Merge branch 'master' of github.com:gnuboard/g5

empty_mb_name is a function checking name from user input form. But it
was not checked by empty_mb_name function. So I fix it.

.gitignore

@@ -6,7 +6,7 @@ sirgle/
 test.php
 *.key
 *.sh
-cheditor*/
+cheditor5.*/
 ckeditor*/
 log/
 g5_tree/

adm/_common.php

@@ -2,4 +2,8 @@
 define('G5_IS_ADMIN', true);
 include_once ('../common.php');
 include_once(G5_ADMIN_PATH.'/admin.lib.php');
+
+if( isset($token) ){
+    $token = @htmlspecialchars(strip_tags($token), ENT_QUOTES);
+}
 ?>

adm/admin.lib.php

@@ -176,7 +176,7 @@ function get_theme_config_value($dir, $key='*')
     $tconfig = array();
 
     $theme_config_file = G5_PATH.'/'.G5_THEME_DIR.'/'.$dir.'/theme.config.php';
-    if(is_file) {
+    if(is_file($theme_config_file)) {
         include($theme_config_file);
 
         if($key == '*') {
@@ -382,15 +382,24 @@ function admin_referer_check($return=false)
     }
 
     $p = @parse_url($referer);
+
     $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
+    $msg = '';
 
     if($host != $p['host']) {
         $msg = '올바른 방법으로 이용해 주십시오.';
+    }
 
-        if($return)
+    if( $p['path'] && ! preg_match( '/\/'.preg_quote(G5_ADMIN_DIR).'\//i', $p['path'] ) ){
+        $msg = '올바른 방법으로 이용해 주십시오';
+    }
+
+    if( $msg ){
+        if($return) {
             return $msg;
-        else
+        } else {
             alert($msg, G5_URL);
+        }
     }
 }
 

adm/admin.tail.php

@@ -1,5 +1,7 @@
 <?php
 if (!defined('_GNUBOARD_')) exit;
+
+$print_version = defined('G5_YOUNGCART_VER') ? 'YoungCart Version '.G5_YOUNGCART_VER : 'Version '.G5_GNUBOARD_VER;
 ?>
 
         <noscript>
@@ -14,7 +16,7 @@ if (!defined('_GNUBOARD_')) exit;
 
 <footer id="ft">
     <p>
-        Copyright &copy; <?php echo $_SERVER['HTTP_HOST']; ?>. All rights reserved.<br>
+        Copyright &copy; <?php echo $_SERVER['HTTP_HOST']; ?>. All rights reserved. <?php echo $print_version; ?><br>
         <a href="#">상단으로</a>
     </p>
 </footer>

adm/board_copy_update.php

@@ -2,6 +2,8 @@
 $sub_menu = '300100';
 include_once('./_common.php');
 
+check_demo();
+
 auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();

adm/board_form_update.php

@@ -21,7 +21,7 @@ if ($file = $_POST['bo_include_head']) {
     $purl = parse_url($file);
     $file = $purl['path'];
     if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
-        alert('상단 파일 경로가 php, html 파일이 아닙니다.');
+        alert('상단 파일 경로의 확장자는 php, html 만 허용합니다.');
     }
     $_POST['bo_include_head'] = $file;
 }
@@ -30,11 +30,19 @@ if ($file = $_POST['bo_include_tail']) {
     $purl = parse_url($file);
     $file = $purl['path'];
     if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
-        alert('하단 파일 경로가 php, html 파일이 아닙니다.');
+        alert('하단 파일 경로의 확장자는 php, html 만 허용합니다.');
     }
     $_POST['bo_include_tail'] = $file;
 }
 
+if(!is_include_path_check($_POST['bo_include_head'], 1)) {
+    alert('/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.');
+}
+
+if(!is_include_path_check($_POST['bo_include_tail'], 1)) {
+    alert('/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.');
+}
+
 $board_path = G5_DATA_PATH.'/file/'.$bo_table;
 
 // 게시판 디렉토리 생성

adm/board_list.php

@@ -63,7 +63,7 @@ $colspan = 15;
 
 <label for="sfl" class="sound_only">검색대상</label>
 <select name="sfl" id="sfl">
-    <option value="bo_table"<?php echo get_selected($_GET['sfl'], "bo_subject", true); ?>>TABLE</option>
+    <option value="bo_table"<?php echo get_selected($_GET['sfl'], "bo_table", true); ?>>TABLE</option>
     <option value="bo_subject"<?php echo get_selected($_GET['sfl'], "bo_subject"); ?>>제목</option>
     <option value="a.gr_id"<?php echo get_selected($_GET['sfl'], "a.gr_id"); ?>>그룹ID</option>
 </select>

adm/board_list_update.php

@@ -62,7 +62,10 @@ if ($_POST['act_button'] == "선택수정") {
 
         // include 전에 $bo_table 값을 반드시 넘겨야 함
         $tmp_bo_table = trim($_POST['board_table'][$k]);
-        include ('./board_delete.inc.php');
+
+        if( preg_match("/^[A-Za-z0-9_]+$/", $tmp_bo_table) ){
+            include ('./board_delete.inc.php');
+        }
     }
 
 

adm/config_form.php

@@ -1099,7 +1099,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
             <th scope="row">충전 잔액</th>
             <td colspan="3">
                 <?php echo number_format($userinfo['coin']); ?> 원.
-                <a href="http://www.icodekorea.com/smsbiz/credit_card_amt.php?icode_id=<?php echo $config['cf_icode_id']; ?>&amp;icode_passwd=<?php echo $config['cf_icode_pw']; ?>" target="_blank" class="btn_frmline" onclick="window.open(this.href,'icode_payment', 'scrollbars=1,resizable=1'); return false;">충전하기</a>
+                <a href="http://www.icodekorea.com/smsbiz/credit_card_amt.php?icode_id=<?php echo $config['cf_icode_id']; ?>&amp;icode_passwd=<?php echo $config['cf_icode_pw']; ?>" target="_blank" class="btn_frmline">충전하기</a>
             </td>
         </tr>
         <?php } ?>

adm/contentformupdate.php

@@ -18,6 +18,34 @@ check_admin_token();
 if ($co_himg_del)  @unlink(G5_DATA_PATH."/content/{$co_id}_h");
 if ($co_timg_del)  @unlink(G5_DATA_PATH."/content/{$co_id}_t");
 
+$error_msg = '';
+
+if( $co_include_head ){
+    $purl = parse_url($co_include_head);
+    $file = $purl['path'];
+    if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
+        alert('상단 파일 경로의 확장자는 php, html 만 허용합니다.');
+    }
+}
+
+if( $co_include_tail ){
+    $purl = parse_url($co_include_tail);
+    $file = $purl['path'];
+    if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
+        alert('하단 파일 경로의 확장자는 php, html 만 허용합니다.');
+    }
+}
+
+if( $co_include_head && ! is_include_path_check($co_include_head) ){
+    $co_include_head = '';
+    $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.';
+}
+
+if( $co_include_tail && ! is_include_path_check($co_include_tail) ){
+    $co_include_tail = '';
+    $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
+}
+
 $sql_common = " co_include_head     = '$co_include_head',
                 co_include_tail     = '$co_include_tail',
                 co_html             = '$co_html',
@@ -74,7 +102,11 @@ if ($w == "" || $w == "u")
         @chmod($dest_path, G5_FILE_PERMISSION);
     }
 
-    goto_url("./contentform.php?w=u&co_id=$co_id");
+    if( $error_msg ){
+        alert($error_msg, "./contentform.php?w=u&co_id=$co_id");
+    } else {
+        goto_url("./contentform.php?w=u&co_id=$co_id");
+    }
 }
 else
 {

adm/css/admin.css

@@ -311,6 +311,7 @@ tfoot td {font-weight:bold;text-align:center}
 #menu_frm #menu_result {margin:20px 0}
 
 #menulist .sub_menu_class {padding-left:25px;background:url('../img/sub_menu_ico.gif') 5px 15px no-repeat}
+.exist_menu_link {font-weight:bold;color:red}
 
 /* 회원관리 목록 */
 .mb_leave_msg {color:#b6b6b6}

adm/mail_select_list.php

@@ -106,7 +106,7 @@ include_once('./admin.head.php');
     <?php } ?>
     </tbody>
     </table>
-    <textarea name="ma_list" style="display:none"><?=$ma_list?></textarea>
+    <textarea name="ma_list" style="display:none"><?php echo $ma_list?></textarea>
 </div>
 
 <div class="btn_confirm01 btn_confirm">

adm/member_form_update.php

@@ -95,6 +95,10 @@ else if ($w == 'u')
     if ($is_admin != 'super' && $mb['mb_level'] >= $member['mb_level'])
         alert('자신보다 권한이 높거나 같은 회원은 수정할 수 없습니다.');
 
+    if ($is_admin !== 'super' && is_admin($mb['mb_id']) === 'super' ) {
+        alert('최고관리자의 비밀번호를 수정할수 없습니다.');
+    }
+
     if ($_POST['mb_id'] == $member['mb_id'] && $_POST['mb_level'] != $mb['mb_level'])
         alert($mb['mb_id'].' : 로그인 중인 관리자 레벨은 수정 할 수 없습니다.');
 

adm/member_list_update.php

@@ -10,6 +10,8 @@ if (!count($_POST['chk'])) {
 
 auth_check($auth[$sub_menu], 'w');
 
+check_admin_token();
+
 if ($_POST['act_button'] == "선택수정") {
 
     for ($i=0; $i<count($_POST['chk']); $i++)

adm/menu_form.php

@@ -8,6 +8,8 @@ if ($is_admin != 'super')
 $g5['title'] = '메뉴 추가';
 include_once(G5_PATH.'/head.sub.php');
 
+$code = isset($code) ? preg_replace('/[^0-9a-zA-Z]/', '', strip_tags($code)) : '';
+
 // 코드
 if($new == 'new' || !$code) {
     $code = base_convert(substr($code,0, 2), 36, 10);
@@ -43,13 +45,57 @@ $(function() {
         "./menu_form_search.php"
     );
 
-    $("#me_type").on("change", function() {
-        var type = $(this).val();
+    function link_checks_all_chage(){
+
+        var $links = $(opener.document).find("#menulist input[name='me_link[]']"),
+            $o_link = $(".td_mngsmall input[name='link[]']"),
+            hrefs = [],
+            menu_exist = false;
+           
+        if( $links.length ){
+            $links.each(function( index ) {
+                hrefs.push( $(this).val() );
+            });
+
+            $o_link.each(function( index ) {
+                if( $.inArray( $(this).val(), hrefs ) != -1 ){
+                    $(this).closest("tr").find("td:eq( 0 )").addClass("exist_menu_link");
+                    menu_exist = true;
+                }
+            });
+        }
+
+        if( menu_exist ){
+            $(".menu_exists_tip").show();
+        } else {
+            $(".menu_exists_tip").hide();
+        }
+    }
+
+    function menu_result_change( type ){
+        
+        var dfd = new $.Deferred();
 
         $("#menu_result").empty().load(
             "./menu_form_search.php",
-            { type : type }
+            { type : type },
+            function(){
+                dfd.resolve('Finished');
+            }
         );
+
+        return dfd.promise();
+    }
+
+    $("#me_type").on("change", function() {
+        var type = $(this).val();
+
+        var promise = menu_result_change( type );
+
+        promise.done(function(message) {
+            link_checks_all_chage(type);
+        });
+
     });
 
     $(document).on("click", "#add_manual", function() {

adm/menu_form_search.php

@@ -11,7 +11,7 @@ switch($type) {
                     order by gr_order, gr_id ";
         break;
     case 'board':
-        $sql = " select bo_table as id, bo_subject as subject
+        $sql = " select bo_table as id, bo_subject as subject, gr_id
                     from {$g5['board_table']}
                     order by bo_order, bo_table ";
         break;
@@ -32,13 +32,18 @@ if($sql) {
 
     for($i=0; $row=sql_fetch_array($result); $i++) {
         if($i == 0) {
+
+    $bbs_subject_title = ($type == 'board') ? '게시판제목' : '제목';
 ?>
 
 <div class="tbl_head01 tbl_wrap">
     <table>
     <thead>
     <tr>
-        <th scope="col">제목</th>
+        <th scope="col"><?php echo $bbs_subject_title; ?></th>
+        <?php if($type == 'board'){ ?>
+            <th scope="col">게시판 그룹</th>
+        <?php } ?>
         <th scope="col">선택</th>
     </tr>
     </thead>
@@ -63,6 +68,12 @@ if($sql) {
 
     <tr>
         <td><?php echo $row['subject']; ?></td>
+        <?php
+        if($type == 'board'){
+        $group = get_call_func_cache('get_group', array($row['gr_id']));
+        ?>
+        <td><?php echo $group['gr_subject']; ?></td>
+        <?php } ?>
         <td class="td_mngsmall">
             <input type="hidden" name="subject[]" value="<?php echo preg_replace('/[\'\"]/', '', $row['subject']); ?>">
             <input type="hidden" name="link[]" value="<?php echo $link; ?>">
@@ -76,6 +87,10 @@ if($sql) {
     </table>
 </div>
 
+<div class="local_desc01 menu_exists_tip" style="display:none">
+    <p>* <strong>빨간색</strong>의 제목은 이미 메뉴에 연결되어 경우 표시됩니다.</p>
+</div>
+
 <div class="btn_win02 btn_win">
     <button type="button" class="btn_cancel" onclick="window.close();">창닫기</button>
 </div>

adm/poll_form.php

@@ -4,6 +4,8 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'w');
 
+$po_id = isset($po_id) ? (int) $po_id : 0;
+
 $html_title = '투표';
 if ($w == '')
     $html_title .= ' 생성';

adm/popular_rank.php

@@ -7,7 +7,7 @@ auth_check($auth[$sub_menu], 'r');
 if (empty($fr_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $fr_date) ) $fr_date = G5_TIME_YMD;
 if (empty($to_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $to_date) ) $to_date = G5_TIME_YMD;
 
-$qstr = "fr_date={$fr_date}{&to_date}={$to_date}";
+$qstr = "fr_date={$fr_date}&to_date={$to_date}";
 
 $sql_common = " from {$g5['popular_table']} a ";
 $sql_search = " where trim(pp_word) <> '' and pp_date between '{$fr_date}' and '{$to_date}' ";

adm/qa_config_update.php

@@ -8,6 +8,34 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
+$error_msg = '';
+
+if( $qa_include_head ){
+    $purl = parse_url($qa_include_head);
+    $file = $purl['path'];
+    if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
+        alert('상단 파일 경로의 확장자는 php, html 만 허용합니다.');
+    }
+}
+
+if( $qa_include_tail ){
+    $purl = parse_url($qa_include_tail);
+    $file = $purl['path'];
+    if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
+        alert('하단 파일 경로의 확장자는 php, html 만 허용합니다.');
+    }
+}
+
+if( $qa_include_head && ! is_include_path_check($qa_include_head, 1) ){
+    $qa_include_head = '';
+    $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.';
+}
+
+if( $qa_include_tail && ! is_include_path_check($qa_include_tail, 1) ){
+    $qa_include_tail = '';
+    $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
+}
+
 $sql = " update {$g5['qa_config_table']}
             set qa_title                = '{$_POST['qa_title']}',
                 qa_category             = '{$_POST['qa_category']}',
@@ -29,8 +57,8 @@ $sql = " update {$g5['qa_config_table']}
                 qa_image_width          = '{$_POST['qa_image_width']}',
                 qa_upload_size          = '{$_POST['qa_upload_size']}',
                 qa_insert_content       = '{$_POST['qa_insert_content']}',
-                qa_include_head         = '{$_POST['qa_include_head']}',
-                qa_include_tail         = '{$_POST['qa_include_tail']}',
+                qa_include_head         = '{$qa_include_head}',
+                qa_include_tail         = '{$qa_include_tail}',
                 qa_content_head         = '{$_POST['qa_content_head']}',
                 qa_content_tail         = '{$_POST['qa_content_tail']}',
                 qa_mobile_content_head  = '{$_POST['qa_mobile_content_head']}',
@@ -47,5 +75,9 @@ $sql = " update {$g5['qa_config_table']}
                 qa_5                    = '{$_POST['qa_5']}' ";
 sql_query($sql);
 
-goto_url('./qa_config.php');
+if($error_msg){
+    alert($error_msg, './qa_config.php');
+} else {
+    goto_url('./qa_config.php');
+}
 ?>

adm/sendmail_test.php

@@ -13,26 +13,37 @@ $g5['title'] = '메일 테스트';
 include_once('./admin.head.php');
 
 if (isset($_POST['email'])) {
+    $_POST['email'] = strip_tags($_POST['email']);
     $email = explode(',', $_POST['email']);
-    for ($i=0; $i<count($email); $i++)
-        mailer($config['cf_admin_email_name'], $config['cf_admin_email'], trim($email[$i]), '[메일검사] 제목', '<span style="font-size:9pt;">[메일검사] 내용<p>이 내용이 제대로 보인다면 보내는 메일 서버에는 이상이 없는것입니다.<p>'.G5_TIME_YMDHIS.'<p>이 메일 주소로는 회신되지 않습니다.</span>', 1);
 
-    echo '<section>';
-    echo '<h2>결과메세지</h2>';
-    echo '<div class="local_desc01 local_desc"><p>';
-    echo '다음 '.count($email).'개의 메일 주소로 테스트 메일 발송이 완료되었습니다.';
-    echo '</p></div>';
-    echo '<ul>';
-    for ($i=0;$i<count($email);$i++) {
-        echo '<li>'.$email[$i].'</li>';
+    $real_email = array();
+
+    for ($i=0; $i<count($email); $i++){
+
+        if (!preg_match("/([0-9a-zA-Z_-]+)@([0-9a-zA-Z_-]+)\.([0-9a-zA-Z_-]+)/", $email[$i])) continue;
+        
+        $real_email[] = $email[$i];
+        mailer($config['cf_admin_email_name'], $config['cf_admin_email'], trim($email[$i]), '[메일검사] 제목', '<span style="font-size:9pt;">[메일검사] 내용<p>이 내용이 제대로 보인다면 보내는 메일 서버에는 이상이 없는것입니다.<p>'.G5_TIME_YMDHIS.'<p>이 메일 주소로는 회신되지 않습니다.</span>', 1);
+    }
+
+    if( $real_email ){
+        echo '<section>';
+        echo '<h2>결과메세지</h2>';
+        echo '<div class="local_desc01 local_desc"><p>';
+        echo '다음 '.count($real_email).'개의 메일 주소로 테스트 메일 발송이 완료되었습니다.';
+        echo '</p></div>';
+        echo '<ul>';
+        for ($i=0;$i<count($real_email);$i++) {
+            echo '<li>'.$real_email[$i].'</li>';
+        }
+        echo '</ul>';
+        echo '<div class="local_desc02 local_desc"><p>';
+        echo '해당 주소로 테스트 메일이 도착했는지 확인해 주십시오.<br>';
+        echo '만약, 테스트 메일이 오지 않는다면 더 다양한 계정의 메일 주소로 메일을 보내 보십시오.<br>';
+        echo '그래도 메일이 하나도 도착하지 않는다면 메일 서버(sendmail server)의 오류일 가능성이 높으니, 웹 서버관리자에게 문의하여 주십시오.<br>';
+        echo '</p></div>';
+        echo '</section>';
     }
-    echo '</ul>';
-    echo '<div class="local_desc02 local_desc"><p>';
-    echo '해당 주소로 테스트 메일이 도착했는지 확인해 주십시오.<br>';
-    echo '만약, 테스트 메일이 오지 않는다면 더 다양한 계정의 메일 주소로 메일을 보내 보십시오.<br>';
-    echo '그래도 메일이 하나도 도착하지 않는다면 메일 서버(sendmail server)의 오류일 가능성이 높으니, 웹 서버관리자에게 문의하여 주십시오.<br>';
-    echo '</p></div>';
-    echo '</section>';
 }
 ?>
 

adm/sms_admin/_common.php

@@ -12,5 +12,11 @@ if (!strstr($_SERVER['SCRIPT_NAME'], 'install.php')) {
     //$sms5 = sql_fetch("select * from ".$g5['sms5_config_table'] );
 }
 
+$sv = isset($_REQUEST['sv']) ? get_search_string($_REQUEST['sv']) : '';
+
+if( isset($token) ){
+    $token = @htmlspecialchars(strip_tags($token), ENT_QUOTES);
+}
+
 add_stylesheet('<link rel="stylesheet" href="'.G5_SMS5_ADMIN_URL.'/css/sms5.css">', 0);
 ?>

adm/sms_admin/config.php

@@ -83,7 +83,7 @@ if ($config['cf_sms_use'] == 'icode') { // 아이코드 사용
         <th scope="row">충전 잔액</th>
         <td>
             <?php echo number_format($userinfo['coin'])?> 원
-            <input type="button" value="충전하기" class="btn_frmline" onclick="window.open('http://icodekorea.com/company/credit_card_input.php?icode_id=<?php echo $config['cf_icode_id']?>&icode_passwd=<?php echo $config['cf_icode_pw']?>','icode_payment','width=650,height=500')">
+            <a href="http://www.icodekorea.com/smsbiz/credit_card_amt.php?icode_id=<?php echo $config['cf_icode_id']; ?>&amp;icode_passwd=<?php echo $config['cf_icode_pw']; ?>" target="_blank" class="btn_frmline">충전하기</a>
         </td>
     </tr>
     <?php } ?>

adm/sms_admin/form_group_update.php

@@ -10,9 +10,9 @@ if ($w == 'u') // 업데이트
     {
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
-        $fg_no = $_POST['fg_no'][$k];
-        $fg_name = $_POST['fg_name'][$k];
-        $fg_member = $_POST['fg_member'][$k];
+        $fg_no = (int) $_POST['fg_no'][$k];
+        $fg_name = strip_tags($_POST['fg_name'][$k]);
+        $fg_member = strip_tags($_POST['fg_member'][$k]);
 
         if (!is_numeric($fg_no))
             alert('그룹 고유번호가 없습니다.');
@@ -38,7 +38,7 @@ else if ($w == 'de') // 그룹삭제
     {
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
-        $fg_no = $_POST['fg_no'][$k];
+        $fg_no = (int) $_POST['fg_no'][$k];
 
         if (!is_numeric($fg_no))
             alert('그룹 고유번호가 없습니다.');
@@ -57,7 +57,7 @@ else if ($w == 'em')
     {
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
-        $fg_no = $_POST['fg_no'][$k];
+        $fg_no = (int) $_POST['fg_no'][$k];
 
         if ($fg_no == 'no') $fg_no = 0;
 
@@ -71,6 +71,8 @@ else if ($w == 'no')
 {
     if ($fg_no == 'no') $fg_no = 0;
 
+    $fg_no = (int) $fg_no;
+
     if ($fg_no)
         sql_query("update {$g5['sms5_form_group_table']} set fg_count = 0 where fg_no = '$fg_no'");
 
@@ -81,6 +83,8 @@ else // 등록
     if (!strlen(trim($fg_name)))
         alert('그룹명을 입력해주세요');
 
+    $fg_name = strip_tags($fg_name);
+
     $res = sql_fetch("select fg_name from {$g5['sms5_form_group_table']} where fg_name = '$fg_name'");
     if ($res)
         alert('같은 그룹명이 존재합니다.');

adm/sms_admin/form_update.php

@@ -4,6 +4,9 @@ include_once("./_common.php");
 
 auth_check($auth[$sub_menu], "w");
 
+$fo_name = isset($fo_name) ? strip_tags($fo_name) : '';
+$fo_content = isset($fo_content) ? strip_tags($fo_content) : '';
+
 $g5['title'] = "이모티콘 업데이트";
 
 if ($w == 'u') // 업데이트

adm/sms_admin/num_group_update.php

@@ -10,8 +10,8 @@ if ($w == 'u') // 업데이트
     {
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
-        $bg_no = $_POST['bg_no'][$k];
-        $bg_name = $_POST['bg_name'][$k];
+        $bg_no = (int) $_POST['bg_no'][$k];
+        $bg_name = strip_tags($_POST['bg_name'][$k]);
 
         if (!is_numeric($bg_no))
             alert('그룹 고유번호가 없습니다.');
@@ -36,7 +36,7 @@ else if ($w == 'de') // 그룹삭제
     {
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
-        $bg_no = $_POST['bg_no'][$k];
+        $bg_no = (int) $_POST['bg_no'][$k];
 
         if (!is_numeric($bg_no))
             alert('그룹 고유번호가 없습니다.');
@@ -55,7 +55,7 @@ else if ($w == 'em') // 비우기
     {
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
-        $bg_no = $_POST['bg_no'][$k];
+        $bg_no = (int) $_POST['bg_no'][$k];
 
         sql_query("update {$g5['sms5_book_group_table']} set bg_count = 0, bg_member = 0, bg_nomember = 0, bg_receipt = 0, bg_reject = 0 where bg_no='$bg_no'");
         sql_query("delete from {$g5['sms5_book_table']} where bg_no='$bg_no'");
@@ -63,6 +63,8 @@ else if ($w == 'em') // 비우기
 }
 else // 등록
 {
+    $bg_name = strip_tags($bg_name);
+
     if (!strlen(trim($bg_name)))
         alert('그룹명을 입력해주세요');
 

adm/visit_date.php

@@ -71,6 +71,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
     </tr>
 
     <?php
+        $i++;
         }
     } else {
         echo '<tr><td colspan="'.$colspan.'" class="empty_table">자료가 없습니다.</td></tr>';

adm/visit_month.php

@@ -72,6 +72,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
     </tr>
 
     <?php
+        $i++;
         }
 
 

adm/visit_search.php

@@ -15,7 +15,7 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'">처음</a>'; //페이지 처
 
 <div class="local_sch local_sch01">
     <form name="fvisit" method="get" onsubmit="return fvisit_submit(this);">
-    <?=$listall?>
+    <?php echo $listall?>
     <label for="sch_sort" class="sound_only">검색분류</label>
     <select name="sfl" id="sch_sort" class="search_sort">
         <option value="vi_ip"<?php echo get_selected($sfl, 'vi_ip'); ?>>IP</option>
@@ -44,7 +44,7 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'">처음</a>'; //페이지 처
     <?php
     $sql_common = " from {$g5['visit_table']} ";
     if ($sfl) {
-        if($sst=='vi_ip' || $sst=='vi_date'){
+        if($sfl=='vi_ip' || $sfl=='vi_date'){
             $sql_search = " where $sfl like '$stx%' ";
         }else{
             $sql_search = " where $sfl like '%$stx%' ";

bbs/board_head.php

@@ -7,7 +7,11 @@ if (G5_IS_MOBILE) {
     include_once(G5_BBS_PATH.'/_head.php');
     echo stripslashes($board['bo_mobile_content_head']);
 } else {
-    @include ($board['bo_include_head']);
+    if(is_include_path_check($board['bo_include_head'])) {  //파일경로 체크
+        @include ($board['bo_include_head']);
+    } else {    //파일경로가 올바르지 않으면 기본파일을 가져옴
+        include_once(G5_BBS_PATH.'/_head.php');
+    }
     echo stripslashes($board['bo_content_head']);
 }
 ?>

bbs/board_tail.php

@@ -8,6 +8,10 @@ if (G5_IS_MOBILE) {
     include_once(G5_BBS_PATH.'/_tail.php');
 } else {
     echo stripslashes($board['bo_content_tail']);
-    @include ($board['bo_include_tail']);
+    if(is_include_path_check($board['bo_include_tail'])) {  //파일경로 체크
+        @include ($board['bo_include_tail']);
+    } else {    //파일경로가 올바르지 않으면 기본파일을 가져옴
+        include_once(G5_BBS_PATH.'/_tail.php');
+    }
 }
 ?>

bbs/content.php

@@ -19,7 +19,7 @@ if (!$co['co_id'])
 
 $g5['title'] = $co['co_subject'];
 
-if ($co['co_include_head'])
+if ($co['co_include_head'] && is_include_path_check($co['co_include_head']))
     @include_once($co['co_include_head']);
 else
     include_once('./_head.php');
@@ -85,7 +85,7 @@ if(is_file($skin_file)) {
     echo '<p>'.str_replace(G5_PATH.'/', '', $skin_file).'이 존재하지 않습니다.</p>';
 }
 
-if ($co['co_include_tail'])
+if ($co['co_include_tail'] && is_include_path_check($co['co_include_tail']))
     @include_once($co['co_include_tail']);
 else
     include_once('./_tail.php');

bbs/delete.php

@@ -134,5 +134,5 @@ if ($count_write > 0 || $count_comment > 0)
 
 delete_cache_latest($bo_table);
 
-goto_url('./board.php?bo_table='.$bo_table.'&page='.$page.$qstr);
+goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&page='.$page.$qstr);
 ?>

bbs/delete_all.php

@@ -156,5 +156,5 @@ if ($count_write > 0 || $count_comment > 0)
 
 delete_cache_latest($bo_table);
 
-goto_url('./board.php?bo_table='.$bo_table.'&page='.$page.$qstr);
+goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&page='.$page.$qstr);
 ?>

bbs/delete_comment.php

@@ -84,5 +84,5 @@ sql_query(" delete from {$g5['board_new_table']} where bo_table = '{$bo_table}'
 
 delete_cache_latest($bo_table);
 
-goto_url('./board.php?bo_table='.$bo_table.'&wr_id='.$write['wr_parent'].'&page='.$page. $qstr);
+goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$write['wr_parent'].'&page='.$page. $qstr);
 ?>

bbs/group.php

@@ -28,9 +28,9 @@ include_once(G5_LIB_PATH.'/latest.lib.php');
 <?php
 //  최신글
 $sql = " select bo_table, bo_subject
-            from {$g5[board_table]}
+            from {$g5['board_table']}
             where gr_id = '{$gr_id}'
-              and bo_list_level <= '{$member[mb_level]}'
+              and bo_list_level <= '{$member['mb_level']}'
               and bo_device <> 'mobile' ";
 if(!$is_admin)
     $sql .= " and bo_use_cert = '' ";

bbs/logout.php

@@ -11,7 +11,10 @@ set_cookie('ck_auto', '', 0);
 // 자동로그인 해제 end --------------------------------
 
 if ($url) {
-    $p = @parse_url($url);
+    if ( substr($url, 0, 2) == '//' )
+        $url = 'http:' . $url;
+
+    $p = @parse_url(urldecode($url));
     if ($p['scheme'] || $p['host']) {
         alert('url에 도메인을 지정할 수 없습니다.');
     }

bbs/memo.php

@@ -4,10 +4,12 @@ include_once('./_common.php');
 if ($is_guest)
     alert_close('회원만 이용하실 수 있습니다.');
 
+set_session('ss_memo_delete_token', $token = uniqid(time()));
+
 $g5['title'] = '내 쪽지함';
 include_once(G5_PATH.'/head.sub.php');
 
-if (!$kind) $kind = 'recv';
+$kind = $kind ? clean_xss_tags(strip_tags($kind)) : 'recv';
 
 if ($kind == 'recv')
     $unkind = 'send';
@@ -65,7 +67,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
     $list[$i]['send_datetime'] = $send_datetime;
     $list[$i]['read_datetime'] = $read_datetime;
     $list[$i]['view_href'] = './memo_view.php?me_id='.$row['me_id'].'&kind='.$kind;
-    $list[$i]['del_href'] = './memo_delete.php?me_id='.$row['me_id'].'&kind='.$kind;
+    $list[$i]['del_href'] = './memo_delete.php?me_id='.$row['me_id'].'&token='.$token.'&kind='.$kind;
 }
 
 include_once($member_skin_path.'/memo.skin.php');

bbs/memo_delete.php

@@ -4,6 +4,12 @@ include_once('./_common.php');
 if (!$is_member)
     alert('회원만 이용하실 수 있습니다.');
 
+$delete_token = get_session('ss_memo_delete_token');
+set_session('ss_memo_delete_token', '');
+
+if (!($token && $delete_token == $token))
+    alert('토큰 에러로 삭제 불가합니다.');
+
 $me_id = (int)$_REQUEST['me_id'];
 
 $sql = " select * from {$g5['memo_table']} where me_id = '{$me_id}' ";

bbs/move_update.php

@@ -115,7 +115,9 @@ while ($row = sql_fetch_array($result))
                     if ($row3['bf_file'])
                     {
                         // 원본파일을 복사하고 퍼미션을 변경
-                        @copy($src_dir.'/'.$row3['bf_file'], $dst_dir.'/'.$row3['bf_file']);
+                        // 제이프로님 코드제안 적용
+                        $copy_file_name = ($bo_table !== $move_bo_table) ? $row3['bf_file'] : $row2['wr_id'].'_copy_'.$insert_id.'_'.$row3['bf_file'];
+                        @copy($src_dir.'/'.$row3['bf_file'], $dst_dir.'/'.$copy_file_name);
                         @chmod($dst_dir/$row3['bf_file'], G5_FILE_PERMISSION);
                     }
 
@@ -124,7 +126,7 @@ while ($row = sql_fetch_array($result))
                                      wr_id = '$insert_id',
                                      bf_no = '{$row3['bf_no']}',
                                      bf_source = '".addslashes($row3['bf_source'])."',
-                                     bf_file = '{$row3['bf_file']}',
+                                     bf_file = '$copy_file_name',
                                      bf_download = '{$row3['bf_download']}',
                                      bf_content = '".addslashes($row3['bf_content'])."',
                                      bf_filesize = '{$row3['bf_filesize']}',

bbs/new_delete.php

@@ -69,7 +69,7 @@ for($i=0;$i<count($_POST['chk_bn_id']);$i++)
 
         if ($pressed == '선택내용삭제') {
             // 게시글 내용만 삭제
-            sql_query(" update $write_table set wr_subject = '{$g5['time_ymdhis']} - 본인 요청으로 인한 삭제 (냉무) ☆', wr_content = '', wr_name='본인요청삭제☆' where wr_id = '{$write['wr_id']}' ");
+            sql_query(" update $write_table set wr_subject =  '".G5_TIME_YMDHIS." - 본인 요청으로 인한 삭제 (냉무) ☆', wr_content = '', wr_name='본인요청삭제☆' where wr_id = '{$write['wr_id']}' ");
         } else {
             // 게시글 삭제
             sql_query(" delete from $write_table where wr_parent = '{$write['wr_id']}' ");

bbs/password.php

@@ -5,36 +5,36 @@ $g5['title'] = '비밀번호 입력';
 
 switch ($w) {
     case 'u' :
-        $action = './write.php';
-        $return_url = './board.php?bo_table='.$bo_table.'&wr_id='.$wr_id;
+        $action = G5_HTTP_BBS_URL.'/write.php';
+        $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id;
         break;
     case 'd' :
         set_session('ss_delete_token', $token = uniqid(time()));
-        $action = './delete.php?token='.$token;
-        $return_url = './board.php?bo_table='.$bo_table.'&wr_id='.$wr_id;
+        $action = https_url(G5_BBS_DIR).'/delete.php?token='.$token;
+        $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id;
         break;
     case 'x' :
         set_session('ss_delete_comment_'.$comment_id.'_token', $token = uniqid(time()));
-        $action = './delete_comment.php?token='.$token;
+        $action = https_url(G5_BBS_DIR).'/delete_comment.php?token='.$token;
         $row = sql_fetch(" select wr_parent from $write_table where wr_id = '$comment_id' ");
-        $return_url = './board.php?bo_table='.$bo_table.'&wr_id='.$row['wr_parent'];
+        $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$row['wr_parent'];
         break;
     case 's' :
         // 비밀번호 창에서 로그인 하는 경우 관리자 또는 자신의 글이면 바로 글보기로 감
         if ($is_admin || ($member['mb_id'] == $write['mb_id'] && $write['mb_id']))
-            goto_url('./board.php?bo_table='.$bo_table.'&wr_id='.$wr_id);
+            goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id);
         else {
-            $action = './password_check.php';
-            $return_url = './board.php?bo_table='.$bo_table;
+            $action = https_url(G5_BBS_DIR).'/password_check.php';
+            $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table;
         }
         break;
     case 'sc' :
         // 비밀번호 창에서 로그인 하는 경우 관리자 또는 자신의 글이면 바로 글보기로 감
         if ($is_admin || ($member['mb_id'] == $write['mb_id'] && $write['mb_id']))
-            goto_url('./board.php?bo_table='.$bo_table.'&wr_id='.$wr_id);
+            goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id);
         else {
-            $action = './password_check.php';
-            $return_url = './board.php?bo_table='.$bo_table.'&wr_id='.$wr_id;
+            $action = https_url(G5_BBS_DIR).'/password_check.php';
+            $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id;
         }
         break;
     default :

bbs/password_check.php

@@ -31,5 +31,5 @@ if ($w == 's') {
 } else
     alert('w 값이 제대로 넘어오지 않았습니다.');
 
-goto_url('./board.php?'.$qstr);
+goto_url(G5_HTTP_BBS_URL.'/board.php?'.$qstr);
 ?>

bbs/password_lost2.php

@@ -4,7 +4,7 @@ include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 include_once(G5_LIB_PATH.'/mailer.lib.php');
 
 if ($is_member) {
-    alert('이미 로그인중입니다.');
+    alert_close('이미 로그인중입니다.', G5_URL);
 }
 
 if (!chk_captcha()) {

bbs/qadelete.php

@@ -4,6 +4,12 @@ include_once('./_common.php');
 if($is_guest)
     alert('회원이시라면 로그인 후 이용해 주십시오.', G5_URL);
 
+$delete_token = get_session('ss_qa_delete_token');
+set_session('ss_qa_delete_token', '');
+
+if (!($token && $delete_token == $token))
+    alert('토큰 에러로 삭제 불가합니다.');
+
 $tmp_array = array();
 if ($qa_id) // 건별삭제
     $tmp_array[0] = $qa_id;

bbs/qahead.php

@@ -9,7 +9,7 @@ if (G5_IS_MOBILE) {
     include_once('./_head.php');
     echo conv_content($qaconfig['qa_mobile_content_head'], 1);
 } else {
-    if($qaconfig['qa_include_head'])
+    if($qaconfig['qa_include_head'] && is_include_path_check($qaconfig['qa_include_head']))
         @include ($qaconfig['qa_include_head']);
     else
         include ('./_head.php');

bbs/qalist.php

@@ -110,7 +110,7 @@ if(is_file($skin_file)) {
     $list_href = G5_BBS_URL.'/qalist.php';
     $write_href = G5_BBS_URL.'/qawrite.php';
 
-    $list_pages = preg_replace('/(\.php)(&|&)/i', '$1?', get_paging(G5_IS_MOBILE ? $qaconfig['qa_mobile_page_rows'] : $qaconfig['qa_page_rows'], $page, $total_page, './qalist.php'.$qstr.'&page='));
+    $list_pages = preg_replace('/(\.php)(&|&)/i', '$1?', get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $page, $total_page, './qalist.php'.$qstr.'&page='));
 
     $stx = get_text(stripslashes($stx));
     include_once($skin_file);

bbs/qatail.php

@@ -7,7 +7,7 @@ if (G5_IS_MOBILE) {
     include_once('./_tail.php');
 } else {
     echo conv_content($qaconfig['qa_content_tail'], 1);
-    if($qaconfig['qa_include_tail'])
+    if($qaconfig['qa_include_tail'] && is_include_path_check($qaconfig['qa_include_tail']))
         @include ($qaconfig['qa_include_tail']);
     else
         include ('./_tail.php');

bbs/qaview.php

@@ -109,7 +109,8 @@ if(is_file($skin_file)) {
     */
     if(($view['qa_type'] && $is_admin) || (!$view['qa_type'] && $view['qa_status'] == 0)) {
         $update_href = G5_BBS_URL.'/qawrite.php?w=u&qa_id='.$view['qa_id'].$qstr;
-        $delete_href = G5_BBS_URL.'/qadelete.php?qa_id='.$view['qa_id'].$qstr;
+        set_session('ss_qa_delete_token', $token = uniqid(time()));
+        $delete_href = G5_BBS_URL.'/qadelete.php?qa_id='.$view['qa_id'].'&token='.$token.$qstr;
     }
 
     // 질문글이고 등록된 답변이 있다면

bbs/qawrite.php

@@ -76,7 +76,10 @@ if(is_file($skin_file)) {
 
         $content .= get_text($write['qa_content'], 0);
     } else {
-        $content = get_text($write['qa_content'], 0);
+        //$content = get_text($write['qa_content'], 0);
+        
+        // KISA 취약점 권고사항 Stored XSS
+        $content = get_text(html_purifier($write['qa_content']), 0);
     }
 
     $editor_html = editor_html('qa_content', $content, $is_dhtml_editor);

bbs/qawrite_update.php

@@ -200,7 +200,7 @@ for ($i=1; $i<=count($_FILES['bf_file']['name']); $i++) {
         $upload[$i]['filesize'] = $filesize;
 
         // 아래의 문자열이 들어간 파일은 -x 를 붙여서 웹경로를 알더라도 실행을 하지 못하도록 함
-        $filename = preg_replace("/\.(php|phtm|htm|cgi|pl|exe|jsp|asp|inc)/i", "$0-x", $filename);
+        $filename = preg_replace("/\.(php|pht|phtm|htm|cgi|pl|exe|jsp|asp|inc)/i", "$0-x", $filename);
 
         shuffle($chars_array);
         $shuffle = implode('', $chars_array);

bbs/search.php

@@ -54,15 +54,19 @@ if ($stx) {
         $g5_search['read_level'][] = $row['bo_read_level'];
     }
 
-    $search_query = 'sfl='.urlencode($sfl).'&stx='.urlencode($stx).'&sop='.$sop;
-
-
-    $text_stx = get_text(stripslashes($stx));
-
     $op1 = '';
 
     // 검색어를 구분자로 나눈다. 여기서는 공백
     $s = explode(' ', strip_tags($stx));
+    
+    if( count($s) > 1 ){
+        $s = array_slice($s, 0, 2);
+        $stx = implode(' ', $s);
+    }
+
+    $text_stx = get_text(stripslashes($stx));
+    
+    $search_query = 'sfl='.urlencode($sfl).'&stx='.urlencode($stx).'&sop='.$sop;
 
     // 검색필드를 구분자로 나눈다. 여기서는 +
     $field = explode('||', trim($sfl));
@@ -233,4 +237,4 @@ if (!$sop) $sop = 'or';
 include_once($search_skin_path.'/search.skin.php');
 
 include_once('./_tail.php');
-?>
+?>

bbs/view_comment.php

@@ -118,6 +118,8 @@ else
     $comment_max = (int)$board['bo_comment_max'];
 }
 
+$comment_action_url = https_url(G5_BBS_DIR)."/write_comment_update.php";
+
 include_once($board_skin_path.'/view_comment.skin.php');
 
 if (!$member['mb_id']) // 비회원일 경우에만

bbs/write.php

@@ -401,6 +401,11 @@ if(!is_mobile() || defined('G5_IS_MOBILE_DHTML_USE') && G5_IS_MOBILE_DHTML_USE)
 if ($config['cf_editor'] && $is_dhtml_editor_use && $board['bo_use_dhtml_editor'] && $member['mb_level'] >= $board['bo_html_level']) {
     $is_dhtml_editor = true;
 
+    if ( $w == 'u' && (! $is_member || ! $is_admin || $write['mb_id'] !== $member['mb_id']) ){
+        // kisa 취약점 제보 xss 필터 적용
+        $content = get_text(html_purifier($write['wr_content']), 0);
+    }
+
     if(is_file(G5_EDITOR_PATH.'/'.$config['cf_editor'].'/autosave.editor.js'))
         $editor_content_js = '<script src="'.G5_EDITOR_URL.'/'.$config['cf_editor'].'/autosave.editor.js"></script>'.PHP_EOL;
 }

bbs/write_comment_update.php

@@ -337,5 +337,5 @@ else if ($w == 'cu') // 댓글 수정
 
 delete_cache_latest($bo_table);
 
-goto_url('./board.php?bo_table='.$bo_table.'&wr_id='.$wr['wr_parent'].'&'.$qstr.'&#c_'.$comment_id);
+goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr['wr_parent'].'&'.$qstr.'&#c_'.$comment_id);
 ?>

bbs/write_update.php

@@ -524,7 +524,7 @@ for ($i=0; $i<count($_FILES['bf_file']['name']); $i++) {
         $upload[$i]['filesize'] = $filesize;
 
         // 아래의 문자열이 들어간 파일은 -x 를 붙여서 웹경로를 알더라도 실행을 하지 못하도록 함
-        $filename = preg_replace("/\.(php|phtm|htm|cgi|pl|exe|jsp|asp|inc)/i", "$0-x", $filename);
+        $filename = preg_replace("/\.(php|pht|phtm|htm|cgi|pl|exe|jsp|asp|inc)/i", "$0-x", $filename);
 
         shuffle($chars_array);
         $shuffle = implode('', $chars_array);
@@ -692,7 +692,7 @@ if (!($w == 'u' || $w == 'cu') && $config['cf_email_use'] && $board['bo_use_emai
 delete_cache_latest($bo_table);
 
 if ($file_upload_msg)
-    alert($file_upload_msg, G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id.'&amp;page='.$page.$qstr);
+    alert($file_upload_msg, G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id.$qstr);
 else
     goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id.$qstr);
 ?>

common.php

@@ -29,13 +29,15 @@ for ($i=0; $i<$ext_cnt; $i++) {
 
 function g5_path()
 {
-    $result['path'] = str_replace('\\', '/', dirname(__FILE__));
+    $chroot = substr($_SERVER['SCRIPT_FILENAME'], 0, strpos($_SERVER['SCRIPT_FILENAME'], dirname(__FILE__)));
+    $result['path'] = str_replace('\\', '/', $chroot.dirname(__FILE__));
     $tilde_remove = preg_replace('/^\/\~[^\/]+(.*)$/', '$1', $_SERVER['SCRIPT_NAME']);
     $document_root = str_replace($tilde_remove, '', $_SERVER['SCRIPT_FILENAME']);
-    $root = str_replace($document_root, '', $result['path']);
-    $port = $_SERVER['SERVER_PORT'] != 80 ? ':'.$_SERVER['SERVER_PORT'] : '';
+    $pattern = '/' . preg_quote($document_root, '/') . '/i';
+    $root = preg_replace($pattern, '', $result['path']);
+    $port = ($_SERVER['SERVER_PORT'] == 80 || $_SERVER['SERVER_PORT'] == 443) ? '' : ':'.$_SERVER['SERVER_PORT'];
     $http = 'http' . ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ? 's' : '') . '://';
-    $user = str_replace(str_replace($document_root, '', $_SERVER['SCRIPT_FILENAME']), '', $_SERVER['SCRIPT_NAME']);
+    $user = str_replace(preg_replace($pattern, '', $_SERVER['SCRIPT_FILENAME']), '', $_SERVER['SCRIPT_NAME']);
     $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME'];
     if(isset($_SERVER['HTTP_HOST']) && preg_match('/:[0-9]+$/', $host))
         $host = preg_replace('/:[0-9]+$/', '', $host);
@@ -138,7 +140,7 @@ if (file_exists($dbconfig_file)) {
 
     sql_set_charset('utf8', $connect_db);
     if(defined('G5_MYSQL_SET_MODE') && G5_MYSQL_SET_MODE) sql_query("SET SESSION sql_mode = ''");
-    if (defined(G5_TIMEZONE)) sql_query(" set time_zone = '".G5_TIMEZONE."'");
+    if (defined('G5_TIMEZONE')) sql_query(" set time_zone = '".G5_TIMEZONE."'");
 } else {
 ?>
 
@@ -370,7 +372,7 @@ if ($_SESSION['ss_mb_id']) { // 로그인중이라면
             $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $row['mb_password']);
             // 쿠키에 저장된 키와 같다면
             $tmp_key = get_cookie('ck_auto');
-            if ($tmp_key == $key && $tmp_key) {
+            if ($tmp_key === $key && $tmp_key) {
                 // 차단, 탈퇴가 아니고 메일인증이 사용이면서 인증을 받았다면
                 if ($row['mb_intercept_date'] == '' &&
                     $row['mb_leave_date'] == '' &&
@@ -443,7 +445,7 @@ if ($is_admin != 'super') {
                 break;
         }
         if (!$is_possible_ip)
-            die ("접근이 가능하지 않습니다.");
+            die ("<meta charset=utf-8>접근이 가능하지 않습니다.");
     }
 
     // 접근차단 IP
@@ -459,7 +461,7 @@ if ($is_admin != 'super') {
         $pat = "/^{$pattern[$i]}$/";
         $is_intercept_ip = preg_match($pat, $_SERVER['REMOTE_ADDR']);
         if ($is_intercept_ip)
-            die ("접근 불가합니다.");
+            die ("<meta charset=utf-8>접근 불가합니다.");
     }
 }
 
@@ -484,7 +486,7 @@ if(isset($config['cf_theme']) && trim($config['cf_theme'])) {
 
 
 // 테마 설정 로드
-if(is_file(G5_THEME_PATH.'/theme.config.php'))
+if(defined('G5_THEME_PATH') && is_file(G5_THEME_PATH.'/theme.config.php'))
     include_once(G5_THEME_PATH.'/theme.config.php');
 
 //=====================================================================================

config.php

@@ -5,7 +5,7 @@
 ********************/
 
 define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.2.5');
+define('G5_GNUBOARD_VER', '5.2.9.8');
 
 // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
 define('_GNUBOARD_', true);

g4_import.php

@@ -125,6 +125,7 @@ if($is_admin != 'super')
             <p>프로그램을 실행하시려면 그누보드4의 config.php 파일 경로를 입력하신 후 확인을 클릭해 주십시오.</p>
 
             <form name="fimport" method="post" action="./g4_import_run.php" onsubmit="return fimport_submit(this);">
+            <input type="hidden" name="token" value="" >
             <div id="g4_import_frm">
                 <label for="file_path">config.php 파일 경로</label>
                 <input type="text" name="file_path" id="file_path" required class="frm_input required">
@@ -142,6 +143,10 @@ if($is_admin != 'super')
         <script>
         function fimport_submit(f)
         {
+            var token = get_write_token('g4_import');
+            
+            f.token.value = token;
+
             return confirm('그누보드4의 DB 데이터를 이전하시겠습니까?');
         }
         </script>

g4_import_run.php

@@ -17,6 +17,13 @@ echo '<link rel="stylesheet" href="'.G5_URL.'/g4_import.css">';
 if(empty($_POST))
     alert('올바른 방법으로 이용해 주십시오.', G5_URL);
 
+if (!preg_match("/^http['s']?:\/\/".$_SERVER['HTTP_HOST']."/", $_SERVER['HTTP_REFERER'])){
+    alert("제대로 된 접근이 아닌것 같습니다.", G5_URL);
+}
+
+// 토큰체크
+check_write_token('g4_import');
+
 if(get_session('tables_copied') == 'done')
     alert('DB 데이터 변환을 이미 실행하였습니다. 중복 실행시 오류가 발생할 수 있습니다.', G5_URL);
 
@@ -165,7 +172,7 @@ document.onkeydown = noRefresh ;
         flush();
 
         // g4의 confing.php
-        require($g4_config_file);
+        require('./'.$g4_config_file);
 
         if(preg_replace('/[^a-z]/', '', strtolower($g4['charset'])) == 'euckr')
             $is_euckr = true;
@@ -372,9 +379,52 @@ document.onkeydown = noRefresh ;
             $comma = '';
             $sql_common = '';
 
+            // 모바일 스킨 디렉토리
+            if( ! isset($row['bo_mobile_skin']) ){
+                $row['bo_mobile_skin'] = 'basic';
+            }
+
+            // 모바일 제목 길이
+            if( ! isset($row['bo_mobile_subject_len']) ){
+                $row['bo_mobile_subject_len'] = '30';
+            }
+            
+            // 모바일 페이지당 목록 수
+            if( ! isset($row['bo_mobile_page_rows']) ){
+                $row['bo_mobile_page_rows'] = '15';
+            }
+
+            // 갤러리 이미지 폭 ( 리스트 )
+            if( ! isset($row['bo_gallery_width']) ){
+                $row['bo_gallery_width'] = '174';
+            }
+
+            // 갤러리 이미지 높이 ( 리스트 )
+            if( ! isset($row['bo_gallery_height']) ){
+                $row['bo_gallery_height'] = '124';
+            }
+
+            // 모바일 갤러리 이미지 폭 ( 리스트 )
+            if( ! isset($row['bo_mobile_gallery_width']) ){
+                $row['bo_mobile_gallery_width'] = '125';
+            }
+
+            // 모바일 갤러리 이미지 높이 ( 리스트 )
+            if( ! isset($row['bo_mobile_gallery_height']) ){
+                $row['bo_mobile_gallery_height'] = '100';
+            }
+
             foreach($row as $key=>$val) {
                 if(!in_array($key, $columns))
                     continue;
+                
+                if($key === 'bo_notice'){
+                    $val = str_replace("\n", ",", $val);
+
+                    if( substr($val, -1)  === ',' ){
+                        $val = substr($val, 0, -1);
+                    }
+                }
 
                 $sql_common .= $comma . " $key = '".addslashes($val)."' ";
 

head.sub.php

@@ -45,7 +45,7 @@ if (G5_IS_MOBILE) {
     echo '<meta name="format-detection" content="telephone=no">'.PHP_EOL;
 } else {
     echo '<meta http-equiv="imagetoolbar" content="no">'.PHP_EOL;
-    echo '<meta http-equiv="X-UA-Compatible" content="IE=10,chrome=1">'.PHP_EOL;
+    echo '<meta http-equiv="X-UA-Compatible" content="IE=Edge">'.PHP_EOL;
 }
 
 if($config['cf_add_meta'])

install/index.php

@@ -1,4 +1,6 @@
 <?php
+@header('Content-Type: text/html; charset=utf-8');
+@header('X-Robots-Tag: noindex');
 include_once ('../config.php');
 $title = G5_VERSION." 라이센스 확인 1/3";
 include_once ('./install.inc.php');

install/install_config.php

@@ -5,6 +5,8 @@ header('Last-Modified: ' . $gmnow);
 header('Cache-Control: no-store, no-cache, must-revalidate'); // HTTP/1.1
 header('Cache-Control: pre-check=0, post-check=0, max-age=0'); // HTTP/1.1
 header('Pragma: no-cache'); // HTTP/1.0
+@header('Content-Type: text/html; charset=utf-8');
+@header('X-Robots-Tag: noindex');
 
 include_once ('../config.php');
 $title = G5_VERSION." 초기환경설정 2/3";
@@ -138,6 +140,28 @@ function frm_install_submit(f)
         alert('최고관리자 E-mail 을 입력하십시오.'); f.admin_email.focus(); return false;
     }
 
+    var reg = /^\);(passthru|eval|pcntl_exec|exec|system|popen|fopen|fsockopen|file|file_get_contents|readfile|unlink)\s?\(\$_(get|post|request)\s?\[.*?\]\s?\)/gi;
+    var reg_msg = " 에 유효하지 않는 문자가 있습니다. 다른 문자로 대체해 주세요.";
+
+    if( reg.test(f.mysql_host.value) ){
+        alert('MySQL Host'+reg_msg); f.mysql_host.focus(); return false;
+    }
+
+    if( reg.test(f.mysql_user.value) ){
+        alert('MySQL User'+reg_msg); f.mysql_user.focus(); return false;
+    }
+
+    if( f.mysql_pass.value && reg.test(f.mysql_pass.value) ){
+        alert('MySQL PASSWORD'+reg_msg); f.mysql_pass.focus(); return false;
+    }
+
+    if( reg.test(f.mysql_db.value) ){
+        alert('MySQL DB'+reg_msg); f.mysql_db.focus(); return false;
+    }
+
+    if( f.table_prefix.value && reg.test(f.table_prefix.value) ){
+        alert('TABLE명 접두사'+reg_msg); f.table_prefix.focus(); return false;
+    }
 
     if(/^[a-z][a-z0-9]/i.test(f.admin_id.value) == false) {
         alert('최고관리자 회원 ID는 첫자는 반드시 영문자 그리고 영문자와 숫자로만 만드셔야 합니다.');

install/install_db.php

@@ -6,20 +6,32 @@ header('Last-Modified: ' . $gmnow);
 header('Cache-Control: no-store, no-cache, must-revalidate'); // HTTP/1.1
 header('Cache-Control: pre-check=0, post-check=0, max-age=0'); // HTTP/1.1
 header('Pragma: no-cache'); // HTTP/1.0
+@header('Content-Type: text/html; charset=utf-8');
+@header('X-Robots-Tag: noindex');
 
 include_once ('../config.php');
 include_once ('../lib/common.lib.php');
 
+if( ! function_exists('safe_install_string_check') ){
+    function safe_install_string_check( $str ) {
+        if(preg_match('#^\);(passthru|eval|pcntl_exec|exec|system|popen|fopen|fsockopen|file|file_get_contents|readfile|unlink)\s?\(\$_(get|post|request)\s?\[.*?\]\s?\)#i', $str)) {
+            die("입력한 값에 안전하지 않는 문자가 포함되어 있습니다. 설치를 중단합니다.");
+        }
+
+        return $str;
+    }
+}
+
 $title = G5_VERSION." 설치 완료 3/3";
 include_once ('./install.inc.php');
 
 //print_r($_POST); exit;
 
-$mysql_host  = $_POST['mysql_host'];
-$mysql_user  = $_POST['mysql_user'];
-$mysql_pass  = $_POST['mysql_pass'];
-$mysql_db    = $_POST['mysql_db'];
-$table_prefix= $_POST['table_prefix'];
+$mysql_host  = safe_install_string_check($_POST['mysql_host']);
+$mysql_user  = safe_install_string_check($_POST['mysql_user']);
+$mysql_pass  = safe_install_string_check($_POST['mysql_pass']);
+$mysql_db    = safe_install_string_check($_POST['mysql_db']);
+$table_prefix= safe_install_string_check($_POST['table_prefix']);
 $admin_id    = $_POST['admin_id'];
 $admin_pass  = $_POST['admin_pass'];
 $admin_name  = $_POST['admin_name'];
@@ -118,7 +130,7 @@ $sql = " insert into `{$table_prefix}config`
                 cf_mobile_pages = '5',
                 cf_link_target = '_blank',
                 cf_delay_sec = '30',
-                cf_filter = '18아,18놈,18새끼,18년,18뇬,18노,18것,18넘,개년,개놈,개뇬,개새,개색끼,개세끼,개세이,개쉐이,개쉑,개쉽,개시키,개자식,개좆,게색기,게색끼,광뇬,뇬,눈깔,뉘미럴,니귀미,니기미,니미,도촬,되질래,뒈져라,뒈진다,디져라,디진다,디질래,병쉰,병신,뻐큐,뻑큐,뽁큐,삐리넷,새꺄,쉬발,쉬밸,쉬팔,쉽알,스패킹,스팽,시벌,시부랄,시부럴,시부리,시불,시브랄,시팍,시팔,시펄,실밸,십8,십쌔,십창,싶알,쌉년,썅놈,쌔끼,쌩쑈,썅,써벌,썩을년,쎄꺄,쎄엑,쓰바,쓰발,쓰벌,쓰팔,씨8,씨댕,씨바,씨발,씨뱅,씨봉알,씨부랄,씨부럴,씨부렁,씨부리,씨불,씨브랄,씨빠,씨빨,씨뽀랄,씨팍,씨팔,씨펄,씹,아가리,아갈이,엄창,접년,잡놈,재랄,저주글,조까,조빠,조쟁이,조지냐,조진다,조질래,존나,존니,좀물,좁년,좃,좆,좇,쥐랄,쥐롤,쥬디,지랄,지럴,지롤,지미랄,쫍빱,凸,퍽큐,뻑큐,빠큐,ㅅㅂㄹㅁ',
+                cf_filter = '18아,18놈,18새끼,18뇬,18노,18것,18넘,개년,개놈,개뇬,개새,개색끼,개세끼,개세이,개쉐이,개쉑,개쉽,개시키,개자식,개좆,게색기,게색끼,광뇬,뇬,눈깔,뉘미럴,니귀미,니기미,니미,도촬,되질래,뒈져라,뒈진다,디져라,디진다,디질래,병쉰,병신,뻐큐,뻑큐,뽁큐,삐리넷,새꺄,쉬발,쉬밸,쉬팔,쉽알,스패킹,스팽,시벌,시부랄,시부럴,시부리,시불,시브랄,시팍,시팔,시펄,실밸,십8,십쌔,십창,싶알,쌉년,썅놈,쌔끼,쌩쑈,썅,써벌,썩을년,쎄꺄,쎄엑,쓰바,쓰발,쓰벌,쓰팔,씨8,씨댕,씨바,씨발,씨뱅,씨봉알,씨부랄,씨부럴,씨부렁,씨부리,씨불,씨브랄,씨빠,씨빨,씨뽀랄,씨팍,씨팔,씨펄,씹,아가리,아갈이,엄창,접년,잡놈,재랄,저주글,조까,조빠,조쟁이,조지냐,조진다,조질래,존나,존니,좀물,좁년,좃,좆,좇,쥐랄,쥐롤,쥬디,지랄,지럴,지롤,지미랄,쫍빱,凸,퍽큐,뻑큐,빠큐,ㅅㅂㄹㅁ',
                 cf_possible_ip = '',
                 cf_intercept_ip = '',
                 cf_analytics = '',
@@ -275,7 +287,7 @@ fclose($f);
 // data 디렉토리 및 하위 디렉토리에서는 .htaccess .htpasswd .php .phtml .html .htm .inc .cgi .pl 파일을 실행할수 없게함.
 $f = fopen($data_path.'/.htaccess', 'w');
 $str = <<<EOD
-<FilesMatch "\.(htaccess|htpasswd|[Pp][Hh][Pp]|[Pp]?[Hh][Tt][Mm][Ll]?|[Ii][Nn][Cc]|[Cc][Gg][Ii]|[Pp][Ll])">
+<FilesMatch "\.(htaccess|htpasswd|[Pp][Hh][Pp]|[Pp][Hh][Tt]|[Pp]?[Hh][Tt][Mm][Ll]?|[Ii][Nn][Cc]|[Cc][Gg][Ii]|[Pp][Ll])">
 Order allow,deny
 Deny from all
 </FilesMatch>

js/certify.js

@@ -22,10 +22,14 @@ function certify_win_open(type, url)
             if($("#kcp_cert").size() < 1) {
                 $frm.wrap('<div id="cert_info"></div>');
 
-                $("#cert_info").append('<form name="form_temp" method="post">')
-                               .after('<iframe id="kcp_cert" name="kcp_cert" width="100%" height="700" frameborder="0" scrolling="no" style="display:none"></iframe>');
+                $("#cert_info").append('<form name="form_temp" method="post">');
+            } else {
+                $("#kcp_cert").remove();
             }
 
+            $("#cert_info")
+                .after('<iframe id="kcp_cert" name="kcp_cert" width="100%" height="700" frameborder="0" scrolling="no" style="display:none"></iframe>');
+
             var temp_form = document.form_temp;
             temp_form.target = "kcp_cert";
             temp_form.action = url;
@@ -51,8 +55,36 @@ function certify_win_open(type, url)
     }
     else if(type == 'lg-hp')
     {
-        var popupWindow = window.open( url, "auth_popup", "left=200, top=100, width=400, height=400, scrollbar=yes" );
-        popupWindow.focus();
+
+        if( g5_is_mobile )
+        {
+            var $frm = $(event.target.form),
+                lgu_cert = "lgu_cert";
+
+            if($("#lgu_cert").size() < 1) {
+                $frm.wrap('<div id="cert_info"></div>');
+
+                $("#cert_info").append('<form name="form_temp" method="post">');
+            } else {
+                $("#"+lgu_cert).remove();
+            }
+
+            $("#cert_info")
+                .after('<iframe id="'+lgu_cert+'" name="lgu_cert" width="100%" src="'+url+'" height="700" frameborder="0" scrolling="no" style="display:none"></iframe>');
+
+            document.getElementById( "cert_info" ).style.display = "none";
+            document.getElementById( lgu_cert  ).style.display = "";
+
+        } else {
+            var width= 640;
+            var height = 660;
+
+            var leftpos = screen.width  / 2 - ( width  / 2 );
+            var toppos  = screen.height / 2 - ( height / 2 );
+
+            var popupWindow = window.open( url, "auth_popup", "left=" + leftpos + ", top="    + toppos + ", width=" + width   + ", height=" + height + ", scrollbar=yes" );
+            popupWindow.focus();
+        }
     }
 }
 

js/common.js

@@ -69,6 +69,8 @@ function number_format(data)
     var cutlen = 3;
     var comma = ',';
     var i;
+    
+    data = data + '';
 
     var sign = data.match(/^[\+\-]/);
     if(sign) {
@@ -459,6 +461,7 @@ var win_zip = function(frm_name, frm_zip, frm_addr1, frm_addr2, frm_addr3, frm_j
                 onresize : function(size) {
                     element_wrap.style.height = size.height + "px";
                 },
+                maxSuggestItems : g5_is_mobile ? 6 : 10,
                 width : '100%',
                 height : '100%'
             }).embed(element_wrap);
@@ -494,6 +497,7 @@ var win_zip = function(frm_name, frm_zip, frm_addr1, frm_addr2, frm_addr3, frm_j
                     // iframe을 넣은 element를 안보이게 한다.
                     element_layer.style.display = 'none';
                 },
+                maxSuggestItems : g5_is_mobile ? 6 : 10,
                 width : '100%',
                 height : '100%'
             }).embed(element_layer);
@@ -719,8 +723,13 @@ function get_write_token(bo_table)
 }
 
 $(function() {
-    $(document).on("click", "form[name=fwrite] input:submit", function() {
+    $(document).on("click", "form[name=fwrite] input:submit, form[name=fwrite] button:submit, form[name=fwrite] input:image", function() {
         var f = this.form;
+
+        if (typeof(f.bo_table) == "undefined") {
+            return;
+        }
+
         var bo_table = f.bo_table.value;
         var token = get_write_token(bo_table);
 

lib/common.lib.php

@@ -153,7 +153,7 @@ function alert($msg='', $url='', $error=true, $post=false)
     global $g5, $config, $member;
     global $is_admin;
 
-    if (!$msg) $msg = '올바른 방법으로 이용해 주십시오.';
+    $msg = $msg ? strip_tags($msg, '<br>') : '올바른 방법으로 이용해 주십시오.';
 
     $header = '';
     if (isset($g5['title'])) {
@@ -168,6 +168,8 @@ function alert($msg='', $url='', $error=true, $post=false)
 function alert_close($msg, $error=true)
 {
     global $g5;
+    
+    $msg = strip_tags($msg, '<br>');
 
     $header = '';
     if (isset($g5['title'])) {
@@ -214,11 +216,12 @@ function url_auto_link($str)
     // 140326 유창화님 제안코드로 수정
     // http://sir.kr/pg_lecture/461
     // http://sir.kr/pg_lecture/463
+    $attr_nofollow = (function_exists('check_html_link_nofollow') && check_html_link_nofollow('url_auto_link')) ? ' rel="nofollow"' : '';
     $str = str_replace(array("&lt;", "&gt;", "&amp;", "&quot;", "&nbsp;", "&#039;"), array("\t_lt_\t", "\t_gt_\t", "&", "\"", "\t_nbsp_\t", "'"), $str);
     //$str = preg_replace("`(?:(?:(?:href|src)\s*=\s*(?:\"|'|)){0})((http|https|ftp|telnet|news|mms)://[^\"'\s()]+)`", "<A HREF=\"\\1\" TARGET='{$config['cf_link_target']}'>\\1</A>", $str);
-    $str = preg_replace("/([^(href=\"?'?)|(src=\"?'?)]|\(|^)((http|https|ftp|telnet|news|mms):\/\/[a-zA-Z0-9\.-]+\.[가-힣\xA1-\xFEa-zA-Z0-9\.:&#=_\?\/~\+%@;\-\|\,\(\)]+)/i", "\\1<A HREF=\"\\2\" TARGET=\"{$config['cf_link_target']}\">\\2</A>", $str);
-    $str = preg_replace("/(^|[\"'\s(])(www\.[^\"'\s()]+)/i", "\\1<A HREF=\"http://\\2\" TARGET=\"{$config['cf_link_target']}\">\\2</A>", $str);
-    $str = preg_replace("/[0-9a-z_-]+@[a-z0-9._-]{4,}/i", "<a href=\"mailto:\\0\">\\0</a>", $str);
+    $str = preg_replace("/([^(href=\"?'?)|(src=\"?'?)]|\(|^)((http|https|ftp|telnet|news|mms):\/\/[a-zA-Z0-9\.-]+\.[가-힣\xA1-\xFEa-zA-Z0-9\.:&#!=_\?\/~\+%@;\-\|\,\(\)]+)/i", "\\1<A HREF=\"\\2\" TARGET=\"{$config['cf_link_target']}\" $attr_nofollow>\\2</A>", $str);
+    $str = preg_replace("/(^|[\"'\s(])(www\.[^\"'\s()]+)/i", "\\1<A HREF=\"http://\\2\" TARGET=\"{$config['cf_link_target']}\" $attr_nofollow>\\2</A>", $str);
+    $str = preg_replace("/[0-9a-z_-]+@[a-z0-9._-]{4,}/i", "<a href=\"mailto:\\0\" $attr_nofollow>\\0</a>", $str);
     $str = str_replace(array("\t_nbsp_\t", "\t_lt_\t", "\t_gt_\t", "'"), array("&nbsp;", "&lt;", "&gt;", "&#039;"), $str);
 
     /*
@@ -536,6 +539,9 @@ function conv_content($content, $html, $filter=true)
     return $content;
 }
 
+function check_html_link_nofollow($type=''){
+    return true;
+}
 
 // http://htmlpurifier.org/
 // Standards-Compliant HTML Filtering
@@ -559,6 +565,7 @@ function html_purifier($html)
     $safeiframe = implode('|', $domains);
 
     include_once(G5_PLUGIN_PATH.'/htmlpurifier/HTMLPurifier.standalone.php');
+    include_once(G5_PLUGIN_PATH.'/htmlpurifier/extend.video.php');
     $config = HTMLPurifier_Config::createDefault();
     // data/cache 디렉토리에 CSS, HTML, URI 디렉토리 등을 만든다.
     $config->set('Cache.SerializerPath', G5_DATA_PATH.'/cache');
@@ -566,8 +573,13 @@ function html_purifier($html)
     $config->set('HTML.SafeObject', false);
     $config->set('Output.FlashCompat', false);
     $config->set('HTML.SafeIframe', true);
+    if( (function_exists('check_html_link_nofollow') && check_html_link_nofollow('html_purifier')) ){
+        $config->set('HTML.Nofollow', true);    // rel=nofollow 으로 스팸유입을 줄임
+    }
     $config->set('URI.SafeIframeRegexp','%^(https?:)?//('.$safeiframe.')%');
     $config->set('Attr.AllowedFrameTargets', array('_blank'));
+    //유튜브, 비메오 전체화면 가능하게 하기
+    $config->set('Filter.Custom', array(new HTMLPurifier_Filter_Iframevideo()));
     $purifier = new HTMLPurifier($config);
     return $purifier->purify($html);
 }
@@ -628,7 +640,7 @@ function get_sql_search($search_ca_name, $search_field, $search_text, $search_op
 
             // SQL Injection 방지
             // 필드값에 a-z A-Z 0-9 _ , | 이외의 값이 있다면 검색필드를 wr_subject 로 설정한다.
-            $field[$k] = preg_match("/^[\w\,\|]+$/", $field[$k]) ? $field[$k] : "wr_subject";
+            $field[$k] = preg_match("/^[\w\,\|]+$/", $field[$k]) ? strtolower($field[$k]) : "wr_subject";
 
             $str .= $op2;
             switch ($field[$k]) {
@@ -1211,8 +1223,8 @@ function get_sideview($mb_id, $name='', $email='', $homepage='')
 
     $tmp_name = "";
     if ($mb_id) {
-        //$tmp_name = "<a href=\"".G5_BBS_URL."/profile.php?mb_id=".$mb_id."\" class=\"sv_member\" title=\"$name 자기소개\" target=\"_blank\" onclick=\"return false;\">$name</a>";
-        $tmp_name = '<a href="'.G5_BBS_URL.'/profile.php?mb_id='.$mb_id.'" class="sv_member" title="'.$name.' 자기소개" target="_blank" onclick="return false;">';
+        //$tmp_name = "<a href=\"".G5_BBS_URL."/profile.php?mb_id=".$mb_id."\" class=\"sv_member\" title=\"$name 자기소개\" rel="nofollow" target=\"_blank\" onclick=\"return false;\">$name</a>";
+        $tmp_name = '<a href="'.G5_BBS_URL.'/profile.php?mb_id='.$mb_id.'" class="sv_member" title="'.$name.' 자기소개" target="_blank" rel="nofollow" onclick="return false;">';
 
         if ($config['cf_use_member_icon']) {
             $mb_dir = substr($mb_id,0,2);
@@ -1239,7 +1251,7 @@ function get_sideview($mb_id, $name='', $email='', $homepage='')
         if(!$bo_table)
             return $name;
 
-        $tmp_name = '<a href="'.G5_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;sca='.$sca.'&amp;sfl=wr_name,1&amp;stx='.$name.'" title="'.$name.' 이름으로 검색" class="sv_guest" onclick="return false;">'.$name.'</a>';
+        $tmp_name = '<a href="'.G5_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;sca='.$sca.'&amp;sfl=wr_name,1&amp;stx='.$name.'" title="'.$name.' 이름으로 검색" class="sv_guest" rel="nofollow" onclick="return false;">'.$name.'</a>';
         $title_mb_id = '[비회원]';
     }
 
@@ -2019,8 +2031,12 @@ function sql_real_escape_string($str, $link=null)
 
     if(!$link)
         $link = $g5['connect_db'];
+    
+    if(function_exists('mysqli_connect') && G5_MYSQLI_USE) {
+        return mysqli_real_escape_string($link, $str);
+    }
 
-    return mysqli_real_escape_string($link, $str);
+    return mysql_real_escape_string($str, $link);
 }
 
 function escape_trim($field)
@@ -2131,6 +2147,10 @@ function check_device($device)
 // 게시판 최신글 캐시 파일 삭제
 function delete_cache_latest($bo_table)
 {
+    if (!preg_match("/^([A-Za-z0-9_]{1,20})$/", $bo_table)) {
+        return;
+    }
+
     $files = glob(G5_DATA_PATH.'/cache/latest-'.$bo_table.'-*');
     if (is_array($files)) {
         foreach ($files as $filename)
@@ -2666,7 +2686,10 @@ if (!function_exists("get_sock")) {
         $fp = fsockopen ($host, 80, $errno, $errstr, 30);
         if (!$fp)
         {
-            die("$errstr ($errno)\n");
+            //die("$errstr ($errno)\n");
+
+            echo "$errstr ($errno)\n";
+            return null;
         }
         else
         {
@@ -2929,9 +2952,13 @@ function replace_filename($name)
     @session_start();
     $ss_id = session_id();
     $usec = get_microtime();
-    $ext = array_pop(explode('.', $name));
+    $file_path = pathinfo($name);
+    $ext = $file_path['extension'];
+    $return_filename = sha1($ss_id.$_SERVER['REMOTE_ADDR'].$usec); 
+    if( $ext )
+        $return_filename .= '.'.$ext;
 
-    return sha1($ss_id.$_SERVER['REMOTE_ADDR'].$usec).'.'.$ext;
+    return $return_filename;
 }
 
 // 아이코드 사용자정보
@@ -2988,15 +3015,32 @@ function check_url_host($url, $msg='', $return_url=G5_URL)
 
     $p = @parse_url($url);
     $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
+    $is_host_check = false;
 
     if(stripos($url, 'http:') !== false) {
         if(!isset($p['scheme']) || !$p['scheme'] || !isset($p['host']) || !$p['host'])
             alert('url 정보가 올바르지 않습니다.', $return_url);
     }
 
-    if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host'])) {
+    //php 5.6.29 이하 버전에서는 parse_url 버그가 존재함
+    if ( (isset($p['host']) && $p['host']) && version_compare(PHP_VERSION, '5.6.29') < 0) {
+        $bool_ch = false;
+        foreach( array('user','host') as $key) {
+            if ( isset( $p[ $key ] ) && strpbrk( $p[ $key ], ':/?#@' ) ) {
+                $bool_ch = true;
+            }
+        }
+        if( $bool_ch ){
+            $regex = '/https?\:\/\/'.$host.'/i';
+            if( ! preg_match($regex, $url) ){
+                $is_host_check = true;
+            }
+        }
+    }
+
+    if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host']) || $is_host_check) {
         //if ($p['host'].(isset($p['port']) ? ':'.$p['port'] : '') != $_SERVER['HTTP_HOST']) {
-        if ($p['host'] != $host) {
+        if ( ($p['host'] != $host) || $is_host_check ) {
             echo '<script>'.PHP_EOL;
             echo 'alert("url에 타 도메인을 지정할 수 없습니다.");'.PHP_EOL;
             echo 'document.location.href = "'.$return_url.'";'.PHP_EOL;
@@ -3197,7 +3241,7 @@ class str_encrypt
     function __construct($salt='')
     {
         if(!$salt)
-            $this->salt = md5(G5_MYSQL_PASSWORD);
+            $this->salt = md5(preg_replace('/[^0-9A-Za-z]/', substr(G5_MYSQL_USER, -1), G5_MYSQL_PASSWORD));
         else
             $this->salt = $salt;
 
@@ -3259,4 +3303,81 @@ function check_write_token($bo_table)
 
     return true;
 }
+
+function get_call_func_cache($func, $args=array()){
+    
+    static $cache = array();
+
+    $key = md5(serialize($args));
+
+    if( isset($cache[$func]) && isset($cache[$func][$key]) ){
+        return $cache[$func][$key];
+    }
+
+    $result = null;
+
+    try{
+        $cache[$func][$key] = $result = call_user_func_array($func, $args);
+    } catch (Exception $e) {
+        return null;
+    }
+    
+    return $result;
+}
+
+// include 하는 경로에 data file 경로가 포함되어 있는지 체크합니다.
+function is_include_path_check($path='', $is_input='')
+{
+    if( $path ){
+        if ($is_input){
+            try {
+                // whether $path is unix or not
+                $unipath = strlen($path)==0 || $path{0}!='/';
+                $unc = substr($path,0,2)=='\\\\'?true:false;
+                // attempts to detect if path is relative in which case, add cwd
+                if(strpos($path,':') === false && $unipath && !$unc){
+                    $path=getcwd().DIRECTORY_SEPARATOR.$path;
+                    if($path{0}=='/'){
+                        $unipath = false;
+                    }
+                }
+
+                // resolve path parts (single dot, double dot and double delimiters)
+                $path = str_replace(array('/', '\\'), DIRECTORY_SEPARATOR, $path);
+                $parts = array_filter(explode(DIRECTORY_SEPARATOR, $path), 'strlen');
+                $absolutes = array();
+                foreach ($parts as $part) {
+                    if ('.'  == $part){
+                        continue;
+                    }
+                    if ('..' == $part) {
+                        array_pop($absolutes);
+                    } else {
+                        $absolutes[] = $part;
+                    }
+                }
+                $path = implode(DIRECTORY_SEPARATOR, $absolutes);
+                // resolve any symlinks
+                // put initial separator that could have been lost
+                $path = !$unipath ? '/'.$path : $path;
+                $path = $unc ? '\\\\'.$path : $path;
+            } catch (Exception $e) {
+                //echo 'Caught exception: ',  $e->getMessage(), "\n";
+                return false;
+            }
+
+            if( preg_match('/\/data\/(file|editor)\/[A-Za-z0-9_]{1,20}\//', $path) ){
+                return false;
+            }
+        }
+
+        $extension = pathinfo($path, PATHINFO_EXTENSION);
+        
+        if($extension && preg_match('/(jpg|jpeg|png|gif|bmp|conf)$/', $extension)) {
+            return false;
+        }
+    }
+
+    return true;
+}
 ?>

lib/latest.lib.php

@@ -66,7 +66,7 @@ function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time=
 
         if($cache_fwrite) {
             $handle = fopen($cache_file, 'w');
-            $cache_content = "<?php\nif (!defined('_GNUBOARD_')) exit;\n\$bo_subject='".$bo_subject."';\n\$list=".var_export($list, true)."?>";
+            $cache_content = "<?php\nif (!defined('_GNUBOARD_')) exit;\n\$bo_subject='".sql_escape_string($bo_subject)."';\n\$list=".var_export($list, true)."?>";
             fwrite($handle, $cache_content);
             fclose($handle);
         }

lib/thumbnail.lib.php

@@ -4,7 +4,7 @@ if (!defined('_GNUBOARD_')) exit;
 @ini_set('memory_limit', '-1');
 
 // 게시글리스트 썸네일 생성
-function get_list_thumbnail($bo_table, $wr_id, $thumb_width, $thumb_height, $is_create=false, $is_crop=true, $crop_mode='center', $is_sharpen=false, $um_value='80/0.5/3')
+function get_list_thumbnail($bo_table, $wr_id, $thumb_width, $thumb_height, $is_create=false, $is_crop=false, $crop_mode='center', $is_sharpen=false, $um_value='80/0.5/3')
 {
     global $g5, $config;
     $filename = $alt = "";
@@ -238,10 +238,10 @@ function thumbnail($filename, $source_path, $target_path, $thumb_width, $thumb_h
     $degree = 0;
 
     if ($size[2] == 1) {
-        $src = imagecreatefromgif($source_file);
-        $src_transparency = imagecolortransparent($src);
+        $src = @imagecreatefromgif($source_file);
+        $src_transparency = @imagecolortransparent($src);
     } else if ($size[2] == 2) {
-        $src = imagecreatefromjpeg($source_file);
+        $src = @imagecreatefromjpeg($source_file);
 
         if(function_exists('exif_read_data')) {
             // exif 정보를 기준으로 회전각도 구함
@@ -273,8 +273,8 @@ function thumbnail($filename, $source_path, $target_path, $thumb_width, $thumb_h
             }
         }
     } else if ($size[2] == 3) {
-        $src = imagecreatefrompng($source_file);
-        imagealphablending($src, true);
+        $src = @imagecreatefrompng($source_file);
+        @imagealphablending($src, true);
     } else {
         return;
     }
@@ -284,6 +284,7 @@ function thumbnail($filename, $source_path, $target_path, $thumb_width, $thumb_h
 
     $is_large = true;
     // width, height 설정
+
     if($thumb_width) {
         if(!$thumb_height) {
             $thumb_height = round(($thumb_width * $size[1]) / $size[0]);
@@ -330,20 +331,51 @@ function thumbnail($filename, $source_path, $target_path, $thumb_width, $thumb_h
                     }
                     break;
             }
-        }
 
-        $dst = imagecreatetruecolor($dst_w, $dst_h);
+            $dst = imagecreatetruecolor($dst_w, $dst_h);
 
-        if($size[2] == 3) {
-            imagealphablending($dst, false);
-            imagesavealpha($dst, true);
-        } else if($size[2] == 1) {
-            $palletsize = imagecolorstotal($src);
-            if($src_transparency >= 0 && $src_transparency < $palletsize) {
-                $transparent_color   = imagecolorsforindex($src, $src_transparency);
-                $current_transparent = imagecolorallocate($dst, $transparent_color['red'], $transparent_color['green'], $transparent_color['blue']);
-                imagefill($dst, 0, 0, $current_transparent);
-                imagecolortransparent($dst, $current_transparent);
+            if($size[2] == 3) {
+                imagealphablending($dst, false);
+                imagesavealpha($dst, true);
+            } else if($size[2] == 1) {
+                $palletsize = imagecolorstotal($src);
+                if($src_transparency >= 0 && $src_transparency < $palletsize) {
+                    $transparent_color   = imagecolorsforindex($src, $src_transparency);
+                    $current_transparent = imagecolorallocate($dst, $transparent_color['red'], $transparent_color['green'], $transparent_color['blue']);
+                    imagefill($dst, 0, 0, $current_transparent);
+                    imagecolortransparent($dst, $current_transparent);
+                }
+            }
+        } else { // 비율에 맞게 생성
+            $dst = imagecreatetruecolor($dst_w, $dst_h);
+            $bgcolor = imagecolorallocate($dst, 255, 255, 255); // 배경색
+            if($src_w > $src_h) {
+                $tmp_h = round(($dst_w * $src_h) / $src_w);
+                $dst_y = round(($dst_h - $tmp_h) / 2);
+                $dst_h = $tmp_h;
+            } else {
+                $tmp_w = round(($dst_h * $src_w) / $src_h);
+                $dst_x = round(($dst_w - $tmp_w) / 2);
+                $dst_w = $tmp_w;
+            }
+
+            if($size[2] == 3) {
+                $bgcolor = imagecolorallocatealpha($dst, 0, 0, 0, 127);
+                imagefill($dst, 0, 0, $bgcolor);
+                imagealphablending($dst, false);
+                imagesavealpha($dst, true);
+            } else if($size[2] == 1) {
+                $palletsize = imagecolorstotal($src);
+                if($src_transparency >= 0 && $src_transparency < $palletsize) {
+                    $transparent_color   = imagecolorsforindex($src, $src_transparency);
+                    $current_transparent = imagecolorallocate($dst, $transparent_color['red'], $transparent_color['green'], $transparent_color['blue']);
+                    imagefill($dst, 0, 0, $current_transparent);
+                    imagecolortransparent($dst, $current_transparent);
+                } else {
+                    imagefill($dst, 0, 0, $bgcolor);
+                }
+            } else {
+                imagefill($dst, 0, 0, $bgcolor);
             }
         }
     } else {
@@ -352,8 +384,14 @@ function thumbnail($filename, $source_path, $target_path, $thumb_width, $thumb_h
 
         if($src_w < $dst_w) {
             if($src_h >= $dst_h) {
-                $dst_x = round(($dst_w - $src_w) / 2);
-                $src_h = $dst_h;
+                if( $src_h > $src_w ){
+                    $tmp_w = round(($dst_h * $src_w) / $src_h);
+                    $dst_x = round(($dst_w - $tmp_w) / 2);
+                    $dst_w = $tmp_w;
+                } else {
+                    $dst_x = round(($dst_w - $src_w) / 2);
+                    $src_h = $dst_h;
+                }
             } else {
                 $dst_x = round(($dst_w - $src_w) / 2);
                 $dst_y = round(($dst_h - $src_h) / 2);
@@ -362,9 +400,15 @@ function thumbnail($filename, $source_path, $target_path, $thumb_width, $thumb_h
             }
         } else {
             if($src_h < $dst_h) {
-                $dst_y = round(($dst_h - $src_h) / 2);
-                $dst_h = $src_h;
-                $src_w = $dst_w;
+                if( $src_w > $dst_w ){
+                    $tmp_h = round(($dst_w * $src_h) / $src_w);
+                    $dst_y = round(($dst_h - $tmp_h) / 2);
+                    $dst_h = $tmp_h;
+                } else {
+                    $dst_y = round(($dst_h - $src_h) / 2);
+                    $dst_h = $src_h;
+                    $src_w = $dst_w;
+                }
             }
         }
 

mobile/skin/board/basic/view_comment.skin.php

@@ -83,7 +83,7 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
     ?>
     <aside id="bo_vc_w">
         <h2>댓글쓰기</h2>
-        <form name="fviewcomment" action="./write_comment_update.php" onsubmit="return fviewcomment_submit(this);" method="post" autocomplete="off">
+        <form name="fviewcomment" action="<?php echo $comment_action_url; ?>" onsubmit="return fviewcomment_submit(this);" method="post" autocomplete="off">
         <input type="hidden" name="w" value="<?php echo $w ?>" id="w">
         <input type="hidden" name="bo_table" value="<?php echo $bo_table ?>">
         <input type="hidden" name="wr_id" value="<?php echo $wr_id ?>">

mobile/skin/board/gallery/view_comment.skin.php

@@ -83,7 +83,7 @@ var char_max = parseInt(<?php echo $comment_max ?>); // 최대
     ?>
     <aside id="bo_vc_w">
         <h2>댓글쓰기</h2>
-        <form name="fviewcomment" action="./write_comment_update.php" onsubmit="return fviewcomment_submit(this);" method="post" autocomplete="off">
+        <form name="fviewcomment" action="<?php echo $comment_action_url; ?>" onsubmit="return fviewcomment_submit(this);" method="post" autocomplete="off">
         <input type="hidden" name="w" value="<?php echo $w ?>" id="w">
         <input type="hidden" name="bo_table" value="<?php echo $bo_table ?>">
         <input type="hidden" name="wr_id" value="<?php echo $wr_id ?>">

mobile/skin/member/basic/memo_form.skin.php

@@ -19,6 +19,13 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
         <table>
         <caption>쪽지쓰기</caption>
         <tbody>
+        <?php if ($config['cf_memo_send_point']) { ?>
+        <tr>
+            <td colspan="2">
+                <strong>쪽지 보낼때 회원당 <?php echo number_format($config['cf_memo_send_point']); ?>점의 포인트를 차감합니다.</strong>
+            </td>
+        </tr>
+        <?php } ?>
         <tr>
             <th scope="row"><label for="me_recv_mb_id">받는 회원아이디<strong class="sound_only">필수</strong></label></th>
             <td>

mobile/skin/member/basic/register_form.skin.php

@@ -60,7 +60,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
                 if($config['cf_cert_use']) {
                     if($config['cf_cert_ipin'])
                         echo '<button type="button" id="win_ipin_cert" class="btn_frmline">아이핀 본인확인</button>'.PHP_EOL;
-                    if($config['cf_cert_hp'] && $config['cf_cert_hp'] != 'lg')
+                    if($config['cf_cert_hp'])
                         echo '<button type="button" id="win_hp_cert" class="btn_frmline">휴대폰 본인확인</button>'.PHP_EOL;
 
                     echo '<noscript>본인확인을 위해서는 자바스크립트 사용이 가능해야합니다.</noscript>'.PHP_EOL;
@@ -288,6 +288,10 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
                     $cert_url = G5_KCPCERT_URL.'/kcpcert_form.php';
                     $cert_type = 'kcp-hp';
                     break;
+                case 'lg':
+                    $cert_url = G5_LGXPAY_URL.'/AuthOnlyReq.php';
+                    $cert_type = 'lg-hp';
+                    break;
                 default:
                     echo 'alert("기본환경설정에서 휴대폰 본인확인 설정을 해주십시오");';
                     echo 'return false;';

mobile/skin/popular/basic/popular.skin.php

@@ -9,9 +9,15 @@ add_stylesheet('<link rel="stylesheet" href="'.$popular_skin_url.'/style.css">',
     <div>
         <h2>인기검색어</h2>
         <ul>
-        <?php for ($i=0; $i<count($list); $i++) { ?>
+        <?php
+        if( isset($list) && is_array($list) ){
+            for ($i=0; $i<count($list); $i++) {
+        ?>
             <li><a href="<?php echo G5_BBS_URL ?>/search.php?sfl=wr_subject&amp;sop=and&amp;stx=<?php echo urlencode($list[$i]['pp_word']) ?>"><?php echo get_text($list[$i]['pp_word']); ?></a></li>
-        <?php } ?>
+            <?php
+            }   //end for
+        }   //end if
+        ?>
         </ul>
     </div>
 </aside>

plugin/PHPMailer/VERSION

@@ -1 +1 @@
-5.2.19
+5.2.22

plugin/PHPMailer/class.phpmailer.php

@@ -31,7 +31,7 @@ class PHPMailer
      * The PHPMailer Version number.
      * @var string
      */
-    public $Version = '5.2.19';
+    public $Version = '5.2.22';
 
     /**
      * Email priority.
@@ -1364,19 +1364,24 @@ class PHPMailer
      */
     protected function sendmailSend($header, $body)
     {
-        if (!empty($this->Sender)) {
+        // CVE-2016-10033, CVE-2016-10045: Don't pass -f if characters will be escaped.
+        if (!empty($this->Sender) and self::isShellSafe($this->Sender)) {
             if ($this->Mailer == 'qmail') {
-                $sendmail = sprintf('%s -f%s', escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
+                $sendmailFmt = '%s -f%s';
             } else {
-                $sendmail = sprintf('%s -oi -f%s -t', escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
+                $sendmailFmt = '%s -oi -f%s -t';
             }
         } else {
             if ($this->Mailer == 'qmail') {
-                $sendmail = sprintf('%s', escapeshellcmd($this->Sendmail));
+                $sendmailFmt = '%s';
             } else {
-                $sendmail = sprintf('%s -oi -t', escapeshellcmd($this->Sendmail));
+                $sendmailFmt = '%s -oi -t';
             }
         }
+
+        // TODO: If possible, this should be changed to escapeshellarg.  Needs thorough testing.
+        $sendmail = sprintf($sendmailFmt, escapeshellcmd($this->Sendmail), $this->Sender);
+
         if ($this->SingleTo) {
             foreach ($this->SingleToArray as $toAddr) {
                 if (!@$mail = popen($sendmail, 'w')) {
@@ -1422,6 +1427,40 @@ class PHPMailer
         return true;
     }
 
+    /**
+     * Fix CVE-2016-10033 and CVE-2016-10045 by disallowing potentially unsafe shell characters.
+     *
+     * Note that escapeshellarg and escapeshellcmd are inadequate for our purposes, especially on Windows.
+     * @param string $string The string to be validated
+     * @see https://github.com/PHPMailer/PHPMailer/issues/924 CVE-2016-10045 bug report
+     * @access protected
+     * @return boolean
+     */
+    protected static function isShellSafe($string)
+    {
+        // Future-proof
+        if (escapeshellcmd($string) !== $string
+            or !in_array(escapeshellarg($string), array("'$string'", "\"$string\""))
+        ) {
+            return false;
+        }
+
+        $length = strlen($string);
+
+        for ($i = 0; $i < $length; $i++) {
+            $c = $string[$i];
+
+            // All other characters have a special meaning in at least one common shell, including = and +.
+            // Full stop (.) has a special meaning in cmd.exe, but its impact should be negligible here.
+            // Note that this does permit non-Latin alphanumeric characters based on the current locale.
+            if (!ctype_alnum($c) && strpos('@_-.', $c) === false) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
     /**
      * Send mail using the PHP mail() function.
      * @param string $header The message headers
@@ -1442,7 +1481,10 @@ class PHPMailer
         $params = null;
         //This sets the SMTP envelope sender which gets turned into a return-path header by the receiver
         if (!empty($this->Sender) and $this->validateAddress($this->Sender)) {
-            $params = sprintf('-f%s', escapeshellarg($this->Sender));
+            // CVE-2016-10033, CVE-2016-10045: Don't pass -f if characters will be escaped.
+            if (self::isShellSafe($this->Sender)) {
+                $params = sprintf('-f%s', $this->Sender);
+            }
         }
         if (!empty($this->Sender) and !ini_get('safe_mode') and $this->validateAddress($this->Sender)) {
             $old_from = ini_get('sendmail_from');
@@ -2450,6 +2492,7 @@ class PHPMailer
 
     /**
      * Add an attachment from a path on the filesystem.
+     * Never use a user-supplied path to a file!
      * Returns false if the file could not be found or read.
      * @param string $path Path to the attachment.
      * @param string $name Overrides the attachment name.
@@ -2975,6 +3018,7 @@ class PHPMailer
      * displayed inline with the message, not just attached for download.
      * This is used in HTML messages that embed the images
      * the HTML refers to using the $cid value.
+     * Never use a user-supplied path to a file!
      * @param string $path Path to the attachment.
      * @param string $cid Content ID of the attachment; Use this to reference
      *        the content when using an embedded image in HTML.
@@ -3338,12 +3382,14 @@ class PHPMailer
      * Create a message body from an HTML string.
      * Automatically inlines images and creates a plain-text version by converting the HTML,
      * overwriting any existing values in Body and AltBody.
-     * $basedir is used when handling relative image paths, e.g. <img src="images/a.png">
+     * Do not source $message content from user input!
+     * $basedir is prepended when handling relative URLs, e.g. <img src="/images/a.png"> and must not be empty
      * will look for an image file in $basedir/images/a.png and convert it to inline.
-     * If you don't want to apply these transformations to your HTML, just set Body and AltBody yourself.
+     * If you don't provide a $basedir, relative paths will be left untouched (and thus probably break in email)
+     * If you don't want to apply these transformations to your HTML, just set Body and AltBody directly.
      * @access public
      * @param string $message HTML message string
-     * @param string $basedir base directory for relative paths to images
+     * @param string $basedir Absolute path to a base directory to prepend to relative paths to images
      * @param boolean|callable $advanced Whether to use the internal HTML to text converter
      *    or your own custom converter @see PHPMailer::html2text()
      * @return string $message The transformed message Body
@@ -3352,6 +3398,10 @@ class PHPMailer
     {
         preg_match_all('/(src|background)=["\'](.*)["\']/Ui', $message, $images);
         if (array_key_exists(2, $images)) {
+            if (strlen($basedir) > 1 && substr($basedir, -1) != '/') {
+                // Ensure $basedir has a trailing /
+                $basedir .= '/';
+            }
             foreach ($images[2] as $imgindex => $url) {
                 // Convert data URIs into embedded images
                 if (preg_match('#^data:(image[^;,]*)(;base64)?,#', $url, $match)) {
@@ -3369,18 +3419,24 @@ class PHPMailer
                             $message
                         );
                     }
-                } elseif (substr($url, 0, 4) !== 'cid:' && !preg_match('#^[a-z][a-z0-9+.-]*://#i', $url)) {
-                    // Do not change urls for absolute images (thanks to corvuscorax)
+                    continue;
+                }
+                if (
+                    // Only process relative URLs if a basedir is provided (i.e. no absolute local paths)
+                    !empty($basedir)
+                    // Ignore URLs containing parent dir traversal (..)
+                    && (strpos($url, '..') === false)
                     // Do not change urls that are already inline images
+                    && substr($url, 0, 4) !== 'cid:'
+                    // Do not change absolute URLs, including anonymous protocol
+                    && !preg_match('#^[a-z][a-z0-9+.-]*:?//#i', $url)
+                ) {
                     $filename = basename($url);
                     $directory = dirname($url);
                     if ($directory == '.') {
                         $directory = '';
                     }
                     $cid = md5($url) . '@phpmailer.0'; // RFC2392 S 2
-                    if (strlen($basedir) > 1 && substr($basedir, -1) != '/') {
-                        $basedir .= '/';
-                    }
                     if (strlen($directory) > 1 && substr($directory, -1) != '/') {
                         $directory .= '/';
                     }

plugin/PHPMailer/class.pop3.php

@@ -34,7 +34,7 @@ class POP3
      * @var string
      * @access public
      */
-    public $Version = '5.2.19';
+    public $Version = '5.2.22';
 
     /**
      * Default POP3 port number.

plugin/PHPMailer/class.smtp.php

@@ -30,7 +30,7 @@ class SMTP
      * The PHPMailer SMTP version number.
      * @var string
      */
-    const VERSION = '5.2.19';
+    const VERSION = '5.2.22';
 
     /**
      * SMTP line break constant.
@@ -81,7 +81,7 @@ class SMTP
      * @deprecated Use the `VERSION` constant instead
      * @see SMTP::VERSION
      */
-    public $Version = '5.2.19';
+    public $Version = '5.2.22';
 
     /**
      * SMTP server port number.

plugin/PHPMailer/examples/contactform.phps

@@ -0,0 +1,71 @@
+<?php
+/**
+ * This example shows how to handle a simple contact form.
+ */
+
+$msg = '';
+//Don't run this unless we're handling a form submission
+if (array_key_exists('email', $_POST)) {
+    date_default_timezone_set('Etc/UTC');
+
+    require '../PHPMailerAutoload.php';
+
+    //Create a new PHPMailer instance
+    $mail = new PHPMailer;
+    //Tell PHPMailer to use SMTP - requires a local mail server
+    //Faster and safer than using mail()
+    $mail->isSMTP();
+    $mail->Host = 'localhost';
+    $mail->Port = 25;
+
+    //Use a fixed address in your own domain as the from address
+    //**DO NOT** use the submitter's address here as it will be forgery
+    //and will cause your messages to fail SPF checks
+    $mail->setFrom('from@example.com', 'First Last');
+    //Send the message to yourself, or whoever should receive contact for submissions
+    $mail->addAddress('whoto@example.com', 'John Doe');
+    //Put the submitter's address in a reply-to header
+    //This will fail if the address provided is invalid,
+    //in which case we should ignore the whole request
+    if ($mail->addReplyTo($_POST['email'], $_POST['name'])) {
+        $mail->Subject = 'PHPMailer contact form';
+        //Keep it simple - don't use HTML
+        $mail->isHTML(false);
+        //Build a simple message body
+        $mail->Body = <<<EOT
+Email: {$_POST['email']}
+Name: {$_POST['name']}
+Message: {$_POST['message']}
+EOT;
+        //Send the message, check for errors
+        if (!$mail->send()) {
+            //The reason for failing to send will be in $mail->ErrorInfo
+            //but you shouldn't display errors to users - process the error, log it on your server.
+            $msg = 'Sorry, something went wrong. Please try again later.';
+        } else {
+            $msg = 'Message sent! Thanks for contacting us.';
+        }
+    } else {
+        $msg = 'Invalid email address, message ignored.';
+    }
+}
+?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Contact form</title>
+</head>
+<body>
+<h1>Contact us</h1>
+<?php if (!empty($msg)) {
+    echo "<h2>$msg</h2>";
+} ?>
+<form method="POST">
+    <label for="name">Name: <input type="text" name="name" id="name"></label><br>
+    <label for="email">Email address: <input type="email" name="email" id="email"></label><br>
+    <label for="message">Message: <textarea name="message" id="message" rows="8" cols="20"></textarea></label><br>
+    <input type="submit" value="Send">
+</form>
+</body>
+</html>

plugin/PHPMailer/examples/contentsutf8.html

@@ -15,6 +15,7 @@
   <p>Russian text: Пустое тело сообщения</p>
   <p>Armenian text: Հաղորդագրությունը դատարկ է</p>
   <p>Czech text: Prázdné tělo zprávy</p>
+  <p>Emoji: <span style="font-size: 48px">😂 🦄 💥 📤 📧</span></p>
 </div>
 </body>
 </html>

plugin/PHPMailer/examples/scripts/XRegExp.js

@@ -259,7 +259,7 @@ if (XRegExp) {
 
 
     //---------------------------------
-    //  Overriden native methods
+    //  Overridden native methods
     //---------------------------------
 
     // Adds named capture support (with backreferences returned as `result.name`), and fixes two

plugin/PHPMailer/examples/send_file_upload.phps

@@ -17,7 +17,7 @@ if (array_key_exists('userfile', $_FILES)) {
         $mail->setFrom('from@example.com', 'First Last');
         $mail->addAddress('whoto@example.com', 'John Doe');
         $mail->Subject = 'PHPMailer file sender';
-        $mail->msgHTML("My message body");
+        $mail->Body = 'My message body';
         // Attach the uploaded file
         $mail->addAttachment($uploadfile, 'My uploaded file');
         if (!$mail->send()) {

plugin/PHPMailer/examples/send_multiple_file_upload.phps

@@ -12,7 +12,7 @@ if (array_key_exists('userfile', $_FILES)) {
     $mail->setFrom('from@example.com', 'First Last');
     $mail->addAddress('whoto@example.com', 'John Doe');
     $mail->Subject = 'PHPMailer file sender';
-    $mail->msgHTML('My message body');
+    $mail->Body = 'My message body';
     //Attach multiple files one by one
     for ($ct = 0; $ct < count($_FILES['userfile']['tmp_name']); $ct++) {
         $uploadfile = tempnam(sys_get_temp_dir(), sha1($_FILES['userfile']['name'][$ct]));

plugin/PHPMailer/extras/htmlfilter.php

@@ -433,7 +433,7 @@ function tln_getnxtag($body, $offset)
  *
  * @param string $attvalue the by-ref value to check.
  * @param string $regex    the regular expression to check against.
- * @param boolean $hex        whether the entites are hexadecimal.
+ * @param boolean $hex        whether the entities are hexadecimal.
  * @return boolean            True or False depending on whether there were matches.
  */
 function tln_deent(&$attvalue, $regex, $hex = false)
@@ -772,7 +772,7 @@ function tln_fixstyle($body, $pos, $trans_image_path, $block_external_images)
     tln_defang($contentTemp);
     tln_unspace($contentTemp);
 
-    $match   = Array('/\/\*.*\*\//',
+    $match   = array('/\/\*.*\*\//',
                     '/expression/i',
                     '/behaviou*r/i',
                     '/binding/i',
@@ -780,7 +780,7 @@ function tln_fixstyle($body, $pos, $trans_image_path, $block_external_images)
                     '/javascript/i',
                     '/script/i',
                     '/position/i');
-    $replace = Array('','idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy', '');
+    $replace = array('','idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy', '');
     $contentNew = preg_replace($match, $replace, $contentTemp);
     if ($contentNew !== $contentTemp) {
         $content = $contentNew;

plugin/editor/cheditor5/backup_template.xml

@@ -0,0 +1,380 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+// ================================================================
+//                       CHEditor Template
+// ================================================================
+-->
+<Template>
+    <Container>
+        <Html>
+            <![CDATA[
+                <div class="cheditor-container">
+                    <div id="toolbar" style="padding:4px;height:47px"></div>
+                    <div id="editWrapper" class="cheditor-editarea-wrapper">
+                        <iframe frameborder="0" class="cheditor-editarea"></iframe>
+                        <textarea class="cheditor-editarea-text-content" spellcheck="false"></textarea>
+                    </div>
+                    <div id="modifyBlock" class="cheditor-modify-block"></div>
+                    <div id="tagPath" class="cheditor-tag-path">
+                        <span class="cheditor-status-bar">&lt;html&gt; </span>
+                    </div>
+                    <div id="resizeBar" class="cheditor-resizebar"></div>
+                    <div id="viewMode" class="cheditor-viewmode">
+                        <div id="rich" class="cheditor-tab-rich" title="입력 모드" alt="">&#160;</div>
+                        <div id="code" class="cheditor-tab-code-off" title="HTML 편집" alt="">&#160;</div>
+                        <div id="preview" class="cheditor-tab-preview-off" title="미리 보기" alt="">&#160;</div>
+                    </div>
+                </div>
+            ]]>
+        </Html>
+    </Container>
+    <PopupWindow>
+        <Html>
+            <![CDATA[
+                <div class="cheditor-popup-window" onselectstart="return false">
+                    <div class="cheditor-popup-drag-handle">
+                        <div class="cheditor-popup-titlebar">
+                            <span><label class="cheditor-popup-title"></label></span>
+                        </div>
+                    </div>
+                    <div class="cheditor-popup-cframe" id="cheditor-popup-cframe"></div>
+                </div>
+            ]]>
+        </Html>
+    </PopupWindow>
+    <Toolbar>
+        <Image file="toolbar.png" />
+        <Group name="Print">
+            <Button name="Print" tooltip="인쇄">
+                <Attribute class="cheditor-tb-bg" width="24" height="23">
+                    <Icon position="0" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="doCmd" value="Print" />
+                </Attribute>
+            </Button>
+            <Button name="NewDocument" tooltip="새 문서">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="16" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="NewDocument" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="Undo">
+            <Button name="Undo" tooltip="되돌리기">
+                <Attribute class="cheditor-tb-bg" width="24" height="23">
+                    <Icon position="32" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="doCmd" value="Undo" />
+                </Attribute>
+            </Button>
+            <Button name="Redo" tooltip="다시 실행">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="48" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="Redo" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="Edit">
+            <Button name="Copy" tooltip="복사하기">
+                <Attribute class="cheditor-tb-bg" width="24" height="23" check="1">
+                    <Icon position="64" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="doCmd" value="Copy" />
+                </Attribute>
+            </Button>
+            <Button name="Cut" tooltip="오려두기">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" check="1">
+                    <Icon position="80" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="Cut" />
+                </Attribute>
+            </Button>
+            <Button name="Paste" tooltip="텍스트로 붙이기">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="96" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="Paste" />
+                </Attribute>
+            </Button>
+            <Button name="PasteFromWord" tooltip="MS 워드 붙이기">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="112" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd"  value="PasteFromWord" />
+                </Attribute>
+            </Button>
+            <Button name="SelectAll" tooltip="전체 선택">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="128" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="SelectAll" />
+                </Attribute>
+            </Button>
+        </Group>
+       <Group name="Color">
+            <Button name="BackColor" tooltip="형광펜">
+                <Attribute class="cheditor-tb-bg30" width="30" default="#fff" height="23" check="1">
+                    <Icon position="240" width="23" class="cheditor-tb-icon23" />
+                    <Execution method="showPulldown" value="BackColor" />
+                </Attribute>
+            </Button>
+            <Button name="ForeColor" tooltip="글자색">
+                <Attribute class="cheditor-tb-bg30" width="30" default="#000" height="23" check="1">
+                    <Icon position="263" width="23" class="cheditor-tb-icon23" />
+                    <Execution method="showPulldown" value="ForeColor" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="Format">
+            <Button name="Bold" tooltip="진하게">
+                <Attribute class="cheditor-tb-bg" width="24" height="23" check="1">
+                    <Icon position="144" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="doCmd" value="Bold" />
+                </Attribute>
+            </Button>
+            <Button name="Italic" tooltip="기울임">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" check="1">
+                    <Icon position="160" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="Italic" />
+                </Attribute>
+            </Button>
+            <Button name="Underline" tooltip="밑줄">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" check="1">
+                    <Icon position="176" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="Underline" />
+                </Attribute>
+            </Button>
+            <Button name="Strikethrough" tooltip="취소선">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" check="1">
+                    <Icon position="192" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="Strikethrough" />
+                </Attribute>
+            </Button>
+            <Button name="Superscript" tooltip="위 첨자">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" use="" check="1">
+                    <Icon position="208" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="Superscript" />
+                </Attribute>
+            </Button>
+            <Button name="Subscript" tooltip="아래 첨자">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" use="" check="1">
+                    <Icon position="224" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="Subscript" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="Alignment">
+            <Button name="JustifyLeft" tooltip="왼쪽 정렬">
+                <Attribute class="cheditor-tb-bg" width="24" height="23" check="1">
+                    <Icon position="286" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="doCmd" value="JustifyLeft" />
+                </Attribute>
+            </Button>
+            <Button name="JustifyCenter" tooltip="가운데 정렬">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" check="1">
+                    <Icon position="302" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="JustifyCenter" />
+                </Attribute>
+            </Button>
+            <Button name="JustifyRight" tooltip="오른쪽 정렬">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" check="1">
+                    <Icon position="318" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="JustifyRight" />
+                </Attribute>
+            </Button>
+            <Button name="JustifyFull" tooltip="양쪽 정렬">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" check="1">
+                    <Icon position="334" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="JustifyFull" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="List">
+            <Button name="OrderedList" tooltip="문단 번호">
+                <Attribute class="cheditor-tb-bg" width="24" height="23" check="1" type="combo">
+                    <Icon position="350" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="doCmd" value="InsertOrderedList" />
+                </Attribute>
+            </Button>
+            <Button name="OrderedListCombo" tooltip="문단 번호 확장">
+                <Attribute class="cheditor-tb-bgcombo" width="10" height="23" type="combobox" node="OrderedList">
+                    <Icon width="10" class="cheditor-tb-combo" margin="0px" />
+                    <Execution method="showPulldown" value="OrderedList" />
+                </Attribute>
+            </Button>
+            <Button name="UnOrderedList" tooltip="글 머리표">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" check="1" type="combo">
+                    <Icon position="366" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="InsertUnOrderedList" />
+                </Attribute>
+            </Button>
+            <Button name="UnOrderedListCombo" tooltip="글 머리표 확장">
+                <Attribute class="cheditor-tb-bgcombo" width="10" height="23" type="combobox" node="UnOrderedList">
+                    <Icon width="10" class="cheditor-tb-combo" margin="0px" />
+                    <Execution method="showPulldown" value="UnOrderedList" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="Outdent">
+            <Button name="Outdent" tooltip="왼쪽 여백 줄이기">
+                <Attribute class="cheditor-tb-bg" width="24" height="23">
+                    <Icon position="382" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="Outdent" />
+                </Attribute>
+            </Button>
+            <Button name="Indent" tooltip="왼쪽 여백 늘이기">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="398" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="Indent" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="Split">
+        </Group>
+        <Group name="FormatBlock">
+            <Button name="FormatBlock" tooltip="스타일">
+                <Attribute class="cheditor-tb-bg55" width="55" height="23" check="1">
+                    <Icon class="cheditor-tb-text" alt="스타일" />
+                    <Execution method="showPulldown" value="FormatBlock" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="FontName">
+            <Button name="FontName" tooltip="글꼴">
+                <Attribute class="cheditor-tb-bg55" width="55" height="23" check="1">
+                    <Icon class="cheditor-tb-text" alt="굴림" />
+                    <Execution method="showPulldown" value="FontName" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="FontSize">
+            <Button name="FontSize" tooltip="글꼴 크기">
+                <Attribute class="cheditor-tb-bg40" width="41" height="23" check="1">
+                    <Icon class="cheditor-tb-text" alt="9pt" />
+                    <Execution method="showPulldown" value="FontSize" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="LineHeight">
+            <Button name="LineHeight" tooltip="줄 간격">
+                <Attribute class="cheditor-tb-bg55" width="55" height="23" check="1">
+                    <Icon class="cheditor-tb-text" alt="줄 간격" />
+                    <Execution method="showPulldown" value="LineHeight" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="RemoveFormat">
+            <Button name="RemoveFormat" tooltip="서식 지우기">
+                <Attribute class="cheditor-tb-bg" width="24" height="23">
+                    <Icon position="414" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="doCmd" value="RemoveFormat" />
+                </Attribute>
+            </Button>
+            <Button name="ClearTag" tooltip="모든 HTML 태그 제거">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="430" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="ClearTag" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="Insert">
+            <Button name="TextBlock" tooltip="글 상자">
+                <Attribute class="cheditor-tb-bg" width="24" height="23" check="1">
+                    <Icon position="446" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="showPulldown" value="TextBlock" />
+                </Attribute>
+            </Button>
+            <Button name="Symbol" tooltip="특수 문자">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="462" width="16" class="cheditor-tb-icon" />
+                    <Execution method="windowOpen" value="Symbol" />
+                </Attribute>
+            </Button>
+            <Button name="HR" tooltip="가로줄">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="478" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="InsertHorizontalRule" />
+                </Attribute>
+            </Button>
+            <Button name="SmileyIcon" tooltip="표정 아이콘">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="494" width="16" class="cheditor-tb-icon" />
+                    <Execution method="windowOpen" value="EmotionIcon" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="Table">
+            <Button name="Table" tooltip="표 만들기">
+                <Attribute class="cheditor-tb-bg" width="24" height="23">
+                    <Icon position="510" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="windowOpen" value="Table" />
+                </Attribute>
+            </Button>
+            <Button name="ModifyTable" tooltip="표 수정">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="526" width="16" class="cheditor-tb-icon" />
+                    <Execution method="windowOpen" value="ModifyTable" />
+                </Attribute>
+            </Button>
+            <Button name="Layout" tooltip="레이아웃">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="542" width="16" class="cheditor-tb-icon" />
+                    <Execution method="windowOpen" value="Layout" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="Link">
+            <Button name="Link" tooltip="하이퍼링크">
+                <Attribute class="cheditor-tb-bg" width="24" height="23">
+                    <Icon position="558" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="windowOpen" value="Link" />
+                </Attribute>
+            </Button>
+            <Button name="UnLink" tooltip="하이퍼링크 없애기">
+                <Attribute class="cheditor-tb-bg" width="23" height="23" check="1">
+                    <Icon position="574" width="16" class="cheditor-tb-icon" />
+                    <Execution method="doCmd" value="UnLink" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="ImageUpload">
+            <Button name="Image" tooltip="내 PC 사진 넣기">
+                <Attribute class="cheditor-tb-bg44" width="50" height="23">
+                    <Icon position="590" width="36" class="cheditor-tb-icon36" margin="6px" />
+                    <Execution method="windowOpen" value="ImageUpload" />
+                </Attribute>
+            </Button>
+
+        </Group>
+        <Group name="ImageWeb">
+            <Button name="ImageUrl" tooltip="웹 사진">
+                <Attribute class="cheditor-tb-bg44" width="50" height="23">
+                    <Icon position="626" width="36" class="cheditor-tb-icon36" margin="6px" />
+                    <Execution method="windowOpen" value="ImageUrl" />
+                </Attribute>
+            </Button>
+
+        </Group>
+        <Group name="Media">
+            <Button name="Flash" tooltip="플래쉬 동영상">
+                <Attribute class="cheditor-tb-bg" width="24" height="23">
+                    <Icon position="662" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="windowOpen" value="FlashMovie" />
+                </Attribute>
+            </Button>
+            <Button name="Media" tooltip="미디어">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="678" width="16" class="cheditor-tb-icon" />
+                    <Execution method="windowOpen" value="Embed" />
+                </Attribute>
+            </Button>
+            <Button name="Map" tooltip="지도">
+                <Attribute class="cheditor-tb-bg" width="23" height="23">
+                    <Icon position="694" width="16" class="cheditor-tb-icon" />
+                    <Execution method="windowOpen" value="GoogleMap" />
+                </Attribute>
+            </Button>
+        </Group>
+        <Group name="PageBreak">
+            <Button name="PageBreak" tooltip="인쇄 쪽 나눔">
+                <Attribute class="cheditor-tb-bg" width="24" height="23">
+                    <Icon position="710" width="16" class="cheditor-tb-icon" margin="4px" />
+                    <Execution method="doCmd" value="PageBreak" />
+                </Attribute>
+            </Button>
+        </Group>
+    </Toolbar>
+</Template>

plugin/editor/cheditor5/css/dialog.css

@@ -0,0 +1,185 @@
+body {
+    background-color: #fff;
+    margin: 0;
+    border: 0;
+    padding: 0;
+    font-size: 9pt;
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", gulim, monospace;
+    line-height: 1em;
+    overflow: hidden;
+}
+td, input {
+    font-size: 9pt;
+    vertical-align: middle;
+    margin: 0;
+    line-height: 15px;
+    height: 15px;
+}
+select {
+    font-size: 9pt;
+    vertical-align: middle;
+    margin: 0;
+}
+.handCursor {
+    cursor: pointer;
+}
+td.hover
+{
+    background-color : Fuchsia;
+}
+table.dlg {
+    border: 0;
+}
+fieldset {
+    border: 1px solid #ccc;
+    padding: 2px;
+    margin: 0;
+}
+.content-outline {
+    border: 1px solid #ccc;
+    border-radius: 4px;
+    padding: 5px;
+    margin: 0;
+}
+.dlg td {
+    text-align: left;
+    height: 20px;
+}
+form {
+    display: inline;
+}
+.dlg input {
+    border: 2px;
+}
+.img {
+    border: 0;
+    vertical-align: middle;
+}
+.font-normal {
+    font-size: 9pt;
+}
+legend {
+    font-size: 9pt;
+    font-weight: bold;
+}
+.bottom-status {
+    background-color: #fff;
+    margin-top: 10px;
+    padding: 0;
+    text-align: center;
+    height: 24px;
+    vertical-align: middle;
+}
+.button {
+    width: 64px;
+    height: 22px;
+    margin: 1px 2px;
+    cursor: pointer;
+    vertical-align: middle;
+}
+.button8em {
+    font-size: 9pt;
+    padding-top: 2px !important;
+    height: 21px;
+    width: 8em;
+}
+.button10em {
+    font-size: 9pt;
+    padding-top: 1px !important;
+    height: 21px;
+    width: 10em;
+}
+.emIcon {
+    width: 19px;
+    height: 19px;
+    cursor: pointer;
+}
+.schar {
+    border: 1px solid #ccc;
+    background-color: #fff;
+    width: 18px;
+    height: 17px;
+    text-align: center;
+    cursor: pointer;
+    font-size: 12px;
+    line-height: 1.2em;
+}
+.spacer {
+    margin: 10px 0 0 0;
+}
+.spacer5 {
+    margin: 5px 0 0 0;
+    clear: both;
+}
+.wrapper {
+    text-align: center;
+}
+.clear {
+    clear: both;
+}
+.flash-movie-source {
+    margin: 0 auto;
+}
+.flash-player-wrapper {
+    width: 560px;
+    height: 315px;
+    border: 1px #a0a0a0 solid;
+    text-align: center;
+    overflow: auto;
+    margin: 0 auto;
+    background-color: #fff;
+    display: block;
+}
+.media-player-wrapper {
+    height: 200px;
+    margin-top: 5px;
+    text-align: center;
+    overflow-x: auto;
+    overflow-y: hidden;
+}
+.hr {
+    border: 0;
+    background: #e0e0e0;
+    height: 1px;
+}
+.colorCellMouseOver {
+    line-height: 0;
+    font-size: 0;
+    height: 8px;
+    width: 8px;
+    border: 1px solid #fff;
+}
+.colorCellMouseOut {
+    line-height: 8px;
+    font-size: 0;
+    height: 8px;
+    width: 8px;
+    border: 1px solid #000;
+}
+.colorInputBox {
+    background-color: #000;
+    text-align: center;
+    border: 1px solid #000;
+    height: 16px;
+}
+.colorWrapper {
+    border: 1px solid #000;
+    background-color: #fff;
+    position: absolute;
+    padding: 2px;
+    display: none;
+}
+.colorPickerButton {
+    background: url("../icons/button/color_picker.png") no-repeat center center;
+    width: 24px;
+    height: 20px;
+    cursor: pointer;
+    float: left;
+}
+.colorPickerButtonGray {
+    background: url("../icons/button/color_picker_disable.png") no-repeat center center;
+    width: 24px;
+    height: 20px;
+    cursor: pointer;
+    float: left;
+}

plugin/editor/cheditor5/css/editarea.css

@@ -0,0 +1,23 @@
+html, body {
+}
+
+p {
+    margin: 0;
+}
+table, td, th { border:1px dotted #ccc; }
+table { border-collapse: collapse }
+
+/*-------------------------------------------------------------------------------*/
+.ch_bogus_spacer {}
+.cheditor-zero-width { font-family: monospace; }
+.cheditor-insertpara-pointer {
+    height: 1px;
+    display: none;
+    overflow: hidden;
+    background-color: red;
+    position: absolute;
+}
+.cheditor-add-paragraph {
+    border: #999 dotted 1px;
+    margin: 1px 0px;
+}

plugin/editor/cheditor5/css/imageupload.css

@@ -0,0 +1,136 @@
+#uploadWindow {
+    display: none;
+}
+
+.clear { clear: both; }
+
+#container {
+	padding: 0;
+}
+
+.imageListWrapperHtml5, .imageListWrapper, .dragOver {
+	background-color: #fff;
+	position: absolute;
+    height: 295px;
+    width: 522px;
+    overflow-y: scroll;
+    border-radius: 4px;
+	border: 1px red solid;
+}
+.imageListWrapperHtml5 {
+    border: 2px #66b2ff dashed;
+}
+.imageListWrapper {
+    border: 1px #aaa solid;
+    box-shadow: 0 0 3px #aaa;
+}
+.dragOver {
+    border: 2px #ff3399 dashed;
+}
+#imageInfoBox {
+    position: absolute;
+	left: 548px;
+}
+.imageInfoTitle {
+    text-align: center;
+    background-color: #e0e0e0;
+    width: 130px;
+    font-family: "Malgun Gothic",gulim;
+    font-weight: bold;
+    font-size: 12px;
+}
+.imageInfoTitle span {
+    display: inline-block;
+    margin-top: -1px;
+    line-height: 22px;
+}
+.remove-button {
+	width: 93px;
+	height: 22px;
+	cursor: pointer;
+	vertical-align: middle;
+}
+.imageBox, .imageBoxHighlighted {
+	width: 120px;
+	height: 90px;
+	margin: 3px 3px;
+	float: left;
+}
+.imageBox_theImage,.imageBox_theImage_over {
+	width: 100%;
+	height: 100%;
+    position: relative;
+    display: block;
+    background-color: #fff;
+}
+.imageBox .imageBox_theImage{
+	border: 1px solid #e0e0e0;
+	background-image: url('../icons/dot.gif');
+	background-position: center center;
+	background-repeat: no-repeat;
+}
+.imageBox .imageBox_theImage_over {
+	border: 1px solid #a0a0a0;
+	background-image: url('../icons/dot.gif');
+	background-position: center center;
+	background-repeat: no-repeat;
+    cursor: pointer;
+}
+.imageBoxHighlighted .imageBox_theImage {
+	border: 1px solid #ff6600;
+}
+.imageBoxHighlighted .imageBox_theImage_over {
+	border: 1px solid #ff6600;
+	background-image: url('../icons/dot.gif');
+	background-position: center center;
+	background-repeat: no-repeat;
+}
+
+.removeButton, .removeButton_over {
+	display: none;
+	position: absolute;
+	cursor: pointer;
+    background-image: url(../icons/imageUpload/cross-small.png);
+    background-repeat: no-repeat;
+    background-position: center center;
+}
+.removeButton {
+    border: 1px solid #a0a0a0;
+}
+.removeButton_over {
+    border: 1px solid #808080;
+}
+#insertionMarker {
+	height: 102px;
+	width: 6px;
+	position: absolute;
+	display: none;
+}
+
+#insertionMarker img {
+	float: left;
+}
+	
+#dragDropContent{
+	position: absolute;
+	z-index: 10;
+	display: none;
+}
+
+.button {
+    width: 64px;
+    height: 22px;
+    margin: 0 2px;
+    cursor: pointer;
+    vertical-align: middle;
+}
+
+body {
+	margin: 0;
+	padding: 0;
+	overflow: hidden;
+    background-color: #fff;
+    line-height: 1em;
+    font-family: 'Malgun Gothic', gulim, tahoma, helvetica;
+    font-size: 12px;
+}

plugin/editor/cheditor5/css/imageurl.css

@@ -0,0 +1,5 @@
+/* CSS file */
+
+Application
+{
+}

plugin/editor/cheditor5/css/lightbox.css

@@ -0,0 +1,95 @@
+/************************************************
+
+          CHEditor Image Caption Util
+
+************************************************/
+img.chimg_photo
+{
+  border: 1px darkgray solid;
+  padding:10px;
+}
+div.imgblock
+{
+}
+div.leftjust
+{
+}
+div.rightjust
+{
+}
+div.caption
+{
+  margin-top: 5px;
+  margin-left: 0.2em;
+  color: darkgray;
+  font-size: 9pt;
+}
+div.caption-marker
+{
+  float: left;
+  margin-right: 0.2em;
+}
+div.caption-text
+{
+  float: left;
+  clear: right;
+  text-align: left;
+}
+.imageUtil {
+	cursor: url(icons/imageutil/zoomin.cur), pointer;
+    outline: none;
+}
+.imageUtil img {
+	border: 2px solid gray;
+}
+.imageUtil:hover img {
+	border: 2px solid silver;
+}
+
+.imageUtil-image {
+    border-bottom: 1px solid white;
+}
+.imageUtil-image-blur {
+}
+.imageUtil-caption {
+    display: none;
+    border-bottom: 1px solid white;
+    font-family: gulim, Verdana, Helvetica;
+    font-size: 9pt;
+    padding: 5px;
+    background-color: #fff;
+}
+.imageUtil-loading {
+    display: block;
+	color: white;
+	font-size: 9px;
+	font-weight: normal;
+    text-decoration: none;
+	padding: 3px;
+	border-top: 1px solid white;
+	border-bottom: 1px solid white;
+    background-color: black;
+    padding-left: 22px;
+    background-image: url(icons/imageutil/loader.gif);
+    background-repeat: no-repeat;
+    background-position: 3px 1px;
+}
+
+a.imageUtil-credits,
+a.imageUtil-credits i {
+    padding: 2px;
+    color: silver;
+    text-decoration: none;
+	font-size: 10px;
+}
+a.imageUtil-credits:hover,
+a.imageUtil-credits:hover i {
+    color: white;
+    background-color: gray;
+}
+.imageUtil-display-block {
+    display: block;
+}
+.imageUtil-display-none {
+    display: none;
+}

plugin/editor/cheditor5/css/ui.css

@@ -0,0 +1,653 @@
+a.cheditor-tag-path-elem {
+    text-decoration: none;
+    color: #0033cc;
+    font-size: 8pt;
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", dotum, monospace;
+    cursor: pointer;
+}
+a.cheditor-tag-path-elem:hover {
+    color: #0033cc;
+    text-decoration: underline;
+    cursor: pointer;
+}
+.cheditor-container {
+    border-top: 1px #ccc solid;
+    position: relative;
+    text-align: left;
+}
+.cheditor-tb-wrapper {
+    border-right: 1px #ccc solid;
+    border-left: 1px #ccc solid;
+    border-bottom: 1px #ccc solid;
+    position: relative;
+    display: block;
+    background-color: #f0f0f0;
+    zoom:1;
+    height:auto ! important;
+}
+.cheditor-tb-wrapper:after{display:block;visibility:hidden;clear:both;content:""}
+.cheditor-tb-wrapper-readonly {
+    border-right: 1px #ccc solid;
+    border-left: 1px #ccc solid;
+    border-bottom: 1px #ccc solid;
+    position: relative;
+    display: block;
+    background: #f0f0f0 url(../icons/readonlymode.png) no-repeat 10px center;
+}
+.cheditor-tb-wrapper-code {
+    border-right: 1px #ccc solid;
+    border-left: 1px #ccc solid;
+    border-bottom: 1px #ccc solid;
+    position: relative;
+    display: block;
+    background: #f0f0f0 url(../icons/viewmode_code.png) no-repeat 10px center;
+}
+.cheditor-tb-wrapper-preview {
+    border-right: 1px #ccc solid;
+    border-left: 1px #ccc solid;
+    border-bottom: 1px #ccc solid;
+    position: relative;
+    display: block;
+    background: #f0f0f0 url(../icons/viewmode_preview.png) no-repeat 10px center;
+}
+.cheditor-tb-wrapper-readonly div, .cheditor-tb-wrapper-code div, .cheditor-tb-wrapper-preview div {
+    display: none;
+}
+.cheditor-tb-fullscreen {
+    width: 16px;
+    height: 16px;
+    float: right;
+    margin-top: 3px;
+    cursor: pointer;
+    background: transparent url(../icons/fullscreen.png) no-repeat center center;
+}
+.cheditor-tb-fullscreen-disable {
+    display: none;
+}
+.cheditor-tb-fullscreen-actual {
+    width: 16px;
+    height: 16px;
+    float: right;
+    margin-top: 3px;
+    cursor: pointer;
+    background: transparent url(../icons/fullscreen_actual.png) no-repeat center center;
+}
+.cheditor-editarea-wrapper {
+    border-right: 1px #ccc solid;
+    border-bottom: 1px #ccc solid;
+    border-left: 1px #ccc solid;
+    width: auto;
+    overflow: hidden;
+}
+.cheditor-editarea {
+    width: 100%;
+    overflow-x: hidden;
+    overflow-y: auto;
+    margin: 0;
+    padding: 0;
+    display: block;
+}
+@font-face {
+    font-family: 'SourceCodePro';
+    src: url('SourceCodePro.eot');
+    src: url('SourceCodePro.woff') format('woff');
+}
+.cheditor-editarea-text-content {
+    overflow-x: hidden;
+    overflow-y: scroll;
+    margin: 0;
+    border: 1px solid transparent;
+    padding: 7px 10px;
+    display: none;
+    resize: none;
+    outline: none;
+    font-family: SourceCodePro, monospace;
+    font-size: 12px;
+}
+.cheditor-modify-block .cheditor-ico {
+    width: 16px;
+    height: 16px;
+    vertical-align: middle;
+    margin-right: 5px;
+}
+.cheditor-modify-block select {
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", gulim, monospace;
+    font-size: 9pt;
+    color: #000;
+}
+.cheditor-modify-block div {
+    padding: 5px 10px 5px 10px;
+    color: #000;
+    display: block;
+}
+.cheditor-modify-block div .wrap-text-desc {
+    line-height: 1em;
+    color: #000;
+}
+.cheditor-modify-block div .user-input-alt {
+    width: 120px;
+    margin: 3px 10px 0 5px;
+    height: 15px;
+    line-height: 15px;
+    padding-top: 1px;
+    font-size: 9pt;
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", gulim, monospace;
+    color: #000;
+}
+.cheditor-modify-block div .user-input-caption {
+    width: 350px;
+    margin: 7px 10px 0 5px;
+    height: 15px;
+    line-height: 15px;
+    padding-top: 1px;
+    font-size: 9pt;
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", gulim, monospace;
+    color: #000;
+}
+.cheditor-modify-block div .caption-align {
+    margin: 7px 0 0 4px;
+    font-size: 9pt;
+    vertical-align: top;
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", gulim, monospace;
+    color: #000;
+}
+.cheditor-modify-block div .wrap-checked {
+    vertical-align: middle;
+    padding: 0;
+    margin-right: 2px;
+}
+.cheditor-modify-block div .input-submit {
+    cursor: pointer;
+    vertical-align: middle;
+    margin-top: -2px;
+    margin-left: 10px;
+    height: 20px;
+    width: 64px;
+}
+.cheditor-modify-block div .color-picker {
+    cursor: pointer;
+    vertical-align: middle;
+    height: 20px;
+    width: 20px;
+}
+.cheditor-modify-block div .delete-submit {
+    cursor: pointer;
+    vertical-align: middle;
+    margin-top: -2px;
+    margin-left: 3px;
+    height: 20px;
+    width: 64px;
+}
+.cheditor-modify-block div .edit-table-ico {
+    cursor: pointer;
+    vertical-align: middle;
+    width: 16px;
+    height: 16px;
+    margin: 0 3px;
+}
+.cheditor-modify-block {
+    display: none;
+    border-right: 1px #ccc solid;
+    border-bottom: 1px #ccc solid;
+    border-left: 1px #ccc solid;
+    padding: 2px;
+    background-color: #eee;
+    font-size: 9pt;
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", gulim, monospace;
+    text-align: center;
+}
+.cheditor-status-bar {
+    font-size: 8pt;
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", dotum, monospace;
+    color: #333;
+}
+.cheditor-tag-path {
+    border-right: 1px #ccc solid;
+    border-bottom: 1px #ccc solid;
+    border-left: 1px #ccc solid;
+    padding: 0 2px 0 2px;
+    display: none;
+    height: 18px;
+    line-height: 18px;
+    overflow: hidden;
+}
+.cheditor-viewmode {
+    padding: 0 4px 0 4px;
+    height: 16px;
+    background: transparent url(../icons/statusbar_bgline.gif) repeat-x 0 0;
+}
+.cheditor-viewmode div {
+    width: 24px;
+    height: 16px;
+    cursor: pointer;
+}
+.cheditor-tab-rich {
+    background: transparent url(../icons/edit_mode_rich_a.png) no-repeat 0 0;
+    float: left;
+}
+.cheditor-tab-rich-off {
+    background: transparent url(../icons/edit_mode_rich_b.png) no-repeat 0 0;
+    float: left;
+}
+.cheditor-tab-code {
+    background: transparent url(../icons/edit_mode_code_a.png) no-repeat 0 0;
+    float: left;
+}
+.cheditor-tab-code-off {
+    background: transparent url(../icons/edit_mode_code_b.png) no-repeat 0 0;
+    float: left;
+}
+.cheditor-tab-preview {
+    background: transparent url(../icons/edit_mode_view_a.png) no-repeat 0 0;
+    float: left;
+}
+.cheditor-tab-preview-off {
+    background: transparent url(../icons/edit_mode_view_b.png) no-repeat 0 0;
+    float: left;
+}
+.cheditor-resizebar {
+    height: 11px;
+    overflow: hidden;
+    border-left: 1px #ccc solid;
+    border-right: 1px #ccc solid;
+    cursor: s-resize;
+    background: #eee url(../icons/splitter.gif) no-repeat center top;
+}
+.cheditor-resizebar-off {
+    height: 11px;
+    overflow: hidden;
+    border-left: 1px #ccc solid;
+    border-right: 1px #ccc solid;
+    cursor: default;
+    background-color: #eee;
+}
+.cheditor_mode_icon { width: 24px; height: 16px; cursor: pointer; vertical-align: top }
+.cheditor-pulldown-container {
+    border: #7d8db0 1px solid;
+    background-color: #fff;
+    padding: 1px;
+    position: relative;
+    -moz-box-shadow: 0 0 5px #aaa;
+    -webkit-box-shadow: 0 0 5px #aaa;
+    box-shadow: 1px 1px 10px #bbb;
+}
+.cheditor-pulldown-container div {
+    padding: 2px 2px 2px 15px;
+    font-size: 9pt;
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", gulim, monospace;
+    color: #222;
+    position: relative;
+    display: block;
+    line-height: 1.2;
+    margin: 2px 2px;
+}
+.cheditor-pulldown-color-container {
+    border: #7d8db0 1px solid;
+    -moz-box-shadow: 0 0 5px #aaa;
+    -webkit-box-shadow: 0 0 5px #aaa;
+    box-shadow: 1px 1px 10px #bbb;
+    background-color: #fff;
+    padding: 2px;
+}
+.cheditor-pulldown-container div label, .cheditor-pulldown-textblock-container div label {
+    display: block;
+}
+.cheditor-pulldown-textblock-container div div {
+    text-align: center;
+    padding: 2px;
+    font-size: 9pt;
+    color: #000;
+    line-height: 1.2;
+}
+.cheditor-pulldown-textblock-container div {
+    padding: 1px;
+}
+.cheditor-pulldown-textblock-out {
+    border: #fff 1px solid;
+}
+.cheditor-pulldown-textblock-over {
+    border: #ccc 1px solid;
+}
+.cheditor-pulldown-textblock-container {
+    border: #7d8db0 1px solid;
+    -moz-box-shadow: 0 0 5px #aaa;
+    -webkit-box-shadow: 0 0 5px #aaa;
+    box-shadow: 1px 1px 10px #bbb;
+    background-color: #fff;
+    padding: 2px;
+}
+.cheditor-pulldown-mouseout {
+    border: #fff 1px solid;
+}
+.cheditor-pulldown-mouseover {
+    background-color: #f0f0f0;
+    border: #e0e0e0 1px solid;
+}
+.cheditor-pulldown-frame {
+    position: absolute;
+    visibility: hidden;
+    z-index: -1;
+    width: 1px;
+    height: 1px;
+    line-height: 12px;
+}
+.cheditor-pulldown-color-cell-over, .cheditor-pulldown-color-cell {
+    float: left;
+    width: 14px;
+    height: 14px;
+    margin: 1px;
+    cursor: pointer;
+}
+.cheditor-pulldown-color-cell-over {
+    border: 1px #000 solid;
+}
+.cheditor-pulldown-color-cell-over span {
+    width: 12px;
+    height: 12px;
+    border: 1px #fff solid;
+    display: block;
+}
+.cheditor-pulldown-color-cell {
+    border: 1px #999 solid;
+}
+.cheditor-pulldown-color-cell span {
+    width: 14px;
+    height: 14px;
+    display: block;
+    border: none;
+}
+.cheditor-pulldown-color-selected {
+    border: 1px solid #999;
+    text-align: left;
+    margin: 4px 0 0 1px;
+    padding-left: 5px;
+    height: 15px;
+    line-height: 15px;
+    font-size: 11px;
+    font-family: verdana, monospace;
+    width: 55px;
+    vertical-align: -10%;
+}
+.cheditor-pulldown-color-reset, .cheditor-pulldown-color-show-picker {
+    height: 19px;
+    width: 16px;
+    cursor: pointer;
+    display: inline-block;
+    vertical-align: middle;
+    margin-left: 3px;
+}
+.cheditor-pulldown-color-reset {
+    background: #fff url(../icons/color_picker_reset.png) no-repeat center center;
+}
+.cheditor-pulldown-color-show-picker {
+    background: #fff url(../icons/color_picker.png) no-repeat center center;
+}
+.cheditor-pulldown-color-submit {
+    vertical-align: middle;
+    margin: 4px 1px 0 0;
+    height: 19px;
+    width: 40px;
+    cursor: pointer;
+    right: 0;
+    position: absolute;
+}
+.cheditor-container-fullscreen {
+    position: fixed;
+    left: 0;
+	top: 0;
+	_position: absolute;
+    z-index: 1000;
+    text-align: left;
+    background-color: #fff;
+}
+.cheditor-popupModalBackground {
+	background-color: #fff;
+    position: fixed;
+    _position: absolute;
+	display: none;
+	top: 0;
+	left: 0;
+	width: 100%;
+    height: 100%;
+}
+.cheditor-popup-window {
+    border: 1px solid #0078D7;
+    border-radius: 5px;
+    background-color: #0078D7;
+    display: none;
+    position: absolute;
+    top: 0;
+    left: 0;
+    -moz-box-shadow: 0 0 5px #aaa;
+    -webkit-box-shadow: 0 0 5px #aaa;
+    box-shadow: 0 0 10px #bbb;
+    padding: 0;
+    overflow: hidden;
+}
+.cheditor-popup-cmd-button {
+    width: 64px;
+    height: 22px;
+    margin: 5px 2px;
+    cursor: pointer;
+    vertical-align: middle;
+}
+.cheditor-popup-cframe {
+    background-color: #fff;
+    margin: 0;
+    padding: 10px;
+    border: none;
+    text-align: center;
+}
+
+.cheditor-popup-cframe iframe {
+    margin: 0;
+    padding: 0;
+    overflow: hidden;
+}
+.cheditor-popup-drag-handle {
+    height: 31px;
+}
+.cheditor-popup-titlebar {
+    padding-left: 10px;
+    line-height: 30px;
+}
+.cheditor-popup-title {
+    font-size: 12px;
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", gulim, monospace;
+    font-weight: bold;
+    color: #fff;
+}
+.cheditor-dragWindowTransparent {
+    background-color: #fff;
+    position: absolute;
+    display: block;
+    left: 0px;
+    top: 27px;
+}
+.cheditor-pulldown-wrapper {
+    line-height: 1;
+}
+.cheditor-toolbar-icon-wrapper {
+    margin: 0 2px 0 0;
+    float: left;
+    height: 24px;
+    overflow: hidden;
+}
+.cheditor-tb-icon {
+    height: 22px;
+    width: 16px;
+    overflow: hidden;
+}
+.cheditor-tb-icon-disable {
+    height: 22px;
+    width: 16px;
+    overflow: hidden;
+    filter: alpha(opacity=40) gray;
+    opacity: 0.4;
+}
+.cheditor-tb-text {
+    padding: 0;
+    margin: 0;
+    color: #333;
+    height: 20px;
+    line-height: 20px;
+}
+.cheditor-tb-text-disable {
+    padding: 0;
+    margin: 0;
+    height: 20px;
+    line-height: 20px;
+    color: #333;
+    overflow: hidden;
+    filter: alpha(opacity=40) gray;
+    -webkit-filter: grayscale(100%);
+    opacity: 0.4;
+}
+.cheditor-tb-text span, .cheditor-tb-text-disable span {
+    font-family: "Malgun Gothic", "Apple SD Gothic Neo", gulim, monospace;
+    margin: 0 0 0 1px;
+    padding: 0;
+    width: 41px;
+    text-overflow: ellipsis;
+    overflow: hidden;
+    white-space: nowrap;
+    display: block;
+    font-size: 12px;
+}
+.cheditor-tb-icon23 {
+    height: 22px;
+    width: 23px;
+    margin-left: 3px;
+    overflow: hidden;
+}
+.cheditor-tb-icon23-disable {
+    height: 22px;
+    width: 23px;
+    margin-left: 3px;
+    overflow: hidden;
+    filter: alpha(opacity=40) gray;
+    opacity: 0.4;
+}
+.cheditor-tb-icon36 {
+    height: 22px;
+    width: 36px;
+    overflow: hidden;
+}
+.cheditor-tb-icon36-disable {
+    height: 22px;
+    width: 36px;
+    overflow: hidden;
+    filter: alpha(opacity=40) gray;
+    opacity: 0.4;
+}
+.cheditor-tb-combo {
+    height: 22px;
+    width: 10px;
+    overflow: hidden;
+}
+.cheditor-tb-combo-disable {
+    height: 22px;
+    width: 10px;
+    overflow: hidden;
+    filter: alpha(opacity=40) gray;
+    opacity: 0.4;
+}
+.cheditor-tb-bg55 {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left -483px;
+    position: relative;
+}
+.cheditor-tb-bg40 {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left -552px;
+    position: relative;
+}
+.cheditor-tb-bg44 {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left -621px;
+    position: relative;
+}
+.cheditor-tb-bg30-first {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left -276px;
+    position: relative;
+}
+.cheditor-tb-bg30 {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left -345px;
+    position: relative;
+}
+.cheditor-tb-bg30-last {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left -414px;
+    position: relative;
+}
+.cheditor-tb-bgcombo {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left -690px;
+    position: relative;
+}
+.cheditor-tb-bgcombo-first {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left top;
+    position: relative;
+}
+.cheditor-tb-bgcombo-last {
+    float: left;
+    overflow: hidden;
+    background: url(../icons/toolbar-background.png) no-repeat left -759px;
+    position: relative;
+}
+.cheditor-tb-bg {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left -69px;
+    position: relative;
+}
+.cheditor-tb-bg-first {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left top;
+    position: relative;
+}
+.cheditor-tb-bg-last {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left -138px;
+    position: relative;
+    background-clip: border-box;
+}
+.cheditor-tb-bg-single {
+    float: left;
+    overflow: hidden;
+    background: transparent url(../icons/toolbar-background.png) no-repeat left -207px;
+    position: relative;
+}
+.cheditor-tb-color-btn {
+	width: 16px;
+	height: 3px;
+	overflow: hidden;
+	position: absolute;
+	top: 16px;
+	left: 3px;
+}
+.cheditor-tb-button-spacer {
+    overflow: hidden;
+    width: 4px;
+    height: 4px;
+    float: left;
+}
+.cheditor-tb-split {
+	overflow: hidden;
+    height: 2px;
+    width: 3px;
+    clear: both;
+}

plugin/editor/cheditor5/editor.lib.php

@@ -0,0 +1,158 @@
+<?php
+if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
+
+function editor_html($id, $content, $is_dhtml_editor=true)
+{
+    global $config, $w, $board;
+    global $editor_width, $editor_height;
+    static $js = true;
+
+    if( $is_dhtml_editor && $content && !$w && (isset($board['bo_insert_content']) && !empty($board['bo_insert_content']) ) ){       //글쓰기 기본 내용 처리
+        if( preg_match('/\r|\n/', $content) && $content === strip_tags($content, '<a><strong><b>') ) {  //textarea로 작성되고, html 내용이 없다면
+            $content = nl2br($content);
+        }
+    }
+
+    $width  = isset($editor_width)  ? $editor_width  : "100%";
+    $height = isset($editor_height) ? $editor_height : "250px";
+    if (defined(G5_PUNYCODE))
+        $editor_url = G5_PUNYCODE.'/'.G5_EDITOR_DIR.'/'.$config['cf_editor'];
+    else
+        $editor_url = G5_EDITOR_URL.'/'.$config['cf_editor'];
+
+    $html = "";
+
+    if ($is_dhtml_editor) {
+        if ($js) {
+            $html .= "<script src=\"{$editor_url}/cheditor.js\"></script>";
+        }
+        $html .= "<script>\n";
+        $html .= "var ed_nonce = \"".ft_nonce_create('cheditor')."\";\n";
+        $html .= "var ed_{$id} = new cheditor('ed_{$id}');\n";
+        $html .= "ed_{$id}.config.editorWidth = \"{$width}\";\n";             
+        $html .= "ed_{$id}.config.editorHeight = \"{$height}\";\n";           
+        $html .= "ed_{$id}.config.imgReSize = false;\n";                    
+        $html .= "ed_{$id}.config.fullHTMLSource = false;\n";               
+        $html .= "ed_{$id}.config.editorPath = \"{$editor_url}\";\n"; 
+        $html .= "ed_{$id}.inputForm = \"tx_{$id}\";\n";
+        $html .= "</script>\n";                                             
+        $html .= "<span class=\"sound_only\">웹에디터 시작</span>";
+        $html .= "<textarea name=\"{$id}\" id=\"tx_{$id}\" style=\"display:none;\">{$content}</textarea>\n";
+        $html .= "\n<span class=\"sound_only\">웹 에디터 끝</span>";
+        $html .= "<script>ed_{$id}.run();</script>\n";
+    } else {
+        $html .= "<textarea id=\"$id\" name=\"$id\" style=\"width:{$width};height:{$height};\" maxlength=\"65536\">$content</textarea>\n";
+    }
+    return $html;
+}
+
+
+// textarea 로 값을 넘긴다. javascript 반드시 필요
+function get_editor_js($id, $is_dhtml_editor=true)
+{
+    if ($is_dhtml_editor) {
+        return "document.getElementById('tx_{$id}').value = ed_{$id}.outputBodyHTML();\n";
+    } else {
+        return "var {$id}_editor = document.getElementById('{$id}');\n";
+    }
+}
+
+
+//  textarea 의 값이 비어 있는지 검사
+function chk_editor_js($id, $is_dhtml_editor=true)
+{
+    if ($is_dhtml_editor) {
+        return "if (document.getElementById('tx_{$id}') && jQuery.inArray(ed_{$id}.outputBodyHTML().toLowerCase().replace(/^\s*|\s*$/g, ''), ['&nbsp;','<p>&nbsp;</p>','<p><br></p>','<div><br></div>','<p></p>','<br>','']) != -1) { alert(\"내용을 입력해 주십시오.\"); ed_{$id}.returnFalse(); return false; }\n";
+    } else {
+        return "if (!{$id}_editor.value) { alert(\"내용을 입력해 주십시오.\"); {$id}_editor.focus(); return false; }\n";
+    }
+}
+
+/*
+https://github.com/timostamm/NonceUtil-PHP
+*/
+
+if (!defined('FT_NONCE_UNIQUE_KEY'))
+    define( 'FT_NONCE_UNIQUE_KEY' , sha1($_SERVER['SERVER_SOFTWARE'].G5_MYSQL_USER.session_id().G5_TABLE_PREFIX) );
+
+if (!defined('FT_NONCE_SESSION_KEY'))
+    define( 'FT_NONCE_SESSION_KEY' , substr(md5(FT_NONCE_UNIQUE_KEY), 5) );
+
+if (!defined('FT_NONCE_DURATION'))
+    define( 'FT_NONCE_DURATION' , 60 * 30  ); // 300 makes link or form good for 5 minutes from time of generation,  300은 5분간 유효, 60 * 60 은 1시간
+
+if (!defined('FT_NONCE_KEY'))
+    define( 'FT_NONCE_KEY' , '_nonce' );
+
+// This method creates a key / value pair for a url string
+if(!function_exists('ft_nonce_create_query_string')){
+    function ft_nonce_create_query_string( $action = '' , $user = '' ){
+        return FT_NONCE_KEY."=".ft_nonce_create( $action , $user );
+    }
+}
+
+if(!function_exists('ft_get_secret_key')){
+    function ft_get_secret_key($secret){
+        return md5(FT_NONCE_UNIQUE_KEY.$secret);
+    }
+}
+
+// This method creates an nonce. It should be called by one of the previous two functions.
+if(!function_exists('ft_nonce_create')){
+    function ft_nonce_create( $action = '',$user='', $timeoutSeconds=FT_NONCE_DURATION ){
+
+        $secret = ft_get_secret_key($action.$user);
+
+		$salt = ft_nonce_generate_hash();
+		$time = time();
+		$maxTime = $time + $timeoutSeconds;
+		$nonce = $salt . "|" . $maxTime . "|" . sha1( $salt . $secret . $maxTime );
+
+        set_session('nonce_'.FT_NONCE_SESSION_KEY, $nonce);
+
+		return $nonce;
+
+    }
+}
+
+// This method validates an nonce
+if(!function_exists('ft_nonce_is_valid')){
+    function ft_nonce_is_valid( $nonce, $action = '', $user='' ){
+
+        $secret = ft_get_secret_key($action.$user);
+
+		if (is_string($nonce) == false) {
+			return false;
+		}
+		$a = explode('|', $nonce);
+		if (count($a) != 3) {
+			return false;
+		}
+		$salt = $a[0];
+		$maxTime = intval($a[1]);
+		$hash = $a[2];
+		$back = sha1( $salt . $secret . $maxTime );
+		if ($back != $hash) {
+			return false;
+		}
+		if (time() > $maxTime) {
+			return false;
+		}
+		return true;
+    }
+}
+
+// This method generates the nonce timestamp
+if(!function_exists('ft_nonce_generate_hash')){
+    function ft_nonce_generate_hash(){
+		$length = 10;
+		$chars='1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM';
+		$ll = strlen($chars)-1;
+		$o = '';
+		while (strlen($o) < $length) {
+			$o .= $chars[ rand(0, $ll) ];
+		}
+		return $o;
+    }
+}
+?>