Merge branch 'master' of github.com:gnuboard/g5

empty_mb_name is a function checking name from user input form. But it
was not checked by empty_mb_name function. So I fix it.

adm/_common.php

@@ -6,4 +6,6 @@ include_once(G5_ADMIN_PATH.'/admin.lib.php');
 if( isset($token) ){
     $token = @htmlspecialchars(strip_tags($token), ENT_QUOTES);
 }
+
+run_event('admin_common');
 ?>

adm/_rewrite_config_form.php

@@ -0,0 +1,120 @@
+<?php
+if (!defined('_GNUBOARD_')) exit;
+
+$is_use_apache = (stripos($_SERVER['SERVER_SOFTWARE'], 'apache') !== false);
+
+$is_use_nginx = (stripos($_SERVER['SERVER_SOFTWARE'], 'nginx') !== false);
+
+$is_use_iis = !$is_use_apache && (stripos($_SERVER['SERVER_SOFTWARE'], 'microsoft-iis') !== false);
+
+$is_write_file = false;
+$is_apache_need_rules = false;
+$is_apache_rewrite = false;
+
+if( !($is_use_apache || $is_use_nginx || $is_use_iis) ){    // 셋다 아니면 다 출력시킨다.
+    $is_use_apache = true;
+    $is_use_nginx = true;
+}
+
+if ( $is_use_nginx ){
+    $is_write_file = false;
+}
+
+if ( $is_use_apache ){
+    $is_write_file = (is_writable(G5_PATH) || (file_exists(G5_PATH.'/.htaccess') && is_writable(G5_PATH.'/.htaccess'))) ? true : false;
+    $is_apache_need_rules = check_need_rewrite_rules();
+    $is_apache_rewrite = function_exists('apache_get_modules') && in_array('mod_rewrite', apache_get_modules());
+}
+
+$get_path_url = parse_url( G5_URL );
+
+$base_path = isset($get_path_url['path']) ? $get_path_url['path'].'/' : '/';
+
+// add_stylesheet('css 구문', 출력순서); 숫자가 작을 수록 먼저 출력됨
+add_stylesheet('<link rel="stylesheet" href="'.G5_JS_URL.'/remodal/remodal.css">', 11);
+add_stylesheet('<link rel="stylesheet" href="'.G5_JS_URL.'/remodal/remodal-default-theme.css">', 12);
+add_javascript('<script src="'.G5_JS_URL.'/remodal/remodal.js"></script>', 10);
+?>
+<section id="anc_cf_url">
+    <h2 class="h2_frm">짧은 주소 설정</h2>
+    <?php echo $pg_anchor ?>
+    <div class="local_desc02 local_desc">
+        <p>
+            게시판과 컨텐츠 페이지에 짧은 URL 을 사용합니다. <a href="https://sir.kr/manual/g5/286" class="btn btn_03" target="_blank" style="margin-left:10px">설정 관련 메뉴얼 보기</a>
+            <?php if( $is_use_apache && ! $is_use_nginx ){ ?>
+                <?php if( ! $is_apache_rewrite ){ ?>
+                <br><strong>Apache 서버인 경우 rewrite_module 이 비활성화 되어 있으면 짧은 주소를 사용할수 없습니다.</strong>
+                <?php } else if( ! $is_write_file && $is_apache_need_rules ) {   // apache인 경우 ?>
+                <br><strong>짧은 주소 사용시 아래 Apache 설정 코드를 참고하여 설정해 주세요.</strong>
+                <?php } ?>
+            <?php } ?>
+        </p>
+    </div>
+
+    <div class="server_config_views">
+        <?php if ( $is_use_apache ){ ?>
+            <button type="button" data-remodal-target="modal_apache" class="btn btn_03">Apache 설정 코드 보기</button>
+        <?php } ?>
+        <?php if ( $is_use_nginx ) { ?>
+            <button type="button" data-remodal-target="modal_nginx" class="btn btn_03">Nginx 설정 코드 보기</button>
+        <?php } ?>
+    </div>
+
+    <div class="tbl_frm01 tbl_wrap">
+        <table>
+        <caption>짧은주소 설정</caption>
+        <colgroup>
+            <col class="grid_4">
+            <col>
+        </colgroup>
+        <tbody>
+        <?php
+            $short_url_arrs = array(
+            '0'=>array('label'=>'사용안함', 'url'=>G5_URL.'/board.php?bo_table=free&wr_id=123'),
+            '1'=>array('label'=>'숫자', 'url'=>G5_URL.'/free/123'),
+            '2'=>array('label'=>'글 이름', 'url'=>G5_URL.'/free/안녕하세요/'),
+            );
+            foreach($short_url_arrs as $k=>$v){
+                $checked = ((int) $config['cf_bbs_rewrite'] === (int) $k) ? 'checked' : '';
+        ?>
+            <tr>
+                <td><input name="cf_bbs_rewrite" id="cf_bbs_rewrite_<?php echo $k; ?>" type="radio" value="<?php echo $k; ?>" <?php echo $checked;?> ><label for="cf_bbs_rewrite_<?php echo $k; ?>" class="rules_label"><?php echo $v['label']; ?></label></td>
+                <td><?php echo $v['url']; ?></td>
+            </tr>
+        <?php }     //end foreach ?>
+        </tbody>
+        </table>
+    </div>
+
+    <div class="server_rewrite_info">
+        <div class="is_rewrite remodal" data-remodal-id="modal_apache" role="dialog" aria-labelledby="modalApache" aria-describedby="modal1Desc">
+
+            <button type="button" class="connect-close" data-remodal-action="close">
+                <i class="fa fa-close"></i>
+                <span class="txt">닫기</span>
+            </button>
+
+            <h4 class="copy_title">.htaccess 파일에 적용할 코드입니다.
+            <?php if( ! $is_apache_rewrite ) { ?>
+            <br><span class="info-warning">Apache 서버인 경우 rewrite_module 이 비활성화 되어 있으면 짧은 주소를 사용할수 없습니다.</span>
+            <?php } else if ( ! $is_write_file && $is_apache_need_rules ) { ?>
+            <br><span class="info-warning">자동으로 .htaccess 파일을 수정 할수 있는 권한이 없습니다.<br>.htaccess 파일이 없다면 생성 후에, 아래 코드가 없으면 코드를 복사하여 붙여넣기 해 주세요.</span>
+            <?php } else if ( ! $is_apache_need_rules ){ ?>
+            <br><span class="info-success">정상적으로 적용된 상태입니다.</span>
+            <?php } ?>
+            </h4>
+            <textarea readonly="readonly" rows="10"><?php echo get_mod_rewrite_rules(true); ?></textarea>
+        </div>
+
+        <div class="is_rewrite remodal" data-remodal-id="modal_nginx" role="dialog" aria-labelledby="modalNginx" aria-describedby="modal2Desc">
+
+            <button type="button" class="connect-close" data-remodal-action="close">
+                <i class="fa fa-close"></i>
+                <span class="txt">닫기</span>
+            </button>
+            <h4 class="copy_title">아래 코드를 복사하여 nginx 설정 파일에 적용해 주세요.</h4>
+            <textarea readonly="readonly" rows="10"><?php echo get_nginx_conf_rules(true); ?></textarea>
+        </div>
+
+    </div>
+</section>

adm/admin.head.php

@@ -1,7 +1,7 @@
 <?php
 if (!defined('_GNUBOARD_')) exit;
 
-$begin_time = get_microtime();
+$g5_debug['php']['begin_time'] = $begin_time = get_microtime();
 
 $files = glob(G5_ADMIN_PATH.'/css/admin_extend_*');
 if (is_array($files)) {
@@ -101,7 +101,7 @@ function imageview(id, w, h)
     <h1><?php echo $config['cf_title'] ?></h1>
     <div id="hd_top">
         <button type="button" id="btn_gnb" class="btn_gnb_close <?php echo $adm_menu_cookie['btn_gnb'];?>">메뉴</button>
-       <div id="logo"><a href="<?php echo G5_ADMIN_URL ?>"><img src="<?php echo G5_ADMIN_URL ?>/img/logo.png" alt="<?php echo $config['cf_title'] ?> 관리자"></a></div>
+       <div id="logo"><a href="<?php echo correct_goto_url(G5_ADMIN_URL); ?>"><img src="<?php echo G5_ADMIN_URL ?>/img/logo.png" alt="<?php echo get_text($config['cf_title']); ?> 관리자"></a></div>
 
         <div id="tnb">
             <ul>

adm/admin.js

@@ -108,7 +108,7 @@ function get_ajax_token()
 }
 
 $(function() {
-    $(document).on("click", "form input:submit", function() {
+    $(document).on("click", "form input:submit, form button:submit", function() {
         var f = this.form;
         var token = get_ajax_token();
 

adm/admin.lib.php

@@ -477,8 +477,8 @@ function admin_check_xss_params($params){
 
         if( is_array($value) ){
             admin_check_xss_params($value);
-        } else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/[onload|onerror]=.*/ius', $value)) ){
-            alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.');
+        } else if ( (preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/[onload|onerror]=.*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || (preg_match('/[onload|onerror|focus]=.*/ius', $value) && preg_match('/(eval|expression|exec|prompt)(\s*)\((.*)\)/ius', $value)) ){
+            alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.', G5_URL);
             die();
         }
     }
@@ -486,10 +486,41 @@ function admin_check_xss_params($params){
     return;
 }
 
+function admin_menu_find_by($call, $search_key){
+    global $menu;
+    
+    static $cache_menu = array();
+    
+    if( empty($cache_menu) ){
+        foreach( $menu as $k1=>$arr1 ){
+
+            if (empty($arr1) ) continue;
+            foreach( $arr1 as $k2=>$arr2 ){
+                if (empty($arr2) ) continue;
+
+                $menu_key = isset($arr2[3]) ? $arr2[3] : '';
+                if (empty($menu_key) ) continue;
+
+                $cache_menu[$menu_key] = array(
+                    'sub_menu'=>$arr2[0],
+                    'title'=>$arr2[1],
+                    'link'=>$arr2[2],
+                    );
+            }
+        }
+    }
+
+    if( isset($cache_menu[$call]) && isset($cache_menu[$call][$search_key]) ){
+        return$cache_menu[$call][$search_key];
+    }
+
+    return '';
+}
+
 // 접근 권한 검사
 if (!$member['mb_id'])
 {
-    alert('로그인 하십시오.', G5_BBS_URL.'/login.php?url=' . urlencode(G5_ADMIN_URL));
+    alert('로그인 하십시오.', G5_BBS_URL.'/login.php?url=' . urlencode(correct_goto_url(G5_ADMIN_URL)));
 }
 else if ($is_admin != 'super')
 {
@@ -541,6 +572,11 @@ foreach($menu_files as $file){
 }
 @ksort($amenu);
 
+$amenu = run_replace('admin_amenu', $amenu);
+if( isset($menu) && $menu ){
+    $menu = run_replace('admin_menu', $menu); 
+}
+
 $arr_query = array();
 if (isset($sst))  $arr_query[] = 'sst='.$sst;
 if (isset($sod))  $arr_query[] = 'sod='.$sod;

adm/auth_list.php

@@ -160,7 +160,7 @@ $pagelist = get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_w
 echo $pagelist;
 ?>
 
-<form name="fauthlist2" id="fauthlist2" action="./auth_update.php" method="post" autocomplete="off">
+<form name="fauthlist2" id="fauthlist2" action="./auth_update.php" method="post" autocomplete="off" onsubmit="return fauth_add_submit(this);">
 <input type="hidden" name="sfl" value="<?php echo $sfl ?>">
 <input type="hidden" name="stx" value="<?php echo $stx ?>">
 <input type="hidden" name="sst" value="<?php echo $sst ?>">
@@ -218,6 +218,17 @@ echo $pagelist;
                 <label for="d">d (삭제)</label>
             </td>
         </tr>
+        <tr>
+            <th scope="row">자동등록방지</th>
+            <td>
+                <?php
+                include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
+                $captcha_html = captcha_html();
+                $captcha_js   = chk_captcha_js();
+                echo $captcha_html;
+                ?>
+            </td>
+        </tr>
         </tbody>
         </table>
     </div>
@@ -230,6 +241,13 @@ echo $pagelist;
 </form>
 
 <script>
+function fauth_add_submit(f){
+    
+    <?php echo $captcha_js; // 캡챠 사용시 자바스크립트에서 입력된 캡챠를 검사함  ?>
+
+    return true;
+}
+
 function fauthlist_submit(f)
 {
     if (!is_checked("chk[]")) {

adm/auth_list_delete.php

@@ -28,6 +28,8 @@ for ($i=0; $i<$count; $i++)
 
     $sql = " delete from {$g5['auth_table']} where mb_id = '".$mb_id."' and au_menu = '".$au_menu."' ";
     sql_query($sql);
+
+    run_event('adm_auth_delete_member', $mb_id, $au_menu);
 }
 
 goto_url('./auth_list.php?'.$qstr);

adm/auth_update.php

@@ -1,6 +1,7 @@
 <?php
 $sub_menu = "100200";
 include_once('./_common.php');
+include_once(G5_LIB_PATH.'/mailer.lib.php');
 
 if ($is_admin != 'super')
     alert('최고관리자만 접근 가능합니다.');
@@ -11,6 +12,12 @@ if (!$mb['mb_id'])
 
 check_admin_token();
 
+include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
+
+if (!chk_captcha()) {
+    alert('자동등록방지 숫자가 틀렸습니다.');
+}
+
 $sql = " insert into {$g5['auth_table']}
             set mb_id   = '{$_POST['mb_id']}',
                 au_menu = '{$_POST['au_menu']}',
@@ -26,5 +33,17 @@ if (!$result) {
 
 //sql_query(" OPTIMIZE TABLE `$g5['auth_table']` ");
 
+// 세션을 체크하여 하루에 한번만 메일알림이 가게 합니다.
+if( str_replace('-', '', G5_TIME_YMD) !== get_session('adm_auth_update') ){
+    $site_url = preg_replace('/^www\./', '', strtolower($_SERVER['SERVER_NAME']));
+    $to_email = 'gnuboard@'.$site_url;
+
+    mailer($config['cf_admin_email_name'], $to_email, $config['cf_admin_email'], '['.$config['cf_title'].'] 관리권한설정 알림', '<p><b>['.$config['cf_title'].'] 관리권한설정 변경 안내</b></p><p style="padding-top:1em">회원 아이디 '.$mb['mb_id'].' 에 관리권한이 추가 되었습니다.</p><p style="padding-top:1em">'.G5_TIME_YMDHIS.'</p><p style="padding-top:1em"><a href="'.G5_URL.'" target="_blank">'.$config['cf_title'].'</a></p>', 1);
+
+    set_session('adm_auth_update', str_replace('-', '', G5_TIME_YMD));
+}
+
+run_event('adm_auth_update', $mb);
+
 goto_url('./auth_list.php?'.$qstr);
 ?>

adm/board_copy.php

@@ -31,7 +31,7 @@ include_once(G5_PATH.'/head.sub.php');
             </tr>
             <tr>
                 <th scope="col"><label for="target_subject">게시판 제목<strong class="sound_only">필수</strong></label></th>
-                <td><input type="text" name="target_subject" value="[복사본] <?php echo $board['bo_subject'] ?>" id="target_subject" required class="required frm_input" maxlength="120"></td>
+                <td><input type="text" name="target_subject" value="[복사본] <?php echo get_sanitize_input($board['bo_subject']); ?>" id="target_subject" required class="required frm_input" maxlength="120"></td>
             </tr>
             <tr>
                 <th scope="col">복사 유형</th>
@@ -58,6 +58,19 @@ include_once(G5_PATH.'/head.sub.php');
 <script>
 function fboardcopy_check(f)
 {
+    <?php
+    if(!$w){
+    $js_array = get_bo_table_banned_word();
+    echo "var banned_array = ". json_encode($js_array) . ";\n";
+    }
+    ?>
+
+    // 게시판명이 금지된 단어로 되어 있으면
+    if( (typeof banned_array != 'undefined') && jQuery.inArray(f.target_table.value, banned_array) !== -1 ){
+        alert("입력한 게시판 TABLE명을 사용할수 없습니다. 다른 이름으로 입력해 주세요.");
+        return false;
+    }
+
     if (f.bo_table.value == f.target_table.value) {
         alert("원본 테이블명과 복사할 테이블명이 달라야 합니다.");
         return false;

adm/board_copy_update.php

@@ -11,10 +11,17 @@ check_admin_token();
 $target_table   = trim($_POST['target_table']);
 $target_subject = trim($_POST['target_subject']);
 
+$target_subject = strip_tags(clean_xss_attributes($target_subject));
+
 if (!preg_match('/[A-Za-z0-9_]{1,20}/', $target_table)) {
     alert('게시판 TABLE명은 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (20자 이내)');
 }
 
+// 게시판명이 금지된 단어로 되어 있으면
+if ( $w == '' && in_array($target_table, get_bo_table_banned_word()) ){
+    alert('입력한 게시판 TABLE명을 사용할수 없습니다. 다른 이름으로 입력해 주세요.');
+}
+
 $row = sql_fetch(" select count(*) as cnt from {$g5['board_table']} where bo_table = '$target_table' ");
 if ($row['cnt'])
     alert($target_table.'은(는) 이미 존재하는 게시판 테이블명 입니다.\\n복사할 테이블명으로 사용할 수 없습니다.');
@@ -160,6 +167,8 @@ if ($copy_case == 'schema_data_both') {
         }
     }
     $d->close();
+    
+    run_event('admin_board_copy_file', $bo_table, $target_table);
 
     // 글복사
     $sql = " insert into {$g5['write_prefix']}$target_table select * from {$g5['write_prefix']}$bo_table ";
@@ -181,6 +190,9 @@ if ($copy_case == 'schema_data_both') {
 
 if (count($file_copy)) {
     for ($i=0; $i<count($file_copy); $i++) {
+
+        $file_copy[$i] = run_replace('admin_copy_update_file', $file_copy[$i], $file_copy[$i]['bf_file'], $bo_table, $target_table);
+
         $sql = " insert into {$g5['board_file_table']}
                     set bo_table = '$target_table',
                          wr_id = '{$file_copy[$i]['wr_id']}',
@@ -189,11 +201,15 @@ if (count($file_copy)) {
                          bf_file = '{$file_copy[$i]['bf_file']}',
                          bf_download = '{$file_copy[$i]['bf_download']}',
                          bf_content = '".addslashes($file_copy[$i]['bf_content'])."',
+                         bf_fileurl = '".addslashes($file_copy[$i]['bf_fileurl'])."',
+                         bf_thumburl = '".addslashes($file_copy[$i]['bf_thumburl'])."',
+                         bf_storage = '".addslashes($file_copy[$i]['bf_storage'])."',
                          bf_filesize = '{$file_copy[$i]['bf_filesize']}',
                          bf_width = '{$file_copy[$i]['bf_width']}',
                          bf_height = '{$file_copy[$i]['bf_height']}',
                          bf_type = '{$file_copy[$i]['bf_type']}',
                          bf_datetime = '{$file_copy[$i]['bf_datetime']}' ";
+
         sql_query($sql, false);
     }
 }

adm/board_delete.inc.php

@@ -26,6 +26,9 @@ sql_query(" delete from {$g5['board_file_table']} where bo_table = '{$tmp_bo_tab
 // 게시판 테이블 DROP
 sql_query(" drop table {$g5['write_prefix']}{$tmp_bo_table} ", FALSE);
 
+// 좋아요 테이블에서 기록 삭제
+sql_query(" delete from {$g5['board_good_table']} where bo_table = '{$tmp_bo_table}' ");
+
 delete_cache_latest($tmp_bo_table);
 
 // 게시판 폴더 전체 삭제

adm/board_form.php

@@ -77,11 +77,18 @@ if (!isset($board['bo_mobile_subject'])) {
 }
 
 if (!isset($board['bo_use_captcha'])) {
-    sql_query(" ALTER TABLE `{$g5['board_table']}` ADD `bo_use_captcha` TINYINT NOT NULL DEFAULT '0' AFTER `bo_use_sns` ");
+    sql_query(" ALTER TABLE `{$g5['board_table']}` ADD `bo_use_captcha` TINYINT NOT NULL DEFAULT '0' AFTER `bo_use_sns` ", false);
 }
 
+if (!isset($board['bo_select_editor'])) {
+    sql_query(" ALTER TABLE `{$g5['board_table']}` ADD `bo_select_editor` VARCHAR(50) NOT NULL DEFAULT '' AFTER `bo_use_dhtml_editor` ", false);
+}
+
+run_event('adm_board_form_before', $board, $w);
+
 $required = "";
 $readonly = "";
+$sound_only = "";
 if ($w == '') {
 
     $html_title .= ' 생성';
@@ -185,7 +192,7 @@ $pg_anchor = '<ul class="anchor">
                 <?php if ($w == '') { ?>
                     영문자, 숫자, _ 만 가능 (공백없이 20자 이내)
                 <?php } else { ?>
-                    <a href="<?php echo G5_BBS_URL ?>/board.php?bo_table=<?php echo $board['bo_table'] ?>" class="btn_frmline">게시판 바로가기</a>
+                    <a href="<?php echo get_pretty_url($board['bo_table']) ?>" class="btn_frmline">게시판 바로가기</a>
                     <a href="./board_list.php?<?php echo $qstr;?>" class="btn_frmline">목록으로</a>
                 <?php } ?>
             </td>
@@ -481,6 +488,27 @@ $pg_anchor = '<ul class="anchor">
                 <label for="chk_all_use_dhtml_editor">전체적용</label>
             </td>
         </tr>
+        <tr>
+            <th scope="row"><label for="bo_select_editor">게시판 에디터 선택</label></th>
+            <td>
+                <?php echo help('게시판에 사용할 에디터를 설정합니다. 스킨에 따라 적용되지 않을 수 있습니다.') ?>
+                <select name="bo_select_editor" id="bo_select_editor">
+                <?php
+                $arr = get_skin_dir('', G5_EDITOR_PATH);
+                for ($i=0; $i<count($arr); $i++) {
+                    if ($i == 0) echo "<option value=\"\">기본환경설정의 에디터 사용</option>";
+                    echo "<option value=\"".$arr[$i]."\"".get_selected($board['bo_select_editor'], $arr[$i]).">".$arr[$i]."</option>\n";
+                }
+                ?>
+                </select>
+            </td>
+            <td class="td_grpset">
+                <input type="checkbox" name="chk_grp_select_editor" value="1" id="chk_grp_select_editor">
+                <label for="chk_grp_select_editor">그룹적용</label>
+                <input type="checkbox" name="chk_all_select_editor" value="1" id="chk_all_select_editor">
+                <label for="chk_all_select_editor">전체적용</label>
+            </td>
+        </tr>
         <tr>
             <th scope="row"><label for="bo_use_rss_view">RSS 보이기 사용</label></th>
             <td>
@@ -1114,25 +1142,23 @@ $pg_anchor = '<ul class="anchor">
             <td>
                 <?php echo help('리스트에서 기본으로 정렬에 사용할 필드를 선택합니다. "기본"으로 사용하지 않으시는 경우 속도가 느려질 수 있습니다.') ?>
                 <select id="bo_sort_field" name="bo_sort_field">
-                    <option value="" <?php echo get_selected($board['bo_sort_field'], ""); ?>>wr_num, wr_reply : 기본</option>
-                    <option value="wr_datetime asc" <?php echo get_selected($board['bo_sort_field'], "wr_datetime asc"); ?>>wr_datetime asc : 날짜 이전것 부터</option>
-                    <option value="wr_datetime desc" <?php echo get_selected($board['bo_sort_field'], "wr_datetime desc"); ?>>wr_datetime desc : 날짜 최근것 부터</option>
-                    <option value="wr_hit asc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_hit asc, wr_num, wr_reply"); ?>>wr_hit asc : 조회수 낮은것 부터</option>
-                    <option value="wr_hit desc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_hit desc, wr_num, wr_reply"); ?>>wr_hit desc : 조회수 높은것 부터</option>
-                    <option value="wr_last asc" <?php echo get_selected($board['bo_sort_field'], "wr_last asc"); ?>>wr_last asc : 최근글 이전것 부터</option>
-                    <option value="wr_last desc" <?php echo get_selected($board['bo_sort_field'], "wr_last desc"); ?>>wr_last desc : 최근글 최근것 부터</option>
-                    <option value="wr_comment asc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_comment asc, wr_num, wr_reply"); ?>>wr_comment asc : 댓글수 낮은것 부터</option>
-                    <option value="wr_comment desc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_comment desc, wr_num, wr_reply"); ?>>wr_comment desc : 댓글수 높은것 부터</option>
-                    <option value="wr_good asc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_good asc, wr_num, wr_reply"); ?>>wr_good asc : 추천수 낮은것 부터</option>
-                    <option value="wr_good desc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_good desc, wr_num, wr_reply"); ?>>wr_good desc : 추천수 높은것 부터</option>
-                    <option value="wr_nogood asc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_nogood asc, wr_num, wr_reply"); ?>>wr_nogood asc : 비추천수 낮은것 부터</option>
-                    <option value="wr_nogood desc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_nogood desc, wr_num, wr_reply"); ?>>wr_nogood desc : 비추천수 높은것 부터</option>
-                    <option value="wr_subject asc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_subject asc, wr_num, wr_reply"); ?>>wr_subject asc : 제목 오름차순</option>
-                    <option value="wr_subject desc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_subject desc, wr_num, wr_reply"); ?>>wr_subject desc : 제목 내림차순</option>
-                    <option value="wr_name asc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_name asc, wr_num, wr_reply"); ?>>wr_name asc : 글쓴이 오름차순</option>
-                    <option value="wr_name desc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "wr_name desc, wr_num, wr_reply"); ?>>wr_name desc : 글쓴이 내림차순</option>
-                    <option value="ca_name asc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "ca_name asc, wr_num, wr_reply"); ?>>ca_name asc : 분류명 오름차순</option>
-                    <option value="ca_name desc, wr_num, wr_reply" <?php echo get_selected($board['bo_sort_field'], "ca_name desc, wr_num, wr_reply"); ?>>ca_name desc : 분류명 내림차순</option>
+                    <?php foreach( get_board_sort_fields($board) as $v ){
+                        
+                        $option_value = $order_by_str = $v[0];
+                        if( $v[0] === 'wr_num, wr_reply' ){
+                            $selected = (! $board['bo_sort_field']) ? 'selected="selected"' : '';
+                            $option_value = '';
+                        } else {
+                            $selected = ($board['bo_sort_field'] === $v[0]) ? 'selected="selected"' : '';
+                        }
+                        
+                        if( $order_by_str !== 'wr_num, wr_reply' ){
+                            $tmp = explode(',', $v[0]);
+                            $order_by_str = $tmp[0];
+                        }
+
+                        echo '<option value="'.$option_value.'" '.$selected.' >'.$order_by_str.' : '.$v[1].'</option>';
+                    } //end foreach ?>
                 </select>
             </td>
             <td class="td_grpset">
@@ -1261,7 +1287,7 @@ $pg_anchor = '<ul class="anchor">
 <div class="btn_fixed_top">
     <?php if( $bo_table && $w ){ ?>
         <a href="./board_copy.php?bo_table=<?php echo $board['bo_table']; ?>" id="board_copy" target="win_board_copy" class=" btn_02 btn">게시판복사</a>
-        <a href="<?php echo G5_BBS_URL ?>/board.php?bo_table=<?php echo $board['bo_table']; ?>" class=" btn_02 btn">게시판 바로가기</a>
+        <a href="<?php echo get_pretty_url($board['bo_table']); ?>" class=" btn_02 btn">게시판 바로가기</a>
         <a href="./board_thumbnail_delete.php?bo_table=<?php echo $board['bo_table'].'&amp;'.$qstr;?>" onclick="return delete_confirm2('게시판 썸네일 파일을 삭제하시겠습니까?');" class="btn_02 btn">게시판 썸네일 삭제</a>
     <?php } ?>
     <input type="submit" value="확인" class="btn_submi btn btn_01" accesskey="s">
@@ -1374,6 +1400,19 @@ jQuery(function($){
 
 function fboardform_submit(f)
 {
+    <?php
+    if(!$w){
+    $js_array = get_bo_table_banned_word();
+    echo "var banned_array = ". json_encode($js_array) . ";\n";
+    }
+    ?>
+
+    // 게시판명이 금지된 단어로 되어 있으면
+    if( (typeof banned_array != 'undefined') && jQuery.inArray(f.bo_table.value, banned_array) !== -1 ){
+        alert("입력한 게시판 TABLE명을 사용할수 없습니다. 다른 이름으로 입력해 주세요.");
+        return false;
+    }
+
     <?php echo get_editor_js("bo_content_head"); ?>
     <?php echo get_editor_js("bo_content_tail"); ?>
     <?php echo get_editor_js("bo_mobile_content_head"); ?>

adm/board_form_update.php

@@ -17,6 +17,11 @@ if (!$bo_table) { alert('게시판 TABLE명은 반드시 입력하세요.'); }
 if (!preg_match("/^([A-Za-z0-9_]{1,20})$/", $bo_table)) { alert('게시판 TABLE명은 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (20자 이내)'); }
 if (!$_POST['bo_subject']) { alert('게시판 제목을 입력하세요.'); }
 
+// 게시판명이 금지된 단어로 되어 있으면
+if ( $w == '' && in_array($bo_table, get_bo_table_banned_word()) ){
+    alert('입력한 게시판 TABLE명을 사용할수 없습니다. 다른 이름으로 입력해 주세요.');
+}
+
 $bo_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($bo_include_head, 0, 255));
 $bo_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($bo_include_tail, 0, 255));
 
@@ -55,6 +60,11 @@ if(!is_include_path_check($bo_include_tail, 1)) {
     alert('하단 파일 경로에 포함시킬수 없는 문자열이 있습니다.');
 }
 
+if( function_exists('filter_input_include_path') ){
+    $bo_include_head = filter_input_include_path($bo_include_head);
+    $bo_include_tail = filter_input_include_path($bo_include_tail);
+}
+
 $board_path = G5_DATA_PATH.'/file/'.$bo_table;
 
 // 게시판 디렉토리 생성
@@ -71,12 +81,12 @@ $f = @fopen($file, 'w');
 // 분류에 & 나 = 는 사용이 불가하므로 2바이트로 바꾼다.
 $src_char = array('&', '=');
 $dst_char = array('＆', '〓');
-$bo_category_list = str_replace($src_char, $dst_char, $bo_category_list);
+$bo_category_list = isset($_POST['bo_category_list']) ? str_replace($src_char, $dst_char, $_POST['bo_category_list']) : '';
 //https://github.com/gnuboard/gnuboard5/commit/f5f4925d4eb28ba1af728e1065fc2bdd9ce1da58 에 따른 조치
-$str_bo_category_list = isset($_POST['bo_category_list']) ? preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $_POST['bo_category_list']) : '';
+$str_bo_category_list = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $bo_category_list);
 
-$_POST['bo_subject'] = strip_tags($_POST['bo_subject']);
-$_POST['bo_mobile_subject'] = strip_tags($_POST['bo_mobile_subject']);
+$_POST['bo_subject'] = strip_tags(clean_xss_attributes($_POST['bo_subject']));
+$_POST['bo_mobile_subject'] = strip_tags(clean_xss_attributes($_POST['bo_mobile_subject']));
 
 $sql_common = " gr_id               = '{$gr_id}',
                 bo_subject          = '{$_POST['bo_subject']}',
@@ -104,6 +114,7 @@ $sql_common = " gr_id               = '{$gr_id}',
                 bo_use_file_content = '{$_POST['bo_use_file_content']}',
                 bo_use_secret       = '{$_POST['bo_use_secret']}',
                 bo_use_dhtml_editor = '{$_POST['bo_use_dhtml_editor']}',
+                bo_select_editor    = '{$_POST['bo_select_editor']}',
                 bo_use_rss_view     = '{$_POST['bo_use_rss_view']}',
                 bo_use_good         = '{$_POST['bo_use_good']}',
                 bo_use_nogood       = '{$_POST['bo_use_nogood']}',
@@ -192,7 +203,9 @@ if ($w == '') {
 
     // 게시판 테이블 생성
     $file = file('./sql_write.sql');
-    $sql = implode($file, "\n");
+    $file = get_db_create_replace($file);
+
+    $sql = implode("\n", $file);
 
     $create_table = $g5['write_prefix'] . $bo_table;
 
@@ -282,13 +295,14 @@ if (is_checked('chk_grp_write_point'))          $grp_fields .= " , bo_write_poin
 if (is_checked('chk_grp_comment_point'))        $grp_fields .= " , bo_comment_point = '{$bo_comment_point}' ";
 if (is_checked('chk_grp_download_point'))       $grp_fields .= " , bo_download_point = '{$bo_download_point}' ";
 if (is_checked('chk_grp_category_list')) {
-    $grp_fields .= " , bo_category_list = '{$bo_category_list}' ";
+    $grp_fields .= " , bo_category_list = '{$str_bo_category_list}' ";
     $grp_fields .= " , bo_use_category = '{$bo_use_category}' ";
 }
 if (is_checked('chk_grp_use_sideview'))         $grp_fields .= " , bo_use_sideview = '{$bo_use_sideview}' ";
 if (is_checked('chk_grp_use_file_content'))     $grp_fields .= " , bo_use_file_content = '{$bo_use_file_content}' ";
 if (is_checked('chk_grp_use_secret'))           $grp_fields .= " , bo_use_secret = '{$bo_use_secret}' ";
 if (is_checked('chk_grp_use_dhtml_editor'))     $grp_fields .= " , bo_use_dhtml_editor = '{$bo_use_dhtml_editor}' ";
+if (is_checked('chk_grp_select_editor'))        $grp_fields .= " , bo_select_editor = '{$bo_select_editor}' ";
 if (is_checked('chk_grp_use_rss_view'))         $grp_fields .= " , bo_use_rss_view = '{$bo_use_rss_view}' ";
 if (is_checked('chk_grp_use_good'))             $grp_fields .= " , bo_use_good = '{$bo_use_good}' ";
 if (is_checked('chk_grp_use_nogood'))           $grp_fields .= " , bo_use_nogood = '{$bo_use_nogood}' ";
@@ -371,13 +385,14 @@ if (is_checked('chk_all_write_point'))          $all_fields .= " , bo_write_poin
 if (is_checked('chk_all_comment_point'))        $all_fields .= " , bo_comment_point = '{$bo_comment_point}' ";
 if (is_checked('chk_all_download_point'))       $all_fields .= " , bo_download_point = '{$bo_download_point}' ";
 if (is_checked('chk_all_category_list')) {
-    $all_fields .= " , bo_category_list = '{$bo_category_list}' ";
+    $all_fields .= " , bo_category_list = '{$str_bo_category_list}' ";
     $all_fields .= " , bo_use_category = '{$bo_use_category}' ";
 }
 if (is_checked('chk_all_use_sideview'))         $all_fields .= " , bo_use_sideview = '{$bo_use_sideview}' ";
 if (is_checked('chk_all_use_file_content'))     $all_fields .= " , bo_use_file_content = '{$bo_use_file_content}' ";
 if (is_checked('chk_all_use_secret'))           $all_fields .= " , bo_use_secret = '{$bo_use_secret}' ";
 if (is_checked('chk_all_use_dhtml_editor'))     $all_fields .= " , bo_use_dhtml_editor = '{$bo_use_dhtml_editor}' ";
+if (is_checked('chk_all_select_editor'))        $all_fields .= " , bo_select_editor = '{$bo_select_editor}' ";
 if (is_checked('chk_all_use_rss_view'))         $all_fields .= " , bo_use_rss_view = '{$bo_use_rss_view}' ";
 if (is_checked('chk_all_use_good'))             $all_fields .= " , bo_use_good = '{$bo_use_good}' ";
 if (is_checked('chk_all_use_nogood'))           $all_fields .= " , bo_use_nogood = '{$bo_use_nogood}' ";
@@ -444,5 +459,7 @@ delete_cache_latest($bo_table);
 if(function_exists('get_admin_captcha_by'))
     get_admin_captcha_by('remove');
 
+run_event('admin_board_form_update', $bo_table, $w);
+
 goto_url("./board_form.php?w=u&bo_table={$bo_table}&amp;{$qstr}");
 ?>

adm/board_list.php

@@ -131,7 +131,7 @@ $colspan = 15;
         </td>
         <td>
             <input type="hidden" name="board_table[<?php echo $i ?>]" value="<?php echo $row['bo_table'] ?>">
-            <a href="<?php echo G5_BBS_URL ?>/board.php?bo_table=<?php echo $row['bo_table'] ?>"><?php echo $row['bo_table'] ?></a>
+            <a href="<?php echo get_pretty_url($row['bo_table']) ?>"><?php echo $row['bo_table'] ?></a>
         </td>
         <td>
             <label for="bo_skin_<?php echo $i; ?>" class="sound_only">스킨</label>

adm/board_list_update.php

@@ -10,6 +10,10 @@ if (!count($_POST['chk'])) {
 
 check_admin_token();
 
+$act_button = isset($_POST['act_button']) ? strip_tags($_POST['act_button']) : '';
+$chk = (isset($_POST['chk']) && is_array($_POST['chk'])) ? $_POST['chk'] : array();
+$board_table = (isset($_POST['board_table']) && is_array($_POST['board_table'])) ? $_POST['board_table'] : array();
+
 if ($_POST['act_button'] == "선택수정") {
 
     auth_check($auth[$sub_menu], 'w');
@@ -29,7 +33,7 @@ if ($_POST['act_button'] == "선택수정") {
                 alert('최고관리자가 아닌 경우 다른 관리자의 게시판('.$board_table[$k].')은 수정이 불가합니다.');
         }
 
-        $p_bo_subject = is_array($_POST['bo_subject']) ? strip_tags($_POST['bo_subject'][$k]) : '';
+        $p_bo_subject = is_array($_POST['bo_subject']) ? strip_tags(clean_xss_attributes($_POST['bo_subject'][$k])) : '';
 
         $sql = " update {$g5['board_table']}
                     set gr_id               = '".sql_real_escape_string(strip_tags($_POST['gr_id'][$k]))."',
@@ -74,5 +78,7 @@ if ($_POST['act_button'] == "선택수정") {
 
 }
 
+run_event('admin_board_list_update', $act_button, $chk, $board_table, $qstr);
+
 goto_url('./board_list.php?'.$qstr);
 ?>

adm/boardgroup_form_update.php

@@ -16,7 +16,7 @@ if (!preg_match("/^([A-Za-z0-9_]{1,10})$/", $_POST['gr_id']))
 
 if (!$gr_subject) alert('그룹 제목을 입력하세요.');
 
-$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';
+$gr_subject = isset($_POST['gr_subject']) ? strip_tags(clean_xss_attributes($_POST['gr_subject'])) : '';
 
 $sql_common = " gr_subject = '{$gr_subject}',
                 gr_device = '{$_POST['gr_device']}',
@@ -69,5 +69,7 @@ if ($w == '') {
     alert('제대로 된 값이 넘어오지 않았습니다.');
 }
 
+run_event('admin_boardgroup_form_update', $gr_id, $w);
+
 goto_url('./boardgroup_form.php?w=u&gr_id='.$gr_id.'&'.$qstr);
 ?>

adm/boardgroup_list.php

@@ -124,7 +124,7 @@ $colspan = 10;
     <tr class="<?php echo $bg; ?>">
         <td class="td_chk">
             <input type="hidden" name="group_id[<?php echo $i ?>]" value="<?php echo $row['gr_id'] ?>">
-            <label for="chk_<?php echo $i; ?>" class="sound_only"><?php echo $row['gr_subject'] ?> 그룹</label>
+            <label for="chk_<?php echo $i; ?>" class="sound_only"><?php echo get_text($row['gr_subject']); ?> 그룹</label>
             <input type="checkbox" name="chk[]" value="<?php echo $i ?>" id="chk_<?php echo $i ?>">
         </td>
         <td class="td_left"><a href="<?php echo G5_BBS_URL ?>/group.php?gr_id=<?php echo $row['gr_id'] ?>"><?php echo $row['gr_id'] ?></a></td>
@@ -135,9 +135,9 @@ $colspan = 10;
         <td class="td_mng td_input">
         <?php if ($is_admin == 'super'){ ?>
             <label for="gr_admin_<?php echo $i; ?>" class="sound_only">그룹관리자</label>
-            <input type="text" name="gr_admin[<?php echo $i ?>]" value="<?php echo $row['gr_admin'] ?>" id="gr_admin_<?php echo $i ?>" class="tbl_input" size="10" maxlength="20">
+            <input type="text" name="gr_admin[<?php echo $i ?>]" value="<?php echo get_sanitize_input($row['gr_admin']); ?>" id="gr_admin_<?php echo $i ?>" class="tbl_input" size="10" maxlength="20">
         <?php }else{ ?>
-            <input type="hidden" name="gr_admin[<?php echo $i ?>]" value="<?php echo $row['gr_admin'] ?>"><?php echo $row['gr_admin'] ?>
+            <input type="hidden" name="gr_admin[<?php echo $i ?>]" value="<?php echo get_sanitize_input($row['gr_admin']); ?>"><?php echo get_text($row['gr_admin']); ?>
         <?php } ?>
         </td>
         <td class="td_num"><a href="./board_list.php?sfl=a.gr_id&amp;stx=<?php echo $row['gr_id'] ?>"><?php echo $row2['cnt'] ?></a></td>

adm/boardgroup_list_update.php

@@ -10,19 +10,23 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
-$count = count($_POST['chk']);
+$post_chk = isset($_POST['chk']) ? (array) $_POST['chk'] : array();
+$post_group_id = isset($_POST['group_id']) ? (array) $_POST['group_id'] : array();
+$act_button = isset($_POST['act_button']) ? $_POST['act_button'] : '';
+
+$count = count($post_chk);
 
 if(!$count)
-    alert($_POST['act_button'].'할 게시판그룹을 1개이상 선택해 주세요.');
+    alert($act_button.'할 게시판그룹을 1개이상 선택해 주세요.');
 
 for ($i=0; $i<$count; $i++)
 {
-    $k     = $_POST['chk'][$i];
-    $gr_id = preg_replace('/[^a-z0-9_]/i', '', $_POST['group_id'][$k]);
-    $gr_subject = is_array($_POST['gr_subject']) ? strip_tags($_POST['gr_subject'][$k]) : '';
-    $gr_admin = is_array($_POST['gr_admin']) ? strip_tags($_POST['gr_admin'][$k]) : '';
+    $k     = $post_chk[$i];
+    $gr_id = preg_replace('/[^a-z0-9_]/i', '', $post_group_id[$k]);
+    $gr_subject = is_array($_POST['gr_subject']) ? strip_tags(clean_xss_attributes($_POST['gr_subject'][$k])) : '';
+    $gr_admin = is_array($_POST['gr_admin']) ? strip_tags(clean_xss_attributes($_POST['gr_admin'][$k])) : '';
 
-    if($_POST['act_button'] == '선택수정') {
+    if($act_button == '선택수정') {
         $sql = " update {$g5['group_table']}
                     set gr_subject    = '{$gr_subject}',
                         gr_device     = '".sql_real_escape_string($_POST['gr_device'][$k])."',
@@ -33,7 +37,7 @@ for ($i=0; $i<$count; $i++)
         if ($is_admin != 'super')
             $sql .= " and gr_admin    = '{$gr_admin}' ";
         sql_query($sql);
-    } else if($_POST['act_button'] == '선택삭제') {
+    } else if($act_button == '선택삭제') {
         $row = sql_fetch(" select count(*) as cnt from {$g5['board_table']} where gr_id = '$gr_id' ");
         if ($row['cnt'])
             alert("이 그룹에 속한 게시판이 존재하여 게시판 그룹을 삭제할 수 없습니다.\\n\\n이 그룹에 속한 게시판을 먼저 삭제하여 주십시오.", './board_list.php?sfl=gr_id&amp;stx='.$gr_id);
@@ -46,5 +50,7 @@ for ($i=0; $i<$count; $i++)
     }
 }
 
+run_event('admin_boardgroup_list_update', $act_button, $chk, $post_group_id, $qstr);
+
 goto_url('./boardgroup_list.php?'.$qstr);
 ?>

adm/browscap.php

@@ -3,7 +3,7 @@ $sub_menu = "100510";
 include_once('./_common.php');
 
 if(!(version_compare(phpversion(), '5.3.0', '>=') && defined('G5_BROWSCAP_USE') && G5_BROWSCAP_USE))
-    alert('사용할 수 없는 기능입니다.', G5_ADMIN_URL);
+    alert('사용할 수 없는 기능입니다.', correct_goto_url(G5_ADMIN_URL));
 
 if ($is_admin != 'super')
     alert('최고관리자만 접근 가능합니다.');

adm/browscap_convert.php

@@ -3,7 +3,7 @@ $sub_menu = "100520";
 include_once('./_common.php');
 
 if(!(version_compare(phpversion(), '5.3.0', '>=') && defined('G5_BROWSCAP_USE') && G5_BROWSCAP_USE))
-    alert('사용할 수 없는 기능입니다.', G5_ADMIN_URL);
+    alert('사용할 수 없는 기능입니다.', correct_goto_url(G5_ADMIN_URL));
 
 if ($is_admin != 'super')
     alert('최고관리자만 접근 가능합니다.');

adm/cache_file_delete.php

@@ -10,6 +10,8 @@ if(function_exists('social_log_file_delete')){
     social_log_file_delete();
 }
 
+run_event('adm_cache_file_delete_before');
+
 $g5['title'] = '캐시파일 일괄삭제';
 include_once('./admin.head.php');
 ?>
@@ -31,6 +33,9 @@ $cnt=0;
 echo '<ul class="session_del">'.PHP_EOL;
 
 $files = glob(G5_DATA_PATH.'/cache/latest-*');
+$content_files = glob(G5_DATA_PATH.'/cache/content-*');
+
+$files = array_merge($files, $content_files);
 if (is_array($files)) {
     foreach ($files as $cache_file) {
         $cnt++;
@@ -44,6 +49,8 @@ if (is_array($files)) {
     }
 }
 
+run_event('adm_cache_file_delete');
+
 echo '<li>완료됨</li></ul>'.PHP_EOL;
 echo '<div class="local_desc01 local_desc"><p><strong>최신글 캐시파일 '.$cnt.'건 삭제 완료됐습니다.</strong><br>프로그램의 실행을 끝마치셔도 좋습니다.</p></div>'.PHP_EOL;
 ?>

adm/config_form.php

@@ -253,6 +253,31 @@ if(!sql_query(" DESC {$g5['social_profile_table']} ", false)) {
                 ) ", true);
 }
 
+// 짧은 URL 주소를 사용 여부 필드 추가
+if (!isset($config['cf_bbs_rewrite'])) {
+    sql_query(" ALTER TABLE `{$g5['config_table']}`
+                    ADD `cf_bbs_rewrite` tinyint(4) NOT NULL DEFAULT '0' AFTER `cf_link_target` ", true);
+}
+
+// 읽지 않은 메모 수 칼럼 추가
+if(!isset($member['mb_memo_cnt'])) {
+    sql_query(" ALTER TABLE `{$g5['member_table']}`
+                ADD `mb_memo_cnt` int(11) NOT NULL DEFAULT '0' AFTER `mb_memo_call`", true);
+}
+
+// 스크랩 읽은 수 추가
+if(!isset($member['mb_scrap_cnt'])) {
+    sql_query(" ALTER TABLE `{$g5['member_table']}`
+                ADD `mb_scrap_cnt` int(11) NOT NULL DEFAULT '0' AFTER `mb_memo_cnt`", true);
+}
+
+// 아이코드 토큰키 추가
+if( ! isset($config['cf_icode_token_key']) ){
+    $sql = "ALTER TABLE `{$g5['config_table']}` 
+            ADD COLUMN `cf_icode_token_key` VARCHAR(100) NOT NULL DEFAULT '' AFTER `cf_icode_server_port`; ";
+    sql_query($sql, false);
+}
+
 if(!$config['cf_faq_skin']) $config['cf_faq_skin'] = "basic";
 if(!$config['cf_mobile_faq_skin']) $config['cf_mobile_faq_skin'] = "basic";
 
@@ -264,6 +289,7 @@ $pg_anchor = '<ul class="anchor">
     <li><a href="#anc_cf_board">게시판기본</a></li>
     <li><a href="#anc_cf_join">회원가입</a></li>
     <li><a href="#anc_cf_cert">본인확인</a></li>
+    <li><a href="#anc_cf_url">짧은주소</a></li>
     <li><a href="#anc_cf_mail">기본메일환경</a></li>
     <li><a href="#anc_cf_article_mail">글작성메일</a></li>
     <li><a href="#anc_cf_join_mail">가입메일</a></li>
@@ -302,7 +328,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
         <tbody>
         <tr>
             <th scope="row"><label for="cf_title">홈페이지 제목<strong class="sound_only">필수</strong></label></th>
-            <td colspan="3"><input type="text" name="cf_title" value="<?php echo $config['cf_title'] ?>" id="cf_title" required class="required frm_input" size="40"></td>
+            <td colspan="3"><input type="text" name="cf_title" value="<?php echo get_sanitize_input($config['cf_title']); ?>" id="cf_title" required class="required frm_input" size="40"></td>
         </tr>
         <tr>
             <th scope="row"><label for="cf_admin">최고관리자<strong class="sound_only">필수</strong></label></th>
@@ -881,6 +907,9 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
     </div>
 </section>
 
+<?php
+include_once('_rewrite_config_form.php');
+?>
 
 <section id="anc_cf_mail">
     <h2 class="h2_frm">기본 메일 환경 설정</h2>
@@ -1154,7 +1183,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
         <tr>
             <th scope="row"><label for="cf_kakao_rest_key">카카오 REST API 키</label></th>
             <td>
-                <input type="text" name="cf_kakao_rest_key" value="<?php echo $config['cf_kakao_rest_key'] ?>" id="cf_kakao_rest_key" class="frm_input" size="40"> <a href="https://developers.kakao.com/apps/new" target="_blank" class="btn_frmline">앱 등록하기</a>
+                <input type="text" name="cf_kakao_rest_key" value="<?php echo $config['cf_kakao_rest_key'] ?>" id="cf_kakao_rest_key" class="frm_input" size="40"> <a href="https://developers.kakao.com/product/kakaoLogin" target="_blank" class="btn_frmline">앱 등록하기</a>
             </td>
             <th scope="row"><label for="cf_kakao_client_secret">카카오 Client Secret</label></th>
             <td>
@@ -1235,29 +1264,29 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
         <tr>
             <th scope="row"><label for="cf_sms_type">SMS 전송유형</label></th>
             <td>
-                <?php echo help("전송유형을 SMS로 선택하시면 최대 80바이트까지 전송하실 수 있으며<br>LMS로 선택하시면 90바이트 이하는 SMS로, 그 이상은 1500바이트까지 LMS로 전송됩니다.<br>요금은 건당 SMS는 16원, LMS는 48원입니다."); ?>
+                <?php echo help("전송유형을 SMS로 선택하시면 최대 80바이트까지 전송하실 수 있으며<br>LMS로 선택하시면 90바이트 이하는 SMS로, 그 이상은 ".G5_ICODE_LMS_MAX_LENGTH."바이트까지 LMS로 전송됩니다.<br>요금은 건당 SMS는 16원, LMS는 48원입니다."); ?>
                 <select id="cf_sms_type" name="cf_sms_type">
                     <option value="" <?php echo get_selected($config['cf_sms_type'], ''); ?>>SMS</option>
                     <option value="LMS" <?php echo get_selected($config['cf_sms_type'], 'LMS'); ?>>LMS</option>
                 </select>
             </td>
         </tr>
-        <tr>
-            <th scope="row"><label for="cf_icode_id">아이코드 회원아이디</label></th>
+        <tr class="icode_old_version">
+            <th scope="row"><label for="cf_icode_id">아이코드 회원아이디<br>(구버전)</label></th>
             <td>
                 <?php echo help("아이코드에서 사용하시는 회원아이디를 입력합니다."); ?>
                 <input type="text" name="cf_icode_id" value="<?php echo $config['cf_icode_id']; ?>" id="cf_icode_id" class="frm_input" size="20">
             </td>
         </tr>
-        <tr>
-            <th scope="row"><label for="cf_icode_pw">아이코드 비밀번호</label></th>
+        <tr class="icode_old_version">
+            <th scope="row"><label for="cf_icode_pw">아이코드 비밀번호<br>(구버전)</label></th>
             <td>
                 <?php echo help("아이코드에서 사용하시는 비밀번호를 입력합니다."); ?>
                 <input type="password" name="cf_icode_pw" value="<?php echo $config['cf_icode_pw']; ?>" id="cf_icode_pw" class="frm_input">
             </td>
         </tr>
-        <tr>
-            <th scope="row">요금제</th>
+        <tr class="icode_old_version <?php if(!(isset($userinfo['payment']) && $userinfo['payment'])){ echo 'cf_tr_hide'; } ?>">
+            <th scope="row">요금제<br>(구버전)</th>
             <td>
                 <input type="hidden" name="cf_icode_server_ip" value="<?php echo $config['cf_icode_server_ip']; ?>">
                 <?php
@@ -1274,21 +1303,31 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                 ?>
             </td>
         </tr>
-        <tr>
-            <th scope="row">아이코드 SMS 신청<br>회원가입</th>
-            <td>
-                <a href="http://icodekorea.com/res/join_company_fix_a.php?sellid=sir2" target="_blank" class="btn_frmline">아이코드 회원가입</a>
-            </td>
-        </tr>
-         <?php if ($userinfo['payment'] == 'A') { ?>
-        <tr>
-            <th scope="row">충전 잔액</th>
+        <?php if ($userinfo['payment'] == 'A') { ?>
+        <tr class="icode_old_version">
+            <th scope="row">충전 잔액<br>(구버전)</th>
             <td>
                 <?php echo number_format($userinfo['coin']); ?> 원.
                 <a href="http://www.icodekorea.com/smsbiz/credit_card_amt.php?icode_id=<?php echo $config['cf_icode_id']; ?>&amp;icode_passwd=<?php echo $config['cf_icode_pw']; ?>" target="_blank" class="btn_frmline">충전하기</a>
             </td>
         </tr>
         <?php } ?>
+        <tr class="icode_json_version">
+            <th scope="row"><label for="cf_icode_token_key">아이코드 토큰키<br>(JSON버전)</label></th>
+            <td>
+                <?php echo help("아이코드 JSON 버전의 경우 아이코드 토큰키를 입력시 실행됩니다.<br>SMS 전송유형을 LMS로 설정시 90바이트 이내는 SMS, 90 ~ 2000 바이트는 LMS 그 이상은 절삭 되어 LMS로 발송됩니다."); ?>
+                <input type="text" name="cf_icode_token_key" value="<?php echo $config['cf_icode_token_key']; ?>" id="cf_icode_token_key" class="frm_input" size="40">
+                <?php echo help("아이코드 사이트 -> 토큰키관리 메뉴에서 생성한 토큰키를 입력합니다."); ?>
+                <br>
+                서버아이피 : <?php echo $_SERVER['SERVER_ADDR']; ?>
+            </td>
+        </tr>
+        <tr>
+            <th scope="row">아이코드 SMS 신청<br>회원가입</th>
+            <td>
+                <a href="http://icodekorea.com/res/join_company_fix_a.php?sellid=sir2" target="_blank" class="btn_frmline">아이코드 회원가입</a>
+            </td>
+        </tr>
         </tbody>
         </table>
     </div>
@@ -1427,10 +1466,14 @@ if($config['cf_cert_use']) {
 
     // kcp일 때
     if($config['cf_cert_hp'] == 'kcp') {
-        if(PHP_INT_MAX == 2147483647) // 32-bit
-            $exe = G5_KCPCERT_PATH . '/bin/ct_cli';
-        else
-            $exe = G5_KCPCERT_PATH . '/bin/ct_cli_x64';
+        if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
+            if(PHP_INT_MAX == 2147483647) // 32-bit
+                $exe = G5_KCPCERT_PATH . '/bin/ct_cli';
+            else
+                $exe = G5_KCPCERT_PATH . '/bin/ct_cli_x64';
+        } else {
+            $exe = G5_KCPCERT_PATH . '/bin/ct_cli_exe.exe';
+        }
 
         echo module_exec_check($exe, 'ct_cli');
     }

adm/config_form_update.php

@@ -26,7 +26,7 @@ if(!$_POST['cf_cert_use']) {
 
 $cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',', $_POST['cf_social_servicelist']) : '';
 
-$_POST['cf_title'] = strip_tags($_POST['cf_title']);
+$_POST['cf_title'] = strip_tags(clean_xss_attributes($_POST['cf_title']));
 
 $check_keys = array('cf_lg_mid', 'cf_lg_mert_key', 'cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret');
 
@@ -36,6 +36,8 @@ foreach( $check_keys as $key ){
     }
 }
 
+$_POST['cf_icode_server_port'] = isset($_POST['cf_icode_server_port']) ? preg_replace('/[^0-9]/', '', $_POST['cf_icode_server_port']) : '7295';
+
 $sql = " update {$g5['config_table']}
             set cf_title = '{$_POST['cf_title']}',
                 cf_admin = '{$_POST['cf_admin']}',
@@ -69,6 +71,7 @@ $sql = " update {$g5['config_table']}
                 cf_add_meta = '{$_POST['cf_add_meta']}',
                 cf_syndi_token = '{$_POST['cf_syndi_token']}',
                 cf_syndi_except = '{$_POST['cf_syndi_except']}',
+                cf_bbs_rewrite = '{$_POST['cf_bbs_rewrite']}',
                 cf_member_skin = '{$_POST['cf_member_skin']}',
                 cf_use_homepage = '{$_POST['cf_use_homepage']}',
                 cf_req_homepage = '{$_POST['cf_req_homepage']}',
@@ -142,6 +145,7 @@ $sql = " update {$g5['config_table']}
                 cf_sms_type = '{$_POST['cf_sms_type']}',
                 cf_icode_id = '{$_POST['cf_icode_id']}',
                 cf_icode_pw = '{$_POST['cf_icode_pw']}',
+                cf_icode_token_key = '{$_POST['cf_icode_token_key']}',
                 cf_icode_server_ip = '{$_POST['cf_icode_server_ip']}',
                 cf_icode_server_port = '{$_POST['cf_icode_server_port']}',
                 cf_googl_shorturl_apikey = '{$_POST['cf_googl_shorturl_apikey']}',
@@ -187,5 +191,13 @@ sql_query($sql);
 
 //sql_query(" OPTIMIZE TABLE `$g5[config_table]` ");
 
+if( isset($_POST['cf_bbs_rewrite']) ){
+    g5_delete_all_cache();
+}
+
+run_event('admin_config_form_update');
+
+update_rewrite_rules();
+
 goto_url('./config_form.php', false);
 ?>

adm/contentform.php

@@ -78,7 +78,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
         <td>
             <?php echo help('20자 이내의 영문자, 숫자, _ 만 가능합니다.'); ?>
             <input type="text" value="<?php echo $co['co_id']; ?>" name="co_id" id ="co_id" required <?php echo $readonly; ?> class="required <?php echo $readonly; ?> frm_input" size="20" maxlength="20">
-            <?php if ($w == 'u') { ?><a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=<?php echo $co_id; ?>" class="btn_frmline">내용확인</a><?php } ?>
+            <?php if ($w == 'u') { ?><a href="<?php echo get_pretty_url('content', $co_id); ?>" class="btn_frmline">내용확인</a><?php } ?>
         </td>
     </tr>
     <tr>

adm/contentformupdate.php

@@ -21,7 +21,7 @@ if ($w == "" || $w == "u")
 }
 
 $co_id = preg_replace('/[^a-z0-9_]/i', '', $co_id);
-$co_subject = strip_tags($co_subject);
+$co_subject = strip_tags(clean_xss_attributes($co_subject));
 $co_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_head, 0, 255));
 $co_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_tail, 0, 255));
 $co_tag_filter_use = isset($_POST['co_tag_filter_use']) ? (int) $_POST['co_tag_filter_use'] : 1;
@@ -71,6 +71,13 @@ if( $co_include_tail && ! is_include_path_check($co_include_tail, 1) ){
     $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
 }
 
+if( function_exists('filter_input_include_path') ){
+    $co_include_head = filter_input_include_path($co_include_head);
+    $co_include_tail = filter_input_include_path($co_include_tail);
+}
+
+$co_seo_title = exist_seo_title_recursive('content', generate_seo_title($co_subject), $g5['content_table'], $co_id);
+
 $sql_common = " co_include_head     = '$co_include_head',
                 co_include_tail     = '$co_include_tail',
                 co_html             = '$co_html',
@@ -78,6 +85,7 @@ $sql_common = " co_include_head     = '$co_include_head',
                 co_subject          = '$co_subject',
                 co_content          = '$co_content',
                 co_mobile_content   = '$co_mobile_content',
+                co_seo_title        = '$co_seo_title',
                 co_skin             = '$co_skin',
                 co_mobile_skin      = '$co_mobile_skin' ";
 
@@ -111,6 +119,8 @@ else if ($w == "d")
 if(function_exists('get_admin_captcha_by'))
     get_admin_captcha_by('remove');
 
+g5_delete_cache_by_prefix('content-'.$co_id.'-');
+
 if ($w == "" || $w == "u")
 {
     if ($_FILES['co_himg']['name'])

adm/contentlist.php

@@ -77,7 +77,7 @@ $result = sql_query($sql);
         <td class="td_left"><?php echo htmlspecialchars2($row['co_subject']); ?></td>
         <td class="td_mng td_mng_l">
             <a href="./contentform.php?w=u&amp;co_id=<?php echo $row['co_id']; ?>" class="btn btn_03"><span class="sound_only"><?php echo htmlspecialchars2($row['co_subject']); ?> </span>수정</a>
-            <a href="<?php echo G5_BBS_URL; ?>/content.php?co_id=<?php echo $row['co_id']; ?>" class="btn btn_02"><span class="sound_only"><?php echo htmlspecialchars2($row['co_subject']); ?> </span> 보기</a>
+            <a href="<?php echo get_pretty_url('content', $row['co_id']); ?>" class="btn btn_02"><span class="sound_only"><?php echo htmlspecialchars2($row['co_subject']); ?> </span> 보기</a>
             <a href="./contentformupdate.php?w=d&amp;co_id=<?php echo $row['co_id']; ?>" onclick="return delete_confirm(this);" class="btn btn_02"><span class="sound_only"><?php echo htmlspecialchars2($row['co_subject']); ?> </span>삭제</a>
         </td>
     </tr>

adm/css/admin.css

@@ -13,20 +13,21 @@ legend {position:absolute;margin:0;padding:0;font-size:0;line-height:0;text-inde
 label, input, button, select, img {vertical-align:middle}
 input, button {margin:0;padding:0;font-family:'Malgun Gothic',"맑은 고딕",AppleGothic,Dotum,"돋움", sans-serif;font-size:1em}
 button,input[type="submit"] {cursor:pointer}
-textarea, select {font-family:'Malgun Gothic',"맑은 고딕",AppleGothic,Dotum,"돋움", sans-serif;;font-size:1em}
+textarea, select {font-family:'Malgun Gothic',"맑은 고딕",AppleGothic,Dotum,"돋움", sans-serif;font-size:1em}
 select {margin:0}
 p {margin:0;padding:0;word-break:break-all}
 pre {overflow-x:scroll;font-size:1.1em}
 a:link, a:visited {color:#000;text-decoration:none}
 
 * {
-  -webkit-box-sizing: border-box;
-     -moz-box-sizing: border-box;
-          box-sizing: border-box;
+-webkit-box-sizing: border-box;
+-moz-box-sizing: border-box;
+box-sizing: border-box;
 }
 
 h2{font-size: 1.083em;font-weight: bold;margin:10px 0}
 
+#wrapper {min-height:480px}
 /* 레이아웃 */
 #hd h1 {position:absolute;font-size:0;line-height:0;overflow:hidden}
 #hd_top{position:fixed;top:0;left:0;width:100%;height:50px;background:#3f51b5;z-index:1000}
@@ -38,12 +39,12 @@ h2{font-size: 1.083em;font-weight: bold;margin:10px 0}
 #tnb{float:right;padding:10px}
 #tnb ul:after{display:block;visibility:hidden;clear:both;content:""}
 #tnb li{float:left;position:relative;margin-left:3px}
-#tnb a{color:#fff;;padding:0 10px;display:block;line-height:30px;}
+#tnb a{color:#fff;padding:0 10px;display:block;line-height:30px;}
 #tnb .tnb_service{border-radius:3px;background:#4e5eb7;color:#fff;padding:0 10px;text-align:left;height:30px;line-height:30px;}
 #tnb .tnb_service:hover{background:#5969c3}
-#tnb  button{width:100px;;border:0;border-radius:3px;background:#4e5eb7;color:#fff;padding:0 30px 0 10px;text-align:left;height:30px;position:relative;text-overflow: ellipsis;overflow: hidden;white-space: nowrap;}
-#tnb  button span{display:block;text-indent:-999px;overflow:hidden;width:30px;border-radius:3px;height:30px;position:absolute;top:0;right:0;background:url(../img/op_btn.png) 50% 50% no-repeat #5969c3}
-#tnb  button:hover {background:#5969c3}
+#tnb button{width:100px;border:0;border-radius:3px;background:#4e5eb7;color:#fff;padding:0 30px 0 10px;text-align:left;height:30px;position:relative;text-overflow: ellipsis;overflow: hidden;white-space: nowrap;}
+#tnb button span{display:block;text-indent:-999px;overflow:hidden;width:30px;border-radius:3px;height:30px;position:absolute;top:0;right:0;background:url(../img/op_btn.png) 50% 50% no-repeat #5969c3}
+#tnb button:hover {background:#5969c3}
 #tnb .tnb_mb_area{display:none;background:#5e6dc2;width:100px;position:absolute;padding:5px;margin-top:1px;}
 #tnb .tnb_mb_area a{padding:0}
 #tnb .tnb_mb_area li{float:none;}
@@ -74,9 +75,9 @@ h2{font-size: 1.083em;font-weight: bold;margin:10px 0}
 #gnb .on .btn_op.menu-900{background:url(../img/menu-4.png) 50% 50% no-repeat #fff}
 #gnb .gnb_li button:hover{background-color:#f3f3f3}
 #gnb .gnb_oparea{display:none;position:absolute;top:0;left:50px;background:#fff;height:100%;width:170px;padding:20px;border-right:1px solid #dbdbdb;
--webkit-box-shadow: 2px 0 2px  rgba(150,150,150,100.1);
-   -moz-box-shadow: 2px 0 2px  rgba(150,150,150,0.1);
-        box-shadow: 2px 0 2px  rgba(150,150,150,0.1);}
+-webkit-box-shadow: 2px 0 2px rgba(150,150,150,100.1);
+-moz-box-shadow: 2px 0 2px rgba(150,150,150,0.1);
+box-shadow: 2px 0 2px rgba(150,150,150,0.1);}
 #gnb .on .gnb_oparea{display:block}
 #gnb .gnb_oparea h3{margin-bottom:10px;line-height:18px;font-size:1.17em}
 #gnb .gnb_oparea li{line-height:28px}
@@ -180,10 +181,10 @@ a.btn_submit{background:#ff4081;color:#fff}
 .btn_add01 button {margin:0}
 
 
-.td_mng a.btn,.td_mng a{display:inline-block;height:26px;line-height:26px;border:0;;border-radius:3px;padding:0 8px;margin:1px;font-weight:normal}
-.td_mng button,.td_mng button.btn{height:26px;border:0;border-radius:3px;padding:0 8px;margin:1px;border:0;;font-weight:normal}
-.btn{height:30px;border:0;;border-radius:5px;padding:0 10px;font-weight:bold;font-size:1.09em;vertical-align:middle}
-a.btn{display:inline-block;height:30px;line-height:30px;border:0;;border-radius:5px;padding:0 10px;font-weight:bold;font-size:1.09em;;vertical-align:middle}
+.td_mng a.btn, .td_mng a{display:inline-block;height:26px;line-height:26px;border:0;border-radius:3px;padding:0 8px;margin:1px;font-weight:normal}
+.td_mng button, .td_mng button.btn{height:26px;border:0;border-radius:3px;padding:0 8px;margin:1px;font-weight:normal}
+.btn{height:30px;border:0;border-radius:5px;padding:0 10px;font-weight:bold;font-size:1.09em;vertical-align:middle}
+a.btn{display:inline-block;height:30px;line-height:30px;border:0;border-radius:5px;padding:0 10px;font-weight:bold;font-size:1.09em;vertical-align:middle}
 .btn_submit{background:#ff4081;color:#fff}
 a.btn_submit{background:#ff4081;color:#fff}
 .btn_submit:hover{background:#ff1464}
@@ -194,19 +195,21 @@ a.btn_submit{background:#ff4081;color:#fff}
 .btn_03,a.btn_03{background:#3f51b5;color:#fff;}
 
 .btn_frmline{display:inline-block;background:#9eacc6;color:#fff;height:35px;border:0;border-radius:5px;padding:0 10px}
-a.btn_frmline{display:inline-block;background:#9eacc6;color:#fff;height:35px;line-height:33px;border-radius:5px;padding:0 10px;text-decoration:none  !important}
+a.btn_frmline{display:inline-block;background:#9eacc6;color:#fff;height:35px;line-height:33px;border-radius:5px;padding:0 10px;text-decoration:none !important}
 .btn_ov01{display:inline-block;line-height:30px;height:30px;font-size:0.92em;vertical-align:top}
-.btn_ov01:after{display:block;visibility:hidden;clear :both;content:""}
 .btn_ov01 .ov_txt{float:left;background:#9eacc6;color:#fff;border-radius:5px 0 0 5px;padding:0 5px}
 .btn_ov01 .ov_num{float:left;background:#ededed;color:#666;border-radius:0 5px 5px 0;padding:0 5px}
 a.btn_ov02,a.ov_listall{display:inline-block;line-height:30px;height:30px;font-size:0.92em;background:#565e8c;color:#fff;vertical-align:top;border-radius:5px;padding:0 7px }
 a.btn_ov02:hover,a.ov_listall:hover{background:#3f51b5}
 
+.local_ov01.local_ov [data-tooltip-text]:hover {position:relative}
+.local_ov01.local_ov [data-tooltip-text]:hover:after{line-height:20px;background-color:#000;background-color:rgba(0,0,0,0.8);-webkit-box-shadow:0 0 3px 1px rgba(50,50,50,0.4);-moz-box-shadow:0 0 3px 1px rgba(50,50,50,0.4);box-shadow:0 0 3px 1px rgba(50,50,50,0.4);-webkit-border-radius:5px;-moz-border-radius:5px;border-radius:5px;color:#FFF;font-size:11px;content:attr(data-tooltip-text);white-space: pre;margin-bottom:10px;top:130%;left:0;padding:7px 12px;position:absolute;max-width:500px;word-wrap:break-word;z-index:9999}
+
 /*form*/
 .sound_only {display:inline-block !important;position:absolute;top:0;left:0;margin:0 !important;padding:0 !important;width:1px !important;height:1px !important;font-size:0;line-height:0;border:0 !important;overflow:hidden !important}
 .frm_input{height:35px;line-height:32px;border:1px solid #d5d5d5;}
 .frm_input_full{width:100%}
-.required{background:url('../img/wrest.gif')  top right no-repeat #fff !important}
+.required{background:url('../img/wrest.gif') top right no-repeat #fff !important}
 select{height:35px;line-height:32px;border:1px solid #d5d5d5;}
 textarea{width:100%;border:1px solid #d5d5d5;min-height:80px}
 legend {position:absolute;width:0;height:0;font-size:0;line-height:0;text-indent:-9999em;border:0;overflow:hidden}
@@ -231,7 +234,7 @@ legend {position:absolute;width:0;height:0;font-size:0;line-height:0;text-indent
 .color_st03{background:#b668d0;color:#fff;display:inline-block;padding:0 3px;font-size:0.92em;line-height:18px}
 .color_st04{background:#ffa700;color:#fff;display:inline-block;padding:0 3px;font-size:0.92em;line-height:18px}
 .color_st05{background:#688fef;color:#fff;display:inline-block;padding:0 3px;font-size:0.92em;line-height:18px}
-.color_st06{;color:#ff0000;border:1px solid #ff0000;display:inline-block;padding:0 3px;font-size:0.92em;line-height:18px}
+.color_st06{color:#ff0000;border:1px solid #ff0000;display:inline-block;padding:0 3px;font-size:0.92em;line-height:18px}
 
 /* 폼 안내글 */
 .frm_info {display:block;padding:0 0 5px;color:#5b747e}
@@ -241,7 +244,7 @@ legend {position:absolute;width:0;height:0;font-size:0;line-height:0;text-indent
 .anchor:after {display:block;visibility:hidden;clear:both;content:""}
 .anchor li{float:left;margin-left:-1px;list-style:none}
 .anchor a {display:inline-block;padding:5px 10px;border:1px solid #c8ced1;background:#d6dde1;text-decoration:none}
-.anchor  .selected{background:#3f51b5}
+.anchor .selected{background:#3f51b5}
 
 
 
@@ -260,22 +263,22 @@ border-bottom: 5px solid black;}
 
 /* 페이지 내 검색 */
 .local_sch{}
-.local_sch:after ,.local_sch div:after{display:block;visibility:hidden;clear:both;content:""}
-.local_sch .btn_sch{width:30px;height:30px;border:0;padding:0;float:left;background:url(../img/sch_btn.png) no-repeat 50% 50%;border:1px solid #dcdcdc;border-left:0;text-indent:-999px;overflow:hidden}
-.local_sch .btn_sch2{width:35px;height:35px;border:0;padding:0;background:url(../img/sch_btn.png) no-repeat 50% 50% #eee;border:1px solid #dcdcdc;text-indent:-999px;overflow:hidden}
+.local_sch:after, .local_sch div:after{display:block;visibility:hidden;clear:both;content:""}
+.local_sch .btn_sch{width:30px;height:30px;border:1px solid #dcdcdc;border-left:0;padding:0;float:left;background:url(../img/sch_btn.png) no-repeat 50% 50%;text-indent:-999px;overflow:hidden}
+.local_sch .btn_sch2{width:35px;height:35px;border:1px solid #dcdcdc;padding:0;background:url(../img/sch_btn.png) no-repeat 50% 50% #eee;text-indent:-999px;overflow:hidden}
 
-.local_sch .sch_input{height:30px;border:1px solid #dcdcdc;border-right:0;;padding:0 5px;float:left;}
+.local_sch .sch_input{height:30px;border:1px solid #dcdcdc;border-right:0;padding:0 5px;float:left;}
 .local_sch select{height:30px;margin-right:3px;border:1px solid #dcdcdc}
 .local_sch01{margin: 10px 0;}
 .local_sch02{}
 .local_sch01 .frm_input{height:30px;border:1px solid #dcdcdc;padding:0 5px;}
-.local_sch01 .btn_submit{width:30px;height:30px;border:0;padding:0;background:url(../img/sch_btn.png) no-repeat 50% 50% #eee;border:1px solid #dcdcdc;text-indent:-999px;overflow:hidden}
-.local_sch03{;padding:5px 15px;background:#e9ebf9;margin:10px 0}
+.local_sch01 .btn_submit{width:30px;height:30px;padding:0;background:url(../img/sch_btn.png) no-repeat 50% 50% #eee;border:1px solid #dcdcdc;text-indent:-999px;overflow:hidden}
+.local_sch03{padding:5px 15px;background:#e9ebf9;margin:10px 0}
 .local_sch div{margin:5px 0;}
 .local_sch03 strong{display:inline-block;width:70px;}
-.local_sch03  label{margin-right:5px;display:inline-block}
+.local_sch03 label{margin-right:5px;display:inline-block}
 .local_sch03 button{height:30px;padding:0 5px;border:0;background:#9eacc6;color:#fff;}
-.local_sch03 .btn_submit{height:30px;padding:0 5px;border:0;;color:#fff;}
+.local_sch03 .btn_submit{height:30px;padding:0 5px;border:0;color:#fff;}
 .local_sch03 .frm_input{height:30px;border:1px solid #dcdcdc;padding:0 5px;}
 /* 페이지 내 실행 */
 .local_cmd {min-width:960px}
@@ -302,7 +305,7 @@ border-bottom: 5px solid black;}
 /* 페이지 내 카운트 */
 .local_ov {min-width:960px}
 
-.local_ov01 {position:relative;;margin: 10px 0;}
+.local_ov01 {position:relative;margin: 10px 0;}
 .local_ov01 .ov_a {display:inline-block;margin:0 0 0 5px;padding:0 0 0 10px;border-left:1px solid #ccc;color:#ff3061}
 
 
@@ -515,8 +518,24 @@ td.td_grpset {width:160px;border-left:1px solid #e9ecee;text-align:center}
 /* 환경설정 */
 .cf_cert_hide {display:none}
 
+.server_config_views {margin-bottom:10px}
+.rules_label {margin-left:5px;vertical-align:middle}
+
+.is_rewrite .connect-close {position:absolute;top:10px;right:10px;margin:0;padding:0;width:30px;height:30px;border:0;background:transparent;color:#383838;cursor:pointer;font-size:15px}
+.is_rewrite .connect-close:hover {color:#ff5191}
+.is_rewrite .connect-close .fa {margin:0 0 0 1px}
+.is_rewrite .connect-close .txt {position:absolute;line-height:0;font-size:0;overflow:hidden}
+.is_rewrite textarea{width:99%;min-height:260px}
+.is_rewrite .copy_title{margin-top:15px;margin-bottom:10px;font-weight:bold;text-align:left}
+.is_rewrite .info-success{color:#155724}
+.is_rewrite .info-warning{color:#856404}
+
+.icode_old_version th{background-color:#FFFCED}
+.icode_json_version th{background-color:#F6F1FF}
+.cf_tr_hide {display:none}
+
 /* 관리권한설정 */
-#add_admin fieldset {margin-top:20px}
+#add_admin fieldset {margin-top:20px;overflow:auto;padding:2px 6px;line-height:1.4;resize:vertical}
 
 /* 메일 테스트 */
 
@@ -607,7 +626,7 @@ td.td_grpset {width:160px;border-left:1px solid #e9ecee;text-align:center}
 -moz-box-shadow: 2px 2px 3px 0px rgba(0,0,0,0.2);
 box-shadow: 2px 2px 3px 0px rgba(0,0,0,0.2);}
 .sv_wrap .sv:before{content: "";position: absolute;top: -6px;left: 15px;width: 0;height: 0;border-style: solid;border-width: 0 6px 6px 6px;border-color: transparent transparent #333 transparent;}
-.sv_wrap .sv a {display:inline-block;margin:0;padding:0  10px;line-height:30px;width:100px;font-weight:normal;color:#bbb }
+.sv_wrap .sv a {display:inline-block;margin:0;padding:0 10px;line-height:30px;width:100px;font-weight:normal;color:#bbb }
 .sv_wrap .sv a:hover{background:#000;color:#fff}
 .sv_member{color:#333}
 .sv_on {display:block !important;position:absolute;top:23px;left:0px;width:auto;height:auto}
@@ -691,15 +710,15 @@ box-shadow: 2px 2px 3px 0px rgba(0,0,0,0.2);}
 /* 캡챠 */
 #captcha {display:inline-block;position:relative}
 #captcha legend {position:absolute;margin:0;padding:0;font-size:0;line-height:0;text-indent:-9999em;overflow:hidden;}
-#captcha #captcha_img {;height:40px;border:1px solid #898989;vertical-align:top;padding:0;margin:0}
-#captcha #captcha_mp3 {;margin:0;padding:0;width:40px;height:40px;border:0;background:transparent;vertical-align:middle;overflow:hidden;cursor:pointer;background:url('../../img/captcha2.png') no-repeat;text-indent:-999px;border-radius:3px}
-#captcha #captcha_reload {margin:0;padding:0;width:40px;height:40px;border:0;background:transparent;vertical-align:middle;overflow:hidden;cursor:pointer;background:url('../../img/captcha2.png') no-repeat  0 -40px;text-indent:-999px;border-radius:3px}
+#captcha #captcha_img {height:40px;border:1px solid #898989;vertical-align:top;padding:0;margin:0}
+#captcha #captcha_mp3 {margin:0;padding:0;width:40px;height:40px;border:0;background:transparent;vertical-align:middle;overflow:hidden;cursor:pointer;background:url('../../img/captcha2.png') no-repeat;text-indent:-999px;border-radius:3px}
+#captcha #captcha_reload {margin:0;padding:0;width:40px;height:40px;border:0;background:transparent;vertical-align:middle;overflow:hidden;cursor:pointer;background:url('../../img/captcha2.png') no-repeat 0 -40px;text-indent:-999px;border-radius:3px}
 #captcha #captcha_key {margin:0 0 0 3px;padding:0 5px;width:90px;height:40px;border:1px solid #ccc;background:#fff;font-size:1.333em;font-weight:bold;text-align:center;border-radius:3px;vertical-align:top}
 #captcha #captcha_info {display:block;margin:5px 0 0;font-size:0.95em;letter-spacing:-0.1em}
 
 /*테마*/
 .theme_p{margin:0 0 10px }
-#theme_list{padding:0;margin:0;list-style:none;  width: 1000px;position:relative}
+#theme_list{padding:0;margin:0;list-style:none; width: 1000px;position:relative}
 #theme_list:after{display:block;visibility:hidden;clear:both;content:""}
 #theme_list li{margin:10px 10px 10px 0;float:left}
 #theme_list li:after{display:block;visibility:hidden;clear:both;content:""}
@@ -707,34 +726,34 @@ box-shadow: 2px 2px 3px 0px rgba(0,0,0,0.2);}
 #theme_list li .tmli_if>img{width:300px;height:225px;}
 #theme_list li .tmli_if:hover>img{-ms-filter:"progid:DXImageTransform.Microsoft.Alpha(Opacity=50)";filter: alpha(opacity=50);-moz-opacity:0.5;-khtml-opacity: 0.5;opacity: 0.5;}
 #theme_list li .tmli_tit{position:relative; border-top: 1px solid #d1dee2; background: #e5ecef;}
-#theme_list li .tmli_tit p{height:40px;line-height:40px;padding:0 10px 0;font-weight:bold;text-overflow: ellipsis;  overflow: hidden;  white-space: nowrap;}
+#theme_list li .tmli_tit p{height:40px;line-height:40px;padding:0 10px 0;font-weight:bold;text-overflow: ellipsis; overflow: hidden; white-space: nowrap;}
 #theme_list li .tmli_tit button.tmli_dt{position:absolute;top:8px;right:10px;padding:5px;background:#111;color:#fff;display:none;border:none}
 #theme_list li .tmli_if:hover button.tmli_dt{display:block}
 #theme_list li .theme_sl{float:left;border:none;margin-top:5px;padding:0 5px;height:26px;background:#999;color:#fff}
 #theme_list li .theme_sl:hover{background:#ff3061}
 #theme_list li .theme_deactive{margin-left:4px}
 #theme_list li .theme_sl_use{background:#ff3061;line-height:26px}
-#theme_list li .theme_pr{float:right;margin-top:5px;padding:0 5px;height:26px;line-height:24px;  border: 1px solid #ccc;  background: #fafafa; }
-#theme_list li .theme_preview{  float: right;  margin-top: 5px; padding:0 5px;height:26px; border: 1px solid #ccc;  background: #fafafa; margin-right:3px}
+#theme_list li .theme_pr{float:right;margin-top:5px;padding:0 5px;height:26px;line-height:24px; border: 1px solid #ccc; background: #fafafa; }
+#theme_list li .theme_preview{ float: right; margin-top: 5px; padding:0 5px;height:26px; border: 1px solid #ccc; background: #fafafa; margin-right:3px}
 
 
 #theme_detail{position:fixed;top:50%;height:540px;width:900px;margin-top:-271px;background:#fff;background:#f3f3f3;border:1px solid #000;
--webkit-box-shadow: 1px 2px 5px  rgba(150,150,150,100.5);
-   -moz-box-shadow: 1px 2px 5px  rgba(150,150,150,0.5);
-        box-shadow: 1px 2px 5px  rgba(150,150,150,0.5);z-index:1000}
+-webkit-box-shadow: 1px 2px 5px rgba(150,150,150,100.5);
+-moz-box-shadow: 1px 2px 5px rgba(150,150,150,0.5);
+box-shadow: 1px 2px 5px rgba(150,150,150,0.5);z-index:1000}
 #theme_detail:after{display:block;visibility:hidden;clear:both;content:""}
 #theme_detail h2{font-size:1.25em;background:#fff;padding:0 15px;line-height:40px;border-bottom:1px solid #d8d8d8;margin:0}
 .theme_dt_img{float:left;padding:20px}
 .theme_dt_img img{border:1px solid #aaa;}
 .theme_dt_if{float:left;width:235px;padding:20px 0}
-.theme_dt_if table{width:100%;border-collapse:collapse;;margin:15px 0 0 ;font-size:0.92em}
+.theme_dt_if table{width:100%;border-collapse:collapse;margin:15px 0 0 ;font-size:0.92em}
 .theme_dt_if table th{padding:5px;background:#fff;border-bottom:1px solid #f3f3f3;vertical-align:top;color:#3f51b5}
 .theme_dt_if table td{padding:5px;background:#fff;border-bottom:1px solid #f3f3f3;line-height:1.56em}
 .theme_dt_if table td a{text-decoration:underline}
 .theme_dt_if p{line-height:1.5em}
 .if_p_bg{display:inline-block;width:20px;height:1px ;background:#000;margin:30px 0 10px}
 #theme_detail .theme_dt_btn{position:absolute;top:0px;right:0px;background:#fff;}
-#theme_detail .theme_dt_btn .close_btn{background:url('../img/close.png') 50% 50% no-repeat;width:40px;height:40px;overflow:hidden;border:0;text-indent:-99999px;border-left:1px solid #d8d8d8}
+#theme_detail .theme_dt_btn .close_btn{border:0;border-left:1px solid #d8d8d8;background:url('../img/close.png') 50% 50% no-repeat;width:40px;height:40px;overflow:hidden;text-indent:-99999px}
 
 #theme_detail .theme_dt_btn .close_btn:hover{background-color:#eceffc}
 #theme_detail .theme_dt_btn .btn_03{line-height:28px;display:inline-block;vertical-align:top;margin-top:6px;padding:0 6px;border-radius:5px}

adm/dbupgrade.php

@@ -74,6 +74,111 @@ if( isset($g5['social_profile_table']) && !sql_query(" DESC {$g5['social_profile
     $is_check = true;
 }
 
+// 게시판 짧은 주소
+$sql = " select bo_table from {$g5['board_table']} ";
+$result = sql_query($sql);
+
+while ($row = sql_fetch_array($result)) {
+    $write_table = $g5['write_prefix'] . $row['bo_table']; // 게시판 테이블 전체이름
+
+    $sql = " SHOW COLUMNS FROM {$write_table} LIKE 'wr_seo_title' ";
+    $row = sql_fetch($sql);
+    
+    if( !$row ){
+        sql_query("ALTER TABLE `{$write_table}`
+                    ADD `wr_seo_title` varchar(200) NOT NULL DEFAULT '' AFTER `wr_content`,
+                    ADD INDEX `wr_seo_title` (`wr_seo_title`);
+        ", false);
+
+        $is_check = true;
+    }
+}
+
+// 내용 관리 짧은 주소
+$sql = " SHOW COLUMNS FROM `{$g5['content_table']}` LIKE 'co_seo_title' ";
+$row = sql_fetch($sql);
+
+if( !$row ){
+    sql_query("ALTER TABLE `{$g5['content_table']}`
+                ADD `co_seo_title` varchar(200) NOT NULL DEFAULT '' AFTER `co_content`,
+                ADD INDEX `co_seo_title` (`co_seo_title`);
+    ", false);
+
+    $is_check = true;
+}
+
+$sql = "select * from {$g5['content_table']} limit 100 ";
+$result = sql_query($sql);
+
+while ($row = sql_fetch_array($result)) {
+
+    if( ! $row['co_seo_title']){
+        
+        $co_seo_title = exist_seo_title_recursive('content', generate_seo_title($row['co_subject']), $g5['content_table'], $row['co_id']);
+        
+        $sql = " update {$g5['content_table']}
+                    set co_seo_title = '$co_seo_title'
+                  where co_id = '{$row['co_id']}' ";
+        sql_query($sql);
+
+    }
+}
+
+// 메모 테이블
+$sql = " SHOW COLUMNS FROM `{$g5['memo_table']}` LIKE 'me_send_id' ";
+$row = sql_fetch($sql);
+
+if( !$row ){
+    sql_query("ALTER TABLE `{$g5['memo_table']}`
+                ADD `me_send_id` INT(11) NOT NULL DEFAULT '0',
+                ADD `me_type` ENUM('send','recv') NOT NULL DEFAULT 'recv',
+                ADD `me_send_ip` VARCHAR(100) NOT NULL DEFAULT '',
+                CHANGE COLUMN `me_id` `me_id` INT(11) NOT NULL AUTO_INCREMENT;
+    ", false);
+
+    $is_check = true;
+}
+
+// 읽지 않은 메모 수 칼럼
+if(!isset($member['mb_memo_cnt'])) {
+    sql_query(" ALTER TABLE `{$g5['member_table']}`
+                ADD `mb_memo_cnt` int(11) NOT NULL DEFAULT '0' AFTER `mb_memo_call`", true);
+
+    $is_check = true;
+}
+
+// 스크랩 읽은 수 추가
+if(!isset($member['mb_scrap_cnt'])) {
+    sql_query(" ALTER TABLE `{$g5['member_table']}`
+                ADD `mb_scrap_cnt` int(11) NOT NULL DEFAULT '0' AFTER `mb_memo_cnt`", true);
+
+	$is_check = true;
+}
+
+// 짧은 URL 주소를 사용 여부 필드 추가
+if (!isset($config['cf_bbs_rewrite'])) {
+    sql_query(" ALTER TABLE `{$g5['config_table']}`
+                    ADD `cf_bbs_rewrite` tinyint(4) NOT NULL DEFAULT '0' AFTER `cf_link_target` ", true);
+
+	$is_check = true;
+}
+
+// 파일테이블에 추가 칼럼
+
+$sql = " SHOW COLUMNS FROM `{$g5['board_file_table']}` LIKE 'bf_fileurl' ";
+$row = sql_fetch($sql);
+
+if( !$row ) {
+    sql_query(" ALTER TABLE `{$g5['board_file_table']}` 
+                ADD COLUMN `bf_fileurl` VARCHAR(255) NOT NULL DEFAULT '' AFTER `bf_content`,
+                ADD COLUMN `bf_thumburl` VARCHAR(255) NOT NULL DEFAULT '' AFTER `bf_fileurl`,
+                ADD COLUMN `bf_storage` VARCHAR(50) NOT NULL DEFAULT '' AFTER `bf_thumburl`", true);
+
+    $is_check = true;
+}
+
+$is_check = run_replace('admin_dbupgrade', $is_check);
+
 $db_upgrade_msg = $is_check ? 'DB 업그레이드가 완료되었습니다.' : '더 이상 업그레이드 할 내용이 없습니다.<br>현재 DB 업그레이드가 완료된 상태입니다.';
 ?>
 

adm/faqlist.php

@@ -68,15 +68,17 @@ $result = sql_query($sql);
         $num = $i + 1;
 
         $bg = 'bg'.($i%2);
+
+        $fa_subject = conv_content($row['fa_subject'], 1);
     ?>
 
     <tr class="<?php echo $bg; ?>">
         <td class="td_num"><?php echo $num; ?></td>
-        <td class="td_left"><?php echo stripslashes($row['fa_subject']); ?></td>
+        <td class="td_left"><?php echo $fa_subject; ?></td>
         <td class="td_num"><?php echo $row['fa_order']; ?></td>
         <td class="td_mng td_mng_m">
-            <a href="./faqform.php?w=u&amp;fm_id=<?php echo $row['fm_id']; ?>&amp;fa_id=<?php echo $row['fa_id']; ?>" class="btn btn_03"><span class="sound_only"><?php echo stripslashes($row['fa_subject']); ?> </span>수정</a>
-            <a href="./faqformupdate.php?w=d&amp;fm_id=<?php echo $row['fm_id']; ?>&amp;fa_id=<?php echo $row['fa_id']; ?>" onclick="return delete_confirm(this);" class="btn btn_02"><span class="sound_only"><?php echo stripslashes($row['fa_subject']); ?> </span>삭제</a>
+            <a href="./faqform.php?w=u&amp;fm_id=<?php echo $row['fm_id']; ?>&amp;fa_id=<?php echo $row['fa_id']; ?>" class="btn btn_03"><span class="sound_only"><?php echo $fa_subject; ?> </span>수정</a>
+            <a href="./faqformupdate.php?w=d&amp;fm_id=<?php echo $row['fm_id']; ?>&amp;fa_id=<?php echo $row['fa_id']; ?>" onclick="return delete_confirm(this);" class="btn btn_02"><span class="sound_only"><?php echo $fa_subject; ?> </span>삭제</a>
         </td>
     </tr>
 

adm/faqmasterformupdate.php

@@ -18,7 +18,7 @@ check_admin_token();
 if ($fm_himg_del)  @unlink(G5_DATA_PATH."/faq/{$fm_id}_h");
 if ($fm_timg_del)  @unlink(G5_DATA_PATH."/faq/{$fm_id}_t");
 
-$fm_subject = strip_tags($fm_subject);
+$fm_subject = strip_tags(clean_xss_attributes($fm_subject));
 
 $sql_common = " set fm_subject = '$fm_subject',
                     fm_head_html = '$fm_head_html',

adm/index.php

@@ -212,8 +212,8 @@ $colspan = 5;
 
         <tr>
             <td class="td_category"><a href="<?php echo G5_BBS_URL ?>/new.php?gr_id=<?php echo $row['gr_id'] ?>"><?php echo cut_str($row['gr_subject'],10) ?></a></td>
-            <td class="td_category"><a href="<?php echo G5_BBS_URL ?>/board.php?bo_table=<?php echo $row['bo_table'] ?>"><?php echo cut_str($row['bo_subject'],20) ?></a></td>
-            <td><a href="<?php echo G5_BBS_URL ?>/board.php?bo_table=<?php echo $row['bo_table'] ?>&amp;wr_id=<?php echo $row2['wr_id'] ?><?php echo $comment_link ?>"><?php echo $comment ?><?php echo conv_subject($row2['wr_subject'], 100) ?></a></td>
+            <td class="td_category"><a href="<?php echo get_pretty_url($row['bo_table']) ?>"><?php echo cut_str($row['bo_subject'],20) ?></a></td>
+            <td><a href="<?php echo get_pretty_url($row['bo_table'], $row2['wr_id']); ?><?php echo $comment_link ?>"><?php echo $comment ?><?php echo conv_subject($row2['wr_subject'], 100) ?></a></td>
             <td class="td_mbname"><div><?php echo $name ?></div></td>
             <td class="td_datetime"><?php echo $datetime ?></td>
         </tr>
@@ -283,7 +283,7 @@ $colspan = 7;
             $link1 = $link2 = "";
             if (!preg_match("/^\@/", $row['po_rel_table']) && $row['po_rel_table'])
             {
-                $link1 = '<a href="'.G5_BBS_URL.'/board.php?bo_table='.$row['po_rel_table'].'&amp;wr_id='.$row['po_rel_id'].'" target="_blank">';
+                $link1 = '<a href="'.get_pretty_url($row['po_rel_table'], $row['po_rel_id']).'" target="_blank">';
                 $link2 = '</a>';
             }
         ?>

adm/mail_form.php

@@ -42,7 +42,7 @@ include_once('./admin.head.php');
     <tbody>
     <tr>
         <th scope="row"><label for="ma_subject">메일 제목<strong class="sound_only">필수</strong></label></th>
-        <td><input type="text" name="ma_subject" value="<?php echo $ma['ma_subject'] ?>" id="ma_subject" required class="required frm_input" size="100"></td>
+        <td><input type="text" name="ma_subject" value="<?php echo get_sanitize_input($ma['ma_subject']); ?>" id="ma_subject" required class="required frm_input" size="100"></td>
     </tr>
     <tr>
         <th scope="row"><label for="ma_content">메일 내용<strong class="sound_only">필수</strong></label></th>

adm/mail_update.php

@@ -10,7 +10,7 @@ auth_check($auth[$sub_menu], 'w');
 check_admin_token();
 
 $ma_id = isset($_POST['ma_id']) ? (int) $_POST['ma_id'] : 0;
-$ma_subject = isset($_POST['ma_subject']) ? strip_tags($_POST['ma_subject']) : '';
+$ma_subject = isset($_POST['ma_subject']) ? strip_tags(clean_xss_attributes($_POST['ma_subject'])) : '';
 
 if ($w == '')
 {

adm/member_form.php

@@ -240,9 +240,9 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
             <input type="file" name="mb_icon" id="mb_icon">
             <?php
             $mb_dir = substr($mb['mb_id'],0,2);
-            $icon_file = G5_DATA_PATH.'/member/'.$mb_dir.'/'.$mb['mb_id'].'.gif';
+            $icon_file = G5_DATA_PATH.'/member/'.$mb_dir.'/'.get_mb_icon_name($mb['mb_id']).'.gif';
             if (file_exists($icon_file)) {
-                $icon_url = G5_DATA_URL.'/member/'.$mb_dir.'/'.$mb['mb_id'].'.gif';
+                $icon_url = str_replace(G5_DATA_PATH, G5_DATA_URL, $icon_file);
                 echo '<img src="'.$icon_url.'" alt="">';
                 echo '<input type="checkbox" id="del_mb_icon" name="del_mb_icon" value="1">삭제';
             }
@@ -256,9 +256,9 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
             <input type="file" name="mb_img" id="mb_img">
             <?php
             $mb_dir = substr($mb['mb_id'],0,2);
-            $icon_file = G5_DATA_PATH.'/member_image/'.$mb_dir.'/'.$mb['mb_id'].'.gif';
+            $icon_file = G5_DATA_PATH.'/member_image/'.$mb_dir.'/'.get_mb_icon_name($mb['mb_id']).'.gif';
             if (file_exists($icon_file)) {
-                $icon_url = G5_DATA_URL.'/member_image/'.$mb_dir.'/'.$mb['mb_id'].'.gif';
+                $icon_url = str_replace(G5_DATA_PATH, G5_DATA_URL, $icon_file);
                 echo '<img src="'.$icon_url.'" alt="">';
                 echo '<input type="checkbox" id="del_mb_img" name="del_mb_img" value="1">삭제';
             }
@@ -441,6 +441,8 @@ this.form.mb_intercept_date.value=this.form.mb_intercept_date.defaultValue; }">
     <?php
         }   //end if
     }   //end if
+
+    run_event('admin_member_form_add', $mb, $w, 'table');
     ?>
 
     <?php for ($i=1; $i<=10; $i++) { ?>
@@ -476,7 +478,8 @@ function fmember_submit(f)
     return true;
 }
 </script>
-
 <?php
+run_event('admin_member_form_after', $mb, $w);
+
 include_once('./admin.tail.php');
 ?>

adm/member_form_update.php

@@ -143,13 +143,13 @@ else
 if( $w == '' || $w == 'u' ){
 
     $mb_dir = substr($mb_id,0,2);
+    $mb_icon_img = get_mb_icon_name($mb_id).'.gif';
 
     // 회원 아이콘 삭제
     if ($del_mb_icon)
-        @unlink(G5_DATA_PATH.'/member/'.$mb_dir.'/'.$mb_id.'.gif');
+        @unlink(G5_DATA_PATH.'/member/'.$mb_dir.'/'.$mb_icon_img);
 
     $image_regex = "/(\.(gif|jpe?g|png))$/i";
-    $mb_icon_img = $mb_id.'.gif';
 
     // 아이콘 업로드
     if (isset($_FILES['mb_icon']) && is_uploaded_file($_FILES['mb_icon']['tmp_name'])) {
@@ -236,5 +236,7 @@ if( $w == '' || $w == 'u' ){
     }
 }
 
+run_event('admin_member_form_update', $w, $mb_id);
+
 goto_url('./member_form.php?'.$qstr.'&w=u&mb_id='.$mb_id, false);
 ?>

adm/member_list.php

@@ -70,8 +70,8 @@ $colspan = 16;
 <div class="local_ov01 local_ov">
     <?php echo $listall ?>
     <span class="btn_ov01"><span class="ov_txt">총회원수 </span><span class="ov_num"> <?php echo number_format($total_count) ?>명 </span></span>
-    <a href="?sst=mb_intercept_date&amp;sod=desc&amp;sfl=<?php echo $sfl ?>&amp;stx=<?php echo $stx ?>" class="btn_ov01"> <span class="ov_txt">차단 </span><span class="ov_num"><?php echo number_format($intercept_count) ?>명</span></a>
-    <a href="?sst=mb_leave_date&amp;sod=desc&amp;sfl=<?php echo $sfl ?>&amp;stx=<?php echo $stx ?>" class="btn_ov01"> <span class="ov_txt">탈퇴  </span><span class="ov_num"><?php echo number_format($leave_count) ?>명</span></a>
+    <a href="?sst=mb_intercept_date&amp;sod=desc&amp;sfl=<?php echo $sfl ?>&amp;stx=<?php echo $stx ?>" class="btn_ov01" data-tooltip-text="차단된 순으로 정렬합니다.&#xa;전체 데이터를 출력합니다."> <span class="ov_txt">차단 </span><span class="ov_num"><?php echo number_format($intercept_count) ?>명</span></a>
+    <a href="?sst=mb_leave_date&amp;sod=desc&amp;sfl=<?php echo $sfl ?>&amp;stx=<?php echo $stx ?>" class="btn_ov01" data-tooltip-text="탈퇴된 순으로 정렬합니다.&#xa;전체 데이터를 출력합니다."> <span class="ov_txt">탈퇴  </span><span class="ov_num"><?php echo number_format($leave_count) ?>명</span></a>
 </div>
 
 <form id="fsearch" name="fsearch" class="local_sch01 local_sch" method="get">

adm/member_list_update.php

@@ -12,6 +12,8 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
+$mb_datas = array();
+
 if ($_POST['act_button'] == "선택수정") {
 
     for ($i=0; $i<count($_POST['chk']); $i++)
@@ -19,7 +21,7 @@ if ($_POST['act_button'] == "선택수정") {
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
 
-        $mb = get_member($_POST['mb_id'][$k]);
+        $mb_datas[] = $mb = get_member($_POST['mb_id'][$k]);
 
         if (!$mb['mb_id']) {
             $msg .= $mb['mb_id'].' : 회원자료가 존재하지 않습니다.\\n';
@@ -53,7 +55,7 @@ if ($_POST['act_button'] == "선택수정") {
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
 
-        $mb = get_member($_POST['mb_id'][$k]);
+        $mb_datas[] = $mb = get_member($_POST['mb_id'][$k]);
 
         if (!$mb['mb_id']) {
             $msg .= $mb['mb_id'].' : 회원자료가 존재하지 않습니다.\\n';
@@ -74,5 +76,7 @@ if ($msg)
     //echo '<script> alert("'.$msg.'"); </script>';
     alert($msg);
 
+run_event('admin_member_list_update', $_POST['act_button'], $mb_datas);
+
 goto_url('./member_list.php?'.$qstr);
 ?>

adm/menu_form.php

@@ -159,11 +159,11 @@ function add_menu_list(name, link, code)
     list += "<option value=\"0\">사용안함</option>";
     list += "</select>";
     list += "</td>";
-    list += "<td class=\"td_mngsmall\">";
+    list += "<td class=\"td_mng\">";
     <?php if($new == 'new') { ?>
-    list += "<button type=\"button\" class=\"btn_add_submenu btn\">추가</button>";
+    list += "<button type=\"button\" class=\"btn_add_submenu btn_03\">추가</button>\n";
     <?php } ?>
-    list += "<button type=\"button\" class=\"btn_del_menu btn\">삭제</button>";
+    list += "<button type=\"button\" class=\"btn_del_menu btn_02\">삭제</button>";
     list += "</td>";
     list += "</tr>";
 

adm/menu_form_search.php

@@ -55,10 +55,10 @@ if($sql) {
                 $link = G5_BBS_URL.'/group.php?gr_id='.$row['id'];
                 break;
             case 'board':
-                $link = G5_BBS_URL.'/board.php?bo_table='.$row['id'];
+                $link = get_pretty_url($row['id']);
                 break;
             case 'content':
-                $link = G5_BBS_URL.'/content.php?co_id='.$row['id'];
+                $link = get_pretty_url(G5_CONTENT_DIR, $row['id']);
                 break;
             default:
                 $link = '';

adm/menu_list_update.php

@@ -21,11 +21,11 @@ for ($i=0; $i<$count; $i++)
 {
     $_POST = array_map_deep('trim', $_POST);
     
-    $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags($_POST['me_link'][$i], 1) : '';
+    $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags(clean_xss_attributes($_POST['me_link'][$i], 1)) : '';
 
     $code    = is_array($_POST['code']) ? strip_tags($_POST['code'][$i]) : '';
     $me_name = is_array($_POST['me_name']) ? strip_tags($_POST['me_name'][$i]) : '';
-    $me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : strip_tags($_POST['me_link'][$i]);
+    $me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : strip_tags(clean_xss_attributes($_POST['me_link'][$i]));
     
     if(!$code || !$me_name || !$me_link)
         continue;
@@ -68,5 +68,7 @@ for ($i=0; $i<$count; $i++)
     sql_query($sql);
 }
 
+run_event('admin_menu_list_update');
+
 goto_url('./menu_list.php');
 ?>

adm/newwinformupdate.php

@@ -12,7 +12,7 @@ else
 
 check_admin_token();
 
-$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';
+$nw_subject = isset($_POST['nw_subject']) ? strip_tags(clean_xss_attributes($_POST['nw_subject'])) : '';
 
 $sql_common = " nw_device = '{$_POST['nw_device']}',
                 nw_begin_time = '{$_POST['nw_begin_time']}',

adm/point_list.php

@@ -131,7 +131,7 @@ else
 
         $link1 = $link2 = '';
         if (!preg_match("/^\@/", $row['po_rel_table']) && $row['po_rel_table']) {
-            $link1 = '<a href="'.G5_BBS_URL.'/board.php?bo_table='.$row['po_rel_table'].'&amp;wr_id='.$row['po_rel_id'].'" target="_blank">';
+            $link1 = '<a href="'.get_pretty_url($row['po_rel_table'], $row['po_rel_id']).'" target="_blank">';
             $link2 = '</a>';
         }
 

adm/point_update.php

@@ -6,9 +6,9 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
-$mb_id = strip_tags($_POST['mb_id']);
-$po_point = strip_tags($_POST['po_point']);
-$po_content = strip_tags($_POST['po_content']);
+$mb_id = strip_tags(clean_xss_attributes($_POST['mb_id']));
+$po_point = strip_tags(clean_xss_attributes($_POST['po_point']));
+$po_content = strip_tags(clean_xss_attributes($_POST['po_content']));
 $expire = preg_replace('/[^0-9]/', '', $_POST['po_expire_term']);
 
 $mb = get_member($mb_id);

adm/poll_form.php

@@ -37,7 +37,7 @@ include_once('./admin.head.php');
     <tbody>
     <tr>
         <th scope="row"><label for="po_subject">투표 제목<strong class="sound_only">필수</strong></label></th>
-        <td><input type="text" name="po_subject" value="<?php echo $po['po_subject'] ?>" id="po_subject" required class="required frm_input" size="80" maxlength="125"></td>
+        <td><input type="text" name="po_subject" value="<?php echo get_sanitize_input($po['po_subject']); ?>" id="po_subject" required class="required frm_input" size="80" maxlength="125"></td>
     </tr>
 
     <?php

adm/poll_form_update.php

@@ -40,7 +40,7 @@ foreach( $_POST as $key=>$value ){
     if( empty($value) ) continue;
 
     if( in_array($key, $check_keys) ) {
-        $_POST[$key] = strip_tags($value);
+        $_POST[$key] = strip_tags(clean_xss_attributes($value));
     }
 }
 

adm/qa_config.php

@@ -133,7 +133,7 @@ if(!isset($qaconfig['qa_include_head'])) {
         <tr>
             <th scope="row"><label for="qa_title">타이틀<strong class="sound_only">필수</strong></label></th>
             <td>
-                <input type="text" name="qa_title" value="<?php echo $qaconfig['qa_title'] ?>" id="qa_title" required class="required frm_input" size="40">
+                <input type="text" name="qa_title" value="<?php echo get_sanitize_input($qaconfig['qa_title']); ?>" id="qa_title" required class="required frm_input" size="40">
                 <a href="<?php echo G5_BBS_URL; ?>/qalist.php" class="btn_frmline">1:1문의 바로가기</a>
             </td>
         </tr>
@@ -141,7 +141,7 @@ if(!isset($qaconfig['qa_include_head'])) {
             <th scope="row"><label for="qa_category">분류<strong class="sound_only">필수</strong></label></th>
             <td>
                 <?php echo help('분류와 분류 사이는 | 로 구분하세요. (예: 질문|답변) 첫자로 #은 입력하지 마세요. (예: #질문|#답변 [X])') ?>
-                <input type="text" name="qa_category" value="<?php echo $qaconfig['qa_category'] ?>" id="qa_category" required class="required frm_input" size="70">
+                <input type="text" name="qa_category" value="<?php echo get_sanitize_input($qaconfig['qa_category']); ?>" id="qa_category" required class="required frm_input" size="70">
             </td>
         </tr>
         <tr>
@@ -184,21 +184,21 @@ if(!isset($qaconfig['qa_include_head'])) {
             <th scope="row"><label for="qa_send_number">SMS 발신번호</label></th>
             <td>
                 <?php echo help('SMS 알림 전송시 발신번호로 사용됩니다.'); ?>
-                <input type="text" name="qa_send_number" value="<?php echo $qaconfig['qa_send_number'] ?>" id="qa_send_number" class="frm_input"  size="30">
+                <input type="text" name="qa_send_number" value="<?php echo get_sanitize_input($qaconfig['qa_send_number']); ?>" id="qa_send_number" class="frm_input"  size="30">
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_admin_hp">관리자 휴대폰번호</label></th>
             <td>
                 <?php echo help('관리자 휴대폰번호를 입력하시면 문의글 등록시 등록하신 번호로 SMS 알림이 전송됩니다.<br>SMS 알림을 사용하지 않으시면 알림이 전송되지 않습니다.'); ?>
-                <input type="text" name="qa_admin_hp" value="<?php echo $qaconfig['qa_admin_hp'] ?>" id="qa_admin_hp" class="frm_input"  size="30">
+                <input type="text" name="qa_admin_hp" value="<?php echo get_sanitize_input($qaconfig['qa_admin_hp']); ?>" id="qa_admin_hp" class="frm_input"  size="30">
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_admin_email">관리자 이메일</label></th>
             <td>
                 <?php echo help('관리자 이메일을 입력하시면 문의글 등록시 등록하신 이메일로 알림이 전송됩니다.'); ?>
-                <input type="text" name="qa_admin_email" value="<?php echo $qaconfig['qa_admin_email'] ?>" id="qa_admin_email" class="frm_input"  size="50">
+                <input type="text" name="qa_admin_email" value="<?php echo get_sanitize_input($qaconfig['qa_admin_email']); ?>" id="qa_admin_email" class="frm_input"  size="50">
             </td>
         </tr>
         <tr>

adm/qa_config_update.php

@@ -12,6 +12,12 @@ $error_msg = '';
 
 $qaconfig = get_qa_config();
 
+$check_keys = array('qa_title', 'qa_category', 'qa_skin', 'qa_mobile_skin', 'qa_use_email', 'qa_req_email', 'qa_use_hp', 'qa_req_hp', 'qa_use_sms', 'qa_send_number', 'qa_admin_hp', 'qa_admin_email', 'qa_subject_len', 'qa_mobile_subject_len', 'qa_page_rows', 'qa_mobile_page_rows', 'qa_image_width', 'qa_upload_size');
+
+foreach($check_keys as $key){
+	$$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
+}
+
 $qa_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_head, 0, 255));
 $qa_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_tail, 0, 255));
 
@@ -50,7 +56,10 @@ if( $qa_include_tail && ! is_include_path_check($qa_include_tail, 1) ){
     $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
 }
 
-$_POST['qa_title'] = strip_tags($_POST['qa_title']);
+if( function_exists('filter_input_include_path') ){
+    $qa_include_head = filter_input_include_path($qa_include_head);
+    $qa_include_tail = filter_input_include_path($qa_include_tail);
+}
 
 $sql = " update {$g5['qa_config_table']}
             set qa_title                = '{$_POST['qa_title']}',

adm/sms_admin/config.php

@@ -9,6 +9,14 @@ $g5['title'] = "SMS 기본설정";
 if (!$config['cf_icode_server_ip'])   $config['cf_icode_server_ip'] = '211.172.232.124';
 if (!$config['cf_icode_server_port']) $config['cf_icode_server_port'] = '7295';
 
+// 아이코드 토큰키 추가
+if( ! isset($config['cf_icode_token_key']) ){
+    $sql = "ALTER TABLE `{$g5['config_table']}` 
+            ADD COLUMN `cf_icode_token_key` VARCHAR(100) NOT NULL DEFAULT '' AFTER `cf_icode_server_port`; ";
+    sql_query($sql, false);
+    $config['cf_icode_token_key'] = '';
+}
+
 if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw'])
 {
     $userinfo = get_icode_userinfo($config['cf_icode_id'], $config['cf_icode_pw']);
@@ -23,7 +31,7 @@ if (!$sms5['cf_skin'])
 include_once(G5_ADMIN_PATH.'/admin.head.php');
 
 ?>
-<?php if (!$config['cf_icode_pw']) { ?>
+<?php if (!($config['cf_icode_pw'] || $config['cf_icode_token_key'])) { ?>
 <div class="local_desc01 local_desc">
     <p>
         SMS 기능을 사용하시려면 먼저 아이코드에 서비스 신청을 하셔야 합니다.<br>
@@ -47,22 +55,31 @@ if ($config['cf_sms_use'] == 'icode') { // 아이코드 사용
     </colgroup>
     <tbody>
     <tr>
-        <th scope="row"><label for="cf_icode_id">아이코드 회원아이디<strong class="sound_only"> 필수</strong></label></th>
+        <th scope="row"><label for="cf_sms_type">SMS 전송유형</label></th>
+        <td>
+            <?php echo help("전송유형을 SMS로 선택하시면 최대 80바이트까지 전송하실 수 있으며<br>LMS로 선택하시면 90바이트 이하는 SMS로, 그 이상은 ".G5_ICODE_LMS_MAX_LENGTH."바이트까지 LMS로 전송됩니다.<br>요금은 건당 SMS는 16원, LMS는 48원입니다."); ?>
+            <select id="cf_sms_type" name="cf_sms_type">
+                <option value="" <?php echo get_selected($config['cf_sms_type'], ''); ?>>SMS</option>
+                <option value="LMS" <?php echo get_selected($config['cf_sms_type'], 'LMS'); ?>>LMS</option>
+            </select>
+        </td>
+    </tr>
+    <tr class="icode_old_version">
+        <th scope="row"><label for="cf_icode_id">아이코드 회원아이디<br>(구버전)<strong class="sound_only"> 필수</strong></label></th>
         <td>
             <?php echo help("아이코드에서 사용하시는 회원아이디를 입력합니다."); ?>
-            <input type="text" name="cf_icode_id" value="<?php echo $config['cf_icode_id']; ?>" id="cf_icode_id" required class="frm_input required">
+            <input type="text" name="cf_icode_id" value="<?php echo $config['cf_icode_id']; ?>" id="cf_icode_id" class="frm_input">
         </td>
     </tr>
-    <tr>
-        <th scope="row"><label for="cf_icode_pw">아이코드 비밀번호<strong class="sound_only"> 필수</strong></label></th>
+    <tr class="icode_old_version">
+        <th scope="row"><label for="cf_icode_pw">아이코드 비밀번호<br>(구버전)<strong class="sound_only"> 필수</strong></label></th>
         <td>
             <?php echo help("아이코드에서 사용하시는 비밀번호를 입력합니다."); ?>
-            <input type="password" name="cf_icode_pw" value="<?php echo $config['cf_icode_pw']; ?>" id="cf_icode_pw" required class="frm_input required">
-            <?php if (!$config['cf_icode_pw']) { ?>현재 비밀번호가 입력되어 있지 않습니다.<?php } ?>
+            <input type="password" name="cf_icode_pw" value="<?php echo $config['cf_icode_pw']; ?>" id="cf_icode_pw" class="frm_input">
         </td>
     </tr>
-    <tr>
-        <th scope="row">요금제</th>
+    <tr class="icode_old_version <?php if(!(isset($userinfo['payment']) && $userinfo['payment'])){ echo 'cf_tr_hide'; } ?>">
+        <th scope="row">요금제<br>(구버전)</th>
         <td>
             <?php
                 if ($userinfo['payment'] == 'A') {
@@ -72,21 +89,30 @@ if ($config['cf_sms_use'] == 'icode') { // 아이코드 사용
                     echo '정액제';
                     echo '<input type="hidden" name="cf_icode_server_port" value="7296">';
                 } else {
-                    echo '가입해주세요.';
                     echo '<input type="hidden" name="cf_icode_server_port" value="7295">';
                 }
             ?>
         </td>
     </tr>
     <?php if ($userinfo['payment'] == 'A') { ?>
-    <tr>
-        <th scope="row">충전 잔액</th>
+    <tr class="icode_old_version">
+        <th scope="row">충전 잔액<br>(구버전)</th>
         <td>
             <?php echo number_format($userinfo['coin'])?> 원
             <a href="http://www.icodekorea.com/smsbiz/credit_card_amt.php?icode_id=<?php echo $config['cf_icode_id']; ?>&amp;icode_passwd=<?php echo $config['cf_icode_pw']; ?>" target="_blank" class="btn_frmline">충전하기</a>
         </td>
     </tr>
     <?php } ?>
+    <tr class="icode_json_version">
+        <th scope="row"><label for="cf_icode_token_key">아이코드 토큰키<br>(JSON버전)</label></th>
+        <td>
+            <?php echo help("아이코드 JSON 버전의 경우 아이코드 토큰키를 입력시 실행됩니다.<br>SMS 전송유형을 LMS로 설정시 90바이트 이내는 SMS, 90 ~ 2000 바이트는 LMS 그 이상은 절삭 되어 LMS로 발송됩니다."); ?>
+            <input type="text" name="cf_icode_token_key" value="<?php echo $config['cf_icode_token_key']; ?>" id="cf_icode_token_key" class="frm_input" size="40">
+            <?php echo help("아이코드 사이트 -> 토큰키관리 메뉴에서 생성한 토큰키를 입력합니다."); ?>
+            <br>
+            서버아이피 : <?php echo $_SERVER['SERVER_ADDR']; ?>
+        </td>
+    </tr>
     <tr>
         <th scope="row"><label for="cf_phone">회신번호<strong class="sound_only"> 필수</strong></label></th>
         <td>

adm/sms_admin/config_update.php

@@ -15,6 +15,7 @@ if(!check_vaild_callback($cf_phone))
     alert('회신번호가 올바르지 않습니다.');
 
 $userinfo = get_icode_userinfo($cf_icode_id, $cf_icode_pw);
+$cf_icode_server_port = isset($cf_icode_server_port) ? preg_replace('/[^0-9]/', '', $cf_icode_server_port) : '7295';
 
 if ($userinfo['code'] == '202')
     alert('아이코드 아이디와 패스워드가 맞지 않습니다.');
@@ -33,10 +34,12 @@ sql_query($sql);
 // 아이코드 설정
 $sql = " update {$g5['config_table']}
             set cf_sms_use              = '$cf_sms_use',
+                cf_sms_type             = '$cf_sms_type',
                 cf_icode_id             = '$cf_icode_id',
                 cf_icode_pw             = '$cf_icode_pw',
                 cf_icode_server_ip      = '$cf_icode_server_ip',
-                cf_icode_server_port    = '$cf_icode_server_port' ";
+                cf_icode_server_port    = '$cf_icode_server_port',
+                cf_icode_token_key      = '$cf_icode_token_key'";
 sql_query($sql);
 
 goto_url("./config.php");

adm/sms_admin/css/sms5.css

@@ -22,6 +22,7 @@
 .sms5_box {position:relative;padding:10px;border-radius:5px;background:#fbec99}
 .sms5_box .box_ico {position:absolute;top:20px;left:-7px;width:7px;height:13px;background:url('../img/box_ico.gif') no-repeat}
 .sms5_box .box_txt {border:0;background:transparent;word-break:break-all;resize:none;overflow:hidden}
+.sms5_box textarea.box_txt.is_overview{overflow:visible;min-height:130px}
 .sms5_box .box_square {width:100px;height:90px}
 
 #write_wrap {z-index:9}

adm/sms_admin/form_update.php

@@ -4,8 +4,8 @@ include_once("./_common.php");
 
 auth_check($auth[$sub_menu], "w");
 
-$fo_name = isset($fo_name) ? strip_tags($fo_name) : '';
-$fo_content = isset($fo_content) ? strip_tags($fo_content) : '';
+$fo_name = isset($fo_name) ? strip_tags(clean_xss_attributes($fo_name)) : '';
+$fo_content = isset($fo_content) ? strip_tags(clean_xss_attributes($fo_content)) : '';
 
 $g5['title'] = "이모티콘 업데이트";
 

adm/sms_admin/form_write.php

@@ -6,6 +6,8 @@ auth_check($auth[$sub_menu], "w");
 
 $g5['title'] = "이모티콘 ";
 
+$fg_no = isset($fg_no) ? (int) $fg_no : '';
+
 if ($w == 'u' && is_numeric($fo_no)) {
     $write = sql_fetch("select * from {$g5['sms5_form_table']} where fo_no='$fo_no'");
     $g5['title'] .= '수정';
@@ -48,7 +50,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
     </tr>
     <tr>
         <th scope="row"><label for="fo_name">제목<strong class="sound_only"> 필수</strong></label></th>
-        <td><input type="text" name="fo_name" id="fo_name" required value="<?php echo $write['fo_name']?>" class="frm_input required" size="70"></td>
+        <td><input type="text" name="fo_name" id="fo_name" required value="<?php echo get_sanitize_input($write['fo_name']); ?>" class="frm_input required" size="70"></td>
     </tr>
     <tr>
         <th scope="row">메세지</th>

adm/sms_admin/history_send.php

@@ -224,8 +224,8 @@ if($config['cf_sms_type'] == 'LMS') {
 
 ?>
 <script>
-act = window.open('sms_ing.php', 'act', 'width=300, height=200');
-act.close();
+//act = window.open('sms_ing.php', 'act', 'width=300, height=200');
+//act.close();
 location.href = 'history_view.php?wr_no=<?php echo $wr_no?>&wr_renum=<?php echo $new_wr_renum?>';
 </script>
 <?php

adm/sms_admin/history_view.php

@@ -4,6 +4,7 @@ include_once("./_common.php");
 
 $spage_size = 20;
 $colspan = 10;
+$re_text = '';
 
 $st = isset($st) ? strip_tags($st) : '';
 $ssv = isset($ssv) ? strip_tags($ssv) : '';
@@ -60,8 +61,8 @@ function re_send()
     if (!confirm('전송에 실패한 SMS 를 재전송 하시겠습니까?'))
         return;
 
-    act = window.open('sms_ing.php', 'act', 'width=300, height=200');
-    act.focus();
+    //act = window.open('sms_ing.php', 'act', 'width=300, height=200');
+    //act.focus();
 
     location.href = './history_send.php?w=f&page=<?php echo $page?>&st=<?php echo  $st?>&sv=<?php echo $sv?>&wr_no=<?php echo $wr_no?>&wr_renum=<?php echo $wr_renum?>';
     <?php } ?>
@@ -104,7 +105,7 @@ function all_send()
 
     <div id="con_sms" class="sms5_box">
         <span class="box_ico"></span>
-        <textarea class="box_txt" readonly><?php echo $write['wr_message'];?></textarea>
+        <textarea class="box_txt is_overview" readonly><?php echo $write['wr_message'];?></textarea>
     </div>
 
     <?php if ($write['wr_re_total'] && !$wr_renum) { ?>

adm/sms_admin/install.php

@@ -53,6 +53,7 @@ eval("\$file = \"$file\";");
 $f = explode(";", $file);
 for ($i=0; $i<count($f); $i++) {
     if (trim($f[$i]) == "") continue;
+	$f[$i] = get_db_create_replace($f[$i]);
     sql_query($f[$i]) or die(mysqli_error());
 }
 // 테이블 생성 ------------------------------------

adm/sms_admin/num_book.php

@@ -13,10 +13,12 @@ $g5['title'] = "휴대폰번호 관리";
 
 if ($page < 1) $page = 1;
 
-$bg_no = isset($bg_no) ? (int) $bg_no : 0;
+$bg_no = isset($bg_no) ? preg_replace('/[^0-9]/i', '', $bg_no) : '';
 $st = isset($st) ? preg_replace('/[^a-z0-9]/i', '', $st) : '';
 
-if (is_numeric($bg_no))
+$sql_korean = $sql_group = $sql_search = $sql_no_hp = '';
+
+if (is_numeric($bg_no) && $bg_no)
     $sql_group = " and bg_no='$bg_no' ";
 else
     $sql_group = "";
@@ -127,9 +129,9 @@ function no_hp_click(val)
 <label for="bg_no" class="sound_only">그룹명</label>
 <select name="bg_no" id="bg_no" onchange="location.href='<?php echo $_SERVER['SCRIPT_NAME']?>?bg_no='+this.value;">
     <option value=""<?php echo get_selected('', $bg_no); ?>> 전체 </option>
-    <option value="<?php echo $no_group['bg_no']?>"<?php echo get_selected($bg_no, $no_group['bg_no']); ?>> <?php echo $no_group['bg_name']?> (<?php echo number_format($no_group['bg_count'])?> 명) </option>
+    <option value="<?php echo $no_group['bg_no']?>"<?php echo get_selected($no_group['bg_no'], $bg_no); ?>> <?php echo $no_group['bg_name']?> (<?php echo number_format($no_group['bg_count'])?> 명) </option>
     <?php for($i=0; $i<count($group); $i++) {?>
-    <option value="<?php echo $group[$i]['bg_no']?>"<?php echo get_selected($bg_no, $group[$i]['bg_no']);?>> <?php echo $group[$i]['bg_name']?> (<?php echo number_format($group[$i]['bg_count'])?> 명) </option>
+    <option value="<?php echo $group[$i]['bg_no']?>"<?php echo get_selected($group[$i]['bg_no'], $bg_no);?>> <?php echo $group[$i]['bg_name']?> (<?php echo number_format($group[$i]['bg_count'])?> 명) </option>
     <?php } ?>
 </select>
 <input type="checkbox" name="no_hp" id="no_hp" <?php echo $no_hp_checked?> onclick="no_hp_click(this.checked)">

adm/sms_admin/num_group.php

@@ -129,7 +129,7 @@ function num_group_submit(f)
             <select name="select_bg_no_999" id="select_bg_no_999" onchange="move(<?php echo $no_group['bg_no']?>, '<?php echo $no_group['bg_name']?>', this);" >
                 <option value=""></option>
                 <?php for ($i=0; $i<count($group); $i++) { ?>
-                <option value="<?php echo $group[$i]['bg_no']?>"> <?php echo $group[$i]['bg_name']?> </option>
+                <option value="<?php echo $group[$i]['bg_no']?>"> <?php echo get_sanitize_input($group[$i]['bg_name']); ?> </option>
                 <?php } ?>
             </select>
         </td>
@@ -150,7 +150,7 @@ function num_group_submit(f)
         </td>
         <td>
             <label for="bg_name_<?php echo $i; ?>" class="sound_only">그룹명</label>
-            <input type="text" name="bg_name[<?php echo $i; ?>]" value="<?php echo $group[$i]['bg_name']?>" id="bg_name_<?php echo $i; ?>" class="frm_input">
+            <input type="text" name="bg_name[<?php echo $i; ?>]" value="<?php echo get_sanitize_input($group[$i]['bg_name']); ?>" id="bg_name_<?php echo $i; ?>" class="frm_input">
         </td>
         <td class="td_num"><?php echo number_format($group[$i]['bg_count'])?></td>
         <td class="td_num"><?php echo number_format($group[$i]['bg_member'])?></td>

adm/sms_admin/num_group_update.php

@@ -11,7 +11,7 @@ if ($w == 'u') // 업데이트
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
         $bg_no = (int) $_POST['bg_no'][$k];
-        $bg_name = strip_tags($_POST['bg_name'][$k]);
+        $bg_name = strip_tags(clean_xss_attributes($_POST['bg_name'][$k]));
 
         if (!is_numeric($bg_no))
             alert('그룹 고유번호가 없습니다.');
@@ -23,11 +23,11 @@ if ($w == 'u') // 업데이트
         if (!strlen(trim($bg_name)))
             alert('그룹명을 입력해주세요');
 
-        $res = sql_fetch("select bg_name from {$g5['sms5_book_group_table']} where bg_no<>'$bg_no' and bg_name='$bg_name'");
+        $res = sql_fetch("select bg_name from {$g5['sms5_book_group_table']} where bg_no<>'$bg_no' and bg_name='".sql_real_escape_string($bg_name)."'");
         if ($res)
             alert('같은 그룹명이 존재합니다.');
 
-        sql_query("update {$g5['sms5_book_group_table']} set bg_name='".addslashes($bg_name)."' where bg_no='$bg_no'");
+        sql_query("update {$g5['sms5_book_group_table']} set bg_name='".sql_real_escape_string($bg_name)."' where bg_no='$bg_no'");
     }
 }
 else if ($w == 'de') // 그룹삭제
@@ -63,7 +63,7 @@ else if ($w == 'em') // 비우기
 }
 else // 등록
 {
-    $bg_name = strip_tags($bg_name);
+    $bg_name = strip_tags(clean_xss_attributes($bg_name));
 
     if (!strlen(trim($bg_name)))
         alert('그룹명을 입력해주세요');
@@ -72,7 +72,7 @@ else // 등록
     if ($res)
         alert('같은 그룹명이 존재합니다.');
 
-    sql_query("insert into {$g5['sms5_book_group_table']} set bg_name='".addslashes($bg_name)."'");
+    sql_query("insert into {$g5['sms5_book_group_table']} set bg_name='$bg_name'");
 }
 
 goto_url('./num_group.php');

adm/sms_admin/sms5.sql

@@ -149,7 +149,7 @@ CREATE TABLE `{$g5['sms5_write_table']}` (
   `wr_no` int(11) NOT NULL default '1',
   `wr_renum` int(11) NOT NULL default '0',
   `wr_reply` varchar(255) NOT NULL default '',
-  `wr_message` varchar(255) NOT NULL default '',
+  `wr_message` text NOT NULL,
   `wr_booking` datetime NOT NULL default '0000-00-00 00:00:00',
   `wr_total` int(11) NOT NULL default '0',
   `wr_re_total` int(11) NOT NULL default '0',

adm/sms_admin/sms_write.php

@@ -266,8 +266,8 @@ function sms5_chk_send(f)
 
         w = document.body.clientWidth/2 - 200;
         h = document.body.clientHeight/2 - 100;
-        act = window.open('sms_ing.php', 'act', 'width=300, height=200, left=' + w + ', top=' + h);
-        act.focus();
+        //act = window.open('sms_ing.php', 'act', 'width=300, height=200, left=' + w + ', top=' + h);
+        //act.focus();
 
         f.send_list.value = list;
         return true;
@@ -407,6 +407,7 @@ function byte_check(wr_message, sms_bytes)
     var conts = document.getElementById(wr_message);
     var bytes = document.getElementById(sms_bytes);
     var max_bytes = document.getElementById("sms_max_bytes");
+    var lms_max_length = <?php echo G5_ICODE_LMS_MAX_LENGTH;?>
 
     var i = 0;
     var cnt = 0;
@@ -427,14 +428,14 @@ function byte_check(wr_message, sms_bytes)
 
     <?php if($config['cf_sms_type'] == 'LMS') { ?>
     if(cnt > 90)
-        max_bytes.innerHTML = 1500;
+        max_bytes.innerHTML = lms_max_length;
     else
         max_bytes.innerHTML = 90;
 
-    if (cnt > 1500)
+    if (cnt > lms_max_length)
     {
-        exceed = cnt - 1500;
-        alert('메시지 내용은 1500바이트를 넘을수 없습니다.\n\n작성하신 메세지 내용은 '+ exceed +'byte가 초과되었습니다.\n\n초과된 부분은 자동으로 삭제됩니다.');
+        exceed = cnt - lms_max_length;
+        alert('메시지 내용은 '+ lms_max_length +'바이트를 넘을수 없습니다.\n\n작성하신 메세지 내용은 '+ exceed +'byte가 초과되었습니다.\n\n초과된 부분은 자동으로 삭제됩니다.');
         var tcnt = 0;
         var xcnt = 0;
         var tmp = conts.value;
@@ -447,7 +448,7 @@ function byte_check(wr_message, sms_bytes)
                 tcnt += 1;
             }
 
-            if (tcnt > 1500) {
+            if (tcnt > lms_max_length) {
                 tmp = tmp.substring(0,i);
                 break;
             } else {

adm/sms_admin/sms_write_form.php

@@ -7,6 +7,8 @@ while ($res = sql_fetch_array($qry)) array_push($group, $res);
 
 $res = sql_fetch("select count(*) as cnt from `{$g5['sms5_form_table']}` where fg_no=0");
 $no_count = $res['cnt'];
+
+$fg_no = isset($fg_no) ? (int) $fg_no : '';
 ?>
 
 <form name="emo_frm">

adm/sms_admin/sms_write_send.php

@@ -6,8 +6,24 @@ auth_check($auth[$sub_menu], "w");
 
 check_admin_token();
 
+$result = sql_query("describe `{$g5['sms5_write_table']}`");
+while ($row = sql_fetch_array($result)){
+    if( $row['Field'] === 'wr_message' && $row['Type'] === 'varchar(255)' ){
+        sql_query("ALTER TABLE `{$g5['sms5_write_table']}` MODIFY wr_message TEXT NOT NULL;", false);
+        break;
+    }
+}
+
 $g5['title'] = "문자전송중";
 
+if ($config['cf_sms_use'] != 'icode') {
+    alert('기본환경설정에서 icode sms 사용이 비활성화 되어 있습니다.');
+}
+
+if ( ! (($config['cf_icode_id'] && $config['cf_icode_pw']) || $config['cf_icode_token_key']) ) {
+    alert('아이코드 설정값이 존재하지 않습니다.');
+}
+
 $wr_reply   = preg_replace('#[^0-9\-]#', '', trim($wr_reply));
 $wr_message = clean_xss_tags(trim($wr_message));
 
@@ -94,12 +110,12 @@ while ($row = array_shift($send_list))
                 $hp = get_hp($item[$i][1], 0);
                 $name = $item[$i][0];
 
-                if(!$hp) continue;
+                if(!$hp) continue 2;
 
                 if ($wr_overlap && array_overlap($hps, $hp)) {
                     $overlap++;
                     array_push( $duplicate_data['hp'], $row['bk_hp'] );
-                    continue;
+                    continue 2;
                 }
 
                 array_push($list, array('bk_hp' => $hp, 'bk_name' => $name));
@@ -111,12 +127,12 @@ while ($row = array_shift($send_list))
                 $row = sql_fetch("select * from {$g5['sms5_book_table']} where bk_no='$item[$i]'");
                 $row['bk_hp'] = get_hp($row['bk_hp'], 0);
 
-                if(!$row['bk_hp']) continue;
+                if(!$row['bk_hp']) continue 2;
 
                 if ($wr_overlap && array_overlap($hps, $row['bk_hp'])) {
                     $overlap++;
                     array_push( $duplicate_data['hp'], $row['bk_hp'] );
-                    continue;
+                    continue 2;
                 }
                 array_push($list, $row);
                 array_push($hps, $row['bk_hp']);
@@ -141,14 +157,11 @@ if ($wr_by && $wr_bm && $wr_bd && $wr_bh && $wr_bi) {
     $booking = '';
 }
 
-if ($config['cf_sms_use'] != 'icode') {
-    alert('기본환경설정에서 icode sms 사용이 비활성화 되어 있습니다.');
-}
-
 include_once(G5_ADMIN_PATH.'/admin.head.php');
 
 $reply = str_replace('-', '', trim($wr_reply));
-$wr_message = conv_unescape_nl($wr_message);
+$db_wr_message = conv_unescape_nl($wr_message);
+$wr_message = conv_unescape_nl(stripslashes($wr_message));
 
 $SMS = new SMS5;
 
@@ -186,7 +199,7 @@ if($config['cf_sms_type'] == 'LMS') {
 
             if($result) {
                 $result = $SMS->Send();
-
+                
                 if ($result) //SMS 서버에 접속했습니다.
                 {
                     foreach ($SMS->Result as $result)
@@ -242,7 +255,7 @@ if($config['cf_sms_type'] == 'LMS') {
             }
         }
 
-        sql_query("insert into {$g5['sms5_write_table']} set wr_no='$wr_no', wr_renum=0, wr_reply='$wr_reply', wr_message='$wr_message', wr_success='$wr_success', wr_failure='$wr_failure', wr_memo='$str_serialize', wr_booking='$wr_booking', wr_total='$wr_total', wr_datetime='".G5_TIME_YMDHIS."'");
+        sql_query("insert into {$g5['sms5_write_table']} set wr_no='$wr_no', wr_renum=0, wr_reply='$wr_reply', wr_message='$db_wr_message', wr_success='$wr_success', wr_failure='$wr_failure', wr_memo='$str_serialize', wr_booking='$wr_booking', wr_total='$wr_total', wr_datetime='".G5_TIME_YMDHIS."'");
     }
 } else {
     $SMS->SMS_con($config['cf_icode_server_ip'], $config['cf_icode_id'], $config['cf_icode_pw'], $config['cf_icode_server_port']);
@@ -260,7 +273,7 @@ if($config['cf_sms_type'] == 'LMS') {
             else
                 $wr_no = 1;
 
-            sql_query("insert into {$g5['sms5_write_table']} set wr_no='$wr_no', wr_renum=0, wr_reply='$wr_reply', wr_message='$wr_message', wr_booking='$wr_booking', wr_total='$wr_total', wr_datetime='".G5_TIME_YMDHIS."'");
+            sql_query("insert into {$g5['sms5_write_table']} set wr_no='$wr_no', wr_renum=0, wr_reply='$wr_reply', wr_message='$db_wr_message', wr_booking='$wr_booking', wr_total='$wr_total', wr_datetime='".G5_TIME_YMDHIS."'");
 
             $wr_success = 0;
             $wr_failure = 0;
@@ -324,11 +337,16 @@ if($config['cf_sms_type'] == 'LMS') {
 
 function win_close_alert($msg) {
 
-    $html = "<script>
-    act = window.open('sms_ing.php', 'act', 'width=300, height=200');
-    act.close();
-    alert('$msg');
-    history.back();</script>";
+    $html = "<script>".PHP_EOL;
+    //$html .= "act = window.open('sms_ing.php', 'act', 'width=300, height=200');".PHP_EOL;
+    //$html .= "act.close();".PHP_EOL;
+    $html .= "alert('$msg');
+        if ('referrer' in document) {
+            window.location = document.referrer;
+        } else {
+            window.history.back();
+        }
+    </script>";
 
     echo $html;
     exit;
@@ -336,8 +354,8 @@ function win_close_alert($msg) {
 
 ?>
 <script>
-act = window.open('sms_ing.php', 'act', 'width=300, height=200');
-act.close();
+//act = window.open('sms_ing.php', 'act', 'width=300, height=200');
+//act.close();
 location.href = 'history_view.php?wr_no=<?php echo $wr_no?>';
 </script>
 <?php

adm/sql_write.sql

@@ -10,6 +10,7 @@ CREATE TABLE `__TABLE_NAME__` (
   `wr_option` set('html1','html2','secret','mail') NOT NULL,
   `wr_subject` varchar(255) NOT NULL,
   `wr_content` text NOT NULL,
+  `wr_seo_title` varchar(255) NOT NULL DEFAULT '',
   `wr_link1` text NOT NULL,
   `wr_link2` text NOT NULL,
   `wr_link1_hit` int(11) NOT NULL DEFAULT '0',
@@ -39,6 +40,7 @@ CREATE TABLE `__TABLE_NAME__` (
   `wr_9` varchar(255) NOT NULL,
   `wr_10` varchar(255) NOT NULL,
   PRIMARY KEY (`wr_id`),
+  KEY `wr_seo_title` (`wr_seo_title`),
   KEY `wr_num_reply_parent` (`wr_num`,`wr_reply`,`wr_parent`),
   KEY `wr_is_comment` (`wr_is_comment`,`wr_id`)
 ) ENGINE=MyISAM  DEFAULT CHARSET=utf8;

adm/theme_config_load.php

@@ -29,7 +29,7 @@ if(!in_array($type, $arr_type)) {
 }
 
 if($type == 'board') {
-    $keys = array('bo_gallery_cols', 'bo_gallery_width', 'bo_gallery_height', 'bo_mobile_gallery_width', 'bo_mobile_gallery_height', 'bo_image_width');
+    $keys = run_replace('theme_config_load_keys', array('bo_gallery_cols', 'bo_gallery_width', 'bo_gallery_height', 'bo_mobile_gallery_width', 'bo_mobile_gallery_height', 'bo_image_width'), $type);
     $tconfig = get_theme_config_value($config['cf_theme'], implode(',', $keys));
 
     $i = 0;
@@ -43,7 +43,7 @@ if($type == 'board') {
     if($i == 0)
         $data['error'] = '적용할 게시판 이미지 설정이 없습니다.';
 } else if($type == 'conf_skin') {
-    $keys = array('cf_new_skin', 'cf_mobile_new_skin', 'cf_search_skin', 'cf_mobile_search_skin', 'cf_connect_skin', 'cf_mobile_connect_skin', 'cf_faq_skin', 'cf_mobile_faq_skin');
+    $keys = run_replace('theme_config_load_keys', array('cf_new_skin', 'cf_mobile_new_skin', 'cf_search_skin', 'cf_mobile_search_skin', 'cf_connect_skin', 'cf_mobile_connect_skin', 'cf_faq_skin', 'cf_mobile_faq_skin'), $type);
 
     $tconfig = get_theme_config_value($config['cf_theme'], implode(',', $keys));
 
@@ -58,7 +58,7 @@ if($type == 'board') {
     if($i == 0)
         $data['error'] = '적용할 기본환경 스킨 설정이 없습니다.';
 } else if($type == 'conf_member') {
-    $keys = array('cf_member_skin', 'cf_mobile_member_skin');
+    $keys = run_replace('theme_config_load_keys', array('cf_member_skin', 'cf_mobile_member_skin'), $type);
 
     $tconfig = get_theme_config_value($config['cf_theme'], implode(',', $keys));
 

adm/theme_detail.php

@@ -12,13 +12,13 @@ if(!in_array($theme, $theme_dir))
     die('선택하신 테마가 설치되어 있지 않습니다.');
 
 $info = get_theme_info($theme);
+$name = get_text($info['theme_name']);
 
 if($info['screenshot'])
     $screenshot = '<img src="'.$info['screenshot'].'" alt="'.$name.'">';
 else
     $screenshot = '<img src="'.G5_ADMIN_URL.'/img/theme_img.jpg" alt="">';
 
-$name = get_text($info['theme_name']);
 if($info['theme_uri']) {
     $name = '<a href="'.set_http($info['theme_uri']).'" target="_blank" class="thdt_home">'.$name.'</a>';
 }

adm/theme_update.php

@@ -68,5 +68,7 @@ if($_POST['set_default_skin'] == 1) {
     }
 }
 
+run_event('adm_theme_update', $theme, $_POST['set_default_skin']);
+
 die('');
 ?>

adm/view.php

@@ -0,0 +1,28 @@
+<?php
+include_once('./_common.php');
+
+$call = isset($_REQUEST['call']) ?  strtolower(preg_replace('/[^a-z0-9_]/i', '', $_REQUEST['call'])) : '';
+
+if( ! $call ){
+    return;
+}
+
+if( ! $is_admin ){
+	$sql = " select count(*) as cnt from {$g5['auth_table']} where mb_id = '{$member['mb_id']}' ";
+	$row = sql_fetch($sql);
+	if ( ! $row['cnt']) {
+		return;
+	}
+}
+
+run_event('admin_request_handler_'.$call, $arr_query, $token);
+
+$sub_menu = admin_menu_find_by($call, 'sub_menu');
+$g5['title'] = admin_menu_find_by($call, 'title');
+
+include_once ('./admin.head.php');
+
+run_event('admin_get_page_'.$call, $arr_query, $token);
+
+include_once ('./admin.tail.php');
+?>

adm/visit_search.php

@@ -11,6 +11,11 @@ include_once(G5_PLUGIN_PATH.'/jquery-ui/datepicker.php');
 
 $colspan = 6;
 $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'">처음</a>'; //페이지 처음으로 (초기화용도)
+$sql_search = '';
+
+if(isset($sfl) && $sfl && !in_array($sfl, array('vi_ip','vi_date','vi_time','vi_referer','vi_agent','vi_browser','vi_os','vi_device')) ) {
+    $sfl = '';
+}
 ?>
 
 <div class="local_sch local_sch01">

adm/write_count.php

@@ -6,27 +6,27 @@ check_demo();
 
 auth_check($auth[$sub_menu], 'r');
 
+$g5['title'] = '글,댓글 현황';
+include_once ('./admin.head.php');
+
 // http://www.jqplot.com/
-add_stylesheet('<link rel="stylesheet" href="'.G5_PLUGIN_URL.'/jqplot/jquery.jqplot.css">', 0);
-add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/jquery.jqplot.js"></script>', 0);
-add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/plugins/jqplot.canvasTextRenderer.min.js"></script>', 0);
-add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/plugins/jqplot.categoryAxisRenderer.min.js"></script>', 0);
-add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/plugins/jqplot.pointLabels.min.js"></script>', 0);
-add_javascript('<!--[if lt IE 9]><script src="'.G5_PLUGIN_URL.'/jqplot/excanvas.js"></script><![endif]-->', 0);
+add_stylesheet('<link rel="stylesheet" href="'.G5_PLUGIN_URL.'/jqplot/jquery.jqplot.css">', 1);
+add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/jquery.jqplot.js"></script>', 1);
+add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/plugins/jqplot.canvasTextRenderer.min.js"></script>', 1);
+add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/plugins/jqplot.categoryAxisRenderer.min.js"></script>', 1);
+add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/plugins/jqplot.pointLabels.min.js"></script>', 1);
+add_javascript('<!--[if lt IE 9]><script src="'.G5_PLUGIN_URL.'/jqplot/excanvas.js"></script><![endif]-->', 1);
 
 if (!($graph == 'line' || $graph == 'bar'))
     $graph = 'line';
 
 if ($graph == 'bar') {
     // 바 타입으로 사용하는 코드입니다.
-    add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/jqplot.barRenderer.min.js"></script>', 0);
-    add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/jqplot.categoryAxisRenderer.min.js"></script>', 0);
-    add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/jqplot.pointLabels.min.js"></script>', 0);
+    add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/jqplot.barRenderer.min.js"></script>', 1);
+    add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/jqplot.categoryAxisRenderer.min.js"></script>', 1);
+    add_javascript('<script src="'.G5_PLUGIN_URL.'/jqplot/jqplot.pointLabels.min.js"></script>', 1);
 }
 
-$g5['title'] = '글,댓글 현황';
-include_once ('./admin.head.php');
-
 $period_array = array(
     '오늘'=>array('시간', 0),
     '어제'=>array('시간', 0),

bbs/board.php

@@ -8,7 +8,7 @@ if (!$board['bo_table']) {
 check_device($board['bo_device']);
 
 if (isset($write['wr_is_comment']) && $write['wr_is_comment']) {
-    goto_url('./board.php?bo_table='.$bo_table.'&wr_id='.$write['wr_parent'].'#c_'.$wr_id);
+    goto_url(get_pretty_url($bo_table, $write['wr_parent'], '#c_'.$wr_id));
 }
 
 if (!$bo_table) {
@@ -19,18 +19,18 @@ if (!$bo_table) {
 $g5['board_title'] = ((G5_IS_MOBILE && $board['bo_mobile_subject']) ? $board['bo_mobile_subject'] : $board['bo_subject']);
 
 // wr_id 값이 있으면 글읽기
-if (isset($wr_id) && $wr_id) {
+if ((isset($wr_id) && $wr_id) || (isset($wr_seo_title) && $wr_seo_title)) {
     // 글이 없을 경우 해당 게시판 목록으로 이동
     if (!$write['wr_id']) {
         $msg = '글이 존재하지 않습니다.\\n\\n글이 삭제되었거나 이동된 경우입니다.';
-        alert($msg, './board.php?bo_table='.$bo_table);
+        alert($msg, get_pretty_url($bo_table));
     }
 
     // 그룹접근 사용
     if (isset($group['gr_use_access']) && $group['gr_use_access']) {
         if ($is_guest) {
             $msg = "비회원은 이 게시판에 접근할 권한이 없습니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.";
-            alert($msg, './login.php?wr_id='.$wr_id.$qstr.'&url='.urlencode(G5_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id.$qstr));
+            alert($msg, G5_BBS_URL.'/login.php?wr_id='.$wr_id.$qstr.'&url='.urlencode(get_pretty_url($bo_table, $wr_id, $qstr)));
         }
 
         // 그룹관리자 이상이라면 통과
@@ -51,14 +51,14 @@ if (isset($wr_id) && $wr_id) {
         if ($is_member)
             alert('글을 읽을 권한이 없습니다.', G5_URL);
         else
-            alert('글을 읽을 권한이 없습니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.', './login.php?wr_id='.$wr_id.$qstr.'&url='.urlencode(G5_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id.$qstr));
+            alert('글을 읽을 권한이 없습니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.', G5_BBS_URL.'/login.php?wr_id='.$wr_id.$qstr.'&url='.urlencode(get_pretty_url($bo_table, $wr_id, $qstr)));
     }
 
     // 본인확인을 사용한다면
     if ($config['cf_cert_use'] && !$is_admin) {
         // 인증된 회원만 가능
         if ($board['bo_use_cert'] != '' && $is_guest) {
-            alert('이 게시판은 본인확인 하신 회원님만 글읽기가 가능합니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.', './login.php?wr_id='.$wr_id.$qstr.'&url='.urlencode(G5_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id.$qstr));
+            alert('이 게시판은 본인확인 하신 회원님만 글읽기가 가능합니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.', G5_BBS_URL.'/login.php?wr_id='.$wr_id.$qstr.'&url='.urlencode(get_pretty_url($bo_table, $wr_id, $qstr)));
         }
 
         if ($board['bo_use_cert'] == 'cert' && !$member['mb_certify']) {
@@ -108,7 +108,7 @@ if (isset($wr_id) && $wr_id) {
                 // 이 게시물이 저장된 게시물이 아니면서 관리자가 아니라면
                 //if ("$bo_table|$write['wr_num']" != get_session("ss_secret"))
                 if (!get_session($ss_name))
-                    goto_url('./password.php?w=s&bo_table='.$bo_table.'&wr_id='.$wr_id.$qstr);
+                    goto_url(G5_BBS_URL.'/password.php?w=s&bo_table='.$bo_table.'&wr_id='.$wr_id.$qstr);
             }
 
             set_session($ss_name, TRUE);
@@ -144,14 +144,14 @@ if (isset($wr_id) && $wr_id) {
         if ($member['mb_id'])
             alert('목록을 볼 권한이 없습니다.', G5_URL);
         else
-            alert('목록을 볼 권한이 없습니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.', './login.php?'.$qstr.'&url='.urlencode(G5_BBS_URL.'/board.php?bo_table='.$bo_table.($qstr?'&':'')));
+            alert('목록을 볼 권한이 없습니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.', G5_BBS_URL.'/login.php?'.$qstr.'&url='.urlencode(G5_BBS_URL.'/board.php?bo_table='.$bo_table.($qstr?'&':'')));
     }
 
     // 본인확인을 사용한다면
     if ($config['cf_cert_use'] && !$is_admin) {
         // 인증된 회원만 가능
         if ($board['bo_use_cert'] != '' && $is_guest) {
-            alert('이 게시판은 본인확인 하신 회원님만 글읽기가 가능합니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.', './login.php?wr_id='.$wr_id.$qstr.'&url='.urlencode(G5_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id.$qstr));
+            alert('이 게시판은 본인확인 하신 회원님만 글읽기가 가능합니다.\\n\\n회원이시라면 로그인 후 이용해 보십시오.', G5_BBS_URL.'/login.php?wr_id='.$wr_id.$qstr.'&url='.urlencode(get_pretty_url($bo_table, $wr_id, $qstr)));
         }
 
         if ($board['bo_use_cert'] == 'cert' && !$member['mb_certify']) {
@@ -189,7 +189,7 @@ $ip = "";
 $is_ip_view = $board['bo_use_ip_view'];
 if ($is_admin) {
     $is_ip_view = true;
-    if (array_key_exists('wr_ip', $write)) {
+    if ($write && array_key_exists('wr_ip', $write)) {
         $ip = $write['wr_ip'];
     }
 } else {

bbs/content.php

@@ -8,14 +8,23 @@ if( !isset($g5['content_table']) ){
     die('<meta charset="utf-8">관리자 모드에서 게시판관리->내용 관리를 먼저 확인해 주세요.');
 }
 
+// 내용
+if($co_seo_title){
+    $co = get_content_by_field($g5['content_table'], 'content', 'co_seo_title', generate_seo_title($co_seo_title));
+    $co_id = $co['co_id'];
+} else {
+    $co = get_content_db($co_id);
+}
+
+if( ! (isset($co['co_seo_title']) && $co['co_seo_title']) && $co['co_id'] ){
+    seo_title_update($g5['content_table'], $co['co_id'], 'content');
+}
+
 if (G5_IS_MOBILE) {
     include_once(G5_MOBILE_PATH.'/content.php');
     return;
 }
 
-// 내용
-$sql = " select * from {$g5['content_table']} where co_id = '$co_id' ";
-$co = sql_fetch($sql);
 if (!$co['co_id'])
     alert('등록된 내용이 없습니다.');
 

bbs/db_table.optimize.php

@@ -53,7 +53,7 @@ if($config['cf_leave_day'] > 0) {
 }
 
 // 음성 캡챠 파일 삭제
-$captcha_mp3 = glob(G5_PATH.'/data/cache/kcaptcha-*.mp3');
+$captcha_mp3 = glob(G5_DATA_PATH.'/cache/kcaptcha-*.mp3');
 if($captcha_mp3 && is_array($captcha_mp3)) {
     foreach ($captcha_mp3 as $file) {
         if (filemtime($file) + 86400 < G5_SERVER_TIME) {

bbs/delete.php

@@ -30,7 +30,7 @@ else if ($is_admin == 'group') { // 그룹관리자
         alert('자신의 글이 아니므로 삭제할 수 없습니다.');
 } else {
     if ($write['mb_id'])
-        alert('로그인 후 삭제하세요.', './login.php?url='.urlencode('./board.php?bo_table='.$bo_table.'&wr_id='.$wr_id));
+        alert('로그인 후 삭제하세요.', G5_BBS_URL.'/login.php?url='.urlencode(get_pretty_url($bo_table, $wr_id)));
     else if (!check_password($wr_password, $write['wr_password']))
         alert('비밀번호가 틀리므로 삭제할 수 없습니다.');
 }
@@ -80,7 +80,11 @@ while ($row = sql_fetch_array($result))
         $sql2 = " select * from {$g5['board_file_table']} where bo_table = '$bo_table' and wr_id = '{$row['wr_id']}' ";
         $result2 = sql_query($sql2);
         while ($row2 = sql_fetch_array($result2)) {
-            @unlink(G5_DATA_PATH.'/file/'.$bo_table.'/'.str_replace('../', '', $row2['bf_file']));
+
+            $delete_file = run_replace('delete_file_path', G5_DATA_PATH.'/file/'.$bo_table.'/'.str_replace('../', '', $row2['bf_file']), $row2);
+            if( file_exists($delete_file) ){
+                @unlink($delete_file);
+            }
             // 썸네일삭제
             if(preg_match("/\.({$config['cf_image_extension']})$/i", $row2['bf_file'])) {
                 delete_board_thumbnail($bo_table, $row2['bf_file']);
@@ -134,5 +138,7 @@ if ($count_write > 0 || $count_comment > 0)
 
 delete_cache_latest($bo_table);
 
-goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&page='.$page.$qstr);
+run_event('bbs_delete', $write, $board);
+
+goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&page='.$page.$qstr));
 ?>

bbs/delete_all.php

@@ -98,7 +98,10 @@ for ($i=$chk_count-1; $i>=0; $i--)
             $result2 = sql_query($sql2);
             while ($row2 = sql_fetch_array($result2)) {
                 // 파일삭제
-                @unlink(G5_DATA_PATH.'/file/'.$bo_table.'/'.str_replace('../', '',$row2['bf_file']));
+                $delete_file = run_replace('delete_file_path', G5_DATA_PATH.'/file/'.$bo_table.'/'.str_replace('../', '',$row2['bf_file']), $row2);
+                if( file_exists($delete_file) ){
+                    @unlink($delete_file);
+                }
 
                 // 썸네일삭제
                 if(preg_match("/\.({$config['cf_image_extension']})$/i", $row2['bf_file'])) {
@@ -156,5 +159,7 @@ if ($count_write > 0 || $count_comment > 0)
 
 delete_cache_latest($bo_table);
 
-goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&page='.$page.$qstr);
+run_event('bbs_delete_all', $tmp_array, $board);
+
+goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&page='.$page.$qstr));
 ?>

bbs/delete_comment.php

@@ -86,5 +86,7 @@ sql_query(" delete from {$g5['board_new_table']} where bo_table = '{$bo_table}'
 
 delete_cache_latest($bo_table);
 
-goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$write['wr_parent'].'&page='.$page. $qstr);
+run_event('bbs_delete_comment', $comment_id, $board);
+
+goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$write['wr_parent'].'&page='.$page. $qstr));
 ?>

bbs/download.php

@@ -15,9 +15,9 @@ if (!get_session('ss_view_'.$bo_table.'_'.$wr_id))
 
 // 다운로드 차감일 때 비회원은 다운로드 불가
 if($board['bo_download_point'] < 0 && $is_guest)
-    alert('다운로드 권한이 없습니다.\\n회원이시라면 로그인 후 이용해 보십시오.', G5_BBS_URL.'/login.php?wr_id='.$wr_id.'&amp;'.$qstr.'&amp;url='.urlencode(G5_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id));
+    alert('다운로드 권한이 없습니다.\\n회원이시라면 로그인 후 이용해 보십시오.', G5_BBS_URL.'/login.php?wr_id='.$wr_id.'&amp;'.$qstr.'&amp;url='.urlencode(get_pretty_url($bo_table, $wr_id)));
 
-$sql = " select bf_source, bf_file from {$g5['board_file_table']} where bo_table = '$bo_table' and wr_id = '$wr_id' and bf_no = '$no' ";
+$sql = " select * from {$g5['board_file_table']} where bo_table = '$bo_table' and wr_id = '$wr_id' and bf_no = '$no' ";
 $file = sql_fetch($sql);
 if (!$file['bf_file'])
     alert_close('파일 정보가 존재하지 않습니다.');
@@ -42,13 +42,16 @@ if ($member['mb_level'] < $board['bo_download_level']) {
     if ($member['mb_id'])
         alert($alert_msg);
     else
-        alert($alert_msg.'\\n회원이시라면 로그인 후 이용해 보십시오.', G5_BBS_URL.'/login.php?wr_id='.$wr_id.'&amp;'.$qstr.'&amp;url='.urlencode(G5_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id));
+        alert($alert_msg.'\\n회원이시라면 로그인 후 이용해 보십시오.', G5_BBS_URL.'/login.php?wr_id='.$wr_id.'&amp;'.$qstr.'&amp;url='.urlencode(get_pretty_url($bo_table, $wr_id)));
 }
 
 $filepath = G5_DATA_PATH.'/file/'.$bo_table.'/'.$file['bf_file'];
 $filepath = addslashes($filepath);
-if (!is_file($filepath) || !file_exists($filepath))
+$file_exist_check = (!is_file($filepath) || !file_exists($filepath)) ? false : true;
+
+if ( false === run_replace('download_file_exist_check', $file_exist_check, $file) ){
     alert('파일이 존재하지 않습니다.');
+}
 
 // 사용자 코드 실행
 @include_once($board_skin_path.'/download.skin.php');
@@ -97,23 +100,27 @@ if(preg_match("/[\xA1-\xFE][\xA1-\xFE]/", $file['bf_source'])){
 }
 */
 
-$original = urlencode($file['bf_source']);
+//$original = urlencode($file['bf_source']);
+$original = rawurlencode($file['bf_source']);
 
 @include_once($board_skin_path.'/download.tail.skin.php');
 
+run_event('download_file_header', $file, $file_exist_check);
+
 if(preg_match("/msie/i", $_SERVER['HTTP_USER_AGENT']) && preg_match("/5\.5/", $_SERVER['HTTP_USER_AGENT'])) {
     header("content-type: doesn/matter");
-    header("content-length: ".filesize("$filepath"));
+    header("content-length: ".filesize($filepath));
     header("content-disposition: attachment; filename=\"$original\"");
     header("content-transfer-encoding: binary");
 } else if (preg_match("/Firefox/i", $_SERVER['HTTP_USER_AGENT'])){
     header("content-type: file/unknown");
-    header("content-length: ".filesize("$filepath"));
-    header("content-disposition: attachment; filename=\"".basename($file['bf_source'])."\"");
+    header("content-length: ".filesize($filepath));
+    //header("content-disposition: attachment; filename=\"".basename($file['bf_source'])."\"");
+    header("content-disposition: attachment; filename=\"".$original."\"");
     header("content-description: php generated data");
 } else {
     header("content-type: file/unknown");
-    header("content-length: ".filesize("$filepath"));
+    header("content-length: ".filesize($filepath));
     header("content-disposition: attachment; filename=\"$original\"");
     header("content-description: php generated data");
 }

bbs/formmail.php

@@ -8,6 +8,8 @@ if (!$config['cf_email_use'])
 if (!$is_member && $config['cf_formmail_is_member'])
     alert_close('회원만 이용하실 수 있습니다.');
 
+$mb_id = isset($mb_id) ? get_search_string($mb_id) : '';
+
 if ($is_member && !$member['mb_open'] && $is_admin != "super" && $member['mb_id'] != $mb_id)
     alert_close('자신의 정보를 공개하지 않으면 다른분에게 메일을 보낼 수 없습니다.\\n\\n정보공개 설정은 회원정보수정에서 하실 수 있습니다.');
 

bbs/good.php

@@ -1,10 +1,12 @@
 <?php
 include_once('./_common.php');
 
+run_event('bbs_good_before', $bo_table, $wr_id, $good);
+
 @include_once($board_skin_path.'/good.head.skin.php');
 
 // 자바스크립트 사용가능할 때
-if($_POST['js'] == "on") {
+if(isset($_POST['js']) && $_POST['js'] === "on") {
     $error = $count = "";
 
     function print_result($error, $count)
@@ -81,6 +83,8 @@ if($_POST['js'] == "on") {
             $row = sql_fetch($sql);
 
             $count = $row['count'];
+			
+			run_event('bbs_increase_good_json', $bo_table, $wr_id, $good);
 
             print_result($error, $count);
         }
@@ -90,7 +94,7 @@ if($_POST['js'] == "on") {
 
     if (!$is_member)
     {
-        $href = './login.php?'.$qstr.'&amp;url='.urlencode('./board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id);
+        $href = G5_BBS_URL.'/login.php?'.$qstr.'&amp;url='.urlencode(get_pretty_url($bo_table, $wr_id));
 
         alert('회원만 가능합니다.', $href);
     }
@@ -144,12 +148,16 @@ if($_POST['js'] == "on") {
             else
                 $status = '비추천';
 
-            $href = './board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id;
+            $href = get_pretty_url($bo_table, $wr_id);
+			
+			run_event('bbs_increase_good_html', $bo_table, $wr_id, $good, $href);
 
             alert("이 글을 $status 하셨습니다.", '', false);
         }
     }
 }
 
+run_event('bbs_good_after', $bo_table, $wr_id, $good);
+
 @include_once($board_skin_path.'/good.tail.skin.php');
 ?>

bbs/group.php

@@ -39,7 +39,7 @@ $sql .= " order by bo_order ";
 $result = sql_query($sql);
 for ($i=0; $row=sql_fetch_array($result); $i++) {
     $lt_style = "";
-    if ($i%2==1) $lt_style = "margin-left:2%";
+    if ($i%3 !== 0) $lt_style = "margin-left:2%";
     else $lt_style = "";
 ?>
     <div style="float:left;<?php echo $lt_style ?>"  class="lt_wr">

bbs/list.php

@@ -6,7 +6,7 @@ $is_category = false;
 $category_option = '';
 if ($board['bo_use_category']) {
     $is_category = true;
-    $category_href = G5_BBS_URL.'/board.php?bo_table='.$bo_table;
+    $category_href = get_pretty_url($bo_table);
 
     $category_option .= '<li><a href="'.$category_href.'"';
     if ($sca=='')
@@ -17,7 +17,7 @@ if ($board['bo_use_category']) {
     for ($i=0; $i<count($categories); $i++) {
         $category = trim($categories[$i]);
         if ($category=='') continue;
-        $category_option .= '<li><a href="'.($category_href."&amp;sca=".urlencode($category)).'"';
+        $category_option .= '<li><a href="'.(get_pretty_url($bo_table,'','sca='.urlencode($category))).'"';
         $category_msg = '';
         if ($category==$sca) { // 현재 선택된 카테고리라면
             $category_option .= ' id="bo_cate_on"';
@@ -153,10 +153,15 @@ if (!$sst) {
         $sod = "";
     }
 } else {
-    // 게시물 리스트의 정렬 대상 필드가 아니라면 공백으로 (nasca 님 09.06.16)
-    // 리스트에서 다른 필드로 정렬을 하려면 아래의 코드에 해당 필드를 추가하세요.
-    // $sst = preg_match("/^(wr_subject|wr_datetime|wr_hit|wr_good|wr_nogood)$/i", $sst) ? $sst : "";
-    $sst = preg_match("/^(wr_datetime|wr_hit|wr_good|wr_nogood)$/i", $sst) ? $sst : "";
+    $board_sort_fields = get_board_sort_fields($board, 1);
+    if (!$sod && array_key_exists($sst, $board_sort_fields)) {
+        $sst = $board_sort_fields[$sst];
+    } else {
+        // 게시물 리스트의 정렬 대상 필드가 아니라면 공백으로 (nasca 님 09.06.16)
+        // 리스트에서 다른 필드로 정렬을 하려면 아래의 코드에 해당 필드를 추가하세요.
+        // $sst = preg_match("/^(wr_subject|wr_datetime|wr_hit|wr_good|wr_nogood)$/i", $sst) ? $sst : "";
+        $sst = preg_match("/^(wr_datetime|wr_hit|wr_good|wr_nogood)$/i", $sst) ? $sst : "";
+    }
 }
 
 if(!$sst)
@@ -200,13 +205,15 @@ if($page_rows > 0) {
     }
 }
 
-$write_pages = get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $page, $total_page, './board.php?bo_table='.$bo_table.$qstr.'&amp;page=');
+g5_latest_cache_data($board['bo_table'], $list);
+
+$write_pages = get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $page, $total_page, get_pretty_url($bo_table, '', $qstr.'&amp;page='));
 
 $list_href = '';
 $prev_part_href = '';
 $next_part_href = '';
 if ($is_search_bbs) {
-    $list_href = './board.php?bo_table='.$bo_table;
+    $list_href = get_pretty_url($bo_table);
 
     $patterns = array('#&amp;page=[0-9]*#', '#&amp;spt=[0-9\-]*#');
 
@@ -214,14 +221,14 @@ if ($is_search_bbs) {
     $prev_spt = $spt - $config['cf_search_part'];
     if (isset($min_spt) && $prev_spt >= $min_spt) {
         $qstr1 = preg_replace($patterns, '', $qstr);
-        $prev_part_href = './board.php?bo_table='.$bo_table.$qstr1.'&amp;spt='.$prev_spt.'&amp;page=1';
+        $prev_part_href = get_pretty_url($bo_table,0,$qstr1.'&amp;spt='.$prev_spt.'&amp;page=1');
         $write_pages = page_insertbefore($write_pages, '<a href="'.$prev_part_href.'" class="pg_page pg_prev">이전검색</a>');
     }
 
     $next_spt = $spt + $config['cf_search_part'];
     if ($next_spt < 0) {
         $qstr1 = preg_replace($patterns, '', $qstr);
-        $next_part_href = './board.php?bo_table='.$bo_table.$qstr1.'&amp;spt='.$next_spt.'&amp;page=1';
+        $next_part_href = get_pretty_url($bo_table,0,$qstr1.'&amp;spt='.$next_spt.'&amp;page=1');
         $write_pages = page_insertafter($write_pages, '<a href="'.$next_part_href.'" class="pg_page pg_end">다음검색</a>');
     }
 }
@@ -229,7 +236,7 @@ if ($is_search_bbs) {
 
 $write_href = '';
 if ($member['mb_level'] >= $board['bo_write_level']) {
-    $write_href = './write.php?bo_table='.$bo_table;
+    $write_href = short_url_clean(G5_BBS_URL.'/write.php?bo_table='.$bo_table);
 }
 
 $nobr_begin = $nobr_end = "";
@@ -241,7 +248,7 @@ if (preg_match("/gecko|firefox/i", $_SERVER['HTTP_USER_AGENT'])) {
 // RSS 보기 사용에 체크가 되어 있어야 RSS 보기 가능 061106
 $rss_href = '';
 if ($board['bo_use_rss_view']) {
-    $rss_href = './rss.php?bo_table='.$bo_table;
+    $rss_href = G5_BBS_URL.'/rss.php?bo_table='.$bo_table;
 }
 
 $stx = get_text(stripslashes($stx));

bbs/login.php

@@ -31,5 +31,7 @@ if (!file_exists($login_file))
 
 include_once($member_skin_path.'/login.skin.php');
 
+run_event('member_login_tail', $login_url, $login_action_url, $member_skin_path, $url);
+
 include_once('./_tail.sub.php');
 ?>

bbs/login_check.php

@@ -29,7 +29,10 @@ if(function_exists('social_is_login_check')){
 // 가입된 회원이 아니다. 비밀번호가 틀리다. 라는 메세지를 따로 보여주지 않는 이유는
 // 회원아이디를 입력해 보고 맞으면 또 비밀번호를 입력해보는 경우를 방지하기 위해서입니다.
 // 불법사용자의 경우 회원아이디가 틀린지, 비밀번호가 틀린지를 알기까지는 많은 시간이 소요되기 때문입니다.
-if (!$is_social_password_check && (!$mb['mb_id'] || !check_password($mb_password, $mb['mb_password'])) ) {
+if (!$is_social_password_check && (!$mb['mb_id'] || !login_password_check($mb, $mb_password, $mb['mb_password'])) ) {
+
+    run_event('password_is_wrong', 'login', $mb);
+
     alert('가입된 회원아이디가 아니거나 비밀번호가 틀립니다.\\n비밀번호는 대소문자를 구분합니다.');
 }
 
@@ -51,6 +54,8 @@ if ( is_use_email_certify() && !preg_match("/[1-9]/", $mb['mb_email_certify']))
     confirm("{$mb['mb_email']} 메일로 메일인증을 받으셔야 로그인 가능합니다. 다른 메일주소로 변경하여 인증하시려면 취소를 클릭하시기 바랍니다.", G5_URL, G5_BBS_URL.'/register_email.php?mb_id='.$mb_id.'&ckey='.$ckey);
 }
 
+run_event('login_session_before', $mb, $is_social_login);
+
 @include_once($member_skin_path.'/login_check.skin.php');
 
 // 회원아이디 세션 생성
@@ -100,6 +105,8 @@ if ($url) {
         $post_check_keys[] = 'provider';
     }
 
+    $post_check_keys = run_replace('login_check_post_check_keys', $post_check_keys, $link, $is_social_login);
+
     foreach($_POST as $key=>$value) {
         if ($key && !in_array($key, $post_check_keys)) {
             $link .= "$split$key=$value";
@@ -118,5 +125,7 @@ if(function_exists('social_login_success_after')){
     social_login_session_clear(1);
 }
 
+run_event('member_login_check', $mb, $link, $is_social_login);
+
 goto_url($link);
 ?>

bbs/logout.php

@@ -29,10 +29,12 @@ if ($url) {
 
     $link = $url;
 } else if ($bo_table) {
-    $link = G5_BBS_URL.'/board.php?bo_table='.$bo_table;
+    $link = get_pretty_url($bo_table);
 } else {
     $link = G5_URL;
 }
 
+run_event('member_logout', $link);
+
 goto_url($link);
 ?>

bbs/memo.php

@@ -18,12 +18,15 @@ else if ($kind == 'send')
 else
     alert(''.$kind .'값을 넘겨주세요.');
 
-$sql = " select count(*) as cnt from {$g5['memo_table']} where me_{$kind}_mb_id = '{$member['mb_id']}' ";
+if ($page < 1) { $page = 1; } // 페이지가 없으면 첫 페이지 (1 페이지)
+
+run_event('memo_list', $kind, $unkind, $page);
+
+$sql = " select count(*) as cnt from {$g5['memo_table']} where me_{$kind}_mb_id = '{$member['mb_id']}' and me_type = '$kind' ";
 $row = sql_fetch($sql);
 $total_count = $row['cnt'];
 
 $total_page  = ceil($total_count / $config['cf_page_rows']);  // 전체 페이지 계산
-if ($page < 1) { $page = 1; } // 페이지가 없으면 첫 페이지 (1 페이지)
 $from_record = ((int) $page - 1) * $config['cf_page_rows']; // 시작 열을 구함
 
 if ($kind == 'recv')
@@ -44,8 +47,9 @@ $list = array();
 $sql = " select a.*, b.mb_id, b.mb_nick, b.mb_email, b.mb_homepage
             from {$g5['memo_table']} a
             left join {$g5['member_table']} b on (a.me_{$unkind}_mb_id = b.mb_id)
-            where a.me_{$kind}_mb_id = '{$member['mb_id']}'
+            where a.me_{$kind}_mb_id = '{$member['mb_id']}' and a.me_type = '$kind'
             order by a.me_id desc limit $from_record, {$config['cf_page_rows']} ";
+
 $result = sql_query($sql);
 for ($i=0; $row=sql_fetch_array($result); $i++)
 {
@@ -67,6 +71,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
 
     $send_datetime = substr($row['me_send_datetime'],2,14);
 
+    $list[$i]['mb_id'] = $mb_id;
     $list[$i]['name'] = $name;
     $list[$i]['send_datetime'] = $send_datetime;
     $list[$i]['read_datetime'] = $read_datetime;

bbs/memo_delete.php

@@ -15,6 +15,11 @@ $me_id = (int)$_REQUEST['me_id'];
 $sql = " select * from {$g5['memo_table']} where me_id = '{$me_id}' ";
 $row = sql_fetch($sql);
 
+$sql = " delete from {$g5['memo_table']}
+            where me_id = '{$me_id}'
+            and (me_recv_mb_id = '{$member['mb_id']}' or me_send_mb_id = '{$member['mb_id']}') ";
+sql_query($sql);
+
 if (!$row['me_read_datetime'][0]) // 메모 받기전이면
 {
     $sql = " update {$g5['member_table']}
@@ -22,12 +27,12 @@ if (!$row['me_read_datetime'][0]) // 메모 받기전이면
                 where mb_id = '{$row['me_recv_mb_id']}'
                 and mb_memo_call = '{$row['me_send_mb_id']}' ";
     sql_query($sql);
+
+    $sql = " update `{$g5['member_table']}` set mb_memo_cnt = '".get_memo_not_read($member['mb_id'])."' where mb_id = '{$member['mb_id']}' ";
+    sql_query($sql);
 }
 
-$sql = " delete from {$g5['memo_table']}
-            where me_id = '{$me_id}'
-            and (me_recv_mb_id = '{$member['mb_id']}' or me_send_mb_id = '{$member['mb_id']}') ";
-sql_query($sql);
+run_event('memo_delete', $me_id, $row);
 
 goto_url('./memo.php?kind='.$kind);
 ?>

bbs/memo_form_update.php

@@ -13,11 +13,14 @@ $recv_list = explode(',', trim($_POST['me_recv_mb_id']));
 $str_nick_list = '';
 $msg = '';
 $error_list  = array();
-$member_list = array();
+$member_list = array('id'=>array(), 'nick'=>array());
+
+run_event('memo_form_update_before', $recv_list);
+
 for ($i=0; $i<count($recv_list); $i++) {
     $row = sql_fetch(" select mb_id, mb_nick, mb_open, mb_leave_date, mb_intercept_date from {$g5['member_table']} where mb_id = '{$recv_list[$i]}' ");
     if ($row) {
-        if ($is_admin || ($row['mb_open'] && (!$row['mb_leave_date'] || !$row['mb_intercept_date']))) {
+        if ($is_admin || ($row['mb_open'] && (!$row['mb_leave_date'] && !$row['mb_intercept_date']))) {
             $member_list['id'][]   = $row['mb_id'];
             $member_list['nick'][] = $row['mb_nick'];
         } else {
@@ -41,6 +44,10 @@ $error_msg = implode(",", $error_list);
 if ($error_msg && !$is_admin)
     alert("회원아이디 '{$error_msg}' 은(는) 존재(또는 정보공개)하지 않는 회원아이디 이거나 탈퇴, 접근차단된 회원아이디 입니다.\\n쪽지를 발송하지 않았습니다.");
 
+if (! count($member_list['id'])){
+    alert('해당 회원이 존재하지 않습니다.');
+}
+
 if (!$is_admin) {
     if (count($member_list['id'])) {
         $point = (int)$config['cf_memo_send_point'] * count($member_list['id']);
@@ -59,12 +66,22 @@ for ($i=0; $i<count($member_list['id']); $i++) {
     $recv_mb_id   = $member_list['id'][$i];
     $recv_mb_nick = get_text($member_list['nick'][$i]);
 
-    // 쪽지 INSERT
-    $sql = " insert into {$g5['memo_table']} ( me_id, me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime ) values ( '$me_id', '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}', '0000-00-00 00:00:00' ) ";
+    // 받는 회원 쪽지 INSERT
+    $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_type, me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}', '0000-00-00 00:00:00' , 'recv', '{$_SERVER['REMOTE_ADDR']}' ) ";
+
     sql_query($sql);
 
+    if( $me_id = sql_insert_id() ){
+
+        // 보내는 회원 쪽지 INSERT
+        $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_send_id, me_type , me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}', '0000-00-00 00:00:00', '$me_id', 'send', '{$_SERVER['REMOTE_ADDR']}' ) ";
+        sql_query($sql);
+		
+		$member_list['me_id'][$i] = $me_id;
+    }
+
     // 실시간 쪽지 알림 기능
-    $sql = " update {$g5['member_table']} set mb_memo_call = '{$member['mb_id']}' where mb_id = '$recv_mb_id' ";
+    $sql = " update {$g5['member_table']} set mb_memo_call = '{$member['mb_id']}', mb_memo_cnt = '".get_memo_not_read($recv_mb_id)."' where mb_id = '$recv_mb_id' ";
     sql_query($sql);
 
     if (!$is_admin) {
@@ -73,9 +90,19 @@ for ($i=0; $i<count($member_list['id']); $i++) {
 }
 
 if ($member_list) {
+
+    $redirect_url = G5_HTTP_BBS_URL."/memo.php?kind=send";
     $str_nick_list = implode(',', $member_list['nick']);
-    alert($str_nick_list." 님께 쪽지를 전달하였습니다.", G5_HTTP_BBS_URL."/memo.php?kind=send", false);
+
+    run_event('memo_form_update_after', $member_list, $str_nick_list, $redirect_url, $_POST['me_memo']);
+
+    alert($str_nick_list." 님께 쪽지를 전달하였습니다.", $redirect_url, false);
 } else {
-    alert("회원아이디 오류 같습니다.", G5_HTTP_BBS_URL."/memo_form.php", false);
+
+    $redirect_url = G5_HTTP_BBS_URL."/memo_form.php";
+    
+    run_event('memo_form_update_failed', $member_list, $redirect_url, $_POST['me_memo']);
+
+    alert("회원아이디 오류 같습니다.", $redirect_url, false);
 }
 ?>

bbs/memo_view.php

@@ -13,10 +13,13 @@ if ($kind == 'recv')
 
     $sql = " update {$g5['memo_table']}
                 set me_read_datetime = '".G5_TIME_YMDHIS."'
-                where me_id = '$me_id'
+                where (me_id = '$me_id' or me_send_id = '$me_id' )
                 and me_recv_mb_id = '{$member['mb_id']}'
                 and me_read_datetime = '0000-00-00 00:00:00' ";
     sql_query($sql);
+
+    $sql = " update `{$g5['member_table']}` set mb_memo_cnt = '".get_memo_not_read($member['mb_id'])."' where mb_id = '{$member['mb_id']}' ";
+    sql_query($sql);
 }
 else if ($kind == 'send')
 {
@@ -28,40 +31,40 @@ else
     alert($kind.' 값을 넘겨주세요.');
 }
 
-$g5['title'] = $t.' 쪽지 보기';
-include_once(G5_PATH.'/head.sub.php');
-
 $sql = " select * from {$g5['memo_table']}
             where me_id = '$me_id'
             and me_{$kind}_mb_id = '{$member['mb_id']}' ";
 $memo = sql_fetch($sql);
 
-// 이전 쪽지
-$sql = " select * from {$g5['memo_table']}
-            where me_id > '{$me_id}'
-            and me_{$kind}_mb_id = '{$member['mb_id']}'
-            order by me_id asc
-            limit 1 ";
-$prev = sql_fetch($sql);
-if ($prev['me_id'])
-    $prev_link = './memo_view.php?kind='.$kind.'&me_id='.$prev['me_id'];
-else
-    //$prev_link = 'javascript:alert(\'쪽지의 처음입니다.\');';
-    $prev_link = '';
+set_session('ss_memo_delete_token', $token = uniqid(time()));
+$del_link = 'memo_delete.php?me_id='.$memo['me_id'].'&token='.$token.'&kind='.$kind;
 
+$g5['title'] = $t.' 쪽지 보기';
+include_once(G5_PATH.'/head.sub.php');
+
+// 이전 쪽지
+$sql = " select me.*, a.rownum from `{$g5['memo_table']}` as me inner join ( select me_id , (@rownum:=@rownum+1) as rownum from `{$g5['memo_table']}` as memo, (select @rownum:=0) tmp where me_{$kind}_mb_id = '{$member['mb_id']}' and memo.me_type = '$kind' order by me_id desc ) as a on a.me_id = me.me_id where me.me_id < '$me_id' and me.me_{$kind}_mb_id = '{$member['mb_id']}' and me.me_type = '$kind' order by me.me_id desc limit 1 ";
+
+$prev = sql_fetch($sql);
+if ($prev['me_id']) {
+    $prev_link = './memo_view.php?kind='.$kind.'&amp;me_id='.$prev['me_id'];
+    $prev['page']  = ceil( (int)$prev['rownum'] / $config['cf_page_rows']);  // 이동할 페이지 계산
+    if( (int)$prev['page'] > 0 ) $prev_link .= "&amp;page=".$prev['page'];
+} else {
+    $prev_link = '';
+}
 
 // 다음 쪽지
-$sql = " select * from {$g5['memo_table']}
-            where me_id < '{$me_id}'
-            and me_{$kind}_mb_id = '{$member['mb_id']}'
-            order by me_id desc
-            limit 1 ";
+$sql = " select me.*, a.rownum from `{$g5['memo_table']}` as me inner join ( select me_id , (@rownum:=@rownum+1) as rownum from `{$g5['memo_table']}` as memo, (select @rownum:=0) tmp where me_{$kind}_mb_id = '{$member['mb_id']}' and memo.me_type = '$kind' order by me_id asc ) as a on a.me_id = me.me_id where me.me_id > '$me_id' and me.me_{$kind}_mb_id = '{$member['mb_id']}' and me.me_type = '$kind' order by me.me_id asc limit 1 ";
+
 $next = sql_fetch($sql);
-if ($next['me_id'])
+if ($next['me_id']) {
     $next_link = './memo_view.php?kind='.$kind.'&amp;me_id='.$next['me_id'];
-else
-    //$next_link = 'javascript:alert(\'쪽지의 마지막입니다.\');';
+    $next['page']  = ceil( (int)$next['rownum'] / $config['cf_page_rows']);  // 이동할 페이지 계산
+    if( (int)$next['page'] > 0 ) $next_link .= "&amp;page=".$next['page'];
+} else {
     $next_link = '';
+}
 
 $mb = get_member($memo['me_'.$unkind.'_mb_id']);
 

bbs/move.php

@@ -156,5 +156,6 @@ function fboardmoveall_submit(f)
 </script>
 
 <?php
+run_event('move_html_footer');
 include_once(G5_PATH.'/tail.sub.php');
 ?>

bbs/move_update.php

@@ -27,6 +27,8 @@ $sql = " select distinct wr_num from $write_table where wr_id in ({$wr_id_list})
 $result = sql_query($sql);
 while ($row = sql_fetch_array($result))
 {
+    $save[$cnt]['wr_contents'] = array();
+
     $wr_num = $row['wr_num'];
     for ($i=0; $i<count($_POST['chk_bo_table']); $i++)
     {
@@ -52,6 +54,8 @@ while ($row = sql_fetch_array($result))
         $result2 = sql_query($sql2);
         while ($row2 = sql_fetch_array($result2))
         {
+            $save[$cnt]['wr_contents'][] = $row2['wr_content'];
+
             $nick = cut_str($member['mb_nick'], $config['cf_cut_name']);
             if (!$row2['wr_is_comment'] && $config['cf_use_copy_log']) {
                 if(strstr($row2['wr_option'], 'html')) {
@@ -126,8 +130,13 @@ while ($row = sql_fetch_array($result))
                         // 원본파일을 복사하고 퍼미션을 변경
                         // 제이프로님 코드제안 적용
                         $copy_file_name = ($bo_table !== $move_bo_table) ? $row3['bf_file'] : $row2['wr_id'].'_copy_'.$insert_id.'_'.$row3['bf_file'];
-                        @copy($src_dir.'/'.$row3['bf_file'], $dst_dir.'/'.$copy_file_name);
-                        @chmod($dst_dir.'/'.$copy_file_name, G5_FILE_PERMISSION);
+                        $is_exist_file = is_file($src_dir.'/'.$row3['bf_file']) && file_exists($src_dir.'/'.$row3['bf_file']);
+                        if( $is_exist_file ){
+                            @copy($src_dir.'/'.$row3['bf_file'], $dst_dir.'/'.$copy_file_name);
+                            @chmod($dst_dir.'/'.$row3['bf_file'], G5_FILE_PERMISSION);
+                        }
+
+                        $row3 = run_replace('bbs_move_update_file', $row3, $copy_file_name, $bo_table, $move_bo_table, $insert_id);
                     }
 
                     $sql = " insert into {$g5['board_file_table']}
@@ -138,6 +147,9 @@ while ($row = sql_fetch_array($result))
                                      bf_file = '$copy_file_name',
                                      bf_download = '{$row3['bf_download']}',
                                      bf_content = '".addslashes($row3['bf_content'])."',
+                                     bf_fileurl = '".addslashes($row3['bf_fileurl'])."',
+                                     bf_thumburl = '".addslashes($row3['bf_thumburl'])."',
+                                     bf_storage = '".addslashes($row3['bf_storage'])."',
                                      bf_filesize = '{$row3['bf_filesize']}',
                                      bf_width = '{$row3['bf_width']}',
                                      bf_height = '{$row3['bf_height']}',
@@ -184,6 +196,8 @@ while ($row = sql_fetch_array($result))
 
         sql_query(" update {$g5['board_table']} set bo_count_write = bo_count_write + '$count_write' where bo_table = '$move_bo_table' ");
         sql_query(" update {$g5['board_table']} set bo_count_comment = bo_count_comment + '$count_comment' where bo_table = '$move_bo_table' ");
+        
+        run_event('bbs_move_copy', $row2, $move_bo_table, $insert_id, $next_wr_num, $sw);
 
         delete_cache_latest($move_bo_table);
     }
@@ -200,12 +214,20 @@ if ($sw == 'move')
     {
         if( isset($save[$i]['bf_file']) && $save[$i]['bf_file'] ){
             for ($k=0; $k<count($save[$i]['bf_file']); $k++) {
-                @unlink($save[$i]['bf_file'][$k]);
+                $del_file = run_replace('delete_file_path', clean_relative_paths($save[$i]['bf_file'][$k]), $save[$i]);
 
+                if ( is_file($del_file) && file_exists($del_file) ){
+                    @unlink($del_file);
+                }
+                
                 // 썸네일 파일 삭제, 먼지손 님 코드 제안
                 delete_board_thumbnail($bo_table, basename($save[$i]['bf_file'][$k]));
             }
         }
+        
+        for ($k=0; $k<count($save[$i]['wr_contents']); $k++){
+            delete_editor_thumbnail($save[$i]['wr_contents'][$k]);
+        }
 
         sql_query(" delete from $write_table where wr_parent = '{$save[$i]['wr_id']}' ");
         sql_query(" delete from {$g5['board_new_table']} where bo_table = '$bo_table' and wr_id = '{$save[$i]['wr_id']}' ");
@@ -215,9 +237,11 @@ if ($sw == 'move')
 }
 
 $msg = '해당 게시물을 선택한 게시판으로 '.$act.' 하였습니다.';
-$opener_href  = './board.php?bo_table='.$bo_table.'&amp;page='.$page.'&amp;'.$qstr;
+$opener_href  = get_pretty_url($bo_table,'','&amp;page='.$page.'&amp;'.$qstr);
 $opener_href1 = str_replace('&amp;', '&', $opener_href);
 
+run_event('bbs_move_update', $bo_table, $chk_bo_table, $wr_id_list, $opener_href);
+
 echo <<<HEREDOC
 <meta http-equiv="content-type" content="text/html; charset=utf-8">
 <script>

bbs/new.php

@@ -99,7 +99,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
     $list[$i]['bo_table'] = $row['bo_table'];
     $list[$i]['name'] = $name;
     $list[$i]['comment'] = $comment;
-    $list[$i]['href'] = './board.php?bo_table='.$row['bo_table'].'&wr_id='.$row2['wr_id'].$comment_link;
+    $list[$i]['href'] = get_pretty_url($row['bo_table'], $row2['wr_id'], $comment_link);
     $list[$i]['datetime'] = $datetime;
     $list[$i]['datetime2'] = $datetime2;
 
@@ -113,4 +113,4 @@ $write_pages = get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['c
 include_once($new_skin_path.'/new.skin.php');
 
 include_once('./_tail.php');
-?>
+?>

bbs/new_delete.php

@@ -8,24 +8,25 @@ if ($is_admin != 'super')
 
 $board = array();
 $save_bo_table = array();
+$save_wr_id = array();
 
 for($i=0;$i<count($_POST['chk_bn_id']);$i++)
 {
     // 실제 번호를 넘김
     $k = $_POST['chk_bn_id'][$i];
 
-    $bo_table = $_POST['bo_table'][$k];
-    $wr_id    = $_POST['wr_id'][$k];
+    $bo_table = isset($_POST['bo_table'][$k]) ? preg_replace('/[^a-z0-9_]/i', '', $_POST['bo_table'][$k]) : '';
+    $wr_id    = isset($_POST['wr_id'][$k]) ? preg_replace('/[^0-9]/i', '', $_POST['wr_id'][$k]) : 0;
 
-    $save_bo_table[] = $bo_table;
+    $save_bo_table[$i] = $bo_table;
+	$save_wr_id[$i] = $wr_id;
 
     $write_table = $g5['write_prefix'].$bo_table;
 
     if ($board['bo_table'] != $bo_table)
         $board = sql_fetch(" select bo_subject, bo_write_point, bo_comment_point, bo_notice from {$g5['board_table']} where bo_table = '$bo_table' ");
 
-    $sql = " select * from $write_table where wr_id = '$wr_id' ";
-    $write = sql_fetch($sql);
+    $write = get_write($write_table, $wr_id);
     if (!$write) continue;
 
     // 원글 삭제
@@ -138,10 +139,11 @@ for($i=0;$i<count($_POST['chk_bn_id']);$i++)
     }
 }
 
-$save_bo_table = array_unique($save_bo_table);
 foreach ($save_bo_table as $key=>$value) {
     delete_cache_latest($value);
 }
 
+run_event('bbs_new_delete', $chk_bn_id, $save_bo_table, $save_wr_id);
+
 goto_url("new.php?sfl=$sfl&stx=$stx&page=$page");
 ?>

bbs/password.php

@@ -3,38 +3,42 @@ include_once('./_common.php');
 
 $g5['title'] = '비밀번호 입력';
 
+if( isset($comment_id) ){
+    $comment_id = (int) $comment_id;
+}
+
 switch ($w) {
     case 'u' :
         $action = G5_HTTP_BBS_URL.'/write.php';
-        $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id;
+        $return_url = short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id);
         break;
     case 'd' :
         set_session('ss_delete_token', $token = uniqid(time()));
         $action = https_url(G5_BBS_DIR).'/delete.php?token='.$token;
-        $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id;
+        $return_url = short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id);
         break;
     case 'x' :
         set_session('ss_delete_comment_'.$comment_id.'_token', $token = uniqid(time()));
         $action = https_url(G5_BBS_DIR).'/delete_comment.php?token='.$token;
         $row = sql_fetch(" select wr_parent from $write_table where wr_id = '$comment_id' ");
-        $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$row['wr_parent'];
+        $return_url = short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$row['wr_parent']);
         break;
     case 's' :
         // 비밀번호 창에서 로그인 하는 경우 관리자 또는 자신의 글이면 바로 글보기로 감
         if ($is_admin || ($member['mb_id'] == $write['mb_id'] && $write['mb_id']))
-            goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id);
+            goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id));
         else {
             $action = https_url(G5_BBS_DIR).'/password_check.php';
-            $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table;
+            $return_url = short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table);
         }
         break;
     case 'sc' :
         // 비밀번호 창에서 로그인 하는 경우 관리자 또는 자신의 글이면 바로 글보기로 감
         if ($is_admin || ($member['mb_id'] == $write['mb_id'] && $write['mb_id']))
-            goto_url(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id);
+            goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id));
         else {
             $action = https_url(G5_BBS_DIR).'/password_check.php';
-            $return_url = G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id;
+            $return_url = short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id);
         }
         break;
     default :

bbs/password_check.php

@@ -6,8 +6,16 @@ if ($w == 's') {
 
     $wr = get_write($write_table, $wr_id);
 
-    if (!check_password($wr_password, $wr['wr_password']))
+    if( !$wr['wr_password'] && $wr['mb_id'] ){
+        if ( $mb = get_member($wr['mb_id']) ){
+            $wr['wr_password'] = $mb['mb_password'];
+        }
+    }
+
+    if (!check_password($wr_password, $wr['wr_password'])) {
+        run_event('password_is_wrong', 'bbs', $wr, $qstr);
         alert('비밀번호가 틀립니다.');
+    }
 
     // 세션에 아래 정보를 저장. 하위번호는 비밀번호없이 보아야 하기 때문임.
     //$ss_name = 'ss_secret.'_'.$bo_table.'_'.$wr_id';
@@ -20,8 +28,16 @@ if ($w == 's') {
 
     $wr = get_write($write_table, $wr_id);
 
-    if (!check_password($wr_password, $wr['wr_password']))
+    if( !$wr['wr_password'] && $wr['mb_id'] ){
+        if ( $mb = get_member($wr['mb_id']) ){
+            $wr['wr_password'] = $mb['mb_password'];
+        }
+    }
+
+    if (!check_password($wr_password, $wr['wr_password'])){
+        run_event('password_is_wrong', 'bbs', $wr, $qstr);
         alert('비밀번호가 틀립니다.');
+    }
 
     // 세션에 아래 정보를 저장. 하위번호는 비밀번호없이 보아야 하기 때문임.
     $ss_name = 'ss_secret_comment_'.$bo_table.'_'.$wr['wr_id'];
@@ -31,5 +47,5 @@ if ($w == 's') {
 } else
     alert('w 값이 제대로 넘어오지 않았습니다.');
 
-goto_url(G5_HTTP_BBS_URL.'/board.php?'.$qstr);
+goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?'.$qstr));
 ?>

bbs/password_lost2.php

@@ -71,5 +71,7 @@ $content .= '</div>';
 
 mailer($config['cf_admin_email_name'], $config['cf_admin_email'], $mb['mb_email'], $subject, $content, 1);
 
+run_event('password_lost2_after', $mb, $mb_nonce, $mb_lost_certify);
+
 alert_close($email.' 메일로 회원아이디와 비밀번호를 인증할 수 있는 메일이 발송 되었습니다.\\n\\n메일을 확인하여 주십시오.');
 ?>

bbs/password_lost_certify.php

@@ -4,9 +4,11 @@ include_once('./_common.php');
 // 봇의 메일 링크 크롤링을 방지합니다.
 if(function_exists('check_mail_bot')){ check_mail_bot($_SERVER['REMOTE_ADDR']); }
 
+run_event('password_lost_certify_before');
+
 // 오류시 공히 Error 라고 처리하는 것은 회원정보가 있는지? 비밀번호가 틀린지? 를 알아보려는 해킹에 대비한것
 
-$mb_no = trim($_GET['mb_no']);
+$mb_no = preg_replace('#[^0-9]#', '', trim($_GET['mb_no']));
 $mb_nonce = trim($_GET['mb_nonce']);
 
 // 회원아이디가 아닌 회원고유번호로 회원정보를 구한다.
@@ -22,6 +24,9 @@ sql_query(" update {$g5['member_table']} set mb_lost_certify = '' where mb_no =
 if ($mb_nonce === substr($mb['mb_lost_certify'], 0, 32)) {
     $new_password_hash = substr($mb['mb_lost_certify'], 33);
     sql_query(" update {$g5['member_table']} set mb_password = '$new_password_hash' where mb_no = '$mb_no' ");
+
+    run_event('password_lost_certify_after', $mb, $mb_nonce);
+
     alert('비밀번호가 변경됐습니다.\\n\\n회원아이디와 변경된 비밀번호로 로그인 하시기 바랍니다.', G5_BBS_URL.'/login.php');
 }
 else {

bbs/profile.php

@@ -7,7 +7,10 @@ if (!$member['mb_id'])
 if (!$member['mb_open'] && $is_admin != 'super' && $member['mb_id'] != $mb_id)
     alert_close('자신의 정보를 공개하지 않으면 다른분의 정보를 조회할 수 없습니다.\\n\\n정보공개 설정은 회원정보수정에서 하실 수 있습니다.');
 
+$mb_id = isset($mb_id) ? $mb_id : '';
+
 $mb = get_member($mb_id);
+
 if (!$mb['mb_id'])
     alert_close('회원정보가 존재하지 않습니다.\\n\\n탈퇴하였을 수 있습니다.');
 

bbs/qadownload.php

@@ -22,21 +22,26 @@ if($is_guest) {
 
 $filepath = G5_DATA_PATH.'/qa/'.$file['qa_file'.$no];
 $filepath = addslashes($filepath);
-if (!is_file($filepath) || !file_exists($filepath))
+$file_exist_check = (!is_file($filepath) || !file_exists($filepath)) ? false : true;
+
+if ( false === run_replace('qa_download_file_exist_check', $file_exist_check, $file) ){
     alert('파일이 존재하지 않습니다.');
+}
 
 $g5['title'] = '다운로드 > '.conv_subject($file['qa_subject'], 255);
 
+run_event('qa_download_file_header', $file, $file_exist_check);
+
 $original = urlencode($file['qa_source'.$no]);
 
 if(preg_match("/msie/i", $_SERVER['HTTP_USER_AGENT']) && preg_match("/5\.5/", $_SERVER['HTTP_USER_AGENT'])) {
     header("content-type: doesn/matter");
-    header("content-length: ".filesize("$filepath"));
+    header("content-length: ".filesize($filepath));
     header("content-disposition: attachment; filename=\"$original\"");
     header("content-transfer-encoding: binary");
 } else {
     header("content-type: file/unknown");
-    header("content-length: ".filesize("$filepath"));
+    header("content-length: ".filesize($filepath));
     header("content-disposition: attachment; filename=\"$original\"");
     header("content-description: php generated data");
 }

bbs/qaview.php

@@ -155,7 +155,8 @@ if(is_file($skin_file)) {
 
     for ($i=1; $i<=2; $i++) {
         if(preg_match("/\.({$config['cf_image_extension']})$/i", $view['qa_file'.$i])) {
-            $view['img_file'][] = '<a href="'.G5_BBS_URL.'/view_image.php?fn='.urlencode('/data/qa/'.$view['qa_file'.$i]).'" target="_blank" class="view_image"><img src="'.G5_DATA_URL.'/qa/'.$view['qa_file'.$i].'"></a>';
+            $attr_href = run_replace('thumb_view_image_href', G5_BBS_URL.'/view_image.php?fn='.urlencode('/'.G5_DATA_DIR.'/qa/'.$view['qa_file'.$i]), '/'.G5_DATA_DIR.'/qa/'.$view['qa_file'.$i], '', '', '', '');
+            $view['img_file'][] = '<a href="'.$attr_href.'" target="_blank" class="view_image"><img src="'.G5_DATA_URL.'/qa/'.$view['qa_file'.$i].'"></a>';
             $view['img_count']++;
             continue;
         }

bbs/qawrite_update.php

@@ -14,6 +14,7 @@ $msg = array();
 
 // 1:1문의 설정값
 $qaconfig = get_qa_config();
+$qa_id = isset($qa_id) ? (int) $qa_id : 0;
 
 if(trim($qaconfig['qa_category'])) {
     if($w != 'a') {
@@ -317,6 +318,8 @@ if($w == '' || $w == 'a' || $w == 'r') {
     sql_query($sql);
 }
 
+run_event('qawrite_update', $qa_id, $write, $w, $qaconfig);
+
 // SMS 알림
 if($config['cf_sms_use'] == 'icode' && $qaconfig['qa_use_sms']) {
     if($config['cf_sms_type'] == 'LMS') {