 이외의 값이 있다면 검색필드를 wr_subject 로 설정한다.
-            $field[$k] = preg_match("/^[\w\,\|]+$/", $field[$k]) ? $field[$k] : "wr_subject";
+            $field[$k] = preg_match("/^[\w\,\|]+$/", $field[$k]) ? strtolower($field[$k]) : "wr_subject";

            $str .= $op2;
            switch ($field[$k]) {
@@ -712,7 +712,7 @@ function get_member($mb_id, $fields='*')
 // 제목별로 컬럼 정렬하는 QUERY STRING
 function subject_sort_link($col, $query_string='', $flag='asc')
 {
-    global $sst, $sod, $sfl, $stx, $page;
+    global $sst, $sod, $sfl, $stx, $page, $sca;

    $q1 = "sst=$col";
    if ($flag == 'asc')
@@ -744,6 +744,7 @@ function subject_sort_link($col, $query_string='', $flag='asc')
    $arr_query[] = $q2;
    $arr_query[] = 'sfl='.$sfl;
    $arr_query[] = 'stx='.$stx;
+    $arr_query[] = 'sca='.$sca;
    $arr_query[] = 'page='.$page;
    $qstr = implode("&amp;", $arr_query);

@@ -796,7 +797,7 @@ function get_category_option($bo_table='', $ca_name='')
 {
    global $g5, $board, $is_admin;

-    $categories = explode("|", $board['bo_category_list'].($is_admin?"|공지":"")); // 구분자가 , 로 되어 있음
+    $categories = explode("|", $board['bo_category_list'].($is_admin?"|공지":"")); // 구분자가 | 로 되어 있음
    $str = "";
    for ($i=0; $i<count($categories); $i++) {
        $category = trim($categories[$i]);
@@ -1200,7 +1201,8 @@ function get_sideview($mb_id, $name='', $email='', $homepage='')
    global $g5;
    global $bo_table, $sca, $is_admin, $member;

-    $email = base64_encode($email);
+    $email_enc = new str_encrypt();
+    $email = $email_enc->encrypt($email);
    $homepage = set_http(clean_xss_tags($homepage));

    $name     = get_text($name, 0, true);
@@ -2422,6 +2424,8 @@ class html_process {
                if(!trim($link[1]))
                    continue;

+                $link[1] = preg_replace('#\.css([\'\"]?>)$#i', '.css?ver='.G5_CSS_VER.'$1', $link[1]);
+
                $stylesheet .= PHP_EOL.$link[1];
            }
        }
@@ -2446,6 +2450,8 @@ class html_process {
                if(!trim($js[1]))
                    continue;

+                $js[1] = preg_replace('#\.js([\'\"]?>)$#i', '.js?ver='.G5_JS_VER.'$1', $js[1]);
+
                $javascript .= $php_eol.$js[1];
                $php_eol = PHP_EOL;
            }
@@ -2463,7 +2469,10 @@ class html_process {
        <body>
        전에 스킨의 자바스크립트가 위치하도록 하게 한다.
        */
-        $buffer = preg_replace('#(</head>[^<]*<body[^>]*>)#', "$javascript\n$1", $buffer);
+        $nl = '';
+        if($javascript)
+            $nl = "\n";
+        $buffer = preg_replace('#(</head>[^<]*<body[^>]*>)#', "$javascript{$nl}$1", $buffer);

        return $buffer;
    }
@@ -2657,7 +2666,10 @@ if (!function_exists("get_sock")) {
        $fp = fsockopen ($host, 80, $errno, $errstr, 30);
        if (!$fp)
        {
-            die("$errstr ($errno)\n");
+            //die("$errstr ($errno)\n");
+
+            echo "$errstr ($errno)\n";
+            return null;
        }
        else
        {
@@ -2979,10 +2991,32 @@ function check_url_host($url, $msg='', $return_url=G5_URL)

    $p = @parse_url($url);
    $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
+    $is_host_check = false;

-    if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host'])) {
+    if(stripos($url, 'http:') !== false) {
+        if(!isset($p['scheme']) || !$p['scheme'] || !isset($p['host']) || !$p['host'])
+            alert('url 정보가 올바르지 않습니다.', $return_url);
+    }
+
+    //php 5.6.29 이하 버전에서는 parse_url 버그가 존재함
+    if ( (isset($p['host']) && $p['host']) && version_compare(PHP_VERSION, '5.6.29') < 0) {
+        $bool_ch = false;
+        foreach( array('user','host') as $key) {
+            if ( isset( $p[ $key ] ) && strpbrk( $p[ $key ], ':/?#@' ) ) {
+                $bool_ch = true;
+            }
+        }
+        if( $bool_ch ){
+            $regex = '/https?\:\/\/'.$host.'/i';
+            if( ! preg_match($regex, $url) ){
+                $is_host_check = true;
+            }
+        }
+    }
+
+    if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host']) || $is_host_check) {
        //if ($p['host'].(isset($p['port']) ? ':'.$p['port'] : '') != $_SERVER['HTTP_HOST']) {
-        if ($p['host'] != $host) {
+        if ( ($p['host'] != $host) || $is_host_check ) {
            echo '<script>'.PHP_EOL;
            echo 'alert("url에 타 도메인을 지정할 수 없습니다.");'.PHP_EOL;
            echo 'document.location.href = "'.$return_url.'";'.PHP_EOL;
@@ -3173,4 +3207,145 @@ function check_vaild_callback($callback){
             return true;
   }
 }
+
+// 문자열 암복호화
+class str_encrypt
+{
+    var $salt;
+    var $lenght;
+
+    function __construct($salt='')
+    {
+        if(!$salt)
+            $this->salt = md5(preg_replace('/[^0-9A-Za-z]/', substr(G5_MYSQL_USER, -1), G5_MYSQL_PASSWORD));
+        else
+            $this->salt = $salt;
+
+        $this->length = strlen($this->salt);
+    }
+
+    function encrypt($str)
+    {
+        $length = strlen($str);
+        $result = '';
+
+        for($i=0; $i<$length; $i++) {
+            $char    = substr($str, $i, 1);
+            $keychar = substr($this->salt, ($i % $this->length) - 1, 1);
+            $char    = chr(ord($char) + ord($keychar));
+            $result .= $char;
+        }
+
+        return base64_encode($result);
+    }
+
+    function decrypt($str) {
+        $result = '';
+        $str    = base64_decode($str);
+        $length = strlen($str);
+
+        for($i=0; $i<$length; $i++) {
+            $char    = substr($str, $i, 1);
+            $keychar = substr($this->salt, ($i % $this->length) - 1, 1);
+            $char    = chr(ord($char) - ord($keychar));
+            $result .= $char;
+        }
+
+        return $result;
+    }
+}
+
+// 불법접근을 막도록 토큰을 생성하면서 토큰값을 리턴
+function get_write_token($bo_table)
+{
+    $token = md5(uniqid(rand(), true));
+    set_session('ss_write_'.$bo_table.'_token', $token);
+
+    return $token;
+}
+
+
+// POST로 넘어온 토큰과 세션에 저장된 토큰 비교
+function check_write_token($bo_table)
+{
+    if(!$bo_table)
+        alert('올바른 방법으로 이용해 주십시오.', G5_URL);
+
+    $token = get_session('ss_write_'.$bo_table.'_token');
+    set_session('ss_write_'.$bo_table.'_token', '');
+
+    if(!$token || !$_REQUEST['token'] || $token != $_REQUEST['token'])
+        alert('올바른 방법으로 이용해 주십시오.', G5_URL);
+
+    return true;
+}
+
+function get_call_func_cache($func, $args=array()){
+    
+    static $cache = array();
+
+    $key = md5(serialize($args));
+
+    if( isset($cache[$func]) && isset($cache[$func][$key]) ){
+        return $cache[$func][$key];
+    }
+
+    $result = null;
+
+    try{
+        $cache[$func][$key] = $result = call_user_func_array($func, $args);
+    } catch (Exception $e) {
+        return null;
+    }
+    
+    return $result;
+}
+
+// include 하는 경로에 data file 경로가 포함되어 있는지 체크합니다.
+function is_include_path_check($path='')
+{
+    if( $path ){
+        try {
+            // whether $path is unix or not
+            $unipath = strlen($path)==0 || $path{0}!='/';
+            $unc = substr($path,0,2)=='\\\\'?true:false;
+            // attempts to detect if path is relative in which case, add cwd
+            if(strpos($path,':') === false && $unipath && !$unc){
+                $path=getcwd().DIRECTORY_SEPARATOR.$path;
+                if($path{0}=='/'){
+                    $unipath = false;
+                }
+            }
+
+            // resolve path parts (single dot, double dot and double delimiters)
+            $path = str_replace(array('/', '\\'), DIRECTORY_SEPARATOR, $path);
+            $parts = array_filter(explode(DIRECTORY_SEPARATOR, $path), 'strlen');
+            $absolutes = array();
+            foreach ($parts as $part) {
+                if ('.'  == $part){
+                    continue;
+                }
+                if ('..' == $part) {
+                    array_pop($absolutes);
+                } else {
+                    $absolutes[] = $part;
+                }
+            }
+            $path = implode(DIRECTORY_SEPARATOR, $absolutes);
+            // resolve any symlinks
+            // put initial separator that could have been lost
+            $path = !$unipath ? '/'.$path : $path;
+            $path = $unc ? '\\\\'.$path : $path;
+        } catch (Exception $e) {
+            //echo 'Caught exception: ',  $e->getMessage(), "\n";
+            return false;
+        }
+
+        if( preg_match('/\/data\/(file|editor)\/[A-Za-z0-9_]{1,20}\//', $path) ){
+            return false;
+        }
+    }
+
+    return true;
+}
 ?>
@@ -66,7 +66,7 @@ function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time=

        if($cache_fwrite) {
            $handle = fopen($cache_file, 'w');
-            $cache_content = "<?php\nif (!defined('_GNUBOARD_')) exit;\n\$bo_subject='".$bo_subject."';\n\$list=".var_export($list, true)."?>";
+            $cache_content = "<?php\nif (!defined('_GNUBOARD_')) exit;\n\$bo_subject='".sql_escape_string($bo_subject)."';\n\$list=".var_export($list, true)."?>";
            fwrite($handle, $cache_content);
            fclose($handle);
        }
@@ -1,7 +1,7 @@
 <?php
 if (!defined('_GNUBOARD_')) exit;

-include_once(G5_PHPMAILER_PATH.'/class.phpmailer.php');
+include_once(G5_PHPMAILER_PATH.'/PHPMailerAutoload.php');

 // 메일 보내기 (파일 여러개 첨부 가능)
 // type : text=0, html=1, text+html=2
@@ -20,24 +20,27 @@ function mailer($fname, $fmail, $to, $subject, $content, $type=0, $file="", $cc=
    if (defined('G5_SMTP') && G5_SMTP) {
        $mail->IsSMTP(); // telling the class to use SMTP
        $mail->Host = G5_SMTP; // SMTP server
+        if(defined('G5_SMTP_PORT') && G5_SMTP_PORT)
+            $mail->Port = G5_SMTP_PORT;
    }
+    $mail->CharSet = 'UTF-8';
    $mail->From = $fmail;
    $mail->FromName = $fname;
    $mail->Subject = $subject;
    $mail->AltBody = ""; // optional, comment out and test
-    $mail->MsgHTML($content);
-    $mail->AddAddress($to);
+    $mail->msgHTML($content);
+    $mail->addAddress($to);
    if ($cc)
-        $mail->AddCC($cc);
+        $mail->addCC($cc);
    if ($bcc)
-        $mail->AddBCC($bcc);
+        $mail->addBCC($bcc);
    //print_r2($file); exit;
    if ($file != "") {
        foreach ($file as $f) {
-            $mail->AddAttachment($f['path'], $f['name']);
+            $mail->addAttachment($f['path'], $f['name']);
        }
    }
-    return $mail->Send();
+    return $mail->send();
 }

 // 파일을 첨부함
@@ -46,364 +49,7 @@ function attach_file($filename, $tmp_name)
    // 서버에 업로드 되는 파일은 확장자를 주지 않는다. (보안 취약점)
    $dest_file = G5_DATA_PATH.'/tmp/'.str_replace('/', '_', $tmp_name);
    move_uploaded_file($tmp_name, $dest_file);
-    /*
-    $fp = fopen($tmp_name, "r");
-    $tmpfile = array(
-        "name" => $filename,
-        "tmp_name" => $tmp_name,
-        "data" => fread($fp, filesize($tmp_name)));
-    fclose($fp);
-    */
    $tmpfile = array("name" => $filename, "path" => $dest_file);
    return $tmpfile;
 }
-
-/*
-// 메일 보내기 (파일 여러개 첨부 가능)
-// type : text=0, html=1, text+html=2
-function mailer($fname, $fmail, $to, $subject, $content, $type=0, $file="", $cc="", $bcc="")
-{
-    global $config;
-    global $g5;
-
-    // 메일발송 사용을 하지 않는다면
-    if (!$config['cf_email_use']) return;
-
-    $boundary = uniqid(time());
-
-    $header = "Message-ID: <".generate_mail_id(preg_replace("/@.+$/i","",$to)).">\r\n".
-              "From:=?utf-8?B?".base64_encode($fname)."?=<$fmail>\r\n";
-    if ($cc)  $header .= "Cc: $cc\n";
-    if ($bcc) $header .= "Bcc: $bcc\n";
-    $header .= "MIME-Version: 1.0\n";
-    $header .= "X-Mailer: SIR Mailer 0.94 : {$_SERVER['SERVER_ADDR']} : {$_SERVER['REMOTE_ADDR']} : ".G5_URL." : {$_SERVER['SCRIPT_NAME']} : {$_SERVER['HTTP_REFERER']} \n";
-    $header .= "Date: ".date ("D, j M Y H:i:s T",time())."\r\n".
-               "To: $to\r\n".
-               "Subject: =?utf-8?B?".base64_encode($subject)."?=\r\n";
-
-    if ($file == "") {
-        $header .= "Content-Type: MULTIPART/ALTERNATIVE;\n".
-                   "              BOUNDARY=\"$boundary\"\n\n";
-    } else {
-        $header .= "Content-Type: MULTIPART/MIXED;\n".
-                   "              BOUNDARY=\"$boundary\"\n\n";
-    }
-
-    if ($type == 2)
-        $content = nl2br($content);
-
-    $strip_content  = stripslashes(trim($content));
-    $encode_content = chunk_split(base64_encode($strip_content));
-
-    $body = "";
-    $body .= "\n--$boundary\n";
-    $body .= "Content-Type: TEXT/PLAIN; charset=utf-8\n";
-    $body .= "Content-Transfer-Encoding: BASE64\n\n";
-    $body .= $encode_content;
-    $body .= "\n--$boundary\n";
-
-    if ($type) {
-        $body .= "Content-Type: TEXT/HTML; charset=utf-8\n";
-        $body .= "Content-Transfer-Encoding: BASE64\n\n";
-        $body .= $encode_content;
-        $body .= "\n--$boundary\n";
-    }
-
-    if ($file != "") {
-        foreach ($file as $f) {
-            $body .= "n--$boundary\n";
-            $body .= "Content-Type: APPLICATION/OCTET-STREAM; name=$fname\n";
-            $body .= "Content-Transfer-Encoding: BASE64\n";
-            $body .= "Content-Disposition: inline; filename=$fname\n";
-
-            $body .= "\n";
-            $body .= chunk_split(base64_encode($f['data']));
-            $body .= "\n";
-        }
-        $body .= "--$boundary--\n";
-    }
-
-    $mails['to'] = $to;
-    $mails['from'] = $fmail;
-    $mails['text'] = $header.$body;
-
-    if (defined(G5_SMTP)) {
-        ini_set('SMTP', G5_SMTP);
-        @mail($to, $subject, $body, $header, "-f $fmail");
-    } else {
-        new maildaemon($mails);
-    }
-}
-
-// 파일 첨부시
-$fp = fopen(__FILE__, "r");
-$file[] = array(
-    "name"=>basename(__FILE__),
-    "data"=>fread($fp, filesize(__FILE__)));
-fclose($fp);
-
-// 메일 유효성 검사
-// core PHP Programming 책 참고
-// hanmail.net , hotmail.com , kebi.com 등이 정상적이지 않음으로 사용 불가
-function verify_email($address, &$error)
-{
-    global $g5;
-
-    $WAIT_SECOND = 3; // ?초 기다림
-
-    list($user, $domain) = explode("@", $address);
-
-    // 도메인에 메일 교환기가 존재하는지 검사
-    if (checkdnsrr($domain, "MX")) {
-        // 메일 교환기 레코드들을 얻는다
-        if (!getmxrr($domain, $mxhost, $mxweight)) {
-            $error = '메일 교환기를 회수할 수 없음';
-            return false;
-        }
-    } else {
-        // 메일 교환기가 없으면, 도메인 자체가 편지를 받는 것으로 간주
-        $mxhost[] = $domain;
-        $mxweight[] = 1;
-    }
-
-    // 메일 교환기 호스트의 배열을 만든다.
-    for ($i=0; $i<count($mxhost); $i++)
-        $weighted_host[($mxweight[$i])] = $mxhost[$i];
-    ksort($weighted_host);
-
-    // 각 호스트를 검사
-    foreach($weighted_host as $host) {
-        // 호스트의 SMTP 포트에 연결
-        if (!($fp = @fsockopen($host, 25))) continue;
-
-        // 220 메세지들은 건너뜀
-        // 3초가 지나도 응답이 없으면 포기
-        socket_set_blocking($fp, false);
-        $stoptime = G5_SERVER_TIME + $WAIT_SECOND;
-        $gotresponse = false;
-
-        while (true) {
-            // 메일서버로부터 한줄 얻음
-            $line = fgets($fp, 1024);
-
-            if (substr($line, 0, 3) == '220') {
-                // 타이머를 초기화
-                $stoptime = G5_SERVER_TIME + $WAIT_SECOND;
-                $gotresponse = true;
-            } else if ($line == '' && $gotresponse)
-                break;
-            else if (G5_SERVER_TIME > $stoptime)
-                break;
-        }
-
-        // 이 호스트는 응답이 없음. 다음 호스트로 넘어간다
-        if (!$gotresponse) continue;
-
-        socket_set_blocking($fp, true);
-
-        // SMTP 서버와의 대화를 시작
-        fputs($fp, "HELO {$_SERVER['SERVER_NAME']}\r\n");
-        echo "HELO {$_SERVER['SERVER_NAME']}\r\n";
-        fgets($fp, 1024);
-
-        // From을 설정
-        fputs($fp, "MAIL FROM: <info@$domain>\r\n");
-        echo "MAIL FROM: <info@$domain>\r\n";
-        fgets($fp, 1024);
-
-        // 주소를 시도
-        fputs($fp, "RCPT TO: <$address>\r\n");
-        echo "RCPT TO: <$address>\r\n";
-        $line = fgets($fp, 1024);
-
-        // 연결을 닫음
-        fputs($fp, "QUIT\r\n");
-        fclose($fp);
-
-        if (substr($line, 0, 3) != '250') {
-            // SMTP 서버가 이 주소를 인식하지 못하므로 잘못된 주소임
-            $error = $line;
-            return false;
-        } else
-            // 주소를 인식했음
-            return true;
-
-    }
-
-    $error = '메일 교환기에 도달하지 못하였습니다.';
-    return false;
-}
-
-
-# jsboard 의 메일보내기 class를 추가합니다. 130808
-# http://kldp.net/projects/jsboard/
-
-# mail 보내기 함수 2001.11.30 김정균
-# $Id: include/sendmail.php,v 1.4 2009/11/19 05:29:51 oops Exp $
-
-# 서버상의 smtp daemon 에 의존하지 않고 직접 발송하는 smtp class
-#
-# 특정 배열로 class 에 전달을 하여 메일을 발송한다. 배열은 아래을 참조한다.
-#
-# debug -> debug 를 할지 안할지를 결정한다.
-# ofhtml -> 웹상에서 사용할지 쉘상에서 사용할지를 결정한다.
-# from -> 메일을 발송하는 사람의 메일주소
-# to -> 메일을 받을 사람의 메일 주소
-# text -> 헤더 내용을 포함한 메일 본문
-#
-class maildaemon {
-  var $failed = 0;
-
-  function __construct($v) {
-    $this->debug = $v['debug'];
-    $this->ofhtml = $v['ofhtml'];
-    if($_SERVER['SERVER_NAME']) $this->helo = $_SERVER['SERVER_NAME'];
-    if(!$this->helo || preg_match("/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/i",$this->helo))
-      $this->helo = "JSBoardMessage";
-
-    $this->from = $v['from'];
-    $this->to   = $v['to'];
-    $this->body = $v['text']."\r\n.";
-
-    //die($v['text']);
-    $this->newline = $this->ofhtml ? "<br>\n" : "\n";
-
-    $this->mx = $this->getMX($this->to);
-
-    if($this->debug) {
-      echo "DEBUG: ".$this->mx." start".$this->newline;
-      echo "################################################################".$this->newline;
-    }
-    $this->sockets("open");
-    $this->send("HELO ".$this->helo);
-    $this->send("MAIL FROM: <".$this->from.">");
-    $this->send("RCPT TO: <".$this->to.">");
-    $this->send("data");
-    $this->send($this->body);
-    $this->send("quit");
-    $this->sockets("close");
-  }
-
-  function getMX($email) {
-    $dev = explode("@",$email);
-    $account = $dev[0];
-    $host = $dev[1];
-
-    if(checkdnsrr($host,"MX") && getmxrr($host,$mx,$weight)) {
-      $idx = 0;
-      for($i=0;$i<sizeof($mx);$i++) {
-        $dest = $dest ? $dest : $weight[$i];
-        if($dest > $weight[$i]) {
-          $dest = $weight[$i];
-          $idx = $i;
-        }
-      }
-    } else return $host;
-    return $mx[$idx];
-  }
-
-  # 디버그 함수
-  #  $t -> 1 (debug of socket open,close)
-  #        0 (regular smtp message)
-  #  $p -> 1 (print detail debug)
-  #
-  # return 1 -> success
-  # return 0 -> failed
-  #
-  function debug($str,$t=0,$p=0) {
-    if($t) {
-      if(!$str) $this->failed = 1;
-      if($this->sock) $returnmsg = trim(fgets($this->sock,1024));
-    } else {
-      if(!preg_match("/^(220|221|250|251|354)$/",substr(trim($str),0,3)))
-        $this->failed = 1;
-    }
-
-    # DEBUG mode -> 모든 메세지 출력
-    if($p) {
-      if($t) {
-        $str = "Conncet ".$this->mx;
-        $str .= $this->failed ? " Failed" : " Success";
-        $str .= $this->newline."DEBUG: $returnmsg";
-      }
-      echo "DEBUG: $str".$this->newline;
-    }
-
-    # DEBUG 모드가 아닐때, 에러 메세지 출력
-    if(!$p && $this->failed) {
-      if($this->ofhtml) echo "<SCRIPT>\nalert('$str')\n</SCRIPT>\n";
-      else "ERROR: $str\n";
-    }
-  }
-
-  function sockets($option=0) {
-    switch($option) {
-      case "open" :
-        $this->sock = @fsockopen($this->mx,25,$this->errno,$this->errstr,30);
-        $this->debug($this->sock,1,$this->debug);
-        break;
-      default :
-        if($this->sock) fclose($this->sock);
-        break;
-    }
-  }
-
-  function send($str,$chk=0) {
-    if(!$this->failed) {
-      if($this->debug) {
-        if(preg_match("/\r\n/",trim($str)))
-          $str_debug = trim(str_replace("\r\n","\r\n       ",$str));
-        else $str_debug = $str;
-      }
-      fputs($this->sock,"$str\r\n");
-      $recv = trim(fgets($this->sock,1024));
-      $recvchk = $recv;
-      $this->debug($recv,0,$this->debug);
-
-      if(preg_match("/Mail From:/i",$str) && preg_match("/exist|require|error/i",$recvchk) && !$chk) {
-        $this->failed = 0;
-        $this->send("MAIL FROM: <".$this->to.">",1);
-      }
-    }
-  }
-}
-
-
-function generate_mail_id($uid) {
-  $id = date("YmdHis",time());
-  mt_srand((float) microtime() * 1000000);
-  $randval = mt_rand();
-  $id .= $randval."@$uid";
-  return $id;
-}
-
-
-function mail_header($to,$from,$title,$mta=0) {
-  global $langs,$boundary;
-
-  # mail header 를 작성
-  $boundary = get_boundary_msg();
-  $header = "Message-ID: <".generate_mail_id(preg_replace("/@.+$/i","",$to)).">\r\n".
-            "From:=?utf-8?B?".base64_encode('보내는사람')."?=<$from>\r\n".
-            "MIME-Version: 1.0\r\n";
-
-  if(!$mta) $header .= "Date: ".date ("D, j M Y H:i:s T",time())."\r\n".
-                       "To: $to\r\n".
-                       "Subject: $title\r\n";
-
-  $header .= "Content-Type: multipart/alternative;\r\n".
-             "              boundary=\"$boundary\"\r\n\r\n";
-
-  return $header;
-}
-
-
-function get_boundary_msg() {
-  $uniqchr = uniqid("");
-  $one = strtoupper($uniqchr[0]);
-  $two = strtoupper(substr($uniqchr,0,8));
-  $three = strtoupper(substr(strrev($uniqchr),0,8));
-  return "----=_NextPart_000_000${one}_${two}.${three}";
-}
-*/
 ?>
@@ -4,7 +4,7 @@ if (!defined('_GNUBOARD_')) exit;
@ini_set('memory_limit', '-1');

 // 게시글리스트 썸네일 생성
-function get_list_thumbnail($bo_table, $wr_id, $thumb_width, $thumb_height, $is_create=false, $is_crop=true, $crop_mode='center', $is_sharpen=false, $um_value='80/0.5/3')
+function get_list_thumbnail($bo_table, $wr_id, $thumb_width, $thumb_height, $is_create=false, $is_crop=false, $crop_mode='center', $is_sharpen=false, $um_value='80/0.5/3')
 {
    global $g5, $config;
    $filename = $alt = "";
@@ -238,10 +238,10 @@ function thumbnail($filename, $source_path, $target_path, $thumb_width, $thumb_h
    $degree = 0;

    if ($size[2] == 1) {
-        $src = imagecreatefromgif($source_file);
-        $src_transparency = imagecolortransparent($src);
+        $src = @imagecreatefromgif($source_file);
+        $src_transparency = @imagecolortransparent($src);
    } else if ($size[2] == 2) {
-        $src = imagecreatefromjpeg($source_file);
+        $src = @imagecreatefromjpeg($source_file);

        if(function_exists('exif_read_data')) {
            // exif 정보를 기준으로 회전각도 구함
@@ -273,8 +273,8 @@ function thumbnail($filename, $source_path, $target_path, $thumb_width, $thumb_h
            }
        }
    } else if ($size[2] == 3) {
-        $src = imagecreatefrompng($source_file);
-        imagealphablending($src, true);
+        $src = @imagecreatefrompng($source_file);
+        @imagealphablending($src, true);
    } else {
        return;
    }
@@ -330,20 +330,52 @@ function thumbnail($filename, $source_path, $target_path, $thumb_width, $thumb_h
                    }
                    break;
            }
-        }

-        $dst = imagecreatetruecolor($dst_w, $dst_h);
+            $dst = imagecreatetruecolor($dst_w, $dst_h);

-        if($size[2] == 3) {
-            imagealphablending($dst, false);
-            imagesavealpha($dst, true);
-        } else if($size[2] == 1) {
-            $palletsize = imagecolorstotal($src);
-            if($src_transparency >= 0 && $src_transparency < $palletsize) {
-                $transparent_color   = imagecolorsforindex($src, $src_transparency);
-                $current_transparent = imagecolorallocate($dst, $transparent_color['red'], $transparent_color['green'], $transparent_color['blue']);
-                imagefill($dst, 0, 0, $current_transparent);
-                imagecolortransparent($dst, $current_transparent);
+            if($size[2] == 3) {
+                imagealphablending($dst, false);
+                imagesavealpha($dst, true);
+            } else if($size[2] == 1) {
+                $palletsize = imagecolorstotal($src);
+                if($src_transparency >= 0 && $src_transparency < $palletsize) {
+                    $transparent_color   = imagecolorsforindex($src, $src_transparency);
+                    $current_transparent = imagecolorallocate($dst, $transparent_color['red'], $transparent_color['green'], $transparent_color['blue']);
+                    imagefill($dst, 0, 0, $current_transparent);
+                    imagecolortransparent($dst, $current_transparent);
+                }
+            }
+        } else { // 비율에 맞게 생성
+            $dst = imagecreatetruecolor($dst_w, $dst_h);
+            $bgcolor = imagecolorallocate($dst, 255, 255, 255); // 배경색
+
+            if($src_w > $src_h) {
+                $tmp_h = round(($dst_w * $src_h) / $src_w);
+                $dst_y = round(($dst_h - $tmp_h) / 2);
+                $dst_h = $tmp_h;
+            } else {
+                $tmp_w = round(($dst_h * $src_w) / $src_h);
+                $dst_x = round(($dst_w - $tmp_w) / 2);
+                $dst_w = $tmp_w;
+            }
+
+            if($size[2] == 3) {
+                $bgcolor = imagecolorallocatealpha($dst, 0, 0, 0, 127);
+                imagefill($dst, 0, 0, $bgcolor);
+                imagealphablending($dst, false);
+                imagesavealpha($dst, true);
+            } else if($size[2] == 1) {
+                $palletsize = imagecolorstotal($src);
+                if($src_transparency >= 0 && $src_transparency < $palletsize) {
+                    $transparent_color   = imagecolorsforindex($src, $src_transparency);
+                    $current_transparent = imagecolorallocate($dst, $transparent_color['red'], $transparent_color['green'], $transparent_color['blue']);
+                    imagefill($dst, 0, 0, $current_transparent);
+                    imagecolortransparent($dst, $current_transparent);
+                } else {
+                    imagefill($dst, 0, 0, $bgcolor);
+                }
+            } else {
+                imagefill($dst, 0, 0, $bgcolor);
            }
        }
    } else {
@@ -17,7 +17,7 @@ $sql = " select bo_table, bo_subject
              and bo_device <> 'pc' ";
 if(!$is_admin)
    $sql .= " and bo_use_cert = '' ";
-$sql .= " order by bo_table ";
+$sql .= " order by bo_order ";
 $result = sql_query($sql);
 for ($i=0; $row=sql_fetch_array($result); $i++) {
    // 이 함수가 바로 최신글을 추출하는 역할을 합니다.
@@ -53,8 +53,10 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
            $query_string = clean_query_string($_SERVER['QUERY_STRING']);

            if($w == 'cu') {
-                $sql = " select wr_id, wr_content from $write_table where wr_id = '$c_id' and wr_is_comment = '1' ";
+                $sql = " select wr_id, wr_content, mb_id from $write_table where wr_id = '$c_id' and wr_is_comment = '1' ";
                $cmt = sql_fetch($sql);
+                if (!($is_admin || ($member['mb_id'] == $cmt['mb_id'] && $cmt['mb_id'])))
+                    $cmt['wr_content'] = '';
                $c_wr_content = $cmt['wr_content'];
            }

@@ -81,7 +83,7 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
    ?>
    <aside id="bo_vc_w">
        <h2>댓글쓰기</h2>
-        <form name="fviewcomment" action="./write_comment_update.php" onsubmit="return fviewcomment_submit(this);" method="post" autocomplete="off">
+        <form name="fviewcomment" action="<?php echo $comment_action_url; ?>" onsubmit="return fviewcomment_submit(this);" method="post" autocomplete="off">
        <input type="hidden" name="w" value="<?php echo $w ?>" id="w">
        <input type="hidden" name="bo_table" value="<?php echo $bo_table ?>">
        <input type="hidden" name="wr_id" value="<?php echo $wr_id ?>">
@@ -248,6 +250,8 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대

        <?php if($is_guest) echo chk_captcha_js(); ?>

+        set_comment_token(f);
+
        document.getElementById("btn_submit").disabled = "disabled";

        return true;
@@ -53,8 +53,10 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
            $query_string = clean_query_string($_SERVER['QUERY_STRING']);

            if($w == 'cu') {
-                $sql = " select wr_id, wr_content from $write_table where wr_id = '$c_id' and wr_is_comment = '1' ";
+                $sql = " select wr_id, wr_content, mb_id from $write_table where wr_id = '$c_id' and wr_is_comment = '1' ";
                $cmt = sql_fetch($sql);
+                if (!($is_admin || ($member['mb_id'] == $cmt['mb_id'] && $cmt['mb_id'])))
+                    $cmt['wr_content'] = '';
                $c_wr_content = $cmt['wr_content'];
            }

@@ -81,7 +83,7 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
    ?>
    <aside id="bo_vc_w">
        <h2>댓글쓰기</h2>
-        <form name="fviewcomment" action="./write_comment_update.php" onsubmit="return fviewcomment_submit(this);" method="post" autocomplete="off">
+        <form name="fviewcomment" action="<?php echo $comment_action_url; ?>" onsubmit="return fviewcomment_submit(this);" method="post" autocomplete="off">
        <input type="hidden" name="w" value="<?php echo $w ?>" id="w">
        <input type="hidden" name="bo_table" value="<?php echo $bo_table ?>">
        <input type="hidden" name="wr_id" value="<?php echo $wr_id ?>">
@@ -248,6 +250,8 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대

        <?php if($is_guest) echo chk_captcha_js(); ?>

+        set_comment_token(f);
+
        document.getElementById("btn_submit").disabled = "disabled";

        return true;
@@ -77,7 +77,7 @@ if( count($faq_master_list) ){

 <?php
 // 하단 HTML
-echo '<div id="faq_thtml">'.conv_content($fm['fm_tail_html'], 1).'</div>';
+echo '<div id="faq_thtml">'.conv_content($fm['fm_mobile_tail_html'], 1).'</div>';
 ?>

 <div id="faq_sch">
@@ -11,7 +11,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
    <form name="fformmail" action="./formmail_send.php" onsubmit="return fformmail_submit(this);" method="post" enctype="multipart/form-data" style="margin:0px;">
    <input type="hidden" name="to" value="<?php echo $email ?>">
    <input type="hidden" name="attach" value="2">
-    <input type="hidden" name="token" value="<?php echo $token ?>">
    <?php if ($is_member) { // 회원이면 ?>
    <input type="hidden" name="fnick" value="<?php echo get_text($member['mb_nick']); ?>">
    <input type="hidden" name="fmail" value="<?php echo $member['mb_email'] ?>">
@@ -19,6 +19,13 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
        <table>
        <caption>쪽지쓰기</caption>
        <tbody>
+        <?php if ($config['cf_memo_send_point']) { ?>
+        <tr>
+            <td colspan="2">
+                <strong>쪽지 보낼때 회원당 <?php echo number_format($config['cf_memo_send_point']); ?>점의 포인트를 차감합니다.</strong>
+            </td>
+        </tr>
+        <?php } ?>
        <tr>
            <th scope="row"><label for="me_recv_mb_id">받는 회원아이디<strong class="sound_only">필수</strong></label></th>
            <td>
@@ -8,7 +8,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
 <div class="mbskin">
    <script src="<?php echo G5_JS_URL ?>/jquery.register_form.js"></script>
    <?php if($config['cf_cert_use'] && ($config['cf_cert_ipin'] || $config['cf_cert_hp'])) { ?>
-    <script src="<?php echo G5_JS_URL ?>/certify.js"></script>
+    <script src="<?php echo G5_JS_URL ?>/certify.js?v=<?php echo G5_JS_VER; ?>"></script>
    <?php } ?>

    <form name="fregisterform" id="fregisterform" action="<?php echo $register_action_url ?>" onsubmit="return fregisterform_submit(this);" method="post" enctype="multipart/form-data" autocomplete="off">
@@ -60,7 +60,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
                if($config['cf_cert_use']) {
                    if($config['cf_cert_ipin'])
                        echo '<button type="button" id="win_ipin_cert" class="btn_frmline">아이핀 본인확인</button>'.PHP_EOL;
-                    if($config['cf_cert_hp'] && $config['cf_cert_hp'] != 'lg')
+                    if($config['cf_cert_hp'])
                        echo '<button type="button" id="win_hp_cert" class="btn_frmline">휴대폰 본인확인</button>'.PHP_EOL;

                    echo '<noscript>본인확인을 위해서는 자바스크립트 사용이 가능해야합니다.</noscript>'.PHP_EOL;
@@ -122,7 +122,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
        </tr>
        <?php } ?>

-        <?php if ($config['cf_use_hp']) {  ?>
+        <?php if ($config['cf_use_hp'] || $config['cf_cert_hp']) {  ?>
        <tr>
            <th scope="row"><label for="reg_mb_hp">휴대폰번호<?php if ($config['cf_req_hp']) { ?><strong class="sound_only">필수</strong><?php } ?></label></th>
            <td>
@@ -288,6 +288,10 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
                    $cert_url = G5_KCPCERT_URL.'/kcpcert_form.php';
                    $cert_type = 'kcp-hp';
                    break;
+                case 'lg':
+                    $cert_url = G5_LGXPAY_URL.'/AuthOnlyReq.php';
+                    $cert_type = 'lg-hp';
+                    break;
                default:
                    echo 'alert("기본환경설정에서 휴대폰 본인확인 설정을 해주십시오");';
                    echo 'return false;';
@@ -135,7 +135,8 @@
 #memo_list_ul {margin:0 20px;padding:0;border-top:1px solid #e9e9e9;list-style:none}
 #memo_list_ul li {position:relative;padding:10px 0;border-bottom:1px solid #e9e9e9}
 #memo_list_ul .memo_link {}
-#memo_list_ul .memo_send {position:absolute;top:10px;right:30px}
+#memo_list_ul .memo_send {display:block;margin-top:4px}
+#memo_list_ul .memo_send a{color:#777}
 #memo_list_ul .memo_read {font-size:0.95em;color:#666}
 #memo_list_ul .memo_del {position:absolute;top:10px;right:0}

@@ -7,7 +7,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$poll_skin_url.'/style.css">', 0)

 <form name="fpoll" action="<?php echo G5_BBS_URL ?>/poll_update.php" onsubmit="return fpoll_submit(this);" method="post">
 <input type="hidden" name="po_id" value="<?php echo $po_id ?>">
-<input type="hidden" name="skin_dir" value="<?php echo $skin_dir ?>">
+<input type="hidden" name="skin_dir" value="<?php echo urlencode($skin_dir); ?>">
 <aside id="poll">
    <header>
        <h2>설문조사</h2>
@@ -21,7 +21,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$poll_skin_url.'/style.css">', 0)
    </ul>
    <footer>
        <input type="submit" value="투표하기">
-        <a href="<?php echo G5_BBS_URL."/poll_result.php?po_id=$po_id&amp;skin_dir=$skin_dir" ?>" target="_blank" onclick="poll_result(this.href); return false;">결과보기</a>
+        <a href="<?php echo G5_BBS_URL."/poll_result.php?po_id=$po_id&amp;skin_dir=".urlencode($skin_dir); ?>" target="_blank" onclick="poll_result(this.href); return false;">결과보기</a>
    </footer>
 </aside>
 </form>
@@ -21,7 +21,7 @@ if(defined('G5_THEME_PATH')) {
    <div id="ft_copy">
        <div id="ft_company">
            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=company">회사소개</a>
-            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=privacy">개인정보취급방침</a>
+            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=privacy">개인정보처리방침</a>
            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=provision">서비스이용약관</a>
        </div>
        Copyright &copy; <b>소유하신 도메인.</b> All rights reserved.<br>
@@ -0,0 +1,49 @@
+<?php
+/**
+ * PHPMailer SPL autoloader.
+ * PHP Version 5
+ * @package PHPMailer
+ * @link https://github.com/PHPMailer/PHPMailer/ The PHPMailer GitHub project
+ * @author Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
+ * @author Jim Jagielski (jimjag) <jimjag@gmail.com>
+ * @author Andy Prevost (codeworxtech) <codeworxtech@users.sourceforge.net>
+ * @author Brent R. Matzelle (original founder)
+ * @copyright 2012 - 2014 Marcus Bointon
+ * @copyright 2010 - 2012 Jim Jagielski
+ * @copyright 2004 - 2009 Andy Prevost
+ * @license http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License
+ * @note This program is distributed in the hope that it will be useful - WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+/**
+ * PHPMailer SPL autoloader.
+ * @param string $classname The name of the class to load
+ */
+function PHPMailerAutoload($classname)
+{
+    //Can't use __DIR__ as it's only in PHP 5.3+
+    $filename = dirname(__FILE__).DIRECTORY_SEPARATOR.'class.'.strtolower($classname).'.php';
+    if (is_readable($filename)) {
+        require $filename;
+    }
+}
+
+if (version_compare(PHP_VERSION, '5.1.2', '>=')) {
+    //SPL autoloading was introduced in PHP 5.1.2
+    if (version_compare(PHP_VERSION, '5.3.0', '>=')) {
+        spl_autoload_register('PHPMailerAutoload', true, true);
+    } else {
+        spl_autoload_register('PHPMailerAutoload');
+    }
+} else {
+    /**
+     * Fall back to traditional autoload for old PHP versions
+     * @param string $classname The name of the class to load
+     */
+    function __autoload($classname)
+    {
+        PHPMailerAutoload($classname);
+    }
+}
@@ -0,0 +1,184 @@
+![PHPMailer](https://raw.github.com/PHPMailer/PHPMailer/master/examples/images/phpmailer.png)
+
+# PHPMailer - A full-featured email creation and transfer class for PHP
+
+Build status: [![Build Status](https://travis-ci.org/PHPMailer/PHPMailer.svg)](https://travis-ci.org/PHPMailer/PHPMailer)
+[![Scrutinizer Quality Score](https://scrutinizer-ci.com/g/PHPMailer/PHPMailer/badges/quality-score.png?s=3758e21d279becdf847a557a56a3ed16dfec9d5d)](https://scrutinizer-ci.com/g/PHPMailer/PHPMailer/)
+[![Code Coverage](https://scrutinizer-ci.com/g/PHPMailer/PHPMailer/badges/coverage.png?s=3fe6ca5fe8cd2cdf96285756e42932f7ca256962)](https://scrutinizer-ci.com/g/PHPMailer/PHPMailer/)
+
+[![Latest Stable Version](https://poser.pugx.org/phpmailer/phpmailer/v/stable.svg)](https://packagist.org/packages/phpmailer/phpmailer) [![Total Downloads](https://poser.pugx.org/phpmailer/phpmailer/downloads)](https://packagist.org/packages/phpmailer/phpmailer) [![Latest Unstable Version](https://poser.pugx.org/phpmailer/phpmailer/v/unstable.svg)](https://packagist.org/packages/phpmailer/phpmailer) [![License](https://poser.pugx.org/phpmailer/phpmailer/license.svg)](https://packagist.org/packages/phpmailer/phpmailer)
+
+## Class Features
+
+- Probably the world's most popular code for sending email from PHP!
+- Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more
+- Integrated SMTP support - send without a local mail server
+- Send emails with multiple TOs, CCs, BCCs and REPLY-TOs
+- Multipart/alternative emails for mail clients that do not read HTML email
+- Support for UTF-8 content and 8bit, base64, binary, and quoted-printable encodings
+- SMTP authentication with LOGIN, PLAIN, NTLM, CRAM-MD5 and Google's XOAUTH2 mechanisms over SSL and TLS transports
+- Error messages in 47 languages!
+- DKIM and S/MIME signing support
+- Compatible with PHP 5.0 and later
+- Much more!
+
+## Why you might need it
+
+Many PHP developers utilize email in their code. The only PHP function that supports this is the mail() function. However, it does not provide any assistance for making use of popular features such as HTML-based emails and attachments.
+
+Formatting email correctly is surprisingly difficult. There are myriad overlapping RFCs, requiring tight adherence to horribly complicated formatting and encoding rules - the vast majority of code that you'll find online that uses the mail() function directly is just plain wrong!
+*Please* don't be tempted to do it yourself - if you don't use PHPMailer, there are many other excellent libraries that you should look at before rolling your own - try SwiftMailer, Zend_Mail, eZcomponents etc.
+
+The PHP mail() function usually sends via a local mail server, typically fronted by a `sendmail` binary on Linux, BSD and OS X platforms, however, Windows usually doesn't include a local mail server; PHPMailer's integrated SMTP implementation allows email sending on Windows platforms without a local mail server.
+
+## License
+
+This software is distributed under the [LGPL 2.1](http://www.gnu.org/licenses/lgpl-2.1.html) license. Please read LICENSE for information on the
+software availability and distribution.
+
+## Installation & loading
+
+PHPMailer is available via [Composer/Packagist](https://packagist.org/packages/phpmailer/phpmailer) (using semantic versioning), so just add this line to your `composer.json` file:
+
+```json
+"phpmailer/phpmailer": "~5.2"
+```
+
+or
+
+```sh
+composer require phpmailer/phpmailer
+```
+
+If you want to use the Gmail XOAUTH2 authentication class, you will also need to add a dependency on the `league/oauth2-client` package.
+
+Alternatively, copy the contents of the PHPMailer folder into somewhere that's in your PHP `include_path` setting. If you don't speak git or just want a tarball, click the 'zip' button at the top of the page in GitHub.
+
+If you're not using composer's autoloader, PHPMailer provides an SPL-compatible autoloader, and that is the preferred way of loading the library - just `require '/path/to/PHPMailerAutoload.php';` and everything should work. The autoloader does not throw errors if it can't find classes so it prepends itself to the SPL list, allowing your own (or your framework's) autoloader to catch errors. SPL autoloading was introduced in PHP 5.1.0, so if you are using a version older than that you will need to require/include each class manually.
+
+PHPMailer does *not* declare a namespace because namespaces were only introduced in PHP 5.3.
+
+If you want to use Google's XOAUTH2 authentication mechanism, you need to be running at least PHP 5.4, and load the dependencies listed in `composer.json`.
+
+### Minimal installation
+
+While installing the entire package manually or with composer is simple, convenient and reliable, you may want to include only vital files in your project. At the very least you will need [class.phpmailer.php](class.phpmailer.php). If you're using SMTP, you'll need [class.smtp.php](class.smtp.php), and if you're using POP-before SMTP, you'll need [class.pop3.php](class.pop3.php). For all of these, we recommend you use [the autoloader](PHPMailerAutoload.php) too as otherwise you will either have to `require` all classes manually or use some other autoloader. You can skip the [language](language/) folder if you're not showing errors to users and can make do with English-only errors. You may need the additional classes in the [extras](extras/) folder if you are using those features, including NTLM authentication and ics generation. If you're using Google XOAUTH2 you will need `class.phpmaileroauth.php` and `class.oauth.php` classes too, as well as the composer dependencies.
+
+## A Simple Example
+
+```php
+<?php
+require 'PHPMailerAutoload.php';
+
+$mail = new PHPMailer;
+
+//$mail->SMTPDebug = 3;                               // Enable verbose debug output
+
+$mail->isSMTP();                                      // Set mailer to use SMTP
+$mail->Host = 'smtp1.example.com;smtp2.example.com';  // Specify main and backup SMTP servers
+$mail->SMTPAuth = true;                               // Enable SMTP authentication
+$mail->Username = 'user@example.com';                 // SMTP username
+$mail->Password = 'secret';                           // SMTP password
+$mail->SMTPSecure = 'tls';                            // Enable TLS encryption, `ssl` also accepted
+$mail->Port = 587;                                    // TCP port to connect to
+
+$mail->setFrom('from@example.com', 'Mailer');
+$mail->addAddress('joe@example.net', 'Joe User');     // Add a recipient
+$mail->addAddress('ellen@example.com');               // Name is optional
+$mail->addReplyTo('info@example.com', 'Information');
+$mail->addCC('cc@example.com');
+$mail->addBCC('bcc@example.com');
+
+$mail->addAttachment('/var/tmp/file.tar.gz');         // Add attachments
+$mail->addAttachment('/tmp/image.jpg', 'new.jpg');    // Optional name
+$mail->isHTML(true);                                  // Set email format to HTML
+
+$mail->Subject = 'Here is the subject';
+$mail->Body    = 'This is the HTML message body <b>in bold!</b>';
+$mail->AltBody = 'This is the body in plain text for non-HTML mail clients';
+
+if(!$mail->send()) {
+    echo 'Message could not be sent.';
+    echo 'Mailer Error: ' . $mail->ErrorInfo;
+} else {
+    echo 'Message has been sent';
+}
+```
+
+You'll find plenty more to play with in the [examples](examples/) folder.
+
+That's it. You should now be ready to use PHPMailer!
+
+## Localization
+PHPMailer defaults to English, but in the [language](language/) folder you'll find numerous (46 at the time of writing!) translations for PHPMailer error messages that you may encounter. Their filenames contain [ISO 639-1](http://en.wikipedia.org/wiki/ISO_639-1) language code for the translations, for example `fr` for French. To specify a language, you need to tell PHPMailer which one to use, like this:
+
+```php
+// To load the French version
+$mail->setLanguage('fr', '/optional/path/to/language/directory/');
+```
+
+We welcome corrections and new languages - if you're looking for corrections to do, run the [phpmailerLangTest.php](test/phpmailerLangTest.php) script in the tests folder and it will show any missing translations.
+
+## Documentation
+
+Examples of how to use PHPMailer for common scenarios can be found in the [examples](examples/) folder. If you're looking for a good starting point, we recommend you start with [the gmail example](examples/gmail.phps).
+
+There are tips and a troubleshooting guide in the [GitHub wiki](https://github.com/PHPMailer/PHPMailer/wiki). If you're having trouble, this should be the first place you look as it's the most frequently updated.
+
+Complete generated API documentation is [available online](http://phpmailer.github.io/PHPMailer/).
+
+You'll find some basic user-level docs in the [docs](docs/) folder, and you can generate complete API-level documentation using the [generatedocs.sh](docs/generatedocs.sh) shell script in the docs folder, though you'll need to install [PHPDocumentor](http://www.phpdoc.org) first. You may find [the unit tests](test/phpmailerTest.php) a good source of how to do various operations such as encryption.
+
+If the documentation doesn't cover what you need, search the [many questions on StackOverflow](http://stackoverflow.com/questions/tagged/phpmailer), and before you ask a question about "SMTP Error: Could not connect to SMTP host.", [read the troubleshooting guide](https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting).
+
+## Tests
+
+There is a PHPUnit test script in the [test](test/) folder.
+
+Build status: [![Build Status](https://travis-ci.org/PHPMailer/PHPMailer.svg)](https://travis-ci.org/PHPMailer/PHPMailer)
+
+If this isn't passing, is there something you can do to help?
+
+## Contributing
+
+Please submit bug reports, suggestions and pull requests to the [GitHub issue tracker](https://github.com/PHPMailer/PHPMailer/issues).
+
+We're particularly interested in fixing edge-cases, expanding test coverage and updating translations.
+
+With the move to the PHPMailer GitHub organisation, you'll need to update any remote URLs referencing the old GitHub location with a command like this from within your clone:
+
+```sh
+git remote set-url upstream https://github.com/PHPMailer/PHPMailer.git
+```
+
+Please *don't* use the SourceForge or Google Code projects any more.
+
+## Sponsorship
+
+Development time and resources for PHPMailer are provided by [Smartmessages.net](https://info.smartmessages.net/), a powerful email marketing system.
+
+<a href="https://info.smartmessages.net/"><img src="https://www.smartmessages.net/img/smartmessages-logo.svg" width="250" height="28" alt="Smartmessages email marketing"></a>
+
+Other contributions are gladly received, whether in beer 🍺, T-shirts 👕, Amazon wishlist raids, or cold, hard cash 💰.
+
+## Changelog
+
+See [changelog](changelog.md).
+
+## History
+- PHPMailer was originally written in 2001 by Brent R. Matzelle as a [SourceForge project](http://sourceforge.net/projects/phpmailer/).
+- Marcus Bointon (coolbru on SF) and Andy Prevost (codeworxtech) took over the project in 2004.
+- Became an Apache incubator project on Google Code in 2010, managed by Jim Jagielski.
+- Marcus created his fork on [GitHub](https://github.com/Synchro/PHPMailer).
+- Jim and Marcus decide to join forces and use GitHub as the canonical and official repo for PHPMailer.
+- PHPMailer moves to the [PHPMailer organisation](https://github.com/PHPMailer) on GitHub.
+
+### What's changed since moving from SourceForge?
+- Official successor to the SourceForge and Google Code projects.
+- Test suite.
+- Continuous integration with Travis-CI.
+- Composer support.
+- Public development.
+- Additional languages and language strings.
+- CRAM-MD5 authentication support.
+- Preserves full repo history of authors, commits and branches from the original SourceForge project.
@@ -0,0 +1 @@
+5.2.22
@@ -0,0 +1,620 @@
+# ChangeLog
+
+## Version 5.2.14 (Nov 1st 2015)
+* Allow addresses with IDN (Internationalized Domain Name) in PHP 5.3+, thanks to @fbonzon
+* Allow access to POP3 errors
+* Make all POP3 private properties and methods protected
+* **SECURITY** Fix vulnerability that allowed email addresses with line breaks (valid in RFC5322) to pass to SMTP, permitting message injection at the SMTP level. Mitigated in both the address validator and in the lower-level SMTP class. Thanks to Takeshi Terada.
+* Updated Brazilian Portuguese translations (Thanks to @phelipealves)
+
+## Version 5.2.13 (Sep 14th 2015)
+* Rename internal oauth class to avoid name clashes
+* Improve Estonian translations
+
+## Version 5.2.12 (Sep 1st 2015)
+* Fix incorrect composer package dependencies
+* Skip existing embedded image `cid`s in `msgHTML`
+
+## Version 5.2.11 (Aug 31st 2015)
+* Don't switch to quoted-printable for long lines if already using base64
+* Fixed Travis-CI config when run on PHP 7
+* Added Google XOAUTH2 authentication mechanism, thanks to @sherryl4george
+* Add address parser for RFC822-format addresses
+* Update MS Office MIME types
+* Don't convert line breaks when using quoted-printable encoding
+* Handle MS Exchange returning an invalid empty AUTH-type list in EHLO
+* Don't set name or filename properties on MIME parts that don't have one
+
+## Version 5.2.10 (May 4th 2015)
+* Add custom header getter
+* Use `application/javascript` for .js attachments
+* Improve RFC2821 compliance for timelimits, especially for end-of-data
+* Add Azerbaijani translations (Thanks to @mirjalal)
+* Minor code cleanup for robustness
+* Add Indonesian translations (Thanks to @ceceprawiro)
+* Avoid `error_log` Debugoutput naming clash
+* Add ability to parse server capabilities in response to EHLO (useful for SendGrid etc)
+* Amended default values for WordWrap to match RFC
+* Remove html2text converter class (has incompatible license)
+* Provide new mechanism for injecting html to text converters
+* Improve pointers to docs and support in README
+* Add example file upload script
+* Refactor and major cleanup of EasyPeasyICS, now a lot more usable
+* Make set() method simpler and more reliable
+* Add Malay translation (Thanks to @nawawi)
+* Add Bulgarian translation (Thanks to @mialy)
+* Add Armenian translation (Thanks to Hrayr Grigoryan)
+* Add Slovenian translation (Thanks to Klemen Tušar)
+* More efficient word wrapping
+* Add support for S/MIME signing with additional CA certificate (thanks to @IgitBuh)
+* Fix incorrect MIME structure when using S/MIME signing and isMail() (#372)
+* Improved checks and error messages for missing extensions
+* Store and report SMTP errors more consistently
+* Add MIME multipart preamble for better Outlook compatibility
+* Enable TLS encryption automatically if the server offers it
+* Provide detailed errors when individual recipients fail
+* Report more errors when connecting
+* Add extras classes to composer classmap
+* Expose stream_context_create options via new SMTPOptions property
+* Automatic encoding switch to quoted-printable if message lines are too long
+* Add Korean translation (Thanks to @ChalkPE)
+* Provide a pointer to troubleshooting docs on SMTP connection failure
+
+## Version 5.2.9 (Sept 25th 2014)
+* **Important: The autoloader is no longer autoloaded by the PHPMailer class**
+* Update html2text from https://github.com/mtibben/html2text
+* Improve Arabic translations (Thanks to @tarekdj)
+* Consistent handling of connection variables in SMTP and POP3
+* PHPDoc cleanup
+* Update composer to use PHPUnit 4.1
+* Pass consistent params to callbacks
+* More consistent handling of error states and debug output
+* Use property defaults, remove constructors
+* Remove unreachable code
+* Use older regex validation pattern for troublesome PCRE library versions
+* Improve PCRE detection in older PHP versions
+* Handle debug output consistently, and always in UTF-8
+* Allow user-defined debug output method via a callable
+* msgHTML now converts data URIs to embedded images
+* SMTP::getLastReply() will now always be populated
+* Improved example code in README
+* Ensure long filenames in Content-Disposition are encoded correctly
+* Simplify SMTP debug output mechanism, clarify levels with constants
+* Add SMTP connection check example
+* Simplify examples, don't use mysql* functions
+
+## Version 5.2.8 (May 14th 2014)
+* Increase timeout to match RFC2821 section 4.5.3.2 and thus not fail greetdelays, fixes #104
+* Add timestamps to default debug output
+* Add connection events and new level 3 to debug output options
+* Chinese language update (Thanks to @binaryoung)
+* Allow custom Mailer types (Thanks to @michield)
+* Cope with spaces around SMTP host specs
+* Fix processing of multiple hosts in connect string
+* Added Galician translation (Thanks to @donatorouco)
+* Autoloader now prepends
+* Docs updates
+* Add Latvian translation (Thanks to @eddsstudio)
+* Add Belarusian translation (Thanks to @amaksymiuk)
+* Make autoloader work better on older PHP versions
+* Avoid double-encoding if mbstring is overloading mail()
+* Add Portuguese translation (Thanks to @Jonadabe)
+* Make quoted-printable encoder respect line ending setting
+* Improve Chinese translation (Thanks to @PeterDaveHello)
+* Add Georgian translation (Thanks to @akalongman)
+* Add Greek translation (Thanks to @lenasterg)
+* Fix serverHostname on PHP < 5.3
+* Improve performance of SMTP class
+* Implement automatic 7bit downgrade
+* Add Vietnamese translation (Thanks to @vinades)
+* Improve example images, switch to PNG
+* Add Croatian translation (Thanks to @hrvoj3e)
+* Remove setting the Return-Path and deprecate the Return-path property - it's just wrong!
+* Fix language file loading if CWD has changed (@stephandesouza)
+* Add HTML5 email validation pattern
+* Improve Turkish translations (Thanks to @yasinaydin)
+* Improve Romanian translations (Thanks to @aflorea)
+* Check php.ini for path to sendmail/qmail before using default
+* Improve Farsi translation (Thanks to @MHM5000)
+* Don't use quoted-printable encoding for multipart types
+* Add Serbian translation (Thanks to ajevremovic at gmail.com)
+* Remove useless PHP5 check
+* Use SVG for build status badges
+* Store MessageDate on creation
+* Better default behaviour for validateAddress
+
+## Version 5.2.7 (September 12th 2013)
+* Add Ukrainian translation from @Krezalis
+* Support for do_verp
+* Fix bug in CRAM-MD5 AUTH
+* Propagate Debugoutput option to SMTP class (@Reblutus)
+* Determine MIME type of attachments automatically
+* Add cross-platform, multibyte-safe pathinfo replacement (with tests) and use it
+* Add a new 'html' Debugoutput type
+* Clean up SMTP debug output, remove embedded HTML
+* Some small changes in header formatting to improve IETF msglint test results
+* Update test_script to use some recently changed features, rename to code_generator
+* Generated code actually works!
+* Update SyntaxHighlighter
+* Major overhaul and cleanup of example code
+* New PHPMailer graphic
+* msgHTML now uses RFC2392-compliant content ids
+* Add line break normalization function and use it in msgHTML
+* Don't set unnecessary reply-to addresses
+* Make fakesendmail.sh a bit cleaner and safer
+* Set a content-transfer-encoding on multiparts (fixes msglint error)
+* Fix cid generation in msgHTML (Thanks to @digitalthought)
+* Fix handling of multiple SMTP servers (Thanks to @NanoCaiordo)
+* SMTP->connect() now supports stream context options (Thanks to @stanislavdavid)
+* Add support for iCal event alternatives (Thanks to @reblutus)
+* Update to Polish language file (Thanks to Krzysztof Kowalewski)
+* Update to Norwegian language file (Thanks to @datagutten)
+* Update to Hungarian language file (Thanks to @dominicus-75)
+* Add Persian/Farsi translation from @jaii
+* Make SMTPDebug property type match type in SMTP class
+* Add unit tests for DKIM
+* Major refactor of SMTP class
+* Reformat to PSR-2 coding standard
+* Introduce autoloader
+* Allow overriding of SMTP class
+* Overhaul of PHPDocs
+* Fix broken Q-encoding
+* Czech language update (Thanks to @nemelu)
+* Removal of excess blank lines in messages
+* Added fake POP server and unit tests for POP-before-SMTP
+
+## Version 5.2.6 (April 11th 2013)
+* Reflect move to PHPMailer GitHub organisation at https://github.com/PHPMailer/PHPMailer
+* Fix unbumped version numbers
+* Update packagist.org with new location
+* Clean up Changelog
+
+## Version 5.2.5 (April 6th 2013)
+* First official release after move from Google Code
+* Fixes for qmail when sending via mail()
+* Merge in changes from Google code 5.2.4 release
+* Minor coding standards cleanup in SMTP class
+* Improved unit tests, now tests S/MIME signing
+* Travis-CI support on GitHub, runs tests with fake SMTP server
+
+## Version 5.2.4 (February 19, 2013)
+* Fix tag and version bug.
+* un-deprecate isSMTP(), isMail(), IsSendmail() and isQmail().
+* Numerous translation updates
+
+## Version 5.2.3 (February 8, 2013)
+* Fix issue with older PCREs and ValidateAddress() (Bugz: 124)
+* Add CRAM-MD5 authentication, thanks to Elijah madden, https://github.com/okonomiyaki3000
+* Replacement of obsolete Quoted-Printable encoder with a much better implementation
+* Composer package definition
+* New language added: Hebrew
+
+## Version 5.2.2 (December 3, 2012)
+* Some fixes and syncs from https://github.com/Synchro/PHPMailer
+* Add Slovak translation, thanks to Michal Tinka
+
+## Version 5.2.2-rc2 (November 6, 2012)
+* Fix SMTP server rotation (Bugz: 118)
+* Allow override of autogen'ed 'Date' header (for Drupal's
+  og_mailinglist module)
+* No whitespace after '-f' option (Bugz: 116)
+* Work around potential warning (Bugz: 114)
+
+## Version 5.2.2-rc1 (September 28, 2012)
+* Header encoding works with long lines (Bugz: 93)
+* Turkish language update (Bugz: 94)
+* undefined $pattern in EncodeQ bug squashed (Bugz: 98)
+* use of mail() in safe_mode now works (Bugz: 96)
+* ValidateAddress() now 'public static' so people can override the
+  default and use their own validation scheme.
+* ValidateAddress() no longer uses broken FILTER_VALIDATE_EMAIL
+* Added in AUTH PLAIN SMTP authentication
+
+## Version 5.2.2-beta2 (August 17, 2012)
+* Fixed Postfix VERP support (Bugz: 92)
+* Allow action_function callbacks to pass/use
+  the From address (passed as final param)
+* Prevent inf look for get_lines() (Bugz: 77)
+* New public var ($UseSendmailOptions). Only pass sendmail()
+  options iff we really are using sendmail or something sendmail
+  compatible. (Bugz: 75)
+* default setting for LE returned to "\n" due to popular demand.
+
+## Version 5.2.2-beta1 (July 13, 2012)
+* Expose PreSend() and PostSend() as public methods to allow
+  for more control if serializing message sending.
+* GetSentMIMEMessage() only constructs the message copy when
+ needed. Save memory.
+* Only pass params to mail() if the underlying MTA is
+  "sendmail" (as defined as "having the string sendmail
+  in its pathname") [#69]
+* Attachments now work with Amazon SES and others [Bugz#70]
+* Debug output now sent to stdout (via echo) or error_log [Bugz#5]
+* New var: Debugoutput (for above) [Bugz#5]
+* SMTP reads now Timeout aware (new var: Timeout=15) [Bugz#71]
+* SMTP reads now can have a Timelimit associated with them
+  (new var: Timelimit=30)[Bugz#71]
+* Fix quoting issue associated with charsets
+* default setting for LE is now RFC compliant: "\r\n"
+* Return-Path can now be user defined (new var: ReturnPath)
+  (the default is "" which implies no change from previous
+  behavior, which was to use either From or Sender) [Bugz#46]
+* X-Mailer header can now be disabled (by setting to a
+  whitespace string, eg "  ") [Bugz#66]
+* Bugz closed: #68, #60, #42, #43, #59, #55, #66, #48, #49,
+               #52, #31, #41, #5. #70, #69
+
+## Version 5.2.1 (January 16, 2012)
+* Closed several bugs #5
+* Performance improvements
+* MsgHTML() now returns the message as required.
+* New method: GetSentMIMEMessage() (returns full copy of sent message)
+
+## Version 5.2 (July 19, 2011)
+* protected MIME body and header
+* better DKIM DNS Resource Record support
+* better aly handling
+* htmlfilter class added to extras
+* moved to Apache Extras
+
+## Version 5.1 (October 20, 2009)
+* fixed filename issue with AddStringAttachment (thanks to Tony)
+* fixed "SingleTo" property, now works with Senmail, Qmail, and SMTP in
+  addition to PHP mail()
+* added DKIM digital signing functionality, new properties:
+  - DKIM_domain (sets the domain name)
+  - DKIM_private (holds DKIM private key)
+  - DKIM_passphrase (holds your DKIM passphrase)
+  - DKIM_selector (holds the DKIM "selector")
+  - DKIM_identity (holds the identifying email address)
+* added callback function support
+  - callback function parameters include:
+    result, to, cc, bcc, subject and body
+  - see the test/test_callback.php file for usage.
+* added "auto" identity functionality
+  - can automatically add:
+    - Return-path (if Sender not set)
+    - Reply-To (if ReplyTo not set)
+  - can be disabled:
+    - $mail->SetFrom('yourname@yourdomain.com','First Last',false);
+    - or by adding the $mail->Sender and/or $mail->ReplyTo properties
+
+Note: "auto" identity added to help with emails ending up in spam or junk boxes because of missing headers
+
+## Version 5.0.2 (May 24, 2009)
+* Fix for missing attachments when inline graphics are present
+* Fix for missing Cc in header when using SMTP (mail was sent,
+  but not displayed in header -- Cc receiver only saw email To:
+  line and no Cc line, but did get the email (To receiver
+  saw same)
+
+## Version 5.0.1 (April 05, 2009)
+* Temporary fix for missing attachments
+
+## Version 5.0.0 (April 02, 2009)
+With the release of this version, we are initiating a new version numbering
+system to differentiate from the PHP4 version of PHPMailer.
+Most notable in this release is fully object oriented code.
+
+### class.smtp.php:
+* Refactored class.smtp.php to support new exception handling
+* code size reduced from 29.2 Kb to 25.6 Kb
+* Removed unnecessary functions from class.smtp.php:
+  - public function Expand($name) {
+  - public function Help($keyword="") {
+  - public function Noop() {
+  - public function Send($from) {
+  - public function SendOrMail($from) {
+  - public function Verify($name) {
+
+###  class.phpmailer.php:
+* Refactored class.phpmailer.php with new exception handling
+* Changed processing functionality of Sendmail and Qmail so they cannot be
+  inadvertently used
+* removed getFile() function, just became a simple wrapper for
+  file_get_contents()
+* added check for PHP version (will gracefully exit if not at least PHP 5.0)
+* enhanced code to check if an attachment source is the same as an embedded or
+  inline graphic source to eliminate duplicate attachments
+
+### New /test_script
+We have written a test script you can use to test the script as part of your
+installation. Once you press submit, the test script will send a multi-mime
+email with either the message you type in or an HTML email with an inline
+graphic. Two attachments are included in the email (one of the attachments
+is also the inline graphic so you can see that only one copy of the graphic
+is sent in the email). The test script will also display the functional
+script that you can copy/paste to your editor to duplicate the functionality.
+
+### New examples
+All new examples in both basic and advanced modes. Advanced examples show
+   Exception handling.
+
+### PHPDocumentator (phpdocs) documentation for PHPMailer version 5.0.0
+All new documentation
+
+## Version 2.3 (November 06, 2008)
+* added Arabic language (many thanks to Bahjat Al Mostafa)
+* removed English language from language files and made it a default within
+  class.phpmailer.php - if no language is found, it will default to use
+  the english language translation
+* fixed public/private declarations
+* corrected line 1728, $basedir to $directory
+* added $sign_cert_file to avoid improper duplicate use of $sign_key_file
+* corrected $this->Hello on line 612 to $this->Helo
+* changed default of $LE to "\r\n" to comply with RFC 2822. Can be set by the user
+  if default is not acceptable
+* removed trim() from return results in EncodeQP
+* /test and three files it contained are removed from version 2.3
+* fixed phpunit.php for compliance with PHP5
+* changed $this->AltBody = $textMsg; to $this->AltBody = html_entity_decode($textMsg);
+* We have removed the /phpdoc from the downloads. All documentation is now on
+  the http://phpmailer.codeworxtech.com website.
+
+## Version 2.2.1 () July 19 2008
+* fixed line 1092 in class.smtp.php (my apologies, error on my part)
+
+## Version 2.2 () July 15 2008
+* Fixed redirect issue (display of UTF-8 in thank you redirect)
+* fixed error in getResponse function declaration (class.pop3.php)
+* PHPMailer now PHP6 compliant
+* fixed line 1092 in class.smtp.php (endless loop from missing = sign)
+
+## Version 2.1 (Wed, June 04 2008)
+NOTE: WE HAVE A NEW LANGUAGE VARIABLE FOR DIGITALLY SIGNED S/MIME EMAILS. IF YOU CAN HELP WITH LANGUAGES OTHER THAN ENGLISH AND SPANISH, IT WOULD BE APPRECIATED.
+
+* added S/MIME functionality (ability to digitally sign emails)
+  BIG THANKS TO "sergiocambra" for posting this patch back in November 2007.
+  The "Signed Emails" functionality adds the Sign method to pass the private key
+  filename and the password to read it, and then email will be sent with
+  content-type multipart/signed and with the digital signature attached.
+* fully compatible with E_STRICT error level
+  - Please note:
+    In about half the test environments this development version was subjected
+    to, an error was thrown for the date() functions used (line 1565 and 1569).
+    This is NOT a PHPMailer error, it is the result of an incorrectly configured
+    PHP5 installation. The fix is to modify your 'php.ini' file and include the
+    date.timezone = Etc/UTC (or your own zone)
+    directive, to your own server timezone
+  - If you do get this error, and are unable to access your php.ini file:
+    In your PHP script, add
+    `date_default_timezone_set('Etc/UTC');`
+  - do not try to use
+    `$myVar = date_default_timezone_get();`
+    as a test, it will throw an error.
+* added ability to define path (mainly for embedded images)
+  function `MsgHTML($message,$basedir='')` ... where:
+  `$basedir` is the fully qualified path
+* fixed `MsgHTML()` function:
+  - Embedded Images where images are specified by `<protocol>://` will not be altered or embedded
+* fixed the return value of SMTP exit code ( pclose )
+* addressed issue of multibyte characters in subject line and truncating
+* added ability to have user specified Message ID
+  (default is still that PHPMailer create a unique Message ID)
+* corrected unidentified message type to 'application/octet-stream'
+* fixed chunk_split() multibyte issue (thanks to Colin Brown, et al).
+* added check for added attachments
+* enhanced conversion of HTML to text in MsgHTML (thanks to "brunny")
+
+## Version 2.1.0beta2 (Sun, Dec 02 2007)
+* implemented updated EncodeQP (thanks to coolbru, aka Marcus Bointon)
+* finished all testing, all known bugs corrected, enhancements tested
+
+Note: will NOT work with PHP4.
+
+Please note, this is BETA software **DO NOT USE THIS IN PRODUCTION OR LIVE PROJECTS; INTENDED STRICTLY FOR TESTING**
+
+## Version 2.1.0beta1
+Please note, this is BETA software
+** DO NOT USE THIS IN PRODUCTION OR LIVE PROJECTS
+ INTENDED STRICTLY FOR TESTING
+
+## Version 2.0.0 rc2 (Fri, Nov 16 2007), interim release
+* implements new property to control VERP in class.smtp.php
+  example (requires instantiating class.smtp.php):
+  $mail->do_verp = true;
+* POP-before-SMTP functionality included, thanks to Richard Davey
+  (see class.pop3.php & pop3_before_smtp_test.php for examples)
+* included example showing how to use PHPMailer with GMAIL
+* fixed the missing Cc in SendMail() and Mail()
+
+## Version 2.0.0 rc1 (Thu, Nov 08 2007), interim release
+* dramatically simplified using inline graphics ... it's fully automated and requires no user input
+* added automatic document type detection for attachments and pictures
+* added MsgHTML() function to replace Body tag for HTML emails
+* fixed the SendMail security issues (input validation vulnerability)
+* enhanced the AddAddresses functionality so that the "Name" portion is used in the email address
+* removed the need to use the AltBody method (set from the HTML, or default text used)
+* set the PHP Mail() function as the default (still support SendMail, SMTP Mail)
+* removed the need to set the IsHTML property (set automatically)
+* added Estonian language file by Indrek P&auml;ri
+* added header injection patch
+* added "set" method to permit users to create their own pseudo-properties like 'X-Headers', etc.
+* fixed warning message in SMTP get_lines method
+* added TLS/SSL SMTP support.
+* PHPMailer has been tested with PHP4 (4.4.7) and PHP5 (5.2.7)
+* Works with PHP installed as a module or as CGI-PHP
+NOTE: will NOT work with PHP5 in E_STRICT error mode
+
+## Version 1.73 (Sun, Jun 10 2005)
+* Fixed denial of service bug: http://www.cybsec.com/vuln/PHPMailer-DOS.pdf
+* Now has a total of 20 translations
+* Fixed alt attachments bug: http://tinyurl.com/98u9k
+
+## Version 1.72 (Wed, May 25 2004)
+* Added Dutch, Swedish, Czech, Norwegian, and Turkish translations.
+* Received: Removed this method because spam filter programs like
+  SpamAssassin reject this header.
+* Fixed error count bug.
+* SetLanguage default is now "language/".
+* Fixed magic_quotes_runtime bug.
+
+## Version 1.71 (Tue, Jul 28 2003)
+* Made several speed enhancements
+* Added German and Italian translation files
+* Fixed HELO/AUTH bugs on keep-alive connects
+* Now provides an error message if language file does not load
+* Fixed attachment EOL bug
+* Updated some unclear documentation
+* Added additional tests and improved others
+
+## Version 1.70 (Mon, Jun 20 2003)
+* Added SMTP keep-alive support
+* Added IsError method for error detection
+* Added error message translation support (SetLanguage)
+* Refactored many methods to increase library performance
+* Hello now sends the newer EHLO message before HELO as per RFC 2821
+* Removed the boundary class and replaced it with GetBoundary
+* Removed queue support methods
+* New $Hostname variable
+* New Message-ID header
+* Received header reformat
+* Helo variable default changed to $Hostname
+* Removed extra spaces in Content-Type definition (#667182)
+* Return-Path should be set to Sender when set
+* Adds Q or B encoding to headers when necessary
+* quoted-encoding should now encode NULs \000
+* Fixed encoding of body/AltBody (#553370)
+* Adds "To: undisclosed-recipients:;" when all recipients are hidden (BCC)
+* Multiple bug fixes
+
+## Version 1.65 (Fri, Aug 09 2002)
+* Fixed non-visible attachment bug (#585097) for Outlook
+* SMTP connections are now closed after each transaction
+* Fixed SMTP::Expand return value
+* Converted SMTP class documentation to phpDocumentor format
+
+## Version 1.62 (Wed, Jun 26 2002)
+* Fixed multi-attach bug
+* Set proper word wrapping
+* Reduced memory use with attachments
+* Added more debugging
+* Changed documentation to phpDocumentor format
+
+## Version 1.60 (Sat, Mar 30 2002)
+* Sendmail pipe and address patch (Christian Holtje)
+* Added embedded image and read confirmation support (A. Ognio)
+* Added unit tests
+* Added SMTP timeout support (*nix only)
+* Added possibly temporary PluginDir variable for SMTP class
+* Added LE message line ending variable
+* Refactored boundary and attachment code
+* Eliminated SMTP class warnings
+* Added SendToQueue method for future queuing support
+
+## Version 1.54 (Wed, Dec 19 2001)
+* Add some queuing support code
+* Fixed a pesky multi/alt bug
+* Messages are no longer forced to have "To" addresses
+
+## Version 1.50 (Thu, Nov 08 2001)
+* Fix extra lines when not using SMTP mailer
+* Set WordWrap variable to int with a zero default
+
+## Version 1.47 (Tue, Oct 16 2001)
+* Fixed Received header code format
+* Fixed AltBody order error
+* Fixed alternate port warning
+
+## Version 1.45 (Tue, Sep 25 2001)
+* Added enhanced SMTP debug support
+* Added support for multiple ports on SMTP
+* Added Received header for tracing
+* Fixed AddStringAttachment encoding
+* Fixed possible header name quote bug
+* Fixed wordwrap() trim bug
+* Couple other small bug fixes
+
+## Version 1.41 (Wed, Aug 22 2001)
+* Fixed AltBody bug w/o attachments
+* Fixed rfc_date() for certain mail servers
+
+## Version 1.40 (Sun, Aug 12 2001)
+* Added multipart/alternative support (AltBody)
+* Documentation update
+* Fixed bug in Mercury MTA
+
+## Version 1.29 (Fri, Aug 03 2001)
+* Added AddStringAttachment() method
+* Added SMTP authentication support
+
+## Version 1.28 (Mon, Jul 30 2001)
+* Fixed a typo in SMTP class
+* Fixed header issue with Imail (win32) SMTP server
+* Made fopen() calls for attachments use "rb" to fix win32 error
+
+## Version 1.25 (Mon, Jul 02 2001)
+* Added RFC 822 date fix (Patrice)
+* Added improved error handling by adding a $ErrorInfo variable
+* Removed MailerDebug variable (obsolete with new error handler)
+
+## Version 1.20 (Mon, Jun 25 2001)
+* Added quoted-printable encoding (Patrice)
+* Set Version as public and removed PrintVersion()
+* Changed phpdoc to only display public variables and methods
+
+## Version 1.19 (Thu, Jun 21 2001)
+* Fixed MS Mail header bug
+* Added fix for Bcc problem with mail(). *Does not work on Win32*
+  (See PHP bug report: http://www.php.net/bugs.php?id=11616)
+* mail() no longer passes a fifth parameter when not needed
+
+## Version 1.15 (Fri, Jun 15 2001)
+Note: these changes contributed by Patrice Fournier
+* Changed all remaining \n to \r\n
+* Bcc: header no longer written to message except
+  when sent directly to sendmail
+* Added a small message to non-MIME compliant mail reader
+* Added Sender variable to change the Sender email
+  used in -f for sendmail/mail and in 'MAIL FROM' for smtp mode
+* Changed boundary setting to a place it will be set only once
+* Removed transfer encoding for whole message when using multipart
+* Message body now uses Encoding in multipart messages
+* Can set encoding and type to attachments 7bit, 8bit
+  and binary attachment are sent as is, base64 are encoded
+* Can set Encoding to base64 to send 8 bits body
+  through 7 bits servers
+
+## Version 1.10 (Tue, Jun 12 2001)
+* Fixed win32 mail header bug (printed out headers in message body)
+
+## Version 1.09 (Fri, Jun 08 2001)
+* Changed date header to work with Netscape mail programs
+* Altered phpdoc documentation
+
+## Version 1.08 (Tue, Jun 05 2001)
+* Added enhanced error-checking
+* Added phpdoc documentation to source
+
+## Version 1.06 (Fri, Jun 01 2001)
+* Added optional name for file attachments
+
+## Version 1.05 (Tue, May 29 2001)
+* Code cleanup
+* Eliminated sendmail header warning message
+* Fixed possible SMTP error
+
+## Version 1.03 (Thu, May 24 2001)
+* Fixed problem where qmail sends out duplicate messages
+
+## Version 1.02 (Wed, May 23 2001)
+* Added multiple recipient and attachment Clear* methods
+* Added Sendmail public variable
+* Fixed problem with loading SMTP library multiple times
+
+## Version 0.98 (Tue, May 22 2001)
+* Fixed problem with redundant mail hosts sending out multiple messages
+* Added additional error handler code
+* Added AddCustomHeader() function
+* Added support for Microsoft mail client headers (affects priority)
+* Fixed small bug with Mailer variable
+* Added PrintVersion() function
+
+## Version 0.92 (Tue, May 15 2001)
+* Changed file names to class.phpmailer.php and class.smtp.php to match
+  current PHP class trend.
+* Fixed problem where body not being printed when a message is attached
+* Several small bug fixes
+
+## Version 0.90 (Tue, April 17 2001)
+* Initial public release
@@ -0,0 +1,197 @@
+<?php
+/**
+ * PHPMailer - PHP email creation and transport class.
+ * PHP Version 5.4
+ * @package PHPMailer
+ * @link https://github.com/PHPMailer/PHPMailer/ The PHPMailer GitHub project
+ * @author Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
+ * @author Jim Jagielski (jimjag) <jimjag@gmail.com>
+ * @author Andy Prevost (codeworxtech) <codeworxtech@users.sourceforge.net>
+ * @author Brent R. Matzelle (original founder)
+ * @copyright 2012 - 2014 Marcus Bointon
+ * @copyright 2010 - 2012 Jim Jagielski
+ * @copyright 2004 - 2009 Andy Prevost
+ * @license http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License
+ * @note This program is distributed in the hope that it will be useful - WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+/**
+ * PHPMailerOAuth - PHPMailer subclass adding OAuth support.
+ * @package PHPMailer
+ * @author @sherryl4george
+ * @author Marcus Bointon (@Synchro) <phpmailer@synchromedia.co.uk>
+ */
+class PHPMailerOAuth extends PHPMailer
+{
+    /**
+     * The OAuth user's email address
+     * @var string
+     */
+    public $oauthUserEmail = '';
+
+    /**
+     * The OAuth refresh token
+     * @var string
+     */
+    public $oauthRefreshToken = '';
+
+    /**
+     * The OAuth client ID
+     * @var string
+     */
+    public $oauthClientId = '';
+
+    /**
+     * The OAuth client secret
+     * @var string
+     */
+    public $oauthClientSecret = '';
+
+    /**
+     * An instance of the PHPMailerOAuthGoogle class.
+     * @var PHPMailerOAuthGoogle
+     * @access protected
+     */
+    protected $oauth = null;
+
+    /**
+     * Get a PHPMailerOAuthGoogle instance to use.
+     * @return PHPMailerOAuthGoogle
+     */
+    public function getOAUTHInstance()
+    {
+        if (!is_object($this->oauth)) {
+            $this->oauth = new PHPMailerOAuthGoogle(
+                $this->oauthUserEmail,
+                $this->oauthClientSecret,
+                $this->oauthClientId,
+                $this->oauthRefreshToken
+            );
+        }
+        return $this->oauth;
+    }
+
+    /**
+     * Initiate a connection to an SMTP server.
+     * Overrides the original smtpConnect method to add support for OAuth.
+     * @param array $options An array of options compatible with stream_context_create()
+     * @uses SMTP
+     * @access public
+     * @return bool
+     * @throws phpmailerException
+     */
+    public function smtpConnect($options = array())
+    {
+        if (is_null($this->smtp)) {
+            $this->smtp = $this->getSMTPInstance();
+        }
+
+        if (is_null($this->oauth)) {
+            $this->oauth = $this->getOAUTHInstance();
+        }
+
+        // Already connected?
+        if ($this->smtp->connected()) {
+            return true;
+        }
+
+        $this->smtp->setTimeout($this->Timeout);
+        $this->smtp->setDebugLevel($this->SMTPDebug);
+        $this->smtp->setDebugOutput($this->Debugoutput);
+        $this->smtp->setVerp($this->do_verp);
+        $hosts = explode(';', $this->Host);
+        $lastexception = null;
+
+        foreach ($hosts as $hostentry) {
+            $hostinfo = array();
+            if (!preg_match('/^((ssl|tls):\/\/)*([a-zA-Z0-9\.-]*):?([0-9]*)$/', trim($hostentry), $hostinfo)) {
+                // Not a valid host entry
+                continue;
+            }
+            // $hostinfo[2]: optional ssl or tls prefix
+            // $hostinfo[3]: the hostname
+            // $hostinfo[4]: optional port number
+            // The host string prefix can temporarily override the current setting for SMTPSecure
+            // If it's not specified, the default value is used
+            $prefix = '';
+            $secure = $this->SMTPSecure;
+            $tls = ($this->SMTPSecure == 'tls');
+            if ('ssl' == $hostinfo[2] or ('' == $hostinfo[2] and 'ssl' == $this->SMTPSecure)) {
+                $prefix = 'ssl://';
+                $tls = false; // Can't have SSL and TLS at the same time
+                $secure = 'ssl';
+            } elseif ($hostinfo[2] == 'tls') {
+                $tls = true;
+                // tls doesn't use a prefix
+                $secure = 'tls';
+            }
+            //Do we need the OpenSSL extension?
+            $sslext = defined('OPENSSL_ALGO_SHA1');
+            if ('tls' === $secure or 'ssl' === $secure) {
+                //Check for an OpenSSL constant rather than using extension_loaded, which is sometimes disabled
+                if (!$sslext) {
+                    throw new phpmailerException($this->lang('extension_missing').'openssl', self::STOP_CRITICAL);
+                }
+            }
+            $host = $hostinfo[3];
+            $port = $this->Port;
+            $tport = (integer)$hostinfo[4];
+            if ($tport > 0 and $tport < 65536) {
+                $port = $tport;
+            }
+            if ($this->smtp->connect($prefix . $host, $port, $this->Timeout, $options)) {
+                try {
+                    if ($this->Helo) {
+                        $hello = $this->Helo;
+                    } else {
+                        $hello = $this->serverHostname();
+                    }
+                    $this->smtp->hello($hello);
+                    //Automatically enable TLS encryption if:
+                    // * it's not disabled
+                    // * we have openssl extension
+                    // * we are not already using SSL
+                    // * the server offers STARTTLS
+                    if ($this->SMTPAutoTLS and $sslext and $secure != 'ssl' and $this->smtp->getServerExt('STARTTLS')) {
+                        $tls = true;
+                    }
+                    if ($tls) {
+                        if (!$this->smtp->startTLS()) {
+                            throw new phpmailerException($this->lang('connect_host'));
+                        }
+                        // We must resend HELO after tls negotiation
+                        $this->smtp->hello($hello);
+                    }
+                    if ($this->SMTPAuth) {
+                        if (!$this->smtp->authenticate(
+                            $this->Username,
+                            $this->Password,
+                            $this->AuthType,
+                            $this->Realm,
+                            $this->Workstation,
+                            $this->oauth
+                        )
+                        ) {
+                            throw new phpmailerException($this->lang('authenticate'));
+                        }
+                    }
+                    return true;
+                } catch (phpmailerException $exc) {
+                    $lastexception = $exc;
+                    $this->edebug($exc->getMessage());
+                    // We must have connected, but then failed TLS or Auth, so close connection nicely
+                    $this->smtp->quit();
+                }
+            }
+        }
+        // If we get here, all connection attempts have failed, so close connection hard
+        $this->smtp->close();
+        // As we've caught all exceptions, just report whatever the last one was
+        if ($this->exceptions and !is_null($lastexception)) {
+            throw $lastexception;
+        }
+        return false;
+    }
+}
@@ -0,0 +1,77 @@
+<?php
+/**
+ * PHPMailer - PHP email creation and transport class.
+ * PHP Version 5.4
+ * @package PHPMailer
+ * @link https://github.com/PHPMailer/PHPMailer/ The PHPMailer GitHub project
+ * @author Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
+ * @author Jim Jagielski (jimjag) <jimjag@gmail.com>
+ * @author Andy Prevost (codeworxtech) <codeworxtech@users.sourceforge.net>
+ * @author Brent R. Matzelle (original founder)
+ * @copyright 2012 - 2014 Marcus Bointon
+ * @copyright 2010 - 2012 Jim Jagielski
+ * @copyright 2004 - 2009 Andy Prevost
+ * @license http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License
+ * @note This program is distributed in the hope that it will be useful - WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+/**
+ * PHPMailerOAuthGoogle - Wrapper for League OAuth2 Google provider.
+ * @package PHPMailer
+ * @author @sherryl4george
+ * @author Marcus Bointon (@Synchro) <phpmailer@synchromedia.co.uk>
+ * @link https://github.com/thephpleague/oauth2-client
+ */
+class PHPMailerOAuthGoogle
+{
+    private $oauthUserEmail = '';
+    private $oauthRefreshToken = '';
+    private $oauthClientId = '';
+    private $oauthClientSecret = '';
+
+    /**
+     * @param string $UserEmail
+     * @param string $ClientSecret
+     * @param string $ClientId
+     * @param string $RefreshToken
+     */
+    public function __construct(
+        $UserEmail,
+        $ClientSecret,
+        $ClientId,
+        $RefreshToken
+    ) {
+        $this->oauthClientId = $ClientId;
+        $this->oauthClientSecret = $ClientSecret;
+        $this->oauthRefreshToken = $RefreshToken;
+        $this->oauthUserEmail = $UserEmail;
+    }
+
+    private function getProvider()
+    {
+        return new League\OAuth2\Client\Provider\Google([
+            'clientId' => $this->oauthClientId,
+            'clientSecret' => $this->oauthClientSecret
+        ]);
+    }
+
+    private function getGrant()
+    {
+        return new \League\OAuth2\Client\Grant\RefreshToken();
+    }
+
+    private function getToken()
+    {
+        $provider = $this->getProvider();
+        $grant = $this->getGrant();
+        return $provider->getAccessToken($grant, ['refresh_token' => $this->oauthRefreshToken]);
+    }
+
+    public function getOauth64()
+    {
+        $token = $this->getToken();
+        return base64_encode("user=" . $this->oauthUserEmail . "\001auth=Bearer " . $token . "\001\001");
+    }
+}
@@ -0,0 +1,407 @@
+<?php
+/**
+ * PHPMailer POP-Before-SMTP Authentication Class.
+ * PHP Version 5
+ * @package PHPMailer
+ * @link https://github.com/PHPMailer/PHPMailer/
+ * @author Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
+ * @author Jim Jagielski (jimjag) <jimjag@gmail.com>
+ * @author Andy Prevost (codeworxtech) <codeworxtech@users.sourceforge.net>
+ * @author Brent R. Matzelle (original founder)
+ * @copyright 2012 - 2014 Marcus Bointon
+ * @copyright 2010 - 2012 Jim Jagielski
+ * @copyright 2004 - 2009 Andy Prevost
+ * @license http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License
+ * @note This program is distributed in the hope that it will be useful - WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+/**
+ * PHPMailer POP-Before-SMTP Authentication Class.
+ * Specifically for PHPMailer to use for RFC1939 POP-before-SMTP authentication.
+ * Does not support APOP.
+ * @package PHPMailer
+ * @author Richard Davey (original author) <rich@corephp.co.uk>
+ * @author Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
+ * @author Jim Jagielski (jimjag) <jimjag@gmail.com>
+ * @author Andy Prevost (codeworxtech) <codeworxtech@users.sourceforge.net>
+ */
+class POP3
+{
+    /**
+     * The POP3 PHPMailer Version number.
+     * @var string
+     * @access public
+     */
+    public $Version = '5.2.22';
+
+    /**
+     * Default POP3 port number.
+     * @var integer
+     * @access public
+     */
+    public $POP3_PORT = 110;
+
+    /**
+     * Default timeout in seconds.
+     * @var integer
+     * @access public
+     */
+    public $POP3_TIMEOUT = 30;
+
+    /**
+     * POP3 Carriage Return + Line Feed.
+     * @var string
+     * @access public
+     * @deprecated Use the constant instead
+     */
+    public $CRLF = "\r\n";
+
+    /**
+     * Debug display level.
+     * Options: 0 = no, 1+ = yes
+     * @var integer
+     * @access public
+     */
+    public $do_debug = 0;
+
+    /**
+     * POP3 mail server hostname.
+     * @var string
+     * @access public
+     */
+    public $host;
+
+    /**
+     * POP3 port number.
+     * @var integer
+     * @access public
+     */
+    public $port;
+
+    /**
+     * POP3 Timeout Value in seconds.
+     * @var integer
+     * @access public
+     */
+    public $tval;
+
+    /**
+     * POP3 username
+     * @var string
+     * @access public
+     */
+    public $username;
+
+    /**
+     * POP3 password.
+     * @var string
+     * @access public
+     */
+    public $password;
+
+    /**
+     * Resource handle for the POP3 connection socket.
+     * @var resource
+     * @access protected
+     */
+    protected $pop_conn;
+
+    /**
+     * Are we connected?
+     * @var boolean
+     * @access protected
+     */
+    protected $connected = false;
+
+    /**
+     * Error container.
+     * @var array
+     * @access protected
+     */
+    protected $errors = array();
+
+    /**
+     * Line break constant
+     */
+    const CRLF = "\r\n";
+
+    /**
+     * Simple static wrapper for all-in-one POP before SMTP
+     * @param $host
+     * @param integer|boolean $port The port number to connect to
+     * @param integer|boolean $timeout The timeout value
+     * @param string $username
+     * @param string $password
+     * @param integer $debug_level
+     * @return boolean
+     */
+    public static function popBeforeSmtp(
+        $host,
+        $port = false,
+        $timeout = false,
+        $username = '',
+        $password = '',
+        $debug_level = 0
+    ) {
+        $pop = new POP3;
+        return $pop->authorise($host, $port, $timeout, $username, $password, $debug_level);
+    }
+
+    /**
+     * Authenticate with a POP3 server.
+     * A connect, login, disconnect sequence
+     * appropriate for POP-before SMTP authorisation.
+     * @access public
+     * @param string $host The hostname to connect to
+     * @param integer|boolean $port The port number to connect to
+     * @param integer|boolean $timeout The timeout value
+     * @param string $username
+     * @param string $password
+     * @param integer $debug_level
+     * @return boolean
+     */
+    public function authorise($host, $port = false, $timeout = false, $username = '', $password = '', $debug_level = 0)
+    {
+        $this->host = $host;
+        // If no port value provided, use default
+        if (false === $port) {
+            $this->port = $this->POP3_PORT;
+        } else {
+            $this->port = (integer)$port;
+        }
+        // If no timeout value provided, use default
+        if (false === $timeout) {
+            $this->tval = $this->POP3_TIMEOUT;
+        } else {
+            $this->tval = (integer)$timeout;
+        }
+        $this->do_debug = $debug_level;
+        $this->username = $username;
+        $this->password = $password;
+        //  Reset the error log
+        $this->errors = array();
+        //  connect
+        $result = $this->connect($this->host, $this->port, $this->tval);
+        if ($result) {
+            $login_result = $this->login($this->username, $this->password);
+            if ($login_result) {
+                $this->disconnect();
+                return true;
+            }
+        }
+        // We need to disconnect regardless of whether the login succeeded
+        $this->disconnect();
+        return false;
+    }
+
+    /**
+     * Connect to a POP3 server.
+     * @access public
+     * @param string $host
+     * @param integer|boolean $port
+     * @param integer $tval
+     * @return boolean
+     */
+    public function connect($host, $port = false, $tval = 30)
+    {
+        //  Are we already connected?
+        if ($this->connected) {
+            return true;
+        }
+
+        //On Windows this will raise a PHP Warning error if the hostname doesn't exist.
+        //Rather than suppress it with @fsockopen, capture it cleanly instead
+        set_error_handler(array($this, 'catchWarning'));
+
+        if (false === $port) {
+            $port = $this->POP3_PORT;
+        }
+
+        //  connect to the POP3 server
+        $this->pop_conn = fsockopen(
+            $host, //  POP3 Host
+            $port, //  Port #
+            $errno, //  Error Number
+            $errstr, //  Error Message
+            $tval
+        ); //  Timeout (seconds)
+        //  Restore the error handler
+        restore_error_handler();
+
+        //  Did we connect?
+        if (false === $this->pop_conn) {
+            //  It would appear not...
+            $this->setError(array(
+                'error' => "Failed to connect to server $host on port $port",
+                'errno' => $errno,
+                'errstr' => $errstr
+            ));
+            return false;
+        }
+
+        //  Increase the stream time-out
+        stream_set_timeout($this->pop_conn, $tval, 0);
+
+        //  Get the POP3 server response
+        $pop3_response = $this->getResponse();
+        //  Check for the +OK
+        if ($this->checkResponse($pop3_response)) {
+            //  The connection is established and the POP3 server is talking
+            $this->connected = true;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Log in to the POP3 server.
+     * Does not support APOP (RFC 2828, 4949).
+     * @access public
+     * @param string $username
+     * @param string $password
+     * @return boolean
+     */
+    public function login($username = '', $password = '')
+    {
+        if (!$this->connected) {
+            $this->setError('Not connected to POP3 server');
+        }
+        if (empty($username)) {
+            $username = $this->username;
+        }
+        if (empty($password)) {
+            $password = $this->password;
+        }
+
+        // Send the Username
+        $this->sendString("USER $username" . self::CRLF);
+        $pop3_response = $this->getResponse();
+        if ($this->checkResponse($pop3_response)) {
+            // Send the Password
+            $this->sendString("PASS $password" . self::CRLF);
+            $pop3_response = $this->getResponse();
+            if ($this->checkResponse($pop3_response)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Disconnect from the POP3 server.
+     * @access public
+     */
+    public function disconnect()
+    {
+        $this->sendString('QUIT');
+        //The QUIT command may cause the daemon to exit, which will kill our connection
+        //So ignore errors here
+        try {
+            @fclose($this->pop_conn);
+        } catch (Exception $e) {
+            //Do nothing
+        };
+    }
+
+    /**
+     * Get a response from the POP3 server.
+     * $size is the maximum number of bytes to retrieve
+     * @param integer $size
+     * @return string
+     * @access protected
+     */
+    protected function getResponse($size = 128)
+    {
+        $response = fgets($this->pop_conn, $size);
+        if ($this->do_debug >= 1) {
+            echo "Server -> Client: $response";
+        }
+        return $response;
+    }
+
+    /**
+     * Send raw data to the POP3 server.
+     * @param string $string
+     * @return integer
+     * @access protected
+     */
+    protected function sendString($string)
+    {
+        if ($this->pop_conn) {
+            if ($this->do_debug >= 2) { //Show client messages when debug >= 2
+                echo "Client -> Server: $string";
+            }
+            return fwrite($this->pop_conn, $string, strlen($string));
+        }
+        return 0;
+    }
+
+    /**
+     * Checks the POP3 server response.
+     * Looks for for +OK or -ERR.
+     * @param string $string
+     * @return boolean
+     * @access protected
+     */
+    protected function checkResponse($string)
+    {
+        if (substr($string, 0, 3) !== '+OK') {
+            $this->setError(array(
+                'error' => "Server reported an error: $string",
+                'errno' => 0,
+                'errstr' => ''
+            ));
+            return false;
+        } else {
+            return true;
+        }
+    }
+
+    /**
+     * Add an error to the internal error store.
+     * Also display debug output if it's enabled.
+     * @param $error
+     * @access protected
+     */
+    protected function setError($error)
+    {
+        $this->errors[] = $error;
+        if ($this->do_debug >= 1) {
+            echo '<pre>';
+            foreach ($this->errors as $error) {
+                print_r($error);
+            }
+            echo '</pre>';
+        }
+    }
+
+    /**
+     * Get an array of error messages, if any.
+     * @return array
+     */
+    public function getErrors()
+    {
+        return $this->errors;
+    }
+
+    /**
+     * POP3 connection error handler.
+     * @param integer $errno
+     * @param string $errstr
+     * @param string $errfile
+     * @param integer $errline
+     * @access protected
+     */
+    protected function catchWarning($errno, $errstr, $errfile, $errline)
+    {
+        $this->setError(array(
+            'error' => "Connecting to the POP3 server raised a PHP warning: ",
+            'errno' => $errno,
+            'errstr' => $errstr,
+            'errfile' => $errfile,
+            'errline' => $errline
+        ));
+    }
+}
--- a/Show More
+++ b/Show More