Merge branch 'master' of github.com:gnuboard/g5

adm/board_form.php

@@ -869,7 +869,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_content_head">상단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_content_head", get_text($board['bo_content_head'], 0)); ?>
+                <?php echo editor_html("bo_content_head", get_text(html_purifier($board['bo_content_head']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_content_head" value="1" id="chk_grp_content_head">
@@ -881,7 +881,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_content_tail">하단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_content_tail", get_text($board['bo_content_tail'], 0)); ?>
+                <?php echo editor_html("bo_content_tail", get_text(html_purifier($board['bo_content_tail']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_content_tail" value="1" id="chk_grp_content_tail">
@@ -893,7 +893,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_mobile_content_head">모바일 상단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_mobile_content_head", get_text($board['bo_mobile_content_head'], 0)); ?>
+                <?php echo editor_html("bo_mobile_content_head", get_text(html_purifier($board['bo_mobile_content_head']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_mobile_content_head" value="1" id="chk_grp_mobile_content_head">
@@ -905,7 +905,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_mobile_content_tail">모바일 하단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_mobile_content_tail", get_text($board['bo_mobile_content_tail'], 0)); ?>
+                <?php echo editor_html("bo_mobile_content_tail", get_text(html_purifier($board['bo_mobile_content_tail']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_mobile_content_tail" value="1" id="chk_grp_mobile_content_tail">

adm/board_list_update.php

@@ -29,9 +29,11 @@ if ($_POST['act_button'] == "선택수정") {
                 alert('최고관리자가 아닌 경우 다른 관리자의 게시판('.$board_table[$k].')은 수정이 불가합니다.');
         }
 
+        $p_bo_subject = is_array($_POST['bo_subject']) ? strip_tags($_POST['bo_subject'][$k]) : '';
+
         $sql = " update {$g5['board_table']}
                     set gr_id               = '".sql_real_escape_string(strip_tags($_POST['gr_id'][$k]))."',
-                        bo_subject          = '".sql_real_escape_string(strip_tags($_POST['bo_subject'][$k]))."',
+                        bo_subject          = '".$p_bo_subject."',
                         bo_device           = '".sql_real_escape_string(strip_tags($_POST['bo_device'][$k]))."',
                         bo_skin             = '".sql_real_escape_string(strip_tags($_POST['bo_skin'][$k]))."',
                         bo_mobile_skin      = '".sql_real_escape_string(strip_tags($_POST['bo_mobile_skin'][$k]))."',

adm/boardgroup_list_update.php

@@ -19,7 +19,8 @@ for ($i=0; $i<$count; $i++)
 {
     $k     = $_POST['chk'][$i];
     $gr_id = preg_replace('/[^a-z0-9_]/i', '', $_POST['group_id'][$k]);
-    $gr_subject = sql_real_escape_string(strip_tags($_POST['gr_subject'][$k]));
+    $gr_subject = is_array($_POST['gr_subject']) ? strip_tags($_POST['gr_subject'][$k]) : '';
+    $gr_admin = is_array($_POST['gr_admin']) ? strip_tags($_POST['gr_admin'][$k]) : '';
 
     if($_POST['act_button'] == '선택수정') {
         $sql = " update {$g5['group_table']}
@@ -30,7 +31,7 @@ for ($i=0; $i<$count; $i++)
                         gr_order      = '".sql_real_escape_string($_POST['gr_order'][$k])."'
                   where gr_id         = '{$gr_id}' ";
         if ($is_admin != 'super')
-            $sql .= " and gr_admin    = '{$_POST['gr_admin'][$k]}' ";
+            $sql .= " and gr_admin    = '{$gr_admin}' ";
         sql_query($sql);
     } else if($_POST['act_button'] == '선택삭제') {
         $row = sql_fetch(" select count(*) as cnt from {$g5['board_table']} where gr_id = '$gr_id' ");

adm/config_form_update.php

@@ -32,7 +32,7 @@ $check_keys = array('cf_lg_mid', 'cf_lg_mert_key', 'cf_cert_kcb_cd', 'cf_cert_kc
 
 foreach( $check_keys as $key ){
     if ( isset($_POST[$key]) && $_POST[$key] ){
-        $_POST[$key] = preg_replace('/[^a-z0-9_\-]/i', '', $_POST[$key]);
+        $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
     }
 }
 

adm/contentform.php

@@ -35,6 +35,7 @@ if(!sql_query(" select co_skin from {$g5['content_table']} limit 1 ", false)) {
 
 $html_title = "내용";
 $g5['title'] = $html_title.' 관리';
+$readonly = '';
 
 if ($w == "u")
 {

adm/faqform.php

@@ -54,11 +54,11 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     </tr>
     <tr>
         <th scope="row">질문</th>
-        <td><?php echo editor_html('fa_subject', get_text($fa['fa_subject'], 0)); ?></td>
+        <td><?php echo editor_html('fa_subject', get_text(html_purifier($fa['fa_subject']), 0)); ?></td>
     </tr>
     <tr>
         <th scope="row">답변</th>
-        <td><?php echo editor_html('fa_content', get_text($fa['fa_content'], 0)); ?></td>
+        <td><?php echo editor_html('fa_content', get_text(html_purifier($fa['fa_content']), 0)); ?></td>
     </tr>
     </tbody>
     </table>

adm/faqmasterform.php

@@ -117,25 +117,25 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     <tr>
         <th scope="row">상단 내용</th>
         <td>
-            <?php echo editor_html('fm_head_html', get_text($fm['fm_head_html'], 0)); ?>
+            <?php echo editor_html('fm_head_html', get_text(html_purifier($fm['fm_head_html']), 0)); ?>
         </td>
     </tr>
     <tr>
         <th scope="row">하단 내용</th>
         <td>
-            <?php echo editor_html('fm_tail_html', get_text($fm['fm_tail_html'], 0)); ?>
+            <?php echo editor_html('fm_tail_html', get_text(html_purifier($fm['fm_tail_html']), 0)); ?>
         </td>
     </tr>
     <tr>
         <th scope="row">모바일상단 내용</th>
         <td>
-            <?php echo editor_html('fm_mobile_head_html', get_text($fm['fm_mobile_head_html'], 0)); ?>
+            <?php echo editor_html('fm_mobile_head_html', get_text(html_purifier($fm['fm_mobile_head_html']), 0)); ?>
         </td>
     </tr>
     <tr>
         <th scope="row">모바일하단 내용</th>
         <td>
-            <?php echo editor_html('fm_mobile_tail_html', get_text($fm['fm_mobile_tail_html'], 0)); ?>
+            <?php echo editor_html('fm_mobile_tail_html', get_text(html_purifier($fm['fm_mobile_tail_html']), 0)); ?>
         </td>
     </tr>
     </tbody>

adm/mail_form.php

@@ -10,6 +10,8 @@ $html_title = '회원메일';
 if ($w == 'u') {
     $html_title .= '수정';
     $readonly = ' readonly';
+    
+    $ma_id = (int) $ma_id;
 
     $sql = " select * from {$g5['mail_table']} where ma_id = '{$ma_id}' ";
     $ma = sql_fetch($sql);
@@ -44,7 +46,7 @@ include_once('./admin.head.php');
     </tr>
     <tr>
         <th scope="row"><label for="ma_content">메일 내용<strong class="sound_only">필수</strong></label></th>
-        <td><?php echo editor_html("ma_content", get_text($ma['ma_content'], 0)); ?></td>
+        <td><?php echo editor_html("ma_content", get_text(html_purifier($ma['ma_content']), 0)); ?></td>
     </tr>
     </tbody>
     </table>

adm/mail_update.php

@@ -9,11 +9,13 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
+$ma_id = isset($_POST['ma_id']) ? (int) $_POST['ma_id'] : 0;
+$ma_subject = isset($_POST['ma_subject']) ? strip_tags($_POST['ma_subject']) : '';
+
 if ($w == '')
 {
     $sql = " insert {$g5['mail_table']}
-                set ma_id = '{$_POST['ma_id']}',
-                     ma_subject = '{$_POST['ma_subject']}',
+                set ma_subject = '{$ma_subject}',
                      ma_content = '{$_POST['ma_content']}',
                      ma_time = '".G5_TIME_YMDHIS."',
                      ma_ip = '{$_SERVER['REMOTE_ADDR']}' ";
@@ -22,16 +24,16 @@ if ($w == '')
 else if ($w == 'u')
 {
     $sql = " update {$g5['mail_table']}
-                set ma_subject = '{$_POST['ma_subject']}',
+                set ma_subject = '{$ma_subject}',
                      ma_content = '{$_POST['ma_content']}',
                      ma_time = '".G5_TIME_YMDHIS."',
                      ma_ip = '{$_SERVER['REMOTE_ADDR']}'
-                where ma_id = '{$_POST['ma_id']}' ";
+                where ma_id = '{$ma_id}' ";
     sql_query($sql);
 }
 else if ($w == 'd')
 {
-	$sql = " delete from {$g5['mail_table']} where ma_id = '{$_POST['ma_id']}' ";
+	$sql = " delete from {$g5['mail_table']} where ma_id = '{$ma_id}' ";
     sql_query($sql);
 }
 

adm/menu_list_update.php

@@ -20,9 +20,11 @@ $count = count($_POST['code']);
 for ($i=0; $i<$count; $i++)
 {
     $_POST = array_map_deep('trim', $_POST);
+    
+    $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags($_POST['me_link'][$i], 1) : '';
 
-    $code    = strip_tags($_POST['code'][$i]);
-    $me_name = strip_tags($_POST['me_name'][$i]);
+    $code    = is_array($_POST['code']) ? strip_tags($_POST['code'][$i]) : '';
+    $me_name = is_array($_POST['me_name']) ? strip_tags($_POST['me_name'][$i]) : '';
     $me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : strip_tags($_POST['me_link'][$i]);
     
     if(!$code || !$me_name || !$me_link)
@@ -56,9 +58,9 @@ for ($i=0; $i<$count; $i++)
 
     // 메뉴 등록
     $sql = " insert into {$g5['menu_table']}
-                set me_code         = '$me_code',
-                    me_name         = '$me_name',
-                    me_link         = '$me_link',
+                set me_code         = '".$me_code."',
+                    me_name         = '".$me_name."',
+                    me_link         = '".$me_link."',
                     me_target       = '".sql_real_escape_string(strip_tags($_POST['me_target'][$i]))."',
                     me_order        = '".sql_real_escape_string(strip_tags($_POST['me_order'][$i]))."',
                     me_use          = '".sql_real_escape_string(strip_tags($_POST['me_use'][$i]))."',

adm/newwinform.php

@@ -114,7 +114,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     </tr>
     <tr>
         <th scope="row"><label for="nw_content">내용</label></th>
-        <td><?php echo editor_html('nw_content', get_text($nw['nw_content'], 0)); ?></td>
+        <td><?php echo editor_html('nw_content', get_text(html_purifier($nw['nw_content']), 0)); ?></td>
     </tr>
     </tbody>
     </table>

adm/qa_config.php

@@ -282,25 +282,25 @@ if(!isset($qaconfig['qa_include_head'])) {
         <tr>
             <th scope="row"><label for="qa_content_head">상단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_content_head", get_text($qaconfig['qa_content_head'], 0)); ?>
+                <?php echo editor_html("qa_content_head", get_text(html_purifier($qaconfig['qa_content_head']), 0)); ?>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_content_tail">하단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_content_tail", get_text($qaconfig['qa_content_tail'], 0)); ?>
+                <?php echo editor_html("qa_content_tail", get_text(html_purifier($qaconfig['qa_content_tail']), 0)); ?>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_mobile_content_head">모바일 상단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_mobile_content_head", get_text($qaconfig['qa_mobile_content_head'], 0)); ?>
+                <?php echo editor_html("qa_mobile_content_head", get_text(html_purifier($qaconfig['qa_mobile_content_head']), 0)); ?>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_mobile_content_tail">모바일 하단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_mobile_content_tail", get_text($qaconfig['qa_mobile_content_tail'], 0)); ?>
+                <?php echo editor_html("qa_mobile_content_tail", get_text(html_purifier($qaconfig['qa_mobile_content_tail']), 0)); ?>
             </td>
         </tr>
         <tr>

adm/visit_list.php

@@ -73,7 +73,7 @@ $result = sql_query($sql);
             }
 
             $title = str_replace(array('<', '>', '&'), array("&lt;", "&gt;", "&amp;"), $referer);
-            $link = '<a href="'.$row['vi_referer'].'" target="_blank">';
+            $link = '<a href="'.get_text($row['vi_referer']).'" target="_blank">';
             $link = str_replace('&', "&amp;", $link);
             $link2 = '</a>';
         }

adm/visit_search.php

@@ -92,7 +92,7 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'">처음</a>'; //페이지 처
             }
 
             $title = str_replace(array("<", ">"), array("&lt;", "&gt;"), $referer);
-            $link = '<a href="'.$row['vi_referer'].'" target="_blank" title="'.$title.'">';
+            $link = '<a href="'.get_text($row['vi_referer']).'" target="_blank" title="'.$title.'">';
         }
 
         if ($is_admin == 'super')

bbs/alert.php

@@ -31,8 +31,8 @@ include_once(G5_PATH.'/head.sub.php');
 $msg = isset($msg) ? strip_tags($msg) : '';
 $msg2 = str_replace("\\n", "<br>", $msg);
 
-$url = clean_xss_tags($url);
-if (!$url) $url = clean_xss_tags($_SERVER['HTTP_REFERER']);
+$url = clean_xss_tags($url, 1);
+if (!$url) $url = clean_xss_tags($_SERVER['HTTP_REFERER'], 1);
 
 $url = preg_replace("/[\<\>\'\"\\\'\\\"\(\)]/", "", $url);
 $url = preg_replace('/\r\n|\r|\n|[^\x20-\x7e]/','', $url);

bbs/confirm.php

@@ -5,11 +5,11 @@ include_once(G5_PATH.'/head.sub.php');
 $pattern1 = "/[\<\>\'\"\\\'\\\"\(\)]/";
 $pattern2 = "/\r\n|\r|\n|[^\x20-\x7e]/";
 
-$url1 = preg_replace($pattern1, "", clean_xss_tags($url1));
+$url1 = preg_replace($pattern1, "", clean_xss_tags($url1, 1));
 $url1 = preg_replace($pattern2, "", $url1);
-$url2 = preg_replace($pattern1, "", clean_xss_tags($url2));
+$url2 = preg_replace($pattern1, "", clean_xss_tags($url2, 1));
 $url2 = preg_replace($pattern2, "", $url2);
-$url3 = preg_replace($pattern1, "", clean_xss_tags($url3));
+$url3 = preg_replace($pattern1, "", clean_xss_tags($url3, 1));
 $url3 = preg_replace($pattern2, "", $url3);
 
 // url 체크
@@ -31,12 +31,12 @@ if (confirm(conf)) {
 <article id="confirm_check">
 <header>
     <hgroup>
-        <h1><?php echo $header; ?></h1> <!-- 수행 중이던 작업 내용 -->
+        <h1><?php echo get_text(strip_tags($header)); ?></h1> <!-- 수행 중이던 작업 내용 -->
         <h2>아래 내용을 확인해 주세요.</h2>
     </hgroup>
 </header>
 <p>
-    <?php echo $msg; ?>
+    <?php echo get_text(strip_tags($msg)); ?>
 </p>
 
 <a href="<?php echo $url1; ?>">확인</a>

bbs/memo_view.php

@@ -51,9 +51,9 @@ else
 
 
 // 다음 쪽지
-$sql = " select * from {$g5[memo_table]}
+$sql = " select * from {$g5['memo_table']}
             where me_id < '{$me_id}'
-            and me_{$kind}_mb_id = '{$member[mb_id]}'
+            and me_{$kind}_mb_id = '{$member['mb_id']}'
             order by me_id desc
             limit 1 ";
 $next = sql_fetch($sql);

bbs/move_update.php

@@ -127,7 +127,7 @@ while ($row = sql_fetch_array($result))
                         // 제이프로님 코드제안 적용
                         $copy_file_name = ($bo_table !== $move_bo_table) ? $row3['bf_file'] : $row2['wr_id'].'_copy_'.$insert_id.'_'.$row3['bf_file'];
                         @copy($src_dir.'/'.$row3['bf_file'], $dst_dir.'/'.$copy_file_name);
-                        @chmod($dst_dir.'/'.$row3['bf_file'], G5_FILE_PERMISSION);
+                        @chmod($dst_dir.'/'.$copy_file_name, G5_FILE_PERMISSION);
                     }
 
                     $sql = " insert into {$g5['board_file_table']}
@@ -199,8 +199,12 @@ if ($sw == 'move')
     for ($i=0; $i<count($save); $i++)
     {
         if( isset($save[$i]['bf_file']) && $save[$i]['bf_file'] ){
-            for ($k=0; $k<count($save[$i]['bf_file']); $k++)
+            for ($k=0; $k<count($save[$i]['bf_file']); $k++) {
                 @unlink($save[$i]['bf_file'][$k]);
+
+                // 썸네일 파일 삭제, 먼지손 님 코드 제안
+                delete_board_thumbnail($bo_table, basename($save[$i]['bf_file'][$k]));
+            }
         }
 
         sql_query(" delete from $write_table where wr_parent = '{$save[$i]['wr_id']}' ");

bbs/new_delete.php

@@ -87,7 +87,7 @@ for($i=0;$i<count($_POST['chk_bn_id']);$i++)
         $lf = '';
         for ($k=0; $k<count($notice_array); $k++) {
             if ((int)$write['wr_id'] != (int)$notice_array[$k])
-                $bo_notice .= $nl.$notice_array[$k];
+                $bo_notice .= $lf.$notice_array[$k];
 
             if($bo_notice)
                 $lf = ',';
@@ -117,7 +117,7 @@ for($i=0;$i<count($_POST['chk_bn_id']);$i++)
 
         // 코멘트 삭제
         if (!delete_point($write['mb_id'], $bo_table, $comment_id, '코멘트')) {
-            insert_point($write['mb_id'], $board['bo_comment_point'] * (-1), "{$board['bo_subject']} {$write[wr_parent]}-{$comment_id} 코멘트삭제");
+            insert_point($write['mb_id'], $board['bo_comment_point'] * (-1), "{$board['bo_subject']} {$write['wr_parent']}-{$comment_id} 코멘트삭제");
         }
 
         // 코멘트 삭제

bbs/visit_insert.inc.php

@@ -13,8 +13,8 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
     $remote_addr = escape_trim($_SERVER['REMOTE_ADDR']);
     $referer = "";
     if (isset($_SERVER['HTTP_REFERER']))
-        $referer = escape_trim(clean_xss_tags($_SERVER['HTTP_REFERER']));
-    $user_agent  = escape_trim(clean_xss_tags($_SERVER['HTTP_USER_AGENT']));
+        $referer = escape_trim(clean_xss_tags(strip_tags($_SERVER['HTTP_REFERER'])));
+    $user_agent  = escape_trim(clean_xss_tags(strip_tags($_SERVER['HTTP_USER_AGENT'])));
     $vi_browser = '';
     $vi_os = '';
     $vi_device = '';

config.php

@@ -5,7 +5,7 @@
 ********************/
 
 define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.3.2.9');
+define('G5_GNUBOARD_VER', '5.3.3.2');
 
 // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
 define('_GNUBOARD_', true);

head.sub.php

@@ -19,8 +19,8 @@ else {
     $g5_head_title .= " | ".$config['cf_title'];
 }
 
-$g5['title'] = strip_tags(get_text($g5['title']));
-$g5_head_title = strip_tags(get_text($g5_head_title));
+$g5['title'] = strip_tags($g5['title']);
+$g5_head_title = strip_tags($g5_head_title);
 
 // 현재 접속자
 // 게시판 제목에 ' 포함되면 오류 발생

lib/common.lib.php

@@ -2887,13 +2887,17 @@ function get_search_string($stx)
 }
 
 // XSS 관련 태그 제거
-function clean_xss_tags($str)
+function clean_xss_tags($str, $check_entities=0)
 {
     $str_len = strlen($str);
     
     $i = 0;
     while($i <= $str_len){
         $result = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $str);
+        
+        if( $check_entities ){
+            $result = str_replace(array('&colon;', '&lpar;', '&rpar;', '&NewLine;', '&Tab;'), '', $result);
+        }
 
         if((string)$result === (string)$str) break;
 
@@ -3421,7 +3425,7 @@ function get_head_title($title){
     global $g5;
 
     if( isset($g5['board_title']) && $g5['board_title'] ){
-        $title = strip_tags(get_text($g5['board_title']));
+        $title = strip_tags($g5['board_title']);
     }
 
     return $title;
@@ -3497,11 +3501,16 @@ function get_call_func_cache($func, $args=array()){
 function is_include_path_check($path='', $is_input='')
 {
     if( $path ){
+
+        if( strlen($path) > 255 ){
+            return false;
+        }
+
         if ($is_input){
             // 장태진 @jtjisgod <jtjisgod@gmail.com> 추가
             // 보안 목적 : rar wrapper 차단
 
-            if( stripos($path, 'rar:') !== false || stripos($path, 'php:') !== false || stripos($path, 'zlib:') !== false || stripos($path, 'bzip2:') !== false || stripos($path, 'zip:') !== false || stripos($path, 'data:') !== false || stripos($path, 'phar:') !== false ){
+            if( stripos($path, 'rar:') !== false || stripos($path, 'php:') !== false || stripos($path, 'zlib:') !== false || stripos($path, 'bzip2:') !== false || stripos($path, 'zip:') !== false || stripos($path, 'data:') !== false || stripos($path, 'phar:') !== false || stripos($path, 'file:') !== false ){
                 return false;
             }
             
@@ -3555,11 +3564,14 @@ function is_include_path_check($path='', $is_input='')
             if( (preg_match('/\.\.\//i', $replace_path) || preg_match('/^\/.*/i', $replace_path)) && preg_match('/plugin\//i', $replace_path) && preg_match('/okname\//i', $replace_path) ){
                 return false;
             }
+            if( substr_count($replace_path, './') > 5 ){
+                return false;
+            }
         }
 
         $extension = pathinfo($path, PATHINFO_EXTENSION);
         
-        if($extension && preg_match('/(jpg|jpeg|png|gif|bmp|conf)$/i', $extension)) {
+        if($extension && preg_match('/(jpg|jpeg|png|gif|bmp|conf|php\-x)$/i', $extension)) {
             return false;
         }
     }

plugin/editor/smarteditor2/js/smarteditor2.js

@@ -20339,18 +20339,23 @@ nhn.husky.HuskyCore.mixin(nhn.husky.SE2M_TableEditor, {
 	
 	addCSSClass : function(sClassName, sClassRule){
 		var oDoc = this.oApp.getWYSIWYGDocument();
-		if(oDoc.styleSheets[0] && oDoc.styleSheets[0].addRule){
-			// IE
-			oDoc.styleSheets[0].addRule("." + sClassName, sClassRule);
-		}else{
-			// FF
-			var elHead = oDoc.getElementsByTagName("HEAD")[0]; 
-			var elStyle = oDoc.createElement ("STYLE"); 
-			//styleElement.type = "text / css"; 
-			elHead.appendChild (elStyle); 
-			
-			elStyle.sheet.insertRule("." + sClassName + " { "+sClassRule+" }", 0);
-		}
+
+        try {
+            if(oDoc.styleSheets[0] && oDoc.styleSheets[0].addRule){
+                // IE
+                oDoc.styleSheets[0].addRule("." + sClassName, sClassRule);
+            }else{
+                // FF
+                var elHead = oDoc.getElementsByTagName("HEAD")[0]; 
+                var elStyle = oDoc.createElement ("STYLE"); 
+                //styleElement.type = "text / css"; 
+                elHead.appendChild (elStyle); 
+                
+                elStyle.sheet.insertRule("." + sClassName + " { "+sClassRule+" }", 0);
+            }
+        } catch (e) {
+            //console.log(e);
+        }
 	},
 	
 	// [SMARTEDITORSUS-1533]

plugin/okname/hpcert.config.php

@@ -5,7 +5,7 @@ if(!$config['cf_cert_use'] || $config['cf_cert_hp'] != 'kcb')
     alert('기본환경설정에서 KCB 휴대폰본인확인 서비스로 설정해 주십시오.');
 
 // key 디렉토리 체크
-include_once('./key_dir_check.php');
+require_once('./key_dir_check.php');
 
 /**************************************************************************
  * okname 생년월일 본인 확인서비스 파라미터

plugin/okname/hpcert1.php

@@ -15,8 +15,8 @@ foreach($check_arrays as $key){
 certify_count_check($member['mb_id'], 'hp');
 
 // KISA 취약점 내용(KVE-2018-0291) hpcert1.php의 $cmd 함수에 대한 인자 값은 hpcert_config.php 파일에서 설정되나, 이를 다른 페이지에서 포함한 뒤 호출할 시 임의 값 설정 가능
-// 이에 include_once 를 include 로 수정함
-include('./hpcert.config.php');
+// 이에 include_once 를 require 로 수정함
+require('./hpcert.config.php');
 /**************************************************************************
 okname 실행
 **************************************************************************/

plugin/okname/hpcert2.php

@@ -1,7 +1,7 @@
 <?php
 include_once('./_common.php');
 
-$check_arrays = array('exe', 'keypath', 'memId', 'endPointURL', 'logPath');
+$check_arrays = array('exe', 'keypath', 'memId', 'endPointURL', 'endPointUrl', 'logPath');
 
 foreach($check_arrays as $key){
     if( isset($_REQUEST[$key]) && $_REQUEST[$key] ){
@@ -12,8 +12,8 @@ foreach($check_arrays as $key){
 }
 
 // KISA 취약점 내용(KVE-2018-0291) hpcert1.php의 $cmd 함수에 대한 인자 값은 hpcert_config.php 파일에서 설정되나, 이를 다른 페이지에서 포함한 뒤 호출할 시 임의 값 설정 가능
-// 이에 include_once 를 include 로 수정함
-include('./hpcert.config.php');
+// 이에 include_once 를 require 로 수정함
+require('./hpcert.config.php');
 /**************************************************************************
     파일명 : safe_hs_cert3.php
 

plugin/okname/ipin.config.php

@@ -5,7 +5,7 @@ if(!$config['cf_cert_use'] || $config['cf_cert_ipin'] != 'kcb')
     alert('기본환경설정에서 KCB 아이핀 본인확인 서비스로 설정해 주십시오.');
 
 // key 디렉토리 체크
-include_once('./key_dir_check.php');
+require_once('./key_dir_check.php');
 
 $exe = '';
 // 실행모듈

plugin/okname/ipin1.php

@@ -15,8 +15,8 @@ foreach($check_arrays as $key){
 certify_count_check($member['mb_id'], 'ipin');
 
 // KISA 취약점 내용(KVE-2018-0291) hpcert1.php의 $cmd 함수에 대한 인자 값은 hpcert_config.php 파일에서 설정되나, 이를 다른 페이지에서 포함한 뒤 호출할 시 임의 값 설정 가능
-// 이에 include_once 를 include 로 수정함
-include('./ipin.config.php');
+// 이에 include_once 를 require 로 수정함
+require('./ipin.config.php');
 
 $option = "C";// Option
 

plugin/okname/ipin2.php

@@ -11,7 +11,7 @@ foreach($check_arrays as $key){
     $$key = '';
 }
 
-include('./ipin.config.php');
+require('./ipin.config.php');
 
 //아이핀팝업에서 조회한 PERSONALINFO이다.
 @$encPsnlInfo = $_POST["encPsnlInfo"];

theme/basic/head.sub.php

@@ -13,8 +13,8 @@ else {
     $g5_head_title .= " | ".$config['cf_title'];
 }
 
-$g5['title'] = strip_tags(get_text($g5['title']));
-$g5_head_title = strip_tags(get_text($g5_head_title));
+$g5['title'] = strip_tags($g5['title']);
+$g5_head_title = strip_tags($g5_head_title);
 
 // 현재 접속자
 // 게시판 제목에 ' 포함되면 오류 발생