Merge branch 'master' of github.com:gnuboard/g5

adm/admin.lib.php

@@ -379,6 +379,47 @@ function get_sanitize_input($s, $is_html=false){
     return $s;
 }
 
+function check_log_folder($log_path){
+
+    if( is_writable($log_path) ){
+
+        // 아파치 서버인 경우 웹에서 해당 폴더 접근 막기
+        $htaccess_file = $log_path.'/.htaccess';
+        if ( !file_exists( $htaccess_file ) ) {
+            if ( $handle = @fopen( $htaccess_file, 'w' ) ) {
+                fwrite( $handle, 'Order deny,allow' . "\n" );
+                fwrite( $handle, 'Deny from all' . "\n" );
+                fclose( $handle );
+            }
+        }
+        
+        // 아파치 서버인 경우 해당 디렉토리 파일 목록 안보이게 하기
+        $index_file = $log_path . '/index.php';
+        if ( !file_exists( $index_file ) ) {
+            if ( $handle = @fopen( $index_file, 'w' ) ) {
+                fwrite( $handle, '' );
+                fclose( $handle );
+            }
+        }
+    }
+    
+    // txt 파일과 log 파일을 조회하여 30일이 지난 파일은 삭제합니다.
+    $txt_files = glob($log_path.'/*.txt');
+    $log_files = glob($log_path.'/*.log');
+    
+    $del_files = array_merge($txt_files, $log_files);
+
+    if( $del_files && is_array($del_files) ){
+        foreach ($del_files as $del_file) {
+            $filetime = filemtime($del_file);
+            // 30일이 지난 파일을 삭제
+            if($filetime && $filetime < (G5_SERVER_TIME - 2592000)) {
+                @unlink($del_file);
+            }
+        }
+    }
+}
+
 // POST로 넘어온 토큰과 세션에 저장된 토큰 비교
 function check_admin_token()
 {
@@ -426,6 +467,25 @@ function admin_referer_check($return=false)
     }
 }
 
+function admin_check_xss_params($params){
+
+    if( ! $params ) return;
+
+    foreach( $params as $key=>$value ){
+
+        if ( empty($value) ) continue;
+
+        if( is_array($value) ){
+            admin_check_xss_params($value);
+        } else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/[onload|onerror]=.*/ius', $value)) ){
+            alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.');
+            die();
+        }
+    }
+
+    return;
+}
+
 // 접근 권한 검사
 if (!$member['mb_id'])
 {
@@ -489,6 +549,12 @@ if (isset($stx))  $arr_query[] = 'stx='.$stx;
 if (isset($page)) $arr_query[] = 'page='.$page;
 $qstr = implode("&amp;", $arr_query);
 
+if ( isset($_REQUEST) && $_REQUEST ){
+    if( admin_referer_check(true) ){
+        admin_check_xss_params($_REQUEST);
+    }
+}
+
 // 관리자에서는 추가 스크립트는 사용하지 않는다.
 //$config['cf_add_script'] = '';
 ?>

adm/board_copy_update.php

@@ -38,43 +38,43 @@ $sql = " insert into {$g5['board_table']}
                 bo_subject = '$target_subject',
                 bo_device = '{$board['bo_device']}',
                 bo_admin = '{$board['bo_admin']}',
-                bo_list_level = '{$board[bo_list_level]}',
-                bo_read_level = '{$board[bo_read_level]}',
-                bo_write_level = '{$board[bo_write_level]}',
-                bo_reply_level = '{$board[bo_reply_level]}',
-                bo_comment_level = '{$board[bo_comment_level]}',
-                bo_upload_level = '{$board[bo_upload_level]}',
-                bo_download_level = '{$board[bo_download_level]}',
-                bo_html_level = '{$board[bo_html_level]}',
-                bo_link_level = '{$board[bo_link_level]}',
-                bo_count_modify = '{$board[bo_count_modify]}',
-                bo_count_delete = '{$board[bo_count_delete]}',
-                bo_read_point = '{$board[bo_read_point]}',
-                bo_write_point = '{$board[bo_write_point]}',
-                bo_comment_point = '{$board[bo_comment_point]}',
-                bo_download_point = '{$board[bo_download_point]}',
-                bo_use_category = '{$board[bo_use_category]}',
+                bo_list_level = '{$board['bo_list_level']}',
+                bo_read_level = '{$board['bo_read_level']}',
+                bo_write_level = '{$board['bo_write_level']}',
+                bo_reply_level = '{$board['bo_reply_level']}',
+                bo_comment_level = '{$board['bo_comment_level']}',
+                bo_upload_level = '{$board['bo_upload_level']}',
+                bo_download_level = '{$board['bo_download_level']}',
+                bo_html_level = '{$board['bo_html_level']}',
+                bo_link_level = '{$board['bo_link_level']}',
+                bo_count_modify = '{$board['bo_count_modify']}',
+                bo_count_delete = '{$board['bo_count_delete']}',
+                bo_read_point = '{$board['bo_read_point']}',
+                bo_write_point = '{$board['bo_write_point']}',
+                bo_comment_point = '{$board['bo_comment_point']}',
+                bo_download_point = '{$board['bo_download_point']}',
+                bo_use_category = '{$board['bo_use_category']}',
                 bo_category_list = '{$board['bo_category_list']}',
-                bo_use_sideview = '{$board[bo_use_sideview]}',
-                bo_use_file_content = '{$board[bo_use_file_content]}',
-                bo_use_secret = '{$board[bo_use_secret]}',
-                bo_use_dhtml_editor = '{$board[bo_use_dhtml_editor]}',
-                bo_use_rss_view = '{$board[bo_use_rss_view]}',
-                bo_use_good = '{$board[bo_use_good]}',
-                bo_use_nogood = '{$board[bo_use_nogood]}',
-                bo_use_name = '{$board[bo_use_name]}',
-                bo_use_signature = '{$board[bo_use_signature]}',
-                bo_use_ip_view = '{$board[bo_use_ip_view]}',
+                bo_use_sideview = '{$board['bo_use_sideview']}',
+                bo_use_file_content = '{$board['bo_use_file_content']}',
+                bo_use_secret = '{$board['bo_use_secret']}',
+                bo_use_dhtml_editor = '{$board['bo_use_dhtml_editor']}',
+                bo_use_rss_view = '{$board['bo_use_rss_view']}',
+                bo_use_good = '{$board['bo_use_good']}',
+                bo_use_nogood = '{$board['bo_use_nogood']}',
+                bo_use_name = '{$board['bo_use_name']}',
+                bo_use_signature = '{$board['bo_use_signature']}',
+                bo_use_ip_view = '{$board['bo_use_ip_view']}',
                 bo_use_list_view = '{$board['bo_use_list_view']}',
-                bo_use_list_content = '{$board[bo_use_list_content]}',
-                bo_table_width = '{$board[bo_table_width]}',
-                bo_subject_len = '{$board[bo_subject_len]}',
-                bo_mobile_subject_len = '{$board[bo_mobile_subject_len]}',
-                bo_page_rows = '{$board[bo_page_rows]}',
-                bo_mobile_page_rows = '{$board[bo_mobile_page_rows]}',
-                bo_new = '{$board[bo_new]}',
-                bo_hot = '{$board[bo_hot]}',
-                bo_image_width = '{$board[bo_image_width]}',
+                bo_use_list_content = '{$board['bo_use_list_content']}',
+                bo_table_width = '{$board['bo_table_width']}',
+                bo_subject_len = '{$board['bo_subject_len']}',
+                bo_mobile_subject_len = '{$board['bo_mobile_subject_len']}',
+                bo_page_rows = '{$board['bo_page_rows']}',
+                bo_mobile_page_rows = '{$board['bo_mobile_page_rows']}',
+                bo_new = '{$board['bo_new']}',
+                bo_hot = '{$board['bo_hot']}',
+                bo_image_width = '{$board['bo_image_width']}',
                 bo_skin = '{$board['bo_skin']}',
                 bo_mobile_skin = '{$board['bo_mobile_skin']}',
                 bo_include_head = '{$board['bo_include_head']}',
@@ -84,20 +84,21 @@ $sql = " insert into {$g5['board_table']}
                 bo_mobile_content_head = '".addslashes($board['bo_mobile_content_head'])."',
                 bo_mobile_content_tail = '".addslashes($board['bo_mobile_content_tail'])."',
                 bo_insert_content = '".addslashes($board['bo_insert_content'])."',
-                bo_gallery_cols = '{$board[bo_gallery_cols]}',
-                bo_gallery_width = '{$board[bo_gallery_width]}',
-                bo_gallery_height = '{$board[bo_gallery_height]}',
-                bo_mobile_gallery_width = '{$board[bo_mobile_gallery_width]}',
-                bo_mobile_gallery_height = '{$board[bo_mobile_gallery_height]}',
-                bo_upload_size = '{$board[bo_upload_size]}',
-                bo_reply_order = '{$board[bo_reply_order]}',
-                bo_use_search = '{$board[bo_use_search]}',
-                bo_order = '{$board[bo_order]}',
+                bo_gallery_cols = '{$board['bo_gallery_cols']}',
+                bo_gallery_width = '{$board['bo_gallery_width']}',
+                bo_gallery_height = '{$board['bo_gallery_height']}',
+                bo_mobile_gallery_width = '{$board['bo_mobile_gallery_width']}',
+                bo_mobile_gallery_height = '{$board['bo_mobile_gallery_height']}',
+                bo_upload_size = '{$board['bo_upload_size']}',
+                bo_reply_order = '{$board['bo_reply_order']}',
+                bo_use_search = '{$board['bo_use_search']}',
+                bo_order = '{$board['bo_order']}',
                 bo_notice = '{$board['bo_notice']}',
-                bo_upload_count = '{$board[bo_upload_count]}',
-                bo_use_email = '{$board[bo_use_email]}',
-                bo_use_cert = '{$board[bo_use_cert]}',
-                bo_use_sns = '{$board[bo_use_sns]}',
+                bo_upload_count = '{$board['bo_upload_count']}',
+                bo_use_email = '{$board['bo_use_email']}',
+                bo_use_cert = '{$board['bo_use_cert']}',
+                bo_use_sns = '{$board['bo_use_sns']}',
+                bo_use_captcha = '{$board['bo_use_captcha']}',
                 bo_sort_field = '{$board['bo_sort_field']}',
                 bo_1_subj = '".addslashes($board['bo_1_subj'])."',
                 bo_2_subj = '".addslashes($board['bo_2_subj'])."',

adm/board_form.php

@@ -869,7 +869,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_content_head">상단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_content_head", get_text($board['bo_content_head'], 0)); ?>
+                <?php echo editor_html("bo_content_head", get_text(html_purifier($board['bo_content_head']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_content_head" value="1" id="chk_grp_content_head">
@@ -881,7 +881,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_content_tail">하단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_content_tail", get_text($board['bo_content_tail'], 0)); ?>
+                <?php echo editor_html("bo_content_tail", get_text(html_purifier($board['bo_content_tail']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_content_tail" value="1" id="chk_grp_content_tail">
@@ -893,7 +893,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_mobile_content_head">모바일 상단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_mobile_content_head", get_text($board['bo_mobile_content_head'], 0)); ?>
+                <?php echo editor_html("bo_mobile_content_head", get_text(html_purifier($board['bo_mobile_content_head']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_mobile_content_head" value="1" id="chk_grp_mobile_content_head">
@@ -905,7 +905,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_mobile_content_tail">모바일 하단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_mobile_content_tail", get_text($board['bo_mobile_content_tail'], 0)); ?>
+                <?php echo editor_html("bo_mobile_content_tail", get_text(html_purifier($board['bo_mobile_content_tail']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_mobile_content_tail" value="1" id="chk_grp_mobile_content_tail">
@@ -918,7 +918,7 @@ $pg_anchor = '<ul class="anchor">
          <tr>
             <th scope="row"><label for="bo_insert_content">글쓰기 기본 내용</label></th>
             <td>
-                <textarea id="bo_insert_content" name="bo_insert_content" rows="5"><?php echo $board['bo_insert_content'] ?></textarea>
+                <textarea id="bo_insert_content" name="bo_insert_content" rows="5"><?php echo html_purifier($board['bo_insert_content']); ?></textarea>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_insert_content" value="1" id="chk_grp_insert_content">
@@ -1242,7 +1242,7 @@ $pg_anchor = '<ul class="anchor">
                 <label for="bo_<?php echo $i ?>_subj">여분필드 <?php echo $i ?> 제목</label>
                 <input type="text" name="bo_<?php echo $i ?>_subj" id="bo_<?php echo $i ?>_subj" value="<?php echo get_text($board['bo_'.$i.'_subj']) ?>" class="frm_input">
                 <label for="bo_<?php echo $i ?>">여분필드 <?php echo $i ?> 값</label>
-                <input type="text" name="bo_<?php echo $i ?>" value="<?php echo get_text($board['bo_'.$i]) ?>" id="bo_<?php echo $i ?>" class="frm_input">
+                <input type="text" name="bo_<?php echo $i ?>" value="<?php echo get_text($board['bo_'.$i]) ?>" id="bo_<?php echo $i ?>" class="frm_input extra-value-input">
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_<?php echo $i ?>" value="1" id="chk_grp_<?php echo $i ?>">

adm/board_form_update.php

@@ -9,16 +9,19 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
-if (!$_POST['gr_id']) { alert('그룹 ID는 반드시 선택하세요.'); }
+$gr_id = isset($_POST['gr_id']) ? preg_replace('/[^a-z0-9_]/i', '', $_POST['gr_id']) : '';
+$bo_admin = isset($_POST['bo_admin']) ? preg_replace('/[^a-z0-9_\, \|\#]/i', '', $_POST['bo_admin']) : '';
+
+if (!$gr_id) { alert('그룹 ID는 반드시 선택하세요.'); }
 if (!$bo_table) { alert('게시판 TABLE명은 반드시 입력하세요.'); }
 if (!preg_match("/^([A-Za-z0-9_]{1,20})$/", $bo_table)) { alert('게시판 TABLE명은 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (20자 이내)'); }
 if (!$_POST['bo_subject']) { alert('게시판 제목을 입력하세요.'); }
 
-$_POST['bo_include_head'] = preg_replace("#[\\\]+$#", "", substr($_POST['bo_include_head'], 0, 255));
-$_POST['bo_include_tail'] = preg_replace("#[\\\]+$#", "", substr($_POST['bo_include_tail'], 0, 255));
+$bo_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($bo_include_head, 0, 255));
+$bo_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($bo_include_tail, 0, 255));
 
 // 관리자가 자동등록방지를 사용해야 할 경우
-if ($board && ($board['bo_include_head'] !== $_POST['bo_include_head'] || $board['bo_include_tail'] !== $_POST['bo_include_tail']) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
+if ($board && ($board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
     include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 
     if (!chk_captcha()) {
@@ -26,7 +29,7 @@ if ($board && ($board['bo_include_head'] !== $_POST['bo_include_head'] || $board
     }
 }
 
-if ($file = $_POST['bo_include_head']) {
+if ($file = $bo_include_head) {
     $file_ext = pathinfo($file, PATHINFO_EXTENSION);
 
     if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) || ! preg_match('/^.*\.(php|htm|html)$/i', $file) ) {
@@ -35,7 +38,7 @@ if ($file = $_POST['bo_include_head']) {
     $_POST['bo_include_head'] = $file;
 }
 
-if ($file = $_POST['bo_include_tail']) {
+if ($file = $bo_include_tail) {
     $file_ext = pathinfo($file, PATHINFO_EXTENSION);
 
     if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) || ! preg_match('/^.*\.(php|htm|html)$/i', $file) ) {
@@ -44,11 +47,11 @@ if ($file = $_POST['bo_include_tail']) {
     $_POST['bo_include_tail'] = $file;
 }
 
-if(!is_include_path_check($_POST['bo_include_head'], 1)) {
+if(!is_include_path_check($bo_include_head, 1)) {
     alert('상단 파일 경로에 포함시킬수 없는 문자열이 있습니다.');
 }
 
-if(!is_include_path_check($_POST['bo_include_tail'], 1)) {
+if(!is_include_path_check($bo_include_tail, 1)) {
     alert('하단 파일 경로에 포함시킬수 없는 문자열이 있습니다.');
 }
 
@@ -72,11 +75,14 @@ $bo_category_list = str_replace($src_char, $dst_char, $bo_category_list);
 //https://github.com/gnuboard/gnuboard5/commit/f5f4925d4eb28ba1af728e1065fc2bdd9ce1da58 에 따른 조치
 $str_bo_category_list = isset($_POST['bo_category_list']) ? preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $_POST['bo_category_list']) : '';
 
-$sql_common = " gr_id               = '{$_POST['gr_id']}',
+$_POST['bo_subject'] = strip_tags($_POST['bo_subject']);
+$_POST['bo_mobile_subject'] = strip_tags($_POST['bo_mobile_subject']);
+
+$sql_common = " gr_id               = '{$gr_id}',
                 bo_subject          = '{$_POST['bo_subject']}',
                 bo_mobile_subject   = '{$_POST['bo_mobile_subject']}',
                 bo_device           = '{$_POST['bo_device']}',
-                bo_admin            = '{$_POST['bo_admin']}',
+                bo_admin            = '{$bo_admin}',
                 bo_list_level       = '{$_POST['bo_list_level']}',
                 bo_read_level       = '{$_POST['bo_read_level']}',
                 bo_write_level      = '{$_POST['bo_write_level']}',
@@ -125,8 +131,8 @@ $sql_common = " gr_id               = '{$_POST['gr_id']}',
 
 // 최고 관리자인 경우에만 수정가능
 if ($is_admin === 'super'){
-$sql_common .= " bo_include_head     = '{$_POST['bo_include_head']}',
-                bo_include_tail     = '{$_POST['bo_include_tail']}',
+$sql_common .= " bo_include_head     = '".$bo_include_head."',
+                bo_include_tail     = '".$bo_include_tail."',
                 bo_content_head     = '{$_POST['bo_content_head']}',
                 bo_content_tail     = '{$_POST['bo_content_tail']}',
                 bo_mobile_content_head     = '{$_POST['bo_mobile_content_head']}',

adm/board_list_update.php

@@ -29,19 +29,21 @@ if ($_POST['act_button'] == "선택수정") {
                 alert('최고관리자가 아닌 경우 다른 관리자의 게시판('.$board_table[$k].')은 수정이 불가합니다.');
         }
 
+        $p_bo_subject = is_array($_POST['bo_subject']) ? strip_tags($_POST['bo_subject'][$k]) : '';
+
         $sql = " update {$g5['board_table']}
-                    set gr_id               = '".sql_real_escape_string($_POST['gr_id'][$k])."',
-                        bo_subject          = '".sql_real_escape_string($_POST['bo_subject'][$k])."',
-                        bo_device           = '".sql_real_escape_string($_POST['bo_device'][$k])."',
-                        bo_skin             = '".sql_real_escape_string($_POST['bo_skin'][$k])."',
-                        bo_mobile_skin      = '".sql_real_escape_string($_POST['bo_mobile_skin'][$k])."',
-                        bo_read_point       = '".sql_real_escape_string($_POST['bo_read_point'][$k])."',
-                        bo_write_point      = '".sql_real_escape_string($_POST['bo_write_point'][$k])."',
-                        bo_comment_point    = '".sql_real_escape_string($_POST['bo_comment_point'][$k])."',
-                        bo_download_point   = '".sql_real_escape_string($_POST['bo_download_point'][$k])."',
-                        bo_use_search       = '".sql_real_escape_string($_POST['bo_use_search'][$k])."',
-                        bo_use_sns          = '".sql_real_escape_string($_POST['bo_use_sns'][$k])."',
-                        bo_order            = '".sql_real_escape_string($_POST['bo_order'][$k])."'
+                    set gr_id               = '".sql_real_escape_string(strip_tags($_POST['gr_id'][$k]))."',
+                        bo_subject          = '".$p_bo_subject."',
+                        bo_device           = '".sql_real_escape_string(strip_tags($_POST['bo_device'][$k]))."',
+                        bo_skin             = '".sql_real_escape_string(strip_tags($_POST['bo_skin'][$k]))."',
+                        bo_mobile_skin      = '".sql_real_escape_string(strip_tags($_POST['bo_mobile_skin'][$k]))."',
+                        bo_read_point       = '".sql_real_escape_string(strip_tags($_POST['bo_read_point'][$k]))."',
+                        bo_write_point      = '".sql_real_escape_string(strip_tags($_POST['bo_write_point'][$k]))."',
+                        bo_comment_point    = '".sql_real_escape_string(strip_tags($_POST['bo_comment_point'][$k]))."',
+                        bo_download_point   = '".sql_real_escape_string(strip_tags($_POST['bo_download_point'][$k]))."',
+                        bo_use_search       = '".sql_real_escape_string(strip_tags($_POST['bo_use_search'][$k]))."',
+                        bo_use_sns          = '".sql_real_escape_string(strip_tags($_POST['bo_use_sns'][$k]))."',
+                        bo_order            = '".sql_real_escape_string(strip_tags($_POST['bo_order'][$k]))."'
                   where bo_table            = '".sql_real_escape_string($_POST['board_table'][$k])."' ";
 
         sql_query($sql);

adm/boardgroup_form.php

@@ -12,7 +12,7 @@ $sound_only = '';
 if ($w == '') {
     $gr_id_attr = 'required';
     $sound_only = '<strong class="sound_only"> 필수</strong>';
-    $gr['gr_use_access'] = 0;
+    $gr = array('gr_use_access' => 0);
     $html_title .= ' 생성';
 } else if ($w == 'u') {
     $gr_id_attr = 'readonly';
@@ -117,7 +117,7 @@ include_once('./admin.head.php');
             <label for="gr_<?php echo $i ?>_subj">여분필드 <?php echo $i ?> 제목</label>
             <input type="text" name="gr_<?php echo $i ?>_subj" value="<?php echo get_text($group['gr_'.$i.'_subj']) ?>" id="gr_<?php echo $i ?>_subj" class="frm_input">
             <label for="gr_<?php echo $i ?>">여분필드 <?php echo $i ?> 내용</label>
-            <input type="text" name="gr_<?php echo $i ?>" value="<?php echo $gr['gr_'.$i] ?>" id="gr_<?php echo $i ?>" class="frm_input">
+            <input type="text" name="gr_<?php echo $i ?>" value="<?php echo get_sanitize_input($gr['gr_'.$i]); ?>" id="gr_<?php echo $i ?>" class="frm_input">
         </td>
     </tr>
     <?php } ?>

adm/boardgroup_form_update.php

@@ -16,7 +16,9 @@ if (!preg_match("/^([A-Za-z0-9_]{1,10})$/", $_POST['gr_id']))
 
 if (!$gr_subject) alert('그룹 제목을 입력하세요.');
 
-$sql_common = " gr_subject = '{$_POST['gr_subject']}',
+$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';
+
+$sql_common = " gr_subject = '{$gr_subject}',
                 gr_device = '{$_POST['gr_device']}',
                 gr_admin  = '{$_POST['gr_admin']}',
                 gr_1_subj = '{$_POST['gr_1_subj']}',

adm/boardgroup_list_update.php

@@ -18,18 +18,20 @@ if(!$count)
 for ($i=0; $i<$count; $i++)
 {
     $k     = $_POST['chk'][$i];
-    $gr_id = $_POST['group_id'][$k];
+    $gr_id = preg_replace('/[^a-z0-9_]/i', '', $_POST['group_id'][$k]);
+    $gr_subject = is_array($_POST['gr_subject']) ? strip_tags($_POST['gr_subject'][$k]) : '';
+    $gr_admin = is_array($_POST['gr_admin']) ? strip_tags($_POST['gr_admin'][$k]) : '';
 
     if($_POST['act_button'] == '선택수정') {
         $sql = " update {$g5['group_table']}
-                    set gr_subject    = '{$_POST['gr_subject'][$k]}',
-                        gr_device     = '{$_POST['gr_device'][$k]}',
-                        gr_admin      = '{$_POST['gr_admin'][$k]}',
-                        gr_use_access = '{$_POST['gr_use_access'][$k]}',
-                        gr_order      = '{$_POST['gr_order'][$k]}'
+                    set gr_subject    = '{$gr_subject}',
+                        gr_device     = '".sql_real_escape_string($_POST['gr_device'][$k])."',
+                        gr_admin      = '".sql_real_escape_string($_POST['gr_admin'][$k])."',
+                        gr_use_access = '".sql_real_escape_string($_POST['gr_use_access'][$k])."',
+                        gr_order      = '".sql_real_escape_string($_POST['gr_order'][$k])."'
                   where gr_id         = '{$gr_id}' ";
         if ($is_admin != 'super')
-            $sql .= " and gr_admin    = '{$_POST['gr_admin'][$k]}' ";
+            $sql .= " and gr_admin    = '{$gr_admin}' ";
         sql_query($sql);
     } else if($_POST['act_button'] == '선택삭제') {
         $row = sql_fetch(" select count(*) as cnt from {$g5['board_table']} where gr_id = '$gr_id' ");

adm/boardgroupmember_update.php

@@ -48,7 +48,7 @@ else if ($w == 'd' || $w == 'ld')
     check_admin_token();
 
     for($i=0; $i<$count; $i++) {
-        $gm_id = $_POST['chk'][$i];
+        $gm_id = (int) $_POST['chk'][$i];
         $sql = " select * from {$g5['group_member_table']} where gm_id = '$gm_id' ";
         $gm = sql_fetch($sql);
         if (!$gm['gm_id']) {

adm/config_form.php

@@ -1067,7 +1067,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                     <input type="checkbox" name="cf_social_servicelist[]" id="check_social_kakao" value="kakao" <?php echo option_array_checked('kakao', $config['cf_social_servicelist']); ?> >
                     <label for="check_social_kakao">카카오 로그인을 사용합니다</label>
                     <div>
-                    <h3>카카오 웹 Redirect Path</h3>
+                    <h3>카카오 로그인 Redirect URI</h3>
                     <p><?php echo get_social_callbackurl('kakao', true); ?></p>
                     </div>
                 </div>
@@ -1317,7 +1317,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                 <label for="cf_<?php echo $i ?>_subj">여분필드<?php echo $i ?> 제목</label>
                 <input type="text" name="cf_<?php echo $i ?>_subj" value="<?php echo get_text($config['cf_'.$i.'_subj']) ?>" id="cf_<?php echo $i ?>_subj" class="frm_input" size="30">
                 <label for="cf_<?php echo $i ?>">여분필드<?php echo $i ?> 값</label>
-                <input type="text" name="cf_<?php echo $i ?>" value="<?php echo $config['cf_'.$i] ?>" id="cf_<?php echo $i ?>" class="frm_input" size="30">
+                <input type="text" name="cf_<?php echo $i ?>" value="<?php echo get_sanitize_input($config['cf_'.$i]); ?>" id="cf_<?php echo $i ?>" class="frm_input extra-value-input" size="30">
             </td>
         </tr>
         <?php } ?>
@@ -1419,6 +1419,10 @@ if($config['cf_cert_use']) {
         }
 
         echo module_exec_check($exe, 'okname');
+
+        if(is_dir(G5_OKNAME_PATH.'/log') && is_writable(G5_OKNAME_PATH.'/log') && function_exists('check_log_folder') ) {
+            check_log_folder(G5_OKNAME_PATH.'/log');
+        }
     }
 
     // kcp일 때
@@ -1436,16 +1440,29 @@ if($config['cf_cert_use']) {
         $log_path = G5_LGXPAY_PATH.'/lgdacom/log';
 
         if(!is_dir($log_path)) {
-            echo '<script>'.PHP_EOL;
-            echo 'alert("'.str_replace(G5_PATH.'/', '', G5_LGXPAY_PATH).'/lgdacom 폴더 안에 log 폴더를 생성하신 후 쓰기권한을 부여해 주십시오.\n> mkdir log\n> chmod 707 log");'.PHP_EOL;
-            echo '</script>'.PHP_EOL;
-        } else {
-            if(!is_writable($log_path)) {
+
+            if( is_writable(G5_LGXPAY_PATH.'/lgdacom/') ){
+                // 디렉토리가 없다면 생성합니다. (퍼미션도 변경하구요.)
+                @mkdir($log_path, G5_DIR_PERMISSION);
+                @chmod($log_path, G5_DIR_PERMISSION);
+            }
+
+            if(!is_dir($log_path)){
                 echo '<script>'.PHP_EOL;
-                echo 'alert("'.str_replace(G5_PATH.'/', '',$log_path).' 폴더에 쓰기권한을 부여해 주십시오.\n> chmod 707 log");'.PHP_EOL;
+                echo 'alert("'.str_replace(G5_PATH.'/', '', G5_LGXPAY_PATH).'/lgdacom 폴더 안에 log 폴더를 생성하신 후 쓰기권한을 부여해 주십시오.\n> mkdir log\n> chmod 707 log");'.PHP_EOL;
                 echo '</script>'.PHP_EOL;
             }
         }
+
+        if(is_dir($log_path) && is_writable($log_path)) {
+            if( function_exists('check_log_folder') ){
+                check_log_folder($log_path);
+            }
+        } else if (is_dir($log_path)) {
+            echo '<script>'.PHP_EOL;
+            echo 'alert("'.str_replace(G5_PATH.'/', '',$log_path).' 폴더에 쓰기권한을 부여해 주십시오.\n> chmod 707 log");'.PHP_EOL;
+            echo '</script>'.PHP_EOL;
+        }
     }
 }
 

adm/config_form_update.php

@@ -26,6 +26,16 @@ if(!$_POST['cf_cert_use']) {
 
 $cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',', $_POST['cf_social_servicelist']) : '';
 
+$_POST['cf_title'] = strip_tags($_POST['cf_title']);
+
+$check_keys = array('cf_lg_mid', 'cf_lg_mert_key', 'cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret');
+
+foreach( $check_keys as $key ){
+    if ( isset($_POST[$key]) && $_POST[$key] ){
+        $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
+    }
+}
+
 $sql = " update {$g5['config_table']}
             set cf_title = '{$_POST['cf_title']}',
                 cf_admin = '{$_POST['cf_admin']}',

adm/contentform.php

@@ -35,6 +35,7 @@ if(!sql_query(" select co_skin from {$g5['content_table']} limit 1 ", false)) {
 
 $html_title = "내용";
 $g5['title'] = $html_title.' 관리';
+$readonly = '';
 
 if ($w == "u")
 {
@@ -49,9 +50,11 @@ if ($w == "u")
 else
 {
     $html_title .= ' 입력';
-    $co['co_html'] = 2;
-    $co['co_skin'] = 'basic';
-    $co['co_mobile_skin'] = 'basic';
+    $co = array(
+        'co_html' => 2,
+        'co_skin' => 'basic',
+        'co_mobile_skin' => 'basic'
+        );
 }
 
 include_once (G5_ADMIN_PATH.'/admin.head.php');
@@ -84,11 +87,11 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     </tr>
     <tr>
         <th scope="row">내용</th>
-        <td><?php echo editor_html('co_content', get_text($co['co_content'], 0)); ?></td>
+        <td><?php echo editor_html('co_content', get_text(html_purifier($co['co_content']), 0)); ?></td>
     </tr>
     <tr>
         <th scope="row">모바일 내용</th>
-        <td><?php echo editor_html('co_mobile_content', get_text($co['co_mobile_content'], 0)); ?></td>
+        <td><?php echo editor_html('co_mobile_content', get_text(html_purifier($co['co_mobile_content']), 0)); ?></td>
     </tr>
     <tr>
         <th scope="row"><label for="co_skin">스킨 디렉토리<strong class="sound_only">필수</strong></label></th>
@@ -102,16 +105,18 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
             <?php echo get_mobile_skin_select('content', 'co_mobile_skin', 'co_mobile_skin', $co['co_mobile_skin'], 'required'); ?>
         </td>
     </tr>
+    <!--
     <tr>
         <th scope="row"><label for="co_tag_filter_use">태그 필터링 사용</label></th>
         <td>
             <?php echo help("내용에서 iframe 등의 태그를 사용하려면 사용안함으로 선택해 주십시오."); ?>
             <select name="co_tag_filter_use" id="co_tag_filter_use">
-                <option value="1"<?php echo get_selected(1, $co['co_tag_filter_use']); ?>>사용함</option>
-                <option value="0"<?php echo get_selected(0, $co['co_tag_filter_use']); ?>>사용안함</option>
+                <option value="1"<?php echo get_selected($co['co_tag_filter_use'], 1); ?>>사용함</option>
+                <option value="0"<?php echo get_selected($co['co_tag_filter_use'], 0); ?>>사용안함</option>
             </select>
         </td>
     </tr>
+    -->
     <tr>
         <th scope="row"><label for="co_include_head">상단 파일 경로</label></th>
         <td>

adm/contentformupdate.php

@@ -20,8 +20,14 @@ if ($w == "" || $w == "u")
     $co_row = sql_fetch($sql);
 }
 
+$co_id = preg_replace('/[^a-z0-9_]/i', '', $co_id);
+$co_subject = strip_tags($co_subject);
+$co_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_head, 0, 255));
+$co_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_tail, 0, 255));
+$co_tag_filter_use = isset($_POST['co_tag_filter_use']) ? (int) $_POST['co_tag_filter_use'] : 1;
+
 // 관리자가 자동등록방지를 사용해야 할 경우
-if (($co_row['co_include_head'] !== $_POST['co_include_head'] || $co_row['co_include_tail'] !== $_POST['co_include_tail']) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
+if (($co_row['co_include_head'] !== $co_include_head || $co_row['co_include_tail'] !== $co_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
     include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 
     if (!chk_captcha()) {
@@ -55,12 +61,12 @@ if( $co_include_tail ){
     }
 }
 
-if( $co_include_head && ! is_include_path_check($co_include_head) ){
+if( $co_include_head && ! is_include_path_check($co_include_head, 1) ){
     $co_include_head = '';
     $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.';
 }
 
-if( $co_include_tail && ! is_include_path_check($co_include_tail) ){
+if( $co_include_tail && ! is_include_path_check($co_include_tail, 1) ){
     $co_include_tail = '';
     $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
 }

adm/css/admin.css

@@ -403,6 +403,9 @@ tfoot th {}
 #anc_bo_extra label {display:inline-block;width:100px}
 #anc_bo_extra input {margin-right:10px}
 
+/* 환경설정 및 게시판 여분필드 값 input style 로빈아빠님 제안 */
+#anc_bo_extra input.extra-value-input, #anc_cf_extra input.extra-value-input{width:calc(100% - 370px);}
+
 /* 접속자집계 목록 */
 .tbl_visit_list td {text-align:center}
 .visit_bar {position:relative}

adm/faqform.php

@@ -54,11 +54,11 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     </tr>
     <tr>
         <th scope="row">질문</th>
-        <td><?php echo editor_html('fa_subject', get_text($fa['fa_subject'], 0)); ?></td>
+        <td><?php echo editor_html('fa_subject', get_text(html_purifier($fa['fa_subject']), 0)); ?></td>
     </tr>
     <tr>
         <th scope="row">답변</th>
-        <td><?php echo editor_html('fa_content', get_text($fa['fa_content'], 0)); ?></td>
+        <td><?php echo editor_html('fa_content', get_text(html_purifier($fa['fa_content']), 0)); ?></td>
     </tr>
     </tbody>
     </table>

adm/faqlist.php

@@ -5,7 +5,13 @@ include_once('./_common.php');
 auth_check($auth[$sub_menu], "r");
 
 $g5['title'] = 'FAQ 상세관리';
-if ($fm_subject) $g5['title'] .= ' : '.$fm_subject;
+if ($fm_subject){
+    $fm_subject = clean_xss_tags(strip_tags($fm_subject));
+    $g5['title'] .= ' : '.$fm_subject;
+}
+
+$fm_id = (int) $fm_id;
+
 include_once (G5_ADMIN_PATH.'/admin.head.php');
 
 $sql = " select * from {$g5['faq_master_table']} where fm_id = '$fm_id' ";
@@ -16,7 +22,7 @@ $sql_common = " from {$g5['faq_table']} where fm_id = '$fm_id' ";
 // 테이블의 전체 레코드수만 얻음
 $sql = " select count(*) as cnt " . $sql_common;
 $row = sql_fetch($sql);
-$total_count = $row[cnt];
+$total_count = $row['cnt'];
 
 $sql = "select * $sql_common order by fa_order , fa_id ";
 $result = sql_query($sql);
@@ -54,7 +60,7 @@ $result = sql_query($sql);
     for ($i=0; $row=sql_fetch_array($result); $i++)
     {
         $row1 = sql_fetch(" select COUNT(*) as cnt from {$g5['faq_table']} where fm_id = '{$row['fm_id']}' ");
-        $cnt = $row1[cnt];
+        $cnt = $row1['cnt'];
 
         $s_mod = icon("수정", "");
         $s_del = icon("삭제", "");

adm/faqmasterform.php

@@ -21,6 +21,7 @@ if ($w == "u")
 else
 {
     $html_title .= ' 입력';
+    $fm = array();
 }
 
 $g5['title'] = $html_title.' 관리';
@@ -116,25 +117,25 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     <tr>
         <th scope="row">상단 내용</th>
         <td>
-            <?php echo editor_html('fm_head_html', get_text($fm['fm_head_html'], 0)); ?>
+            <?php echo editor_html('fm_head_html', get_text(html_purifier($fm['fm_head_html']), 0)); ?>
         </td>
     </tr>
     <tr>
         <th scope="row">하단 내용</th>
         <td>
-            <?php echo editor_html('fm_tail_html', get_text($fm['fm_tail_html'], 0)); ?>
+            <?php echo editor_html('fm_tail_html', get_text(html_purifier($fm['fm_tail_html']), 0)); ?>
         </td>
     </tr>
     <tr>
         <th scope="row">모바일상단 내용</th>
         <td>
-            <?php echo editor_html('fm_mobile_head_html', get_text($fm['fm_mobile_head_html'], 0)); ?>
+            <?php echo editor_html('fm_mobile_head_html', get_text(html_purifier($fm['fm_mobile_head_html']), 0)); ?>
         </td>
     </tr>
     <tr>
         <th scope="row">모바일하단 내용</th>
         <td>
-            <?php echo editor_html('fm_mobile_tail_html', get_text($fm['fm_mobile_tail_html'], 0)); ?>
+            <?php echo editor_html('fm_mobile_tail_html', get_text(html_purifier($fm['fm_mobile_tail_html']), 0)); ?>
         </td>
     </tr>
     </tbody>

adm/faqmasterformupdate.php

@@ -18,6 +18,8 @@ check_admin_token();
 if ($fm_himg_del)  @unlink(G5_DATA_PATH."/faq/{$fm_id}_h");
 if ($fm_timg_del)  @unlink(G5_DATA_PATH."/faq/{$fm_id}_t");
 
+$fm_subject = strip_tags($fm_subject);
+
 $sql_common = " set fm_subject = '$fm_subject',
                     fm_head_html = '$fm_head_html',
                     fm_tail_html = '$fm_tail_html',

adm/mail_form.php

@@ -10,6 +10,8 @@ $html_title = '회원메일';
 if ($w == 'u') {
     $html_title .= '수정';
     $readonly = ' readonly';
+    
+    $ma_id = (int) $ma_id;
 
     $sql = " select * from {$g5['mail_table']} where ma_id = '{$ma_id}' ";
     $ma = sql_fetch($sql);
@@ -44,7 +46,7 @@ include_once('./admin.head.php');
     </tr>
     <tr>
         <th scope="row"><label for="ma_content">메일 내용<strong class="sound_only">필수</strong></label></th>
-        <td><?php echo editor_html("ma_content", get_text($ma['ma_content'], 0)); ?></td>
+        <td><?php echo editor_html("ma_content", get_text(html_purifier($ma['ma_content']), 0)); ?></td>
     </tr>
     </tbody>
     </table>

adm/mail_update.php

@@ -9,11 +9,13 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
+$ma_id = isset($_POST['ma_id']) ? (int) $_POST['ma_id'] : 0;
+$ma_subject = isset($_POST['ma_subject']) ? strip_tags($_POST['ma_subject']) : '';
+
 if ($w == '')
 {
     $sql = " insert {$g5['mail_table']}
-                set ma_id = '{$_POST['ma_id']}',
-                     ma_subject = '{$_POST['ma_subject']}',
+                set ma_subject = '{$ma_subject}',
                      ma_content = '{$_POST['ma_content']}',
                      ma_time = '".G5_TIME_YMDHIS."',
                      ma_ip = '{$_SERVER['REMOTE_ADDR']}' ";
@@ -22,16 +24,16 @@ if ($w == '')
 else if ($w == 'u')
 {
     $sql = " update {$g5['mail_table']}
-                set ma_subject = '{$_POST['ma_subject']}',
+                set ma_subject = '{$ma_subject}',
                      ma_content = '{$_POST['ma_content']}',
                      ma_time = '".G5_TIME_YMDHIS."',
                      ma_ip = '{$_SERVER['REMOTE_ADDR']}'
-                where ma_id = '{$_POST['ma_id']}' ";
+                where ma_id = '{$ma_id}' ";
     sql_query($sql);
 }
 else if ($w == 'd')
 {
-	$sql = " delete from {$g5['mail_table']} where ma_id = '{$_POST['ma_id']}' ";
+	$sql = " delete from {$g5['mail_table']} where ma_id = '{$ma_id}' ";
     sql_query($sql);
 }
 

adm/member_form_update.php

@@ -33,9 +33,14 @@ if($_POST['mb_certify_case'] && $_POST['mb_certify']) {
 $mb_zip1 = substr($_POST['mb_zip'], 0, 3);
 $mb_zip2 = substr($_POST['mb_zip'], 3);
 
+$mb_email = isset($_POST['mb_email']) ? get_email_address(trim($_POST['mb_email'])) : '';
+$mb_nick = isset($_POST['mb_nick']) ? trim(strip_tags($_POST['mb_nick'])) : '';
+
+if ($msg = valid_mb_nick($mb_nick))     alert($msg, "", true, true);
+
 $sql_common = "  mb_name = '{$_POST['mb_name']}',
-                 mb_nick = '{$_POST['mb_nick']}',
-                 mb_email = '{$_POST['mb_email']}',
+                 mb_nick = '{$mb_nick}',
+                 mb_email = '{$mb_email}',
                  mb_homepage = '{$_POST['mb_homepage']}',
                  mb_tel = '{$_POST['mb_tel']}',
                  mb_hp = '{$mb_hp}',
@@ -74,13 +79,13 @@ if ($w == '')
         alert('이미 존재하는 회원아이디입니다.\\nＩＤ : '.$mb['mb_id'].'\\n이름 : '.$mb['mb_name'].'\\n닉네임 : '.$mb['mb_nick'].'\\n메일 : '.$mb['mb_email']);
 
     // 닉네임중복체크
-    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_nick = '{$_POST['mb_nick']}' ";
+    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_nick = '{$mb_nick}' ";
     $row = sql_fetch($sql);
     if ($row['mb_id'])
         alert('이미 존재하는 닉네임입니다.\\nＩＤ : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
 
     // 이메일중복체크
-    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_email = '{$_POST['mb_email']}' ";
+    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_email = '{$mb_email}' ";
     $row = sql_fetch($sql);
     if ($row['mb_id'])
         alert('이미 존재하는 이메일입니다.\\nＩＤ : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
@@ -104,17 +109,39 @@ else if ($w == 'u')
         alert($mb['mb_id'].' : 로그인 중인 관리자 레벨은 수정 할 수 없습니다.');
 
     // 닉네임중복체크
-    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_nick = '{$_POST['mb_nick']}' and mb_id <> '$mb_id' ";
+    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_nick = '{$mb_nick}' and mb_id <> '$mb_id' ";
     $row = sql_fetch($sql);
     if ($row['mb_id'])
         alert('이미 존재하는 닉네임입니다.\\nＩＤ : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
 
     // 이메일중복체크
-    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_email = '{$_POST['mb_email']}' and mb_id <> '$mb_id' ";
+    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_email = '{$mb_email}' and mb_id <> '$mb_id' ";
     $row = sql_fetch($sql);
     if ($row['mb_id'])
         alert('이미 존재하는 이메일입니다.\\nＩＤ : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
 
+    if ($mb_password)
+        $sql_password = " , mb_password = '".get_encrypt_string($mb_password)."' ";
+    else
+        $sql_password = "";
+
+    if ($passive_certify)
+        $sql_certify = " , mb_email_certify = '".G5_TIME_YMDHIS."' ";
+    else
+        $sql_certify = "";
+
+    $sql = " update {$g5['member_table']}
+                set {$sql_common}
+                     {$sql_password}
+                     {$sql_certify}
+                where mb_id = '{$mb_id}' ";
+    sql_query($sql);
+}
+else
+    alert('제대로 된 값이 넘어오지 않았습니다.');
+
+if( $w == '' || $w == 'u' ){
+
     $mb_dir = substr($mb_id,0,2);
 
     // 회원 아이콘 삭제
@@ -207,26 +234,7 @@ else if ($w == 'u')
             }
         }
     }
-
-    if ($mb_password)
-        $sql_password = " , mb_password = '".get_encrypt_string($mb_password)."' ";
-    else
-        $sql_password = "";
-
-    if ($passive_certify)
-        $sql_certify = " , mb_email_certify = '".G5_TIME_YMDHIS."' ";
-    else
-        $sql_certify = "";
-
-    $sql = " update {$g5['member_table']}
-                set {$sql_common}
-                     {$sql_password}
-                     {$sql_certify}
-                where mb_id = '{$mb_id}' ";
-    sql_query($sql);
 }
-else
-    alert('제대로 된 값이 넘어오지 않았습니다.');
 
 goto_url('./member_form.php?'.$qstr.'&amp;w=u&amp;mb_id='.$mb_id, false);
 ?>

adm/member_list_update.php

@@ -29,19 +29,19 @@ if ($_POST['act_button'] == "선택수정") {
             $msg .= $mb['mb_id'].' : 로그인 중인 관리자는 수정 할 수 없습니다.\\n';
         } else {
             if($_POST['mb_certify'][$k])
-                $mb_adult = $_POST['mb_adult'][$k];
+                $mb_adult = (int) $_POST['mb_adult'][$k];
             else
                 $mb_adult = 0;
 
             $sql = " update {$g5['member_table']}
-                        set mb_level = '{$_POST['mb_level'][$k]}',
-                            mb_intercept_date = '{$_POST['mb_intercept_date'][$k]}',
-                            mb_mailling = '{$_POST['mb_mailling'][$k]}',
-                            mb_sms = '{$_POST['mb_sms'][$k]}',
-                            mb_open = '{$_POST['mb_open'][$k]}',
-                            mb_certify = '{$_POST['mb_certify'][$k]}',
+                        set mb_level = '".sql_real_escape_string($_POST['mb_level'][$k])."',
+                            mb_intercept_date = '".sql_real_escape_string($_POST['mb_intercept_date'][$k])."',
+                            mb_mailling = '".sql_real_escape_string($_POST['mb_mailling'][$k])."',
+                            mb_sms = '".sql_real_escape_string($_POST['mb_sms'][$k])."',
+                            mb_open = '".sql_real_escape_string($_POST['mb_open'][$k])."',
+                            mb_certify = '".sql_real_escape_string($_POST['mb_certify'][$k])."',
                             mb_adult = '{$mb_adult}'
-                        where mb_id = '{$_POST['mb_id'][$k]}' ";
+                        where mb_id = '".sql_real_escape_string($_POST['mb_id'][$k])."' ";
             sql_query($sql);
         }
     }

adm/menu_list.php

@@ -76,7 +76,7 @@ $colspan = 7;
         <td class="td_category<?php echo $sub_menu_class; ?>">
             <input type="hidden" name="code[]" value="<?php echo substr($row['me_code'], 0, 2) ?>">
             <label for="me_name_<?php echo $i; ?>" class="sound_only"><?php echo $sub_menu_info; ?> 메뉴<strong class="sound_only"> 필수</strong></label>
-            <input type="text" name="me_name[]" value="<?php echo $me_name; ?>" id="me_name_<?php echo $i; ?>" required class="required tbl_input full_input">
+            <input type="text" name="me_name[]" value="<?php echo get_sanitize_input($me_name); ?>" id="me_name_<?php echo $i; ?>" required class="required tbl_input full_input">
         </td>
         <td>
             <label for="me_link_<?php echo $i; ?>" class="sound_only">링크<strong class="sound_only"> 필수</strong></label>
@@ -196,6 +196,20 @@ function base_convert(number, frombase, tobase) {
 
 function fmenulist_submit(f)
 {
+
+    var me_links = document.getElementsByName('me_link[]');
+    var reg = /^javascript/; 
+
+	for (i=0; i<me_links.length; i++){
+        
+	    if( reg.test(me_links[i].value) ){ 
+        
+            alert('링크에 자바스크립트문을 입력할수 없습니다.');
+            me_links[i].focus();
+            return false;
+        }
+    }
+
     return true;
 }
 </script>

adm/menu_list_update.php

@@ -20,11 +20,13 @@ $count = count($_POST['code']);
 for ($i=0; $i<$count; $i++)
 {
     $_POST = array_map_deep('trim', $_POST);
+    
+    $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags($_POST['me_link'][$i], 1) : '';
 
-    $code    = $_POST['code'][$i];
-    $me_name = $_POST['me_name'][$i];
-    $me_link = $_POST['me_link'][$i];
-
+    $code    = is_array($_POST['code']) ? strip_tags($_POST['code'][$i]) : '';
+    $me_name = is_array($_POST['me_name']) ? strip_tags($_POST['me_name'][$i]) : '';
+    $me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : strip_tags($_POST['me_link'][$i]);
+    
     if(!$code || !$me_name || !$me_link)
         continue;
 
@@ -56,13 +58,13 @@ for ($i=0; $i<$count; $i++)
 
     // 메뉴 등록
     $sql = " insert into {$g5['menu_table']}
-                set me_code         = '$me_code',
-                    me_name         = '$me_name',
-                    me_link         = '$me_link',
-                    me_target       = '{$_POST['me_target'][$i]}',
-                    me_order        = '{$_POST['me_order'][$i]}',
-                    me_use          = '{$_POST['me_use'][$i]}',
-                    me_mobile_use   = '{$_POST['me_mobile_use'][$i]}' ";
+                set me_code         = '".$me_code."',
+                    me_name         = '".$me_name."',
+                    me_link         = '".$me_link."',
+                    me_target       = '".sql_real_escape_string(strip_tags($_POST['me_target'][$i]))."',
+                    me_order        = '".sql_real_escape_string(strip_tags($_POST['me_order'][$i]))."',
+                    me_use          = '".sql_real_escape_string(strip_tags($_POST['me_use'][$i]))."',
+                    me_mobile_use   = '".sql_real_escape_string(strip_tags($_POST['me_mobile_use'][$i]))."' ";
     sql_query($sql);
 }
 

adm/newwinform.php

@@ -109,12 +109,12 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     <tr>
         <th scope="row"><label for="nw_subject">팝업 제목<strong class="sound_only"> 필수</strong></label></th>
         <td>
-            <input type="text" name="nw_subject" value="<?php echo stripslashes($nw['nw_subject']) ?>" id="nw_subject" required class="frm_input required" size="80">
+            <input type="text" name="nw_subject" value="<?php echo get_sanitize_input($nw['nw_subject']); ?>" id="nw_subject" required class="frm_input required" size="80">
         </td>
     </tr>
     <tr>
         <th scope="row"><label for="nw_content">내용</label></th>
-        <td><?php echo editor_html('nw_content', get_text($nw['nw_content'], 0)); ?></td>
+        <td><?php echo editor_html('nw_content', get_text(html_purifier($nw['nw_content']), 0)); ?></td>
     </tr>
     </tbody>
     </table>

adm/newwinformupdate.php

@@ -12,6 +12,8 @@ else
 
 check_admin_token();
 
+$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';
+
 $sql_common = " nw_device = '{$_POST['nw_device']}',
                 nw_begin_time = '{$_POST['nw_begin_time']}',
                 nw_end_time = '{$_POST['nw_end_time']}',
@@ -20,7 +22,7 @@ $sql_common = " nw_device = '{$_POST['nw_device']}',
                 nw_top = '{$_POST['nw_top']}',
                 nw_height = '{$_POST['nw_height']}',
                 nw_width = '{$_POST['nw_width']}',
-                nw_subject = '{$_POST['nw_subject']}',
+                nw_subject = '{$nw_subject}',
                 nw_content = '{$_POST['nw_content']}',
                 nw_content_html = '{$_POST['nw_content_html']}' ";
 

adm/point_list_delete.php

@@ -16,9 +16,11 @@ for ($i=0; $i<$count; $i++)
 {
     // 실제 번호를 넘김
     $k = $_POST['chk'][$i];
+    $po_id = (int) $_POST['po_id'][$k];
+    $str_mb_id = sql_real_escape_string($_POST['mb_id'][$k]);
 
     // 포인트 내역정보
-    $sql = " select * from {$g5['point_table']} where po_id = '{$_POST['po_id'][$k]}' ";
+    $sql = " select * from {$g5['point_table']} where po_id = '{$po_id}' ";
     $row = sql_fetch($sql);
 
     if(!$row['po_id'])
@@ -39,19 +41,19 @@ for ($i=0; $i<$count; $i++)
     }
 
     // 포인트 내역삭제
-    $sql = " delete from {$g5['point_table']} where po_id = '{$_POST['po_id'][$k]}' ";
+    $sql = " delete from {$g5['point_table']} where po_id = '{$po_id}' ";
     sql_query($sql);
 
     // po_mb_point에 반영
     $sql = " update {$g5['point_table']}
                 set po_mb_point = po_mb_point - '{$row['po_point']}'
-                where mb_id = '{$_POST['mb_id'][$k]}'
-                  and po_id > '{$_POST['po_id'][$k]}' ";
+                where mb_id = '{$str_mb_id}'
+                  and po_id > '{$po_id}' ";
     sql_query($sql);
 
     // 포인트 UPDATE
     $sum_point = get_point_sum($_POST['mb_id'][$k]);
-    $sql= " update {$g5['member_table']} set mb_point = '$sum_point' where mb_id = '{$_POST['mb_id'][$k]}' ";
+    $sql= " update {$g5['member_table']} set mb_point = '$sum_point' where mb_id = '{$str_mb_id}' ";
     sql_query($sql);
 }
 

adm/point_update.php

@@ -6,9 +6,9 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
-$mb_id = $_POST['mb_id'];
-$po_point = $_POST['po_point'];
-$po_content = $_POST['po_content'];
+$mb_id = strip_tags($_POST['mb_id']);
+$po_point = strip_tags($_POST['po_point']);
+$po_content = strip_tags($_POST['po_content']);
 $expire = preg_replace('/[^0-9]/', '', $_POST['po_expire_term']);
 
 $mb = get_member($mb_id);

adm/popular_list.php

@@ -7,7 +7,7 @@ auth_check($auth[$sub_menu], 'r');
 // 체크된 자료 삭제
 if (isset($_POST['chk']) && is_array($_POST['chk'])) {
     for ($i=0; $i<count($_POST['chk']); $i++) {
-        $pp_id = $_POST['chk'][$i];
+        $pp_id = (int) $_POST['chk'][$i];
 
         sql_query(" delete from {$g5['popular_table']} where pp_id = '$pp_id' ", true);
     }

adm/qa_config.php

@@ -282,31 +282,31 @@ if(!isset($qaconfig['qa_include_head'])) {
         <tr>
             <th scope="row"><label for="qa_content_head">상단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_content_head", get_text($qaconfig['qa_content_head'], 0)); ?>
+                <?php echo editor_html("qa_content_head", get_text(html_purifier($qaconfig['qa_content_head']), 0)); ?>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_content_tail">하단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_content_tail", get_text($qaconfig['qa_content_tail'], 0)); ?>
+                <?php echo editor_html("qa_content_tail", get_text(html_purifier($qaconfig['qa_content_tail']), 0)); ?>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_mobile_content_head">모바일 상단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_mobile_content_head", get_text($qaconfig['qa_mobile_content_head'], 0)); ?>
+                <?php echo editor_html("qa_mobile_content_head", get_text(html_purifier($qaconfig['qa_mobile_content_head']), 0)); ?>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_mobile_content_tail">모바일 하단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_mobile_content_tail", get_text($qaconfig['qa_mobile_content_tail'], 0)); ?>
+                <?php echo editor_html("qa_mobile_content_tail", get_text(html_purifier($qaconfig['qa_mobile_content_tail']), 0)); ?>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_insert_content">글쓰기 기본 내용</label></th>
             <td>
-                <textarea id="qa_insert_content" name="qa_insert_content" rows="5"><?php echo $qaconfig['qa_insert_content'] ?></textarea>
+                <textarea id="qa_insert_content" name="qa_insert_content" rows="5"><?php echo html_purifier($qaconfig['qa_insert_content']); ?></textarea>
             </td>
         </tr>
         <?php for ($i=1; $i<=5; $i++) { ?>

adm/qa_config_update.php

@@ -12,8 +12,11 @@ $error_msg = '';
 
 $qaconfig = get_qa_config();
 
+$qa_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_head, 0, 255));
+$qa_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_tail, 0, 255));
+
 // 관리자가 자동등록방지를 사용해야 할 경우
-if ($board && ($qaconfig['qa_include_head'] !== $_POST['qa_include_head'] || $qaconfig['qa_include_tail'] !== $_POST['qa_include_tail']) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
+if ($board && ($qaconfig['qa_include_head'] !== $qa_include_head || $qaconfig['qa_include_tail'] !== $qa_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
     include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 
     if (!chk_captcha()) {
@@ -47,6 +50,8 @@ if( $qa_include_tail && ! is_include_path_check($qa_include_tail, 1) ){
     $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
 }
 
+$_POST['qa_title'] = strip_tags($_POST['qa_title']);
+
 $sql = " update {$g5['qa_config_table']}
             set qa_title                = '{$_POST['qa_title']}',
                 qa_category             = '{$_POST['qa_category']}',

adm/sms_admin/_common.php

@@ -13,6 +13,7 @@ if (!strstr($_SERVER['SCRIPT_NAME'], 'install.php')) {
 }
 
 $sv = isset($_REQUEST['sv']) ? get_search_string($_REQUEST['sv']) : '';
+$st = (isset($_REQUEST['st']) && $st) ? substr(get_search_string($_REQUEST['st']), 0, 12) : '';
 
 if( isset($token) ){
     $token = @htmlspecialchars(strip_tags($token), ENT_QUOTES);

adm/sms_admin/ajax.sms_write_form.php

@@ -74,10 +74,13 @@ while($res = sql_fetch_array($qry))
     ";
 }
 
-$arr_ajax_msg['error'] = "";
-$arr_ajax_msg['list_text'] = $list_text;
-$arr_ajax_msg['page'] = $page;
-$arr_ajax_msg['total_count'] = $total_count;
-$arr_ajax_msg['total_page'] = $total_page;
+$arr_ajax_msg = array(
+'error'=>'',
+'list_text'=>$list_text,
+'page'=>$page,
+'total_count'=>$total_count,
+'total_page'=>$total_page
+);
+
 die( json_encode($arr_ajax_msg) );
 ?>

adm/sms_admin/emoticon_move.php

@@ -12,7 +12,7 @@ $g5['title'] = '이모티콘그룹 이동';
 include_once(G5_PATH.'/head.sub.php');
 
 $list = array();    //배열 변수 초기화
-$fo_no_list = isset($_POST['fo_no']) ? implode(',', $_POST['fo_no']) : '';
+$fo_no_list = isset($_POST['fo_no']) ? clean_xss_tags(strip_tags(implode(',', $_POST['fo_no']))) : '';
 
 $sql = " select * from {$g5['sms5_form_group_table']} order by fg_no ";
 $result = sql_query($sql);

adm/sms_admin/emoticon_move_update.php

@@ -6,6 +6,8 @@ auth_check($auth[$sub_menu], "r");
 if(!count($_POST['chk_fg_no']))
     alert('이모티콘을 이동할 그룹을 한개 이상 선택해 주십시오.', $url);
 
+$fo_no_list = preg_replace('/[^a-zA-Z0-9\, ]/', '', $fo_no_list);
+
 $sql = "select * from {$g5['sms5_form_table']} where fo_no in ($fo_no_list) order by fo_no desc ";
 $result = sql_query($sql);
 $save = array();

adm/sms_admin/form_group_update.php

@@ -11,8 +11,8 @@ if ($w == 'u') // 업데이트
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
         $fg_no = (int) $_POST['fg_no'][$k];
-        $fg_name = strip_tags($_POST['fg_name'][$k]);
-        $fg_member = strip_tags($_POST['fg_member'][$k]);
+        $fg_name = isset($_POST['fg_name'][$k]) ? addslashes(strip_tags($_POST['fg_name'][$k])) : '';
+        $fg_member = isset($_POST['fg_member'][$k]) ? addslashes(strip_tags($_POST['fg_member'][$k])) : '';
 
         if (!is_numeric($fg_no))
             alert('그룹 고유번호가 없습니다.');
@@ -83,7 +83,7 @@ else // 등록
     if (!strlen(trim($fg_name)))
         alert('그룹명을 입력해주세요');
 
-    $fg_name = strip_tags($fg_name);
+    $fg_name = addslashes(strip_tags($fg_name));
 
     $res = sql_fetch("select fg_name from {$g5['sms5_form_group_table']} where fg_name = '$fg_name'");
     if ($res)

adm/sms_admin/history_num.php

@@ -11,6 +11,10 @@ $g5['title'] = "문자전송 내역 (번호별)";
 
 if ($page < 1) $page = 1;
 
+if( isset($st) && !in_array($st, array('hs_name', 'hs_hp', 'bk_no')) ){
+    $st = '';
+}
+
 if ($st && trim($sv))
     $sql_search = " and $st like '%$sv%' ";
 else
@@ -27,7 +31,7 @@ $vnum = $total_count - (($page-1) * $page_size);
 include_once(G5_ADMIN_PATH.'/admin.head.php');
 ?>
 
-<form name="search_form" method="get" action="<?echo $_SERVER['SCRIPT_NAME']?>" class="local_sch01 local_sch" >
+<form name="search_form" method="get" action="<?php echo $_SERVER['SCRIPT_NAME']; ?>" class="local_sch01 local_sch" >
 <label for="st" class="sound_only">검색대상</label>
 <select name="st" id="st">
     <option value="hs_name"<?php echo get_selected('hs_name', $st); ?>>이름</option>

adm/sms_admin/history_view.php

@@ -8,6 +8,14 @@ $colspan = 10;
 $st = isset($st) ? strip_tags($st) : '';
 $ssv = isset($ssv) ? strip_tags($ssv) : '';
 
+if( $st && !in_array($st, array('hs_name', 'hs_hp', 'bk_no')) ){
+    $st = '';
+}
+
+if( $sst && !in_array($sst, array('mb_id', 'bk_no', 'hs_name', 'hs_hp', 'hs_datetime', 'hs_flag', 'hs_code', 'hs_memo', 'hs_log')) ){
+    $sst = '';
+}
+
 auth_check($auth[$sub_menu], "r");
 
 $g5['title'] = "문자전송 상세내역";
@@ -18,7 +26,7 @@ if (!is_numeric($wr_no))
 if ($spage < 1) $spage = 1;
 
 if ($sst && trim($ssv))
-    $sql_search = " and $sst like '%$ssv%' ";
+    $sql_search = " and $sst like '%".sql_real_escape_string($ssv)."%' ";
 else
     $sql_search = "";
 
@@ -127,22 +135,22 @@ function all_send()
     <tr>
         <td><?php echo $re_vnum--?></td>
         <!-- <td><input type=checkbox></td> -->
-        <!-- <td><?php echo $res[wr_message]; ?></span></td>-->
-        <!-- <td><?php echo $res[wr_reply]; ?></td>-->
+        <!-- <td><?php echo $res['wr_message']; ?></span></td>-->
+        <!-- <td><?php echo $res['wr_reply']; ?></td>-->
         <td><?php echo $res['wr_datetime']?></td>
         <td><?php echo number_format($res['wr_total'])?></td>
         <td><?php echo number_format($res['wr_success'])?></td>
         <td><?php echo number_format($res['wr_failure'])?></td>
         <td class="td_mng">
             <a href="./history_view.php?page=<?php echo $page?>&amp;st=<?php echo $st?>&amp;sv=<?php echo $sv?>&amp;wr_no=<?php echo $res['wr_no']?>&amp;wr_renum=<?php echo $res['wr_renum']?>" class="btn btn_03">수정</a>
-            <!-- <a href="./history_del.php?page=<?php echo $page?>&amp;st=<?php echo $st?>&amp;sv=<?php echo $sv?>&amp;wr_no=<?php echo $res[wr_no]?>&amp;wr_renum=<?php echo $res[wr_renum]?>">삭제</a> -->
+            <!-- <a href="./history_del.php?page=<?php echo $page?>&amp;st=<?php echo $st?>&amp;sv=<?php echo $sv?>&amp;wr_no=<?php echo $res['wr_no']?>&amp;wr_renum=<?php echo $res['wr_renum']?>">삭제</a> -->
         </td>
     </tr>
     <?php } ?>
     </tbody>
     </table>
-    <?php } ?>
     </div>
+    <?php } ?>
 
     <?php
     if( $write['wr_memo'] ){

adm/sms_admin/num_book_move.php

@@ -31,8 +31,8 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
 
     <form name="fboardmoveall" method="post" action="./number_move_update.php" onsubmit="return fboardmoveall_submit(this);">
     <input type="hidden" name="sw" value="<?php echo $sw ?>">
-    <input type="hidden" name="bk_no_list" value="<?php echo $bk_no_list ?>">
-    <input type="hidden" name="act" value="<?php echo $act ?>">
+    <input type="hidden" name="bk_no_list" value="<?php echo get_sanitize_input($bk_no_list); ?>">
+    <input type="hidden" name="act" value="<?php echo get_sanitize_input($act); ?>">
     <input type="hidden" name="url" value="<?php echo clean_xss_tags(strip_tags($_SERVER['HTTP_REFERER'])); ?>">
     <div class=" new_win_con"> 
         <div class="tbl_head01 tbl_wrap">

adm/sms_admin/num_book_update.php

@@ -12,6 +12,9 @@ $is_hp_exist = false;
 
 $bk_hp = get_hp($bk_hp);
 
+$bk_memo = strip_tags($bk_memo);
+$bk_name = strip_tags($bk_name);
+
 if ($w=='u') // 업데이트
 {
     if (!$bg_no) $bg_no = 0;
@@ -46,7 +49,7 @@ if ($w=='u') // 업데이트
             sql_query("update {$g5['sms5_book_group_table']} set bg_receipt = bg_receipt - 1, bg_reject = bg_reject + 1 where bg_no='$bg_no'");
     }
 
-    sql_query("update {$g5['sms5_book_table']} set bg_no='$bg_no', bk_name='$bk_name', bk_hp='$bk_hp', bk_receipt='$bk_receipt', bk_datetime='".G5_TIME_YMDHIS."', bk_memo='".addslashes($bk_memo)."' where bk_no='$bk_no'");
+    sql_query("update {$g5['sms5_book_table']} set bg_no='$bg_no', bk_name='".addslashes($bk_name)."', bk_hp='$bk_hp', bk_receipt='$bk_receipt', bk_datetime='".G5_TIME_YMDHIS."', bk_memo='".addslashes($bk_memo)."' where bk_no='$bk_no'");
     if ($res['mb_id']){ //만약에 mb_id가 있다면...
         // 휴대폰번호 중복체크
         $sql = " select mb_id from {$g5['member_table']} where mb_id <> '{$res['mb_id']}' and mb_hp = '{$bk_hp}' ";

adm/sms_admin/num_book_write.php

@@ -30,7 +30,7 @@ if ($w == 'u' && is_numeric($bk_no)) {
     $g5['title'] .= '수정';
 }
 else  {
-    $write['bg_no'] = $bg_no;
+    $write = array('bg_no' => (int) $bg_no);
     $g5['title'] .= '추가';
 }
 
@@ -43,12 +43,12 @@ include_once(G5_ADMIN_PATH."/admin.head.php");
 ?>
 
 <form name="book_form" id="book_form" method="post" action="./num_book_update.php">
-<input type="hidden" name="w" value="<?php echo $w?>">
-<input type="hidden" name="page" value="<?php echo $page?>">
-<input type="hidden" name="ap" value="<?php echo $ap?>">
+<input type="hidden" name="w" value="<?php echo get_sanitize_input($w); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
+<input type="hidden" name="ap" value="<?php echo get_sanitize_input($ap); ?>">
 <input type="hidden" name="bk_no" value="<?php echo $write['bk_no']?>">
 <input type="hidden" name="mb_id" id="mb_id" value="<?php echo $write['mb_id']?>">
-<input type="hidden" name="get_bg_no" value="<?php echo $bg_no?>">
+<input type="hidden" name="get_bg_no" value="<?php echo get_sanitize_input($bg_no); ?>">
 
 <div class="tbl_frm01 tbl_wrap">
     <table>
@@ -74,7 +74,7 @@ include_once(G5_ADMIN_PATH."/admin.head.php");
     </tr>
     <tr>
         <th scope="row"><label for="bk_name">이름<strong class="sound_only"> 필수</strong></label></th>
-        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo $write['bk_name']?>" required class="frm_input required"></td>
+        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo get_sanitize_input($write['bk_name']); ?>" required class="frm_input required"></td>
     </tr>
     <tr>
         <th scope="row"><label for="bk_hp">휴대폰번호<strong class="sound_only"> 필수</strong></label></th>
@@ -121,7 +121,7 @@ include_once(G5_ADMIN_PATH."/admin.head.php");
     <tr>
         <th scope="row"><label for="bk_memo">메모</label></th>
         <td>
-            <textarea name="bk_memo" id="bk_memo"><?php echo $write['bk_memo']?></textarea>
+            <textarea name="bk_memo" id="bk_memo"><?php echo html_purifier($write['bk_memo']); ?></textarea>
         </td>
     </tr>
     </tbody>
@@ -187,14 +187,12 @@ function book_submit(){
                     if($check_msg.size()> 0)
                         $check_msg.remove();
 
-//                    $("#exist_msg").text("<?php echo $exist_msg_2; ?>");
                     is_submit = true;
                 } else {
                     if($check_msg.size() < 1)
                         $("input#bk_hp").after("<div id=\"hp_check_el\"><h3>이 번호를 쓰는 회원 정보</h3><ul></ul></div>");
 
                     $("#hp_check_el").find("ul").html( list_text );
-//                    $("#exist_msg").html("<?php echo $exist_msg_1 ?>");
 
                     if(confirm("회원 정보에 중복 휴대폰 번호가 있습니다.수정하실 경우 회원정보에 반영되지 않습니다.\n수정하시겠습니까?"))
                         is_submit = true;

adm/sms_admin/number_move_update.php

@@ -6,6 +6,8 @@ auth_check($auth[$sub_menu], "r");
 if(!count($_POST['chk_bg_no']))
     alert('번호를 '.$act.'할 그룹을 한개 이상 선택해 주십시오.', $url);
 
+$bk_no_list = preg_replace('/[^a-zA-Z0-9\, ]/', '', $bk_no_list);
+
 $sql = "select * from {$g5['sms5_book_table']} where bk_no in ($bk_no_list) order by bk_no desc ";
 $result = sql_query($sql);
 $save = array();

adm/visit_list.php

@@ -73,7 +73,7 @@ $result = sql_query($sql);
             }
 
             $title = str_replace(array('<', '>', '&'), array("&lt;", "&gt;", "&amp;"), $referer);
-            $link = '<a href="'.$row['vi_referer'].'" target="_blank">';
+            $link = '<a href="'.get_text($row['vi_referer']).'" target="_blank">';
             $link = str_replace('&', "&amp;", $link);
             $link2 = '</a>';
         }

adm/visit_search.php

@@ -92,7 +92,7 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'">처음</a>'; //페이지 처
             }
 
             $title = str_replace(array("<", ">"), array("&lt;", "&gt;"), $referer);
-            $link = '<a href="'.$row['vi_referer'].'" target="_blank" title="'.$title.'">';
+            $link = '<a href="'.get_text($row['vi_referer']).'" target="_blank" title="'.$title.'">';
         }
 
         if ($is_admin == 'super')

bbs/alert.php

@@ -31,10 +31,11 @@ include_once(G5_PATH.'/head.sub.php');
 $msg = isset($msg) ? strip_tags($msg) : '';
 $msg2 = str_replace("\\n", "<br>", $msg);
 
-$url = clean_xss_tags($url);
-if (!$url) $url = clean_xss_tags($_SERVER['HTTP_REFERER']);
+$url = clean_xss_tags($url, 1);
+if (!$url) $url = clean_xss_tags($_SERVER['HTTP_REFERER'], 1);
 
 $url = preg_replace("/[\<\>\'\"\\\'\\\"\(\)]/", "", $url);
+$url = preg_replace('/\r\n|\r|\n|[^\x20-\x7e]/','', $url);
 
 // url 체크
 check_url_host($url, $msg);
@@ -48,11 +49,9 @@ if($error) {
 
 <script>
 alert("<?php echo $msg; ?>");
-//document.location.href = "<?php echo $url; ?>";
 <?php if ($url) { ?>
 document.location.replace("<?php echo str_replace('&amp;', '&', $url); ?>");
 <?php } else { ?>
-//alert('history.back();');
 history.back();
 <?php } ?>
 </script>
@@ -67,13 +66,17 @@ history.back();
     <form method="post" action="<?php echo $url ?>">
     <?php
     foreach($_POST as $key => $value) {
+        
+        $key = clean_xss_tags($key);
+        $value = clean_xss_tags($value);
+
         if(strlen($value) < 1)
             continue;
 
         if(preg_match("/pass|pwd|capt|url/", $key))
             continue;
     ?>
-    <input type="hidden" name="<?php echo $key ?>" value="<?php echo $value ?>">
+    <input type="hidden" name="<?php echo htmlspecialchars($key); ?>" value="<?php echo htmlspecialchars($value); ?>">
     <?php
     }
     ?>

bbs/board_head.php

@@ -5,13 +5,13 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
 if (G5_IS_MOBILE) {
     // 모바일의 경우 설정을 따르지 않는다.
     include_once(G5_BBS_PATH.'/_head.php');
-    echo stripslashes($board['bo_mobile_content_head']);
+    echo html_purifier(stripslashes($board['bo_mobile_content_head']));
 } else {
     if(is_include_path_check($board['bo_include_head'])) {  //파일경로 체크
         @include ($board['bo_include_head']);
     } else {    //파일경로가 올바르지 않으면 기본파일을 가져옴
         include_once(G5_BBS_PATH.'/_head.php');
     }
-    echo stripslashes($board['bo_content_head']);
+    echo html_purifier(stripslashes($board['bo_content_head']));
 }
 ?>

bbs/board_tail.php

@@ -3,11 +3,11 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
 
 // 게시판 관리의 하단 파일 경로
 if (G5_IS_MOBILE) {
-    echo stripslashes($board['bo_mobile_content_tail']);
+    echo html_purifier(stripslashes($board['bo_mobile_content_tail']));
     // 모바일의 경우 설정을 따르지 않는다.
     include_once(G5_BBS_PATH.'/_tail.php');
 } else {
-    echo stripslashes($board['bo_content_tail']);
+    echo html_purifier(stripslashes($board['bo_content_tail']));
     if(is_include_path_check($board['bo_include_tail'])) {  //파일경로 체크
         @include ($board['bo_include_tail']);
     } else {    //파일경로가 올바르지 않으면 기본파일을 가져옴

bbs/confirm.php

@@ -2,9 +2,15 @@
 include_once('./_common.php');
 include_once(G5_PATH.'/head.sub.php');
 
-$url1 = clean_xss_tags($url1);
-$url2 = clean_xss_tags($url2);
-$url3 = clean_xss_tags($url3);
+$pattern1 = "/[\<\>\'\"\\\'\\\"\(\)]/";
+$pattern2 = "/\r\n|\r|\n|[^\x20-\x7e]/";
+
+$url1 = preg_replace($pattern1, "", clean_xss_tags($url1, 1));
+$url1 = preg_replace($pattern2, "", $url1);
+$url2 = preg_replace($pattern1, "", clean_xss_tags($url2, 1));
+$url2 = preg_replace($pattern2, "", $url2);
+$url3 = preg_replace($pattern1, "", clean_xss_tags($url3, 1));
+$url3 = preg_replace($pattern2, "", $url3);
 
 // url 체크
 check_url_host($url1);
@@ -25,12 +31,12 @@ if (confirm(conf)) {
 <article id="confirm_check">
 <header>
     <hgroup>
-        <h1><?php echo $header; ?></h1> <!-- 수행 중이던 작업 내용 -->
+        <h1><?php echo get_text(strip_tags($header)); ?></h1> <!-- 수행 중이던 작업 내용 -->
         <h2>아래 내용을 확인해 주세요.</h2>
     </hgroup>
 </header>
 <p>
-    <?php echo $msg; ?>
+    <?php echo get_text(strip_tags($msg)); ?>
 </p>
 
 <a href="<?php echo $url1; ?>">확인</a>

bbs/content.php

@@ -1,6 +1,8 @@
 <?php
 include_once('./_common.php');
 
+$co_id = preg_replace('/[^a-z0-9_]/i', '', $co_id);
+
 //dbconfig파일에 $g5['content_table'] 배열변수가 있는지 체크
 if( !isset($g5['content_table']) ){
     die('<meta charset="utf-8">관리자 모드에서 게시판관리->내용 관리를 먼저 확인해 주세요.');
@@ -24,6 +26,8 @@ if ($co['co_include_head'] && is_include_path_check($co['co_include_head']))
 else
     include_once('./_head.php');
 
+// KVE-2019-0828 취약점 내용
+$co['co_tag_filter_use'] = 1;
 $str = conv_content($co['co_content'], $co['co_html'], $co['co_tag_filter_use']);
 
 // $src 를 $dst 로 변환

bbs/delete_comment.php

@@ -53,8 +53,8 @@ $comment_reply = substr($write['wr_comment_reply'], 0, $len);
 $sql = " select count(*) as cnt from {$write_table}
             where wr_comment_reply like '{$comment_reply}%'
             and wr_id <> '{$comment_id}'
-            and wr_parent = '{$write[wr_parent]}'
-            and wr_comment = '{$write[wr_comment]}'
+            and wr_parent = '{$write['wr_parent']}'
+            and wr_comment = '{$write['wr_comment']}'
             and wr_is_comment = 1 ";
 $row = sql_fetch($sql);
 if ($row['cnt'] && !$is_admin)

bbs/download.php

@@ -25,8 +25,12 @@ if (!$file['bf_file'])
 // JavaScript 불가일 때
 if($js != 'on' && $board['bo_download_point'] < 0) {
     $msg = $file['bf_source'].' 파일을 다운로드 하시면 포인트가 차감('.number_format($board['bo_download_point']).'점)됩니다.\\n포인트는 게시물당 한번만 차감되며 다음에 다시 다운로드 하셔도 중복하여 차감하지 않습니다.\\n그래도 다운로드 하시겠습니까?';
-    $url1 = G5_BBS_URL.'/download.php?'.clean_query_string($_SERVER['QUERY_STRING']).'&amp;js=on';
+    $url1 = G5_BBS_URL.'/download.php?'.clean_query_string($_SERVER['QUERY_STRING'], false).'&js=on';
     $url2 = clean_xss_tags($_SERVER['HTTP_REFERER']);
+    
+    if( $url2 && stripos($url2, $_SERVER['REQUEST_URI']) !== false ){
+        $url2 = G5_BBS_URL.'/board.php?'.clean_query_string($_SERVER['QUERY_STRING'], false);
+    }
 
     //$url1 = 확인link, $url2=취소link
     // 특정주소로 이동시키려면 $url3 이용
@@ -84,11 +88,16 @@ if (!get_session($ss_name))
 $g5['title'] = '다운로드 &gt; '.conv_subject($write['wr_subject'], 255);
 
 //파일명에 한글이 있는 경우
+/*
 if(preg_match("/[\xA1-\xFE][\xA1-\xFE]/", $file['bf_source'])){
+    // 2015.09.02 날짜의 파이어폭스에서 인코딩된 문자 그대로 출력되는 문제가 발생됨, 2018.12.11 날짜의 파이어폭스에서는 해당 현상이 없으므로 해당 코드를 사용 안합니다.
     $original = iconv('utf-8', 'euc-kr', $file['bf_source']); // SIR 잉끼님 제안코드
 } else {
     $original = urlencode($file['bf_source']);
 }
+*/
+
+$original = urlencode($file['bf_source']);
 
 @include_once($board_skin_path.'/download.tail.skin.php');
 

bbs/email_certify.php

@@ -1,14 +1,21 @@
 <?php
 include_once('./_common.php');
 
+// 봇의 메일 링크 크롤링을 방지합니다.
+if(function_exists('check_mail_bot')){ check_mail_bot($_SERVER['REMOTE_ADDR']); }
+
 $mb_id  = trim($_GET['mb_id']);
 $mb_md5 = trim($_GET['mb_md5']);
 
-$sql = " select mb_id, mb_email_certify2 from {$g5['member_table']} where mb_id = '{$mb_id}' ";
+$sql = " select mb_id, mb_email_certify2, mb_leave_date, mb_intercept_date from {$g5['member_table']} where mb_id = '{$mb_id}' ";
 $row = sql_fetch($sql);
 if (!$row['mb_id'])
     alert('존재하는 회원이 아닙니다.', G5_URL);
 
+if ( $row['mb_leave_date'] || $row['mb_intercept_date'] ){
+    alert('탈퇴 또는 차단된 회원입니다.', G5_URL);
+}
+
 // 인증 링크는 한번만 처리가 되게 한다.
 sql_query(" update {$g5['member_table']} set mb_email_certify2 = '' where mb_id = '$mb_id' ");
 

bbs/formmail_send.php

@@ -12,14 +12,13 @@ if (!$is_member && $config['cf_formmail_is_member'])
 $email_enc = new str_encrypt();
 $to = $email_enc->decrypt($to);
 
-if (substr_count($to, "@") > 1)
-    alert_close('한번에 한사람에게만 메일을 발송할 수 있습니다.');
-
-
 if (!chk_captcha()) {
     alert('자동등록방지 숫자가 틀렸습니다.');
 }
 
+if (!preg_match("/([0-9a-zA-Z_-]+)@([0-9a-zA-Z_-]+)\.([0-9a-zA-Z_-]+)/", $to)){
+    alert_close('E-mail 주소가 형식에 맞지 않아서, 메일을 보낼수 없습니다.');
+}
 
 $file = array();
 for ($i=1; $i<=$attach; $i++) {

bbs/login.php

@@ -8,7 +8,7 @@ if( function_exists('social_check_login_before') ){
 $g5['title'] = '로그인';
 include_once('./_head.sub.php');
 
-$url = $_GET['url'];
+$url = strip_tags($_GET['url']);
 
 // url 체크
 check_url_host($url);

bbs/login_check.php

@@ -72,7 +72,7 @@ if ($auto_login) {
     // 3.27
     // 자동로그인 ---------------------------
     // 쿠키 한달간 저장
-    $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $mb['mb_password']);
+    $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['SERVER_SOFTWARE'] . $_SERVER['HTTP_USER_AGENT'] . $mb['mb_password']);
     set_cookie('ck_mb_id', $mb['mb_id'], 86400 * 31);
     set_cookie('ck_auto', $key, 86400 * 31);
     // 자동로그인 end ---------------------------

bbs/member_confirm.php

@@ -11,19 +11,28 @@ else
     $urlencode = urlencode($_SERVER[REQUEST_URI]);
 */
 
+$url = clean_xss_tags($_GET['url']);
+
 //소셜 로그인 한 경우
-if( function_exists('social_member_comfirm_redirect') ){    
+if( function_exists('social_member_comfirm_redirect') && (! $url || $url === 'register_form.php' || (function_exists('social_is_edit_page') && social_is_edit_page($url) ) ) ){    
     social_member_comfirm_redirect();
 }
 
 $g5['title'] = '회원 비밀번호 확인';
 include_once('./_head.sub.php');
 
-$url = clean_xss_tags($_GET['url']);
-
 // url 체크
 check_url_host($url, '', G5_URL, true);
 
+if($url){
+    $url = preg_replace('#^/\\\{1,}#', '/', $url);
+
+    if( preg_match('#^/{3,}#', $url) ){
+        $url = preg_replace('#^/{3,}#', '/', $url);
+    }
+}
+
+
 $url = get_text($url);
 
 include_once($member_skin_path.'/member_confirm.skin.php');

bbs/memo_form_update.php

@@ -60,7 +60,7 @@ for ($i=0; $i<count($member_list['id']); $i++) {
     $recv_mb_nick = get_text($member_list['nick'][$i]);
 
     // 쪽지 INSERT
-    $sql = " insert into {$g5['memo_table']} ( me_id, me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo ) values ( '$me_id', '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}' ) ";
+    $sql = " insert into {$g5['memo_table']} ( me_id, me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime ) values ( '$me_id', '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}', '0000-00-00 00:00:00' ) ";
     sql_query($sql);
 
     // 실시간 쪽지 알림 기능

bbs/memo_view.php

@@ -51,9 +51,9 @@ else
 
 
 // 다음 쪽지
-$sql = " select * from {$g5[memo_table]}
+$sql = " select * from {$g5['memo_table']}
             where me_id < '{$me_id}'
-            and me_{$kind}_mb_id = '{$member[mb_id]}'
+            and me_{$kind}_mb_id = '{$member['mb_id']}'
             order by me_id desc
             limit 1 ";
 $next = sql_fetch($sql);

bbs/move_update.php

@@ -1,6 +1,8 @@
 <?php
 include_once('./_common.php');
 
+$act = isset($act) ? strip_tags($act) : '';
+
 // 게시판 관리자 이상 복사, 이동 가능
 if ($is_admin != 'board' && $is_admin != 'group' && $is_admin != 'super')
     alert_close('게시판 관리자 이상 접근이 가능합니다.');
@@ -125,7 +127,7 @@ while ($row = sql_fetch_array($result))
                         // 제이프로님 코드제안 적용
                         $copy_file_name = ($bo_table !== $move_bo_table) ? $row3['bf_file'] : $row2['wr_id'].'_copy_'.$insert_id.'_'.$row3['bf_file'];
                         @copy($src_dir.'/'.$row3['bf_file'], $dst_dir.'/'.$copy_file_name);
-                        @chmod($dst_dir/$row3['bf_file'], G5_FILE_PERMISSION);
+                        @chmod($dst_dir.'/'.$copy_file_name, G5_FILE_PERMISSION);
                     }
 
                     $sql = " insert into {$g5['board_file_table']}
@@ -196,8 +198,14 @@ if ($sw == 'move')
 {
     for ($i=0; $i<count($save); $i++)
     {
-        for ($k=0; $k<count($save[$i]['bf_file']); $k++)
-            @unlink($save[$i]['bf_file'][$k]);
+        if( isset($save[$i]['bf_file']) && $save[$i]['bf_file'] ){
+            for ($k=0; $k<count($save[$i]['bf_file']); $k++) {
+                @unlink($save[$i]['bf_file'][$k]);
+
+                // 썸네일 파일 삭제, 먼지손 님 코드 제안
+                delete_board_thumbnail($bo_table, basename($save[$i]['bf_file'][$k]));
+            }
+        }
 
         sql_query(" delete from $write_table where wr_parent = '{$save[$i]['wr_id']}' ");
         sql_query(" delete from {$g5['board_new_table']} where bo_table = '$bo_table' and wr_id = '{$save[$i]['wr_id']}' ");

bbs/new_delete.php

@@ -87,7 +87,7 @@ for($i=0;$i<count($_POST['chk_bn_id']);$i++)
         $lf = '';
         for ($k=0; $k<count($notice_array); $k++) {
             if ((int)$write['wr_id'] != (int)$notice_array[$k])
-                $bo_notice .= $nl.$notice_array[$k];
+                $bo_notice .= $lf.$notice_array[$k];
 
             if($bo_notice)
                 $lf = ',';
@@ -117,7 +117,7 @@ for($i=0;$i<count($_POST['chk_bn_id']);$i++)
 
         // 코멘트 삭제
         if (!delete_point($write['mb_id'], $bo_table, $comment_id, '코멘트')) {
-            insert_point($write['mb_id'], $board['bo_comment_point'] * (-1), "{$board['bo_subject']} {$write[wr_parent]}-{$comment_id} 코멘트삭제");
+            insert_point($write['mb_id'], $board['bo_comment_point'] * (-1), "{$board['bo_subject']} {$write['wr_parent']}-{$comment_id} 코멘트삭제");
         }
 
         // 코멘트 삭제
@@ -128,7 +128,7 @@ for($i=0;$i<count($_POST['chk_bn_id']);$i++)
         $row = sql_fetch($sql);
 
         // 원글의 코멘트 숫자를 감소
-        sql_query(" update $write_table set wr_comment = wr_comment - 1, wr_last = '$row[wr_last]' where wr_id = '{$write['wr_parent']}' ");
+        sql_query(" update $write_table set wr_comment = wr_comment - 1, wr_last = '{$row['wr_last']}' where wr_id = '{$write['wr_parent']}' ");
 
         // 코멘트 숫자 감소
         sql_query(" update {$g5['board_table']} set bo_count_comment = bo_count_comment - 1 where bo_table = '$bo_table' ");

bbs/password.php

@@ -43,8 +43,8 @@ switch ($w) {
 
 include_once(G5_PATH.'/head.sub.php');
 
-//if ($board['bo_include_head']) { @include ($board['bo_include_head']); }
-//if ($board['bo_content_head']) { echo stripslashes($board['bo_content_head']); }
+//if ($board['bo_include_head'] && is_include_path_check($board['bo_content_head'])) { @include ($board['bo_include_head']); }
+//if ($board['bo_content_head']) { echo html_purifier(stripslashes($board['bo_content_head'])); }
 
 /* 비밀글의 제목을 가져옴 지운아빠 2013-01-29 */
 $sql = " select wr_subject from {$write_table}
@@ -57,8 +57,8 @@ $g5['title'] = get_text($row['wr_subject']);
 
 include_once($member_skin_path.'/password.skin.php');
 
-//if ($board['bo_content_tail']) { echo stripslashes($board['bo_content_tail']); }
-//if ($board['bo_include_tail']) { @include ($board['bo_include_tail']); }
+//if ($board['bo_content_tail']) { echo html_purifier(stripslashes($board['bo_content_tail'])); }
+//if ($board['bo_include_tail'] && is_include_path_check($board['bo_content_tail'])) { @include ($board['bo_include_tail']); }
 
 include_once(G5_PATH.'/tail.sub.php');
 ?>

bbs/password_lost2.php

@@ -11,7 +11,7 @@ if (!chk_captcha()) {
     alert('자동등록방지 숫자가 틀렸습니다.');
 }
 
-$email = trim($_POST['mb_email']);
+$email = get_email_address(trim($_POST['mb_email']));
 
 if (!$email)
     alert_close('메일주소 오류입니다.');
@@ -21,9 +21,9 @@ $row = sql_fetch($sql);
 if ($row['cnt'] > 1)
     alert('동일한 메일주소가 2개 이상 존재합니다.\\n\\n관리자에게 문의하여 주십시오.');
 
-$sql = " select mb_no, mb_id, mb_name, mb_nick, mb_email, mb_datetime from {$g5['member_table']} where mb_email = '$email' ";
+$sql = " select mb_no, mb_id, mb_name, mb_nick, mb_email, mb_datetime, mb_leave_date from {$g5['member_table']} where mb_email = '$email' ";
 $mb = sql_fetch($sql);
-if (!$mb['mb_id'])
+if (!$mb['mb_id'] || $mb['mb_leave_date'])
     alert('존재하지 않는 회원입니다.');
 else if (is_admin($mb['mb_id']))
     alert('관리자 아이디는 접근 불가합니다.');

bbs/password_lost_certify.php

@@ -1,6 +1,9 @@
 <?php
 include_once('./_common.php');
 
+// 봇의 메일 링크 크롤링을 방지합니다.
+if(function_exists('check_mail_bot')){ check_mail_bot($_SERVER['REMOTE_ADDR']); }
+
 // 오류시 공히 Error 라고 처리하는 것은 회원정보가 있는지? 비밀번호가 틀린지? 를 알아보려는 해킹에 대비한것
 
 $mb_no = trim($_GET['mb_no']);

bbs/qawrite.php

@@ -67,7 +67,7 @@ if(is_file($skin_file)) {
 
     $content = '';
     if ($w == '') {
-        $content = $qaconfig['qa_insert_content'];
+        $content = html_purifier($qaconfig['qa_insert_content']);
     } else if($w == 'r') {
         if($is_dhtml_editor)
             $content = '<div><br><br><br>====== 이전 답변내용 =======<br></div>';

bbs/view_image.php

@@ -4,13 +4,18 @@ include_once('./_common.php');
 $g5['title'] = '이미지 크게보기';
 include_once(G5_PATH.'/head.sub.php');
 
-$filename = $_GET['fn'];
-$bo_table = $_GET['bo_table'];
+$filename = preg_replace('/[^A-Za-z0-9 _ .\-\/]/', '', $_GET['fn']);
 
-if(strpos($filename, 'data/editor')) {
+$extension = pathinfo($filename, PATHINFO_EXTENSION);
+
+if ( ! preg_match('/(jpg|jpeg|png|gif|bmp)$/i', $extension) ){
+    alert_close('이미지 확장자가 아닙니다.');
+}
+
+if(strpos($filename, G5_DATA_DIR.'/editor')) {
     $editor_file = strstr($filename, 'editor');
     $filepath = G5_DATA_PATH.'/'.$editor_file;
-} else if(strpos($filename, 'data/qa')) {
+} else if(strpos($filename, G5_DATA_DIR.'/qa')) {
     $editor_file = strstr($filename, 'qa');
     $filepath = G5_DATA_PATH.'/'.$editor_file;
 } else {

bbs/visit_insert.inc.php

@@ -13,8 +13,8 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
     $remote_addr = escape_trim($_SERVER['REMOTE_ADDR']);
     $referer = "";
     if (isset($_SERVER['HTTP_REFERER']))
-        $referer = escape_trim(clean_xss_tags($_SERVER['HTTP_REFERER']));
-    $user_agent  = escape_trim(clean_xss_tags($_SERVER['HTTP_USER_AGENT']));
+        $referer = escape_trim(clean_xss_tags(strip_tags($_SERVER['HTTP_REFERER'])));
+    $user_agent  = escape_trim(clean_xss_tags(strip_tags($_SERVER['HTTP_USER_AGENT'])));
     $vi_browser = '';
     $vi_os = '';
     $vi_device = '';

bbs/write.php

@@ -362,7 +362,7 @@ if (isset($write['wr_subject'])) {
 
 $content = '';
 if ($w == '') {
-    $content = $board['bo_insert_content'];
+    $content = html_purifier($board['bo_insert_content']);
 } else if ($w == 'r') {
     if (!strstr($write['wr_option'], 'html')) {
         $content = "\n\n\n > "

common.php

@@ -29,20 +29,22 @@ for ($i=0; $i<$ext_cnt; $i++) {
 
 function g5_path()
 {
-    $chroot = substr($_SERVER['SCRIPT_FILENAME'], 0, strpos($_SERVER['SCRIPT_FILENAME'], dirname(__FILE__)));
-    $result['path'] = str_replace('\\', '/', $chroot.dirname(__FILE__));
-    $tilde_remove = preg_replace('/^\/\~[^\/]+(.*)$/', '$1', $_SERVER['SCRIPT_NAME']);
-    $document_root = str_replace($tilde_remove, '', $_SERVER['SCRIPT_FILENAME']);
-    $pattern = '/' . preg_quote($document_root, '/') . '/i';
-    $root = preg_replace($pattern, '', $result['path']);
-    $port = ($_SERVER['SERVER_PORT'] == 80 || $_SERVER['SERVER_PORT'] == 443) ? '' : ':'.$_SERVER['SERVER_PORT'];
-    $http = 'http' . ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ? 's' : '') . '://';
-    $user = str_replace(preg_replace($pattern, '', $_SERVER['SCRIPT_FILENAME']), '', $_SERVER['SCRIPT_NAME']);
-    $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME'];
-    if(isset($_SERVER['HTTP_HOST']) && preg_match('/:[0-9]+$/', $host))
-        $host = preg_replace('/:[0-9]+$/', '', $host);
-    $host = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", '', $host);
-    $result['url'] = $http.$host.$port.$user.$root;
+    $chroot = substr($_SERVER['SCRIPT_FILENAME'], 0, strpos($_SERVER['SCRIPT_FILENAME'], dirname(__FILE__))); 
+    $result['path'] = str_replace('\\', '/', $chroot.dirname(__FILE__)); 
+    $server_script_name = preg_replace('/\/+/', '/', str_replace('\\', '/', $_SERVER['SCRIPT_NAME'])); 
+    $server_script_filename = preg_replace('/\/+/', '/', str_replace('\\', '/', $_SERVER['SCRIPT_FILENAME'])); 
+    $tilde_remove = preg_replace('/^\/\~[^\/]+(.*)$/', '$1', $server_script_name); 
+    $document_root = str_replace($tilde_remove, '', $server_script_filename); 
+    $pattern = '/' . preg_quote($document_root, '/') . '/i'; 
+    $root = preg_replace($pattern, '', $result['path']); 
+    $port = ($_SERVER['SERVER_PORT'] == 80 || $_SERVER['SERVER_PORT'] == 443) ? '' : ':'.$_SERVER['SERVER_PORT']; 
+    $http = 'http' . ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ? 's' : '') . '://'; 
+    $user = str_replace(preg_replace($pattern, '', $server_script_filename), '', $server_script_name); 
+    $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME']; 
+    if(isset($_SERVER['HTTP_HOST']) && preg_match('/:[0-9]+$/', $host)) 
+        $host = preg_replace('/:[0-9]+$/', '', $host); 
+    $host = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", '', $host); 
+    $result['url'] = $http.$host.$port.$user.$root; 
     return $result;
 }
 
@@ -122,7 +124,7 @@ $member = array();
 $board  = array();
 $group  = array();
 $g5     = array();
-
+$qaconfig = array();
 
 //==============================================================================
 // 공통
@@ -374,7 +376,7 @@ if ($_SESSION['ss_mb_id']) { // 로그인중이라면
             $sql = " select mb_password, mb_intercept_date, mb_leave_date, mb_email_certify from {$g5['member_table']} where mb_id = '{$tmp_mb_id}' ";
             $row = sql_fetch($sql);
             if($row['mb_password']){
-                $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $row['mb_password']);
+                $key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['SERVER_SOFTWARE'] . $_SERVER['HTTP_USER_AGENT'] . $row['mb_password']);
                 // 쿠키에 저장된 키와 같다면
                 $tmp_key = get_cookie('ck_auto');
                 if ($tmp_key === $key && $tmp_key) {
@@ -621,6 +623,7 @@ if(!empty($extend_file) && is_array($extend_file)) {
     foreach($extend_file as $file) {
         include_once(G5_EXTEND_PATH.'/'.$file);
     }
+    unset($file);
 }
 unset($extend_file);
 

config.php

@@ -5,7 +5,7 @@
 ********************/
 
 define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.3.1.4');
+define('G5_GNUBOARD_VER', '5.3.3.3');
 
 // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
 define('_GNUBOARD_', true);

extend/sms5.extend.php

@@ -23,6 +23,8 @@ $g5['sms5_book_group_table']      = $g5['sms5_prefix'] . 'book_group';
 $g5['sms5_form_table']            = $g5['sms5_prefix'] . 'form';
 $g5['sms5_form_group_table']      = $g5['sms5_prefix'] . 'form_group';
 
+$sms5 = array();
+
 if (!empty($config['cf_sms_use'])) {
 
     $sms5 = sql_fetch("select * from {$g5['sms5_config_table']} ", false);

g4_import_run.php

@@ -71,6 +71,7 @@ document.onkeydown = noRefresh ;
 <?php
 flush();
 
+$g4 = array();
 // g4의 confing.php
 require('./'.$g4_config_file);
 

head.sub.php

@@ -19,6 +19,9 @@ else {
     $g5_head_title .= " | ".$config['cf_title'];
 }
 
+$g5['title'] = strip_tags($g5['title']);
+$g5_head_title = strip_tags($g5_head_title);
+
 // 현재 접속자
 // 게시판 제목에 ' 포함되면 오류 발생
 $g5['lo_location'] = addslashes($g5['title']);

install/ajax.install.check.php

@@ -0,0 +1,53 @@
+<?php
+include_once ('../config.php');
+include_once('../lib/json.lib.php');
+include_once('../lib/common.lib.php');    // 공통 라이브러리
+include_once('./install.function.php');    // 인스톨 과정 함수 모음
+
+$data_path = '../'.G5_DATA_DIR;
+
+// 파일이 존재한다면 설치할 수 없다.
+$dbconfig_file = $data_path.'/'.G5_DBCONFIG_FILE;
+if (file_exists($dbconfig_file)) {
+    die(install_json_msg('프로그램이 이미 설치되어 있습니다.'));
+}
+
+$mysql_host  = safe_install_string_check($_POST['mysql_host'], 'json');
+$mysql_user  = safe_install_string_check($_POST['mysql_user'], 'json');
+$mysql_pass  = safe_install_string_check($_POST['mysql_pass'], 'json');
+$mysql_db    = safe_install_string_check($_POST['mysql_db'], 'json');
+$table_prefix= safe_install_string_check(preg_replace('/[^a-zA-Z0-9_]/', '_', $_POST['table_prefix']));
+
+$tmp_str = isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '';
+$ajax_token = md5($tmp_str.$_SERVER['REMOTE_ADDR'].$_SERVER['DOCUMENT_ROOT']);
+
+$bool_ajax_token = ($ajax_token == $_POST['ajax_token']) ? true : false;
+
+if( !($mysql_host && $mysql_user && $mysql_pass && $mysql_db && $table_prefix && $bool_ajax_token) ){
+    die(install_json_msg('잘못된 요청입니다.'));
+}
+
+try {
+    $dblink = sql_connect($mysql_host, $mysql_user, $mysql_pass, $mysql_db);
+} catch (Exception $e) {
+}
+
+if (!$dblink) {
+    die(install_json_msg('MySQL Host, User, Password 를 확인해 주십시오.'));
+}
+
+try {
+    $select_db = sql_select_db($mysql_db, $dblink);
+} catch (Exception $e) {
+}
+
+if (!$select_db) {
+    die(install_json_msg('MySQL DB 를 확인해 주십시오.'));
+}
+
+if(sql_query("DESCRIBE `{$table_prefix}config`", G5_DISPLAY_SQL_ERROR, $dblink)) {
+    die(install_json_msg('주의! 이미 테이블이 존재하므로, 기존 DB 자료가 망실됩니다. 계속 진행하겠습니까?', 'exists'));
+}
+
+die(install_json_msg('ok', 'success'));
+?>

install/install.function.php

@@ -0,0 +1,40 @@
+<?php
+if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
+
+if( ! function_exists('safe_install_string_check') ){
+    function safe_install_string_check( $str, $is_json=false ) {
+        $is_check = false;
+
+        if(preg_match('#\);(passthru|eval|pcntl_exec|exec|system|popen|fopen|fsockopen|file|file_get_contents|readfile|unlink|include|include_once|require|require_once)\s?#i', $str)) {
+            $is_check = true;
+        }
+
+        if(preg_match('#\$_(get|post|request)\s?\[.*?\]\s?\)#i', $str)){
+            $is_check = true;
+        }
+
+        if($is_check){
+            $msg = "입력한 값에 안전하지 않는 문자가 포함되어 있습니다. 설치를 중단합니다.";
+
+            if($is_json){
+                die(install_json_msg($msg));
+            }
+
+            die($msg);
+        }
+
+        return $str;
+    }
+}
+
+if( ! function_exists('install_json_msg') ){
+    function install_json_msg($msg, $type='error'){
+
+        $error_msg = ($type==='error') ? $msg : '';
+        $success_msg = ($type==='success') ? $msg : '';
+        $exists_msg = ($type==='exists') ? $msg : '';
+
+        return json_encode(array('error'=>$error_msg, 'success'=>$success_msg, 'exists'=>$exists_msg));
+    }
+}
+?>

install/install_config.php

@@ -17,6 +17,9 @@ if (!isset($_POST['agree']) || $_POST['agree'] != '동의함') {
     echo "<div class=\"inner_btn\"><a href=\"./\">뒤로가기</a></div></div>".PHP_EOL;
     exit;
 }
+
+$tmp_str = isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '';
+$ajax_token = md5($tmp_str.$_SERVER['REMOTE_ADDR'].$_SERVER['DOCUMENT_ROOT']);
 ?>
 
 
@@ -66,6 +69,7 @@ if (!isset($_POST['agree']) || $_POST['agree'] != '동의함') {
 
     <table class="ins_frm">
     <caption>최고관리자 정보입력</caption>
+    <input type="hidden" name="ajax_token" value="<?php echo $ajax_token; ?>" >
     <colgroup>
         <col style="width:150px">
         <col>
@@ -108,6 +112,7 @@ if (!isset($_POST['agree']) || $_POST['agree'] != '동의함') {
     </div>
 </div>
 
+<script src="../js/jquery-1.8.3.min.js"></script>
 <script>
 function frm_install_submit(f)
 {
@@ -163,11 +168,34 @@ function frm_install_submit(f)
         alert('TABLE명 접두사'+reg_msg); f.table_prefix.focus(); return false;
     }
 
-    if(/^[a-z][a-z0-9]/i.test(f.admin_id.value) == false) {
+    if(/^[a-z]+[a-z0-9]{2,19}$/i.test(f.admin_id.value) == false) {
         alert('최고관리자 회원 ID는 첫자는 반드시 영문자 그리고 영문자와 숫자로만 만드셔야 합니다.');
         f.admin_id.focus();
         return false;
     }
+    
+    if (window.jQuery) {
+
+        var jqxhr = jQuery.post( "ajax.install.check.php", $(f).serialize(), function(data) {
+            
+            if( data.error ){
+                alert(data.error);
+            } else if( data.exists ) {
+                if( confirm(data.exists) ){
+                    f.submit();
+                }
+            } else if( data.success ) {
+                f.submit();
+            }
+
+        }, "json");
+
+        jqxhr.fail(function(xhr) {
+            alert( xhr.responseText );
+        });
+
+        return false;
+    }
 
     return true;
 }

install/install_db.php

@@ -11,26 +11,7 @@ header('Pragma: no-cache'); // HTTP/1.0
 
 include_once ('../config.php');
 include_once ('../lib/common.lib.php');
-
-if( ! function_exists('safe_install_string_check') ){
-    function safe_install_string_check( $str ) {
-        $is_check = false;
-
-        if(preg_match('#\);(passthru|eval|pcntl_exec|exec|system|popen|fopen|fsockopen|file|file_get_contents|readfile|unlink|include|include_once|require|require_once)\s?#i', $str)) {
-            $is_check = true;
-        }
-
-        if(preg_match('#\$_(get|post|request)\s?\[.*?\]\s?\)#i', $str)){
-            $is_check = true;
-        }
-
-        if($is_check){
-            die("입력한 값에 안전하지 않는 문자가 포함되어 있습니다. 설치를 중단합니다.");
-        }
-
-        return $str;
-    }
-}
+include_once('./install.function.php');    // 인스톨 과정 함수 모음
 
 $title = G5_VERSION." 설치 완료 3/3";
 include_once ('./install.inc.php');
@@ -47,6 +28,10 @@ $admin_pass  = $_POST['admin_pass'];
 $admin_name  = $_POST['admin_name'];
 $admin_email = $_POST['admin_email'];
 
+if (preg_match("/[^0-9a-z_]+/i", $admin_id)) {
+    die('<div class="ins_inner"><p>관리자 아이디는 영문자, 숫자, _ 만 입력하세요.</p><div class="inner_btn"><a href="./install_config.php">뒤로가기</a></div></div>');
+}
+
 $dblink = sql_connect($mysql_host, $mysql_user, $mysql_pass, $mysql_db);
 if (!$dblink) {
 ?>

js/certify.js

@@ -1,6 +1,11 @@
 // 본인확인 인증창 호출
-function certify_win_open(type, url)
+function certify_win_open(type, url, event)
 {
+
+    if (typeof event == "undefined") {
+        event = window.event;
+    }
+
     if(type == 'kcb-ipin')
     {
         var popupWindow = window.open( url, "kcbPop", "left=200, top=100, status=0, width=450, height=550" );

js/common.js

@@ -350,7 +350,8 @@ var check_goto_new = function(href, event) {
     if( !(typeof g5_is_mobile != "undefined" && g5_is_mobile) ){
         if (window.opener && window.opener.document && window.opener.document.getElementById) {
             event.preventDefault ? event.preventDefault() : (event.returnValue = false);
-            window.opener.document.location.href = href;
+            window.open(href);
+            //window.opener.document.location.href = href;
         }
     }
 }
@@ -359,7 +360,7 @@ var check_goto_new = function(href, event) {
  * 메일 창
  **/
 var win_email = function(href) {
-    var new_win = window.open(href, 'win_email', 'left=100,top=100,width=600,height=580,scrollbars=0');
+    var new_win = window.open(href, 'win_email', 'left=100,top=100,width=600,height=580,scrollbars=1');
     new_win.focus();
 }
 
@@ -439,8 +440,10 @@ var win_zip = function(frm_name, frm_zip, frm_addr1, frm_addr2, frm_addr3, frm_j
         if(of[frm_jibeon] !== undefined){
             of[frm_jibeon].value = data.userSelectedType;
         }
-
-        of[frm_addr2].focus();
+        
+        setTimeout(function(){
+            of[frm_addr2].focus();
+        } , 100);
     };
 
     switch(zip_case) {

js/kakaolink.js

@@ -1,10 +1,20 @@
-function kakaolink_send(text, url)
+function kakaolink_send(text, url, image)
 {
+    if( image === undefined ){
+        image = '';
+    }
+
     // 카카오톡 링크 버튼을 생성합니다. 처음 한번만 호출하면 됩니다.
-    Kakao.Link.sendTalkLink({
-      webLink : {
-        text: String(text),
-        url: url // 앱 설정의 웹 플랫폼에 등록한 도메인의 URL이어야 합니다.
-      }
+    Kakao.Link.sendDefault({
+        objectType: 'feed',
+        content: {
+            title: String(text),
+            description: url,
+            imageUrl: image,
+            link: {
+                mobileWebUrl: url,
+                webUrl: url // 앱 설정의 웹 플랫폼에 등록한 도메인의 URL이어야 합니다.
+            }
+        }
     });
 }

lib/common.lib.php

@@ -288,6 +288,7 @@ function get_file($bo_table, $wr_id)
     while ($row = sql_fetch_array($result))
     {
         $no = $row['bf_no'];
+        $bf_content = $row['bf_content'] ? html_purifier($row['bf_content']) : '';
         $file[$no]['href'] = G5_BBS_URL."/download.php?bo_table=$bo_table&wr_id=$wr_id&no=$no" . $qstr;
         $file[$no]['download'] = $row['bf_download'];
         // 4.00.11 - 파일 path 추가
@@ -295,8 +296,8 @@ function get_file($bo_table, $wr_id)
         $file[$no]['size'] = get_filesize($row['bf_filesize']);
         $file[$no]['datetime'] = $row['bf_datetime'];
         $file[$no]['source'] = addslashes($row['bf_source']);
-        $file[$no]['bf_content'] = $row['bf_content'];
-        $file[$no]['content'] = get_text($row['bf_content']);
+        $file[$no]['bf_content'] = $bf_content;
+        $file[$no]['content'] = get_text($bf_content);
         //$file[$no]['view'] = view_file_link($row['bf_file'], $file[$no]['content']);
         $file[$no]['view'] = view_file_link($row['bf_file'], $row['bf_width'], $row['bf_height'], $file[$no]['content']);
         $file[$no]['file'] = $row['bf_file'];
@@ -714,6 +715,8 @@ function get_group($gr_id)
 function get_member($mb_id, $fields='*')
 {
     global $g5;
+    
+    $mb_id = preg_replace("/[^0-9a-z_]+/i", "", $mb_id);
 
     return sql_fetch(" select $fields from {$g5['member_table']} where mb_id = TRIM('$mb_id') ");
 }
@@ -2068,13 +2071,21 @@ function abs_ip2long($ip='')
 
 function get_selected($field, $value)
 {
-    return ($field==$value) ? ' selected="selected"' : '';
+    if( is_int($value) ){
+        return ((int) $field===$value) ? ' selected="selected"' : '';
+    }
+
+    return ($field===$value) ? ' selected="selected"' : '';
 }
 
 
 function get_checked($field, $value)
 {
-    return ($field==$value) ? ' checked="checked"' : '';
+    if( is_int($value) ){
+        return ((int) $field===$value) ? ' checked="checked"' : '';
+    }
+
+    return ($field===$value) ? ' checked="checked"' : '';
 }
 
 
@@ -2107,7 +2118,7 @@ function get_uniqid()
     sql_query(" LOCK TABLE {$g5['uniqid_table']} WRITE ");
     while (1) {
         // 년월일시분초에 100분의 1초 두자리를 추가함 (1/100 초 앞에 자리가 모자르면 0으로 채움)
-        $key = date('ymdHis', time()) . str_pad((int)(microtime()*100), 2, "0", STR_PAD_LEFT);
+        $key = date('YmdHis', time()) . str_pad((int)(microtime()*100), 2, "0", STR_PAD_LEFT);
 
         $result = sql_query(" insert into {$g5['uniqid_table']} set uq_id = '$key', uq_ip = '{$_SERVER['REMOTE_ADDR']}' ", false);
         if ($result) break; // 쿼리가 정상이면 빠진다.
@@ -2678,7 +2689,7 @@ function get_qa_config($fld='*')
 
 // get_sock 함수 대체
 if (!function_exists("get_sock")) {
-    function get_sock($url)
+    function get_sock($url, $timeout=30)
     {
         // host 와 uri 를 분리
         //if (ereg("http://([a-zA-Z0-9_\-\.]+)([^<]*)", $url, $res))
@@ -2689,7 +2700,7 @@ if (!function_exists("get_sock")) {
         }
 
         // 80번 포트로 소캣접속 시도
-        $fp = fsockopen ($host, 80, $errno, $errstr, 30);
+        $fp = fsockopen ($host, 80, $errno, $errstr, $timeout);
         if (!$fp)
         {
             //die("$errstr ($errno)\n");
@@ -2741,6 +2752,11 @@ function module_exec_check($exe, $type)
         } else {
             // 바이너리 파일인지
             if($is_linux) {
+
+                if ( !function_exists('exec') ) {
+                    alert('exec 함수실행이 불가능하므로 사용할수 없습니다.');
+                }
+
                 $search = false;
                 $isbinary = true;
                 $executable = true;
@@ -2871,9 +2887,31 @@ function get_search_string($stx)
 }
 
 // XSS 관련 태그 제거
-function clean_xss_tags($str)
+function clean_xss_tags($str, $check_entities=0)
 {
-    $str = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $str);
+    $str_len = strlen($str);
+    
+    $i = 0;
+    while($i <= $str_len){
+        $result = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $str);
+        
+        if( $check_entities ){
+            $result = str_replace(array('&colon;', '&lpar;', '&rpar;', '&NewLine;', '&Tab;'), '', $result);
+        }
+
+        if((string)$result === (string)$str) break;
+
+        $str = $result;
+        $i++;
+    }
+
+    return $str;
+}
+
+// XSS 어트리뷰트 태그 제거
+function clean_xss_attributes($str)
+{
+    $str = preg_replace('#(onabort|onactivate|onafterprint|onafterupdate|onbeforeactivate|onbeforecopy|onbeforecut|onbeforedeactivate|onbeforeeditfocus|onbeforepaste|onbeforeprint|onbeforeunload|onbeforeupdate|onblur|onbounce|oncellchange|onchange|onclick|oncontextmenu|oncontrolselect|oncopy|oncut|ondataavaible|ondatasetchanged|ondatasetcomplete|ondblclick|ondeactivate|ondrag|ondragdrop|ondragend|ondragenter|ondragleave|ondragover|ondragstart|ondrop|onerror|onerrorupdate|onfilterupdate|onfinish|onfocus|onfocusin|onfocusout|onhelp|onkeydown|onkeypress|onkeyup|onlayoutcomplete|onload|onlosecapture|onmousedown|onmouseenter|onmouseleave|onmousemove|onmoveout|onmouseover|onmouseup|onmousewheel|onmove|onmoveend|onmovestart|onpaste|onpropertychange|onreadystatechange|onreset|onresize|onresizeend|onresizestart|onrowexit|onrowsdelete|onrowsinserted|onscroll|onselect|onselectionchange|onselectstart|onstart|onstop|onsubmit|onunload)\\s*=\\s*\\\?".*?"#is', '', $str);
 
     return $str;
 }
@@ -2938,6 +2976,9 @@ function member_delete($mb_id)
 
     // 아이콘 삭제
     @unlink(G5_DATA_PATH.'/member/'.substr($mb_id,0,2).'/'.$mb_id.'.gif');
+
+    // 프로필 이미지 삭제
+    @unlink(G5_DATA_PATH.'/member_image/'.substr($mb_id,0,2).'/'.$mb_id.'.gif');
 }
 
 // 이메일 주소 추출
@@ -2975,7 +3016,7 @@ function replace_filename($name)
 // 아이코드 사용자정보
 function get_icode_userinfo($id, $pass)
 {
-    $res = get_sock('http://www.icodekorea.com/res/userinfo.php?userid='.$id.'&userpw='.$pass);
+    $res = get_sock('http://www.icodekorea.com/res/userinfo.php?userid='.$id.'&userpw='.$pass, 2);
     $res = explode(';', $res);
     $userinfo = array(
         'code'      => $res[0], // 결과코드
@@ -3269,7 +3310,7 @@ class str_encrypt
     function __construct($salt='')
     {
         if(!$salt)
-            $this->salt = md5(preg_replace('/[^0-9A-Za-z]/', substr(G5_MYSQL_USER, -1), G5_MYSQL_PASSWORD));
+            $this->salt = md5(preg_replace('/[^0-9A-Za-z]/', substr(G5_MYSQL_USER, -1), $_SERVER['SERVER_SOFTWARE'].$_SERVER['DOCUMENT_ROOT']));
         else
             $this->salt = $salt;
 
@@ -3288,12 +3329,12 @@ class str_encrypt
             $result .= $char;
         }
 
-        return base64_encode($result);
+        return strtr(base64_encode($result) , '+/=', '._-');
     }
 
     function decrypt($str) {
         $result = '';
-        $str    = base64_decode($str);
+        $str    = base64_decode(strtr($str, '._-', '+/='));
         $length = strlen($str);
 
         for($i=0; $i<$length; $i++) {
@@ -3384,7 +3425,7 @@ function get_head_title($title){
     global $g5;
 
     if( isset($g5['board_title']) && $g5['board_title'] ){
-        $title = $g5['board_title'];
+        $title = strip_tags($g5['board_title']);
     }
 
     return $title;
@@ -3405,10 +3446,34 @@ function is_use_email_certify(){
 
 function get_real_client_ip(){
 
-    if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
-        return $_SERVER['HTTP_X_FORWARDED_FOR'];
+    $real_ip = $_SERVER['REMOTE_ADDR'];
 
-    return $_SERVER['REMOTE_ADDR'];
+    if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\z/', $_SERVER['HTTP_X_FORWARDED_FOR']) ){
+        $real_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
+    }
+
+    return preg_replace('/[^0-9.]/', '', $real_ip);
+}
+
+function check_mail_bot($ip=''){
+
+    //아이피를 체크하여 메일 크롤링을 방지합니다.
+    $check_ips = array('211.249.40.');
+    $bot_message = 'bot 으로 판단되어 중지합니다.';
+    
+    if($ip){
+        foreach( $check_ips as $c_ip ){
+            if( preg_match('/^'.preg_quote($c_ip).'/', $ip) ) {
+                die($bot_message);
+            }
+        }
+    }
+
+    // user agent를 체크하여 메일 크롤링을 방지합니다.
+    $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';
+    if ($user_agent === 'Carbon' || strpos($user_agent, 'BingPreview') !== false || strpos($user_agent, 'Slackbot') !== false) { 
+        die($bot_message);
+    } 
 }
 
 function get_call_func_cache($func, $args=array()){
@@ -3432,13 +3497,28 @@ function get_call_func_cache($func, $args=array()){
     return $result;
 }
 
-// include 하는 경로에 data file 경로가 포함되어 있는지 체크합니다.
+// include 하는 경로에 data file 경로나 안전하지 않은 경로가 있는지 체크합니다.
 function is_include_path_check($path='', $is_input='')
 {
     if( $path ){
-        if ($is_input){
 
-            if( stripos($path, 'php://') !== false || stripos($path, 'zlib://') !== false || stripos($path, 'bzip2://') !== false || stripos($path, 'zip://') !== false || stripos($path, 'data:text/') !== false || stripos($path, 'data://') !== false ){
+        if( strlen($path) > 255 ){
+            return false;
+        }
+
+        if ($is_input){
+            // 장태진 @jtjisgod <jtjisgod@gmail.com> 추가
+            // 보안 목적 : rar wrapper 차단
+
+            if( stripos($path, 'rar:') !== false || stripos($path, 'php:') !== false || stripos($path, 'zlib:') !== false || stripos($path, 'bzip2:') !== false || stripos($path, 'zip:') !== false || stripos($path, 'data:') !== false || stripos($path, 'phar:') !== false || stripos($path, 'file:') !== false ){
+                return false;
+            }
+            
+            $replace_path = str_replace('\\', '/', $path);
+            $slash_count = substr_count(str_replace('\\', '/', $_SERVER['SCRIPT_NAME']), '/');
+            $peer_count = substr_count($replace_path, '../');
+
+            if ( $peer_count && $peer_count > $slash_count ){
                 return false;
             }
 
@@ -3478,14 +3558,23 @@ function is_include_path_check($path='', $is_input='')
                 return false;
             }
 
-            if( preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $path) ){
+            if( preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $replace_path) ){
+                return false;
+            }
+            if( preg_match('/'.G5_PLUGIN_DIR.'\//i', $replace_path) && (preg_match('/'.G5_OKNAME_DIR.'\//i', $replace_path) || preg_match('/'.G5_KCPCERT_DIR.'\//i', $replace_path) || preg_match('/'.G5_LGXPAY_DIR.'\//i', $replace_path)) ){
+                return false;
+            }
+            if( substr_count($replace_path, './') > 5 ){
+                return false;
+            }
+            if( defined('G5_SHOP_DIR') && preg_match('/'.G5_SHOP_DIR.'\//i', $replace_path) && preg_match('/kcp\//i', $replace_path) ){
                 return false;
             }
         }
 
         $extension = pathinfo($path, PATHINFO_EXTENSION);
         
-        if($extension && preg_match('/(jpg|jpeg|png|gif|bmp|conf)$/i', $extension)) {
+        if($extension && preg_match('/(jpg|jpeg|png|gif|bmp|conf|php\-x)$/i', $extension)) {
             return false;
         }
     }

lib/icode.lms.lib.php

@@ -119,7 +119,7 @@ class LMS {
 	function Send() {
 		$fsocket = fsockopen($this->socket_host,$this->socket_port, $errno, $errstr, 2);
 		if (!$fsocket) return false;
-		set_time_limit(300);
+		set_time_limit(60);
 
 		foreach($this->Data as $puts) {
 			fputs($fsocket, $puts);

lib/icode.sms.lib.php

@@ -122,9 +122,9 @@ class SMS {
 	}
 
 	function Send () {
-		$fp=@fsockopen(trim($this->SMS_Server),trim($this->SMS_Port));
+		$fp=@fsockopen(trim($this->SMS_Server),trim($this->SMS_Port), $errno, $errstr, 2);
 		if (!$fp) return false;
-		set_time_limit(300);
+		set_time_limit(60);
 
 		## php4.3.10일경우
         ## zend 최신버전으로 업해주세요..

lib/register.lib.php

@@ -180,6 +180,4 @@ function exist_mb_hp($reg_mb_hp, $reg_mb_id)
     else
         return "";
 }
-
-return;
 ?>

lib/thumbnail.lib.php

@@ -25,29 +25,31 @@ function get_list_thumbnail($bo_table, $wr_id, $thumb_width, $thumb_height, $is_
         $matches = get_editor_image($write['wr_content'], false);
         $edt = true;
 
-        for($i=0; $i<count($matches[1]); $i++)
-        {
-            // 이미지 path 구함
-            $p = parse_url($matches[1][$i]);
-            if(strpos($p['path'], '/'.G5_DATA_DIR.'/') != 0)
-                $data_path = preg_replace('/^\/.*\/'.G5_DATA_DIR.'/', '/'.G5_DATA_DIR, $p['path']);
-            else
-                $data_path = $p['path'];
+        if(isset($matches[1]) && is_array($matches[1])){
+            for($i=0; $i<count($matches[1]); $i++)
+            {
+                // 이미지 path 구함
+                $p = parse_url($matches[1][$i]);
+                if(strpos($p['path'], '/'.G5_DATA_DIR.'/') != 0)
+                    $data_path = preg_replace('/^\/.*\/'.G5_DATA_DIR.'/', '/'.G5_DATA_DIR, $p['path']);
+                else
+                    $data_path = $p['path'];
 
-            $srcfile = G5_PATH.$data_path;
+                $srcfile = G5_PATH.$data_path;
 
-            if(preg_match("/\.({$config['cf_image_extension']})$/i", $srcfile) && is_file($srcfile)) {
-                $size = @getimagesize($srcfile);
-                if(empty($size))
-                    continue;
+                if(preg_match("/\.({$config['cf_image_extension']})$/i", $srcfile) && is_file($srcfile)) {
+                    $size = @getimagesize($srcfile);
+                    if(empty($size))
+                        continue;
 
-                $filename = basename($srcfile);
-                $filepath = dirname($srcfile);
+                    $filename = basename($srcfile);
+                    $filepath = dirname($srcfile);
 
-                preg_match("/alt=[\"\']?([^\"\']*)[\"\']?/", $matches[0][$i], $malt);
-                $alt = get_text($malt[1]);
+                    preg_match("/alt=[\"\']?([^\"\']*)[\"\']?/", $matches[0][$i], $malt);
+                    $alt = get_text($malt[1]);
 
-                break;
+                    break;
+                }
             }
         }
     }

mobile/skin/board/basic/list.skin.php

@@ -76,7 +76,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
                         <?php if ($list[$i]['is_notice']) { ?><strong class="notice_icon"><i class="fa fa-volume-up" aria-hidden="true"></i>공지</strong><?php } ?> 
                         <?php echo $list[$i]['subject'] ?>
                         <?php
-                        // if ($list[$i]['link']['count']) { echo '['.$list[$i]['link']['count']}.']'; }
                         // if ($list[$i]['file']['count']) { echo '<'.$list[$i]['file']['count'].'>'; }
 
                         if (isset($list[$i]['icon_new'])) echo $list[$i]['icon_new'];

mobile/skin/board/basic/view.skin.php

@@ -153,7 +153,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
     </section>
     <?php } ?>
 
-    <?php if(isset($view['link'][1]) && $view['link'][1]) { ?>
+    <?php if(array_filter($view['link'])) { ?>
     <!-- 관련링크 시작 { -->
     <section id="bo_v_link">
         <h2>관련링크</h2>

mobile/skin/board/gallery/list.skin.php

@@ -103,7 +103,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
                         <?php if ($list[$i]['comment_cnt']) { ?><span class="sound_only">댓글</span><?php echo $list[$i]['comment_cnt']; ?><span class="sound_only">개</span><?php } ?>
                     </a>
                     <?php
-                    // if ($list[$i]['link']['count']) { echo '['.$list[$i]['link']['count']}.']'; }
                     // if ($list[$i]['file']['count']) { echo '<'.$list[$i]['file']['count'].'>'; }
 
                     if (isset($list[$i]['icon_new'])) echo $list[$i]['icon_new'];

mobile/skin/board/gallery/view.skin.php

@@ -153,7 +153,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
     </section>
     <?php } ?>
 
-    <?php if(isset($view['link'][1]) && $view['link'][1]) { ?>
+    <?php if(array_filter($view['link'])) { ?>
     <!-- 관련링크 시작 { -->
     <section id="bo_v_link">
         <h2>관련링크</h2>

mobile/skin/content/basic/style.css

@@ -4,5 +4,6 @@
 #ctt {margin:10px 0;padding:10px;border-top:1px solid #e9e9e9;border-bottom:1px solid #e9e9e9}
 .ctt_admin {margin:0 5px;text-align:right}
 #ctt header h1 {position:absolute;font-size:0;line-height:0;overflow:hidden}
+#ctt_himg img, #ctt_timg img, #ctt_con img {max-width:100%;height:auto}
 #ctt_con {padding:10px 0}
 .ctt_img {text-align:center}

mobile/skin/member/basic/register_form.skin.php

@@ -52,7 +52,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
             if($config['cf_cert_use']) {
                 if($config['cf_cert_ipin'])
                     echo '<button type="button" id="win_ipin_cert" class="btn_frmline btn">아이핀 본인확인</button>'.PHP_EOL;
-                if($config['cf_cert_hp'] && $config['cf_cert_hp'] != 'lg')
+                if($config['cf_cert_hp'])
                     echo '<button type="button" id="win_hp_cert" class="btn_frmline btn">휴대폰 본인확인</button>'.PHP_EOL;
 
                 echo '<noscript>본인확인을 위해서는 자바스크립트 사용이 가능해야합니다.</noscript>'.PHP_EOL;
@@ -106,7 +106,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
         <?php if ($config['cf_use_homepage']) { ?>
         <li>
             <label for="reg_mb_homepage" class="sound_only">홈페이지<?php if ($config['cf_req_homepage']){ ?><strong>필수</strong><?php } ?></label>
-            <input type="url" name="mb_homepage" value="<?php echo get_text($member['mb_homepage']) ?>" id="reg_mb_homepage" class="frm_input full_input <?php echo $config['cf_req_homepage']?"required":""; ?>" maxlength="255" <?php echo $config['cf_req_homepage']?"required":""; ?> placeholder="홈페이지">
+            <input type="text" name="mb_homepage" value="<?php echo get_text($member['mb_homepage']) ?>" id="reg_mb_homepage" class="frm_input full_input <?php echo $config['cf_req_homepage']?"required":""; ?>" maxlength="255" <?php echo $config['cf_req_homepage']?"required":""; ?> placeholder="홈페이지">
         </li>
         <?php } ?>
 
@@ -272,19 +272,19 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
 
         <?php if($config['cf_cert_use'] && $config['cf_cert_ipin']) { ?>
         // 아이핀인증
-        $("#win_ipin_cert").click(function() {
+        $("#win_ipin_cert").click(function(e) {
             if(!cert_confirm())
                 return false;
 
             var url = "<?php echo G5_OKNAME_URL; ?>/ipin1.php";
-            certify_win_open('kcb-ipin', url);
+            certify_win_open('kcb-ipin', url, e);
             return;
         });
 
         <?php } ?>
         <?php if($config['cf_cert_use'] && $config['cf_cert_hp']) { ?>
         // 휴대폰인증
-        $("#win_hp_cert").click(function() {
+        $("#win_hp_cert").click(function(e) {
             if(!cert_confirm())
                 return false;
 
@@ -298,6 +298,10 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
                     $cert_url = G5_KCPCERT_URL.'/kcpcert_form.php';
                     $cert_type = 'kcp-hp';
                     break;
+                case 'lg':
+                    $cert_url = G5_LGXPAY_URL.'/AuthOnlyReq.php';
+                    $cert_type = 'lg-hp';
+                    break;
                 default:
                     echo 'alert("기본환경설정에서 휴대폰 본인확인 설정을 해주십시오");';
                     echo 'return false;';
@@ -305,7 +309,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
             }
             ?>
 
-            certify_win_open("<?php echo $cert_type; ?>", "<?php echo $cert_url; ?>");
+            certify_win_open("<?php echo $cert_type; ?>", "<?php echo $cert_url; ?>", e);
             return;
         });
         <?php } ?>

mobile/skin/social/social_login.skin.php

@@ -47,13 +47,13 @@ add_stylesheet('<link rel="stylesheet" href="'.get_social_skin_url().'/style.css
         <?php if( social_service_check('twitter') ) {     //트위터 로그인을 사용한다면 ?>
         <a href="<?php echo $self_url;?>?provider=twitter&amp;url=<?php echo $urlencode;?>" class="sns-icon social_link sns-twitter" title="트위터">
             <span class="ico"></span>
-            <span class="txt">트위터+<i> 트위터</i></span>
+            <span class="txt">트위터+<i> 로그인</i></span>
         </a>
         <?php }     //end if ?>
         <?php if( social_service_check('payco') ) {     //페이코 로그인을 사용한다면 ?>
         <a href="<?php echo $self_url;?>?provider=payco&amp;url=<?php echo $urlencode;?>" class="sns-icon social_link sns-payco" title="페이코">
             <span class="ico"></span>
-            <span class="txt">페이코 로그인</span>
+            <span class="txt">페이코<i> 로그인</i></span>
         </a>
         <?php }     //end if ?>
 
@@ -69,7 +69,7 @@ add_stylesheet('<link rel="stylesheet" href="'.get_social_skin_url().'/style.css
                     var newWin = window.open(
                         pop_url, 
                         "social_sing_on", 
-                        "location=0,status=0,scrollbars=0,width=600,height=500"
+                        "location=0,status=0,scrollbars=1,width=600,height=500"
                     );
 
                     if(!newWin || newWin.closed || typeof newWin.closed=='undefined')

mobile/skin/social/social_outlogin.skin.1.php

@@ -69,7 +69,7 @@ add_stylesheet('<link rel="stylesheet" href="'.get_social_skin_url().'/style.css
                     var newWin = window.open(
                         pop_url, 
                         "social_sing_on", 
-                        "location=0,status=0,scrollbars=0,width=600,height=500"
+                        "location=0,status=0,scrollbars=1,width=600,height=500"
                     );
 
                     if(!newWin || newWin.closed || typeof newWin.closed=='undefined')

mobile/skin/social/social_register.skin.php

@@ -54,7 +54,7 @@ add_stylesheet('<link rel="stylesheet" href="'.get_social_skin_url().'/style.css
             <?php if( social_service_check('payco') ) {     //페이코 로그인을 사용한다면 ?>
             <a href="<?php echo $self_url;?>?provider=payco&amp;url=<?php echo $urlencode;?>" class="sns-icon social_link sns-payco" title="페이코">
                 <span class="ico"></span>
-                <span class="txt">페이코 로그인</span>
+                <span class="txt">페이코<i> 로그인</i></span>
             </a>
             <?php }     //end if ?>
 
@@ -70,7 +70,7 @@ add_stylesheet('<link rel="stylesheet" href="'.get_social_skin_url().'/style.css
                         var newWin = window.open(
                             pop_url, 
                             "social_sing_on", 
-                            "location=0,status=0,scrollbars=0,width=600,height=500"
+                            "location=0,status=0,scrollbars=1,width=600,height=500"
                         );
 
                         if(!newWin || newWin.closed || typeof newWin.closed=='undefined')

mobile/skin/social/social_u_register_form.skin.php

@@ -150,7 +150,7 @@ jQuery(function($){
                 var newWin = window.open(
                     pop_url, 
                     "social_sing_on", 
-                    "location=0,status=0,scrollbars=0,width=600,height=500"
+                    "location=0,status=0,scrollbars=1,width=600,height=500"
                 );
 
                 if(!newWin || newWin.closed || typeof newWin.closed=='undefined')

plugin/editor/smarteditor2/js/smarteditor2.js

@@ -20339,18 +20339,23 @@ nhn.husky.HuskyCore.mixin(nhn.husky.SE2M_TableEditor, {
 	
 	addCSSClass : function(sClassName, sClassRule){
 		var oDoc = this.oApp.getWYSIWYGDocument();
-		if(oDoc.styleSheets[0] && oDoc.styleSheets[0].addRule){
-			// IE
-			oDoc.styleSheets[0].addRule("." + sClassName, sClassRule);
-		}else{
-			// FF
-			var elHead = oDoc.getElementsByTagName("HEAD")[0]; 
-			var elStyle = oDoc.createElement ("STYLE"); 
-			//styleElement.type = "text / css"; 
-			elHead.appendChild (elStyle); 
-			
-			elStyle.sheet.insertRule("." + sClassName + " { "+sClassRule+" }", 0);
-		}
+
+        try {
+            if(oDoc.styleSheets[0] && oDoc.styleSheets[0].addRule){
+                // IE
+                oDoc.styleSheets[0].addRule("." + sClassName, sClassRule);
+            }else{
+                // FF
+                var elHead = oDoc.getElementsByTagName("HEAD")[0]; 
+                var elStyle = oDoc.createElement ("STYLE"); 
+                //styleElement.type = "text / css"; 
+                elHead.appendChild (elStyle); 
+                
+                elStyle.sheet.insertRule("." + sClassName + " { "+sClassRule+" }", 0);
+            }
+        } catch (e) {
+            //console.log(e);
+        }
 	},
 	
 	// [SMARTEDITORSUS-1533]

plugin/htmlpurifier/extend.video.php

@@ -24,6 +24,7 @@ if( !class_exists('HTMLPurifier_Filter_Iframevideo') ){
 			if (strstr($html, '<iframe')) {
 				$html = preg_replace_callback('/<iframe.*?src="https?:\/\/www\.youtube\.com\/embed\/([^"]*)[^>]*>(.*?)?\/iframe>/i', array($this, 'trust_url_match'), $html);
 				$html = preg_replace_callback('/<iframe.*?src="https?:\/\/player\.vimeo.com\/video\/([^"]*)[^>]*>(.*?)?\/iframe>/i', array($this, 'trust_url_match'), $html);
+                $html = preg_replace_callback('/<iframe.*?src="https?:\/\/www\.facebook.com\/plugins\/([^"]*)[^>]*>(.*?)?\/iframe>/i', array($this, 'trust_url_match'), $html);
 				//$html = preg_replace('#<iframe#i', '<img class="Iframevideo"', $html);
 				//$html = preg_replace('#</iframe>#i', '</img>', $html);
 			}
@@ -62,9 +63,10 @@ if( !class_exists('HTMLPurifier_Filter_Iframevideo') ){
 			// Domain Whitelist
 			$youTubeMatch = preg_match('#src="https?://www.youtube(-nocookie)?.com/#i', $matches[1]);
 			$vimeoMatch = preg_match('#src="https?://player.vimeo.com/#i', $matches[1]);
-			if ($youTubeMatch || $vimeoMatch) {
+            $fackbookMatch = preg_match('#src="https?://www.facebook.com/#i', $matches[1]);
+			if ($youTubeMatch || $vimeoMatch || $fackbookMatch) {
 				$extra = ' frameborder="0"';
-				if ($youTubeMatch) {
+				if ($youTubeMatch || $fackbookMatch) {
 					$extra .= ' allowfullscreen';
 				} elseif ($vimeoMatch) {
 					$extra .= ' webkitAllowFullScreen mozallowfullscreen allowFullScreen';

plugin/htmlpurifier/safeiframe.txt

@@ -9,4 +9,7 @@ play.afreeca.com/
 v.nate.com/
 www.microsoft.com/showcase/video.aspx/
 w.soundcloud.com/
-www.facebook.com/
+www.facebook.com/
+kakaotv.daum.net/
+v.afree.ca/
+play-tv.kakao.com/

plugin/kcpcert/kcpcert_result.php

@@ -143,7 +143,7 @@ if( $cert_enc_use == "Y" )
         $sql = " select mb_id from {$g5['member_table']} where mb_id <> '{$member['mb_id']}' and mb_dupinfo = '{$mb_dupinfo}' ";
         $row = sql_fetch($sql);
         if ($row['mb_id']) {
-            alert_close("입력하신 본인학인 정보로 가입된 내역이 존재합니다.\\n회원아이디 : ".$row['mb_id']);
+            alert_close("입력하신 본인확인 정보로 가입된 내역이 존재합니다.\\n회원아이디 : ".$row['mb_id']);
         }
 
         // hash 데이터

plugin/lgxpay/AuthOnlyReq.php

@@ -165,6 +165,8 @@ $_SESSION['lgd_certify'] = $payReqMap;
 <input type="hidden" name="LGD_ENCODING" value="UTF-8"/>
 <?php
 foreach ($payReqMap as $key => $value) {
+    $key = htmlspecialchars(strip_tags($key), ENT_QUOTES);
+    $value = htmlspecialchars(strip_tags($value), ENT_QUOTES);
     echo "<input type='hidden' name='$key' id='$key' value='$value'/>".PHP_EOL;
 }
 ?>