5.2.5 버전변경

adm/admin.tail.php

@@ -21,7 +21,7 @@ if (!defined('_GNUBOARD_')) exit;
 
 <!-- <p>실행시간 : <?php echo get_microtime() - $begin_time; ?> -->
 
-<script src="<?php echo G5_ADMIN_URL ?>/admin.js"></script>
+<script src="<?php echo G5_ADMIN_URL ?>/admin.js?ver=<?php echo G5_JS_VER; ?>"></script>
 <script>
 $(function(){
     var hide_menu = false;

adm/board_copy.php

@@ -8,7 +8,7 @@ $g5['title'] = '게시판 복사';
 include_once(G5_PATH.'/head.sub.php');
 ?>
 
-<script src="<?php echo G5_ADMIN_URL ?>/admin.js"></script>
+<script src="<?php echo G5_ADMIN_URL ?>/admin.js?ver=<?php echo G5_JS_VER; ?>"></script>
 
 <div class="new_win">
     <h1><?php echo $g5['title']; ?></h1>

adm/faqmasterform.php

@@ -7,6 +7,8 @@ auth_check($auth[$sub_menu], "w");
 
 $html_title = 'FAQ';
 
+$fm_id = preg_replace('/[^0-9]/', '', $fm_id);
+
 if ($w == "u")
 {
     $html_title .= ' 수정';

adm/member_delete.php

@@ -1,4 +1,4 @@
-<?
+<?php
 $sub_menu = "200100";
 include_once("./_common.php");
 

adm/member_list_delete.php

@@ -1,4 +1,4 @@
-<?
+<?php
 $sub_menu = "200100";
 include_once("./_common.php");
 

adm/newwinform.php

@@ -5,6 +5,8 @@ include_once(G5_EDITOR_LIB);
 
 auth_check($auth[$sub_menu], "w");
 
+$nw_id = preg_replace('/[^0-9]/', '', $nw_id);
+
 $html_title = "팝업레이어";
 if ($w == "u")
 {

adm/popular_rank.php

@@ -4,8 +4,8 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'r');
 
-if (empty($fr_date)) $fr_date = G5_TIME_YMD;
+if (empty($fr_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $fr_date) ) $fr_date = G5_TIME_YMD;
-if (empty($to_date)) $to_date = G5_TIME_YMD;
+if (empty($to_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $to_date) ) $to_date = G5_TIME_YMD;
 
 $qstr = "fr_date={$fr_date}{&to_date}={$to_date}";
 

adm/sms_admin/form_list.php

@@ -18,6 +18,9 @@ if (is_numeric($fg_no))
 else
     $sql_group = "";
 
+$st = clean_xss_tags($st);
+$sv = clean_xss_tags($sv);
+
 if ($st == 'all') {
     $sql_search = "and (fo_name like '%{$sv}%' or fo_content like '%{$sv}%')";
 } else if ($st == 'name') {
@@ -60,7 +63,7 @@ function book_all_checked(chk)
 function book_del(fo_no)
 {
     if (confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n그래도 삭제하시겠습니까?"))
-        location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=<?php echo $page?>&fg_no=<?php echo $fg_no?>&st=<?php echo $st?>&sv=<?php echo $sv?>";
+        location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=<?php echo $page?>&fg_no=<?php echo $fg_no?>&st=<?php echo get_text($st); ?>&sv=<?php echo get_text($sv); ?>";
 }
 
 function multi_update(sel)
@@ -127,7 +130,7 @@ function multi_update(sel)
         <option value="content"<?php echo get_selected('content', $st); ?>>이모티콘</option>
     </select>
     <label for="sv" class="sound_only">검색어<strong class="sound_only"> 필수</strong></label>
-    <input type="text" name="sv" value="<?php echo $sv;?>" id="sv" required class="frm_input required" >
+    <input type="text" name="sv" value="<?php echo get_text($sv) ;?>" id="sv" required class="frm_input required" >
     <input type="submit" value="검색" class="btn_submit">
     </form>
 </div>
@@ -181,7 +184,7 @@ function multi_update(sel)
             <span class="sound_only">등록 </span><?php echo date('Y-m-d', strtotime($res['fo_datetime']))?>
         </div>
         <div class="li_cmd">
-            <a href="./form_write.php?w=u&amp;fo_no=<?php echo $res['fo_no']?>&amp;page=<?php echo $page;?>&amp;fg_no=<?php echo $fg_no;?>&amp;st=<?php echo $st;?>&amp;sv=<?php echo $sv;?>">수정</a>
+            <a href="./form_write.php?w=u&amp;fo_no=<?php echo $res['fo_no']?>&amp;page=<?php echo $page;?>&amp;fg_no=<?php echo $fg_no;?>&amp;st=<?php echo get_text($st);?>&amp;sv=<?php echo get_text($sv);?>">수정</a>
             <a href="javascript:void(book_del('<?php echo $res['fo_no']?>'));">삭제</a>
             <a href="./sms_write.php?fo_no=<?php echo $res['fo_no']?>">보내기</a>
         </div>

adm/visit.sub.php

@@ -5,8 +5,8 @@ include_once(G5_LIB_PATH.'/visit.lib.php');
 include_once('./admin.head.php');
 include_once(G5_PLUGIN_PATH.'/jquery-ui/datepicker.php');
 
-if (empty($fr_date)) $fr_date = G5_TIME_YMD;
+if (empty($fr_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $fr_date) ) $fr_date = G5_TIME_YMD;
-if (empty($to_date)) $to_date = G5_TIME_YMD;
+if (empty($to_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $to_date) ) $to_date = G5_TIME_YMD;
 
 $qstr = "fr_date=".$fr_date."&to_date=".$to_date;
 $query_string = $qstr ? '?'.$qstr : '';

adm/write_count.php

@@ -14,7 +14,7 @@ add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/plugins/jqplot.categoryAxi
 add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/plugins/jqplot.pointLabels.min.js"></script>', 0);
 add_javascript('<!--[if lt IE 9]><script src="'.G5_PLUGIN_URL.'/jqplot/excanvas.js"></script><![endif]-->', 0);
 
-if (!($graph == 'line' || $graph == 'bar')) 
+if (!($graph == 'line' || $graph == 'bar'))
     $graph = 'line';
 
 if ($graph == 'bar') {
@@ -49,7 +49,7 @@ foreach($period_array as $key=>$value) {
         break;
     }
 }
-if (!$is_period) 
+if (!$is_period)
     $period = '오늘';
 
 $day = $period_array[$period][0];
@@ -64,15 +64,15 @@ if ($period == '오늘') {
     $from = $yesterday;
     $to = $from;
 } else if ($period == '내일') {
-    $from = date('Y-m-d', G5_SERVER_TIME + (86400 * 2)); 
+    $from = date('Y-m-d', G5_SERVER_TIME + (86400 * 2));
     $to = $from;
 } else {
-    $from = date('Y-m-d', G5_SERVER_TIME - (86400 * $period_array[$period][1])); 
+    $from = date('Y-m-d', G5_SERVER_TIME - (86400 * $period_array[$period][1]));
     $to = $yesterday;
 }
 
 $sql_bo_table = '';
-if ($bo_table) 
+if ($bo_table)
     $sql_bo_table = "and bo_table = '$bo_table'";
 
 switch ($day) {
@@ -130,7 +130,7 @@ switch ($day) {
     <form>
     <select name="bo_table">
     <option value="">전체게시판</a>
-    <?php 
+    <?php
     $sql = " select bo_table, bo_subject from {$g5['board_table']} order by bo_count_write desc ";
     $result = sql_query($sql);
     for($i=0; $row=sql_fetch_array($result); $i++) {
@@ -179,7 +179,7 @@ $(document).ready(function(){
     var line1 = [<?php echo implode($line1, ','); ?>];
     var line2 = [<?php echo implode($line2, ','); ?>];
     var plot1 = $.jqplot ('chart1', [line1, line2], {
-            seriesDefaults: { 
+            seriesDefaults: {
                 <?php if ($graph == 'bar') { ?>
                 renderer:$.jqplot.BarRenderer,
                 <?php } ?>
@@ -205,6 +205,6 @@ $(document).ready(function(){
 }
 ?>
 
-<?
+<?php
 include_once ('./admin.tail.php');
 ?>

bbs/ajax.comment_token.php

@@ -0,0 +1,14 @@
+<?php
+include_once('./_common.php');
+include_once(G5_LIB_PATH.'/json.lib.php');
+
+$ss_name = 'ss_comment_token';
+
+set_session($ss_name, '');
+
+$token = _token();
+
+set_session($ss_name, $token);
+
+die(json_encode(array('token'=>$token)));
+?>

bbs/move_update.php

@@ -19,6 +19,8 @@ $save_count_write = 0;
 $save_count_comment = 0;
 $cnt = 0;
 
+$wr_id_list = preg_replace('/[^0-9\,]/', '', $_POST['wr_id_list']);
+
 $sql = " select distinct wr_num from $write_table where wr_id in ({$wr_id_list}) order by wr_id ";
 $result = sql_query($sql);
 while ($row = sql_fetch_array($result))

bbs/write_comment_update.php

@@ -3,6 +3,12 @@ define('G5_CAPTCHA', true);
 include_once('./_common.php');
 include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 
+// 토큰체크
+$comment_token = trim(get_session('ss_comment_token'));
+set_session('ss_comment_token', '');
+if(!trim($_POST['token']) || !$comment_token || $comment_token != $_POST['token'])
+    alert('올바른 방법으로 이용해 주십시오.');
+
 // 090710
 if (substr_count($wr_content, "&#") > 50) {
     alert('내용에 올바르지 않은 코드가 다수 포함되어 있습니다.');

bbs/write_token.php

@@ -0,0 +1,13 @@
+<?php
+include_once('./_common.php');
+include_once(G5_LIB_PATH.'/json.lib.php');
+
+if(!$bo_table)
+   die(json_encode(array('error'=>'게시판 정보가 올바르지 않습니다.', 'url'=>G5_URL)));
+
+set_session('ss_write_'.$bo_table.'_token', '');
+
+$token = get_write_token($bo_table);
+
+die(json_encode(array('error'=>'', 'token'=>$token, 'url'=>'')));
+?>

bbs/write_update.php

@@ -3,6 +3,9 @@ include_once('./_common.php');
 include_once(G5_LIB_PATH.'/naver_syndi.lib.php');
 include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 
+// 토큰체크
+check_write_token($bo_table);
+
 $g5['title'] = '게시글 저장';
 
 $msg = array();

config.php

@@ -5,7 +5,7 @@
 ********************/
 
 define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.2.0');
+define('G5_GNUBOARD_VER', '5.2.5');
 
 // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
 define('_GNUBOARD_', true);

extend/smarteditor_upload_extend.php

@@ -0,0 +1,11 @@
+<?php
+if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
+
+//플러그인 폴더 이름 및 스킨 폴더 이름
+define('SMARTEDITOR_UPLOAD_IMG_CHECK', 1);  // 이미지 파일을 썸네일 할수 있는지 여부를 체크합니다. ( 해당 파일이 이미지 파일인지 체크합니다. 1이면 사용, 0이면 사용 안함 )
+define('SMARTEDITOR_UPLOAD_RESIZE', 0);  // 스마트에디터 업로드 이미지파일 JPG, PNG 리사이즈 1이면 사용, 0이면 사용안함
+define('SMARTEDITOR_UPLOAD_MAX_WIDTH', 1200);  // 스마트에디터 업로드 이미지 리사이즈 제한 width
+define('SMARTEDITOR_UPLOAD_MAX_HEIGHT', 2800);  // 스마트에디터 업로드 이미지 리사이즈 제한 height
+define('SMARTEDITOR_UPLOAD_SIZE_LIMIT', 20);  // 스마트에디터 업로드 사이즈 제한 ( 기본 20MB )
+define('SMARTEDITOR_UPLOAD_IMAGE_QUALITY', 98);  // 썸네일 이미지 JPG, PNG 압축률
+?>

extend/version.extend.php

@@ -0,0 +1,6 @@
+<?php
+if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
+
+define('G5_JS_VER',  '161020');
+define('G5_CSS_VER', '161020');
+?>

g4_import_run.php

@@ -28,6 +28,8 @@ $g4_config_file = trim($_POST['file_path']);
 if(!$g4_config_file)
     alert('config.php 파일의 경로를 입력해 주십시오.');
 
+$g4_config_file = preg_replace('#/config.php$#i', '', $g4_config_file).'/config.php';
+
 if(!is_file($g4_config_file))
     alert('입력하신 경로에 config.php 파일이 존재하지 않습니다.');
 

head.sub.php

@@ -55,9 +55,9 @@ if($config['cf_add_meta'])
 <?php
 if (defined('G5_IS_ADMIN')) {
     if(!defined('_THEME_PREVIEW_'))
-        echo '<link rel="stylesheet" href="'.G5_ADMIN_URL.'/css/admin.css">'.PHP_EOL;
+        echo '<link rel="stylesheet" href="'.G5_ADMIN_URL.'/css/admin.css?ver='.G5_CSS_VER.'">'.PHP_EOL;
 } else {
-    echo '<link rel="stylesheet" href="'.G5_CSS_URL.'/'.(G5_IS_MOBILE?'mobile':'default').'.css">'.PHP_EOL;
+    echo '<link rel="stylesheet" href="'.G5_CSS_URL.'/'.(G5_IS_MOBILE?'mobile':'default').'.css?ver='.G5_CSS_VER.'">'.PHP_EOL;
 }
 ?>
 <!--[if lte IE 8]>
@@ -79,9 +79,9 @@ var g5_admin_url = "<?php echo G5_ADMIN_URL; ?>";
 <?php } ?>
 </script>
 <script src="<?php echo G5_JS_URL ?>/jquery-1.8.3.min.js"></script>
-<script src="<?php echo G5_JS_URL ?>/jquery.menu.js"></script>
+<script src="<?php echo G5_JS_URL ?>/jquery.menu.js?ver=<?php echo G5_JS_VER; ?>"></script>
-<script src="<?php echo G5_JS_URL ?>/common.js"></script>
+<script src="<?php echo G5_JS_URL ?>/common.js?ver=<?php echo G5_JS_VER; ?>"></script>
-<script src="<?php echo G5_JS_URL ?>/wrest.js"></script>
+<script src="<?php echo G5_JS_URL ?>/wrest.js?ver=<?php echo G5_JS_VER; ?>"></script>
 <?php
 if(G5_IS_MOBILE) {
     echo '<script src="'.G5_JS_URL.'/modernizr.custom.70111.js"></script>'.PHP_EOL; // overflow scroll 감지

js/certify.js

@@ -13,16 +13,41 @@ function certify_win_open(type, url)
     }
     else if(type == 'kcp-hp')
     {
-        var return_gubun;
+        if($("input[name=veri_up_hash]").size() < 1)
-        var width  = 410;
+                $("input[name=cert_no]").after('<input type="hidden" name="veri_up_hash" value="">');
-        var height = 500;
 
-        var leftpos = screen.width  / 2 - ( width  / 2 );
+        if( navigator.userAgent.indexOf("Android") > - 1 || navigator.userAgent.indexOf("iPhone") > - 1 )
-        var toppos  = screen.height / 2 - ( height / 2 );
+        {
+            var $frm = $(event.target.form);
+            if($("#kcp_cert").size() < 1) {
+                $frm.wrap('<div id="cert_info"></div>');
 
-        var winopts  = "width=" + width   + ", height=" + height + ", toolbar=no,status=no,statusbar=no,menubar=no,scrollbars=no,resizable=no";
+                $("#cert_info").append('<form name="form_temp" method="post">')
-        var position = ",left=" + leftpos + ", top="    + toppos;
+                               .after('<iframe id="kcp_cert" name="kcp_cert" width="100%" height="700" frameborder="0" scrolling="no" style="display:none"></iframe>');
-        var AUTH_POP = window.open(url,'auth_popup', winopts + position);
+            }
+
+            var temp_form = document.form_temp;
+            temp_form.target = "kcp_cert";
+            temp_form.action = url;
+
+            document.getElementById( "cert_info" ).style.display = "none";
+            document.getElementById( "kcp_cert"  ).style.display = "";
+
+            temp_form.submit();
+        }
+        else
+        {
+            var return_gubun;
+            var width  = 410;
+            var height = 500;
+
+            var leftpos = screen.width  / 2 - ( width  / 2 );
+            var toppos  = screen.height / 2 - ( height / 2 );
+
+            var winopts  = "width=" + width   + ", height=" + height + ", toolbar=no,status=no,statusbar=no,menubar=no,scrollbars=no,resizable=no";
+            var position = ",left=" + leftpos + ", top="    + toppos;
+            var AUTH_POP = window.open(url,'auth_popup', winopts + position);
+        }
     }
     else if(type == 'lg-hp')
     {

js/common.js

@@ -546,6 +546,26 @@ function font_resize(id, rmv_class, add_class)
     set_cookie("ck_font_resize_add_class", add_class, 1, g5_cookie_domain);
 }
 
+/**
+ * 댓글 수정 토큰
+**/
+function set_comment_token(f)
+{
+    if(typeof f.token === "undefined")
+        $(f).prepend('<input type="hidden" name="token" value="">');
+
+    $.ajax({
+        url: g5_bbs_url+"/ajax.comment_token.php",
+        type: "GET",
+        dataType: "json",
+        async: false,
+        cache: false,
+        success: function(data, textStatus) {
+            f.token.value = data.token;
+        }
+    });
+}
+
 $(function(){
     $(".win_point").click(function() {
         win_point(this.href);
@@ -669,4 +689,53 @@ $(function(){
             return false;
         }
     });
+});
+
+function get_write_token(bo_table)
+{
+    var token = "";
+
+    $.ajax({
+        type: "POST",
+        url: g5_bbs_url+"/write_token.php",
+        data: { bo_table: bo_table },
+        cache: false,
+        async: false,
+        dataType: "json",
+        success: function(data) {
+            if(data.error) {
+                alert(data.error);
+                if(data.url)
+                    document.location.href = data.url;
+
+                return false;
+            }
+
+            token = data.token;
+        }
+    });
+
+    return token;
+}
+
+$(function() {
+    $(document).on("click", "form[name=fwrite] input:submit", function() {
+        var f = this.form;
+        var bo_table = f.bo_table.value;
+        var token = get_write_token(bo_table);
+
+        if(!token) {
+            alert("토큰 정보가 올바르지 않습니다.");
+            return false;
+        }
+
+        var $f = $(f);
+
+        if(typeof f.token === "undefined")
+            $f.prepend('<input type="hidden" name="token" value="">');
+
+        $f.find("input[name=token]").val(token);
+
+        return true;
+    });
 });

lib/common.lib.php

@@ -712,7 +712,7 @@ function get_member($mb_id, $fields='*')
 // 제목별로 컬럼 정렬하는 QUERY STRING
 function subject_sort_link($col, $query_string='', $flag='asc')
 {
-    global $sst, $sod, $sfl, $stx, $page;
+    global $sst, $sod, $sfl, $stx, $page, $sca;
 
     $q1 = "sst=$col";
     if ($flag == 'asc')
@@ -744,6 +744,7 @@ function subject_sort_link($col, $query_string='', $flag='asc')
     $arr_query[] = $q2;
     $arr_query[] = 'sfl='.$sfl;
     $arr_query[] = 'stx='.$stx;
+    $arr_query[] = 'sca='.$sca;
     $arr_query[] = 'page='.$page;
     $qstr = implode("&", $arr_query);
 
@@ -2423,6 +2424,8 @@ class html_process {
                 if(!trim($link[1]))
                     continue;
 
+                $link[1] = preg_replace('#\.css([\'\"]?>)$#i', '.css?ver='.G5_CSS_VER.'$1', $link[1]);
+
                 $stylesheet .= PHP_EOL.$link[1];
             }
         }
@@ -2447,6 +2450,8 @@ class html_process {
                 if(!trim($js[1]))
                     continue;
 
+                $js[1] = preg_replace('#\.js([\'\"]?>)$#i', '.js?ver='.G5_JS_VER.'$1', $js[1]);
+
                 $javascript .= $php_eol.$js[1];
                 $php_eol = PHP_EOL;
             }
@@ -2464,7 +2469,10 @@ class html_process {
         <body>
         전에 스킨의 자바스크립트가 위치하도록 하게 한다.
         */
-        $buffer = preg_replace('#(</head>[^<]*<body[^>]*>)#', "$javascript\n$1", $buffer);
+        $nl = '';
+        if($javascript)
+            $nl = "\n";
+        $buffer = preg_replace('#(</head>[^<]*<body[^>]*>)#', "$javascript{$nl}$1", $buffer);
 
         return $buffer;
     }
@@ -2981,6 +2989,11 @@ function check_url_host($url, $msg='', $return_url=G5_URL)
     $p = @parse_url($url);
     $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
 
+    if(stripos($url, 'http:') !== false) {
+        if(!isset($p['scheme']) || !$p['scheme'] || !isset($p['host']) || !$p['host'])
+            alert('url 정보가 올바르지 않습니다.', $return_url);
+    }
+
     if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host'])) {
         //if ($p['host'].(isset($p['port']) ? ':'.$p['port'] : '') != $_SERVER['HTTP_HOST']) {
         if ($p['host'] != $host) {
@@ -3221,4 +3234,29 @@ class str_encrypt
         return $result;
     }
 }
+
+// 불법접근을 막도록 토큰을 생성하면서 토큰값을 리턴
+function get_write_token($bo_table)
+{
+    $token = md5(uniqid(rand(), true));
+    set_session('ss_write_'.$bo_table.'_token', $token);
+
+    return $token;
+}
+
+
+// POST로 넘어온 토큰과 세션에 저장된 토큰 비교
+function check_write_token($bo_table)
+{
+    if(!$bo_table)
+        alert('올바른 방법으로 이용해 주십시오.', G5_URL);
+
+    $token = get_session('ss_write_'.$bo_table.'_token');
+    set_session('ss_write_'.$bo_table.'_token', '');
+
+    if(!$token || !$_REQUEST['token'] || $token != $_REQUEST['token'])
+        alert('올바른 방법으로 이용해 주십시오.', G5_URL);
+
+    return true;
+}
 ?>

mobile/skin/board/basic/view_comment.skin.php

@@ -250,6 +250,8 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
 
         <?php if($is_guest) echo chk_captcha_js(); ?>
 
+        set_comment_token(f);
+
         document.getElementById("btn_submit").disabled = "disabled";
 
         return true;

mobile/skin/board/gallery/view_comment.skin.php

@@ -250,6 +250,8 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
 
         <?php if($is_guest) echo chk_captcha_js(); ?>
 
+        set_comment_token(f);
+
         document.getElementById("btn_submit").disabled = "disabled";
 
         return true;

mobile/skin/faq/basic/list.skin.php

@@ -77,7 +77,7 @@ if( count($faq_master_list) ){
 
 <?php
 // 하단 HTML
-echo '<div id="faq_thtml">'.conv_content($fm['fm_tail_html'], 1).'</div>';
+echo '<div id="faq_thtml">'.conv_content($fm['fm_mobile_tail_html'], 1).'</div>';
 ?>
 
 <div id="faq_sch">

mobile/skin/member/basic/register_form.skin.php

@@ -8,7 +8,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
 <div class="mbskin">
     <script src="<?php echo G5_JS_URL ?>/jquery.register_form.js"></script>
     <?php if($config['cf_cert_use'] && ($config['cf_cert_ipin'] || $config['cf_cert_hp'])) { ?>
-    <script src="<?php echo G5_JS_URL ?>/certify.js"></script>
+    <script src="<?php echo G5_JS_URL ?>/certify.js?v=<?php echo G5_JS_VER; ?>"></script>
     <?php } ?>
 
     <form name="fregisterform" id="fregisterform" action="<?php echo $register_action_url ?>" onsubmit="return fregisterform_submit(this);" method="post" enctype="multipart/form-data" autocomplete="off">
@@ -122,7 +122,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
         </tr>
         <?php } ?>
 
-        <?php if ($config['cf_use_hp']) {  ?>
+        <?php if ($config['cf_use_hp'] || $config['cf_cert_hp']) {  ?>
         <tr>
             <th scope="row"><label for="reg_mb_hp">휴대폰번호<?php if ($config['cf_req_hp']) { ?><strong class="sound_only">필수</strong><?php } ?></label></th>
             <td>

mobile/tail.php

@@ -21,7 +21,7 @@ if(defined('G5_THEME_PATH')) {
     <div id="ft_copy">
         <div id="ft_company">
             <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=company">회사소개</a>
-            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=privacy">개인정보취급방침</a>
+            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=privacy">개인정보처리방침</a>
             <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=provision">서비스이용약관</a>
         </div>
         Copyright &copy; <b>소유하신 도메인.</b> All rights reserved.<br>

plugin/PHPMailer/VERSION

@@ -1 +1 @@
-5.2.14
+5.2.19

plugin/PHPMailer/class.phpmailer.php

@@ -31,7 +31,7 @@ class PHPMailer
      * The PHPMailer Version number.
      * @var string
      */
-    public $Version = '5.2.14';
+    public $Version = '5.2.19';
 
     /**
      * Email priority.
@@ -201,6 +201,9 @@ class PHPMailer
     /**
      * An ID to be used in the Message-ID header.
      * If empty, a unique id will be generated.
+     * You can set your own, but it must be in the format "<id@domain>",
+     * as defined in RFC5322 section 3.6.4 or it will be ignored.
+     * @see https://tools.ietf.org/html/rfc5322#section-3.6.4
      * @var string
      */
     public $MessageID = '';
@@ -285,7 +288,7 @@ class PHPMailer
 
     /**
      * SMTP auth type.
-     * Options are LOGIN (default), PLAIN, NTLM, CRAM-MD5
+     * Options are CRAM-MD5, LOGIN, PLAIN, NTLM, XOAUTH2, attempted in that order if not specified
      * @var string
      */
     public $AuthType = '';
@@ -352,6 +355,7 @@ class PHPMailer
     /**
      * Whether to split multiple to addresses into multiple messages
      * or send them all in one message.
+     * Only supported in `mail` and `sendmail` transports, not in SMTP.
      * @var boolean
      */
     public $SingleTo = false;
@@ -394,7 +398,7 @@ class PHPMailer
 
     /**
      * DKIM Identity.
-     * Usually the email address used as the source of the email
+     * Usually the email address used as the source of the email.
      * @var string
      */
     public $DKIM_identity = '';
@@ -419,6 +423,13 @@ class PHPMailer
      */
     public $DKIM_private = '';
 
+    /**
+     * DKIM private key string.
+     * If set, takes precedence over `$DKIM_private`.
+     * @var string
+     */
+    public $DKIM_private_string = '';
+
     /**
      * Callback Action function name.
      *
@@ -446,6 +457,15 @@ class PHPMailer
      */
     public $XMailer = '';
 
+    /**
+     * Which validator to use by default when validating email addresses.
+     * May be a callable to inject your own validator, but there are several built-in validators.
+     * @see PHPMailer::validateAddress()
+     * @var string|callable
+     * @static
+     */
+    public static $validator = 'auto';
+
     /**
      * An instance of the SMTP sender class.
      * @var SMTP
@@ -634,9 +654,11 @@ class PHPMailer
      * Constructor.
      * @param boolean $exceptions Should we throw external exceptions?
      */
-    public function __construct($exceptions = false)
+    public function __construct($exceptions = null)
     {
-        $this->exceptions = (boolean)$exceptions;
+        if ($exceptions !== null) {
+            $this->exceptions = (boolean)$exceptions;
+        }
     }
 
     /**
@@ -645,9 +667,7 @@ class PHPMailer
     public function __destruct()
     {
         //Close any open SMTP connection nicely
-        if ($this->Mailer == 'smtp') {
+        $this->smtpClose();
-            $this->smtpClose();
-        }
     }
 
     /**
@@ -671,14 +691,16 @@ class PHPMailer
         } else {
             $subject = $this->encodeHeader($this->secureHeader($subject));
         }
-        if (ini_get('safe_mode') || !($this->UseSendmailOptions)) {
+
+        //Can't use additional_parameters in safe_mode, calling mail() with null params breaks
+        //@link http://php.net/manual/en/function.mail.php
+        if (ini_get('safe_mode') or !$this->UseSendmailOptions or is_null($params)) {
             $result = @mail($to, $subject, $body, $header);
         } else {
             $result = @mail($to, $subject, $body, $header, $params);
         }
         return $result;
     }
-
     /**
      * Output debugging info via user-defined method.
      * Only generates output if SMTP debug output is enabled (@see SMTP::$do_debug).
@@ -713,7 +735,7 @@ class PHPMailer
             case 'echo':
             default:
                 //Normalize line breaks
-                $str = preg_replace('/(\r\n|\r|\n)/ms', "\n", $str);
+                $str = preg_replace('/\r\n?/ms', "\n", $str);
                 echo gmdate('Y-m-d H:i:s') . "\t" . str_replace(
                     "\n",
                     "\n                   \t                  ",
@@ -850,7 +872,7 @@ class PHPMailer
         $name = trim(preg_replace('/[\r\n]+/', '', $name)); //Strip breaks and trim
         if (($pos = strrpos($address, '@')) === false) {
             // At-sign is misssing.
-            $error_message = $this->lang('invalid_address') . $address;
+            $error_message = $this->lang('invalid_address') . " (addAnAddress $kind): $address";
             $this->setError($error_message);
             $this->edebug($error_message);
             if ($this->exceptions) {
@@ -900,7 +922,7 @@ class PHPMailer
             return false;
         }
         if (!$this->validateAddress($address)) {
-            $error_message = $this->lang('invalid_address') . $address;
+            $error_message = $this->lang('invalid_address') . " (addAnAddress $kind): $address";
             $this->setError($error_message);
             $this->edebug($error_message);
             if ($this->exceptions) {
@@ -994,7 +1016,7 @@ class PHPMailer
         if (($pos = strrpos($address, '@')) === false or
             (!$this->has8bitChars(substr($address, ++$pos)) or !$this->idnSupported()) and
             !$this->validateAddress($address)) {
-            $error_message = $this->lang('invalid_address') . $address;
+            $error_message = $this->lang('invalid_address') . " (setFrom) $address";
             $this->setError($error_message);
             $this->edebug($error_message);
             if ($this->exceptions) {
@@ -1027,19 +1049,30 @@ class PHPMailer
     /**
      * Check that a string looks like an email address.
      * @param string $address The email address to check
-     * @param string $patternselect A selector for the validation pattern to use :
+     * @param string|callable $patternselect A selector for the validation pattern to use :
      * * `auto` Pick best pattern automatically;
      * * `pcre8` Use the squiloople.com pattern, requires PCRE > 8.0, PHP >= 5.3.2, 5.2.14;
      * * `pcre` Use old PCRE implementation;
      * * `php` Use PHP built-in FILTER_VALIDATE_EMAIL;
      * * `html5` Use the pattern given by the HTML5 spec for 'email' type form input elements.
      * * `noregex` Don't use a regex: super fast, really dumb.
+     * Alternatively you may pass in a callable to inject your own validator, for example:
+     * PHPMailer::validateAddress('user@example.com', function($address) {
+     *     return (strpos($address, '@') !== false);
+     * });
+     * You can also set the PHPMailer::$validator static to a callable, allowing built-in methods to use your validator.
      * @return boolean
      * @static
      * @access public
      */
-    public static function validateAddress($address, $patternselect = 'auto')
+    public static function validateAddress($address, $patternselect = null)
     {
+        if (is_null($patternselect)) {
+            $patternselect = self::$validator;
+        }
+        if (is_callable($patternselect)) {
+            return call_user_func($patternselect, $address);
+        }
         //Reject line breaks in addresses; it's valid RFC5322, but not RFC5321
         if (strpos($address, "\n") !== false or strpos($address, "\r") !== false) {
             return false;
@@ -1216,7 +1249,7 @@ class PHPMailer
                 }
                 $this->$address_kind = $this->punyencodeAddress($this->$address_kind);
                 if (!$this->validateAddress($this->$address_kind)) {
-                    $error_message = $this->lang('invalid_address') . $this->$address_kind;
+                    $error_message = $this->lang('invalid_address') . ' (punyEncode) ' . $this->$address_kind;
                     $this->setError($error_message);
                     $this->edebug($error_message);
                     if ($this->exceptions) {
@@ -1227,7 +1260,7 @@ class PHPMailer
             }
 
             // Set whether the message is multipart/alternative
-            if (!empty($this->AltBody)) {
+            if ($this->alternativeExists()) {
                 $this->ContentType = 'multipart/alternative';
             }
 
@@ -1261,9 +1294,11 @@ class PHPMailer
 
             // Sign with DKIM if enabled
             if (!empty($this->DKIM_domain)
-                && !empty($this->DKIM_private)
                 && !empty($this->DKIM_selector)
-                && file_exists($this->DKIM_private)) {
+                && (!empty($this->DKIM_private_string)
+                   || (!empty($this->DKIM_private) && file_exists($this->DKIM_private))
+                )
+            ) {
                 $header_dkim = $this->DKIM_Add(
                     $this->MIMEHeader . $this->mailHeader,
                     $this->encodeHeader($this->secureHeader($this->Subject)),
@@ -1329,7 +1364,7 @@ class PHPMailer
      */
     protected function sendmailSend($header, $body)
     {
-        if ($this->Sender != '') {
+        if (!empty($this->Sender)) {
             if ($this->Mailer == 'qmail') {
                 $sendmail = sprintf('%s -f%s', escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
             } else {
@@ -1404,17 +1439,17 @@ class PHPMailer
         }
         $to = implode(', ', $toArr);
 
-        if (empty($this->Sender)) {
+        $params = null;
-            $params = ' ';
+        //This sets the SMTP envelope sender which gets turned into a return-path header by the receiver
-        } else {
+        if (!empty($this->Sender) and $this->validateAddress($this->Sender)) {
-            $params = sprintf('-f%s', $this->Sender);
+            $params = sprintf('-f%s', escapeshellarg($this->Sender));
         }
-        if ($this->Sender != '' and !ini_get('safe_mode')) {
+        if (!empty($this->Sender) and !ini_get('safe_mode') and $this->validateAddress($this->Sender)) {
             $old_from = ini_get('sendmail_from');
             ini_set('sendmail_from', $this->Sender);
         }
         $result = false;
-        if ($this->SingleTo && count($toArr) > 1) {
+        if ($this->SingleTo and count($toArr) > 1) {
             foreach ($toArr as $toAddr) {
                 $result = $this->mailPassthru($toAddr, $this->Subject, $body, $header, $params);
                 $this->doCallback($result, array($toAddr), $this->cc, $this->bcc, $this->Subject, $body, $this->From);
@@ -1463,10 +1498,10 @@ class PHPMailer
         if (!$this->smtpConnect($this->SMTPOptions)) {
             throw new phpmailerException($this->lang('smtp_connect_failed'), self::STOP_CRITICAL);
         }
-        if ('' == $this->Sender) {
+        if (!empty($this->Sender) and $this->validateAddress($this->Sender)) {
-            $smtp_from = $this->From;
-        } else {
             $smtp_from = $this->Sender;
+        } else {
+            $smtp_from = $this->From;
         }
         if (!$this->smtp->mail($smtp_from)) {
             $this->setError($this->lang('from_failed') . $smtp_from . ' : ' . implode(',', $this->smtp->getError()));
@@ -1520,12 +1555,17 @@ class PHPMailer
      * @throws phpmailerException
      * @return boolean
      */
-    public function smtpConnect($options = array())
+    public function smtpConnect($options = null)
     {
         if (is_null($this->smtp)) {
             $this->smtp = $this->getSMTPInstance();
         }
 
+        //If no options are provided, use whatever is set in the instance
+        if (is_null($options)) {
+            $options = $this->SMTPOptions;
+        }
+
         // Already connected?
         if ($this->smtp->connected()) {
             return true;
@@ -1595,7 +1635,7 @@ class PHPMailer
                         if (!$this->smtp->startTLS()) {
                             throw new phpmailerException($this->lang('connect_host'));
                         }
-                        // We must resend HELO after tls negotiation
+                        // We must resend EHLO after TLS negotiation
                         $this->smtp->hello($hello);
                     }
                     if ($this->SMTPAuth) {
@@ -1634,7 +1674,7 @@ class PHPMailer
      */
     public function smtpClose()
     {
-        if ($this->smtp !== null) {
+        if (is_a($this->smtp, 'SMTP')) {
             if ($this->smtp->connected()) {
                 $this->smtp->quit();
                 $this->smtp->close();
@@ -1653,6 +1693,19 @@ class PHPMailer
      */
     public function setLanguage($langcode = 'en', $lang_path = '')
     {
+        // Backwards compatibility for renamed language codes
+        $renamed_langcodes = array(
+            'br' => 'pt_br',
+            'cz' => 'cs',
+            'dk' => 'da',
+            'no' => 'nb',
+            'se' => 'sv',
+        );
+
+        if (isset($renamed_langcodes[$langcode])) {
+            $langcode = $renamed_langcodes[$langcode];
+        }
+
         // Define full set of translatable strings in English
         $PHPMAILER_LANG = array(
             'authenticate' => 'SMTP Error: Could not authenticate.',
@@ -1679,6 +1732,10 @@ class PHPMailer
             // Calculate an absolute path so it can work if CWD is not here
             $lang_path = dirname(__FILE__). DIRECTORY_SEPARATOR . 'language'. DIRECTORY_SEPARATOR;
         }
+        //Validate $langcode
+        if (!preg_match('/^[a-z]{2}(?:_[a-zA-Z]{2})?$/', $langcode)) {
+            $langcode = 'en';
+        }
         $foundlang = true;
         $lang_file = $lang_path . 'phpmailer.lang-' . $langcode . '.php';
         // There is no English translation file
@@ -1972,7 +2029,9 @@ class PHPMailer
             $result .= $this->headerLine('Subject', $this->encodeHeader($this->secureHeader($this->Subject)));
         }
 
-        if ($this->MessageID != '') {
+        // Only allow a custom message ID if it conforms to RFC 5322 section 3.6.4
+        // https://tools.ietf.org/html/rfc5322#section-3.6.4
+        if ('' != $this->MessageID and preg_match('/^<.*@.*>$/', $this->MessageID)) {
             $this->lastMessageID = $this->MessageID;
         } else {
             $this->lastMessageID = sprintf('<%s@%s>', $this->uniqueid, $this->serverHostname());
@@ -2074,7 +2133,15 @@ class PHPMailer
      */
     public function getSentMIMEMessage()
     {
-        return $this->MIMEHeader . $this->mailHeader . self::CRLF . $this->MIMEBody;
+        return rtrim($this->MIMEHeader . $this->mailHeader, "\n\r") . self::CRLF . self::CRLF . $this->MIMEBody;
+    }
+
+    /**
+     * Create unique ID
+     * @return string
+     */
+    protected function generateId() {
+        return md5(uniqid(time()));
     }
 
     /**
@@ -2088,7 +2155,7 @@ class PHPMailer
     {
         $body = '';
         //Create unique IDs and preset boundaries
-        $this->uniqueid = md5(uniqid(time()));
+        $this->uniqueid = $this->generateId();
         $this->boundary[1] = 'b1_' . $this->uniqueid;
         $this->boundary[2] = 'b2_' . $this->uniqueid;
         $this->boundary[3] = 'b3_' . $this->uniqueid;
@@ -2104,12 +2171,12 @@ class PHPMailer
         //Can we do a 7-bit downgrade?
         if ($bodyEncoding == '8bit' and !$this->has8bitChars($this->Body)) {
             $bodyEncoding = '7bit';
+            //All ISO 8859, Windows codepage and UTF-8 charsets are ascii compatible up to 7-bit
             $bodyCharSet = 'us-ascii';
         }
         //If lines are too long, and we're not already using an encoding that will shorten them,
-        //change to quoted-printable transfer encoding
+        //change to quoted-printable transfer encoding for the body part only
         if ('base64' != $this->Encoding and self::hasLineLongerThanMax($this->Body)) {
-            $this->Encoding = 'quoted-printable';
             $bodyEncoding = 'quoted-printable';
         }
 
@@ -2118,10 +2185,12 @@ class PHPMailer
         //Can we do a 7-bit downgrade?
         if ($altBodyEncoding == '8bit' and !$this->has8bitChars($this->AltBody)) {
             $altBodyEncoding = '7bit';
+            //All ISO 8859, Windows codepage and UTF-8 charsets are ascii compatible up to 7-bit
             $altBodyCharSet = 'us-ascii';
         }
-        //If lines are too long, change to quoted-printable transfer encoding
+        //If lines are too long, and we're not already using an encoding that will shorten them,
-        if (self::hasLineLongerThanMax($this->AltBody)) {
+        //change to quoted-printable transfer encoding for the alt body part only
+        if ('base64' != $altBodyEncoding and self::hasLineLongerThanMax($this->AltBody)) {
             $altBodyEncoding = 'quoted-printable';
         }
         //Use this as a preamble in all multipart message types
@@ -2224,8 +2293,10 @@ class PHPMailer
                 $body .= $this->attachAll('attachment', $this->boundary[1]);
                 break;
             default:
-                // catch case 'plain' and case ''
+                // Catch case 'plain' and case '', applies to simple `text/plain` and `text/html` body content types
-                $body .= $this->encodeString($this->Body, $bodyEncoding);
+                //Reset the `Encoding` property in case we changed it for line length reasons
+                $this->Encoding = $bodyEncoding;
+                $body .= $this->encodeString($this->Body, $this->Encoding);
                 break;
         }
 
@@ -2331,8 +2402,7 @@ class PHPMailer
 
     /**
      * Set the message type.
-     * PHPMailer only supports some preset message types,
+     * PHPMailer only supports some preset message types, not arbitrary MIME structures.
-     * not arbitrary MIME structures.
      * @access protected
      * @return void
      */
@@ -2350,6 +2420,7 @@ class PHPMailer
         }
         $this->message_type = implode('_', $type);
         if ($this->message_type == '') {
+            //The 'plain' message_type refers to the message having a single body element, not that it is plain-text
             $this->message_type = 'plain';
         }
     }
@@ -3264,16 +3335,18 @@ class PHPMailer
     }
 
     /**
-     * Create a message from an HTML string.
+     * Create a message body from an HTML string.
-     * Automatically makes modifications for inline images and backgrounds
+     * Automatically inlines images and creates a plain-text version by converting the HTML,
-     * and creates a plain-text version by converting the HTML.
+     * overwriting any existing values in Body and AltBody.
-     * Overwrites any existing values in $this->Body and $this->AltBody
+     * $basedir is used when handling relative image paths, e.g. <img src="images/a.png">
+     * will look for an image file in $basedir/images/a.png and convert it to inline.
+     * If you don't want to apply these transformations to your HTML, just set Body and AltBody yourself.
      * @access public
      * @param string $message HTML message string
-     * @param string $basedir baseline directory for path
+     * @param string $basedir base directory for relative paths to images
      * @param boolean|callable $advanced Whether to use the internal HTML to text converter
      *    or your own custom converter @see PHPMailer::html2text()
-     * @return string $message
+     * @return string $message The transformed message Body
      */
     public function msgHTML($message, $basedir = '', $advanced = false)
     {
@@ -3296,7 +3369,7 @@ class PHPMailer
                             $message
                         );
                     }
-                } elseif (substr($url, 0, 4) !== 'cid:' && !preg_match('#^[A-z]+://#', $url)) {
+                } elseif (substr($url, 0, 4) !== 'cid:' && !preg_match('#^[a-z][a-z0-9+.-]*://#i', $url)) {
                     // Do not change urls for absolute images (thanks to corvuscorax)
                     // Do not change urls that are already inline images
                     $filename = basename($url);
@@ -3332,7 +3405,7 @@ class PHPMailer
         // Convert all message body line breaks to CRLF, makes quoted-printable encoding work much better
         $this->Body = $this->normalizeBreaks($message);
         $this->AltBody = $this->normalizeBreaks($this->html2text($message, $advanced));
-        if (empty($this->AltBody)) {
+        if (!$this->alternativeExists()) {
             $this->AltBody = 'To view this email message, open it in a program that understands HTML!' .
                 self::CRLF . self::CRLF;
         }
@@ -3343,7 +3416,7 @@ class PHPMailer
      * Convert an HTML string into plain text.
      * This is used by msgHTML().
      * Note - older versions of this function used a bundled advanced converter
-     * which was been removed for license reasons in #232
+     * which was been removed for license reasons in #232.
      * Example usage:
      * <code>
      * // Use default conversion
@@ -3643,7 +3716,7 @@ class PHPMailer
      * @access public
      * @param string $signHeader
      * @throws phpmailerException
-     * @return string
+     * @return string The DKIM signature value
      */
     public function DKIM_Sign($signHeader)
     {
@@ -3653,15 +3726,35 @@ class PHPMailer
             }
             return '';
         }
-        $privKeyStr = file_get_contents($this->DKIM_private);
+        $privKeyStr = !empty($this->DKIM_private_string) ? $this->DKIM_private_string : file_get_contents($this->DKIM_private);
-        if ($this->DKIM_passphrase != '') {
+        if ('' != $this->DKIM_passphrase) {
             $privKey = openssl_pkey_get_private($privKeyStr, $this->DKIM_passphrase);
         } else {
-            $privKey = $privKeyStr;
+            $privKey = openssl_pkey_get_private($privKeyStr);
         }
-        if (openssl_sign($signHeader, $signature, $privKey)) {
+        //Workaround for missing digest algorithms in old PHP & OpenSSL versions
-            return base64_encode($signature);
+        //@link http://stackoverflow.com/a/11117338/333340
+        if (version_compare(PHP_VERSION, '5.3.0') >= 0 and
+            in_array('sha256WithRSAEncryption', openssl_get_md_methods(true))) {
+            if (openssl_sign($signHeader, $signature, $privKey, 'sha256WithRSAEncryption')) {
+                openssl_pkey_free($privKey);
+                return base64_encode($signature);
+            }
+        } else {
+            $pinfo = openssl_pkey_get_details($privKey);
+            $hash = hash('sha256', $signHeader);
+            //'Magic' constant for SHA256 from RFC3447
+            //@link https://tools.ietf.org/html/rfc3447#page-43
+            $t = '3031300d060960864801650304020105000420' . $hash;
+            $pslen = $pinfo['bits'] / 8 - (strlen($t) / 2 + 3);
+            $eb = pack('H*', '0001' . str_repeat('FF', $pslen) . '00' . $t);
+
+            if (openssl_private_encrypt($eb, $signature, $privKey, OPENSSL_NO_PADDING)) {
+                openssl_pkey_free($privKey);
+                return base64_encode($signature);
+            }
         }
+        openssl_pkey_free($privKey);
         return '';
     }
 
@@ -3678,7 +3771,7 @@ class PHPMailer
         foreach ($lines as $key => $line) {
             list($heading, $value) = explode(':', $line, 2);
             $heading = strtolower($heading);
-            $value = preg_replace('/\s+/', ' ', $value); // Compress useless spaces
+            $value = preg_replace('/\s{2,}/', ' ', $value); // Compress useless spaces
             $lines[$key] = $heading . ':' . trim($value); // Don't forget to remove WSP around the value
         }
         $signHeader = implode("\r\n", $lines);
@@ -3716,7 +3809,7 @@ class PHPMailer
      */
     public function DKIM_Add($headers_line, $subject, $body)
     {
-        $DKIMsignatureType = 'rsa-sha1'; // Signature & hash algorithms
+        $DKIMsignatureType = 'rsa-sha256'; // Signature & hash algorithms
         $DKIMcanonicalization = 'relaxed/simple'; // Canonicalization of header/body
         $DKIMquery = 'dns/txt'; // Query method
         $DKIMtime = time(); // Signature Timestamp = seconds since 00:00:00 - Jan 1, 1970 (UTC time zone)
@@ -3724,6 +3817,7 @@ class PHPMailer
         $headers = explode($this->LE, $headers_line);
         $from_header = '';
         $to_header = '';
+        $date_header = '';
         $current = '';
         foreach ($headers as $header) {
             if (strpos($header, 'From:') === 0) {
@@ -3732,6 +3826,9 @@ class PHPMailer
             } elseif (strpos($header, 'To:') === 0) {
                 $to_header = $header;
                 $current = 'to_header';
+            } elseif (strpos($header, 'Date:') === 0) {
+                $date_header = $header;
+                $current = 'date_header';
             } else {
                 if (!empty($$current) && strpos($header, ' =?') === 0) {
                     $$current .= $header;
@@ -3742,6 +3839,7 @@ class PHPMailer
         }
         $from = str_replace('|', '=7C', $this->DKIM_QP($from_header));
         $to = str_replace('|', '=7C', $this->DKIM_QP($to_header));
+        $date = str_replace('|', '=7C', $this->DKIM_QP($date_header));
         $subject = str_replace(
             '|',
             '=7C',
@@ -3749,7 +3847,7 @@ class PHPMailer
         ); // Copied header fields (dkim-quoted-printable)
         $body = $this->DKIM_BodyC($body);
         $DKIMlen = strlen($body); // Length of body
-        $DKIMb64 = base64_encode(pack('H*', sha1($body))); // Base64 of packed binary SHA-1 hash of body
+        $DKIMb64 = base64_encode(pack('H*', hash('sha256', $body))); // Base64 of packed binary SHA-256 hash of body
         if ('' == $this->DKIM_identity) {
             $ident = '';
         } else {
@@ -3762,16 +3860,18 @@ class PHPMailer
             $this->DKIM_selector .
             ";\r\n" .
             "\tt=" . $DKIMtime . '; c=' . $DKIMcanonicalization . ";\r\n" .
-            "\th=From:To:Subject;\r\n" .
+            "\th=From:To:Date:Subject;\r\n" .
             "\td=" . $this->DKIM_domain . ';' . $ident . "\r\n" .
             "\tz=$from\r\n" .
             "\t|$to\r\n" .
+            "\t|$date\r\n" .
             "\t|$subject;\r\n" .
             "\tbh=" . $DKIMb64 . ";\r\n" .
             "\tb=";
         $toSign = $this->DKIM_HeaderC(
             $from_header . "\r\n" .
             $to_header . "\r\n" .
+            $date_header . "\r\n" .
             $subject_header . "\r\n" .
             $dkimhdrs
         );

plugin/PHPMailer/class.phpmaileroauth.php

@@ -80,6 +80,7 @@ class PHPMailerOAuth extends PHPMailer
      * @uses SMTP
      * @access public
      * @return bool
+     * @throws phpmailerException
      */
     public function smtpConnect($options = array())
     {

plugin/PHPMailer/class.phpmaileroauthgoogle.php

@@ -49,7 +49,8 @@ class PHPMailerOAuthGoogle
         $this->oauthUserEmail = $UserEmail;
     }
 
-    private function getProvider() {
+    private function getProvider()
+    {
         return new League\OAuth2\Client\Provider\Google([
             'clientId' => $this->oauthClientId,
             'clientSecret' => $this->oauthClientSecret

plugin/PHPMailer/class.pop3.php

@@ -34,7 +34,7 @@ class POP3
      * @var string
      * @access public
      */
-    public $Version = '5.2.14';
+    public $Version = '5.2.19';
 
     /**
      * Default POP3 port number.

plugin/PHPMailer/class.smtp.php

@@ -30,7 +30,7 @@ class SMTP
      * The PHPMailer SMTP version number.
      * @var string
      */
-    const VERSION = '5.2.14';
+    const VERSION = '5.2.19';
 
     /**
      * SMTP line break constant.
@@ -81,7 +81,7 @@ class SMTP
      * @deprecated Use the `VERSION` constant instead
      * @see SMTP::VERSION
      */
-    public $Version = '5.2.14';
+    public $Version = '5.2.19';
 
     /**
      * SMTP server port number.
@@ -150,6 +150,17 @@ class SMTP
      */
     public $Timelimit = 300;
 
+	/**
+	 * @var array patterns to extract smtp transaction id from smtp reply
+	 * Only first capture group will be use, use non-capturing group to deal with it
+	 * Extend this class to override this property to fulfil your needs.
+	 */
+	protected $smtp_transaction_id_patterns = array(
+		'exim' => '/[0-9]{3} OK id=(.*)/',
+		'sendmail' => '/[0-9]{3} 2.0.0 (.*) Message/',
+		'postfix' => '/[0-9]{3} 2.0.0 Ok: queued as (.*)/'
+	);
+
     /**
      * The socket for the server connection.
      * @var resource
@@ -206,7 +217,7 @@ class SMTP
         }
         //Avoid clash with built-in function names
         if (!in_array($this->Debugoutput, array('error_log', 'html', 'echo')) and is_callable($this->Debugoutput)) {
-            call_user_func($this->Debugoutput, $str, $this->do_debug);
+            call_user_func($this->Debugoutput, $str, $level);
             return;
         }
         switch ($this->Debugoutput) {
@@ -272,8 +283,8 @@ class SMTP
         $errstr = '';
         if ($streamok) {
             $socket_context = stream_context_create($options);
-            //Suppress errors; connection failures are handled at a higher level
+            set_error_handler(array($this, 'errorHandler'));
-            $this->smtp_conn = @stream_socket_client(
+            $this->smtp_conn = stream_socket_client(
                 $host . ":" . $port,
                 $errno,
                 $errstr,
@@ -281,12 +292,14 @@ class SMTP
                 STREAM_CLIENT_CONNECT,
                 $socket_context
             );
+            restore_error_handler();
         } else {
             //Fall back to fsockopen which should work in more places, but is missing some features
             $this->edebug(
                 "Connection: stream_socket_client not available, falling back to fsockopen",
                 self::DEBUG_CONNECTION
             );
+            set_error_handler(array($this, 'errorHandler'));
             $this->smtp_conn = fsockopen(
                 $host,
                 $port,
@@ -294,6 +307,7 @@ class SMTP
                 $errstr,
                 $timeout
             );
+            restore_error_handler();
         }
         // Verify we connected properly
         if (!is_resource($this->smtp_conn)) {
@@ -336,11 +350,22 @@ class SMTP
         if (!$this->sendCommand('STARTTLS', 'STARTTLS', 220)) {
             return false;
         }
+
+        //Allow the best TLS version(s) we can
+        $crypto_method = STREAM_CRYPTO_METHOD_TLS_CLIENT;
+
+        //PHP 5.6.7 dropped inclusion of TLS 1.1 and 1.2 in STREAM_CRYPTO_METHOD_TLS_CLIENT
+        //so add them back in manually if we can
+        if (defined('STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT')) {
+            $crypto_method |= STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT;
+            $crypto_method |= STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT;
+        }
+
         // Begin encrypted connection
         if (!stream_socket_enable_crypto(
             $this->smtp_conn,
             true,
-            STREAM_CRYPTO_METHOD_TLS_CLIENT
+            $crypto_method
         )) {
             return false;
         }
@@ -389,7 +414,7 @@ class SMTP
             );
 
             if (empty($authtype)) {
-                foreach (array('LOGIN', 'CRAM-MD5', 'NTLM', 'PLAIN', 'XOAUTH2') as $method) {
+                foreach (array('CRAM-MD5', 'LOGIN', 'PLAIN', 'NTLM', 'XOAUTH2') as $method) {
                     if (in_array($method, $this->server_caps['AUTH'])) {
                         $authtype = $method;
                         break;
@@ -463,7 +488,7 @@ class SMTP
                 $temp = new stdClass;
                 $ntlm_client = new ntlm_sasl_client_class;
                 //Check that functions are available
-                if (!$ntlm_client->Initialize($temp)) {
+                if (!$ntlm_client->initialize($temp)) {
                     $this->setError($temp->error);
                     $this->edebug(
                         'You need to enable some modules in your php.ini file: '
@@ -473,7 +498,7 @@ class SMTP
                     return false;
                 }
                 //msg1
-                $msg1 = $ntlm_client->TypeMsg1($realm, $workstation); //msg1
+                $msg1 = $ntlm_client->typeMsg1($realm, $workstation); //msg1
 
                 if (!$this->sendCommand(
                     'AUTH NTLM',
@@ -492,7 +517,7 @@ class SMTP
                     $password
                 );
                 //msg3
-                $msg3 = $ntlm_client->TypeMsg3(
+                $msg3 = $ntlm_client->typeMsg3(
                     $ntlm_res,
                     $username,
                     $realm,
@@ -736,7 +761,7 @@ class SMTP
     protected function parseHelloFields($type)
     {
         $this->server_caps = array();
-        $lines = explode("\n", $this->last_reply);
+        $lines = explode("\n", $this->helo_rply);
 
         foreach ($lines as $n => $s) {
             //First 4 chars contain response code followed by - or space
@@ -1178,4 +1203,47 @@ class SMTP
     {
         return $this->Timeout;
     }
+
+    /**
+     * Reports an error number and string.
+     * @param integer $errno The error number returned by PHP.
+     * @param string $errmsg The error message returned by PHP.
+     */
+    protected function errorHandler($errno, $errmsg)
+    {
+        $notice = 'Connection: Failed to connect to server.';
+        $this->setError(
+            $notice,
+            $errno,
+            $errmsg
+        );
+        $this->edebug(
+            $notice . ' Error number ' . $errno . '. "Error notice: ' . $errmsg,
+            self::DEBUG_CONNECTION
+        );
+    }
+
+	/**
+	 * Will return the ID of the last smtp transaction based on a list of patterns provided
+	 * in SMTP::$smtp_transaction_id_patterns.
+	 * If no reply has been received yet, it will return null.
+	 * If no pattern has been matched, it will return false.
+	 * @return bool|null|string
+	 */
+	public function getLastTransactionID()
+	{
+		$reply = $this->getLastReply();
+
+		if (empty($reply)) {
+			return null;
+		}
+
+		foreach($this->smtp_transaction_id_patterns as $smtp_transaction_id_pattern) {
+			if(preg_match($smtp_transaction_id_pattern, $reply, $matches)) {
+				return $matches[1];
+			}
+		}
+
+		return false;
+    }
 }

plugin/PHPMailer/composer.json

@@ -0,0 +1,44 @@
+{
+    "name": "phpmailer/phpmailer",
+    "type": "library",
+    "description": "PHPMailer is a full-featured email creation and transfer class for PHP",
+    "authors": [
+        {
+            "name": "Marcus Bointon",
+            "email": "phpmailer@synchromedia.co.uk"
+        },
+        {
+            "name": "Jim Jagielski",
+            "email": "jimjag@gmail.com"
+        },
+        {
+            "name": "Andy Prevost",
+            "email": "codeworxtech@users.sourceforge.net"
+        },
+        {
+            "name": "Brent R. Matzelle"
+        }
+    ],
+    "require": {
+        "php": ">=5.0.0"
+    },
+    "require-dev": {
+        "phpdocumentor/phpdocumentor": "*",
+        "phpunit/phpunit": "4.7.*"
+    },
+    "suggest": {
+        "league/oauth2-google": "Needed for Google XOAUTH2 authentication"
+    },
+    "autoload": {
+        "classmap": [
+            "class.phpmailer.php",
+            "class.phpmaileroauth.php",
+            "class.phpmaileroauthgoogle.php",
+            "class.smtp.php",
+            "class.pop3.php",
+            "extras/EasyPeasyICS.php",
+            "extras/ntlm_sasl_client.php"
+        ]
+    },
+    "license": "LGPL-2.1"
+}

plugin/PHPMailer/examples/DKIM.phps

@@ -0,0 +1,38 @@
+<?php
+/**
+ * This example shows how to use DKIM message authentication with PHPMailer.
+ * There's more to using DKIM than just this code - check out this article:
+ * @link https://yomotherboard.com/how-to-setup-email-server-dkim-keys/
+ * See also the DKIM code in the PHPMailer unit tests,
+ * which shows how to make a key pair from PHP.
+ */
+
+require '../PHPMailerAutoload.php';
+
+//Create a new PHPMailer instance
+$mail = new PHPMailer;
+//Set who the message is to be sent from
+$mail->setFrom('from@example.com', 'First Last');
+//Set an alternative reply-to address
+$mail->addReplyTo('replyto@example.com', 'First Last');
+//Set who the message is to be sent to
+$mail->addAddress('whoto@example.com', 'John Doe');
+//Set the subject line
+$mail->Subject = 'PHPMailer DKIM test';
+//This should be the same as the domain of your From address
+$mail->DKIM_domain = 'example.com';
+//Path to your private key file
+$mail->DKIM_private = 'dkim_private.pem';
+//Set this to your own selector
+$mail->DKIM_selector = 'phpmailer';
+//If your private key has a passphrase, set it here
+$mail->DKIM_passphrase = '';
+//The identity you're signing as - usually your From address
+$mail->DKIM_identity = $mail->From;
+
+//send the message, check for errors
+if (!$mail->send()) {
+    echo "Mailer Error: " . $mail->ErrorInfo;
+} else {
+    echo "Message sent!";
+}

plugin/PHPMailer/examples/scripts/shLegacy.js

@@ -23,24 +23,23 @@ dp.SyntaxHighlighter = {
 					return match.value;
 			
 			return null;
-		};
+		}
 		
 		function defaultValue(value, def)
 		{
 			return value != null ? value : def;
-		};
+		}
 		
 		function asString(value)
 		{
 			return value != null ? value.toString() : null;
-		};
+		}
 
 		var parts = input.split(':'),
 			brushName = parts[0],
 			options = {},
-			straight = { 'true' : true }
+			straight = { 'true' : true },
 			reverse = { 'true' : false },
-			result = null,
 			defaults = SyntaxHighlighter.defaults
 			;
 		
@@ -89,7 +88,7 @@ dp.SyntaxHighlighter = {
 			}
 			
 			return null;
-		};
+		}
 
 		function findTagsByName(list, name, tagName)
 		{

plugin/PHPMailer/examples/send_file_upload.phps

@@ -12,7 +12,7 @@ if (array_key_exists('userfile', $_FILES)) {
         // Upload handled successfully
         // Now create a message
         // This should be somewhere in your include_path
-        require 'PHPMailerAutoload.php';
+        require '../PHPMailerAutoload.php';
         $mail = new PHPMailer;
         $mail->setFrom('from@example.com', 'First Last');
         $mail->addAddress('whoto@example.com', 'John Doe');
@@ -21,19 +21,19 @@ if (array_key_exists('userfile', $_FILES)) {
         // Attach the uploaded file
         $mail->addAttachment($uploadfile, 'My uploaded file');
         if (!$mail->send()) {
-            $msg = "Mailer Error: " . $mail->ErrorInfo;
+            $msg .= "Mailer Error: " . $mail->ErrorInfo;
         } else {
-            $msg = "Message sent!";
+            $msg .= "Message sent!";
         }
     } else {
-        $msg = 'Failed to move file to ' . $uploadfile;
+        $msg .= 'Failed to move file to ' . $uploadfile;
     }
 }
 ?>
 <!DOCTYPE html>
 <html>
 <head>
-    <meta charset="utf-8"/>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
     <title>PHPMailer Upload</title>
 </head>
 <body>

plugin/PHPMailer/examples/send_multiple_file_upload.phps

@@ -0,0 +1,51 @@
+<?php
+/**
+ * PHPMailer multiple files upload and send example
+ */
+$msg = '';
+if (array_key_exists('userfile', $_FILES)) {
+
+    // Create a message
+    // This should be somewhere in your include_path
+    require '../PHPMailerAutoload.php';
+    $mail = new PHPMailer;
+    $mail->setFrom('from@example.com', 'First Last');
+    $mail->addAddress('whoto@example.com', 'John Doe');
+    $mail->Subject = 'PHPMailer file sender';
+    $mail->msgHTML('My message body');
+    //Attach multiple files one by one
+    for ($ct = 0; $ct < count($_FILES['userfile']['tmp_name']); $ct++) {
+        $uploadfile = tempnam(sys_get_temp_dir(), sha1($_FILES['userfile']['name'][$ct]));
+        $filename = $_FILES['userfile']['name'][$ct];
+        if (move_uploaded_file($_FILES['userfile']['tmp_name'][$ct], $uploadfile)) {
+            $mail->addAttachment($uploadfile, $filename);
+        } else {
+            $msg .= 'Failed to move file to ' . $uploadfile;
+        }
+    }
+    if (!$mail->send()) {
+        $msg .= "Mailer Error: " . $mail->ErrorInfo;
+    } else {
+        $msg .= "Message sent!";
+    }
+}
+?>
+<!DOCTYPE html>
+<html>
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+    <title>PHPMailer Upload</title>
+</head>
+<body>
+<?php if (empty($msg)) { ?>
+    <form method="post" enctype="multipart/form-data">
+        <input type="hidden" name="MAX_FILE_SIZE" value="100000">
+        Select one or more files:
+        <input name="userfile[]" type="file" multiple="multiple">
+        <input type="submit" value="Send Files">
+    </form>
+<?php } else {
+    echo $msg;
+} ?>
+</body>
+</html>

plugin/PHPMailer/examples/smtp_check.phps

@@ -17,24 +17,39 @@ $smtp = new SMTP;
 $smtp->do_debug = SMTP::DEBUG_CONNECTION;
 
 try {
-//Connect to an SMTP server
+    //Connect to an SMTP server
-    if ($smtp->connect('mail.example.com', 25)) {
+    if (!$smtp->connect('mail.example.com', 25)) {
-        //Say hello
-        if ($smtp->hello('localhost')) { //Put your host name in here
-            //Authenticate
-            if ($smtp->authenticate('username', 'password')) {
-                echo "Connected ok!";
-            } else {
-                throw new Exception('Authentication failed: ' . $smtp->getLastReply());
-            }
-        } else {
-            throw new Exception('HELO failed: '. $smtp->getLastReply());
-        }
-    } else {
         throw new Exception('Connect failed');
     }
+    //Say hello
+    if (!$smtp->hello(gethostname())) {
+        throw new Exception('EHLO failed: ' . $smtp->getError()['error']);
+    }
+    //Get the list of ESMTP services the server offers
+    $e = $smtp->getServerExtList();
+    //If server can do TLS encryption, use it
+    if (is_array($e) && array_key_exists('STARTTLS', $e)) {
+        $tlsok = $smtp->startTLS();
+        if (!$tlsok) {
+            throw new Exception('Failed to start encryption: ' . $smtp->getError()['error']);
+        }
+        //Repeat EHLO after STARTTLS
+        if (!$smtp->hello(gethostname())) {
+            throw new Exception('EHLO (2) failed: ' . $smtp->getError()['error']);
+        }
+        //Get new capabilities list, which will usually now include AUTH if it didn't before
+        $e = $smtp->getServerExtList();
+    }
+    //If server supports authentication, do it (even if no encryption)
+    if (is_array($e) && array_key_exists('AUTH', $e)) {
+        if ($smtp->authenticate('username', 'password')) {
+            echo "Connected ok!";
+        } else {
+            throw new Exception('Authentication failed: ' . $smtp->getError()['error']);
+        }
+    }
 } catch (Exception $e) {
-    echo 'SMTP error: '. $e->getMessage(), "\n";
+    echo 'SMTP error: ' . $e->getMessage(), "\n";
 }
 //Whatever happened, close the connection.
 $smtp->quit(true);

plugin/PHPMailer/extras/htmlfilter.php

@@ -461,7 +461,6 @@ function tln_deent(&$attvalue, $regex, $hex = false)
  * checks on them.
  *
  * @param string $attvalue A string to run entity check against.
- * @return             Void, modifies a reference value.
  */
 function tln_defang(&$attvalue)
 {
@@ -488,7 +487,6 @@ function tln_defang(&$attvalue)
  * be funny to make "java[tab]script" be just as good as "javascript".
  *
  * @param string $attvalue     The attribute value before extraneous spaces removed.
- * @return     Void, modifies a reference value.
  */
 function tln_unspace(&$attvalue)
 {
@@ -511,7 +509,7 @@ function tln_unspace(&$attvalue)
  * @param array $add_attr_to_tag See description for tln_sanitize
  * @param string $trans_image_path
  * @param boolean $block_external_images
- * @return					Array with modified attributes.
+ * @return array with modified attributes.
  */
 function tln_fixatts(
     $tagname,
@@ -667,9 +665,7 @@ function tln_fixurl($attname, &$attvalue, $trans_image_path, $block_external_ima
 
 function tln_fixstyle($body, $pos, $trans_image_path, $block_external_images)
 {
-    $me = 'tln_fixstyle';
     // workaround for </style> in between comments
-    $iCurrentPos = $pos;
     $content = '';
     $sToken = '';
     $bSucces = false;
@@ -740,8 +736,6 @@ function tln_fixstyle($body, $pos, $trans_image_path, $block_external_images)
      */
     $content = preg_replace("|body(\s*\{.*?\})|si", ".bodyclass\\1", $content);
 
-    $trans_image_path = $trans_image_path;
-
     /**
     * Fix url('blah') declarations.
     */
@@ -796,7 +790,6 @@ function tln_fixstyle($body, $pos, $trans_image_path, $block_external_images)
 
 function tln_body2div($attary, $trans_image_path)
 {
-    $me = 'tln_body2div';
     $divattary = array('class' => "'bodyclass'");
     $text = '#000000';
     $has_bgc_stl = $has_txt_stl = false;
@@ -901,7 +894,7 @@ function tln_sanitize(
                 }
                 $trusted .= tln_tagprint($tagname, $attary, $tagtype);
                 $trusted .= $free_content;
-                $trusted .= tln_tagprint($tagname, false, 2);
+                $trusted .= tln_tagprint($tagname, null, 2);
             }
             continue;
         }

plugin/PHPMailer/extras/ntlm_sasl_client.php

@@ -160,12 +160,12 @@ class ntlm_sasl_client_class
     {
         switch ($this->state) {
             case SASL_NTLM_STATE_IDENTIFY_DOMAIN:
-                $message = $this->TypeMsg1($this->credentials["realm"], $this->credentials["workstation"]);
+                $message = $this->typeMsg1($this->credentials["realm"], $this->credentials["workstation"]);
                 $this->state = SASL_NTLM_STATE_RESPOND_CHALLENGE;
                 break;
             case SASL_NTLM_STATE_RESPOND_CHALLENGE:
                 $ntlm_response = $this->NTLMResponse(substr($response, 24, 8), $this->credentials["password"]);
-                $message = $this->TypeMsg3(
+                $message = $this->typeMsg3(
                     $ntlm_response,
                     $this->credentials["user"],
                     $this->credentials["realm"],

plugin/PHPMailer/get_oauth_token.php

@@ -13,8 +13,15 @@
  * PHP Version 5.4
  */
 
+namespace League\OAuth2\Client\Provider;
+
 require 'vendor/autoload.php';
 
+use League\OAuth2\Client\Provider\Exception\IdentityProviderException;
+use League\OAuth2\Client\Token\AccessToken;
+use League\OAuth2\Client\Tool\BearerAuthorizationTrait;
+use Psr\Http\Message\ResponseInterface;
+
 session_start();
 
 //If this automatic URL doesn't work, set it yourself manually
@@ -25,14 +32,109 @@ $redirectUri = isset($_SERVER['HTTPS']) ? 'https://' : 'http://' . $_SERVER['HTT
 $clientId = 'RANDOMCHARS-----duv1n2.apps.googleusercontent.com';
 $clientSecret = 'RANDOMCHARS-----lGyjPcRtvP';
 
+class Google extends AbstractProvider
+{
+    use BearerAuthorizationTrait;
+
+    const ACCESS_TOKEN_RESOURCE_OWNER_ID = 'id';
+
+    /**
+     * @var string If set, this will be sent to google as the "access_type" parameter.
+     * @link https://developers.google.com/accounts/docs/OAuth2WebServer#offline
+     */
+    protected $accessType;
+
+    /**
+     * @var string If set, this will be sent to google as the "hd" parameter.
+     * @link https://developers.google.com/accounts/docs/OAuth2Login#hd-param
+     */
+    protected $hostedDomain;
+
+    /**
+     * @var string If set, this will be sent to google as the "scope" parameter.
+     * @link https://developers.google.com/gmail/api/auth/scopes
+     */
+    protected $scope;
+
+    public function getBaseAuthorizationUrl()
+    {
+        return 'https://accounts.google.com/o/oauth2/auth';
+    }
+
+    public function getBaseAccessTokenUrl(array $params)
+    {
+        return 'https://accounts.google.com/o/oauth2/token';
+    }
+
+    public function getResourceOwnerDetailsUrl(AccessToken $token)
+    {
+	return ' ';
+    }
+
+    protected function getAuthorizationParameters(array $options)
+    {
+	if (is_array($this->scope)) {
+            $separator = $this->getScopeSeparator();
+            $this->scope = implode($separator, $this->scope);
+        }
+
+        $params = array_merge(
+            parent::getAuthorizationParameters($options),
+            array_filter([
+                'hd'          => $this->hostedDomain,
+                'access_type' => $this->accessType,
+		'scope'       => $this->scope,
+                // if the user is logged in with more than one account ask which one to use for the login!
+                'authuser'    => '-1'
+            ])
+        );
+        return $params;
+    }
+
+    protected function getDefaultScopes()
+    {
+        return [
+            'email',
+            'openid',
+            'profile',
+        ];
+    }
+
+    protected function getScopeSeparator()
+    {
+        return ' ';
+    }
+
+    protected function checkResponse(ResponseInterface $response, $data)
+    {
+        if (!empty($data['error'])) {
+            $code  = 0;
+            $error = $data['error'];
+
+            if (is_array($error)) {
+                $code  = $error['code'];
+                $error = $error['message'];
+            }
+
+            throw new IdentityProviderException($error, $code, $data);
+        }
+    }
+
+    protected function createResourceOwner(array $response, AccessToken $token)
+    {
+        return new GoogleUser($response);
+    }
+}
+
+
 //Set Redirect URI in Developer Console as [https/http]://<yourdomain>/<folder>/get_oauth_token.php
-$provider = new League\OAuth2\Client\Provider\Google(
+$provider = new Google(
     array(
         'clientId' => $clientId,
         'clientSecret' => $clientSecret,
         'redirectUri' => $redirectUri,
-        'scopes' => array('https://mail.google.com/'),
+        'scope' => array('https://mail.google.com/'),
-        'accessType' => 'offline'
+	'accessType' => 'offline'
     )
 );
 

plugin/PHPMailer/language/phpmailer.lang-cs.php

@@ -0,0 +1,25 @@
+<?php
+/**
+ * Czech PHPMailer language file: refer to English translation for definitive list
+ * @package PHPMailer
+ */
+
+$PHPMAILER_LANG['authenticate']         = 'Chyba SMTP: Autentizace selhala.';
+$PHPMAILER_LANG['connect_host']         = 'Chyba SMTP: Nelze navázat spojení se SMTP serverem.';
+$PHPMAILER_LANG['data_not_accepted']    = 'Chyba SMTP: Data nebyla přijata.';
+$PHPMAILER_LANG['empty_message']        = 'Prázdné tělo zprávy';
+$PHPMAILER_LANG['encoding']             = 'Neznámé kódování: ';
+$PHPMAILER_LANG['execute']              = 'Nelze provést: ';
+$PHPMAILER_LANG['file_access']          = 'Nelze získat přístup k souboru: ';
+$PHPMAILER_LANG['file_open']            = 'Chyba souboru: Nelze otevřít soubor pro čtení: ';
+$PHPMAILER_LANG['from_failed']          = 'Následující adresa odesílatele je nesprávná: ';
+$PHPMAILER_LANG['instantiate']          = 'Nelze vytvořit instanci emailové funkce.';
+$PHPMAILER_LANG['invalid_address']      = 'Neplatná adresa: ';
+$PHPMAILER_LANG['mailer_not_supported'] = ' mailer není podporován.';
+$PHPMAILER_LANG['provide_address']      = 'Musíte zadat alespoň jednu emailovou adresu příjemce.';
+$PHPMAILER_LANG['recipients_failed']    = 'Chyba SMTP: Následující adresy příjemců nejsou správně: ';
+$PHPMAILER_LANG['signing']              = 'Chyba přihlašování: ';
+$PHPMAILER_LANG['smtp_connect_failed']  = 'SMTP Connect() selhal.';
+$PHPMAILER_LANG['smtp_error']           = 'Chyba SMTP serveru: ';
+$PHPMAILER_LANG['variable_set']         = 'Nelze nastavit nebo změnit proměnnou: ';
+//$PHPMAILER_LANG['extension_missing']    = 'Extension missing: ';

plugin/PHPMailer/language/phpmailer.lang-da.php

@@ -0,0 +1,26 @@
+<?php
+/**
+ * Danish PHPMailer language file: refer to English translation for definitive list
+ * @package PHPMailer
+ * @author Mikael Stokkebro <info@stokkebro.dk>
+ */
+
+$PHPMAILER_LANG['authenticate']         = 'SMTP fejl: Kunne ikke logge på.';
+$PHPMAILER_LANG['connect_host']         = 'SMTP fejl: Kunne ikke tilslutte SMTP serveren.';
+$PHPMAILER_LANG['data_not_accepted']    = 'SMTP fejl: Data kunne ikke accepteres.';
+//$PHPMAILER_LANG['empty_message']        = 'Message body empty';
+$PHPMAILER_LANG['encoding']             = 'Ukendt encode-format: ';
+$PHPMAILER_LANG['execute']              = 'Kunne ikke køre: ';
+$PHPMAILER_LANG['file_access']          = 'Ingen adgang til fil: ';
+$PHPMAILER_LANG['file_open']            = 'Fil fejl: Kunne ikke åbne filen: ';
+$PHPMAILER_LANG['from_failed']          = 'Følgende afsenderadresse er forkert: ';
+$PHPMAILER_LANG['instantiate']          = 'Kunne ikke initialisere email funktionen.';
+//$PHPMAILER_LANG['invalid_address']        = 'Invalid address: ';
+$PHPMAILER_LANG['mailer_not_supported'] = ' mailer understøttes ikke.';
+$PHPMAILER_LANG['provide_address']      = 'Du skal indtaste mindst en modtagers emailadresse.';
+$PHPMAILER_LANG['recipients_failed']    = 'SMTP fejl: Følgende modtagere er forkerte: ';
+//$PHPMAILER_LANG['signing']              = 'Signing Error: ';
+//$PHPMAILER_LANG['smtp_connect_failed']  = 'SMTP Connect() failed.';
+//$PHPMAILER_LANG['smtp_error']           = 'SMTP server error: ';
+//$PHPMAILER_LANG['variable_set']         = 'Cannot set or reset variable: ';
+//$PHPMAILER_LANG['extension_missing']    = 'Extension missing: ';

plugin/PHPMailer/language/phpmailer.lang-de.php

@@ -4,22 +4,22 @@
  * @package PHPMailer
  */
 
-$PHPMAILER_LANG['authenticate']         = 'SMTP Fehler: Authentifizierung fehlgeschlagen.';
+$PHPMAILER_LANG['authenticate']         = 'SMTP-Fehler: Authentifizierung fehlgeschlagen.';
-$PHPMAILER_LANG['connect_host']         = 'SMTP Fehler: Konnte keine Verbindung zum SMTP-Host herstellen.';
+$PHPMAILER_LANG['connect_host']         = 'SMTP-Fehler: Konnte keine Verbindung zum SMTP-Host herstellen.';
-$PHPMAILER_LANG['data_not_accepted']    = 'SMTP Fehler: Daten werden nicht akzeptiert.';
+$PHPMAILER_LANG['data_not_accepted']    = 'SMTP-Fehler: Daten werden nicht akzeptiert.';
-$PHPMAILER_LANG['empty_message']        = 'E-Mail Inhalt ist leer.';
+$PHPMAILER_LANG['empty_message']        = 'E-Mail-Inhalt ist leer.';
-$PHPMAILER_LANG['encoding']             = 'Unbekanntes Encoding-Format: ';
+$PHPMAILER_LANG['encoding']             = 'Unbekannte Kodierung: ';
 $PHPMAILER_LANG['execute']              = 'Konnte folgenden Befehl nicht ausführen: ';
 $PHPMAILER_LANG['file_access']          = 'Zugriff auf folgende Datei fehlgeschlagen: ';
-$PHPMAILER_LANG['file_open']            = 'Datei Fehler: konnte folgende Datei nicht öffnen: ';
+$PHPMAILER_LANG['file_open']            = 'Dateifehler: Konnte folgende Datei nicht öffnen: ';
 $PHPMAILER_LANG['from_failed']          = 'Die folgende Absenderadresse ist nicht korrekt: ';
-$PHPMAILER_LANG['instantiate']          = 'Mail Funktion konnte nicht initialisiert werden.';
+$PHPMAILER_LANG['instantiate']          = 'Mail-Funktion konnte nicht initialisiert werden.';
-$PHPMAILER_LANG['invalid_address']      = 'E-Mail wird nicht gesendet, die Adresse ist ungültig: ';
+$PHPMAILER_LANG['invalid_address']      = 'Die Adresse ist ungültig: ';
 $PHPMAILER_LANG['mailer_not_supported'] = ' mailer wird nicht unterstützt.';
-$PHPMAILER_LANG['provide_address']      = 'Bitte geben Sie mindestens eine Empfänger E-Mailadresse an.';
+$PHPMAILER_LANG['provide_address']      = 'Bitte geben Sie mindestens eine Empfängeradresse an.';
-$PHPMAILER_LANG['recipients_failed']    = 'SMTP Fehler: Die folgenden Empfänger sind nicht korrekt: ';
+$PHPMAILER_LANG['recipients_failed']    = 'SMTP-Fehler: Die folgenden Empfänger sind nicht korrekt: ';
 $PHPMAILER_LANG['signing']              = 'Fehler beim Signieren: ';
-$PHPMAILER_LANG['smtp_connect_failed']  = 'Verbindung zu SMTP Server fehlgeschlagen.';
+$PHPMAILER_LANG['smtp_connect_failed']  = 'Verbindung zum SMTP-Server fehlgeschlagen.';
-$PHPMAILER_LANG['smtp_error']           = 'Fehler vom SMTP Server: ';
+$PHPMAILER_LANG['smtp_error']           = 'Fehler vom SMTP-Server: ';
 $PHPMAILER_LANG['variable_set']         = 'Kann Variable nicht setzen oder zurücksetzen: ';
-//$PHPMAILER_LANG['extension_missing']    = 'Extension missing: ';
+$PHPMAILER_LANG['extension_missing']    = 'Fehlende Erweiterung: ';

plugin/PHPMailer/language/phpmailer.lang-es.php

@@ -23,4 +23,4 @@ $PHPMAILER_LANG['signing']              = 'Error al firmar: ';
 $PHPMAILER_LANG['smtp_connect_failed']  = 'SMTP Connect() falló.';
 $PHPMAILER_LANG['smtp_error']           = 'Error del servidor SMTP: ';
 $PHPMAILER_LANG['variable_set']         = 'No se pudo configurar la variable: ';
-//$PHPMAILER_LANG['extension_missing']    = 'Extension missing: ';
+$PHPMAILER_LANG['extension_missing']    = 'Extensión faltante: ';

plugin/PHPMailer/language/phpmailer.lang-ka.php

@@ -23,4 +23,4 @@ $PHPMAILER_LANG['signing']              = 'ხელმოწერის შე
 $PHPMAILER_LANG['smtp_connect_failed']  = 'შეცდომა SMTP სერვერთან დაკავშირებისას';
 $PHPMAILER_LANG['smtp_error']           = 'SMTP სერვერის შეცდომა: ';
 $PHPMAILER_LANG['variable_set']         = 'შეუძლებელია შემდეგი ცვლადის შექმნა ან შეცვლა: ';
-//$PHPMAILER_LANG['extension_missing']    = 'Extension missing: ';
+$PHPMAILER_LANG['extension_missing']    = 'ბიბლიოთეკა არ არსებობს: ';

plugin/PHPMailer/language/phpmailer.lang-nb.php

@@ -0,0 +1,25 @@
+<?php
+/**
+ * Norwegian PHPMailer language file: refer to English translation for definitive list
+ * @package PHPMailer
+ */
+
+$PHPMAILER_LANG['authenticate']         = 'SMTP Feil: Kunne ikke autentisere.';
+$PHPMAILER_LANG['connect_host']         = 'SMTP Feil: Kunne ikke koble til SMTP tjener.';
+$PHPMAILER_LANG['data_not_accepted']    = 'SMTP Feil: Data ble ikke akseptert.';
+$PHPMAILER_LANG['empty_message']        = 'Meldingsinnholdet er tomt';
+$PHPMAILER_LANG['encoding']             = 'Ukjent tegnkoding: ';
+$PHPMAILER_LANG['execute']              = 'Kunne ikke utføre: ';
+$PHPMAILER_LANG['file_access']          = 'Får ikke tilgang til filen: ';
+$PHPMAILER_LANG['file_open']            = 'Fil feil: Kunne ikke åpne filen: ';
+$PHPMAILER_LANG['from_failed']          = 'Følgende avsenderadresse feilet: ';
+$PHPMAILER_LANG['instantiate']          = 'Kunne ikke initialisere mailfunksjonen.';
+$PHPMAILER_LANG['invalid_address']      = 'Meldingen ble ikke sendt, følgende adresse er ugyldig: ';
+$PHPMAILER_LANG['provide_address']      = 'Du må angi minst en mottakeradresse.';
+$PHPMAILER_LANG['mailer_not_supported'] = ' mailer er ikke supportert.';
+$PHPMAILER_LANG['recipients_failed']    = 'SMTP Feil: Følgende mottagere feilet: ';
+$PHPMAILER_LANG['signing']              = 'Signeringsfeil: ';
+$PHPMAILER_LANG['smtp_connect_failed']  = 'SMTP Connect() feilet.';
+$PHPMAILER_LANG['smtp_error']           = 'SMTP-serverfeil: ';
+$PHPMAILER_LANG['variable_set']         = 'Kan ikke sette eller resette variabelen: ';
+//$PHPMAILER_LANG['extension_missing']    = 'Extension missing: ';

plugin/PHPMailer/language/phpmailer.lang-pl.php

@@ -23,4 +23,4 @@ $PHPMAILER_LANG['signing']              = 'Błąd podpisywania wiadomości: ';
 $PHPMAILER_LANG['smtp_connect_failed']  = 'SMTP Connect() zakończone niepowodzeniem.';
 $PHPMAILER_LANG['smtp_error']           = 'Błąd SMTP: ';
 $PHPMAILER_LANG['variable_set']         = 'Nie można ustawić lub zmodyfikować zmiennej: ';
-//$PHPMAILER_LANG['extension_missing']    = 'Extension missing: ';
+$PHPMAILER_LANG['extension_missing']    = 'Brakujące rozszerzenie: ';

plugin/PHPMailer/language/phpmailer.lang-pt_br.php

@@ -0,0 +1,28 @@
+<?php
+/**
+ * Brazilian Portuguese PHPMailer language file: refer to English translation for definitive list
+ * @package PHPMailer
+ * @author Paulo Henrique Garcia <paulo@controllerweb.com.br>
+ * @author Lucas Guimarães <lucas@lucasguimaraes.com>
+ * @author Phelipe Alves <phelipealvesdesouza@gmail.com>
+ */
+
+$PHPMAILER_LANG['authenticate']         = 'Erro de SMTP: Não foi possível autenticar.';
+$PHPMAILER_LANG['connect_host']         = 'Erro de SMTP: Não foi possível conectar ao servidor SMTP.';
+$PHPMAILER_LANG['data_not_accepted']    = 'Erro de SMTP: Dados rejeitados.';
+$PHPMAILER_LANG['empty_message']        = 'Mensagem vazia';
+$PHPMAILER_LANG['encoding']             = 'Codificação desconhecida: ';
+$PHPMAILER_LANG['execute']              = 'Não foi possível executar: ';
+$PHPMAILER_LANG['file_access']          = 'Não foi possível acessar o arquivo: ';
+$PHPMAILER_LANG['file_open']            = 'Erro de Arquivo: Não foi possível abrir o arquivo: ';
+$PHPMAILER_LANG['from_failed']          = 'Os seguintes remententes falharam: ';
+$PHPMAILER_LANG['instantiate']          = 'Não foi possível instanciar a função mail.';
+$PHPMAILER_LANG['invalid_address']      = 'Endereço de e-mail inválido: ';
+$PHPMAILER_LANG['mailer_not_supported'] = ' mailer não é suportado.';
+$PHPMAILER_LANG['provide_address']      = 'Você deve informar pelo menos um destinatário.';
+$PHPMAILER_LANG['recipients_failed']    = 'Erro de SMTP: Os seguintes destinatários falharam: ';
+$PHPMAILER_LANG['signing']              = 'Erro de Assinatura: ';
+$PHPMAILER_LANG['smtp_connect_failed']  = 'SMTP Connect() falhou.';
+$PHPMAILER_LANG['smtp_error']           = 'Erro de servidor SMTP: ';
+$PHPMAILER_LANG['variable_set']         = 'Não foi possível definir ou redefinir a variável: ';
+$PHPMAILER_LANG['extension_missing']    = 'Extensão ausente: ';

plugin/PHPMailer/language/phpmailer.lang-ro.php

@@ -2,25 +2,25 @@
 /**
  * Romanian PHPMailer language file: refer to English translation for definitive list
  * @package PHPMailer
- * @author Catalin Constantin <catalin@dazoot.ro>
+ * @author Alex Florea <alecz.fia@gmail.com>
  */
 
-$PHPMAILER_LANG['authenticate']         = 'Eroare SMTP: Nu a functionat autentificarea.';
+$PHPMAILER_LANG['authenticate']         = 'Eroare SMTP: Autentificarea a eșuat.';
-$PHPMAILER_LANG['connect_host']         = 'Eroare SMTP: Nu m-am putut conecta la adresa SMTP.';
+$PHPMAILER_LANG['connect_host']         = 'Eroare SMTP: Conectarea la serverul SMTP a eșuat.';
-$PHPMAILER_LANG['data_not_accepted']    = 'Eroare SMTP: Continutul mailului nu a fost acceptat.';
+$PHPMAILER_LANG['data_not_accepted']    = 'Eroare SMTP: Datele nu au fost acceptate.';
 $PHPMAILER_LANG['empty_message']        = 'Mesajul este gol.';
-$PHPMAILER_LANG['encoding']             = 'Encodare necunoscuta: ';
+$PHPMAILER_LANG['encoding']             = 'Encodare necunoscută: ';
-$PHPMAILER_LANG['execute']              = 'Nu pot executa:  ';
+$PHPMAILER_LANG['execute']              = 'Nu se poate executa următoarea comandă:  ';
-$PHPMAILER_LANG['file_access']          = 'Nu pot accesa fisierul: ';
+$PHPMAILER_LANG['file_access']          = 'Nu se poate accesa următorul fișier: ';
-$PHPMAILER_LANG['file_open']            = 'Eroare de fisier: Nu pot deschide fisierul: ';
+$PHPMAILER_LANG['file_open']            = 'Eroare fișier: Nu se poate deschide următorul fișier: ';
-$PHPMAILER_LANG['from_failed']          = 'Urmatoarele adrese From au dat eroare: ';
+$PHPMAILER_LANG['from_failed']          = 'Următoarele adrese From au dat eroare: ';
-$PHPMAILER_LANG['instantiate']          = 'Nu am putut instantia functia mail.';
+$PHPMAILER_LANG['instantiate']          = 'Funcția mail nu a putut fi inițializată.';
-$PHPMAILER_LANG['invalid_address']      = 'Adresa de email nu este valida: ';
+$PHPMAILER_LANG['invalid_address']      = 'Adresa de email nu este validă: ';
 $PHPMAILER_LANG['mailer_not_supported'] = ' mailer nu este suportat.';
-$PHPMAILER_LANG['provide_address']      = 'Trebuie sa adaugati cel putin un recipient (adresa de mail).';
+$PHPMAILER_LANG['provide_address']      = 'Trebuie să adăugați cel puțin o adresă de email.';
-$PHPMAILER_LANG['recipients_failed']    = 'Eroare SMTP: Urmatoarele adrese de mail au dat eroare: ';
+$PHPMAILER_LANG['recipients_failed']    = 'Eroare SMTP: Următoarele adrese de email au eșuat: ';
-$PHPMAILER_LANG['signing']              = 'A aparut o problema la semnarea emailului. ';
+$PHPMAILER_LANG['signing']              = 'A aparut o problemă la semnarea emailului. ';
-$PHPMAILER_LANG['smtp_connect_failed']  = 'Conectarea la serverul SMTP a esuat.';
+$PHPMAILER_LANG['smtp_connect_failed']  = 'Conectarea la serverul SMTP a eșuat.';
-$PHPMAILER_LANG['smtp_error']           = 'A aparut o eroare la serverul SMTP. ';
+$PHPMAILER_LANG['smtp_error']           = 'Eroare server SMTP: ';
 $PHPMAILER_LANG['variable_set']         = 'Nu se poate seta/reseta variabila. ';
-//$PHPMAILER_LANG['extension_missing']    = 'Extension missing: ';
+$PHPMAILER_LANG['extension_missing']    = 'Lipsește extensia: ';

plugin/PHPMailer/language/phpmailer.lang-ru.php

@@ -18,9 +18,9 @@ $PHPMAILER_LANG['instantiate']          = 'Невозможно запустит
 $PHPMAILER_LANG['provide_address']      = 'Пожалуйста, введите хотя бы один адрес e-mail получателя.';
 $PHPMAILER_LANG['mailer_not_supported'] = ' — почтовый сервер не поддерживается.';
 $PHPMAILER_LANG['recipients_failed']    = 'Ошибка SMTP: отправка по следующим адресам получателей не удалась: ';
-$PHPMAILER_LANG['empty_message']        = 'Пустое тело сообщения';
+$PHPMAILER_LANG['empty_message']        = 'Пустое сообщение';
 $PHPMAILER_LANG['invalid_address']      = 'Не отослано, неправильный формат email адреса: ';
-$PHPMAILER_LANG['signing']              = 'Ошибка подписывания: ';
+$PHPMAILER_LANG['signing']              = 'Ошибка подписи: ';
 $PHPMAILER_LANG['smtp_connect_failed']  = 'Ошибка соединения с SMTP-сервером';
 $PHPMAILER_LANG['smtp_error']           = 'Ошибка SMTP-сервера: ';
 $PHPMAILER_LANG['variable_set']         = 'Невозможно установить или переустановить переменную: ';

plugin/PHPMailer/language/phpmailer.lang-sv.php

@@ -0,0 +1,26 @@
+<?php
+/**
+ * Swedish PHPMailer language file: refer to English translation for definitive list
+ * @package PHPMailer
+ * @author Johan Linnér <johan@linner.biz>
+ */
+
+$PHPMAILER_LANG['authenticate']         = 'SMTP fel: Kunde inte autentisera.';
+$PHPMAILER_LANG['connect_host']         = 'SMTP fel: Kunde inte ansluta till SMTP-server.';
+$PHPMAILER_LANG['data_not_accepted']    = 'SMTP fel: Data accepterades inte.';
+//$PHPMAILER_LANG['empty_message']        = 'Message body empty';
+$PHPMAILER_LANG['encoding']             = 'Okänt encode-format: ';
+$PHPMAILER_LANG['execute']              = 'Kunde inte köra: ';
+$PHPMAILER_LANG['file_access']          = 'Ingen åtkomst till fil: ';
+$PHPMAILER_LANG['file_open']            = 'Fil fel: Kunde inte öppna fil: ';
+$PHPMAILER_LANG['from_failed']          = 'Följande avsändaradress är felaktig: ';
+$PHPMAILER_LANG['instantiate']          = 'Kunde inte initiera e-postfunktion.';
+$PHPMAILER_LANG['invalid_address']      = 'Felaktig adress: ';
+$PHPMAILER_LANG['provide_address']      = 'Du måste ange minst en mottagares e-postadress.';
+$PHPMAILER_LANG['mailer_not_supported'] = ' mailer stöds inte.';
+$PHPMAILER_LANG['recipients_failed']    = 'SMTP fel: Följande mottagare är felaktig: ';
+$PHPMAILER_LANG['signing']              = 'Signerings fel: ';
+$PHPMAILER_LANG['smtp_connect_failed']  = 'SMTP Connect() misslyckades.';
+$PHPMAILER_LANG['smtp_error']           = 'SMTP server fel: ';
+$PHPMAILER_LANG['variable_set']         = 'Kunde inte definiera eller återställa variabel: ';
+$PHPMAILER_LANG['extension_missing']    = 'Tillägg ej tillgängligt: ';

plugin/editor/smarteditor2/editor.lib.php

@@ -3,9 +3,15 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
 
 function editor_html($id, $content, $is_dhtml_editor=true)
 {
-    global $g5, $config;
+    global $g5, $config, $w, $board;
     static $js = true;
 
+    if( $is_dhtml_editor && $content && !$w && (isset($board['bo_insert_content']) && !empty($board['bo_insert_content']) ) ){       //글쓰기 기본 내용 처리
+        if( preg_match('/\r|\n/', $content) && $content === strip_tags($content, '<a><strong><b>') ) {  //textarea로 작성되고, html 내용이 없다면
+            $content = nl2br($content);
+        }
+    }
+
     $editor_url = G5_EDITOR_URL.'/'.$config['cf_editor'];
 
     $html = "";
@@ -66,36 +72,17 @@ function chk_editor_js($id, $is_dhtml_editor=true)
 }
 
 /*
- * Name: FT-NONCE-LIB
+https://github.com/timostamm/NonceUtil-PHP
- * Created By: Full Throttle Development, LLC (http://fullthrottledevelopment.com)
- * Created On: July 2009
- * Last Modified On: August 12, 2009
- * Last Modified By: Glenn Ansley (glenn@fullthrottledevelopment.com)
- * Version: 0.2
- */
-
-/* 
-Copyright 2009 Full Throttle Development, LLC
-
-This program is free software; you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation; either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 if (!defined('FT_NONCE_UNIQUE_KEY'))
-    define( 'FT_NONCE_UNIQUE_KEY' , sha1(G5_MYSQL_USER) );
+    define( 'FT_NONCE_UNIQUE_KEY' , sha1($_SERVER['SERVER_SOFTWARE'].G5_MYSQL_USER.session_id().G5_TABLE_PREFIX) );
+
+if (!defined('FT_NONCE_SESSION_KEY'))
+    define( 'FT_NONCE_SESSION_KEY' , substr(md5(FT_NONCE_UNIQUE_KEY), 5) );
 
 if (!defined('FT_NONCE_DURATION'))
-    define( 'FT_NONCE_DURATION' , 2160000 ); // 300 makes link or form good for 5 minutes from time of generation,  300은 5분간 유효, 2160000은 10시간동안 유효
+    define( 'FT_NONCE_DURATION' , 60 * 60 ); // 300 makes link or form good for 5 minutes from time of generation,  300은 5분간 유효, 60 * 60 은 1시간
 
 if (!defined('FT_NONCE_KEY'))
     define( 'FT_NONCE_KEY' , '_nonce' );
@@ -107,29 +94,73 @@ if(!function_exists('ft_nonce_create_query_string')){
     }
 }
 
+if(!function_exists('ft_get_secret_key')){
+    function ft_get_secret_key($secret){
+        return md5(FT_NONCE_UNIQUE_KEY.$secret);
+    }
+}
+
 // This method creates an nonce. It should be called by one of the previous two functions.
 if(!function_exists('ft_nonce_create')){
-    function ft_nonce_create( $action = '' , $user='' ){
+    function ft_nonce_create( $action = '',$user='', $timeoutSeconds=FT_NONCE_DURATION ){
-        return substr( ft_nonce_generate_hash( $action . $user ), -12, 10);
+
+        $secret = ft_get_secret_key($action.$user);
+
+        set_session('token_'.FT_NONCE_SESSION_KEY, $secret);
+
+		$salt = ft_nonce_generate_hash();
+		$time = time();
+		$maxTime = $time + $timeoutSeconds;
+		$nonce = $salt . "|" . $maxTime . "|" . sha1( $salt . $secret . $maxTime );
+		return $nonce;
+
     }
 }
 
 // This method validates an nonce
 if(!function_exists('ft_nonce_is_valid')){
-    function ft_nonce_is_valid( $nonce , $action = '' , $user='' ){
+    function ft_nonce_is_valid( $nonce, $action = '', $user='' ){
-        // Nonce generated 0-12 hours ago
+
-        if ( substr(ft_nonce_generate_hash( $action . $user ), -12, 10) == $nonce ){
+        $secret = ft_get_secret_key($action.$user);
-            return true;
+
+        $token = get_session('token_'.FT_NONCE_SESSION_KEY);
+
+        if ($secret != $token){
+            return false;
         }
-        return false;
+
+		if (is_string($nonce) == false) {
+			return false;
+		}
+		$a = explode('|', $nonce);
+		if (count($a) != 3) {
+			return false;
+		}
+		$salt = $a[0];
+		$maxTime = intval($a[1]);
+		$hash = $a[2];
+		$back = sha1( $salt . $secret . $maxTime );
+		if ($back != $hash) {
+			return false;
+		}
+		if (time() > $maxTime) {
+			return false;
+		}
+		return true;
     }
 }
 
 // This method generates the nonce timestamp
 if(!function_exists('ft_nonce_generate_hash')){
-    function ft_nonce_generate_hash( $action='' , $user='' ){
+    function ft_nonce_generate_hash(){
-        $i = ceil( time() / ( FT_NONCE_DURATION / 2 ) );
+		$length = 10;
-        return md5( $i . $action . $user . $action );
+		$chars='1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM';
+		$ll = strlen($chars)-1;
+		$o = '';
+		while (strlen($o) < $length) {
+			$o .= $chars[ rand(0, $ll) ];
+		}
+		return $o;
     }
 }
 ?>

plugin/editor/smarteditor2/js/smarteditor2.js

@@ -1,6 +1,5 @@
 /**
- * SmartEditor2 NAVER_Library:SE2.8.2.O12056
+ * SmartEditor2 NAVER_Library:SE2.8.2.O4259f59 * Copyright NAVER Corp. Licensed under LGPL v2
- * Copyright NAVER Corp. Licensed under LGPL v2
  * See license text at http://dev.naver.com/projects/smarteditor/wiki/LICENSE
  */
 if(typeof window.nhn=='undefined'){window.nhn = {};}
@@ -4241,9 +4240,9 @@ nhn.husky.SE_EditingAreaManager = jindo.$Class({
 		return this.elEditingAreaContainer.offsetHeight;
 	}
 });
-var nSE2Version = "12056";
+var nSE2Version = "4259f59";
 nhn.husky.SE_EditingAreaManager.version = {
-	revision : "12056",
+	revision : "4259f59",
 	type : "open",
 	number : "2.8.2"
 };

plugin/editor/smarteditor2/photo_uploader/popup/attach_photo.js

@@ -1,681 +0,0 @@
-	//변수 선언 및 초기화
-	var nImageInfoCnt = 0;
-	var htImageInfo = [];		//image file정보 저장
-	var aResult = [];
-	
-	var rFilter = /^(image\/bmp|image\/gif|image\/jpg|image\/jpeg|image\/png)$/i;  
-	var rFilter2 = /^(bmp|gif|jpg|jpeg|png)$/i; 
-	var nTotalSize = 0;
-	var nMaxImageSize = 10*1024*1024;
-	var nMaxTotalImageSize = 50*1024*1024;
-	var nMaxImageCount = 10;
-	var nImageFileCount = 0;
-	var bSupportDragAndDropAPI = false;
-	var oFileUploader;
-	var bAttachEvent = false;
-
-	//마크업에 따른 할당
-	var elContent= $("pop_content");  
-	var elDropArea = jindo.$$.getSingle(".drag_area",elContent);
-	var elDropAreaUL = jindo.$$.getSingle(".lst_type",elContent);
-	var elCountTxtTxt = jindo.$$.getSingle("#imageCountTxt",elContent);
-	var elTotalSizeTxt = jindo.$$.getSingle("#totalSizeTxt",elContent);
-	var elTextGuide = $("guide_text");
-	var welUploadInputBox = $Element("uploadInputBox");
-	var oNavigator = jindo.$Agent().navigator();
-	
-	//마크업-공통 
-	var welBtnConfirm = $Element("btn_confirm");				//확인 버튼
-	var welBtnCancel= $Element("btn_cancel");				//취소 버튼
-	
-	//진도로 랩핑된 element
-	var welTextGuide = $Element(elTextGuide);
-	var welDropArea = $Element(elDropArea);
-	var welDropAreaUL = $Element(elDropAreaUL); 
-	var fnUploadImage = null;
-	
-	//File API 지원 여부로 결정
-	function checkDragAndDropAPI(){
-		try{
-			if( !oNavigator.ie ){
-				if(!!oNavigator.safari && oNavigator.version <= 5){
-					bSupportDragAndDropAPI = false;
-				}else{
-					bSupportDragAndDropAPI = true;
-				}
-			} else {
-				bSupportDragAndDropAPI = false;
-			}
-		}catch(e){
-			bSupportDragAndDropAPI = false;
-		}
-	}
-	
-	//--------------- html5 미지원 브라우저에서 (IE9 이하) ---------------
-	/** 
-	 * 이미지를 첨부 후 활성화된 버튼 상태
-	 */
-     function goStartMode(){
-    	 var sSrc = welBtnConfirm.attr("src")|| "";
-    	 if(sSrc.indexOf("btn_confirm2.png") < 0 ){
-    		 welBtnConfirm.attr("src","../../img/photoQuickPopup/btn_confirm2.png");
-    		 fnUploadImage.attach(welBtnConfirm.$value(), "click");
-    	 }
-     } 
-     /**
-      * 이미지를 첨부 전 비활성화된 버튼 상태
-      * @return
-      */
-     function goReadyMode(){
-    	 var sSrc = welBtnConfirm.attr("src")|| "";
-    	 if(sSrc.indexOf("btn_confirm2.png") >= 0 ){
-    		 fnUploadImage.detach(welBtnConfirm.$value(), "click");
-	    	 welBtnConfirm.attr("src","../../img/photoQuickPopup/btn_confirm.png");
-    	 }
-     }   
-	
-	/**
-	 * 일반 업로드 
-	 * @desc oFileUploader의 upload함수를 호출함. 
-	 */
-	function generalUpload(){
-		oFileUploader.upload();
-	}
-	
-    /** 
-     * 이미지 첨부 전 안내 텍스트가 나오는 배경으로 '설정'하는 함수.
-     * @return
-     */
- 	function readyModeBG (){
- 		var sClass = welTextGuide.className();
- 		if(sClass.indexOf('nobg') >= 0){
- 			welTextGuide.removeClass('nobg');
- 			welTextGuide.className('bg');
- 		}
- 	}
- 	
- 	/**
- 	 * 이미지 첨부 전 안내 텍스트가 나오는 배경을 '제거'하는 함수. 
- 	 * @return
- 	 */
- 	function startModeBG (){
- 		var sClass = welTextGuide.className();
- 		if(sClass.indexOf('nobg') < 0){
-	 		welTextGuide.removeClass('bg');
-	 		welTextGuide.className('nobg');
- 		}
- 	}
-
-	//--------------------- html5  지원되는 브라우저에서 사용하는 함수  --------------------------
- 	/**
- 	 * 팝업에 노출될 업로드 예정 사진의 수.
- 	 * @param {Object} nCount 현재 업로드 예정인 사진 장수
- 	 * @param {Object} nVariable 삭제되는 수
- 	 */
- 	function updateViewCount (nCount, nVariable){
- 		var nCnt = nCount + nVariable;
- 		elCountTxtTxt.innerHTML = nCnt +"장";
- 		nImageFileCount = nCnt;
- 		return nCnt;
- 	}
- 	
- 	/**
- 	 * 팝업에 노출될 업로드될 사진 총 용량
- 	 */
- 	function updateViewTotalSize(){
- 		var nViewTotalSize = Number(parseInt((nTotalSize || 0), 10) / (1024*1024));
- 		elTotalSizeTxt.innerHTML = nViewTotalSize.toFixed(2) +"MB";
- 	}
- 	
- 	/**
- 	 * 이미지 전체 용량 재계산.
- 	 * @param {Object} sParentId
- 	 */
- 	function refreshTotalImageSize(sParentId){
- 		var nDelImgSize = htImageInfo[sParentId].size;
- 		if(nTotalSize - nDelImgSize > -1 ){
- 			nTotalSize = nTotalSize - nDelImgSize;
- 		} 
- 	}
-	
- 	/**
- 	 * hash table에서 이미지 정보 초기화.
- 	 * @param {Object} sParentId
- 	 */
- 	function removeImageInfo (sParentId){
- 		//삭제된 이미지의 공간을 초기화 한다.
- 		htImageInfo[sParentId] = null;
- 	}
- 	
- 	
- 	/**
- 	 * byte로 받은 이미지 용량을 화면에 표시를 위해 포맷팅
- 	 * @param {Object} nByte
- 	 */
- 	function setUnitString (nByte) {
- 		var nImageSize;
- 		var sUnit;
- 		
- 		if(nByte < 0 ){
- 			nByte = 0;
- 		}
- 		
- 		if( nByte < 1024) {
- 			nImageSize = Number(nByte);
- 			sUnit = 'B';
- 			return nImageSize + sUnit;
- 		} else if( nByte > (1024*1024)) {
- 			nImageSize = Number(parseInt((nByte || 0), 10) / (1024*1024));
- 			sUnit = 'MB';
- 			return nImageSize.toFixed(2) + sUnit;
- 		} else {
- 			nImageSize = Number(parseInt((nByte || 0), 10) / 1024);
- 			sUnit = 'KB';
- 			return nImageSize.toFixed(0) + sUnit;
- 		}
-     }
- 	
- 	/**
- 	 * 화면 목록에 적당하게 이름을 잘라서 표시.
- 	 * @param {Object} sName 파일명
- 	 * @param {Object} nMaxLng 최대 길이
- 	 */
- 	function cuttingNameByLength (sName, nMaxLng) {
- 		var sTemp, nIndex;
- 		if(sName.length > nMaxLng){
- 			nIndex = sName.indexOf(".");
- 			sTemp = sName.substring(0,nMaxLng) + "..." + sName.substring(nIndex,sName.length) ;
- 		} else {
- 			sTemp = sName;
- 		}
- 		return sTemp;
- 	}
- 	
- 	/**
- 	 * Total Image Size를 체크해서 추가로 이미지를 넣을지 말지를 결정함.
- 	 * @param {Object} nByte
- 	 */
- 	function checkTotalImageSize(nByte){
- 		if( nTotalSize + nByte < nMaxTotalImageSize){
- 			nTotalSize = nTotalSize + nByte;
- 			return false;
- 		} else {
- 			return true;
- 		}
- 	}
-	
- 	// 이벤트 핸들러 할당
- 	function dragEnter(ev) {
- 		ev.stopPropagation();
- 		ev.preventDefault();
-     }
- 	
-     function dragExit(ev) {
-     	ev.stopPropagation();
-     	ev.preventDefault();
-     }
-     
- 	function dragOver(ev) {
- 		ev.stopPropagation();
- 		ev.preventDefault();
-     }
- 	
-	/**
-	 * 드랍 영역에 사진을 떨구는 순간 발생하는 이벤트
-	 * @param {Object} ev
-	 */
-    function drop(ev) {
-		ev.stopPropagation();
-		ev.preventDefault();
-		
-		if (nImageFileCount >= 10){
-			alert("최대 10장까지만 등록할 수 있습니다.");
-			return;
-		}
-		
-		if(typeof ev.dataTransfer.files == 'undefined'){
-			alert("HTML5를 지원하지 않는 브라우저입니다.");
-		}else{
-			//변수 선언
-			var wel,
-				files,
-				nCount,
-				sListTag = '';
-			
-			//초기화	
-			files = ev.dataTransfer.files;
-			nCount = files.length;
-						
-			if (!!files && nCount === 0){
-				//파일이 아닌, 웹페이지에서 이미지를 드래서 놓는 경우.
-				alert("정상적인 첨부방식이 아닙니다.");
-				return ;
-			}
-			
-			for (var i = 0, j = nImageFileCount ; i < nCount ; i++){
-				if (!rFilter.test(files[i].type)) {
-					alert("이미지파일 (jpg,gif,png,bmp)만 업로드 가능합니다.");
-				} else if(files[i].size > nMaxImageSize){
-					alert("이미지 용량이 10MB를 초과하여 등록할 수 없습니다.");
-				} else {
-					//제한된 수만 업로드 가능.
-					if ( j < nMaxImageCount ){
-						sListTag += addImage(files[i]);
-						
-						//다음 사진을위한 셋팅
-						j = j+1;
-						nImageInfoCnt = nImageInfoCnt+1;
-					} else {
-						alert("최대 10장까지만 등록할 수 있습니다.");
-						break;			
-					}
-				}
-			}
-			if(j > 0){
-				//배경 이미지 변경
-				startModeBG();
-				if ( sListTag.length > 1){
-					welDropAreaUL.prependHTML(sListTag);
-				}
-				//이미지 총사이즈 view update 
-				updateViewTotalSize();
-				//이미치 총 수 view update
-				nImageFileCount = j;
-				updateViewCount(nImageFileCount, 0);
-				// 저장 버튼 활성화
-				goStartMode();
-			}else{
-				readyModeBG();
-			}
-		}
-    }
-	
-    /**
-     * 이미지를 추가하기 위해서 file을 저장하고, 목록에 보여주기 위해서 string을 만드는 함수.
-     * @param ofile 한개의 이미지 파일
-     * @return
-     */
-    function addImage(ofile){
-    	//파일 사이즈
-		var ofile = ofile,
-			sFileSize = 0,
-			sFileName = "",
-			sLiTag = "",
-			bExceedLimitTotalSize = false,
-			aFileList = [];
-		
-		sFileSize = setUnitString(ofile.size);
-		sFileName = cuttingNameByLength(ofile.name, 15);
-		bExceedLimitTotalSize = checkTotalImageSize(ofile.size);
-
-		if( !!bExceedLimitTotalSize ){
-			alert("전체 이미지 용량이 50MB를 초과하여 등록할 수 없습니다. \n\n (파일명 : "+sFileName+", 사이즈 : "+sFileSize+")");
-		} else {
-			//이미지 정보 저장							
-			htImageInfo['img'+nImageInfoCnt] = ofile;
-			
-    		//List 마크업 생성하기
-			aFileList.push('	<li id="img'+nImageInfoCnt+'" class="imgLi"><span>'+ sFileName +'</span>');
-			aFileList.push('	<em>'+ sFileSize +'</em>');
-	        aFileList.push('	<a onclick="delImage(\'img'+nImageInfoCnt+'\')"><img class="del_button" src="../../img/photoQuickPopup/btn_del.png"  width="14" height="13" alt="첨부 사진 삭제"></a>');
-			aFileList.push('	</li> ');   
-			
-			sLiTag = aFileList.join(" ");
-			aFileList = [];
-		}
-		return sLiTag;
-    }
-    
-    /**
-     * HTML5 DragAndDrop으로 사진을 추가하고, 확인버튼을 누른 경우에 동작한다.
-     * @return
-     */
-    function html5Upload() {	
-    	var tempFile,
-    		sUploadURL;
-    	
-    	sUploadURL= 'file_uploader_html5.php'; 	//upload URL
-    	
-    	//파일을 하나씩 보내고, 결과를 받음.
-    	for(var j=0, k=0; j < nImageInfoCnt; j++) {
-    		tempFile = htImageInfo['img'+j];
-    		try{
-	    		if(!!tempFile){
-	    			//Ajax통신하는 부분. 파일과 업로더할 url을 전달한다.
-	    			callAjaxForHTML5(tempFile,sUploadURL);
-	    			k += 1;
-	    		}
-	    	}catch(e){}
-    		tempFile = null;
-    	}
-	}
-    
-    function callAjaxForHTML5 (tempFile, sUploadURL){
-    	var oAjax = jindo.$Ajax(sUploadURL, {
-			type: 'xhr',
-			method : "post",
-			onload : function(res){ // 요청이 완료되면 실행될 콜백 함수
-				var sResString = res._response.responseText;
-				if (res.readyState() == 4) {
-					if(sResString.indexOf("NOTALLOW_") > -1){
-						var sFileName = sResString.replace("NOTALLOW_", "");
-						alert("이미지 파일(jpg,gif,png,bmp)만 업로드 하실 수 있습니다. ("+sFileName+")");
-					}else{
-						//성공 시에  responseText를 가지고 array로 만드는 부분.
-						makeArrayFromString(res._response.responseText);
-					}
-				}
-			},
-			timeout : 3,
-			onerror :  jindo.$Fn(onAjaxError, this).bind()
-		});
-		oAjax.header("contentType","multipart/form-data");
-		oAjax.header("file-name",encodeURIComponent(tempFile.name));
-		oAjax.header("file-size",tempFile.size);
-		oAjax.header("file-Type",tempFile.type);
-		oAjax.request(tempFile);
-    }
-    
-    function makeArrayFromString(sResString){
-    	var	aTemp = [],
-    		aSubTemp = [],
-    		htTemp = {}
-    		aResultleng = 0;
-    	
- 		try{
- 			if(!sResString || sResString.indexOf("sFileURL") < 0){
- 	    		return ;
- 	    	}
- 			aTemp = sResString.split("&");
-	    	for (var i = 0; i < aTemp.length ; i++){
-	    		if( !!aTemp[i] && aTemp[i] != "" && aTemp[i].indexOf("=") > 0){
-	    			aSubTemp = aTemp[i].split("=");
-	    			htTemp[aSubTemp[0]] = aSubTemp[1];
-	    		}
-	 		}
- 		}catch(e){}
- 		
- 		aResultleng = aResult.length;
-    	aResult[aResultleng] = htTemp;
-    	
-    	if(aResult.length == nImageFileCount){
-    		setPhotoToEditor(aResult); 
-    		aResult = null;
-    		window.close();
-    	}
-    }
-    
-    /**
- 	 * 사진 삭제 시에 호출되는 함수
- 	 * @param {Object} sParentId 
- 	 */
- 	function delImage (sParentId){
- 		var elLi = jindo.$$.getSingle("#"+sParentId);
- 		
- 		refreshTotalImageSize(sParentId);
- 		
- 		updateViewTotalSize();
- 		updateViewCount(nImageFileCount,-1);
- 		//사진 file array에서 정보 삭제.
- 		removeImageInfo(sParentId);
- 		//해당 li삭제
- 		$Element(elLi).leave();
- 		
- 		//마지막 이미지인경우.
- 		if(nImageFileCount === 0){
- 			readyModeBG();
- 			//사진 추가 버튼 비활성화
- 			goReadyMode();
- 		}
- 		
- 		// drop 영역 이벤트 다시 활성화.
- 		if(!bAttachEvent){
- 			addEvent();
- 		}
- 	}
-
- 	/**
-     * 이벤트 할당
-     */
-	function addEvent() {
-		bAttachEvent = true;
-		elDropArea.addEventListener("dragenter", dragEnter, false);
-		elDropArea.addEventListener("dragexit", dragExit, false);
-		elDropArea.addEventListener("dragover", dragOver, false);
-		elDropArea.addEventListener("drop", drop, false);
-	}
-	
-	function removeEvent(){
-		bAttachEvent = false;
-		elDropArea.removeEventListener("dragenter", dragEnter, false);
-	    elDropArea.removeEventListener("dragexit", dragExit, false);
-	    elDropArea.removeEventListener("dragover", dragOver, false);
-	    elDropArea.removeEventListener("drop", drop, false);	
-	}
- 	
-	/**
-	 * Ajax 통신 시 error가 발생할 때 처리하는 함수입니다.
-	 * @return
-	 */
-	function onAjaxError (){
-		alert("[가이드]사진 업로더할 서버URL셋팅이 필요합니다.-onAjaxError");
-	}
-
- 	/**
-      * 이미지 업로드 시작
-      * 확인 버튼 클릭하면 호출되는 msg
-      */
-     function uploadImage (e){
-    	 if(!bSupportDragAndDropAPI){
-    		 generalUpload();
-    	 }else{
-    		 html5Upload();
-    	 }
-     }
-     
- 	/**
- 	 * jindo에 파일 업로드 사용.(iframe에 Form을 Submit하여 리프레시없이 파일을 업로드하는 컴포넌트)
- 	 */
- 	function callFileUploader (){
- 		oFileUploader = new jindo.FileUploader(jindo.$("uploadInputBox"),{
- 			sUrl  : location.href.replace(/\/[^\/]*$/, '') + '/file_uploader.php',	//샘플 URL입니다.
- 	        sCallback : location.href.replace(/\/[^\/]*$/, '') + '/callback.html',	//업로드 이후에 iframe이 redirect될 콜백페이지의 주소
- 	    	sFiletype : "*.jpg;*.png;*.bmp;*.gif",						//허용할 파일의 형식. ex) "*", "*.*", "*.jpg", 구분자(;)	
- 	    	sMsgNotAllowedExt : 'JPG, GIF, PNG, BMP 확장자만 가능합니다',	//허용할 파일의 형식이 아닌경우에 띄워주는 경고창의 문구
- 	    	bAutoUpload : false,									 	//파일이 선택됨과 동시에 자동으로 업로드를 수행할지 여부 (upload 메소드 수행)
- 	    	bAutoReset : true 											// 업로드한 직후에 파일폼을 리셋 시킬지 여부 (reset 메소드 수행)
- 	    }).attach({
- 	    	select : function(oCustomEvent) {
- 	    		//파일 선택이 완료되었을 때 발생
-// 		    	 oCustomEvent (이벤트 객체) = {
-// 	    			sValue (String) 선택된 File Input의 값
-// 	    			bAllowed (Boolean) 선택된 파일의 형식이 허용되는 형식인지 여부
-// 	    			sMsgNotAllowedExt (String) 허용되지 않는 파일 형식인 경우 띄워줄 경고메세지
-// 	    		}
-//  				선택된 파일의 형식이 허용되는 경우만 처리 
- 	    		if(oCustomEvent.bAllowed === true){
- 		    		goStartMode();
- 		    	}else{
- 		    		goReadyMode();
- 		    		oFileUploader.reset();
- 		    	}
-// 	    		bAllowed 값이 false인 경우 경고문구와 함께 alert 수행 
-// 	    		oCustomEvent.stop(); 수행시 bAllowed 가 false이더라도 alert이 수행되지 않음
- 	    	},
- 	    	success : function(oCustomEvent) {
- 	    		// alert("success");
- 	    		// 업로드가 성공적으로 완료되었을 때 발생
- 	    		// oCustomEvent(이벤트 객체) = {
- 	    		//	htResult (Object) 서버에서 전달해주는 결과 객체 (서버 설정에 따라 유동적으로 선택가능)
- 	    		// }
- 	    		var aResult = []; 
- 	    		aResult[0] = oCustomEvent.htResult;
- 	    		setPhotoToEditor(aResult); 
- 	    		//버튼 비활성화
- 	    		goReadyMode();
- 	    		oFileUploader.reset();
- 	    		window.close();
- 	    	},
- 	    	error : function(oCustomEvent) {
- 	    		//업로드가 실패했을 때 발생
- 	    		//oCustomEvent(이벤트 객체) = {
- 	    		//	htResult : { (Object) 서버에서 전달해주는 결과 객체. 에러발생시 errstr 프로퍼티를 반드시 포함하도록 서버 응답을 설정하여야한다.
- 	    		//		errstr : (String) 에러메시지
- 	    		// 	}
- 	    		//}
- 	    		//var wel = jindo.$Element("info");
- 	    		//wel.html(oCustomEvent.htResult.errstr);
- 	    		alert(oCustomEvent.htResult.errstr);
- 	    	}
- 	    });
- 	}
-	
-    /**
-     * 페이지 닫기 버튼 클릭
-     */
-    function closeWindow(){
-	   	if(bSupportDragAndDropAPI){
-	   		removeEvent();
-	   	}
-	   	window.close();
-    }
-    
-	window.onload = function(){
-  		checkDragAndDropAPI();
-  		
-  		if(bSupportDragAndDropAPI){
-  			$Element("pop_container2").hide();
-  			$Element("pop_container").show();
-  			
-  			welTextGuide.removeClass("nobg");
-  			welTextGuide.className("bg");
-  			
-  			addEvent();
-  		} else {
-  			$Element("pop_container").hide();
-  			$Element("pop_container2").show();
-  			callFileUploader();
-  		}
-  		fnUploadImage = $Fn(uploadImage,this);
-  		$Fn(closeWindow,this).attach(welBtnCancel.$value(), "click");
-	};
-
-	/**
-	 *  서버로부터 받은 데이타를 에디터에 전달하고 창을 닫음.
-	 * @parameter aFileInfo [{},{},...] 
-	 * @ex aFileInfo = [
-	 * 	{
-			sFileName : "nmms_215646753.gif",
-			sFileURL :"http://static.naver.net/www/u/2010/0611/nmms_215646753.gif",
-			bNewLine : true
-		},
-		{
-			sFileName : "btn_sch_over.gif",
-			sFileURL :"http://static1.naver.net/w9/btn_sch_over.gif",
-			bNewLine : true
-		}
-	 * ]
-	 */
- 	function setPhotoToEditor(oFileInfo){
-		if (!!opener && !!opener.nhn && !!opener.nhn.husky && !!opener.nhn.husky.PopUpManager) {
-			//스마트 에디터 플러그인을 통해서 넣는 방법 (oFileInfo는 Array)
-			opener.nhn.husky.PopUpManager.setCallback(window, 'SET_PHOTO', [oFileInfo]);
-			//본문에 바로 tag를 넣는 방법 (oFileInfo는 String으로 <img src=....> )
-			//opener.nhn.husky.PopUpManager.setCallback(window, 'PASTE_HTML', [oFileInfo]);
-		}
-	}
- 	
- 	// 2012.05 현재] jindo.$Ajax.prototype.request에서 file과 form을 지원하지 안함. 
- 	jindo.$Ajax.prototype.request = function(oData) {
- 		this._status++;
- 		var t   = this;
- 		var req = this._request;
- 		var opt = this._options;
- 		var data, v,a = [], data = "";
- 		var _timer = null;
- 		var url = this._url;
- 		this._is_abort = false;
-
- 		if( opt.postBody && opt.type.toUpperCase()=="XHR" && opt.method.toUpperCase()!="GET"){
- 			if(typeof oData == 'string'){
- 				data = oData;
- 			}else{
- 				data = jindo.$Json(oData).toString();	
- 			}	
- 		}else if (typeof oData == "undefined" || !oData) {
- 			data = null;
- 		} else {
- 			data = oData;
- 		}
- 		
- 		req.open(opt.method.toUpperCase(), url, opt.async);
- 		if (opt.sendheader) {
- 			if(!this._headers["Content-Type"]){
- 				req.setRequestHeader("Content-Type", "application/x-www-form-urlencoded; charset=utf-8");
- 			}
- 			req.setRequestHeader("charset", "utf-8");
- 			for (var x in this._headers) {
- 				if(this._headers.hasOwnProperty(x)){
- 					if (typeof this._headers[x] == "function") 
- 						continue;
- 					req.setRequestHeader(x, String(this._headers[x]));
- 				}
- 			}
- 		}
- 		var navi = navigator.userAgent;
- 		if(req.addEventListener&&!(navi.indexOf("Opera") > -1)&&!(navi.indexOf("MSIE") > -1)){
- 			/*
- 			 * opera 10.60에서 XMLHttpRequest에 addEventListener기 추가되었지만 정상적으로 동작하지 않아 opera는 무조건 dom1방식으로 지원함.
- 			 * IE9에서도 opera와 같은 문제가 있음.
- 			 */
- 			if(this._loadFunc){ req.removeEventListener("load", this._loadFunc, false); }
- 			this._loadFunc = function(rq){ 
- 				clearTimeout(_timer);
- 				_timer = undefined; 
- 				t._onload(rq); 
- 			}
- 			req.addEventListener("load", this._loadFunc, false);
- 		}else{
- 			if (typeof req.onload != "undefined") {
- 				req.onload = function(rq){
- 					if(req.readyState == 4 && !t._is_abort){
- 						clearTimeout(_timer); 
- 						_timer = undefined;
- 						t._onload(rq);
- 					}
- 				};
- 			} else {
- 	            /*
- 				 * IE6에서는 onreadystatechange가 동기적으로 실행되어 timeout이벤트가 발생안됨.
- 				 * 그래서 interval로 체크하여 timeout이벤트가 정상적으로 발생되도록 수정. 비동기 방식일때만
- 		
- 	             */
- 				if(window.navigator.userAgent.match(/(?:MSIE) ([0-9.]+)/)[1]==6&&opt.async){
- 					var onreadystatechange = function(rq){
- 						if(req.readyState == 4 && !t._is_abort){
- 							if(_timer){
- 								clearTimeout(_timer);
- 								_timer = undefined;
- 							}
- 							t._onload(rq);
- 							clearInterval(t._interval);
- 							t._interval = undefined;
- 						}
- 					};
- 					this._interval = setInterval(onreadystatechange,300);
-
- 				}else{
- 					req.onreadystatechange = function(rq){
- 						if(req.readyState == 4){
- 							clearTimeout(_timer); 
- 							_timer = undefined;
- 							t._onload(rq);
- 						}
- 					};
- 				}
- 			}
- 		}
-
- 		req.send(data);
- 		return this;
- 	};

plugin/editor/smarteditor2/photo_uploader/popup/callback.html

@@ -1,31 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 
-<html lang="ko">
-<head>
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <title>FileUploader Callback</title>
-</head>
-<body>
-    <script type="text/javascript">
-    	// alert("callback");
-		// document.domain 설정
-		try { document.domain = "http://*.naver.com"; } catch(e) {}
-		
-        // execute callback script
-        var sUrl = document.location.search.substr(1);
-		if (sUrl != "blank") {
-	        var oParameter = {}; // query array
-
-	        sUrl.replace(/([^=]+)=([^&]*)(&|$)/g, function(){
-	            oParameter[arguments[1]] = arguments[2];
-	            return "";
-	        });
-	        
-	        if ((oParameter.errstr || '').length) { // on error
-	            (parent.jindo.FileUploader._oCallback[oParameter.callback_func+'_error'])(oParameter);
-	        } else {
-		        (parent.jindo.FileUploader._oCallback[oParameter.callback_func+'_success'])(oParameter);
-		   }
-		}
-    </script>
-</body>
-</html>

plugin/editor/smarteditor2/photo_uploader/popup/file_uploader.php

@@ -1,45 +0,0 @@
-<?php
-//사용하지 않으니 막아놓겠습니다.
-exit;
-include_once("../../../../../common.php");
-// default redirection
-$url = $_REQUEST["callback"].'?callback_func='.$_REQUEST["callback_func"];
-$bSuccessUpload = is_uploaded_file($_FILES['Filedata']['tmp_name']);
-
-$ym = date('ym', G5_SERVER_TIME);
-
-$data_dir = G5_DATA_PATH.'/editor/'.$ym;
-$data_url = G5_DATA_URL.'/editor/'.$ym;
-
-@mkdir($data_dir, G5_DIR_PERMISSION);
-@chmod($data_dir, G5_DIR_PERMISSION);
-
-// SUCCESSFUL
-if(bSuccessUpload) {
-	$tmp_name = $_FILES['Filedata']['tmp_name'];
-	$name = $_FILES['Filedata']['name'];
-	
-	$filename_ext = strtolower(array_pop(explode('.',$name)));␍
-	
-	if (!preg_match("/(jpe?g|gif|bmp|png)$/i", $filename_ext)) {
-		$url .= '&errstr='.$name;
-	} else {
-		
-        $file_name = sprintf('%u', ip2long($_SERVER['REMOTE_ADDR'])).'_'.get_microtime().".".$filename_ext;
-		$save_dir = sprintf('%s/%s', $data_dir, $file_name);
-        $save_url = sprintf('%s/%s', $data_url, $file_name);
-		
-		@move_uploaded_file($tmp_name, $save_dir);
-		
-		$url .= "&bNewLine=true";
-		$url .= "&sFileName=".$name;
-		$url .= "&sFileURL=".$save_url;
-	}
-}
-// FAILED
-else {
-	$url .= '&errstr=error';
-}
-	
-header('Location: '. $url);
-?>

plugin/editor/smarteditor2/photo_uploader/popup/file_uploader_html5.php

@@ -1,49 +0,0 @@
-<?php
-//사용하지 않으니 막아놓겠습니다.
-exit;
-include_once("../../../../../common.php");
-
-$ym = date('ym', G5_SERVER_TIME);
-
-$data_dir = G5_DATA_PATH.'/editor/'.$ym;
-$data_url = G5_DATA_URL.'/editor/'.$ym;
-
-@mkdir($data_dir, G5_DIR_PERMISSION);
-@chmod($data_dir, G5_DIR_PERMISSION);
-
- 	$sFileInfo = '';
-	$headers = array();
-	 
-	foreach($_SERVER as $k => $v) {
-		if(substr($k, 0, 9) == "HTTP_FILE") {
-			$k = substr(strtolower($k), 5);
-			$headers[$k] = $v;
-		} 
-	}
-	
-	$file = new stdClass;
-	//$file->name = str_replace("\0", "", rawurldecode($headers['file_name']));
-    $file->name = str_replace("\0", "", rawurldecode($headers['file_name']));
-	$file->size = $headers['file_size'];
-	$file->content = file_get_contents("php://input");
-	
-	$filename_ext = strtolower(array_pop(explode('.',$file->name)));
-
-    if (!preg_match("/(jpe?g|gif|bmp|png)$/i", $filename_ext)) {
-        echo "NOTALLOW_".$file->name;
-        exit;
-    }
-    
-	//$file_name = iconv("utf-8", "cp949", $file->name);
-    $file_name = sprintf('%u', ip2long($_SERVER['REMOTE_ADDR'])).'_'.get_microtime().".".$filename_ext;
-    $newPath = $data_dir."/".$file_name;
-    $save_url = sprintf('%s/%s', $data_url, $file_name);
-
-    if(file_put_contents($newPath, $file->content)) {
-        $sFileInfo .= "&bNewLine=true";
-        $sFileInfo .= "&sFileName=".$file->name;
-        $sFileInfo .= "&sFileURL=".$save_url;
-    }
-    
-    echo $sFileInfo;␍
-?>

plugin/editor/smarteditor2/photo_uploader/popup/jindo.fileuploader.js

@@ -1,390 +0,0 @@
-/**
- * Jindo Component
- * @version 1.0.3
- * NHN_Library:Jindo_Component-1.0.3;JavaScript Components for Jindo;
- * @include Component, UIComponent, FileUploader
- */
-jindo.Component = jindo.$Class({
-    _htEventHandler: null,
-    _htOption: null,
-    $init: function () {
-        var aInstance = this.constructor.getInstance();
-        aInstance.push(this);
-        this._htEventHandler = {};
-        this._htOption = {};
-        this._htOption._htSetter = {};
-    },
-    option: function (sName, vValue) {
-        switch (typeof sName) {
-        case "undefined":
-            return this._htOption;
-        case "string":
-            if (typeof vValue != "undefined") {
-                if (sName == "htCustomEventHandler") {
-                    if (typeof this._htOption[sName] == "undefined") {
-                        this.attach(vValue);
-                    } else {
-                        return this;
-                    }
-                }
-                this._htOption[sName] = vValue;
-                if (typeof this._htOption._htSetter[sName] == "function") {
-                    this._htOption._htSetter[sName](vValue);
-                }
-            } else {
-                return this._htOption[sName];
-            }
-            break;
-        case "object":
-            for (var sKey in sName) {
-                if (sKey == "htCustomEventHandler") {
-                    if (typeof this._htOption[sKey] == "undefined") {
-                        this.attach(sName[sKey]);
-                    } else {
-                        continue;
-                    }
-                }
-                this._htOption[sKey] = sName[sKey];
-                if (typeof this._htOption._htSetter[sKey] == "function") {
-                    this._htOption._htSetter[sKey](sName[sKey]);
-                }
-            }
-            break;
-        }
-        return this;
-    },
-    optionSetter: function (sName, fSetter) {
-        switch (typeof sName) {
-        case "undefined":
-            return this._htOption._htSetter;
-        case "string":
-            if (typeof fSetter != "undefined") {
-                this._htOption._htSetter[sName] = jindo.$Fn(fSetter, this).bind();
-            } else {
-                return this._htOption._htSetter[sName];
-            }
-            break;
-        case "object":
-            for (var sKey in sName) {
-                this._htOption._htSetter[sKey] = jindo.$Fn(sName[sKey], this).bind();
-            }
-            break;
-        }
-        return this;
-    },
-    fireEvent: function (sEvent, oEvent) {
-        oEvent = oEvent || {};
-        var fInlineHandler = this['on' + sEvent],
-            aHandlerList = this._htEventHandler[sEvent] || [],
-            bHasInlineHandler = typeof fInlineHandler == "function",
-            bHasHandlerList = aHandlerList.length > 0;
-        if (!bHasInlineHandler && !bHasHandlerList) {
-            return true;
-        }
-        aHandlerList = aHandlerList.concat();
-        oEvent.sType = sEvent;
-        if (typeof oEvent._aExtend == 'undefined') {
-            oEvent._aExtend = [];
-            oEvent.stop = function () {
-                if (oEvent._aExtend.length > 0) {
-                    oEvent._aExtend[oEvent._aExtend.length - 1].bCanceled = true;
-                }
-            };
-        }
-        oEvent._aExtend.push({
-            sType: sEvent,
-            bCanceled: false
-        });
-        var aArg = [oEvent],
-            i, nLen;
-        for (i = 2, nLen = arguments.length; i < nLen; i++) {
-            aArg.push(arguments[i]);
-        }
-        if (bHasInlineHandler) {
-            fInlineHandler.apply(this, aArg);
-        }
-        if (bHasHandlerList) {
-            var fHandler;
-            for (i = 0, fHandler;
-            (fHandler = aHandlerList[i]); i++) {
-                fHandler.apply(this, aArg);
-            }
-        }
-        return !oEvent._aExtend.pop().bCanceled;
-    },
-    attach: function (sEvent, fHandlerToAttach) {
-        if (arguments.length == 1) {
-            jindo.$H(arguments[0]).forEach(jindo.$Fn(function (fHandler, sEvent) {
-                this.attach(sEvent, fHandler);
-            }, this).bind());
-            return this;
-        }
-        var aHandler = this._htEventHandler[sEvent];
-        if (typeof aHandler == 'undefined') {
-            aHandler = this._htEventHandler[sEvent] = [];
-        }
-        aHandler.push(fHandlerToAttach);
-        return this;
-    },
-    detach: function (sEvent, fHandlerToDetach) {
-        if (arguments.length == 1) {
-            jindo.$H(arguments[0]).forEach(jindo.$Fn(function (fHandler, sEvent) {
-                this.detach(sEvent, fHandler);
-            }, this).bind());
-            return this;
-        }
-        var aHandler = this._htEventHandler[sEvent];
-        if (aHandler) {
-            for (var i = 0, fHandler;
-            (fHandler = aHandler[i]); i++) {
-                if (fHandler === fHandlerToDetach) {
-                    aHandler = aHandler.splice(i, 1);
-                    break;
-                }
-            }
-        }
-        return this;
-    },
-    detachAll: function (sEvent) {
-        var aHandler = this._htEventHandler;
-        if (arguments.length) {
-            if (typeof aHandler[sEvent] == 'undefined') {
-                return this;
-            }
-            delete aHandler[sEvent];
-            return this;
-        }
-        for (var o in aHandler) {
-            delete aHandler[o];
-        }
-        return this;
-    }
-});
-jindo.Component.factory = function (aObject, htOption) {
-    var aReturn = [],
-        oInstance;
-    if (typeof htOption == "undefined") {
-        htOption = {};
-    }
-    for (var i = 0, el;
-    (el = aObject[i]); i++) {
-        oInstance = new this(el, htOption);
-        aReturn[aReturn.length] = oInstance;
-    }
-    return aReturn;
-};
-jindo.Component.getInstance = function () {
-    if (typeof this._aInstance == "undefined") {
-        this._aInstance = [];
-    }
-    return this._aInstance;
-};
-jindo.UIComponent = jindo.$Class({
-    $init: function () {
-        this._bIsActivating = false;
-    },
-    isActivating: function () {
-        return this._bIsActivating;
-    },
-    activate: function () {
-        if (this.isActivating()) {
-            return this;
-        }
-        this._bIsActivating = true;
-        if (arguments.length > 0) {
-            this._onActivate.apply(this, arguments);
-        } else {
-            this._onActivate();
-        }
-        return this;
-    },
-    deactivate: function () {
-        if (!this.isActivating()) {
-            return this;
-        }
-        this._bIsActivating = false;
-        if (arguments.length > 0) {
-            this._onDeactivate.apply(this, arguments);
-        } else {
-            this._onDeactivate();
-        }
-        return this;
-    }
-}).extend(jindo.Component);
-jindo.FileUploader = jindo.$Class({
-    _bIsActivating: false,
-    _aHiddenInput: [],
-    $init: function (elFileSelect, htOption) {
-        var htDefaultOption = {
-            sUrl: '',
-            sCallback: '',
-            htData: {},
-            sFiletype: '*',
-            sMsgNotAllowedExt: "업로드가 허용되지 않는 파일형식입니다",
-            bAutoUpload: false,
-            bAutoReset: true,
-            bActivateOnload: true
-        };
-        this.option(htDefaultOption);
-        this.option(htOption || {});
-        this._el = jindo.$(elFileSelect);
-        this._wel = jindo.$Element(this._el);
-        this._elForm = this._el.form;
-        this._aHiddenInput = [];
-        this.constructor._oCallback = {};
-        this._wfChange = jindo.$Fn(this._onFileSelectChange, this);
-        if (this.option("bActivateOnload")) {
-            this.activate();
-        }
-    },
-    _appendIframe: function () {
-        var sIframeName = 'tmpFrame_' + this._makeUniqueId();
-        this._welIframe = jindo.$Element(jindo.$('<iframe name="' + sIframeName + '" src="' + this.option("sCallback") + '?blank">')).css({
-            width: '10px',
-            border: '2px',
-            height: '10px',
-            left: '10px',
-            top: '10px'
-        });
-        document.body.appendChild(this._welIframe.$value());
-    },
-    _removeIframe: function () {
-        this._welIframe.leave();
-    },
-    getBaseElement: function () {
-        return this.getFileSelect();
-    },
-    getFileSelect: function () {
-        return this._el;
-    },
-    getFormElement: function () {
-        return this._elForm;
-    },
-    upload: function () {
-        this._appendIframe();
-        var elForm = this.getFormElement(),
-            welForm = jindo.$Element(elForm),
-            sIframeName = this._welIframe.attr("name"),
-            sFunctionName = sIframeName + '_func',
-            sAction = this.option("sUrl");
-        welForm.attr({
-            target: sIframeName,
-            action: sAction
-        });
-        this._aHiddenInput.push(this._createElement('input', {
-            'type': 'hidden',
-            'name': 'callback',
-            'value': this.option("sCallback")
-        }));
-        this._aHiddenInput.push(this._createElement('input', {
-            'type': 'hidden',
-            'name': 'callback_func',
-            'value': sFunctionName
-        }));
-        for (var k in this.option("htData")) {
-            this._aHiddenInput.push(this._createElement('input', {
-                'type': 'hidden',
-                'name': k,
-                'value': this.option("htData")[k]
-            }));
-        }
-        for (var i = 0; i < this._aHiddenInput.length; i++) {
-            elForm.appendChild(this._aHiddenInput[i]);
-        }
-        this.constructor._oCallback[sFunctionName + '_success'] = jindo.$Fn(function (oParameter) {
-            this.fireEvent("success", {
-                htResult: oParameter
-            });
-            delete this.constructor._oCallback[oParameter.callback_func + '_success'];
-            delete this.constructor._oCallback[oParameter.callback_func + '_error'];
-            for (var i = 0; i < this._aHiddenInput.length; i++) {
-                jindo.$Element(this._aHiddenInput[i]).leave();
-            }
-            this._aHiddenInput.length = 0;
-            this._removeIframe();
-        }, this).bind();
-        this.constructor._oCallback[sFunctionName + '_error'] = jindo.$Fn(function (oParameter) {
-            this.fireEvent("error", {
-                htResult: oParameter
-            });
-            delete this.constructor._oCallback[oParameter.callback_func + '_success'];
-            delete this.constructor._oCallback[oParameter.callback_func + '_error'];
-            for (var i = 0; i < this._aHiddenInput.length; i++) {
-                jindo.$Element(this._aHiddenInput[i]).leave();
-            }
-            this._aHiddenInput.length = 0;
-            this._removeIframe();
-        }, this).bind();
-        
-        elForm.submit();
-        if (this.option("bAutoReset")) {
-            this.reset();
-        }
-    },
-    reset: function () {
-        var elWrapForm = jindo.$("<form>");
-        this._wel.wrap(elWrapForm);
-        elWrapForm.reset();
-        jindo.$Element(elWrapForm).replace(this._el);
-        var elForm = this.getFormElement(),
-            welForm = jindo.$Element(elForm);
-        welForm.attr({
-            target: this._sPrevTarget,
-            action: this._sAction
-        });
-        return this;
-    },
-    _onActivate: function () {
-        var elForm = this.getFormElement(),
-            welForm = jindo.$Element(elForm);
-        this._sPrevTarget = welForm.attr("target");
-        this._sAction = welForm.attr("action");
-        this._el.value = "";
-        this._wfChange.attach(this._el, "change");
-    },
-    _onDeactivate: function () {
-        this._wfChange.detach(this._el, "change");
-    },
-    _makeUniqueId: function () {
-        return new Date().getMilliseconds() + Math.floor(Math.random() * 100000);
-    },
-    _createElement: function (name, attributes) {
-        var el = jindo.$("<" + name + ">");
-        var wel = jindo.$Element(el);
-        for (var k in attributes) {
-            wel.attr(k, attributes[k]);
-        }
-        return el;
-    },
-    _checkExtension: function (sFile) {
-        var aType = this.option("sFiletype").split(';');
-        for (var i = 0, sType; i < aType.length; i++) {
-            sType = (aType[i] == "*.*") ? "*" : aType[i];
-            sType = sType.replace(/^\s+|\s+$/, '');
-            sType = sType.replace(/\./g, '\\.');
-            sType = sType.replace(/\*/g, '[^\\\/]+');
-            if ((new RegExp(sType + '$', 'gi')).test(sFile)) {
-                return true;
-            }
-        }
-        return false;
-    },
-    _onFileSelectChange: function (we) {
-        var sValue = we.element.value,
-            bAllowed = this._checkExtension(sValue),
-            htParam = {
-                sValue: sValue,
-                bAllowed: bAllowed,
-                sMsgNotAllowedExt: this.option("sMsgNotAllowedExt")
-            };
-        if (sValue.length && this.fireEvent("select", htParam)) {
-            if (bAllowed) {
-                if (this.option("bAutoUpload")) {
-                    this.upload();
-                }
-            } else {
-                alert(htParam.sMsgNotAllowedExt);
-            }
-        }
-    }
-}).extend(jindo.UIComponent);

plugin/editor/smarteditor2/photo_uploader/popup/js/basic.js

@@ -68,7 +68,7 @@ jQuery(function ($) {
                 delete_url = $button.attr("data-delete");
             if( delete_url ){
                 $.ajax({
-                    url: othis.url+"?del=1&file="+ delete_url
+                    url: othis.url+"&del=1&file="+ delete_url
                 }).done(function (result) {
                 });
             }
@@ -122,7 +122,7 @@ jQuery(function ($) {
                 // Uncomment the following to send cross-domain cookies:
                 //xhrFields: {withCredentials: true},
                 //url: $('#fileupload').fileupload('option', 'url'),
-                url: this.url+"?t="+ oDate.getTime(),
+                url: this.url+"&t="+ oDate.getTime(),
                 dataType: 'json',
                 context: $('#fileupload')[0]
             }).always(function () {

plugin/editor/smarteditor2/photo_uploader/popup/photo_uploader.html

@@ -1,100 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<html lang="ko">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
-<meta http-equiv="Content-Script-Type" content="text/javascript">
-<meta http-equiv="Content-Style-Type" content="text/css">
-<title>사진 첨부하기 :: SmartEditor2</title>
-<style type="text/css">
-/* NHN Web Standard 1Team JJS 120106 */ 
-/* Common */
-body,p,h1,h2,h3,h4,h5,h6,ul,ol,li,dl,dt,dd,table,th,td,form,fieldset,legend,input,textarea,button,select{margin:0;padding:0}
-body,input,textarea,select,button,table{font-family:'돋움',Dotum,Helvetica,sans-serif;font-size:12px}
-img,fieldset{border:0}
-ul,ol{list-style:none}
-em,address{font-style:normal}
-a{text-decoration:none}
-a:hover,a:active,a:focus{text-decoration:underline}
-
-/* Contents */
-.blind{visibility:hidden;position:absolute;line-height:0}
-#pop_wrap{width:383px}
-#pop_header{height:26px;padding:14px 0 0 20px;border-bottom:1px solid #ededeb;background:#f4f4f3}
-.pop_container{padding:11px 20px 0}
-#pop_footer{margin:21px 20px 0;padding:10px 0 16px;border-top:1px solid #e5e5e5;text-align:center}
-h1{color:#333;font-size:14px;letter-spacing:-1px}
-.btn_area{word-spacing:2px}
-.pop_container .drag_area{overflow:hidden;overflow-y:auto;position:relative;width:341px;height:129px;margin-top:4px;border:1px solid #eceff2}
-.pop_container .drag_area .bg{display:block;position:absolute;top:0;left:0;width:341px;height:129px;background:#fdfdfd url(../../img/photoQuickPopup/bg_drag_image.png) 0 0 no-repeat}
-.pop_container .nobg{background:none}
-.pop_container .bar{color:#e0e0e0}
-.pop_container .lst_type li{overflow:hidden;position:relative;padding:7px 0 6px 8px;border-bottom:1px solid #f4f4f4;vertical-align:top}
-.pop_container :root .lst_type li{padding:6px 0 5px 8px}
-.pop_container .lst_type li span{float:left;color:#222}
-.pop_container .lst_type li em{float:right;margin-top:1px;padding-right:22px;color:#a1a1a1;font-size:11px}
-.pop_container .lst_type li a{position:absolute;top:6px;right:5px}
-.pop_container .dsc{margin-top:6px;color:#666;line-height:18px}
-.pop_container .dsc_v1{margin-top:12px}
-.pop_container .dsc em{color:#13b72a}
-.pop_container2{padding:46px 60px 20px}
-.pop_container2 .dsc{margin-top:6px;color:#666;line-height:18px}
-.pop_container2 .dsc strong{color:#13b72a}
-.upload{margin:0 4px 0 0;_margin:0;padding:6px 0 4px 6px;border:solid 1px #d5d5d5;color:#a1a1a1;font-size:12px;border-right-color:#efefef;border-bottom-color:#efefef;length:300px;}
-:root  .upload{padding:6px 0 2px 6px;}
-</style>
-</head>
-<body>
-<div id="pop_wrap">
-	<!-- header -->
-    <div id="pop_header">
-        <h1>사진 첨부하기</h1>
-    </div>
-    <!-- //header -->
-    <!-- container -->
-	
-    <!-- [D] HTML5인 경우 pop_container 클래스와 하위 HTML 적용
-	    	 그밖의 경우 pop_container2 클래스와 하위 HTML 적용      -->
-	<div id="pop_container2" class="pop_container2">
-    	<!-- content -->
-		<form id="editor_upimage" name="editor_upimage" action="FileUploader.php" method="post" enctype="multipart/form-data" onSubmit="return false;">
-        <div id="pop_content2">
-			<input type="file" class="upload" id="uploadInputBox" name="Filedata">
-            <p class="dsc" id="info"><strong>10MB</strong>이하의 이미지 파일만 등록할 수 있습니다.<br>(JPG, GIF, PNG, BMP)</p>
-        </div>
-		</form>
-        <!-- //content -->
-    </div>
-    <div id="pop_container" class="pop_container" style="display:none;">
-    	<!-- content -->
-        <div id="pop_content">
-	        <p class="dsc"><em id="imageCountTxt">0장</em>/10장 <span class="bar">|</span> <em id="totalSizeTxt">0MB</em>/50MB</p>
-        	<!-- [D] 첨부 이미지 여부에 따른 Class 변화 
-            	 첨부 이미지가 있는 경우 : em에 "bg" 클래스 적용 //첨부 이미지가 없는 경우 : em에 "nobg" 클래스 적용   -->
-				 
-            <div class="drag_area" id="drag_area">
-				<ul class="lst_type" >
-				</ul>
-            	<em class="blind">마우스로 드래그해서 이미지를 추가해주세요.</em><span id="guide_text" class="bg"></span>
-            </div>
-			<div style="display:none;" id="divImageList"></div>
-            <p class="dsc dsc_v1"><em>한 장당 10MB, 1회에 50MB까지, 10개</em>의 이미지 파일을<br>등록할 수 있습니다. (JPG, GIF, PNG, BMP)</p>
-        </div>
-        <!-- //content -->
-    </div>
-
-    <!-- //container -->
-    <!-- footer -->
-    <div id="pop_footer">
-	    <div class="btn_area">
-            <a href="#"><img src="../../img/photoQuickPopup/btn_confirm.png" width="49" height="28" alt="확인" id="btn_confirm"></a>
-            <a href="#"><img src="../../img/photoQuickPopup/btn_cancel.png" width="48" height="28" alt="취소" id="btn_cancel"></a>
-        </div>
-    </div>
-    <!-- //footer -->
-</div>
-<script type="text/javascript" src="jindo.min.js" charset="utf-8"></script>
-<script type="text/javascript" src="jindo.fileuploader.js" charset="utf-8"></script>
-<script type="text/javascript" src="attach_photo.js" charset="utf-8"></script>
-
-</body>
-</html>

plugin/editor/smarteditor2/photo_uploader/popup/php/UploadHandler.php

@@ -8,39 +8,54 @@
  *
  * Licensed under the MIT license:
  * http://www.opensource.org/licenses/MIT
+ * https://github.com/blueimp/jQuery-File-Upload/wiki/Security
+ * https://github.com/blueimp/jQuery-File-Upload/pull/148
  */
-
 class UploadHandler
 {
 
+    public $files = array();
     protected $options;
-
+    protected $post_max_size;
-    // PHP File Upload error message codes:
+    protected $error_messages;
-    // http://php.net/manual/en/features.file-upload.errors.php
-    protected $error_messages = array(
-        1 => 'The uploaded file exceeds the upload_max_filesize directive in php.ini',
-        2 => 'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form',
-        3 => 'The uploaded file was only partially uploaded',
-        4 => 'No file was uploaded',
-        6 => 'Missing a temporary folder',
-        7 => 'Failed to write file to disk',
-        8 => 'A PHP extension stopped the file upload',
-        'post_max_size' => 'The uploaded file exceeds the post_max_size directive in php.ini',
-        'max_file_size' => 'File is too big',
-        'min_file_size' => 'File is too small',
-        'accept_file_types' => 'Filetype not allowed',
-        'max_number_of_files' => 'Maximum number of files exceeded',
-        'max_width' => 'Image exceeds maximum width',
-        'min_width' => 'Image requires a minimum width',
-        'max_height' => 'Image exceeds maximum height',
-        'min_height' => 'Image requires a minimum height',
-        'abort' => 'File upload aborted',
-        'image_resize' => 'Failed to resize image'
-    );
 
     protected $image_objects = array();
 
-    function __construct($options = null, $initialize = true, $error_messages = null) {
+    private static $MIME_TYPES_PROCESSORS = array(
+        "image/gif"       => array("imagecreatefromgif", "imagegif"),
+        "image/jpg"       => array("imagecreatefromjpeg", "imagejpeg"),
+        "image/jpeg"      => array("imagecreatefromjpeg", "imagejpeg"),
+        "image/png"       => array("imagecreatefrompng", "imagepng"),
+        "image/bmp"       => array("imagecreatefromwbmp", "imagewbmp")
+    );
+
+    public function __construct($options = null, $initialize = true, $error_messages = null) {
+
+        $this->post_max_size = (defined('SMARTEDITOR_UPLOAD_SIZE_LIMIT') && SMARTEDITOR_UPLOAD_SIZE_LIMIT) ? SMARTEDITOR_UPLOAD_SIZE_LIMIT.'M' : ini_get('post_max_size');
+
+        // PHP File Upload error message codes:
+        // http://php.net/manual/en/features.file-upload.errors.php
+        $this->error_messages = array(
+            1 => 'The uploaded file exceeds the upload_max_filesize',
+            2 => 'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form',
+            3 => 'The uploaded file was only partially uploaded',
+            4 => 'No file was uploaded',
+            6 => 'Missing a temporary folder',
+            7 => 'Failed to write file to disk',
+            8 => 'A PHP extension stopped the file upload',
+            'post_max_size' => 'The uploaded file exceeds the post_max_size',
+            'max_file_size' => 'File is too big',
+            'min_file_size' => 'File is too small',
+            'accept_file_types' => 'Filetype not allowed',
+            'max_number_of_files' => 'Maximum number of files exceeded',
+            'max_width' => 'Image exceeds maximum width',
+            'min_width' => 'Image requires a minimum width',
+            'max_height' => 'Image exceeds maximum height',
+            'min_height' => 'Image requires a minimum height',
+            'abort' => 'File upload aborted',
+            'image_resize' => 'Failed to resize image'
+        );
+
         $this->options = array(
             'script_url' => $this->get_full_url().'/',
             'upload_dir' => dirname($this->get_server_var('SCRIPT_FILENAME')).'/files/',
@@ -90,6 +105,10 @@ class UploadHandler
             'max_number_of_files' => null,
             // Defines which files are handled as image files:
             'image_file_types' => '/\.(gif|jpe?g|bmp|png)$/i',
+            'is_resize' => (defined('SMARTEDITOR_UPLOAD_RESIZE') && SMARTEDITOR_UPLOAD_RESIZE) ? true : false,
+            'resize_max_width' => (defined('SMARTEDITOR_UPLOAD_MAX_WIDTH') && SMARTEDITOR_UPLOAD_MAX_WIDTH) ? SMARTEDITOR_UPLOAD_MAX_WIDTH : 800,
+            'resize_max_height' => (defined('SMARTEDITOR_UPLOAD_MAX_HEIGHT') && SMARTEDITOR_UPLOAD_MAX_HEIGHT) ? SMARTEDITOR_UPLOAD_MAX_HEIGHT : 800,
+            'resize_jpeg_compress' => (defined('SMARTEDITOR_UPLOAD_IMAGE_QUALITY') && SMARTEDITOR_UPLOAD_IMAGE_QUALITY) ? SMARTEDITOR_UPLOAD_IMAGE_QUALITY : 800,
             // Image resolution restrictions:
             'max_width' => null,
             'max_height' => null,
@@ -362,7 +381,8 @@ class UploadHandler
         $content_length = $this->fix_integer_overflow(intval(
             $this->get_server_var('CONTENT_LENGTH')
         ));
-        $post_max_size = $this->get_config_bytes(ini_get('post_max_size'));
+        $post_max_size = $this->get_config_bytes($this->post_max_size);
+
         if ($post_max_size && ($content_length > $post_max_size)) {
             $file->error = $this->get_error_message('post_max_size');
             return false;
@@ -1038,6 +1058,48 @@ class UploadHandler
         return $tmp_name;
     }
 
+    protected function reprocessImage($file_path, $callback)
+    {
+        // Extracting mime type using getimagesize
+        try {
+            $image_info = getimagesize($file_path);
+            if ($image_info === null) {
+              //throw new Exception("Invalid image type");
+              return false;
+            }
+
+            $mime_type = $image_info["mime"];
+
+            if (!array_key_exists($mime_type, self::$MIME_TYPES_PROCESSORS)) {
+              //throw new Exception("Invalid image MIME type");
+              return false;
+            }
+
+            $image_from_file = self::$MIME_TYPES_PROCESSORS[$mime_type][0];
+            $image_to_file = self::$MIME_TYPES_PROCESSORS[$mime_type][1];
+
+            $reprocessed_image = @$image_from_file($file_path);
+
+            if (!$reprocessed_image) {
+              //throw new Exception("Unable to create reprocessed image from file");
+              return false;
+            }
+
+            // Calling callback(if set) with path of image as a parameter
+            if ($callback !== null) {
+              $callback($reprocessed_image);
+            }
+
+            // Freeing up memory
+            imagedestroy($reprocessed_image);
+        } catch (Exception $e) {
+            unlink($file_path);
+            return false;
+        }
+
+        return true;
+    }
+
     protected function handle_file_upload($uploaded_file, $name, $size, $type, $error,
             $index = null, $content_range = null) {
         $file = new \stdClass();
@@ -1050,6 +1112,12 @@ class UploadHandler
         //$file->name = iconv('UTF-8', 'UTF-8//IGNORE', utf8_encode($file->name));
         $file->size = $this->fix_integer_overflow(intval($size));
         $file->type = $type;
+
+        if ( SMARTEDITOR_UPLOAD_IMG_CHECK && ! $this->reprocessImage($uploaded_file, null) ){
+            $file->error = $this->get_error_message('accept_file_types');
+            return $file;
+        }
+
         if ($this->validate($uploaded_file, $file, $error, $index)) {
             $this->handle_form_data($file, $index);
             $upload_dir = $this->get_upload_path();
@@ -1079,10 +1147,32 @@ class UploadHandler
                 );
             }
             $file_size = $this->get_file_size($file_path, $append_file);
+
+            try {
+                if(defined('G5_FILE_PERMISSION')) chmod($file_path, G5_FILE_PERMISSION);
+            } catch (Exception $e) {
+            }
+
             if ($file_size === $file->size) {
                 $file->url = $this->get_download_url($file->name);
                 if ($this->is_valid_image_file($file_path)) {
                     $this->handle_image_file($file_path, $file);
+
+                    $this->files[] = $file->name;
+
+                    if( $this->options['is_resize'] ){
+                        $resize_options = array(
+                            'max_width'=>$this->options['resize_max_width'],
+                            'max_height'=>$this->options['resize_max_height'],
+                            'jpeg_quality'=>$this->options['resize_jpeg_compress'],
+                            'auto_orient' => true,
+                            );
+
+                        if ($this->create_scaled_image($file->name, '', $resize_options)) {
+                            $file->size = $this->get_file_size($file_path, true);
+                        }
+                    }
+
                     $image_width_height = $this->get_image_size($file_path);
                     $file->width = $image_width_height[0];
                     $file->height = $image_width_height[1];
@@ -1099,6 +1189,7 @@ class UploadHandler
             }
             $this->set_additional_file_properties($file);
         }
+
         return $file;
     }
 
@@ -1365,4 +1456,4 @@ class UploadHandler
         return $this->generate_response($response, $print_response);
     }
 
-}
+}

plugin/htmlpurifier/HTMLPurifier.standalone.php

@@ -7,7 +7,7 @@
  * primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS
  * FILE, changes will be overwritten the next time the script is run.
  *
- * @version 4.7.0
+ * @version 4.8.0
  *
  * @warning
  *      You must *not* include any other HTML Purifier files before this file,
@@ -39,7 +39,7 @@
  */
 
 /*
-    HTML Purifier 4.7.0 - Standards Compliant HTML Filtering
+    HTML Purifier 4.8.0 - Standards Compliant HTML Filtering
     Copyright (C) 2006-2008 Edward Z. Yang
 
     This library is free software; you can redistribute it and/or
@@ -78,12 +78,12 @@ class HTMLPurifier
      * Version of HTML Purifier.
      * @type string
      */
-    public $version = '4.7.0';
+    public $version = '4.8.0';
 
     /**
      * Constant with version of HTML Purifier.
      */
-    const VERSION = '4.7.0';
+    const VERSION = '4.8.0';
 
     /**
      * Global configuration object.
@@ -124,7 +124,7 @@ class HTMLPurifier
     /**
      * Initializes the purifier.
      *
-     * @param HTMLPurifier_Config $config Optional HTMLPurifier_Config object
+     * @param HTMLPurifier_Config|mixed $config Optional HTMLPurifier_Config object
      *                for all instances of the purifier, if omitted, a default
      *                configuration is supplied (which can be overridden on a
      *                per-use basis).
@@ -406,6 +406,11 @@ class HTMLPurifier_AttrCollections
      * @param HTMLPurifier_HTMLModule[] $modules Hash array of HTMLPurifier_HTMLModule members
      */
     public function __construct($attr_types, $modules)
+    {
+        $this->doConstruct($attr_types, $modules);
+    }
+
+    public function doConstruct($attr_types, $modules)
     {
         // load extensions from the modules
         foreach ($modules as $module) {
@@ -1557,6 +1562,19 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
         );
         $this->info['page-break-inside'] = new HTMLPurifier_AttrDef_Enum(array('auto', 'avoid'));
 
+        $border_radius = new HTMLPurifier_AttrDef_CSS_Composite(
+            array(
+                new HTMLPurifier_AttrDef_CSS_Percentage(true), // disallow negative
+                new HTMLPurifier_AttrDef_CSS_Length('0') // disallow negative
+            ));
+
+        $this->info['border-top-left-radius'] =
+        $this->info['border-top-right-radius'] =
+        $this->info['border-bottom-right-radius'] =
+        $this->info['border-bottom-left-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 2);
+        // TODO: support SLASH syntax
+        $this->info['border-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 4);
+
     }
 
     /**
@@ -1736,7 +1754,7 @@ class HTMLPurifier_Config
      * HTML Purifier's version
      * @type string
      */
-    public $version = '4.7.0';
+    public $version = '4.8.0';
 
     /**
      * Whether or not to automatically finalize
@@ -3198,7 +3216,7 @@ abstract class HTMLPurifier_DefinitionCache
 
     /**
      * Clears all expired (older version or revision) objects from cache
-     * @note Be carefuly implementing this method as flush. Flush must
+     * @note Be careful implementing this method as flush. Flush must
      *       not interfere with other Definition types, and cleanup()
      *       should not be repeatedly called by userland code.
      * @param HTMLPurifier_Config $config
@@ -6293,6 +6311,11 @@ class HTMLPurifier_HTMLModuleManager
         if ($config->get('HTML.TargetBlank')) {
             $modules[] = 'TargetBlank';
         }
+        // NB: HTML.TargetNoreferrer must be AFTER HTML.TargetBlank
+        // so that its post-attr-transform gets run afterwards.
+        if ($config->get('HTML.TargetNoreferrer')) {
+            $modules[] = 'TargetNoreferrer';
+        }
 
         // merge in custom modules
         $modules = array_merge($modules, $this->userModules);
@@ -7743,12 +7766,17 @@ class HTMLPurifier_Lexer
     public function extractBody($html)
     {
         $matches = array();
-        $result = preg_match('!<body[^>]*>(.*)</body>!is', $html, $matches);
+        $result = preg_match('|(.*?)<body[^>]*>(.*)</body>|is', $html, $matches);
         if ($result) {
-            return $matches[1];
+            // Make sure it's not in a comment
-        } else {
+            $comment_start = strrpos($matches[1], '<!--');
-            return $html;
+            $comment_end   = strrpos($matches[1], '-->');
+            if ($comment_start === false ||
+                ($comment_end !== false && $comment_end > $comment_start)) {
+                return $matches[2];
+            }
         }
+        return $html;
     }
 }
 
@@ -10073,6 +10101,7 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
         $css = $this->parseCDATA($css);
 
         $definition = $config->getCSSDefinition();
+        $allow_duplicates = $config->get("CSS.AllowDuplicates");
 
         // we're going to break the spec and explode by semicolons.
         // This is because semicolon rarely appears in escaped form
@@ -10082,6 +10111,7 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
 
         $declarations = explode(';', $css);
         $propvalues = array();
+        $new_declarations = '';
 
         /**
          * Name of the current CSS property being validated.
@@ -10131,7 +10161,11 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
             if ($result === false) {
                 continue;
             }
-            $propvalues[$property] = $result;
+            if ($allow_duplicates) {
+                $new_declarations .= "$property:$result;";
+            } else {
+                $propvalues[$property] = $result;
+            }
         }
 
         $context->destroy('CurrentCSSProperty');
@@ -10140,7 +10174,6 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
         // slightly inefficient, but it's the only way of getting rid of
         // duplicates. Perhaps config to optimize it, but not now.
 
-        $new_declarations = '';
         foreach ($propvalues as $prop => $value) {
             $new_declarations .= "$prop:$value;";
         }
@@ -12251,6 +12284,9 @@ class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI
             return false;
         }
         $uri_string = substr($uri_string, 4);
+        if (strlen($uri_string) == 0) {
+            return false;
+        }
         $new_length = strlen($uri_string) - 1;
         if ($uri_string[$new_length] != ')') {
             return false;
@@ -12625,18 +12661,26 @@ class HTMLPurifier_AttrDef_HTML_ID extends HTMLPurifier_AttrDef
 
         // we purposely avoid using regex, hopefully this is faster
 
-        if (ctype_alpha($id)) {
+        if ($config->get('Attr.ID.HTML5') === true) {
-            $result = true;
+            if (preg_match('/[\t\n\x0b\x0c ]/', $id)) {
-        } else {
-            if (!ctype_alpha(@$id[0])) {
                 return false;
             }
-            // primitive style of regexps, I suppose
+        } else {
-            $trim = trim(
+            if (ctype_alpha($id)) {
-                $id,
+                // OK
-                'A..Za..z0..9:-._'
+            } else {
-            );
+                if (!ctype_alpha(@$id[0])) {
-            $result = ($trim === '');
+                    return false;
+                }
+                // primitive style of regexps, I suppose
+                $trim = trim(
+                    $id,
+                    'A..Za..z0..9:-._'
+                );
+                if ($trim !== '') {
+                    return false;
+                }
+            }
         }
 
         $regexp = $config->get('Attr.IDBlacklistRegexp');
@@ -12644,14 +12688,14 @@ class HTMLPurifier_AttrDef_HTML_ID extends HTMLPurifier_AttrDef
             return false;
         }
 
-        if (!$this->selector && $result) {
+        if (!$this->selector) {
             $id_accumulator->add($id);
         }
 
         // if no change was made to the ID, return the result
         // else, return the new id if stripping whitespace made it
         //     valid, or return false.
-        return $result ? $id : false;
+        return $id;
     }
 }
 
@@ -13024,24 +13068,33 @@ class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef
         // fairly well supported.
         $underscore = $config->get('Core.AllowHostnameUnderscore') ? '_' : '';
 
+        // Based off of RFC 1738, but amended so that
+        // as per RFC 3696, the top label need only not be all numeric.
         // The productions describing this are:
         $a   = '[a-z]';     // alpha
         $an  = '[a-z0-9]';  // alphanum
         $and = "[a-z0-9-$underscore]"; // alphanum | "-"
         // domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum
-        $domainlabel = "$an($and*$an)?";
+        $domainlabel = "$an(?:$and*$an)?";
-        // toplabel    = alpha | alpha *( alphanum | "-" ) alphanum
+        // AMENDED as per RFC 3696
-        $toplabel = "$a($and*$an)?";
+        // toplabel    = alphanum | alphanum *( alphanum | "-" ) alphanum
+        //      side condition: not all numeric
+        $toplabel = "$an(?:$and*$an)?";
         // hostname    = *( domainlabel "." ) toplabel [ "." ]
-        if (preg_match("/^($domainlabel\.)*$toplabel\.?$/i", $string)) {
+        if (preg_match("/^(?:$domainlabel\.)*($toplabel)\.?$/i", $string, $matches)) {
-            return $string;
+            if (!ctype_digit($matches[1])) {
+                return $string;
+            }
         }
 
+        // PHP 5.3 and later support this functionality natively
+        if (function_exists('idn_to_ascii')) {
+            return idn_to_ascii($string);
+
         // If we have Net_IDNA2 support, we can support IRIs by
         // punycoding them. (This is the most portable thing to do,
         // since otherwise we have to assume browsers support
-
+        } elseif ($config->get('Core.EnableIDNA')) {
-        if ($config->get('Core.EnableIDNA')) {
             $idna = new Net_IDNA2(array('encoding' => 'utf8', 'overlong' => false, 'strict' => true));
             // we need to encode each period separately
             $parts = explode('.', $string);
@@ -13505,8 +13558,7 @@ class HTMLPurifier_AttrTransform_ImgRequired extends HTMLPurifier_AttrTransform
             if ($src) {
                 $alt = $config->get('Attr.DefaultImageAlt');
                 if ($alt === null) {
-                    // truncate if the alt is too long
+                    $attr['alt'] = basename($attr['src']);
-                    $attr['alt'] = substr(basename($attr['src']), 0, 40);
                 } else {
                     $attr['alt'] = $alt;
                 }
@@ -14053,6 +14105,44 @@ class HTMLPurifier_AttrTransform_TargetBlank extends HTMLPurifier_AttrTransform
 
 
 
+// must be called POST validation
+
+/**
+ * Adds rel="noreferrer" to any links which target a different window
+ * than the current one.  This is used to prevent malicious websites
+ * from silently replacing the original window, which could be used
+ * to do phishing.
+ * This transform is controlled by %HTML.TargetNoreferrer.
+ */
+class HTMLPurifier_AttrTransform_TargetNoreferrer extends HTMLPurifier_AttrTransform
+{
+    /**
+     * @param array $attr
+     * @param HTMLPurifier_Config $config
+     * @param HTMLPurifier_Context $context
+     * @return array
+     */
+    public function transform($attr, $config, $context)
+    {
+        if (isset($attr['rel'])) {
+            $rels = explode(' ', $attr['rel']);
+        } else {
+            $rels = array();
+        }
+        if (isset($attr['target']) && !in_array('noreferrer', $rels)) {
+            $rels[] = 'noreferrer';
+        }
+        if (!empty($rels) || isset($attr['rel'])) {
+            $attr['rel'] = implode(' ', $rels);
+        }
+
+        return $attr;
+    }
+}
+
+
+
+
 /**
  * Sets height/width defaults for <textarea>
  */
@@ -14329,6 +14419,12 @@ class HTMLPurifier_ChildDef_List extends HTMLPurifier_ChildDef
             return false;
         }
 
+        // if li is not allowed, delete parent node
+        if (!isset($config->getHTMLDefinition()->info['li'])) {
+            trigger_error("Cannot allow ul/ol without allowing li", E_USER_WARNING);
+            return false;
+        }
+
         // the new set of children
         $result = array();
 
@@ -15166,6 +15262,12 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
         }
         $dir = $this->generateDirectoryPath($config);
         $dh = opendir($dir);
+        // Apparently, on some versions of PHP, readdir will return
+        // an empty string if you pass an invalid argument to readdir.
+        // So you need this test.  See #49.
+        if (false === $dh) {
+            return false;
+        }
         while (false !== ($filename = readdir($dh))) {
             if (empty($filename)) {
                 continue;
@@ -15175,6 +15277,7 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
             }
             unlink($dir . '/' . $filename);
         }
+        return true;
     }
 
     /**
@@ -15188,6 +15291,10 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
         }
         $dir = $this->generateDirectoryPath($config);
         $dh = opendir($dir);
+        // See #49 (and above).
+        if (false === $dh) {
+            return false;
+        }
         while (false !== ($filename = readdir($dh))) {
             if (empty($filename)) {
                 continue;
@@ -15200,6 +15307,7 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
                 unlink($dir . '/' . $filename);
             }
         }
+        return true;
     }
 
     /**
@@ -15255,11 +15363,12 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
         if ($result !== false) {
             // set permissions of the new file (no execute)
             $chmod = $config->get('Cache.SerializerPermissions');
-            if (!$chmod) {
+            if ($chmod === null) {
-                $chmod = 0644; // invalid config or simpletest
+                // don't do anything
+            } else {
+                $chmod = $chmod & 0666;
+                chmod($file, $chmod);
             }
-            $chmod = $chmod & 0666;
-            chmod($file, $chmod);
         }
         return $result;
     }
@@ -15273,9 +15382,6 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
     {
         $directory = $this->generateDirectoryPath($config);
         $chmod = $config->get('Cache.SerializerPermissions');
-        if (!$chmod) {
-            $chmod = 0755; // invalid config or simpletest
-        }
         if (!is_dir($directory)) {
             $base = $this->generateBaseDirectoryPath($config);
             if (!is_dir($base)) {
@@ -15288,7 +15394,19 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
             } elseif (!$this->_testPermissions($base, $chmod)) {
                 return false;
             }
-            mkdir($directory, $chmod);
+            if ($chmod === null) {
+                trigger_error(
+                    'Base directory ' . $base . ' does not exist,
+                    please create or change using %Cache.SerializerPath',
+                    E_USER_WARNING
+                );
+                return false;
+            }
+            if ($chmod !== null) {
+                mkdir($directory, $chmod);
+            } else {
+                mkdir($directory);
+            }
             if (!$this->_testPermissions($directory, $chmod)) {
                 trigger_error(
                     'Base directory ' . $base . ' does not exist,
@@ -15325,7 +15443,7 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
             );
             return false;
         }
-        if (function_exists('posix_getuid')) {
+        if (function_exists('posix_getuid') && $chmod !== null) {
             // POSIX system, we can give more specific advice
             if (fileowner($dir) === posix_getuid()) {
                 // we can chmod it ourselves
@@ -16873,6 +16991,28 @@ class HTMLPurifier_HTMLModule_TargetBlank extends HTMLPurifier_HTMLModule
 
 
 
+/**
+ * Module adds the target-based noreferrer attribute transformation to a tags.  It
+ * is enabled by HTML.TargetNoreferrer
+ */
+class HTMLPurifier_HTMLModule_TargetNoreferrer extends HTMLPurifier_HTMLModule
+{
+    /**
+     * @type string
+     */
+    public $name = 'TargetNoreferrer';
+
+    /**
+     * @param HTMLPurifier_Config $config
+     */
+    public function setup($config) {
+        $a = $this->addBlankElement('a');
+        $a->attr_transform_post[] = new HTMLPurifier_AttrTransform_TargetNoreferrer();
+    }
+}
+
+
+
 /**
  * XHTML 1.1 Text Module, defines basic text containers. Core Module.
  * @note In the normative XML Schema specification, this module
@@ -17979,9 +18119,14 @@ class HTMLPurifier_Injector_Linkify extends HTMLPurifier_Injector
             return;
         }
 
-        // there is/are URL(s). Let's split the string:
+        // there is/are URL(s). Let's split the string.
-        // Note: this regex is extremely permissive
+        // We use this regex:
-        $bits = preg_split('#((?:https?|ftp)://[^\s\'",<>()]+)#Su', $token->data, -1, PREG_SPLIT_DELIM_CAPTURE);
+        // https://gist.github.com/gruber/249502
+        // but with @cscott's backtracking fix and also
+        // the Unicode characters un-Unicodified.
+        $bits = preg_split(
+            '/\\b((?:[a-z][\\w\\-]+:(?:\\/{1,3}|[a-z0-9%])|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}\\/)(?:[^\\s()<>]|\\((?:[^\\s()<>]|(?:\\([^\\s()<>]+\\)))*\\))+(?:\\((?:[^\\s()<>]|(?:\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:\'".,<>?\x{00ab}\x{00bb}\x{201c}\x{201d}\x{2018}\x{2019}]))/iu',
+            $token->data, -1, PREG_SPLIT_DELIM_CAPTURE);
 
 
         $token = array();
@@ -18126,6 +18271,12 @@ class HTMLPurifier_Injector_RemoveEmpty extends HTMLPurifier_Injector
         $this->removeNbsp = $config->get('AutoFormat.RemoveEmpty.RemoveNbsp');
         $this->removeNbspExceptions = $config->get('AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions');
         $this->exclude = $config->get('AutoFormat.RemoveEmpty.Predicate');
+        foreach ($this->exclude as $key => $attrs) {
+            if (!is_array($attrs)) {
+                // HACK, see HTMLPurifier/Printer/ConfigForm.php
+                $this->exclude[$key] = explode(';', $attrs);
+            }
+        }
         $this->attrValidator = new HTMLPurifier_AttrValidator();
     }
 
@@ -18308,6 +18459,7 @@ class HTMLPurifier_Injector_SafeObject extends HTMLPurifier_Injector
     );
 
     /**
+     * These are all lower-case keys.
      * @type array
      */
     protected $allowedParam = array(
@@ -18315,7 +18467,7 @@ class HTMLPurifier_Injector_SafeObject extends HTMLPurifier_Injector
         'movie' => true,
         'flashvars' => true,
         'src' => true,
-        'allowFullScreen' => true, // if omitted, assume to be 'false'
+        'allowfullscreen' => true, // if omitted, assume to be 'false'
     );
 
     /**
@@ -18365,9 +18517,11 @@ class HTMLPurifier_Injector_SafeObject extends HTMLPurifier_Injector
                     $token->attr['name'] === $this->addParam[$n]) {
                     // keep token, and add to param stack
                     $this->paramStack[$i][$n] = true;
-                } elseif (isset($this->allowedParam[$n])) {
+                } elseif (isset($this->allowedParam[strtolower($n)])) {
                     // keep token, don't do anything to it
                     // (could possibly check for duplicates here)
+                    // Note: In principle, parameters should be case sensitive.
+                    // But it seems they are not really; so accept any case.
                 } else {
                     $token = false;
                 }
@@ -21400,9 +21554,18 @@ class HTMLPurifier_URIScheme_data extends HTMLPurifier_URIScheme
         } else {
             $raw_data = $data;
         }
+        if ( strlen($raw_data) < 12 ) {
+            // error; exif_imagetype throws exception with small files,
+            // and this likely indicates a corrupt URI/failed parse anyway
+            return false;
+        }
         // XXX probably want to refactor this into a general mechanism
         // for filtering arbitrary content types
-        $file = tempnam("/tmp", "");
+        if (function_exists('sys_get_temp_dir')) {
+            $file = tempnam(sys_get_temp_dir(), "");
+        } else {
+            $file = tempnam("/tmp", "");
+        }
         file_put_contents($file, $raw_data);
         if (function_exists('exif_imagetype')) {
             $image_code = exif_imagetype($file);
@@ -21719,6 +21882,53 @@ class HTMLPurifier_URIScheme_nntp extends HTMLPurifier_URIScheme
 
 
 
+/**
+ * Validates tel (for phone numbers).
+ *
+ * The relevant specifications for this protocol are RFC 3966 and RFC 5341,
+ * but this class takes a much simpler approach: we normalize phone
+ * numbers so that they only include (possibly) a leading plus,
+ * and then any number of digits and x'es.
+ */
+
+class HTMLPurifier_URIScheme_tel extends HTMLPurifier_URIScheme
+{
+    /**
+     * @type bool
+     */
+    public $browsable = false;
+
+    /**
+     * @type bool
+     */
+    public $may_omit_host = true;
+
+    /**
+     * @param HTMLPurifier_URI $uri
+     * @param HTMLPurifier_Config $config
+     * @param HTMLPurifier_Context $context
+     * @return bool
+     */
+    public function doValidate(&$uri, $config, $context)
+    {
+        $uri->userinfo = null;
+        $uri->host     = null;
+        $uri->port     = null;
+
+        // Delete all non-numeric characters, non-x characters
+        // from phone number, EXCEPT for a leading plus sign.
+        $uri->path = preg_replace('/(?!^\+)[^\dx]/', '',
+                     // Normalize e(x)tension to lower-case
+                     str_replace('X', 'x', $uri->path));
+
+        return true;
+    }
+}
+
+
+
+
+
 /**
  * Performs safe variable parsing based on types which can be used by
  * users. This may not be able to represent all possible data inputs,

plugin/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/Attr.ID.HTML5.txt

@@ -0,0 +1,10 @@
+Attr.ID.HTML5
+TYPE: bool/null
+DEFAULT: null
+VERSION: 4.8.0
+--DESCRIPTION--
+In HTML5, restrictions on the format of the id attribute have been significantly
+relaxed, such that any string is valid so long as it contains no spaces and
+is at least one character.  In lieu of a general HTML5 compatibility flag,
+set this configuration directive to true to use the relaxed rules.
+--# vim: et sw=4 sts=4

plugin/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowDuplicates.txt

@@ -0,0 +1,11 @@
+CSS.AllowDuplicates
+TYPE: bool
+DEFAULT: false
+VERSION: 4.8.0
+--DESCRIPTION--
+<p>
+  By default, HTML Purifier removes duplicate CSS properties,
+  like <code>color:red; color:blue</code>.  If this is set to
+  true, duplicate properties are allowed.
+</p>
+--# vim: et sw=4 sts=4

plugin/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt

@@ -1,5 +1,5 @@
 Cache.SerializerPermissions
-TYPE: int
+TYPE: int/null
 VERSION: 4.3.0
 DEFAULT: 0755
 --DESCRIPTION--
@@ -8,4 +8,9 @@ DEFAULT: 0755
     Directory permissions of the files and directories created inside
     the DefinitionCache/Serializer or other custom serializer path.
 </p>
+<p>
+    In HTML Purifier 4.8.0, this also supports <code>NULL</code>,
+    which means that no chmod'ing or directory creation shall
+    occur.
+</p>
 --# vim: et sw=4 sts=4

plugin/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt

@@ -0,0 +1,9 @@
+HTML.TargetNoreferrer
+TYPE: bool
+VERSION: 4.8.0
+DEFAULT: TRUE
+--DESCRIPTION--
+If enabled, noreferrer rel attributes are added to links which have
+a target attribute associated with them.  This prevents malicious
+destinations from overwriting the original window.
+--# vim: et sw=4 sts=4

plugin/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt

@@ -8,6 +8,7 @@ array (
   'ftp' => true,
   'nntp' => true,
   'news' => true,
+  'tel' => true,
 )
 --DESCRIPTION--
 Whitelist that defines the schemes that a URI is allowed to have.  This

plugin/htmlpurifier/standalone/HTMLPurifier/Printer/ConfigForm.php

@@ -327,6 +327,10 @@ class HTMLPurifier_Printer_ConfigForm_default extends HTMLPurifier_Printer
                 case HTMLPurifier_VarParser::HASH:
                     $nvalue = '';
                     foreach ($value as $i => $v) {
+                        if (is_array($v)) {
+                            // HACK
+                            $v = implode(";", $v);
+                        }
                         $nvalue .= "$i:$v" . PHP_EOL;
                     }
                     $value = $nvalue;

plugin/kcpcert/kcpcert_form.php

@@ -41,7 +41,17 @@ $up_hash = $ct_cert->make_hash_data( $home_dir, $hash_data );
 $ct_cert->mf_clear();
 ?>
 
-<form name="form_auth" method="post" target="auth_popup" action="<?php echo $cert_url ?>">
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<?php if(is_mobile()) { ?>
+<meta name="viewport" content="user-scalable=yes, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, width=device-width, target-densitydpi=medium-dpi" >
+<?php } ?>
+</head>
+
+<body oncontextmenu="return false;" ondragstart="return false;" onselectstart="return false;">
+<form name="form_auth" method="post" action="<?php echo $cert_url ?>">
 <!-- 유저네임 -->
 <input type="hidden" name="user_name"    value="" />
 <!-- 주문번호 -->
@@ -67,6 +77,11 @@ $ct_cert->mf_clear();
 <!-- cert_enc_use 필수 (고정값 : 메뉴얼 참고) -->
 <input type="hidden" name="cert_enc_use" value="Y"/>
 
+<?php if(is_mobile()) { ?>
+<!-- cert_able_yn input 비활성화 설정 -->
+<input type="hidden" name="cert_able_yn" value=""/>
+<?php } ?>
+
 <input type="hidden" name="res_cd"       value=""/>
 <input type="hidden" name="res_msg"      value=""/>
 
@@ -82,5 +97,53 @@ $ct_cert->mf_clear();
 </form>
 
 <script>
-document.form_auth.submit();
+window.onload = function() {
-</script>
+    cert_page();
+}
+
+// 인증 요청 시 호출 함수
+function cert_page()
+{
+    var frm = document.form_auth;
+
+    if ( ( frm.req_tx.value == "auth" || frm.req_tx.value == "otp_auth" ) )
+    {
+        frm.action="./kcpcert_result.php";
+
+       // MOBILE
+        if( ( navigator.userAgent.indexOf("Android") > - 1 || navigator.userAgent.indexOf("iPhone") > - 1 ) )
+        {
+            self.name="kcp_cert";
+        }
+        // PC
+        else
+        {
+            frm.target="kcp_cert";
+        }
+
+        frm.submit();
+
+        window.close();
+    }
+
+    else if ( frm.req_tx.value == "cert" )
+    {
+        if( ( navigator.userAgent.indexOf("Android") > - 1 || navigator.userAgent.indexOf("iPhone") > - 1 ) ) // 스마트폰인 경우
+        {
+            window.parent.$("input[name=veri_up_hash]").val(frm.up_hash.value); // up_hash 데이터 검증을 위한 필드
+            self.name="auth_popup";
+        }
+        else // 스마트폰 아닐때
+        {
+            window.opener.$("input[name=veri_up_hash]").val(frm.up_hash.value); // up_hash 데이터 검증을 위한 필드
+            frm.target = "auth_popup";
+        }
+
+        frm.action="<?php echo $cert_url; ?>";
+        frm.submit();
+    }
+}
+</script>
+
+</body>
+</html>

plugin/kcpcert/kcpcert_result.php

@@ -180,9 +180,26 @@ else if( $cert_enc_use != "Y" )
 $ct_cert->mf_clear();
 ?>
 
+<form name="form_auth" method="post">
+    <?php echo $sbParam; ?>
+</form>
+
 <script>
 $(function() {
-    var $opener = window.opener;
+    var $opener;
+    var is_mobile = false;
+
+    if( ( navigator.userAgent.indexOf("Android") > - 1 || navigator.userAgent.indexOf("iPhone") > - 1 ) ) { // 스마트폰인 경우
+        $opener = window.parent;
+        is_mobile = true;
+    } else {
+        $opener = window.opener;
+    }
+
+    // up_hash 검증
+    if( document.form_auth.up_hash.value != $opener.$("input[name=veri_up_hash]").val() ) {
+        alert("up_hash 변조 위험있음");
+    }
 
     // 인증정보
     $opener.$("input[name=cert_type]").val("<?php echo $cert_type; ?>");
@@ -190,7 +207,13 @@ $(function() {
     $opener.$("input[name=mb_hp]").val("<?php echo $phone_no; ?>").attr("readonly", true);
     $opener.$("input[name=cert_no]").val("<?php echo $md5_cert_no; ?>");
 
+    if(is_mobile) {
+        $opener.$("#cert_info").css("display", "");
+        $opener.$("#kcp_cert" ).css("display", "none");
+    }
+
     alert("본인의 휴대폰번호로 확인 되었습니다.");
+
     window.close();
 });
 </script>

skin/board/basic/view_comment.skin.php

@@ -258,6 +258,8 @@ function fviewcomment_submit(f)
 
     <?php if($is_guest) echo chk_captcha_js();  ?>
 
+    set_comment_token(f);
+
     document.getElementById("btn_submit").disabled = "disabled";
 
     return true;

skin/board/gallery/view_comment.skin.php

@@ -258,6 +258,8 @@ function fviewcomment_submit(f)
 
     <?php if($is_guest) echo chk_captcha_js();  ?>
 
+    set_comment_token(f);
+
     document.getElementById("btn_submit").disabled = "disabled";
 
     return true;

skin/member/basic/register_form.skin.php

@@ -10,7 +10,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
 
     <script src="<?php echo G5_JS_URL ?>/jquery.register_form.js"></script>
     <?php if($config['cf_cert_use'] && ($config['cf_cert_ipin'] || $config['cf_cert_hp'])) { ?>
-    <script src="<?php echo G5_JS_URL ?>/certify.js"></script>
+    <script src="<?php echo G5_JS_URL ?>/certify.js?v=<?php echo G5_JS_VER; ?>"></script>
     <?php } ?>
 
     <form id="fregisterform" name="fregisterform" action="<?php echo $register_action_url ?>" onsubmit="return fregisterform_submit(this);" method="post" enctype="multipart/form-data" autocomplete="off">

tail.php

@@ -29,7 +29,7 @@ if (G5_IS_MOBILE) {
     <div id="ft_copy">
         <div>
             <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=company">회사소개</a>
-            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=privacy">개인정보취급방침</a>
+            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=privacy">개인정보처리방침</a>
             <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=provision">서비스이용약관</a>
             Copyright &copy; <b>소유하신 도메인.</b> All rights reserved.<br>
             <a href="#hd" id="ft_totop">상단으로</a>

theme/basic/head.sub.php

@@ -46,7 +46,7 @@ if($config['cf_add_meta'])
     echo $config['cf_add_meta'].PHP_EOL;
 ?>
 <title><?php echo $g5_head_title; ?></title>
-<link rel="stylesheet" href="<?php echo G5_THEME_CSS_URL; ?>/<?php echo G5_IS_MOBILE ? 'mobile' : 'default'; ?>.css">
+<link rel="stylesheet" href="<?php echo G5_THEME_CSS_URL; ?>/<?php echo G5_IS_MOBILE ? 'mobile' : 'default'; ?>.css?ver=<?php echo G5_CSS_VER; ?>">
 <!--[if lte IE 8]>
 <script src="<?php echo G5_JS_URL ?>/html5.js"></script>
 <![endif]-->
@@ -63,9 +63,9 @@ var g5_editor    = "<?php echo ($config['cf_editor'] && $board['bo_use_dhtml_edi
 var g5_cookie_domain = "<?php echo G5_COOKIE_DOMAIN ?>";
 </script>
 <script src="<?php echo G5_JS_URL ?>/jquery-1.8.3.min.js"></script>
-<script src="<?php echo G5_JS_URL ?>/jquery.menu.js"></script>
+<script src="<?php echo G5_JS_URL ?>/jquery.menu.js?ver=<?php echo G5_JS_VER; ?>"></script>
-<script src="<?php echo G5_JS_URL ?>/common.js"></script>
+<script src="<?php echo G5_JS_URL ?>/common.js?ver=<?php echo G5_JS_VER; ?>"></script>
-<script src="<?php echo G5_JS_URL ?>/wrest.js"></script>
+<script src="<?php echo G5_JS_URL ?>/wrest.js?ver=<?php echo G5_JS_VER; ?>"></script>
 <?php
 if(G5_IS_MOBILE) {
     echo '<script src="'.G5_JS_URL.'/modernizr.custom.70111.js"></script>'.PHP_EOL; // overflow scroll 감지

theme/basic/mobile/skin/board/basic/view_comment.skin.php

@@ -250,6 +250,8 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
 
         <?php if($is_guest) echo chk_captcha_js(); ?>
 
+        set_comment_token(f);
+
         document.getElementById("btn_submit").disabled = "disabled";
 
         return true;

theme/basic/mobile/skin/board/gallery/view_comment.skin.php

@@ -250,6 +250,8 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
 
         <?php if($is_guest) echo chk_captcha_js(); ?>
 
+        set_comment_token(f);
+
         document.getElementById("btn_submit").disabled = "disabled";
 
         return true;

theme/basic/mobile/skin/faq/basic/list.skin.php

@@ -77,7 +77,7 @@ if( count($faq_master_list) ){
 
 <?php
 // 하단 HTML
-echo '<div id="faq_thtml">'.conv_content($fm['fm_tail_html'], 1).'</div>';
+echo '<div id="faq_thtml">'.conv_content($fm['fm_mobile_tail_html'], 1).'</div>';
 ?>
 
 <div id="faq_sch">

theme/basic/mobile/skin/member/basic/register_form.skin.php

@@ -8,7 +8,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
 <div class="mbskin">
     <script src="<?php echo G5_JS_URL ?>/jquery.register_form.js"></script>
     <?php if($config['cf_cert_use'] && ($config['cf_cert_ipin'] || $config['cf_cert_hp'])) { ?>
-    <script src="<?php echo G5_JS_URL ?>/certify.js"></script>
+    <script src="<?php echo G5_JS_URL ?>/certify.js?v=<?php echo G5_JS_VER; ?>"></script>
     <?php } ?>
 
     <form name="fregisterform" id="fregisterform" action="<?php echo $register_action_url ?>" onsubmit="return fregisterform_submit(this);" method="post" enctype="multipart/form-data" autocomplete="off">
@@ -122,7 +122,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
         </tr>
         <?php } ?>
 
-        <?php if ($config['cf_use_hp']) {  ?>
+        <?php if ($config['cf_use_hp'] || $config['cf_cert_hp']) {  ?>
         <tr>
             <th scope="row"><label for="reg_mb_hp">휴대폰번호<?php if ($config['cf_req_hp']) { ?><strong class="sound_only">필수</strong><?php } ?></label></th>
             <td>

theme/basic/mobile/tail.php

@@ -16,7 +16,7 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
     <div id="ft_copy">
         <div id="ft_company">
             <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=company">회사소개</a>
-            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=privacy">개인정보취급방침</a>
+            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=privacy">개인정보처리방침</a>
             <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=provision">서비스이용약관</a>
         </div>
         Copyright &copy; <b>소유하신 도메인.</b> All rights reserved.<br>

theme/basic/skin/board/basic/view_comment.skin.php

@@ -258,6 +258,8 @@ function fviewcomment_submit(f)
 
     <?php if($is_guest) echo chk_captcha_js();  ?>
 
+    set_comment_token(f);
+
     document.getElementById("btn_submit").disabled = "disabled";
 
     return true;

theme/basic/skin/board/gallery/view_comment.skin.php

@@ -258,6 +258,8 @@ function fviewcomment_submit(f)
 
     <?php if($is_guest) echo chk_captcha_js();  ?>
 
+    set_comment_token(f);
+
     document.getElementById("btn_submit").disabled = "disabled";
 
     return true;

theme/basic/skin/member/basic/register_form.skin.php

@@ -10,7 +10,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
 
     <script src="<?php echo G5_JS_URL ?>/jquery.register_form.js"></script>
     <?php if($config['cf_cert_use'] && ($config['cf_cert_ipin'] || $config['cf_cert_hp'])) { ?>
-    <script src="<?php echo G5_JS_URL ?>/certify.js"></script>
+    <script src="<?php echo G5_JS_URL ?>/certify.js?v=<?php echo G5_JS_VER; ?>"></script>
     <?php } ?>
 
     <form id="fregisterform" name="fregisterform" action="<?php echo $register_action_url ?>" onsubmit="return fregisterform_submit(this);" method="post" enctype="multipart/form-data" autocomplete="off">

theme/basic/tail.php

@@ -24,7 +24,7 @@ if (G5_IS_MOBILE) {
     <div id="ft_copy">
         <div>
             <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=company">회사소개</a>
-            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=privacy">개인정보취급방침</a>
+            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=privacy">개인정보처리방침</a>
             <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=provision">서비스이용약관</a>
             Copyright &copy; <b>소유하신 도메인.</b> All rights reserved.<br>
             <a href="#hd" id="ft_totop">상단으로</a>