Merge branch 'master' of github.com:gnuboard/g5

adm/admin.lib.php

@@ -435,8 +435,8 @@ function admin_check_xss_params($params){
         if ( empty($value) ) continue;
 
         if( is_array($value) ){
-            admin_check_xss_params($params);
-        } else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && preg_match('/script.*?\/script/ius', $value) ){
+            admin_check_xss_params($value);
+        } else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/onload=.*/ius', $value)) ){
             alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.');
             die();
         }

adm/board_copy_update.php

@@ -38,43 +38,43 @@ $sql = " insert into {$g5['board_table']}
                 bo_subject = '$target_subject',
                 bo_device = '{$board['bo_device']}',
                 bo_admin = '{$board['bo_admin']}',
-                bo_list_level = '{$board[bo_list_level]}',
-                bo_read_level = '{$board[bo_read_level]}',
-                bo_write_level = '{$board[bo_write_level]}',
-                bo_reply_level = '{$board[bo_reply_level]}',
-                bo_comment_level = '{$board[bo_comment_level]}',
-                bo_upload_level = '{$board[bo_upload_level]}',
-                bo_download_level = '{$board[bo_download_level]}',
-                bo_html_level = '{$board[bo_html_level]}',
-                bo_link_level = '{$board[bo_link_level]}',
-                bo_count_modify = '{$board[bo_count_modify]}',
-                bo_count_delete = '{$board[bo_count_delete]}',
-                bo_read_point = '{$board[bo_read_point]}',
-                bo_write_point = '{$board[bo_write_point]}',
-                bo_comment_point = '{$board[bo_comment_point]}',
-                bo_download_point = '{$board[bo_download_point]}',
-                bo_use_category = '{$board[bo_use_category]}',
+                bo_list_level = '{$board['bo_list_level']}',
+                bo_read_level = '{$board['bo_read_level']}',
+                bo_write_level = '{$board['bo_write_level']}',
+                bo_reply_level = '{$board['bo_reply_level']}',
+                bo_comment_level = '{$board['bo_comment_level']}',
+                bo_upload_level = '{$board['bo_upload_level']}',
+                bo_download_level = '{$board['bo_download_level']}',
+                bo_html_level = '{$board['bo_html_level']}',
+                bo_link_level = '{$board['bo_link_level']}',
+                bo_count_modify = '{$board['bo_count_modify']}',
+                bo_count_delete = '{$board['bo_count_delete']}',
+                bo_read_point = '{$board['bo_read_point']}',
+                bo_write_point = '{$board['bo_write_point']}',
+                bo_comment_point = '{$board['bo_comment_point']}',
+                bo_download_point = '{$board['bo_download_point']}',
+                bo_use_category = '{$board['bo_use_category']}',
                 bo_category_list = '{$board['bo_category_list']}',
-                bo_use_sideview = '{$board[bo_use_sideview]}',
-                bo_use_file_content = '{$board[bo_use_file_content]}',
-                bo_use_secret = '{$board[bo_use_secret]}',
-                bo_use_dhtml_editor = '{$board[bo_use_dhtml_editor]}',
-                bo_use_rss_view = '{$board[bo_use_rss_view]}',
-                bo_use_good = '{$board[bo_use_good]}',
-                bo_use_nogood = '{$board[bo_use_nogood]}',
-                bo_use_name = '{$board[bo_use_name]}',
-                bo_use_signature = '{$board[bo_use_signature]}',
-                bo_use_ip_view = '{$board[bo_use_ip_view]}',
+                bo_use_sideview = '{$board['bo_use_sideview']}',
+                bo_use_file_content = '{$board['bo_use_file_content']}',
+                bo_use_secret = '{$board['bo_use_secret']}',
+                bo_use_dhtml_editor = '{$board['bo_use_dhtml_editor']}',
+                bo_use_rss_view = '{$board['bo_use_rss_view']}',
+                bo_use_good = '{$board['bo_use_good']}',
+                bo_use_nogood = '{$board['bo_use_nogood']}',
+                bo_use_name = '{$board['bo_use_name']}',
+                bo_use_signature = '{$board['bo_use_signature']}',
+                bo_use_ip_view = '{$board['bo_use_ip_view']}',
                 bo_use_list_view = '{$board['bo_use_list_view']}',
-                bo_use_list_content = '{$board[bo_use_list_content]}',
-                bo_table_width = '{$board[bo_table_width]}',
-                bo_subject_len = '{$board[bo_subject_len]}',
-                bo_mobile_subject_len = '{$board[bo_mobile_subject_len]}',
-                bo_page_rows = '{$board[bo_page_rows]}',
-                bo_mobile_page_rows = '{$board[bo_mobile_page_rows]}',
-                bo_new = '{$board[bo_new]}',
-                bo_hot = '{$board[bo_hot]}',
-                bo_image_width = '{$board[bo_image_width]}',
+                bo_use_list_content = '{$board['bo_use_list_content']}',
+                bo_table_width = '{$board['bo_table_width']}',
+                bo_subject_len = '{$board['bo_subject_len']}',
+                bo_mobile_subject_len = '{$board['bo_mobile_subject_len']}',
+                bo_page_rows = '{$board['bo_page_rows']}',
+                bo_mobile_page_rows = '{$board['bo_mobile_page_rows']}',
+                bo_new = '{$board['bo_new']}',
+                bo_hot = '{$board['bo_hot']}',
+                bo_image_width = '{$board['bo_image_width']}',
                 bo_skin = '{$board['bo_skin']}',
                 bo_mobile_skin = '{$board['bo_mobile_skin']}',
                 bo_include_head = '{$board['bo_include_head']}',
@@ -84,20 +84,20 @@ $sql = " insert into {$g5['board_table']}
                 bo_mobile_content_head = '".addslashes($board['bo_mobile_content_head'])."',
                 bo_mobile_content_tail = '".addslashes($board['bo_mobile_content_tail'])."',
                 bo_insert_content = '".addslashes($board['bo_insert_content'])."',
-                bo_gallery_cols = '{$board[bo_gallery_cols]}',
-                bo_gallery_width = '{$board[bo_gallery_width]}',
-                bo_gallery_height = '{$board[bo_gallery_height]}',
-                bo_mobile_gallery_width = '{$board[bo_mobile_gallery_width]}',
-                bo_mobile_gallery_height = '{$board[bo_mobile_gallery_height]}',
-                bo_upload_size = '{$board[bo_upload_size]}',
-                bo_reply_order = '{$board[bo_reply_order]}',
-                bo_use_search = '{$board[bo_use_search]}',
-                bo_order = '{$board[bo_order]}',
+                bo_gallery_cols = '{$board['bo_gallery_cols']}',
+                bo_gallery_width = '{$board['bo_gallery_width']}',
+                bo_gallery_height = '{$board['bo_gallery_height']}',
+                bo_mobile_gallery_width = '{$board['bo_mobile_gallery_width']}',
+                bo_mobile_gallery_height = '{$board['bo_mobile_gallery_height']}',
+                bo_upload_size = '{$board['bo_upload_size']}',
+                bo_reply_order = '{$board['bo_reply_order']}',
+                bo_use_search = '{$board['bo_use_search']}',
+                bo_order = '{$board['bo_order']}',
                 bo_notice = '{$board['bo_notice']}',
-                bo_upload_count = '{$board[bo_upload_count]}',
-                bo_use_email = '{$board[bo_use_email]}',
-                bo_use_cert = '{$board[bo_use_cert]}',
-                bo_use_sns = '{$board[bo_use_sns]}',
+                bo_upload_count = '{$board['bo_upload_count']}',
+                bo_use_email = '{$board['bo_use_email']}',
+                bo_use_cert = '{$board['bo_use_cert']}',
+                bo_use_sns = '{$board['bo_use_sns']}',
                 bo_sort_field = '{$board['bo_sort_field']}',
                 bo_1_subj = '".addslashes($board['bo_1_subj'])."',
                 bo_2_subj = '".addslashes($board['bo_2_subj'])."',

bbs/alert.php

@@ -67,13 +67,17 @@ history.back();
     <form method="post" action="<?php echo $url ?>">
     <?php
     foreach($_POST as $key => $value) {
+        
+        $key = clean_xss_tags($url);
+        $value = clean_xss_tags($value);
+
         if(strlen($value) < 1)
             continue;
 
         if(preg_match("/pass|pwd|capt|url/", $key))
             continue;
     ?>
-    <input type="hidden" name="<?php echo $key ?>" value="<?php echo $value ?>">
+    <input type="hidden" name="<?php echo htmlspecialchars($key); ?>" value="<?php echo htmlspecialchars($value); ?>">
     <?php
     }
     ?>

bbs/download.php

@@ -84,11 +84,16 @@ if (!get_session($ss_name))
 $g5['title'] = '다운로드 > '.conv_subject($write['wr_subject'], 255);
 
 //파일명에 한글이 있는 경우
+/*
 if(preg_match("/[\xA1-\xFE][\xA1-\xFE]/", $file['bf_source'])){
+    // 2015.09.02 날짜의 파이어폭스에서 인코딩된 문자 그대로 출력되는 문제가 발생됨, 2018.12.11 날짜의 파이어폭스에서는 해당 현상이 없으므로 해당 코드를 사용 안합니다.
     $original = iconv('utf-8', 'euc-kr', $file['bf_source']); // SIR 잉끼님 제안코드
 } else {
     $original = urlencode($file['bf_source']);
 }
+*/
+
+$original = urlencode($file['bf_source']);
 
 @include_once($board_skin_path.'/download.tail.skin.php');
 

bbs/email_certify.php

@@ -1,6 +1,9 @@
 <?php
 include_once('./_common.php');
 
+// 봇의 메일 링크 크롤링을 방지합니다.
+if(function_exists('check_mail_bot')){ check_mail_bot($_SERVER['REMOTE_ADDR']); }
+
 $mb_id  = trim($_GET['mb_id']);
 $mb_md5 = trim($_GET['mb_md5']);
 

bbs/member_confirm.php

@@ -14,7 +14,7 @@ else
 $url = clean_xss_tags($_GET['url']);
 
 //소셜 로그인 한 경우
-if( function_exists('social_member_comfirm_redirect') && (! $url || $url === 'register_form.php') ){    
+if( function_exists('social_member_comfirm_redirect') && (! $url || $url === 'register_form.php' || (function_exists('social_is_edit_page') && social_is_edit_page($url) ) ) ){    
     social_member_comfirm_redirect();
 }
 

bbs/password_lost_certify.php

@@ -1,6 +1,9 @@
 <?php
 include_once('./_common.php');
 
+// 봇의 메일 링크 크롤링을 방지합니다.
+if(function_exists('check_mail_bot')){ check_mail_bot($_SERVER['REMOTE_ADDR']); }
+
 // 오류시 공히 Error 라고 처리하는 것은 회원정보가 있는지? 비밀번호가 틀린지? 를 알아보려는 해킹에 대비한것
 
 $mb_no = trim($_GET['mb_no']);

config.php

@@ -5,7 +5,7 @@
 ********************/
 
 define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.3.2.0');
+define('G5_GNUBOARD_VER', '5.3.2.3');
 
 // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
 define('_GNUBOARD_', true);

lib/common.lib.php

@@ -2883,9 +2883,17 @@ function get_search_string($stx)
 // XSS 관련 태그 제거
 function clean_xss_tags($str)
 {
-    $str = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $str);
+    $str_len = strlen($str);
+    
+    $i = 0;
+    while($i <= $str_len){
+        $result = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $str);
 
-    $str = str_replace(array('<script>','</script>','<noscript>','</noscript>'), '', $str);
+        if((string)$result === (string)$str) break;
+
+        $str = $result;
+        $i++;
+    }
 
     return $str;
 }
@@ -3434,6 +3442,27 @@ function get_real_client_ip(){
     return preg_replace('/[^0-9.]/', '', $real_ip);
 }
 
+function check_mail_bot($ip=''){
+
+    //아이피를 체크하여 메일 크롤링을 방지합니다.
+    $check_ips = array('211.249.40.');
+    $bot_message = 'bot 으로 판단되어 중지합니다.';
+    
+    if($ip){
+        foreach( $check_ips as $c_ip ){
+            if( preg_match('/^'.preg_quote($c_ip).'/', $ip) ) {
+                die($bot_message);
+            }
+        }
+    }
+
+    // user agent를 체크하여 메일 크롤링을 방지합니다.
+    $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';
+    if ($user_agent === 'Carbon' || strpos($user_agent, 'BingPreview') !== false || strpos($user_agent, 'Slackbot') !== false) { 
+        die($bot_message);
+    } 
+}
+
 function get_call_func_cache($func, $args=array()){
     
     static $cache = array();

lib/thumbnail.lib.php

@@ -25,29 +25,31 @@ function get_list_thumbnail($bo_table, $wr_id, $thumb_width, $thumb_height, $is_
         $matches = get_editor_image($write['wr_content'], false);
         $edt = true;
 
-        for($i=0; $i<count($matches[1]); $i++)
-        {
-            // 이미지 path 구함
-            $p = parse_url($matches[1][$i]);
-            if(strpos($p['path'], '/'.G5_DATA_DIR.'/') != 0)
-                $data_path = preg_replace('/^\/.*\/'.G5_DATA_DIR.'/', '/'.G5_DATA_DIR, $p['path']);
-            else
-                $data_path = $p['path'];
+        if(isset($matches[1]) && is_array($matches[1])){
+            for($i=0; $i<count($matches[1]); $i++)
+            {
+                // 이미지 path 구함
+                $p = parse_url($matches[1][$i]);
+                if(strpos($p['path'], '/'.G5_DATA_DIR.'/') != 0)
+                    $data_path = preg_replace('/^\/.*\/'.G5_DATA_DIR.'/', '/'.G5_DATA_DIR, $p['path']);
+                else
+                    $data_path = $p['path'];
 
-            $srcfile = G5_PATH.$data_path;
+                $srcfile = G5_PATH.$data_path;
 
-            if(preg_match("/\.({$config['cf_image_extension']})$/i", $srcfile) && is_file($srcfile)) {
-                $size = @getimagesize($srcfile);
-                if(empty($size))
-                    continue;
+                if(preg_match("/\.({$config['cf_image_extension']})$/i", $srcfile) && is_file($srcfile)) {
+                    $size = @getimagesize($srcfile);
+                    if(empty($size))
+                        continue;
 
-                $filename = basename($srcfile);
-                $filepath = dirname($srcfile);
+                    $filename = basename($srcfile);
+                    $filepath = dirname($srcfile);
 
-                preg_match("/alt=[\"\']?([^\"\']*)[\"\']?/", $matches[0][$i], $malt);
-                $alt = get_text($malt[1]);
+                    preg_match("/alt=[\"\']?([^\"\']*)[\"\']?/", $matches[0][$i], $malt);
+                    $alt = get_text($malt[1]);
 
-                break;
+                    break;
+                }
             }
         }
     }

mobile/skin/content/basic/style.css

@@ -4,5 +4,6 @@
 #ctt {margin:10px 0;padding:10px;border-top:1px solid #e9e9e9;border-bottom:1px solid #e9e9e9}
 .ctt_admin {margin:0 5px;text-align:right}
 #ctt header h1 {position:absolute;font-size:0;line-height:0;overflow:hidden}
+#ctt_himg img, #ctt_timg img, #ctt_con img {max-width:100%;height:auto}
 #ctt_con {padding:10px 0}
 .ctt_img {text-align:center}

plugin/htmlpurifier/safeiframe.txt

@@ -11,4 +11,5 @@ www.microsoft.com/showcase/video.aspx/
 w.soundcloud.com/
 www.facebook.com/
 kakaotv.daum.net/
-v.afree.ca/
+v.afree.ca/
+play-tv.kakao.com/

plugin/kcpcert/kcpcert_result.php

@@ -143,7 +143,7 @@ if( $cert_enc_use == "Y" )
         $sql = " select mb_id from {$g5['member_table']} where mb_id <> '{$member['mb_id']}' and mb_dupinfo = '{$mb_dupinfo}' ";
         $row = sql_fetch($sql);
         if ($row['mb_id']) {
-            alert_close("입력하신 본인학인 정보로 가입된 내역이 존재합니다.\\n회원아이디 : ".$row['mb_id']);
+            alert_close("입력하신 본인확인 정보로 가입된 내역이 존재합니다.\\n회원아이디 : ".$row['mb_id']);
         }
 
         // hash 데이터

plugin/social/includes/functions.php

@@ -52,6 +52,10 @@ function get_social_callbackurl($provider, $no_domain=false){
         $base_url = '/'.ltrim(parse_url($base_url, PHP_URL_PATH), '/');
     }
 
+    if ( $provider === 'twitter' ){
+        return $base_url;
+    }
+
     $base_url = $base_url . ( strpos($base_url, '?') ? '&' : '?' ).G5_SOCIAL_LOGIN_DONE_PARAM.'='.$provider;
 
     return $base_url;
@@ -764,6 +768,23 @@ function social_member_comfirm_redirect(){
     }
 }
 
+function social_is_edit_page($url=''){
+    global $is_member;
+
+    if( !$is_member ) return false;
+
+    if($url){
+        $p = @parse_url($url);
+        $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
+
+        if ( isset($p['host']) && ($p['host'] === $host) && preg_match('/register_form\.php$/i', $url) ){
+            return true;
+        }
+    }
+
+    return false;
+}
+
 function social_is_login_password_check($mb_id){
     global $g5;
 

skin/content/basic/style.css

@@ -5,5 +5,5 @@
 .ctt_admin {text-align:right}
 #ctt header h1 {position:absolute;font-size:0;line-height:0;overflow:hidden}
 #ctt_con {padding:10px 0;line-height:1.6em}
-#ctt_con img{max-width:100%;height:auto}
+#ctt_himg img, #ctt_timg img, #ctt_con img {max-width:100%;height:auto}
 .ctt_img {text-align:center}

theme/basic/mobile/skin/content/basic/style.css

@@ -4,5 +4,6 @@
 #ctt {margin:10px 0;padding:10px;border-top:1px solid #e9e9e9;border-bottom:1px solid #e9e9e9}
 .ctt_admin {margin:0 5px;text-align:right}
 #ctt header h1 {position:absolute;font-size:0;line-height:0;overflow:hidden}
+#ctt_himg img, #ctt_timg img, #ctt_con img {max-width:100%;height:auto}
 #ctt_con {padding:10px 0}
 .ctt_img {text-align:center}

theme/basic/skin/content/basic/style.css

@@ -5,5 +5,5 @@
 .ctt_admin {text-align:right}
 #ctt header h1 {position:absolute;font-size:0;line-height:0;overflow:hidden}
 #ctt_con {padding:10px 0;line-height:1.6em}
-#ctt_con img{max-width:100%;height:auto}
+#ctt_himg img, #ctt_timg img, #ctt_con img {max-width:100%;height:auto}
 .ctt_img {text-align:center}