버전 5.6.17 수정

[#42] fix: sms5 TABLE 생성 및 패치 시 G5_TABLE_PREFIX 사용

SECURITY.md

@@ -0,0 +1,3 @@
+# Gnuboard5 Security Policy
+
+Please ask [https://sir.kr/security/.](https://sir.kr/co_qa)

adm/admin.lib.php

@@ -554,9 +554,18 @@ function admin_check_xss_params($params)
 
         if (is_array($value)) {
             admin_check_xss_params($value);
-        } else if ((preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/(onload|onerror)=.*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || (preg_match('/(onload|onerror|focus)=.*/ius', $value) && preg_match('/(eval|expression|exec|prompt)(\s*)\((.*)\)/ius', $value))) {
+        } else if (
+            (preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/on[a-z]+=*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || 
+            (preg_match('/(on[a-z]+|focus)=.*/ius', $value) && preg_match('/(eval|atob|fetch|expression|exec|prompt)(\s*)\((.*)\)/ius', $value))) {
             alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.', G5_URL);
             die();
+        } else if (preg_match('/atob\s*\(\s*[\'"]?([a-zA-Z0-9+\/=]+)[\'"]?\s*\)/ius', $value, $matches)) {
+            $decoded = base64_decode($matches[1], true);
+            if ($decoded && preg_match('/(eval|fetch|script|alert|settimeout|setinterval)/ius', $decoded)) {
+                // error_log("Base64 XSS 시도 감지: key=$key, decoded=$decoded, IP=" . $_SERVER['REMOTE_ADDR']);
+                alert('Base64로 인코딩된 위험한 스크립트가 발견되었습니다.', G5_URL);
+                die();
+            }
         }
     }
 

adm/board_form.php

@@ -1439,7 +1439,7 @@ function frm_check_file(){
 
         return false;
     } else {
-        jQuery("#admin_captcha_box").hide();
+        // jQuery("#admin_captcha_box").hide();
     }
 
     return true;
@@ -1447,12 +1447,12 @@ function frm_check_file(){
 
 jQuery(function($){
     if( window.self !== window.top ){   // frame 또는 iframe을 사용할 경우 체크
-        $("#bo_include_head, #bo_include_tail").on("change paste keyup", function(e) {
-            frm_check_file();
-        });
-
         use_captcha_check();
     }
+    
+    $("#bo_include_head, #bo_include_tail").on("change paste keyup", function(e) {
+        frm_check_file();
+    });
 });
 
 function fboardform_submit(f)
@@ -1487,10 +1487,14 @@ function fboardform_submit(f)
         return false;
     }
 
+    if (frm_check_file() == false) {
+        jQuery(window).scrollTop($('#bo_include_tail').offset().top - 30);
+    }
+    
     if( captcha_chk ) {
         <?php echo isset($captcha_js) ? $captcha_js : ''; // 캡챠 사용시 자바스크립트에서 입력된 캡챠를 검사함  ?>
     }
-
+    
     return true;
 }
 </script>

adm/board_form_update.php

@@ -36,10 +36,24 @@ if ($w == '' && in_array($bo_table, get_bo_table_banned_word())) {
 $bo_include_head = isset($_POST['bo_include_head']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['bo_include_head'], 0, 255)) : '';
 $bo_include_tail = isset($_POST['bo_include_tail']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['bo_include_tail'], 0, 255)) : '';
 
-// 관리자가 자동등록방지를 사용해야 할 경우
-if ($board && (isset($board['bo_include_head']) && $board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()) {
-    include_once(G5_CAPTCHA_PATH . '/captcha.lib.php');
+$check_captcha = false;
 
+// 관리자가 자동등록방지 CAPTCHA를 사용해야 할 경우
+if ($w === 'u') {
+    if (isset($board['bo_include_head'], $board['bo_include_tail']) &&
+        ($board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail)) {
+        $check_captcha = true;
+    }
+} elseif ($w === '') {
+    if ($bo_include_head !== '_head.php' || $bo_include_tail !== '_tail.php') {
+        $check_captcha = true;
+    }
+}
+
+// 실제 CAPTCHA 검증
+if ($check_captcha) {
+    include_once(G5_CAPTCHA_PATH . '/captcha.lib.php');
+    
     if (!chk_captcha()) {
         alert('자동등록방지 숫자가 틀렸습니다.');
     }

adm/config_form.php

@@ -411,9 +411,17 @@ if (!isset($config['cf_cert_kg_mid'])) {
 }
 if (!isset($config['cf_cert_use_seed'])) {
     $sql = "ALTER TABLE `{$g5['config_table']}` 
-            ADD COLUMN `cf_cert_use_seed` TINYINT(4) NOT NULL DEFAULT '0' AFTER `cf_cert_kg_mid`; ";
+            ADD COLUMN `cf_cert_use_seed` TINYINT(4) NOT NULL DEFAULT '1' AFTER `cf_cert_kg_mid`; ";
     sql_query($sql, false);
 }
+if (!isset($config['cf_cert_kcp_enckey'])) {
+    $sql = "ALTER TABLE `{$g5['config_table']}` 
+            ADD COLUMN `cf_cert_kcp_enckey` VARCHAR(100) NOT NULL DEFAULT '' AFTER `cf_cert_kcp_cd`; ";
+    sql_query($sql, false);
+    
+    $config['cf_cert_kcp_enckey'] = '';
+}
+
 if (!$config['cf_faq_skin']) {
     $config['cf_faq_skin'] = "basic";
 }
@@ -1066,6 +1074,13 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                             <input type="text" name="cf_cert_kcp_cd" value="<?php echo get_sanitize_input($config['cf_cert_kcp_cd']); ?>" id="cf_cert_kcp_cd" class="frm_input" size="3"> <a href="http://sir.kr/main/service/p_cert.php" target="_blank" class="btn_frmline">NHN KCP 휴대폰 본인확인 서비스 신청페이지</a>
                         </td>
                     </tr>
+                    <tr>
+                        <th scope="row" class="cf_cert_service"><label for="cf_cert_kcp_enckey">NHN KCP 가맹점 인증키</label></th>
+                        <td class="cf_cert_service">
+                            <?php echo help('(선택사항, 추후 NHN_KCP 상점관리자에서 인증키 발급 메뉴 오픈일정 이후부터 적용되는 내용입니다.)<br>NHN_KCP 상점관리자 > 기술관리센터 > 인증센터 > 가맹점 인증키관리 에서 인증키 발급 후에 인증키 정보를 입력') ?>
+                            <input type="text" name="cf_cert_kcp_enckey" value="<?php echo get_sanitize_input($config['cf_cert_kcp_enckey']); ?>" id="cf_cert_kcp_enckey" class="frm_input" maxlength="100" size="40"> <a href="https://partner.kcp.co.kr" target="_blank" class="btn_frmline">NHN KCP 상점관리자</a>
+                        </td>
+                    </tr>
                     <tr>
                         <th scope="row" class="cf_cert_service"><label for="cf_cert_limit">본인확인 이용제한</label></th>
                         <td class="cf_cert_service">
@@ -1542,7 +1557,17 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
             </table>
         </div>
     </section>
-
+    
+    <div id="config_captcha_wrap" style="display:none">
+        <h2>캡챠입력</h2>
+        <?php
+        require_once G5_CAPTCHA_PATH . '/captcha.lib.php';
+        $captcha_html = captcha_html();
+        $captcha_js   = chk_captcha_js();
+        echo $captcha_html;
+        ?>
+    </div>
+    
     <div class="btn_fixed_top btn_confirm">
         <input type="submit" value="확인" class="btn_submit btn" accesskey="s">
     </div>
@@ -1614,10 +1639,61 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
         });
     });
 
+    // 각 요소의 초기값 저장
+    var initialValues = {
+        cf_admin: $('#cf_admin').val(),
+        cf_analytics: $('#cf_analytics').val(),
+        cf_add_meta: $('#cf_add_meta').val(),
+        cf_add_script: $('#cf_add_script').val()
+    };
+
+    function check_config_captcha_open() {
+        var isChanged = false;
+
+        // 현재 값이 있는 경우에만 변경 여부 체크
+        if ($('#cf_admin').val()) {
+            isChanged = isChanged || $('#cf_admin').val() !== initialValues.cf_admin;
+        }
+        if ($('#cf_analytics').val()) {
+            isChanged = isChanged || $('#cf_analytics').val() !== initialValues.cf_analytics;
+        }
+        if ($('#cf_add_meta').val()) {
+            isChanged = isChanged || $('#cf_add_meta').val() !== initialValues.cf_add_meta;
+        }
+        if ($('#cf_add_script').val()) {
+            isChanged = isChanged || $('#cf_add_script').val() !== initialValues.cf_add_script;
+        }
+        
+        var $wrap = $("#config_captcha_wrap"),
+            tooptipid = "mp_captcha_tooltip",
+            $p_text = $("<p>", {id:tooptipid, style:"font-size:0.95em;letter-spacing:-0.1em"}).html("중요정보를 수정할 경우 캡챠를 입력해야 합니다."),
+            $children = $wrap.children(':first'),
+            is_invisible_recaptcha = $("#captcha").hasClass("invisible_recaptcha");
+
+        if(isChanged){
+            $wrap.show();
+            if(! is_invisible_recaptcha) {
+                $wrap.css("margin-top","1em");
+                if(! $("#"+tooptipid).length){ $children.after($p_text) }
+            }
+        } else {
+            $wrap.hide();
+            if($("#"+tooptipid).length && ! is_invisible_recaptcha){ $children.next("#"+tooptipid).remove(); }
+        }
+        
+        return isChanged;
+    }
+        
     function fconfigform_submit(f) {
         var current_user_ip = "<?php echo $_SERVER['REMOTE_ADDR']; ?>";
         var cf_intercept_ip_val = f.cf_intercept_ip.value;
-
+        
+        if (check_config_captcha_open()){
+            jQuery("html, body").scrollTop(jQuery("#config_captcha_wrap").offset().top);
+            
+            <?php echo $captcha_js; // 캡챠 사용시 자바스크립트에서 입력된 캡챠를 검사함 ?>
+        }
+        
         if (cf_intercept_ip_val && current_user_ip) {
             var cf_intercept_ips = cf_intercept_ip_val.split("\n");
 
@@ -1638,6 +1714,22 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
         f.action = "./config_form_update.php";
         return true;
     }
+    
+    jQuery(function($){
+        $("#captcha_key").prop('required', false).removeAttr("required").removeClass("required");
+        
+        // 최고관리자 변경시
+        $(document).on('change', '#cf_admin', check_config_captcha_open);
+
+        // 방문자분석 스크립트 변경시
+        $(document).on('input', '#cf_analytics', check_config_captcha_open);
+        
+        // 추가 메타태그 변경시
+        $(document).on('input', '#cf_add_meta', check_config_captcha_open);
+        
+        // 추가 script, css 변경시
+        $(document).on('input', '#cf_add_script', check_config_captcha_open);
+    });
 </script>
 
 <?php
@@ -1669,16 +1761,19 @@ if ($config['cf_cert_use']) {
 
     // kcp일 때
     if ($config['cf_cert_hp'] == 'kcp') {
+        
+        $bin_path = ((int)$config['cf_cert_use'] === 2 && !$config['cf_cert_kcp_enckey']) ? 'bin_old' : 'bin';
+        
         if (strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
             if (PHP_INT_MAX == 2147483647) { // 32-bit
-                $exe = G5_KCPCERT_PATH . '/bin/ct_cli';
+                $exe = G5_KCPCERT_PATH . '/'.$bin_path.'/ct_cli';
             } else {
-                $exe = G5_KCPCERT_PATH . '/bin/ct_cli_x64';
+                $exe = G5_KCPCERT_PATH . '/'.$bin_path.'/ct_cli_x64';
             }
         } else {
-            $exe = G5_KCPCERT_PATH . '/bin/ct_cli_exe.exe';
+            $exe = G5_KCPCERT_PATH . '/'.$bin_path.'/ct_cli_exe.exe';
         }
-
+        
         echo module_exec_check($exe, 'ct_cli');
     }
 

adm/config_form_update.php

@@ -10,9 +10,11 @@ if ($is_admin != 'super') {
     alert('최고관리자만 접근 가능합니다.');
 }
 
+$sql = " select * from {$g5['config_table']} limit 1";
+$ori_config = sql_fetch($sql);
+
 $cf_title = isset($_POST['cf_title']) ? strip_tags(clean_xss_attributes($_POST['cf_title'])) : '';
 $cf_admin = isset($_POST['cf_admin']) ? clean_xss_tags($_POST['cf_admin'], 1, 1) : '';
-$posts = array();
 
 $mb = get_member($cf_admin);
 
@@ -24,15 +26,15 @@ check_admin_token();
 
 $cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',', $_POST['cf_social_servicelist']) : '';
 
-$check_keys = array('cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret', 'cf_cert_kg_cd', 'cf_cert_kg_mid');
+$check_keys = array('cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_cert_kcp_enckey', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret', 'cf_cert_kg_cd', 'cf_cert_kg_mid');
 
 foreach ($check_keys as $key) {
     if (isset($_POST[$key]) && $_POST[$key]) {
-        $posts[$key] = $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
+        $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
     }
 }
 
-$posts['cf_icode_server_port'] = $_POST['cf_icode_server_port'] = isset($_POST['cf_icode_server_port']) ? preg_replace('/[^0-9]/', '', $_POST['cf_icode_server_port']) : '7295';
+$_POST['cf_icode_server_port'] = isset($_POST['cf_icode_server_port']) ? preg_replace('/[^0-9]/', '', $_POST['cf_icode_server_port']) : '7295';
 
 if (isset($_POST['cf_intercept_ip']) && $_POST['cf_intercept_ip']) {
     $pattern = explode("\n", trim($_POST['cf_intercept_ip']));
@@ -165,12 +167,12 @@ for ($i = 1; $i <= 10; $i++) {
 
 foreach ($check_keys as $k => $v) {
     if ($v === 'int') {
-        $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? (int) $_POST[$k] : 0;
+        $_POST[$k] = isset($_POST[$k]) ? (int) $_POST[$k] : 0;
     } else {
         if (in_array($k, array('cf_analytics', 'cf_add_meta', 'cf_add_script', 'cf_stipulation', 'cf_privacy'))) {
-            $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? $_POST[$k] : '';
+            $_POST[$k] = isset($_POST[$k]) ? $_POST[$k] : '';
         } else {
-            $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? strip_tags(clean_xss_attributes($_POST[$k])) : '';
+            $_POST[$k] = isset($_POST[$k]) ? strip_tags(clean_xss_attributes($_POST[$k])) : '';
         }
     }
 }
@@ -181,9 +183,36 @@ if ($_POST['cf_cert_use'] && !$_POST['cf_cert_ipin'] && !$_POST['cf_cert_hp'] &&
 }
 
 if (!$_POST['cf_cert_use']) {
-    $posts[$key] = $_POST['cf_cert_ipin'] = '';
-    $posts[$key] = $_POST['cf_cert_hp'] = '';
-    $posts[$key] = $_POST['cf_cert_simple'] = '';
+    $_POST['cf_cert_ipin'] = '';
+    $_POST['cf_cert_hp'] = '';
+   $_POST['cf_cert_simple'] = '';
+}
+
+// 관리자가 자동등록방지를 사용해야 할 경우 ( 기본환경설정에서 최고관리자, 방문자분석 스크립트, 추가 메타태그, 추가 script, css 변경시 )
+$check_captcha = 0;
+
+if ($cf_admin && $ori_config['cf_admin'] !== $cf_admin) {
+    $check_captcha = 1;
+}
+
+if ($_POST['cf_analytics'] && $ori_config['cf_analytics'] !== stripslashes($_POST['cf_analytics'])) {
+    $check_captcha = 1;
+}
+
+if ($_POST['cf_add_meta'] && $ori_config['cf_add_meta'] !== stripslashes($_POST['cf_add_meta'])) {
+    $check_captcha = 1;
+}
+
+if ($_POST['cf_add_script'] && $ori_config['cf_add_script'] !== stripslashes($_POST['cf_add_script'])) {
+    $check_captcha = 1;
+}
+
+if ($check_captcha) {
+    include_once(G5_CAPTCHA_PATH . '/captcha.lib.php');
+
+    if (!chk_captcha()) {
+        alert('자동등록방지 숫자가 틀렸습니다.');
+    }
 }
 
 $sql = " update {$g5['config_table']}
@@ -290,6 +319,7 @@ $sql = " update {$g5['config_table']}
                 cf_cert_kg_mid = '" . trim($_POST['cf_cert_kg_mid']) . "',
                 cf_cert_kcb_cd = '{$_POST['cf_cert_kcb_cd']}',
                 cf_cert_kcp_cd = '{$_POST['cf_cert_kcp_cd']}',
+                cf_cert_kcp_enckey = '{$_POST['cf_cert_kcp_enckey']}',
                 cf_cert_limit = '{$_POST['cf_cert_limit']}',
                 cf_cert_req = '{$_POST['cf_cert_req']}',
                 cf_sms_use = '{$_POST['cf_sms_use']}',
@@ -346,6 +376,10 @@ if (isset($_POST['cf_bbs_rewrite'])) {
     g5_delete_all_cache();
 }
 
+if (function_exists('get_admin_captcha_by')) {
+    get_admin_captcha_by('remove');
+}
+
 run_event('admin_config_form_update');
 
 update_rewrite_rules();

adm/css/admin.css

@@ -624,6 +624,7 @@ a.lg_btn{display:inline-block;margin:5px 0 0;padding:5px 10px;background:#ED008C
 a.kg_btn{display:inline-block;margin:5px 0 0;padding:5px 10px;background:#4A2C7C;color:#fff;font-weight:normal;text-decoration:none}
 a.kakao_btn{display:inline-block;margin:5px 0 0;padding:5px 10px;background:#FDDC2F;color:#3B1E1E;font-weight:normal;text-decoration:none}
 a.naver_btn {display:inline-block;margin:5px 0 0;padding:5px 10px;background:#00C73C;color:#fff;font-weight:normal;text-decoration:none}
+a.nicepay_btn{display:inline-block;margin:5px 0 0;padding:5px 10px;background:#0057bf;color:#fff;font-weight:normal;text-decoration:none}
 
 .scf_cardtest {margin:5px 0 0}
 .scf_cardtest_btn {margin-left:5px;vertical-align:middle}
@@ -666,6 +667,7 @@ ul.de_pg_tab li.tab-current a{background:#2CC185;color:#fff}
 .inicis_info_fld th{background-color:#F6F1FF}
 .kakao_info_fld th{background-color:#FFFCED}
 .naver_info_fld th{background-color:#F3FFF3}
+.nicepay_info_fld th{background-color:#d1e6ff}
 
 /* 주문내역 */
 #sodr_list td {text-align:center}

adm/dbupgrade.php

@@ -269,6 +269,26 @@ while ($row = sql_fetch_array($result)){
     }
 }
 
+// SMS5 테이블 G5_TABLE_PREFIX 적용
+if($g5['sms5_prefix'] != 'sms5_' && sql_num_rows(sql_query("show tables like 'sms5_config'")))
+{
+    $tables = array('config','write','history','book','book_group','form','form_group');
+
+    foreach($tables as $name){
+        $old_table = 'sms5_' . $name;
+        $new_table = $g5['sms5_prefix'] . $name;
+
+        // 기존 테이블이 있고, G5_TABLE_PREFIX 적용 테이블이 없을 경우 → 테이블명 변경
+        if(sql_num_rows(sql_query("SHOW TABLES LIKE '{$old_table}' "))){
+            if(!sql_num_rows(sql_query("SHOW TABLES LIKE '{$new_table}' "))){
+                sql_query("RENAME TABLE {$old_table} TO {$new_table}", false);
+            }
+        }
+    }
+
+    $is_check = true;
+}
+
 $is_check = run_replace('admin_dbupgrade', $is_check);
 
 $db_upgrade_msg = $is_check ? 'DB 업그레이드가 완료되었습니다.' : '더 이상 업그레이드 할 내용이 없습니다.<br>현재 DB 업그레이드가 완료된 상태입니다.';

adm/member_form.php

@@ -205,7 +205,7 @@ if (isset($mb_id) && $mb_id) {
 if ($mb['mb_intercept_date']) {
     $g5['title'] = "차단된 ";
 } else {
-    $g5['title'] .= "";
+    $g5['title'] = "";
 }
 $g5['title'] .= '회원 ' . $html_title;
 require_once './admin.head.php';
@@ -455,7 +455,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                 <?php if ($config['cf_use_recommend']) { // 추천인 사용 ?>
                     <tr>
                         <th scope="row">추천인</th>
-                        <td colspan="3"><?php echo ($mb['mb_recommend'] ? get_text($mb['mb_recommend']) : '없음'); // 081022 : CSRF 보안 결함으로 인한 코드 수정 ?></td>
+                        <td colspan="3"><?php echo ((isset($mb['mb_recommend']) && $mb['mb_recommend']) ? get_text($mb['mb_recommend']) : '없음'); // 081022 : CSRF 보안 결함으로 인한 코드 수정 ?></td>
                     </tr>
                 <?php } ?>
 

adm/member_form_update.php

@@ -19,7 +19,7 @@ $mb_certify     = isset($_POST['mb_certify']) ? preg_replace('/[^0-9a-z_]/i', ''
 $mb_zip         = isset($_POST['mb_zip']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_zip']) : '';
 
 // 관리자가 자동등록방지를 사용해야 할 경우 ( 회원의 비밀번호 변경시 캡챠를 체크한다 )
-if ($mb_password && function_exists('get_admin_captcha_by') && get_admin_captcha_by()) {
+if ($mb_password) {
     include_once(G5_CAPTCHA_PATH . '/captcha.lib.php');
 
     if (!chk_captcha()) {

adm/menu_form.php

@@ -117,6 +117,15 @@ if ($new == 'new' || !$code) {
         });
     });
 
+    function htmlEscape(str) {
+        return str
+            .replace(/&/g, '&')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#39;');
+    }
+
     function add_menu_list(name, link, code) {
         var $menulist = $("#menulist", opener.document);
         var ms = new Date().getTime();
@@ -126,7 +135,10 @@ if ($new == 'new' || !$code) {
         <?php } else { ?>
             sub_menu_class = " class=\"td_category sub_menu_class\"";
         <?php } ?>
-
+        
+        name = htmlEscape(name);
+        link = htmlEscape(link);
+        
         var list = "<tr class=\"menu_list menu_group_<?php echo $code; ?>\">";
         list += "<td" + sub_menu_class + ">";
         list += "<label for=\"me_name_" + ms + "\"  class=\"sound_only\">메뉴<strong class=\"sound_only\"> 필수</strong></label>";

adm/shop_admin/admin.shop.lib.php

@@ -133,6 +133,8 @@ function pg_setting_check($is_print=false){
 			$pg_msg = 'LG유플러스';
 		} else if ( $default['de_pg_service'] === 'inicis' && $default['de_inicis_mid'] && $default['de_inicis_sign_key'] ){
 			$pg_msg = 'KG이니시스';
+		} else if ( $default['de_pg_service'] === 'nicepay' && $default['de_nicepay_mid'] && $default['de_nicepay_key'] ){
+			$pg_msg = 'NICEPAY';
 		}
 	}
 
@@ -156,6 +158,21 @@ function pg_setting_check($is_print=false){
 	}
 }
 
+function is_cancel_shop_pg_order($od){
+
+    $is_od_pg_cancel = false;
+
+    if (($od['od_settle_case'] == '신용카드' || $od['od_settle_case'] == '간편결제' || $od['od_settle_case'] == 'KAKAOPAY') || ($od['od_pg'] == 'inicis' && is_inicis_order_pay($od['od_settle_case']))) {
+        $is_od_pg_cancel = true;
+    }
+
+    if ($od['od_pg'] === 'nicepay' && in_array($od['od_settle_case'], array('계좌이체', '휴대폰'))) {
+        $is_od_pg_cancel = true;
+    }
+
+    return $is_od_pg_cancel;
+}
+
 function check_order_inicis_tmps(){
     global $g5, $config, $default, $member;
 

adm/shop_admin/configform.php

@@ -207,6 +207,14 @@ if( ! isset($default['de_inicis_iniapi_key']) ){
     sql_query($sql, false);
 }
 
+// NICEPAY mid, key 추가
+if (! isset($default['de_nicepay_mid'])) {
+    $sql = "ALTER TABLE `{$g5['g5_shop_default_table']}` 
+            ADD COLUMN `de_nicepay_mid` VARCHAR(20) NOT NULL DEFAULT '' AFTER `de_inicis_cartpoint_use`,
+            ADD COLUMN `de_nicepay_key` VARCHAR(150) NOT NULL DEFAULT '' AFTER `de_nicepay_mid`; ";
+    sql_query($sql, false);
+}
+
 if( function_exists('pg_setting_check') ){
     pg_setting_check(true);
 }
@@ -633,6 +641,12 @@ if(!$default['de_kakaopay_cancelpwd']){
                 <?php echo help("KG이니시스 가상계좌 사용시 다음 주소를 <strong><a href=\"https://iniweb.inicis.com/\" target=\"_blank\">KG이니시스 관리자</a> &gt; 거래내역 &gt; 가상계좌 &gt; 입금통보방식선택 &gt; URL 수신 설정</strong>에 넣으셔야 상점에 자동으로 입금 통보됩니다."); ?>
                 <?php echo G5_SHOP_URL; ?>/settle_inicis_common.php</td>
         </tr>
+        <tr id="nicepay_vbank_url" class="pg_vbank_url">
+            <th scope="row">NICEPAY 가상계좌 입금통보 URL</th>
+            <td>
+                <?php echo help("NICEPAY 가상계좌 사용시 다음 주소를 <strong><a href=\"https://npg.nicepay.co.kr/\" target=\"_blank\">NICEPAY 관리자</a> &gt; 가맹점관리자페이지 설정 (메인화면 → 가맹점정보 클릭)</strong>에 넣으셔야 상점에 자동으로 입금 통보됩니다."); ?>
+                <?php echo G5_SHOP_URL; ?>/settle_nicepay_common.php</td>
+        </tr>
         <tr>
             <th scope="row"><label for="de_hp_use">휴대폰결제사용</label></th>
             <td>
@@ -763,6 +777,7 @@ if(!$default['de_kakaopay_cancelpwd']){
                     <li class="<?php if($default['de_pg_service'] == 'kcp') echo 'tab-current'; ?>"><a href="#kcp_info_anchor" data-value="kcp" title="NHN KCP 선택하기" >NHN KCP</a></li>
                     <li class="<?php if($default['de_pg_service'] == 'lg') echo 'tab-current'; ?>"><a href="#lg_info_anchor" data-value="lg" title="토스페이먼츠 선택하기">토스페이먼츠</a></li>
                     <li class="<?php if($default['de_pg_service'] == 'inicis') echo 'tab-current'; ?>"><a href="#inicis_info_anchor" data-value="inicis" title="KG이니시스 선택하기">KG이니시스</a></li>
+                    <li class="<?php if($default['de_pg_service'] == 'nicepay') echo 'tab-current'; ?>"><a href="#nicepay_info_anchor" data-value="nicepay" title="NICEPAY 선택하기">NICEPAY</a></li>
                 </ul>
             </td>
         </tr>
@@ -820,7 +835,7 @@ if(!$default['de_kakaopay_cancelpwd']){
         <tr class="pg_info_fld lg_info_fld">
             <th scope="row"><label for="cf_lg_mert_key">토스페이먼츠 MERT KEY</label></th>
             <td>
-                <?php echo help("토스페이먼츠 상점MertKey는 상점관리자 -> 계약정보 -> 상점정보관리에서 확인하실 수 있습니다.\n예) 95160cce09854ef44d2edb2bfb05f9f3\n<a href=\"".G5_ADMIN_URL."/config_form.php#anc_cf_cert\">기본환경설정 &gt; 본인확인</a> 설정의 토스페이먼츠 MERT KEY와 동일합니다."); ?>
+                <?php echo help("토스페이먼츠 상점MertKey는 상점관리자 -> 개발자센터 -> API키 -> 머트 키에서 확인하실 수 있습니다.\n예) 95160cce09854ef44d2edb2bfb05f9f3"); ?>
                 <input type="text" name="cf_lg_mert_key" value="<?php echo get_sanitize_input($config['cf_lg_mert_key']); ?>" id="cf_lg_mert_key" class="frm_input " size="36" maxlength="50">
             </td>
         </tr>
@@ -918,7 +933,7 @@ if(!$default['de_kakaopay_cancelpwd']){
         </tr>
         <tr class="kakao_info_fld">
             <th scope="row">
-                <label for="de_kakaopay_enckey">카카오페이 사용</label>
+                <label for="de_kakaopay_enckey">KG이니시스<br>카카오페이 사용</label>
             </th>
             <td>
                 <?php echo help("체크시 카카오페이 (KG 이니시스)를 사용합니다. <br >KG 이니시스의 SIRK****** 아이디를 받은 상점만 해당됩니다.", 50); ?>
@@ -932,6 +947,38 @@ if(!$default['de_kakaopay_cancelpwd']){
                 <input type="text" name="de_kakaopay_hashkey" value="<?php echo get_sanitize_input($default['de_kakaopay_hashkey']); ?>" id="de_kakaopay_hashkey" class="frm_input" size="20">
             </td>
         </tr>
+
+        <tr class="pg_info_fld nicepay_info_fld" id="nicepay_info_anchor">
+            <th scope="row"><label for="de_nicepay_mid">NICEPAY MID</label><br><a href="http://sir.kr/main/service/nicepayments_pg.php" target="_blank" id="scf_nicepay_reg" class="nicepay_btn">NICEPAY 신청하기</a></th>
+            <td>
+                <span class="frm_info">NICEPAY로 부터 발급 받으신 상점MID를 SR 을 제외한 나머지 자리를 입력 합니다.<br>NICEPAY 상점관리자 > 가맹점정보 > KEY관리에서 확인 할수 있습니다.<br>만약, 상점아이디가 SR로 시작하지 않는다면 계약담당자에게 변경 요청을 해주시기 바랍니다. 예) SRpaytestm</span>
+                <span class="sitecode">SR</span>
+                <input type="text" name="de_nicepay_mid" value="<?php echo get_sanitize_input($default['de_nicepay_mid']); ?>" id="de_nicepay_mid" class="frm_input" size="12" maxlength="12">
+                영문소문자(숫자포함 가능)
+            </td>
+        </tr>
+        <tr class="pg_info_fld nicepay_info_fld">
+            <th scope="row"><label for="de_nicepay_key">NICEPAY KEY</label></th>
+            <td>
+                <input type="text" name="de_nicepay_key" value="<?php echo get_sanitize_input($default['de_nicepay_key']); ?>" id="de_nicepay_key" class="frm_input" size="100" maxlength="100">
+            </td>
+        </tr>
+
+        <tr class="pg_info_fld nicepay_info_fld">
+            <th scope="row"><label for="de_nicepay_easy_pays">NICEPAY 간편결제</label></th>
+            <td>
+                <?php echo help("체크시 NICEPAY 간편결제들을 활성화 합니다.\nNICEPAY > 간편결제는 테스트결제가 되지 않습니다. 실결제에만 정상작동 합니다.\n애플페이는 IOS 기기에 모바일결제만 가능합니다."); ?>
+                <input type="checkbox" id="de_easy_nicepay_samsungpay" name="de_easy_pays[]" value="nicepay_samsungpay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_samsungpay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_samsungpay" disabled>삼성페이</label><br>
+                <input type="checkbox" id="de_easy_nicepay_naverpay" name="de_easy_pays[]" value="nicepay_naverpay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_naverpay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_naverpay">NAVERPAY (네이버페이)</label><br>
+                <input type="checkbox" id="de_easy_nicepay_kakaopay" name="de_easy_pays[]" value="nicepay_kakaopay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_kakaopay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_kakaopay">KAKAOPAY (카카오페이)</label><br>
+                <input type="checkbox" id="de_easy_nicepay_applepay" name="de_easy_pays[]" value="nicepay_applepay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_applepay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_applepay">APPLEPAY (애플페이)</label><br>
+                <input type="checkbox" id="de_easy_nicepay_paycopay" name="de_easy_pays[]" value="nicepay_paycopay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_paycopay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_paycopay">페이코</label><br>
+                <input type="checkbox" id="de_easy_nicepay_skpay" name="de_easy_pays[]" value="nicepay_skpay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_skpay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_skpay">SK페이</label><br>
+                <input type="checkbox" id="de_easy_nicepay_ssgpay" name="de_easy_pays[]" value="nicepay_ssgpay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_ssgpay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_ssgpay">SSG페이</label><br>
+                <input type="checkbox" id="de_easy_nicepay_lpay" name="de_easy_pays[]" value="nicepay_lpay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_lpay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_lpay">LPAY</label>
+            </td>
+        </tr>
+
         <?php if (defined('G5_SHOP_DIRECT_NAVERPAY') && G5_SHOP_DIRECT_NAVERPAY) { ?>
         <tr class="naver_info_fld">
             <th scope="row">
@@ -1020,8 +1067,8 @@ if(!$default['de_kakaopay_cancelpwd']){
                     <a href="http://testadmin8.kcp.co.kr/" target="_blank" class="btn_frmline">테스트 관리자</a>
                 </div>
                 <div class="scf_cardtest lg_cardtest">
-                    <a href="https://pgweb.uplus.co.kr/" target="_blank" class="btn_frmline">실결제 관리자</a>
-                    <a href="https://pgweb.uplus.co.kr/tmert" target="_blank" class="btn_frmline">테스트 관리자</a>
+                    <a href="https://app.tosspayments.com/" target="_blank" class="btn_frmline">실결제 관리자</a>
+                    <a href="https://pgweb.tosspayments.com/tmert" target="_blank" class="btn_frmline">테스트 관리자</a>
                 </div>
                 <div class="scf_cardtest inicis_cardtest">
                     <a href="https://iniweb.inicis.com/" target="_blank" class="btn_frmline">상점 관리자</a>
@@ -1046,7 +1093,7 @@ if(!$default['de_kakaopay_cancelpwd']){
                         <li><b>일반결제</b>의 테스트 사이트코드는 <b>T0000</b> 이며, <b>에스크로 결제</b>의 테스트 사이트코드는 <b>T0007</b> 입니다.</li>
                     </ul>
                     <ul id="lg_cardtest_tip" class="scf_cardtest_tip_adm scf_cardtest_tip_adm_hide">
-                        <li>테스트결제의 <a href="http://pgweb.dacom.net:7085/" target="_blank">상점관리자</a> 로그인 정보는 토스페이먼츠 상점아이디 첫 글자에 t를 추가해서 로그인하시기 바랍니다. 예) tsi_lguplus</li>
+                        <li>테스트결제의 <a href="https://pgweb.tosspayments.com/tmert" target="_blank">상점관리자</a> 로그인 정보는 토스페이먼츠 상점아이디 첫 글자에 t를 추가해서 로그인하시기 바랍니다. 예) tsi_lguplus</li>
                     </ul>
                     <ul id="inicis_cardtest_tip" class="scf_cardtest_tip_adm scf_cardtest_tip_adm_hide">
                         <li><b>일반결제</b>의 테스트 사이트 mid는 <b>INIpayTest</b> 이며, <b>에스크로 결제</b>의 테스트 사이트 mid는 <b>iniescrow0</b> 입니다.</li>
@@ -1728,6 +1775,10 @@ function fconfig_check(f)
         if( f.de_inicis_mid.value && f.de_inicis_sign_key.value && parseInt(f.de_card_test.value) > 0 ){
             pg_msg = "KG이니시스";
         }
+    } else if ( f.de_pg_service.value == "nicepay" ) {
+        if( f.de_nicepay_mid.value && f.de_nicepay_key.value && parseInt(f.de_card_test.value) > 0 ){
+            pg_msg = "NICEPAY";
+        }
     }
 
     if( pg_msg ){

adm/shop_admin/configformupdate.php

@@ -167,6 +167,8 @@ $check_sanitize_keys = array(
 'de_inicis_lpay_use',           //KG이니시스 Lpay 사용
 'de_inicis_kakaopay_use',       //KG이니시스 카카오페이 사용
 'de_inicis_cartpoint_use',      //KG이니시스 신용카드 포인트 결제
+'de_nicepay_mid',               //NICEPAY 상점아이디
+'de_nicepay_key',               //NICEPAY 상점키
 'de_kakaopay_mid',              //카카오페이 상점MID
 'de_kakaopay_key',              //카카오페이 상점키
 'de_kakaopay_enckey',           //카카오페이 상점 EncKey
@@ -377,6 +379,8 @@ $sql = " update {$g5['g5_shop_default_table']}
                 de_inicis_lpay_use            = '{$de_inicis_lpay_use}',
                 de_inicis_kakaopay_use        = '{$de_inicis_kakaopay_use}',
                 de_inicis_cartpoint_use       = '{$de_inicis_cartpoint_use}',
+                de_nicepay_mid                = '{$de_nicepay_mid}',
+                de_nicepay_key                = '{$de_nicepay_key}',
                 de_card_noint_use             = '{$de_card_noint_use}',
                 de_card_point                 = '{$de_card_point}',
                 de_settle_min_point           = '{$de_settle_min_point}',

adm/shop_admin/couponform.php

@@ -46,13 +46,13 @@ include_once(G5_PLUGIN_PATH.'/jquery-ui/datepicker.php');
 ?>
 
 <form name="fcouponform" action="./couponformupdate.php" method="post" onsubmit="return form_check(this);">
-<input type="hidden" name="w" value="<?php echo $w; ?>">
-<input type="hidden" name="cp_id" value="<?php echo $cp_id; ?>">
-<input type="hidden" name="sst" value="<?php echo $sst; ?>">
-<input type="hidden" name="sod" value="<?php echo $sod; ?>">
-<input type="hidden" name="sfl" value="<?php echo $sfl; ?>">
-<input type="hidden" name="stx" value="<?php echo $stx; ?>">
-<input type="hidden" name="page" value="<?php echo $page;?>">
+<input type="hidden" name="w" value="<?php echo get_sanitize_input($w); ?>">
+<input type="hidden" name="cp_id" value="<?php echo get_sanitize_input($cp_id); ?>">
+<input type="hidden" name="sst" value="<?php echo get_sanitize_input($sst); ?>">
+<input type="hidden" name="sod" value="<?php echo get_sanitize_input($sod); ?>">
+<input type="hidden" name="sfl" value="<?php echo get_sanitize_input($sfl); ?>">
+<input type="hidden" name="stx" value="<?php echo get_sanitize_input($stx); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page);?>">
 
 <div class="tbl_frm01 tbl_wrap">
     <table>

adm/shop_admin/itemformupdate.php

@@ -235,6 +235,14 @@ sql_query(" delete from {$g5['g5_shop_event_item_table']} where it_id = '$it_id'
 // 선택옵션
 sql_query(" delete from {$g5['g5_shop_item_option_table']} where io_type = '0' and it_id = '$it_id' "); // 기존선택옵션삭제
 
+// 금지할 패턴 목록
+$forbidden_patterns = array(
+    '/<\s*script/i',      // <script>
+    '/<\s*iframe/i',      // <iframe>
+    '/on\w+\s*=/i',       // onclick=, onerror= 등 이벤트 핸들러
+    '/javascript:/i'      // javascript: 프로토콜
+);
+
 $option_count = (isset($_POST['opt_id']) && is_array($_POST['opt_id'])) ? count($_POST['opt_id']) : array();
 $it_option_subject = '';
 $it_supply_subject = '';
@@ -243,8 +251,18 @@ if($option_count) {
     // 옵션명
     $opt1_cnt = $opt2_cnt = $opt3_cnt = 0;
     for($i=0; $i<$option_count; $i++) {
-        $post_opt_id = isset($_POST['opt_id'][$i]) ? preg_replace(G5_OPTION_ID_FILTER, '', strip_tags($_POST['opt_id'][$i])) : '';
-
+        $post_opt_id = isset($_POST['opt_id'][$i]) ? $_POST['opt_id'][$i] : '';
+        
+        foreach ($forbidden_patterns as $pattern) {
+            if (preg_match($pattern, $post_opt_id)) {
+                $post_opt_id = '';
+                $_POST['opt_id'][$i] = '';
+                continue 2;
+            }
+        }
+        
+        $post_opt_id = preg_replace(G5_OPTION_ID_FILTER, '', strip_tags($post_opt_id));
+            
         $opt_val = explode(chr(30), $post_opt_id);
         if(isset($opt_val[0]) && $opt_val[0])
             $opt1_cnt++;
@@ -271,8 +289,18 @@ if($supply_count) {
     // 추가옵션명
     $arr_spl = array();
     for($i=0; $i<$supply_count; $i++) {
-        $post_spl_id = isset($_POST['spl_id'][$i]) ? preg_replace(G5_OPTION_ID_FILTER, '', strip_tags($_POST['spl_id'][$i])) : '';
-
+        $post_spl_id = isset($_POST['spl_id'][$i]) ? $_POST['spl_id'][$i] : '';
+        
+        foreach ($forbidden_patterns as $pattern) {
+            if (preg_match($pattern, $post_spl_id)) {
+                $post_spl_id = '';
+                $_POST['spl_id'][$i] = '';
+                continue 2;
+            }
+        }
+        
+        $post_spl_id = preg_replace(G5_OPTION_ID_FILTER, '', strip_tags($post_spl_id));
+        
         $spl_val = explode(chr(30), $post_spl_id);
         if(!in_array($spl_val[0], $arr_spl))
             $arr_spl[] = $spl_val[0];

adm/shop_admin/itemoption.php

@@ -84,11 +84,11 @@ if($po_run) {
     ?>
     <tr>
         <td class="td_chk">
-            <input type="hidden" name="opt_id[]" value="<?php echo $opt_id; ?>">
+            <input type="hidden" name="opt_id[]" value="<?php echo get_text($opt_id); ?>">
             <label for="opt_chk_<?php echo $i; ?>" class="sound_only"></label>
             <input type="checkbox" name="opt_chk[]" id="opt_chk_<?php echo $i; ?>" value="1">
         </td>
-        <td class="opt-cell"><?php echo $opt_1; if ($opt_2_len) echo ' <small>&gt;</small> '.$opt_2; if ($opt_3_len) echo ' <small>&gt;</small> '.$opt_3; ?></td>
+        <td class="opt-cell"><?php echo get_text($opt_1); if ($opt_2_len) echo ' <small>&gt;</small> '.get_text($opt_2); if ($opt_3_len) echo ' <small>&gt;</small> '.get_text($opt_3); ?></td>
         <td class="td_numsmall">
             <label for="opt_price_<?php echo $i; ?>" class="sound_only"></label>
             <input type="text" name="opt_price[]" value="<?php echo $opt_price; ?>" id="opt_price_<?php echo $i; ?>" class="frm_input" size="9">

adm/shop_admin/itemsellrank.php

@@ -68,10 +68,10 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>
 
 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="sort1" value="<?php echo $sort1; ?>">
-<input type="hidden" name="sort2" value="<?php echo $sort2; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="sort1" value="<?php echo get_sanitize_input($sort1); ?>">
+<input type="hidden" name="sort2" value="<?php echo get_sanitize_input($sort2); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
 
 <label for="sel_ca_id" class="sound_only">검색대상</label>
 <select name="sel_ca_id" id="sel_ca_id">

adm/shop_admin/itemstocklist.php

@@ -35,7 +35,7 @@ $sql_common .= $sql_search;
 // 테이블의 전체 레코드수만 얻음
 $sql = " select count(*) as cnt " . $sql_common;
 $row = sql_fetch($sql);
-$total_count = $row['cnt'];
+$total_count = isset($row['cnt']) ? $row['cnt'] : 0;
 
 $rows = $config['cf_page_rows'];
 $total_page  = ceil($total_count / $rows);  // 전체 페이지 계산
@@ -67,10 +67,10 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>
 
 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="sort1" value="<?php echo $sort1; ?>">
-<input type="hidden" name="sort2" value="<?php echo $sort2; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="sort1" value="<?php echo get_sanitize_input($sort1); ?>">
+<input type="hidden" name="sort2" value="<?php echo get_sanitize_input($sort2); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
 
 <label for="sel_ca_id" class="sound_only">분류선택</label>
 <select name="sel_ca_id" id="sel_ca_id">
@@ -159,7 +159,6 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
         $it_stock_qty_st = ''; // 스타일 정의
         if($row['it_stock_qty'] <= $row['it_noti_qty']) {
             $it_stock_qty_st = ' sit_stock_qty_alert';
-            $it_stock_qty = ''.$it_stock_qty.' !<span class="sound_only"> 재고부족 </span>';
         }
 
         $bg = 'bg'.($i%2);
@@ -171,7 +170,7 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
             <?php echo $row['it_id']; ?>
         </td>
         <td class="td_left"><a href="<?php echo $href; ?>"><?php echo get_it_image($row['it_id'], 50, 50); ?> <?php echo cut_str(stripslashes($row['it_name']), 60, "&#133"); ?></a></td>
-        <td class="td_num<?php echo $it_stock_qty_st; ?>"><?php echo (int)$it_stock_qty; ?></td>
+        <td class="td_num<?php echo $it_stock_qty_st; ?>"><?php echo $it_stock_qty; ?></td>
         <td class="td_num"><?php echo number_format((float)$wait_qty); ?></td>
         <td class="td_num"><?php echo number_format((float)$temporary_qty); ?></td>
         <td class="td_num">

adm/shop_admin/itemstocksms.php

@@ -74,10 +74,10 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>
 
 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="sort1" value="<?php echo $sort1; ?>">
-<input type="hidden" name="sort2" value="<?php echo $sort2; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="sort1" value="<?php echo get_sanitize_input($sort1); ?>">
+<input type="hidden" name="sort2" value="<?php echo get_sanitize_input($sort2); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
 
 <label for="sel_field" class="sound_only">검색대상</label>
 <select name="sel_field" id="sel_field">

adm/shop_admin/itemsupply.php

@@ -55,12 +55,12 @@ if($ps_run) {
     ?>
     <tr>
         <td class="td_chk">
-            <input type="hidden" name="spl_id[]" value="<?php echo $spl_id; ?>">
-            <label for="spl_chk_<?php echo $i; ?>" class="sound_only"><?php echo $spl_subject.' '.$spl; ?></label>
+            <input type="hidden" name="spl_id[]" value="<?php echo get_text($spl_id); ?>">
+            <label for="spl_chk_<?php echo $i; ?>" class="sound_only"><?php echo get_text($spl_subject.' '.$spl); ?></label>
             <input type="checkbox" name="spl_chk[]" id="spl_chk_<?php echo $i; ?>" value="1">
         </td>
-        <td class="spl-subject-cell"><?php echo $spl_subject; ?></td>
-        <td class="spl-cell"><?php echo $spl; ?></td>
+        <td class="spl-subject-cell"><?php echo get_text($spl_subject); ?></td>
+        <td class="spl-cell"><?php echo get_text($spl); ?></td>
         <td class="td_numsmall">
             <label for="spl_price_<?php echo $i; ?>" class="sound_only">상품금액</label>
             <input type="text" name="spl_price[]" value="<?php echo $spl_price; ?>" id="spl_price_<?php echo $i; ?>" class="frm_input" size="5">

adm/shop_admin/itemtypelist.php

@@ -85,8 +85,8 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>
 
 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
 
 <label for="sca" class="sound_only">분류선택</label>
 <select name="sca" id="sca">

adm/shop_admin/optionstocklist.php

@@ -69,10 +69,10 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>
 
 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="sort1" value="<?php echo $sort1; ?>">
-<input type="hidden" name="sort2" value="<?php echo $sort2; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="sort1" value="<?php echo get_sanitize_input($sort1); ?>">
+<input type="hidden" name="sort2" value="<?php echo get_sanitize_input($sort2); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
 
 <label for="sel_ca_id" class="sound_only">분류선택</label>
 <select name="sel_ca_id" id="sel_ca_id">

adm/shop_admin/orderform.php

@@ -107,6 +107,12 @@ if($od['od_pg'] == 'lg') {
     }
 }
 
+$print_od_deposit_name = $od['od_deposit_name'];
+// nicepay 로 주문하고 가상계좌인 경우
+if ($od['od_pg'] === 'nicepay' && $od['od_settle_case'] === '가상계좌' && $od['od_deposit_name']){
+    $print_od_deposit_name .= '_NICE';
+}
+
 // add_javascript('js 구문', 출력순서); 숫자가 작을 수록 먼저 출력됨
 add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
 ?>
@@ -408,7 +414,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                 </tr>
                 <tr>
                     <th scope="row">입금자</th>
-                    <td><?php echo get_text($od['od_deposit_name']); ?></td>
+                    <td><?php echo get_text($print_od_deposit_name); ?></td>
                 </tr>
                 <tr>
                     <th scope="row">입금확인일시</th>
@@ -504,10 +510,10 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                         if ($od['od_settle_case'] != '무통장') {
                             switch($od['od_pg']) {
                                 case 'lg':
-                                    $pg_url  = 'http://pgweb.uplus.co.kr';
+                                    $pg_url  = 'https://app.tosspayments.com';
                                     $pg_test = '토스페이먼츠';
                                     if ($default['de_card_test']) {
-                                        $pg_url = 'http://pgweb.uplus.co.kr/tmert';
+                                        $pg_url = 'https://pgweb.tosspayments.com/tmert';
                                         $pg_test .= ' 테스트 ';
                                     }
                                     break;
@@ -519,6 +525,10 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                                     $pg_url  = 'https://mms.cnspay.co.kr';
                                     $pg_test = 'KAKAOPAY';
                                     break;
+                                case 'nicepay':
+                                    $pg_url  = 'https://npg.nicepay.co.kr/';
+                                    $pg_test = 'NICEPAY';
+                                    break;
                                 default:
                                     $pg_url  = 'http://admin8.kcp.co.kr';
                                     $pg_test = 'KCP';
@@ -623,6 +633,18 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                         } else if($od['od_pg'] == 'inicis') {
                             $cash = unserialize($od['od_cash_info']);
                             $cash_receipt_script = 'window.open(\'https://iniweb.inicis.com/DefaultWebApp/mall/cr/cm/Cash_mCmReceipt.jsp?noTid='.$cash['TID'].'&clpaymethod=22\',\'showreceipt\',\'width=380,height=540,scrollbars=no,resizable=no\');';
+                        } else if($od['od_pg'] == 'nicepay') {
+                            
+                            $od_tid = $od['od_tno'];
+                            $cash_type = 0;
+
+                            if (! $od_tid) {
+                                $cash = unserialize($od['od_cash_info']);
+                                $od_tid = isset($cash['TID']) ? $cash['TID'] : '';
+                                $cash_type = $od_tid ? 1 : 0;
+                            }
+
+                            $cash_receipt_script = 'window.open(\'https://npg.nicepay.co.kr/issue/IssueLoader.do?type='.$cash_type.'&TID='.$od_tid.'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
                         } else {
                             require G5_SHOP_PATH.'/settle_kcp.inc.php';
 
@@ -1075,7 +1097,7 @@ function form_submit(f)
 
     var msg = "";
 
-    <?php if($od['od_settle_case'] == '신용카드' || $od['od_settle_case'] == 'KAKAOPAY' || $od['od_settle_case'] == '간편결제' || ($od['od_pg'] == 'inicis' && is_inicis_order_pay($od['od_settle_case']) )) { ?>
+    <?php if (is_cancel_shop_pg_order($od)) { ?>
     if(status == "취소" || status == "반품" || status == "품절") {
         var $ct_chk = $("input[name^=ct_chk]");
         var chk_cnt = $ct_chk.length;

adm/shop_admin/orderformcartupdate.php

@@ -191,7 +191,7 @@ if (in_array($_POST['ct_status'], $status_cancel)) {
             $sql = " select * from {$g5['g5_shop_order_table']} where od_id = '$od_id' ";
             $od = sql_fetch($sql);
 
-            if($od['od_tno'] && ($od['od_settle_case'] == '신용카드' || $od['od_settle_case'] == '간편결제' || $od['od_settle_case'] == 'KAKAOPAY') || ($od['od_pg'] == 'inicis' && is_inicis_order_pay($od['od_settle_case']) )) {
+            if ($od['od_tno'] && is_cancel_shop_pg_order($od)) {
                 switch($od['od_pg']) {
                     case 'lg':
                         include_once(G5_SHOP_PATH.'/settle_lg.inc.php');
@@ -243,6 +243,32 @@ if (in_array($_POST['ct_status'], $status_cancel)) {
                             $pg_res_msg = 'curl 로 데이터를 받지 못했습니다.';
                         }
 
+                        break;
+                    case 'nicepay':
+                        include_once(G5_SHOP_PATH.'/settle_nicepay.inc.php');
+                        $cancel_msg = '쇼핑몰 운영자 승인 취소';
+                        
+                        $tno = $od['od_tno'];
+                        
+                        $cancelAmt = $od['od_receipt_price'];
+
+                        // 0:전체 취소, 1:부분 취소(별도 계약 필요)
+                        $partialCancelCode = 0;
+
+
+                        include G5_SHOP_PATH.'/nicepay/cancel_process.php';
+
+                        if (isset($result['ResultCode'])) {
+                            // 실패했다면
+                            if ($result['ResultCode'] !== '2001') {
+                                $pg_res_cd = $result['ResultCode'];
+                                $pg_res_msg = $result['ResultMsg'];
+                            }
+                        } else {
+                            $pg_res_cd = '';
+                            $pg_res_msg = 'curl 로 데이터를 받지 못하거나 통신에 실패했습니다.';
+                        }
+
                         break;
                     case 'KAKAOPAY':
                         include_once(G5_SHOP_PATH.'/settle_kakaopay.inc.php');
@@ -296,7 +322,7 @@ if (in_array($_POST['ct_status'], $status_cancel)) {
 
                 // PG 취소요청 성공했으면
                 if($pg_res_cd == '') {
-                    $pg_cancel_log = ' PG 신용카드 승인취소 처리';
+                    $pg_cancel_log = ' PG '.$od['od_settle_case'].' 승인취소 처리';
                     $sql = " update {$g5['g5_shop_order_table']}
                                 set od_refund_price = '{$od['od_receipt_price']}'
                                 where od_id = '$od_id' ";

adm/shop_admin/orderlist.php

@@ -16,6 +16,7 @@ $sort2 = (isset($_GET['sort2']) && in_array($_GET['sort2'], array('desc', 'asc')
 $sel_field = (isset($_GET['sel_field']) && in_array($_GET['sel_field'], array('od_id', 'mb_id', 'od_name', 'od_tel', 'od_hp', 'od_b_name', 'od_b_tel', 'od_b_hp', 'od_deposit_name', 'od_invoice')) ) ? $_GET['sel_field'] : ''; 
 $od_status = isset($_GET['od_status']) ? get_search_string($_GET['od_status']) : '';
 $search = isset($_GET['search']) ? get_search_string($_GET['search']) : '';
+$save_search = isset($_GET['save_search']) ? get_search_string($_GET['save_search']) : '';
 
 $fr_date = (isset($_GET['fr_date']) && preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $_GET['fr_date'])) ? $_GET['fr_date'] : '';
 $to_date = (isset($_GET['to_date']) && preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $_GET['to_date'])) ? $_GET['to_date'] : '';
@@ -160,11 +161,11 @@ if( function_exists('pg_setting_check') ){
 </div>
 
 <form name="frmorderlist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="sort1" value="<?php echo $sort1; ?>">
-<input type="hidden" name="sort2" value="<?php echo $sort2; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
-<input type="hidden" name="save_search" value="<?php echo $search; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="sort1" value="<?php echo get_sanitize_input($sort1); ?>">
+<input type="hidden" name="sort2" value="<?php echo get_sanitize_input($sort2); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
+<input type="hidden" name="save_search" value="<?php echo get_sanitize_input($search); ?>">
 
 <label for="sel_field" class="sound_only">검색대상</label>
 <select name="sel_field" id="sel_field">

adm/shop_admin/orderprintresult.php

@@ -49,7 +49,7 @@ if ($csv == 'csv')
     $to_date = date_conv($to_date);
 
 
-    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, a.od_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
+    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
                FROM {$g5['g5_shop_order_table']} a, {$g5['g5_shop_cart_table']} b
               where a.od_id = b.od_id ";
     if ($case == 1) // 출력기간
@@ -65,7 +65,7 @@ if ($csv == 'csv')
         alert("출력할 내역이 없습니다.");
 
     //header('Content-Type: text/x-csv');
-    header("Content-charset=utf-8");
+    header("Content-Type: text/csv; charset=utf-8");
     header('Content-Type: doesn/matter');
     header('Expires: ' . gmdate('D, d M Y H:i:s') . ' GMT');
     header('Content-Disposition: attachment; filename="orderlist-' . date("ymd", time()) . '.csv"');
@@ -153,7 +153,7 @@ if ($csv == 'xls')
     $fr_date = date_conv($fr_date);
     $to_date = date_conv($to_date);
 
-    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, a.od_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
+    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
                FROM {$g5['g5_shop_order_table']} a, {$g5['g5_shop_cart_table']} b
               where a.od_id = b.od_id ";
     if ($case == 1) // 출력기간

adm/shop_admin/personalpayform.php

@@ -44,6 +44,12 @@ if($popup == 'yes') { // 팝업창일 때
         $pp['pp_price'] = $od['od_misu'];
     $wrp_tag_st = '<div class="new_win">'.PHP_EOL.'<h1 id="new_win_title">'.$html_title.'</h1>';
     $wrp_tag_end = '</div>';
+
+    echo '<script>
+        if (typeof g5_admin_csrf_token_key === "undefined") {
+            var g5_admin_csrf_token_key = "' . (function_exists('admin_csrf_token_key') ? admin_csrf_token_key() : '') . '";
+        }
+    </script>';
 }
 else { // 현재페이지일 때
     include_once (G5_ADMIN_PATH.'/admin.head.php');

adm/shop_admin/wishlist.php

@@ -58,8 +58,8 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>
 
 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
 
 <label for="sel_ca_id" class="sound_only">검색대상</label>
 <select name="sel_ca_id" id="sel_ca_id">

adm/sms_admin/_common.php

@@ -5,6 +5,16 @@ include_once(G5_ADMIN_PATH.'/admin.lib.php');
 include_once(G5_SMS5_PATH.'/sms5.lib.php');
 
 if (!strstr($_SERVER['SCRIPT_NAME'], 'install.php')) {
+    // SMS5 테이블 G5_TABLE_PREFIX 적용
+    if($g5['sms5_prefix'] != 'sms5_' && sql_num_rows(sql_query("show tables like 'sms5_config'")))
+    {
+        echo '<script>
+            alert("기존 SMS5 테이블을 sms5 prefix 기준으로 변경합니다.\n(DB 업그레이드에서 자동 적용됩니다.)");
+            location.href = "'.G5_ADMIN_URL.'/dbupgrade.php";
+        </script>';
+        exit;
+    }
+
     if(!sql_num_rows(sql_query(" show tables like '{$g5['sms5_config_table']}' ")))
         goto_url('install.php');
 

bbs/ajax.autosave.php

@@ -4,8 +4,8 @@ include_once('./_common.php');
 if (!$is_member) die('0');
 
 $uid     = isset($_REQUEST['uid']) ? preg_replace('/[^0-9]/', '', $_REQUEST['uid']) : 0;
-$subject = isset($_REQUEST['subject']) ? trim($_REQUEST['subject']) : '';
-$content = isset($_REQUEST['content']) ? trim($_REQUEST['content']) : '';
+$subject = isset($_REQUEST['subject']) ? preg_replace("#[\\\]+$#", "", substr(trim($_POST['subject']),0,255)) : '';
+$content = isset($_REQUEST['content']) ? preg_replace("#[\\\]+$#", "", substr(trim($_POST['content']),0,65536)) : '';
 
 if ($subject && $content) {
     $sql = " select count(*) as cnt from {$g5['autosave_table']} where mb_id = '{$member['mb_id']}' and as_subject = '$subject' and as_content = '$content' ";

bbs/db_table.optimize.php

@@ -14,7 +14,9 @@ if($config['cf_visit_del'] > 0) {
     $tmp_before_date = date("Y-m-d", G5_SERVER_TIME - ($config['cf_visit_del'] * 86400));
     $sql = " delete from {$g5['visit_table']} where vi_date < '$tmp_before_date' ";
     sql_query($sql);
-    sql_query(" OPTIMIZE TABLE `{$g5['visit_table']}`, `{$g5['visit_sum_table']}` ");
+    if (defined('G5_USE_OPTIMIZE_DBTABLE') && G5_USE_OPTIMIZE_DBTABLE) {
+        sql_query(" OPTIMIZE TABLE `{$g5['visit_table']}`, `{$g5['visit_sum_table']}` ");
+    }
 }
 
 // 설정일이 지난 인기검색어 삭제
@@ -22,21 +24,29 @@ if($config['cf_popular_del'] > 0) {
     $tmp_before_date = date("Y-m-d", G5_SERVER_TIME - ($config['cf_popular_del'] * 86400));
     $sql = " delete from {$g5['popular_table']} where pp_date < '$tmp_before_date' ";
     sql_query($sql);
-    sql_query(" OPTIMIZE TABLE `{$g5['popular_table']}` ");
+    if (defined('G5_USE_OPTIMIZE_DBTABLE') && G5_USE_OPTIMIZE_DBTABLE) {
+        sql_query(" OPTIMIZE TABLE `{$g5['popular_table']}` ");
+    }
 }
 
 // 설정일이 지난 최근게시물 삭제
 if($config['cf_new_del'] > 0) {
     $sql = " delete from {$g5['board_new_table']} where (TO_DAYS('".G5_TIME_YMDHIS."') - TO_DAYS(bn_datetime)) > '{$config['cf_new_del']}' ";
     sql_query($sql);
-    sql_query(" OPTIMIZE TABLE `{$g5['board_new_table']}` ");
+    
+    // 데이터가 많으면 처리시간 때문에 브라우저 응답이 늦을수 있음
+    if (defined('G5_USE_OPTIMIZE_DBTABLE') && G5_USE_OPTIMIZE_DBTABLE) {
+        sql_query(" OPTIMIZE TABLE `{$g5['board_new_table']}` ");
+    }
 }
 
 // 설정일이 지난 쪽지 삭제
 if($config['cf_memo_del'] > 0) {
     $sql = " delete from {$g5['memo_table']} where (TO_DAYS('".G5_TIME_YMDHIS."') - TO_DAYS(me_send_datetime)) > '{$config['cf_memo_del']}' ";
     sql_query($sql);
-    sql_query(" OPTIMIZE TABLE `{$g5['memo_table']}` ");
+    if (defined('G5_USE_OPTIMIZE_DBTABLE') && G5_USE_OPTIMIZE_DBTABLE) {
+        sql_query(" OPTIMIZE TABLE `{$g5['memo_table']}` ");
+    }
 }
 
 // 탈퇴회원 자동 삭제
@@ -65,4 +75,8 @@ if($captcha_mp3 && is_array($captcha_mp3)) {
 // 실행일 기록
 if(isset($config['cf_optimize_date'])) {
     sql_query(" update {$g5['config_table']} set cf_optimize_date = '".G5_TIME_YMD."' ");
-}
+    
+    run_event('cf_optimize_date_update', $config);
+}
+
+run_event('db_table_optimize_end', $config);

bbs/delete_comment.php

@@ -3,6 +3,7 @@
 include_once('./_common.php');
 
 $comment_id = isset($_REQUEST['comment_id']) ? (int) $_REQUEST['comment_id'] : 0;
+$token = isset($_REQUEST['token']) ? clean_xss_tags($_REQUEST['token']) : 0;
 
 $delete_comment_token = get_session('ss_delete_comment_'.$comment_id.'_token');
 set_session('ss_delete_comment_'.$comment_id.'_token', '');

bbs/good.php

@@ -1,6 +1,8 @@
 <?php
 include_once('./_common.php');
 
+$good = isset($_REQUEST['good']) ? preg_replace('/[^a-z0-9]/i', '', $_REQUEST['good']) : '';
+
 run_event('bbs_good_before', $bo_table, $wr_id, $good);
 
 @include_once($board_skin_path.'/good.head.skin.php');

bbs/link.php

@@ -1,7 +1,11 @@
 <?php
 include_once('./_common.php');
 
-$html_title = '링크 &gt; '.conv_subject($write['wr_subject'], 255);
+$html_title = '링크';
+
+if (isset($write['wr_subject']) && $write['wr_subject']) {
+    $html_title .= ' &gt; '.conv_subject($write['wr_subject'], 255);
+}
 
 $no = isset($_REQUEST['no']) ? preg_replace('/[^0-9]/i', '', $_REQUEST['no']) : '';
 
@@ -10,10 +14,10 @@ if (!($bo_table && $wr_id && $no))
 
 // SQL Injection 예방
 $row = sql_fetch(" select count(*) as cnt from {$g5['write_prefix']}{$bo_table} ", FALSE);
-if (!$row['cnt'])
+if (!(isset($row['cnt']) && $row['cnt']))
     alert_close('존재하는 게시판이 아닙니다.');
 
-if (!$write['wr_link'.$no])
+if (!(isset($write['wr_link'.$no]) && $write['wr_link'.$no]))
     alert_close('링크가 없습니다.');
 
 $ss_name = 'ss_link_'.$bo_table.'_'.$wr_id.'_'.$no;

bbs/login.php

@@ -8,7 +8,6 @@ if( function_exists('social_check_login_before') ){
 $g5['title'] = '로그인';
 include_once('./_head.sub.php');
 
-$url = isset($_GET['url']) ? strip_tags($_GET['url']) : '';
 $od_id = isset($_POST['od_id']) ? safe_replace_regex($_POST['od_id'], 'od_id') : '';
 
 // url 체크

bbs/login_check.php

@@ -147,8 +147,16 @@ if(function_exists('set_cart_id')){
     cart_item_clean();
     set_cart_id('');
     $s_cart_id = get_session('ss_cart_id');
+
+    $add_cart_where = '';
+
+    // 장바구니에서 주문하기를 하는 경우
+    if (strpos($link, 'orderform.php') !== false) {
+        $add_cart_where = " and ct_select_time < '".date('Y-m-d H:i:s', strtotime('-1 hour', G5_SERVER_TIME))."' ";
+    }
+
     // 선택필드 초기화
-    $sql = " update {$g5['g5_shop_cart_table']} set ct_select = '0' where od_id = '$s_cart_id' ";
+    $sql = " update {$g5['g5_shop_cart_table']} set ct_select = '0' where od_id = '$s_cart_id' $add_cart_where ";
     sql_query($sql);
 }
 

bbs/member_confirm.php

@@ -4,8 +4,6 @@ include_once('./_common.php');
 if ($is_guest)
     alert('로그인 한 회원만 접근하실 수 있습니다.', G5_BBS_URL.'/login.php');
 
-$url = isset($_GET['url']) ? clean_xss_tags($_GET['url']) : '';
-
 while (1) {
     $tmp = preg_replace('/&#[^;]+;/', '', $url);
     if ($tmp == $url) break;
@@ -31,6 +29,10 @@ if($url){
     if( preg_match('#^/{3,}#', $url) ){
         $url = preg_replace('#^/{3,}#', '/', $url);
     }
+
+    if (function_exists('safe_filter_url_host')) {
+        $url = safe_filter_url_host($url);
+    }
 }
 
 $url = get_text($url);

bbs/memo_form_update.php

@@ -14,24 +14,28 @@ $str_nick_list = '';
 $msg = '';
 $error_list  = array();
 $member_list = array('id'=>array(), 'nick'=>array());
+$me_memo = isset($_POST['me_memo']) ? preg_replace("#[\\\]+$#", "", substr(trim($_POST['me_memo']),0,65536)) : '';
 
 run_event('memo_form_update_before', $recv_list);
 
 for ($i=0; $i<count($recv_list); $i++) {
-    $row = sql_fetch(" select mb_id, mb_nick, mb_open, mb_leave_date, mb_intercept_date from {$g5['member_table']} where mb_id = '{$recv_list[$i]}' ");
+
+    $recv_list_id = substr(preg_replace("/[^a-zA-Z0-9_]*/", "", $recv_list[$i]), 0, 20);
+
+    $row = sql_fetch(" select mb_id, mb_nick, mb_open, mb_leave_date, mb_intercept_date from {$g5['member_table']} where mb_id = '{$recv_list_id}' ");
     if ($row) {
         if ($is_admin || ($row['mb_open'] && (!$row['mb_leave_date'] && !$row['mb_intercept_date']))) {
             $member_list['id'][]   = $row['mb_id'];
             $member_list['nick'][] = $row['mb_nick'];
         } else {
-            $error_list[]   = $recv_list[$i];
+            $error_list[]   = $recv_list_id;
         }
     }
     /*
     // 관리자가 아니면서
     // 가입된 회원이 아니거나 정보공개를 하지 않았거나 탈퇴한 회원이거나 차단된 회원에게 쪽지를 보내는것은 에러
     if ((!$row['mb_id'] || !$row['mb_open'] || $row['mb_leave_date'] || $row['mb_intercept_date']) && !$is_admin) {
-        $error_list[]   = $recv_list[$i];
+        $error_list[]   = $recv_list_id;
     } else {
         $member_list['id'][]   = $row['mb_id'];
         $member_list['nick'][] = $row['mb_nick'];
@@ -67,14 +71,14 @@ for ($i=0; $i<count($member_list['id']); $i++) {
     $recv_mb_nick = get_text($member_list['nick'][$i]);
 
     // 받는 회원 쪽지 INSERT
-    $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_type, me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}', '0000-00-00 00:00:00' , 'recv', '{$_SERVER['REMOTE_ADDR']}' ) ";
+    $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_type, me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$me_memo}', '0000-00-00 00:00:00' , 'recv', '{$_SERVER['REMOTE_ADDR']}' ) ";
 
     sql_query($sql);
 
     if( $me_id = sql_insert_id() ){
 
         // 보내는 회원 쪽지 INSERT
-        $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_send_id, me_type , me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}', '0000-00-00 00:00:00', '$me_id', 'send', '{$_SERVER['REMOTE_ADDR']}' ) ";
+        $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_send_id, me_type , me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$me_memo}', '0000-00-00 00:00:00', '$me_id', 'send', '{$_SERVER['REMOTE_ADDR']}' ) ";
         sql_query($sql);
 		
 		$member_list['me_id'][$i] = $me_id;

bbs/move_update.php

@@ -80,7 +80,7 @@ while ($row = sql_fetch_array($result))
             }
 
             $sql = " insert into $move_write_table
-                        set wr_num = " . ($next_wr_num ? "'$next_wr_num'" : "(SELECT IFNULL(MIN(wr_num) - 1, -1) FROM $move_write_table sq) ") . ",
+                        set wr_num = " . ($next_wr_num ? "'$next_wr_num'" : "(SELECT IFNULL(MIN(wr_num) - 1, -1) FROM $move_write_table as sq) ") . ",
                              wr_reply = '{$row2['wr_reply']}',
                              wr_is_comment = '{$row2['wr_is_comment']}',
                              wr_comment = '{$row2['wr_comment']}',

bbs/password.php

@@ -23,7 +23,7 @@ switch ($w) {
         break;
     case 's' :
         // 비밀번호 창에서 로그인 하는 경우 관리자 또는 자신의 글이면 바로 글보기로 감
-        if ($is_admin || ($member['mb_id'] == $write['mb_id'] && $write['mb_id']))
+        if ($is_admin || (isset($write['mb_id']) && $write['mb_id'] && $member['mb_id'] == $write['mb_id']))
             goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id));
         else {
             $action = https_url(G5_BBS_DIR).'/password_check.php';
@@ -32,7 +32,7 @@ switch ($w) {
         break;
     case 'sc' :
         // 비밀번호 창에서 로그인 하는 경우 관리자 또는 자신의 글이면 바로 글보기로 감
-        if ($is_admin || ($member['mb_id'] == $write['mb_id'] && $write['mb_id']))
+        if ($is_admin || (isset($write['mb_id']) && $write['mb_id'] && $member['mb_id'] == $write['mb_id']))
             goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&wr_id='.$wr_id));
         else {
             $action = https_url(G5_BBS_DIR).'/password_check.php';

bbs/poll_update.php

@@ -3,7 +3,7 @@ include_once('./_common.php');
 
 $po_id = isset($_POST['po_id']) ? preg_replace('/[^0-9]/', '', $_POST['po_id']) : 0;
 
-$po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '{$_POST['po_id']}' ");
+$po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '$po_id' ");
 if (! (isset($po['po_id']) && $po['po_id']))
     alert('po_id 값이 제대로 넘어오지 않았습니다.');
 

bbs/qawrite_update.php

@@ -86,6 +86,7 @@ $qa_related = 0;
 $qa_email_recv = (isset($_POST['qa_email_recv']) && $_POST['qa_email_recv']) ? 1 : 0;
 $qa_sms_recv = (isset($_POST['qa_sms_recv']) && $_POST['qa_sms_recv']) ? 1 : 0;
 $qa_status = 0;
+$qa_html = (isset($_POST['qa_html']) && $_POST['qa_html']) ? (int) $_POST['qa_html'] : 0;
 $answer_id = null;
 
 for ($i=1; $i<=5; $i++) {

bbs/register_form_update.php

@@ -64,15 +64,15 @@ $mb_8           = isset($_POST['mb_8'])             ? trim($_POST['mb_8'])
 $mb_9           = isset($_POST['mb_9'])             ? trim($_POST['mb_9'])           : "";
 $mb_10          = isset($_POST['mb_10'])            ? trim($_POST['mb_10'])          : "";
 
-$mb_name        = clean_xss_tags($mb_name);
+$mb_name        = clean_xss_tags($mb_name, 1, 1);
 $mb_email       = get_email_address($mb_email);
-$mb_homepage    = clean_xss_tags($mb_homepage);
-$mb_tel         = clean_xss_tags($mb_tel);
+$mb_homepage    = clean_xss_tags($mb_homepage, 1, 1);
+$mb_tel         = clean_xss_tags($mb_tel, 1, 1);
 $mb_zip1        = preg_replace('/[^0-9]/', '', $mb_zip1);
 $mb_zip2        = preg_replace('/[^0-9]/', '', $mb_zip2);
-$mb_addr1       = clean_xss_tags($mb_addr1);
-$mb_addr2       = clean_xss_tags($mb_addr2);
-$mb_addr3       = clean_xss_tags($mb_addr3);
+$mb_addr1       = clean_xss_tags($mb_addr1, 1, 1);
+$mb_addr2       = clean_xss_tags($mb_addr2, 1, 1);
+$mb_addr3       = clean_xss_tags($mb_addr3, 1, 1);
 $mb_addr_jibeon = preg_match("/^(N|R)$/", $mb_addr_jibeon) ? $mb_addr_jibeon : '';
 
 run_event('register_form_update_before', $mb_id, $w);
@@ -338,7 +338,7 @@ if ($w == '') {
         $sql_nick_date =  " , mb_nick_date = '".G5_TIME_YMD."' ";
 
     $sql_open_date = "";
-    if ($mb_open_default != $mb_open)
+    if (isset($mb_open_default) && $mb_open_default != $mb_open)
         $sql_open_date =  " , mb_open_date = '".G5_TIME_YMD."' ";
 
     // 이전 메일주소와 수정한 메일주소가 틀리다면 인증을 다시 해야하므로 값을 삭제
@@ -531,7 +531,7 @@ if ($config['cf_use_email_certify'] && $old_email != $mb_email) {
 
 
 // 신규회원 쿠폰발생
-if($w == '' && $default['de_member_reg_coupon_use'] && $default['de_member_reg_coupon_term'] > 0 && $default['de_member_reg_coupon_price'] > 0) {
+if($w == '' && isset($default['de_member_reg_coupon_use']) && $default['de_member_reg_coupon_use'] && $default['de_member_reg_coupon_term'] > 0 && $default['de_member_reg_coupon_price'] > 0) {
     $j = 0;
     $create_coupon = false;
 

bbs/register_result.php

@@ -5,7 +5,7 @@ if (isset($_SESSION['ss_mb_reg']))
     $mb = get_member($_SESSION['ss_mb_reg']);
 
 // 회원정보가 없다면 초기 페이지로 이동
-if (!$mb['mb_id'])
+if (!(isset($mb['mb_id']) && $mb['mb_id']))
     goto_url(G5_URL);
 
 $g5['title'] = '회원가입 완료';

bbs/view_comment.php

@@ -7,7 +7,7 @@ if ($is_guest && $board['bo_comment_level'] < 2) {
     $captcha_html = captcha_html('_comment');
 }
 
-$c_id = isset($_GET['c_id']) ? clean_xss_tags($_GET['c_id'], 1, 1) : '';
+$c_id = isset($_GET['c_id']) ? preg_replace('/[\'",]/', '', clean_xss_tags($_GET['c_id'], 1, 1)) : '';
 $c_wr_content = '';
 
 @include_once($board_skin_path.'/view_comment.head.skin.php');

bbs/visit_insert.inc.php

@@ -6,8 +6,8 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
 {
     set_cookie('ck_visit_ip', $_SERVER['REMOTE_ADDR'], 86400); // 하루동안 저장
 
-    $tmp_row = sql_fetch(" select max(vi_id) as max_vi_id from {$g5['visit_table']} ");
-    $vi_id = $tmp_row['max_vi_id'] + 1;
+    // $tmp_row = sql_fetch(" select max(vi_id) as max_vi_id from {$g5['visit_table']} ");
+    // $vi_id = $tmp_row['max_vi_id'] + 1;
 
     // $_SERVER 배열변수 값의 변조를 이용한 SQL Injection 공격을 막는 코드입니다. 110810
     $remote_addr = escape_trim($_SERVER['REMOTE_ADDR']);
@@ -23,7 +23,7 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
     if(version_compare(phpversion(), '5.3.0', '>=') && defined('G5_BROWSCAP_USE') && G5_BROWSCAP_USE) {
         include_once(G5_BBS_PATH.'/visit_browscap.inc.php');
     }
-    $sql = " insert {$g5['visit_table']} ( vi_id, vi_ip, vi_date, vi_time, vi_referer, vi_agent, vi_browser, vi_os, vi_device ) values ( '{$vi_id}', '{$remote_addr}', '".G5_TIME_YMD."', '".G5_TIME_HIS."', '{$referer}', '{$user_agent}', '{$vi_browser}', '{$vi_os}', '{$vi_device}' ) ";
+    $sql = " insert {$g5['visit_table']} ( vi_ip, vi_date, vi_time, vi_referer, vi_agent, vi_browser, vi_os, vi_device ) values ( '{$remote_addr}', '".G5_TIME_YMD."', '".G5_TIME_HIS."', '{$referer}', '{$user_agent}', '{$vi_browser}', '{$vi_os}', '{$vi_device}' ) ";
 
     $result = sql_query($sql, FALSE);
     // 정상으로 INSERT 되었다면 방문자 합계에 반영

bbs/write.php

@@ -20,7 +20,7 @@ if (!($w == '' || $w == 'u' || $w == 'r')) {
 }
 
 if ($w == 'u' || $w == 'r') {
-    if ($write['wr_id']) {
+    if (isset($write['wr_id']) && $write['wr_id']) {
         // 가변 변수로 $wr_1 .. $wr_10 까지 만든다.
         for ($i=1; $i<=10; $i++) {
             $vvar = "wr_".$i;

bbs/write_update.php

@@ -31,6 +31,9 @@ $wr_subject = '';
 if (isset($_POST['wr_subject'])) {
     $wr_subject = substr(trim($_POST['wr_subject']),0,255);
     $wr_subject = preg_replace("#[\\\]+$#", "", $wr_subject);
+    if (function_exists('normalize_utf8_string')) {
+        $wr_subject = normalize_utf8_string($wr_subject);
+    }
 }
 if ($wr_subject == '') {
     $msg[] = '<strong>제목</strong>을 입력하세요.';
@@ -40,6 +43,9 @@ $wr_content = '';
 if (isset($_POST['wr_content'])) {
     $wr_content = substr(trim($_POST['wr_content']),0,65536);
     $wr_content = preg_replace("#[\\\]+$#", "", $wr_content);
+    if (function_exists('normalize_utf8_string')) {
+        $wr_content = normalize_utf8_string($wr_content);
+    }
 }
 if ($wr_content == '') {
     $msg[] = '<strong>내용</strong>을 입력하세요.';
@@ -679,7 +685,7 @@ sql_query(" delete from {$g5['autosave_table']} where as_uid = '{$uid}' ");
 
 // 비밀글이라면 세션에 비밀글의 아이디를 저장한다. 자신의 글은 다시 비밀번호를 묻지 않기 위함
 if ($secret) {
-    if (! $wr_num) {
+    if (!(isset($wr_num) && $wr_num)) {
         $write = get_write($write_table, $wr_id, true);
         $wr_num = $write['wr_num'];
     }

cloudflare.check.php

@@ -0,0 +1,110 @@
+<?php
+// CloudFlare를 사용시, 사용자 환경에 맞는 $_SERVER['REMOTE_ADDR']과 $_SERVER['HTTPS'] 사용 여부를 수정합니다.
+class G5CloudflareRequestHandler {
+    public static function check_cloudflare_ips($user_ip){
+        
+        // 클라우드플레어 IP, https://www.cloudflare.com/ips
+        $cloudflare_ips = array(
+            // IPv4
+            '173.245.48.0/20',
+            '103.21.244.0/22',
+            '103.22.200.0/22',
+            '103.31.4.0/22',
+            '141.101.64.0/18',
+            '108.162.192.0/18',
+            '190.93.240.0/20',
+            '188.114.96.0/20',
+            '197.234.240.0/22',
+            '198.41.128.0/17',
+            '162.158.0.0/15',
+            '104.16.0.0/12',
+            '104.24.0.0/14',
+            '172.64.0.0/13',
+            '131.0.72.0/22',
+            // IPv6
+            '2400:cb00::/32',
+            '2606:4700::/32',
+            '2803:f800::/32',
+            '2405:b500::/32',
+            '2405:8100::/32',
+            '2a06:98c0::/29',
+            '2c0f:f248::/32',
+        );
+            
+        // 사용자 IP가 Cloudflare IP 대역 범위에 있는지 확인
+        $is_cloudflare_ip = false;
+        foreach ($cloudflare_ips as $cidr) {
+            if (self::ip_in_range($user_ip, $cidr)) {
+                $is_cloudflare_ip = true;
+                break;
+            }
+        }
+        
+        return $is_cloudflare_ip;
+    }
+
+    // IP 주소가 CIDR 범위 내에 있는지 확인하는 함수 (IPv4, IPv6 모두 가능)
+    public static function ip_in_range($ip, $range) {
+        // IPv4와 IPv6를 구분
+        if (strpos($range, ':') === false && preg_match('/^([0-9]{1,3}\.){3}[0-9]{1,3}$/', $ip)) {
+            // IPv4 처리
+            return self::ipv4_in_range($ip, $range);
+        } elseif (strpos($range, ':') !== false && strpos($ip, ':') !== false) {
+            // IPv6 처리
+            return self::ipv6_in_range($ip, $range);
+        }
+        
+        return false;
+    }
+
+    // IPv4 CIDR 범위 검사
+    public static function ipv4_in_range($ip, $range) {
+        list($range, $netmask) = explode('/', $range, 2);
+        $range_decimal = ip2long($range);
+        $ip_decimal = ip2long($ip);
+        $wildcard_decimal = pow(2, (32 - $netmask)) - 1;
+        $netmask_decimal = ~$wildcard_decimal;
+        
+        return (($ip_decimal & $netmask_decimal) == ($range_decimal & $netmask_decimal));
+    }
+
+    // IPv6 CIDR 범위 검사
+    public static function ipv6_in_range($ip, $range) {
+        list($range_ip, $netmask) = explode('/', $range, 2);
+        $netmask = (int) $netmask;
+
+        $ip_bin = @inet_pton($ip);
+        $range_bin = @inet_pton($range_ip);
+        
+        // IPv6 주소는 128비트이므로, 비트마스크를 적용
+        $unpacked = unpack('A16', $ip_bin);
+        $ip_bits = $unpacked[1];
+        $unpacked2 = unpack('A16', $range_bin);
+        $range_bits = $unpacked2[1];
+
+        for ($i = 0; $i < (int)($netmask / 8); $i++) {
+            if ($ip_bits[$i] !== $range_bits[$i]) {
+                return false;
+            }
+        }
+
+        $remainder = $netmask % 8;
+        if ($remainder) {
+            $mask = 0xFF << (8 - $remainder);
+            return (ord($ip_bits[$i]) & $mask) === (ord($range_bits[$i]) & $mask);
+        }
+
+        return true;
+    }
+
+}
+if ($_SERVER['HTTP_CF_CONNECTING_IP'] && G5CloudflareRequestHandler::check_cloudflare_ips($_SERVER['REMOTE_ADDR'])) {
+    $_SERVER['REMOTE_ADDR'] = preg_replace('/[^0-9a-fA-F:.]/', '', $_SERVER['HTTP_CF_CONNECTING_IP']);
+    
+    // Cloudflare 환경을 고려한 https 사용여부
+    if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === "https") {
+        $_SERVER['HTTPS'] = 'on';
+    } elseif (isset($_SERVER['HTTP_CF_VISITOR']) && stripos($_SERVER['HTTP_CF_VISITOR'], 'https') !== false) {
+        $_SERVER['HTTPS'] = 'on';
+    }
+}

common.php

@@ -29,6 +29,10 @@ for ($i=0; $i<$ext_cnt; $i++) {
 }
 //==========================================================================================================================
 
+// Cloudflare 사용시 REMOTE_ADDR 에 사용자 IP 적용과 https 사용 여부
+if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
+    include_once('cloudflare.check.php');    // cloudflare 의 ip 대역인지 체크
+}
 
 function g5_path()
 {
@@ -58,15 +62,10 @@ include_once($g5_path['path'].'/config.php');   // 설정 파일
 unset($g5_path);
 
 // IIS 에서 SERVER_ADDR 서버변수가 없다면
-if(! isset($_SERVER['SERVER_ADDR'])) {
+if (!isset($_SERVER['SERVER_ADDR'])) {
     $_SERVER['SERVER_ADDR'] = isset($_SERVER['LOCAL_ADDR']) ? $_SERVER['LOCAL_ADDR'] : '';
 }
 
-// Cloudflare 환경을 고려한 https 사용여부
-if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === "https") {
-    $_SERVER['HTTPS'] = 'on';
-}
-
 // multi-dimensional array에 사용자지정 함수적용
 function array_map_deep($fn, $array)
 {
@@ -505,7 +504,7 @@ if (isset($_REQUEST['bo_table']) && ! is_array($_REQUEST['bo_table'])) {
 
 // URL ENCODING
 if (isset($_REQUEST['url'])) {
-    $url = strip_tags(trim($_REQUEST['url']));
+    $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\x80-\\xff]|i', '', trim($_REQUEST['url']));
     $urlencode = urlencode($url);
 } else {
     $url = '';
@@ -526,7 +525,6 @@ if (isset($_REQUEST['gr_id'])) {
 }
 //===================================
 
-
 // 자동로그인 부분에서 첫로그인에 포인트 부여하던것을 로그인중일때로 변경하면서 코드도 대폭 수정하였습니다.
 if (isset($_SESSION['ss_mb_id']) && $_SESSION['ss_mb_id']) { // 로그인중이라면
     $member = get_member($_SESSION['ss_mb_id']);
@@ -586,6 +584,45 @@ if (isset($_SESSION['ss_mb_id']) && $_SESSION['ss_mb_id']) { // 로그인중이
     // 자동로그인 end ---------------------------------------
 }
 
+// 최고관리자가 아니면 IP를 체크한다.
+if (!(isset($member['mb_id']) && $config['cf_admin'] === $member['mb_id'])) {
+    // 접근가능 IP
+    $cf_possible_ip = trim($config['cf_possible_ip']);
+    if ($cf_possible_ip) {
+        $is_possible_ip = false;
+        $pattern = explode("\n", $cf_possible_ip);
+        for ($i=0; $i<count($pattern); $i++) {
+            $pattern[$i] = trim($pattern[$i]);
+            if (empty($pattern[$i]))
+                continue;
+
+            $pattern[$i] = str_replace(".", "\.", $pattern[$i]);
+            $pattern[$i] = str_replace("+", "[0-9\.]+", $pattern[$i]);
+            $pat = "/^{$pattern[$i]}$/";
+            $is_possible_ip = preg_match($pat, $_SERVER['REMOTE_ADDR']);
+            if ($is_possible_ip)
+                break;
+        }
+        if (!$is_possible_ip)
+            die ("<meta charset=utf-8>접근이 가능하지 않습니다.");
+    }
+
+    // 접근차단 IP
+    $is_intercept_ip = false;
+    $pattern = explode("\n", trim($config['cf_intercept_ip']));
+    for ($i=0; $i<count($pattern); $i++) {
+        $pattern[$i] = trim($pattern[$i]);
+        if (empty($pattern[$i]))
+            continue;
+
+        $pattern[$i] = str_replace(".", "\.", $pattern[$i]);
+        $pattern[$i] = str_replace("+", "[0-9\.]+", $pattern[$i]);
+        $pat = "/^{$pattern[$i]}$/";
+        $is_intercept_ip = preg_match($pat, $_SERVER['REMOTE_ADDR']);
+        if ($is_intercept_ip)
+            die ("<meta charset=utf-8>접근 불가합니다.");
+    }
+}
 
 /** @var array $write 글 데이터 */
 $write = array();
@@ -638,47 +675,6 @@ if (isset($member['mb_id']) && $member['mb_id']) {
     $member['mb_level'] = 1; // 비회원의 경우 회원레벨을 가장 낮게 설정
 }
 
-
-if ($is_admin != 'super') {
-    // 접근가능 IP
-    $cf_possible_ip = trim($config['cf_possible_ip']);
-    if ($cf_possible_ip) {
-        $is_possible_ip = false;
-        $pattern = explode("\n", $cf_possible_ip);
-        for ($i=0; $i<count($pattern); $i++) {
-            $pattern[$i] = trim($pattern[$i]);
-            if (empty($pattern[$i]))
-                continue;
-
-            $pattern[$i] = str_replace(".", "\.", $pattern[$i]);
-            $pattern[$i] = str_replace("+", "[0-9\.]+", $pattern[$i]);
-            $pat = "/^{$pattern[$i]}$/";
-            $is_possible_ip = preg_match($pat, $_SERVER['REMOTE_ADDR']);
-            if ($is_possible_ip)
-                break;
-        }
-        if (!$is_possible_ip)
-            die ("<meta charset=utf-8>접근이 가능하지 않습니다.");
-    }
-
-    // 접근차단 IP
-    $is_intercept_ip = false;
-    $pattern = explode("\n", trim($config['cf_intercept_ip']));
-    for ($i=0; $i<count($pattern); $i++) {
-        $pattern[$i] = trim($pattern[$i]);
-        if (empty($pattern[$i]))
-            continue;
-
-        $pattern[$i] = str_replace(".", "\.", $pattern[$i]);
-        $pattern[$i] = str_replace("+", "[0-9\.]+", $pattern[$i]);
-        $pat = "/^{$pattern[$i]}$/";
-        $is_intercept_ip = preg_match($pat, $_SERVER['REMOTE_ADDR']);
-        if ($is_intercept_ip)
-            die ("<meta charset=utf-8>접근 불가합니다.");
-    }
-}
-
-
 // 테마경로
 if(defined('_THEME_PREVIEW_') && _THEME_PREVIEW_ === true)
     $config['cf_theme'] = isset($_GET['theme']) ? trim($_GET['theme']) : '';

css/default_shop.css

@@ -806,12 +806,16 @@ box-shadow: 1px 2px 2px #eee;}
 #sod_frm_paysel legend {position:absolute;font-size:0;line-height:0;overflow:hidden}
 #sod_frm_paysel .KPAY{background:url('../img/kpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .PAYNOW{background:url('../img/paynow.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
-#sod_frm_paysel .PAYCO{background:url('../img/payco.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
-#sod_frm_paysel .inicis_lpay{background:url('../img/lpay_logo.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .PAYCO, #sod_frm_paysel .paycopay_icon{background:url('../img/payco.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .inicis_lpay, #sod_frm_paysel .lpay_icon{background:url('../img/lpay_logo.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .inicis_kakaopay{position:relative;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .inicis_kakaopay em{position:absolute;top:15px;left:45px;width:70px;height:30px;background:url('../img/kakao.png') no-repeat 50% 50% #ffeb00;overflow:hidden;text-indent:-999px;border-radius:30px}
 #sod_frm_paysel .kakaopay_icon{background:url('../img/kakao.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .naverpay_icon{background:url('../img/ico-default-naverpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;background-position: 50% 30%;padding-top:35px;padding-left:0;text-align:center}
+#sod_frm_paysel .samsungpay_icon{background:url('../img/samsungpay.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .ssgpay_icon{background:url('../img/ssgpay_icon.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .skpay_icon{background:url('../img/skpay11_icon.png') no-repeat 50% 50% #fff; background-size: 70px;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .bank_icon{background:url('../img/pay_icon1.png') no-repeat 15px 50% #fff}
 #sod_frm_paysel .vbank_icon{background:url('../img/pay_icon2.png') no-repeat 15px 50% #fff;padding-top:13px}
 #sod_frm_paysel .iche_icon{background:url('../img/pay_icon2.png') no-repeat 15px 50% #fff;padding-top:13px}
@@ -1148,6 +1152,8 @@ box-shadow: 1px 2px 2px #eee;}
 .sod_frm_mobile #m_sod_frm_paysel .inicis_lpay{background:url(../img/lpay_logo.png) no-repeat;width:35px;height:12px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%}
 .sod_frm_mobile #m_sod_frm_paysel .inicis_kakaopay{background:url(../img/kakao.png) no-repeat 50% 50% #f4dc34;border-radius:30px;height:22px;width:74px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
 .sod_frm_mobile #m_sod_frm_paysel .kakaopay_icon{background:url(../img/kakao.png) no-repeat 50% 50% #f4dc34;border-radius:30px;height:22px;width:74px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
+.sod_frm_mobile #m_sod_frm_paysel .naverpay_icon{background:url(../img/ico-default-naverpay.png) no-repeat 50% 50% #fff;border-radius:30px;height:22px;width:50px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
+.sod_frm_mobile #m_sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;padding-left:50px;padding-top:2px;width:83px}
 .sod_frm_mobile #m_sod_frm_paysel .applepay_icon{background:url(../img/ico-mobile-applepay.png) no-repeat 50% 50% #fff;border-radius:30px;height:23px;width:50px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
 .sod_frm_mobile #m_sod_frm_paysel .samsung_pay{margin-left:-23px;background:url(../img/samsungpay.png) no-repeat 24px 3px;height:25px;width:106px;display:inline-block;overflow:hidden;text-indent:-999px}
 .sod_frm_mobile #sod_frm_pay{border-top:1px solid #f3f3f3}

css/mobile_shop.css

@@ -223,13 +223,16 @@ box-shadow: 0 0 6px rgba(0,0,0,0.2);}
 #m_sod_frm_paysel li {float:left;padding:5px;width:46%;height:35px}
 #m_sod_frm_paysel .KPAY{background:url('../img/kpay.png') no-repeat;width:37px;height:15px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%}
 #m_sod_frm_paysel .PAYNOW{background:url('../img/paynow.png') no-repeat;width:46px;height:15px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%;}
-#m_sod_frm_paysel .PAYCO{background:url('../img/payco.png') no-repeat 1px;width:50px;height:15px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%}
-#m_sod_frm_paysel .inicis_lpay{background:url('../img/lpay_logo.png') no-repeat;width:35px;height:12px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%;}
+#m_sod_frm_paysel .PAYCO, #m_sod_frm_paysel .paycopay_icon{background:url('../img/payco.png') no-repeat 1px;width:50px;height:15px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%}
+#m_sod_frm_paysel .inicis_lpay, #m_sod_frm_paysel .lpay_icon{background:url('../img/lpay_logo.png') no-repeat;width:35px;height:12px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%;}
 #m_sod_frm_paysel .inicis_kakaopay{background:url('../img/kakao.png') no-repeat 50% 50% #ffeb00;border-radius:30px;height:26px;width:74px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:36px auto}
 #m_sod_frm_paysel .kakaopay_icon{background:url('../img/ico-mobile-kakaopay.png') no-repeat #fff;height:23px;width:63px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:45px auto;background-position: 10% 40%}
 #m_sod_frm_paysel .naverpay_icon{background:url('../img/ico-mobile-naverpay.png') no-repeat #fff;height:23px;width:60px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:45px auto;background-position: 0% 30%}
+#m_sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;padding-left:50px;padding-top:2px;width:83px}
 #m_sod_frm_paysel .applepay_icon{background:url('../img/ico-mobile-applepay.png') no-repeat #fff;height:30px;width:60px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:43px auto}
-#m_sod_frm_paysel .samsung_pay{margin-left:-23px;background:url('../img/samsungpay.png') no-repeat 24px 3px;height:25px;width:106px;display:inline-block;overflow:hidden;text-indent:-999px}
+#m_sod_frm_paysel .ssgpay_icon{background:url('../img/ssgpay_icon.png') no-repeat 0px 3px #fff;width:55px;height:20px;background-size:100%;display:inline-block;overflow:hidden;text-indent:-999px}
+#m_sod_frm_paysel .skpay_icon{background:url('../img/skpay11_icon.png') no-repeat 0px 3px #fff;width:55px;height:20px;background-size:100%;display:inline-block;overflow:hidden;text-indent:-999px}
+#m_sod_frm_paysel .samsung_pay, #m_sod_frm_paysel .samsungpay_icon{margin-left:-23px;background:url('../img/samsungpay.png') no-repeat 24px 7px;height:25px;width:106px;display:inline-block;overflow:hidden;text-indent:-999px}
 
 #sod_frm_pay{padding:10px;;border-top:1px solid #f3f3f3}
 #sod_frm_pay h2{margin:10px 0;font-size:1.25em}
@@ -907,10 +910,15 @@ box-shadow:0 0 8px rgba(65,98,255,0.8)}
 #sod_frm_paysel legend {position:absolute;font-size:0;line-height:0;overflow:hidden}
 #sod_frm_paysel .KPAY{background:url('../img/kpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .PAYNOW{background:url('../img/paynow.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
-#sod_frm_paysel .PAYCO{background:url('../img/payco.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
-#sod_frm_paysel .inicis_lpay{background:url('../img/lpay_logo.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .PAYCO, #sod_frm_paysel .paycopay_icon{background:url('../img/payco.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .inicis_lpay, #sod_frm_paysel .lpay_icon{background:url('../img/lpay_logo.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .inicis_kakaopay{background:url('../img/kakao.png') no-repeat 50% 50% #f4dc34;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .kakaopay_icon{background:url('../img/kakao.png') no-repeat 50% 50% #f4dc34;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .naverpay_icon{background:url('../img/ico-default-naverpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;background-position: 50% 30%;padding-top:35px;padding-left:0;text-align:center}
+#sod_frm_paysel .samsungpay_icon{background:url('../img/samsungpay.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .ssgpay_icon{background:url('../img/ssgpay_icon.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .skpay_icon{background:url('../img/skpay11_icon.png') no-repeat 50% 50% #fff; background-size: 70px;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .bank_icon{background:url('../img/pay_icon1.png') no-repeat 15px 50% #fff}
 #sod_frm_paysel .vbank_icon{background:url('../img/pay_icon2.png') no-repeat 15px 50% #fff;padding-top:13px}
 #sod_frm_paysel .iche_icon{background:url('../img/pay_icon2.png') no-repeat 15px 50% #fff;padding-top:13px}

extend/default.config.php

@@ -1,7 +1,7 @@
 <?php
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
 
-define('KGINICIS_USE_CERT_SEED', isset($config['cf_cert_use_seed']) ? (int) $config['cf_cert_use_seed'] : 0);
+define('KGINICIS_USE_CERT_SEED', isset($config['cf_cert_use_seed']) ? (int) $config['cf_cert_use_seed'] : 1);
 
 // 유저 사이드뷰에서 아이콘 지정 안했을시 기본 no 프로필 이미지
 define('G5_NO_PROFILE_IMG', '<span class="profile_img"><img src="'.G5_IMG_URL.'/no_profile.gif" alt="no_profile" width="'.$config['cf_member_icon_width'].'" height="'.$config['cf_member_icon_height'].'"></span>');

extend/shop.extend.php

@@ -8,21 +8,24 @@ if (!defined('G5_USE_SHOP') || !G5_USE_SHOP) return;
 .'(배송업체명^택배조회URL^연락처)'
 */
 define('G5_DELIVERY_COMPANY',
-     '(경동택배^https://kdexp.com/basicNewDelivery.kd?barcode=^080-873-2178)'
+     '(경동택배^https://kdexp.com/service/delivery/etc/delivery.do?barcode=^1899-5368)'
     .'(대신택배^https://www.ds3211.co.kr/freight/internalFreightSearch.ht?billno=^043-222-4582)'
-    .'(동부택배^http://www.dongbups.com/delivery/delivery_search_view.jsp?item_no=^1588-8848)'
     .'(로젠택배^https://www.ilogen.com/m/personal/trace.pop/^1588-9988)'
     .'(우체국^https://m.epost.go.kr/postal/mobile/mobile.trace.RetrieveDomRigiTraceList.comm?ems_gubun=E&sid1=^1588-1300)'
-    .'(이노지스택배^http://www.innogis.co.kr/tracking_view.asp?invoice=^1566-4082)'
     .'(한진택배^https://www.hanjin.co.kr/kor/CMS/DeliveryMgr/WaybillResult.do?mCode=MN038&schLang=KR&wblnumText2=^1588-0011)'
     .'(롯데택배^https://www.lotteglogis.com/open/tracking?invno=^1588-2121)'
-    .'(CJ대한통운^https://www.doortodoor.co.kr/parcel/doortodoor.do?fsp_action=PARC_ACT_002&fsp_cmd=retrieveInvNoACT&invc_no=^1588-1255)'
-    .'(CVSnet편의점택배^https://www.cvsnet.co.kr/invoice/tracking.do?invoice_no=^1577-1287)'
-    .'(KG옐로우캡택배^http://www.yellowcap.co.kr/custom/inquiry_result.asp?invoice_no=^1588-0123)'
-    .'(KGB택배^http://www.kgbls.co.kr/sub5/trace.asp?f_slipno=^1577-4577)'
-    .'(KG로지스^http://www.kglogis.co.kr/contents/waybill.jsp?item_no=^1588-8848)'
+    .'(CJ대한통운^https://trace.cjlogistics.com/next/tracking.html?wblNo=^1588-1255)'
+    .'(GS25편의점택배^https://www.cvsnet.co.kr/invoice/tracking.do?invoice_no=^1577-1287)'
+    .'(합동택배^https://hdexp.co.kr/deliverySearch2.hd?barcode=^1899-3392)'
+    .'(CU편의점택배^https://www.cupost.co.kr/postbox/delivery/localResult.cupost?invoice_no=^1577-1287)'
+    .'(천일택배^http://www.chunil.co.kr/HTrace/HTrace.jsp?transNo=^1877-6606)'
     .'(건영택배^https://www.kunyoung.com/goods/goods_01.php?mulno=^031-460-2700)'
-    .'(호남택배^http://www.honamlogis.co.kr/04estimate/songjang_list.php?c_search1=^031-376-6070)'
+    .'(우리택배^http://www.honamlogis.co.kr/04estimate/songjang_list.php?c_search1=^031-376-6070)'
+    .'(일양로지스^https://www.ilyanglogis.com/functionality/popup_result.asp?hawb_no=^1588-0002)'
+    .'(EMS^https://service.epost.go.kr/trace.RetrieveEmsRigiTraceList.comm?POST_CODE=^1588-1300)'
+    .'(DHL^https://www.dhl.com/kr-ko/home/tracking.html?tracking-id=^1588-1588-0001)'
+    .'(FedEx^https://www.fedex.com/fedextrack/?trknbr=^02-3496-7777)'
+    .'(UPS^https://www.fedex.com/fedextrack/?trknbr=^02-3496-7777)'
 );
 
 include_once(G5_LIB_PATH.'/shop.data.lib.php');

extend/sms5.extend.php

@@ -20,7 +20,7 @@ define('G5_ICODE_LMS_MAX_LENGTH', 1500);    // 구버전 LMS 최대길이
 define('G5_ICODE_JSON_MAX_LENGTH', 2000);   // JSON 버전 LMS 최대길이
 
 // SMS 테이블명
-$g5['sms5_prefix']                = 'sms5_';
+$g5['sms5_prefix']                = G5_TABLE_PREFIX.'sms5_';
 $g5['sms5_config_table']          = $g5['sms5_prefix'] . 'config';
 $g5['sms5_write_table']           = $g5['sms5_prefix'] . 'write';
 $g5['sms5_history_table']         = $g5['sms5_prefix'] . 'history';

install/ajax.install.check.php

@@ -1,5 +1,6 @@
 <?php
 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once('../config.php');
 include_once('./install.function.php');    // 인스톨 과정 함수 모음
 include_once('../lib/common.lib.php');    // 공통 라이브러리

install/gnuboard5.sql

@@ -292,9 +292,10 @@ CREATE TABLE IF NOT EXISTS `g5_config` (
   `cf_cert_simple` varchar(255) NOT NULL DEFAULT '',
   `cf_cert_kg_cd` varchar(255) NOT NULL DEFAULT '',
   `cf_cert_kg_mid` varchar(255) NOT NULL DEFAULT '',
-  `cf_cert_use_seed` tinyint(4) NOT NULL DEFAULT '0',
+  `cf_cert_use_seed` tinyint(4) NOT NULL DEFAULT '1',
   `cf_cert_kcb_cd` varchar(255) NOT NULL DEFAULT '',
   `cf_cert_kcp_cd` varchar(255) NOT NULL DEFAULT '',
+  `cf_cert_kcp_enckey` varchar(100) NOT NULL DEFAULT '',
   `cf_lg_mid` varchar(100) NOT NULL DEFAULT '',
   `cf_lg_mert_key` varchar(100) NOT NULL DEFAULT '',
   `cf_cert_limit` int(11) NOT NULL DEFAULT '0',
@@ -909,7 +910,7 @@ CREATE TABLE IF NOT EXISTS `g5_member_social_profiles` (
   `description` varchar(255) NOT NULL DEFAULT '',
   `mp_register_day` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
   `mp_latest_day` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
-  UNIQUE KEY `mp_no` (`mp_no`),
+  PRIMARY KEY (`mp_no`),
   KEY `mb_id` (`mb_id`),
   KEY `provider` (`provider`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;

install/gnuboard5shop.sql

@@ -360,6 +360,8 @@ CREATE TABLE IF NOT EXISTS `g5_shop_default` (
   `de_inicis_lpay_use` tinyint(4) NOT NULL DEFAULT '0',
   `de_inicis_kakaopay_use` tinyint(4) NOT NULL DEFAULT '0',
   `de_inicis_cartpoint_use` tinyint(4) NOT NULL DEFAULT '0',
+  `de_nicepay_mid` varchar(30) NOT NULL DEFAULT '',
+  `de_nicepay_key` varchar(255) NOT NULL DEFAULT '',
   `de_item_use_use` tinyint(4) NOT NULL DEFAULT '0',
   `de_item_use_write` tinyint(4) NOT NULL DEFAULT '0',
   `de_code_dup_use` tinyint(4) NOT NULL DEFAULT '0',

install/index.php

@@ -2,6 +2,7 @@
 @header('Content-Type: text/html; charset=utf-8');
 @header('X-Robots-Tag: noindex');
 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once ('../config.php');
 $title = G5_VERSION." 라이센스 확인 1/3";
 include_once ('./install.inc.php');

install/install_common.php

@@ -0,0 +1,4 @@
+<?php
+if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
+    include_once('../cloudflare.check.php');    // cloudflare 의 ip 대역인지 체크
+}

install/install_config.php

@@ -9,6 +9,7 @@ header('Pragma: no-cache'); // HTTP/1.0
 @header('X-Robots-Tag: noindex');
 
 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once ('../config.php');
 $title = G5_VERSION." 초기환경설정 2/3";
 include_once ('./install.inc.php');

install/install_db.php

@@ -10,6 +10,7 @@ header('Pragma: no-cache'); // HTTP/1.0
 @header('X-Robots-Tag: noindex');
 
 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once('../config.php');
 include_once('../lib/common.lib.php');
 include_once('./install.function.php');    // 인스톨 과정 함수 모음

js/common.js

@@ -134,7 +134,7 @@ function no_comma(data)
 function del(href)
 {
     if(confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n정말 삭제하시겠습니까?")) {
-        document.location.href = href;
+        window.location.href = href;
     }
 }
 

js/viewimageresize.js

@@ -24,6 +24,9 @@
             var width = $this.width();
 
             $img.each(function() {
+				
+				if ($(this).attr("loading") === "lazy") return; // loading="lazy" 속성이 있는 경우 건너뜀
+				
                 if($(this).data("width") == undefined)
                     $(this).data("width", $(this).width());
 
@@ -73,6 +76,9 @@
             var width = $this.width();
 
             $img.each(function() {
+				
+				if ($(this).attr("loading") === "lazy") return; // loading="lazy" 속성이 있는 경우 건너뜀
+				
                 $(this).removeAttr("width")
                        .removeAttr("height")
                        .css("width","")

lib/common.lib.php

@@ -102,6 +102,10 @@ function goto_url($url)
 {
     run_event('goto_url', $url);
 
+    if (function_exists('safe_filter_url_host')) {
+        $url = safe_filter_url_host($url);
+    }
+
     $url = str_replace("&", "&", $url);
     //echo "<script> location.replace('$url'); </script>";
 
@@ -182,6 +186,10 @@ function alert($msg='', $url='', $error=true, $post=false)
 
     run_event('alert', $msg, $url, $error, $post);
 
+    if (function_exists('safe_filter_url_host')) {
+        $url = safe_filter_url_host($url);
+    }
+
     $msg = $msg ? strip_tags($msg, '<br>') : '올바른 방법으로 이용해 주십시오.';
 
     $header = '';
@@ -220,6 +228,12 @@ function confirm($msg, $url1='', $url2='', $url3='')
         alert($msg);
     }
 
+    if (function_exists('safe_filter_url_host')) {
+        $url1 = safe_filter_url_host($url1);
+        $url2 = safe_filter_url_host($url2);
+        $url3 = safe_filter_url_host($url3);
+    }
+
     if(!trim($url1) || !trim($url2)) {
         $msg = '$url1 과 $url2 를 지정해 주세요.';
         alert($msg);
@@ -243,7 +257,13 @@ function url_auto_link($str)
 {
     global $g5;
     global $config;
-
+    
+    if ($replace_str = run_replace('url_auto_link_before', '', $str)) {
+        return $replace_str;
+    }
+    
+    $ori_str = $str;
+    
     // 140326 유창화님 제안코드로 수정
     // http://sir.kr/pg_lecture/461
     // http://sir.kr/pg_lecture/463
@@ -276,7 +296,7 @@ function url_auto_link($str)
     $str = preg_replace("/\t_gt_\t/", "&gt;", $str);
     */
 
-    return run_replace('url_auto_link', $str);
+    return run_replace('url_auto_link', $str, $ori_str);
 }
 
 
@@ -671,6 +691,10 @@ function html_purifier($html)
     )
     );
 
+    // 커스텀 URI 필터 등록
+    $def = $config->getDefinition('URI', true); // URI 정의 가져오기
+    $def->addFilter(new HTMLPurifierContinueParamFilter(), $config); // 커스텀 필터 추가
+
     $purifier = new HTMLPurifier($config);
 
     return run_replace('html_purifier_result', $purifier->purify($html), $purifier, $html);
@@ -712,7 +736,7 @@ function get_sql_search($search_ca_name, $search_field, $search_text, $search_op
     $tmp = explode(",", trim($search_field));
     $field = explode("||", $tmp[0]);
     $not_comment = "";
-    if (!empty($tmp[1]))
+    if (isset($tmp[1]))
         $not_comment = $tmp[1];
 
     $str .= "(";
@@ -768,8 +792,11 @@ function get_sql_search($search_ca_name, $search_field, $search_text, $search_op
         $op1 = " $search_operator ";
     }
     $str .= " ) ";
-    if ($not_comment)
+    if ($not_comment === '1') {
         $str .= " and wr_is_comment = '0' ";
+    } else if ($not_comment === '0') {
+        $str .= " and wr_is_comment = '1' ";
+    }
 
     return $str;
 }
@@ -832,23 +859,33 @@ function get_group($gr_id, $is_cache=false)
 }
 
 
-// 회원 정보를 얻는다.
-function get_member($mb_id, $fields='*', $is_cache=false)
+/**
+ * 회원 정보를 얻는다
+ * 
+ * @param string $mb_id
+ * @param string $fields
+ * @param bool $is_cache
+ * 
+ * @return array
+ */
+function get_member($mb_id, $fields = '*', $is_cache = false)
 {
     global $g5;
-    
-    if (preg_match("/[^0-9a-z_]+/i", $mb_id))
+
+    $mb_id = trim($mb_id);
+    if (preg_match("/[^0-9a-z_]+/i", $mb_id)) {
         return array();
+    }
 
     static $cache = array();
 
     $key = md5($fields);
 
-    if( $is_cache && isset($cache[$mb_id]) && isset($cache[$mb_id][$key]) ){
+    if ($is_cache && isset($cache[$mb_id]) && isset($cache[$mb_id][$key])) {
         return $cache[$mb_id][$key];
     }
 
-    $sql = " select $fields from {$g5['member_table']} where mb_id = TRIM('$mb_id') ";
+    $sql = " SELECT {$fields} from {$g5['member_table']} where mb_id = '{$mb_id}' ";
 
     $cache[$mb_id][$key] = run_replace('get_member', sql_fetch($sql), $mb_id, $fields, $is_cache);
 
@@ -1104,7 +1141,11 @@ function insert_point($mb_id, $point, $content='', $rel_table='', $rel_id='', $r
 function insert_use_point($mb_id, $point, $po_id='')
 {
     global $g5, $config;
-
+    
+    if ($replace_insert = run_replace('insert_use_point_before', '', $mb_id, $point, $po_id)) {
+        return $replace_insert;
+    }
+    
     if($config['cf_point_term'])
         $sql_order = " order by po_expire_date asc, po_id asc ";
     else
@@ -1320,6 +1361,10 @@ function delete_point($mb_id, $rel_table, $rel_id, $rel_action)
                       and po_rel_action = '$rel_action' ";
         $row = sql_fetch($sql);
 
+        if (! (isset($row['po_id']) && $row['po_id'])) {
+            return true;
+        }
+
         if(isset($row['po_point']) && $row['po_point'] < 0) {
             $mb_id = $row['mb_id'];
             $po_point = abs($row['po_point']);
@@ -1367,15 +1412,14 @@ function get_sideview($mb_id, $name='', $email='', $homepage='')
     static $cache = array();
 
     $name = get_text($name, 0, true);
-
-    if (isset($cache['id:' . $mb_id]) && $cache['id:' . $mb_id]) {
+    $namekey = ($mb_id && $name) ? $mb_id."\t".$name : '';
+    
+    // id는 유니크하지만 닉네임 또는 이름은 변경이 가능하다
+    // name의 경우 비회원은 게시판에 동일한 이름을 등록할수 있다.
+    if ($namekey && isset($cache['idname:' . $namekey]) && $cache['idname:' . $namekey]) {
+        return $cache['idname:' . $namekey];
+    } else if (isset($cache['id:' . $mb_id]) && $cache['id:' . $mb_id]) {
         return $cache['id:' . $mb_id];
-    } else if (
-        isset($name)
-        && isset($cache['name:' . $name])
-        && $cache['name:' . $name]
-    ) {
-        return $cache['name:' . $name];
     }
 
     $email = get_string_encrypt($email);
@@ -1489,11 +1533,11 @@ function get_sideview($mb_id, $name='', $email='', $homepage='')
     $str .= $str2;
     $str .= '<noscript class="sv_nojs">' . $str2 . '</noscript>';
     $str .= "</span>";
-
-    if ($mb_id) {
+    
+    if ($namekey) {
+        $cache['idname:' . $namekey] = $str;
+    } else if ($mb_id && !$name) {
         $cache['id:' . $mb_id] = $str;
-    } else {
-        $cache['name:' . $name] = $str;
     }
 
     return $str;
@@ -1652,7 +1696,10 @@ function sql_connect($host, $user, $pass, $db=G5_MYSQL_DB)
             die('Connect Error: '.mysqli_connect_error());
         }
     } else {
-        $link = mysql_connect($host, $user, $pass);
+        if (!function_exists('mysql_connect')) {
+            die('MySQL이 설치되지 않아 mysql_connect 함수를 사용할 수 없습니다.');
+        }
+        $link = mysql_connect($host, $user, $pass) or die('MySQL Host, User, Password 정보에 오류가 있습니다.');
     }
 
     return $link;
@@ -2098,7 +2145,7 @@ function time_select($time, $name="")
     preg_match("/([0-9]{2}):([0-9]{2}):([0-9]{2})/", $time, $m);
 
     // 시
-    $s .= "<select name='{$name}_h'>";
+    $s = "<select name='{$name}_h'>";
     for ($i=0; $i<=23; $i++) {
         $s .= "<option value='$i'";
         if ($i == $m['0']) {
@@ -2246,6 +2293,24 @@ function _callback_bad_tag_convert($matches){
     return "<div class=\"embedx\">보안문제로 인하여 관리자 아이디로는 embed 또는 object 태그를 볼 수 없습니다. 확인하시려면 관리권한이 없는 다른 아이디로 접속하세요.</div>";
 }
 
+function normalize_utf8_string($string) {
+    // utf8mb4 환경과 mb_ord 함수가 지원되지 않는 환경에서는 제외한다.
+    if (G5_DB_CHARSET === 'utf8mb4' || !function_exists('mb_ord')) {
+        return $string;
+    }
+    
+    // Unicode 특수 문자를 일반 문자로 변환
+    $normalized = preg_replace_callback('/[\x{1D400}-\x{1D7FF}]/u', '_callback_normalizeString', $string);
+
+    return $normalized;
+}
+
+function _callback_normalizeString($matches){
+    $charCode = mb_ord($matches[0], 'UTF-8');
+    // 변환 테이블에서 일반 문자로 매핑
+    return chr(($charCode - 0x1D400) % 26 + ord('A'));
+}
+
 // 토큰 생성
 function _token()
 {
@@ -2480,6 +2545,10 @@ function get_uniqid()
 {
     global $g5;
 
+    if ($get_uniqid_key = run_replace('get_uniqid_key', '')) {
+        return $get_uniqid_key;
+    }
+    
     sql_query(" LOCK TABLE {$g5['uniqid_table']} WRITE ");
     while (1) {
         // 년월일시분초에 100분의 1초 두자리를 추가함 (1/100 초 앞에 자리가 모자르면 0으로 채움)
@@ -3360,6 +3429,12 @@ function clean_xss_tags($str, $check_entities=0, $is_remove_tags=0, $cur_str_len
         $result = preg_replace('#([^\p{L}]|^)(?:javascript|jar|applescript|vbscript|vbs|wscript|jscript|behavior|mocha|livescript|view-source)\s*:(?:.*?([/\\\;()\'">]|$))#ius',
                 '$1$2', $result);
 
+        // 이벤트 핸들러 속성 제거 (예: onclick=, onerror= 등)
+        $result = preg_replace('/on\w+\s*=\s*(".*?"|\'.*?\'|[^\s>]+)/i', '', $result);
+        
+        // 속성 제거 (CSS 기반 인젝션 차단)
+        $result = preg_replace('/\s*style\s*=\s*(".*?"|\'.*?\'|[^\s>]+)/i', '', $result);
+        
         if((string)$result === (string)$str) break;
 
         $str = $result;
@@ -3594,6 +3669,13 @@ function login_password_check($mb, $pass, $hash)
     return check_password($pass, $hash);
 }
 
+function safe_filter_url_host($url) {
+
+    $regex = run_replace('safe_filter_url_regex', '\\', $url);
+
+    return $regex ? preg_replace('#'. preg_quote($regex, '#') .'#iu', '', $url) : '';
+}
+
 // 동일한 host url 인지
 function check_url_host($url, $msg='', $return_url=G5_URL, $is_redirect=false)
 {
@@ -3609,6 +3691,10 @@ function check_url_host($url, $msg='', $return_url=G5_URL, $is_redirect=false)
         alert('url 에 올바르지 않은 값이 포함되어 있습니다.');
     }
 
+    if (preg_match('#//[^/@]+@#', $url)) {
+        alert('url에 사용자 정보가 포함되어 있어 접근할 수 없습니다.');
+    }
+
     while ( ( $replace_url = preg_replace(array('/\/{2,}/', '/\\@/'), array('//', ''), urldecode($url)) ) != $url ) {
         $url = $replace_url;
     }
@@ -4053,15 +4139,9 @@ function safe_replace_regex($str, $str_case=''){
     return preg_replace('/[^0-9a-z_\-]/i', '', $str);
 }
 
-function get_real_client_ip(){
-
-    $real_ip = $_SERVER['REMOTE_ADDR'];
-
-    if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\z/', $_SERVER['HTTP_X_FORWARDED_FOR']) ){
-        $real_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
-    }
-
-    return preg_replace('/[^0-9.]/', '', $real_ip);
+function get_real_client_ip() {
+    
+    return run_replace('get_real_client_ip', $_SERVER['REMOTE_ADDR']);
 }
 
 function check_mail_bot($ip=''){
@@ -4130,7 +4210,14 @@ function is_include_path_check($path='', $is_input='')
             if ( $peer_count && $peer_count > $slash_count ){
                 return false;
             }
-
+            
+            $dirname_doc_root = !empty($_SERVER['DOCUMENT_ROOT']) ? dirname($_SERVER['DOCUMENT_ROOT']) : dirname(dirname(dirname(__DIR__)));
+            
+            // 웹서버 폴더만 허용
+            if ($dirname_doc_root && file_exists($path) && strpos(realpath($path), realpath($dirname_doc_root)) !== 0) {
+                return false;
+            }
+            
             try {
                 // whether $path is unix or not
                 $unipath = strlen($path)==0 || substr($path, 0, 1) != '/';
@@ -4166,8 +4253,8 @@ function is_include_path_check($path='', $is_input='')
                 //echo 'Caught exception: ',  $e->getMessage(), "\n";
                 return false;
             }
-
-            if( preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $replace_path) ){
+            
+            if (preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $replace_path) || preg_match('/pe(?:ar|cl)(?:cmd)?\.php/i', $replace_path)){
                 return false;
             }
             if( preg_match('/'.G5_PLUGIN_DIR.'\//i', $replace_path) && (preg_match('/'.G5_OKNAME_DIR.'\//i', $replace_path) || preg_match('/'.G5_KCPCERT_DIR.'\//i', $replace_path) || preg_match('/'.G5_LGXPAY_DIR.'\//i', $replace_path)) || (preg_match('/search\.skin\.php/i', $replace_path) ) ){

lib/get_data.lib.php

@@ -145,6 +145,8 @@ function get_content_by_field($write_table, $type='bbs', $where_field='', $where
 {
     global $g5, $g5_object;
 
+    static $cache = array();
+
     $order_key = 'wr_id';
 
     if( $type === 'content' ){

lib/latest.lib.php

@@ -4,7 +4,7 @@ if (!defined('_GNUBOARD_')) exit;
 
 // 최신글 추출
 // $cache_time 캐시 갱신시간
-function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time=1, $options='')
+function latest($skin_dir='', $bo_table='', $rows=10, $subject_len=40, $cache_time=1, $options='')
 {
     global $g5;
 

lib/mailer.lib.php

@@ -52,9 +52,12 @@ function mailer($fname, $fmail, $to, $subject, $content, $type=0, $file="", $cc=
 
         $mail = run_replace('mail_options', $mail, $fname, $fmail, $to, $subject, $content, $type, $file, $cc, $bcc);
 
-        $mail_send_result = $mail->send();
-
+        if (!($mail_send_result = $mail->send())) {
+            throw new Exception($mail->ErrorInfo);
+        }
+        
     } catch (Exception $e) {
+        error_log("Mail sending error: " . $e->getMessage());
     }
 
     run_event('mail_send_result', $mail_send_result, $mail, $to, $cc, $bcc);

lib/pbkdf2.compat.php

@@ -50,6 +50,7 @@ function create_hash($password, $force_compat = false)
         $salt = base64_encode(mcrypt_create_iv(PBKDF2_COMPAT_SALT_BYTES, MCRYPT_DEV_URANDOM));
     } elseif (@file_exists('/dev/urandom') && $fp = @fopen('/dev/urandom', 'r')) {
         $salt = base64_encode(fread($fp, PBKDF2_COMPAT_SALT_BYTES));
+        fclose($fp); // 파일 닫기
     } else {
         $salt = '';
         for ($i = 0; $i < PBKDF2_COMPAT_SALT_BYTES; $i += 2) {

lib/shop.lib.php

@@ -1010,7 +1010,7 @@ function get_item_options($it_id, $subject, $is_div='', $is_first_option_title='
                 for($k=0; $k<$opt_count; $k++) {
                     $opt_val = $opt[$k];
                     if(strlen($opt_val)) {
-                        $select .= '<option value="'.$opt_val.'">'.$opt_val.'</option>'.PHP_EOL;
+                        $select .= '<option value="'.get_text($opt_val).'">'.get_text($opt_val).'</option>'.PHP_EOL;
                     }
                 }
                 $select .= '</select>'.PHP_EOL;
@@ -1046,7 +1046,7 @@ function get_item_options($it_id, $subject, $is_div='', $is_first_option_title='
             else
                 $soldout = '';
 
-            $select .= '<option value="'.$row['io_id'].','.$row['io_price'].','.$row['io_stock_qty'].'">'.$row['io_id'].$price.$soldout.'</option>'.PHP_EOL;
+            $select .= '<option value="'.get_text($row['io_id']).','.$row['io_price'].','.$row['io_stock_qty'].'">'.get_text($row['io_id']).$price.$soldout.'</option>'.PHP_EOL;
         }
         $select .= '</select>'.PHP_EOL;
         
@@ -1101,7 +1101,7 @@ function get_item_supply($it_id, $subject, $is_div='', $is_first_option_title=''
             else
                 $soldout = '';
 
-            $options[$opt_id[0]][] = '<option value="'.$opt_id[1].','.$row['io_price'].','.$io_stock_qty.'">'.$opt_id[1].$price.$soldout.'</option>';
+            $options[$opt_id[0]][] = '<option value="'.get_text($opt_id[1]).','.$row['io_price'].','.$io_stock_qty.'">'.get_text($opt_id[1]).$price.$soldout.'</option>';
         }
     }
 
@@ -1122,7 +1122,7 @@ function get_item_supply($it_id, $subject, $is_div='', $is_first_option_title=''
             $first_option_title = $is_first_option_title ? $subj[$i] : '선택';
 
             $select = '<select id="it_supply_'.$seq.'" class="it_supply">'.PHP_EOL;
-            $select .= '<option value="">'.$first_option_title.'</option>'.PHP_EOL;
+            $select .= '<option value="">'.get_text($first_option_title).'</option>'.PHP_EOL;
             for($k=0; $k<$opt_count; $k++) {
                 $opt_val = $opt[$k];
                 if($opt_val) {
@@ -2487,6 +2487,15 @@ function shop_is_taxsave($od, $is_view_receipt=false){
 	return 0;
 }
 
+// 해당 주문에 현금영수증이 발급되었다면 마이페이지 주문
+function is_order_cashreceipt($od) {
+    if ($od['od_cash'] && $od['od_cash_no'] && $od['od_cash_info'] && $od['od_receipt_price'] && in_array($od['od_settle_case'], array('무통장', '계좌이체', '가상계좌'))) {
+        return true;
+    }
+
+    return false;
+}
+
 // 장바구니 금액 체크 $is_price_update 가 true 이면 장바구니 가격 업데이트한다. 
 function before_check_cart_price($s_cart_id, $is_ct_select_condition=false, $is_price_update=false, $is_item_cache=false){
     global $g5, $default, $config;
@@ -2632,16 +2641,25 @@ function make_order_field($data, $exclude)
 
         if(is_array($value)) {
             foreach($value as $k=>$v) {
-                $field .= '<input type="hidden" name="'.$key.'['.$k.']" value="'.get_text($v).'">'.PHP_EOL;
+                $field .= '<input type="hidden" name="'.get_text($key.'['.$k.']').'" value="'.get_text($v).'">'.PHP_EOL;
             }
         } else {
-            $field .= '<input type="hidden" name="'.$key.'" value="'.get_text($value).'">'.PHP_EOL;
+            $field .= '<input type="hidden" name="'.get_text($key).'" value="'.get_text($value).'">'.PHP_EOL;
         }
     }
 
     return $field;
 }
 
+function shop_order_data_fields($is_personal=0) {
+
+    if ($is_personal){
+        return array('pp_name', 'pp_email', 'pp_hp', 'pp_settle_case');
+    }
+
+    return array('od_price', 'od_name', 'od_tel', 'od_hp', 'od_email', 'od_memo', 'od_settle_case', 'max_temp_point', 'od_temp_point', 'od_bank_account', 'od_deposit_name', 'od_test', 'od_ip', 'od_zip', 'od_addr1', 'od_addr2', 'od_addr3', 'od_addr_jibeon', 'od_b_name', 'od_b_tel', 'od_b_hp', 'od_b_addr1', 'od_b_addr2', 'od_b_addr3', 'od_b_addr_jibeon', 'od_b_zip', 'od_send_cost', 'od_send_cost2', 'od_hope_date');
+}
+
 // 주문요청기록 로그를 남깁니다.
 function add_order_post_log($msg='', $code='error'){
     global $g5, $member;
@@ -2729,7 +2747,7 @@ function is_inicis_order_pay($type){
     return false;
 }
 
-function get_item_images_info($it, $size=array(), $image_width, $image_height){
+function get_item_images_info($it, $size=array(), $image_width=0, $image_height=0){
     
     if( !(is_array($it) && $it) ) return array();
     $images = array();
@@ -2805,7 +2823,7 @@ function check_pay_name_replace($payname, $od=array(), $is_client=0){
         } else if( isset($od['od_pg']) && $od['od_pg'] === 'inicis' ){
             return 'KPAY';
         } else if( isset($od['od_pg']) && $od['od_pg'] === 'kcp' ){
-            if( isset($od['od_other_pay_type']) && $od['od_other_pay_type'] === 'OT16' ){
+            if( isset($od['od_other_pay_type']) && ($od['od_other_pay_type'] === 'OT16' || $od['od_other_pay_type'] === 'NHNKCP_NAVERMONEY')){
                 return '네이버페이_NHNKCP'.$add_str;
             } else if( isset($od['od_other_pay_type']) && ($od['od_other_pay_type'] === 'OT13' || $od['od_other_pay_type'] === 'NHNKCP_KAKAOMONEY') ){
                 return '카카오페이_NHNKCP'.$add_str;

mobile/shop/kcp/KCPPaymentService.wsdl

@@ -130,13 +130,13 @@
     </wsdl:binding>
     <wsdl:service name="PayService">
         <wsdl:port name="PayServiceHttpSoap11Endpoint" binding="ns:PayServiceSoap11Binding">
-            <soap:address location="https://devpggw.kcp.co.kr:8100/services/KCPPaymentService"/>
+            <soap:address location="https://testsmpay.kcp.co.kr/services/KCPPaymentService"/>
         </wsdl:port>
         <wsdl:port name="PayServiceHttpSoap12Endpoint" binding="ns:PayServiceSoap12Binding">
-            <soap12:address location="https://devpggw.kcp.co.kr:8100/services/KCPPaymentService"/>
+            <soap12:address location="https://testsmpay.kcp.co.kr/services/KCPPaymentService"/>
         </wsdl:port>
         <wsdl:port name="PayServiceHttpEndpoint" binding="ns:PayServiceHttpBinding">
-            <http:address location="https://devpggw.kcp.co.kr:8100/services/KCPPaymentService"/>
+            <http:address location="https://testsmpay.kcp.co.kr/services/KCPPaymentService"/>
         </wsdl:port>
     </wsdl:service>
 </wsdl:definitions>

mobile/shop/kcp/m_order.script.php

@@ -23,6 +23,14 @@ jQuery(function($){
 
             if( nhnkcp_settle_case == "naverpay" ){
                 if(typeof nhnkcp_pay_form.naverpay_direct !== "undefined") nhnkcp_pay_form.naverpay_direct.value = "Y";
+                
+                 var is_money = jQuery("input[name='od_settle_case']:checked" ).attr("data-money");
+                
+                if (is_money) {     // 머니/포인트 결제
+                    jQuery(nhnkcp_pay_form).find("input[name='naverpay_point_direct']").val("Y");
+                } else {    // 카드 결제
+                    jQuery(nhnkcp_pay_form).find("input[name='naverpay_point_direct']").val("");
+                }
             }
 
             if( ! jQuery("form[name='sm_form']").length ){

mobile/shop/kcp/order_approval_form.php

@@ -37,7 +37,7 @@ include_once('./_common.php');
     $tran_cd         = isset($_POST["tran_cd"]) ? $_POST["tran_cd"] : ''; // 트랜잭션 코드
     $ordr_idxx       = isset($_POST["ordr_idxx"]) ? $_POST["ordr_idxx"] : ''; // 쇼핑몰 주문번호
     $good_name       = isset($_POST["good_name"]) ? $_POST["good_name"] : ''; // 상품명
-    $good_mny        = isset($_POST["good_mny"]) ? $_POST["good_mny"] : ''; // 결제 총금액
+    $good_mny        = isset($_POST["good_mny"]) ? (int) $_POST["good_mny"] : ''; // 결제 총금액
     $buyr_name       = isset($_POST["buyr_name"]) ? $_POST["buyr_name"] : ''; // 주문자명
     $buyr_tel1       = isset($_POST["buyr_tel1"]) ? $_POST["buyr_tel1"] : ''; // 주문자 전화번호
     $buyr_tel2       = isset($_POST["buyr_tel2"]) ? $_POST["buyr_tel2"] : ''; // 주문자 핸드폰 번호
@@ -60,9 +60,9 @@ include_once('./_common.php');
     $bask_cntx       = isset($_POST["bask_cntx"]) ? $_POST["bask_cntx"] : ''; // 장바구니 상품수
     $tablet_size     = isset($_POST["tablet_size"]) ? $_POST["tablet_size"] : ''; // 모바일기기 화면비율
 
-    $comm_tax_mny    = isset($_POST["comm_tax_mny"]) ? $_POST["comm_tax_mny"] : ''; // 과세금액
-    $comm_vat_mny    = isset($_POST["comm_vat_mny"]) ? $_POST["comm_vat_mny"] : ''; // 부가세
-    $comm_free_mny   = isset($_POST["comm_free_mny"]) ? $_POST["comm_free_mny"] : ''; // 비과세금액
+    $comm_tax_mny    = isset($_POST["comm_tax_mny"]) ? (int) $_POST["comm_tax_mny"] : ''; // 과세금액
+    $comm_vat_mny    = isset($_POST["comm_vat_mny"]) ? (int) $_POST["comm_vat_mny"] : ''; // 부가세
+    $comm_free_mny   = isset($_POST["comm_free_mny"]) ? (int) $_POST["comm_free_mny"] : ''; // 비과세금액
 
     $payco_direct    = isset($_POST["payco_direct"]) ? $_POST["payco_direct"] : ''; // PAYCO 결제창 호출
     $naverpay_direct = isset($_POST["naverpay_direct"]) ? $_POST["naverpay_direct"] : ''; // NAVERPAY 결제창 호출
@@ -253,7 +253,7 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
     echo make_order_field($data, $exclude);
 
     foreach($_POST as $key=>$value) {
-        echo '<input type="hidden" name="'.$key.'" value="'.$value.'">'.PHP_EOL;
+        echo '<input type="hidden" name="'.get_text($key).'" value="'.get_text($value).'">'.PHP_EOL;
     }
 
     echo '</form>'.PHP_EOL;
@@ -262,12 +262,12 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
 
 <form name="sm_form" method="POST" accept-charset="euc-kr">
 
-<input type="hidden" name="good_name" value="<?php echo $good_name; ?>">
+<input type="hidden" name="good_name" value="<?php echo get_text($good_name); ?>">
 <input type="hidden" name="good_mny"  value="<?php echo $good_mny; ?>" >
-<input type="hidden" name='buyr_name' value="<?php echo $buyr_name; ?>">
-<input type="hidden" name="buyr_tel1" value="<?php echo $buyr_tel1; ?>">
-<input type="hidden" name="buyr_tel2" value="<?php echo $buyr_tel2; ?>">
-<input type="hidden" name="buyr_mail" value="<?php echo $buyr_mail; ?>">
+<input type="hidden" name='buyr_name' value="<?php echo get_text($buyr_name); ?>">
+<input type="hidden" name="buyr_tel1" value="<?php echo get_text($buyr_tel1); ?>">
+<input type="hidden" name="buyr_tel2" value="<?php echo get_text($buyr_tel2); ?>">
+<input type="hidden" name="buyr_mail" value="<?php echo get_text($buyr_mail); ?>">
 <?php
 // 가상계좌 입금 마감일을 설정하려면 아래 주석을 풀어서 사용해 주세요.
 //$ipgm_date = date("Ymd", (G5_SERVER_TIME + 86400 * 5));
@@ -279,7 +279,7 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
 <?php } ?>
 <?php if($naverpay_direct){ ?>
 <input type="hidden" name="naverpay_direct"   value="<?php echo get_text($naverpay_direct); ?>">      <!-- 네이버페이 결제창 호출 -->
-    <?php if(isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){     // 네이버페이 포인트 결제 옵션 ?>
+    <?php if(isset($_POST['naverpay_point_direct']) && $_POST['naverpay_point_direct'] && isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){     // 네이버페이 포인트 결제 옵션 ?>
     <input type="hidden" name="naverpay_point_direct" value="Y">    <!-- 네이버페이 포인트 결제를 하려면 naverpay_point_direct 를 Y  -->
     <?php } ?>
 <?php } ?>
@@ -294,13 +294,13 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
 <!-- 요청 구분 -->
 <input type="hidden" name="req_tx"       value="pay">
 <!-- 사이트 코드 -->
-<input type="hidden" name="site_cd"      value="<?php echo $g_conf_site_cd; ?>">
+<input type="hidden" name="site_cd"      value="<?php echo get_text($g_conf_site_cd); ?>">
  <!-- 사이트 이름 -->
-<input type="hidden" name="shop_name"    value="<?php echo $g_conf_site_name; ?>">
+<input type="hidden" name="shop_name"    value="<?php echo get_text($g_conf_site_name); ?>">
 <!-- 결제수단-->
-<input type="hidden" name="pay_method"   value="<?php echo $pay_method; ?>">
+<input type="hidden" name="pay_method"   value="<?php echo get_text($pay_method); ?>">
 <!-- 주문번호 -->
-<input type="hidden"   name="ordr_idxx"    value="<?php echo $ordr_idxx; ?>">
+<input type="hidden"   name="ordr_idxx"    value="<?php echo get_text($ordr_idxx); ?>">
 <!-- 최대 할부개월수 -->
 <input type="hidden" name="quotaopt"     value="12">
 <!-- 통화 코드 -->
@@ -311,29 +311,29 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
 <!-- 반드시 가맹점 주문페이지의 URL을 입력 해주시기 바랍니다. -->
 <input type="hidden" name="Ret_URL"      value="<?php echo G5_MSHOP_URL; ?>/kcp/order_approval_form.php">
 <!-- 인증시 필요한 파라미터(변경불가)-->
-<input type="hidden" name="ActionResult" value="<?php echo $ActionResult; ?>">
+<input type="hidden" name="ActionResult" value="<?php echo get_text($ActionResult); ?>">
 <!-- 에스크로 사용유무 에스크로 사용 업체(가상계좌만 해당)는 Y로 세팅 해주시기 바랍니다.-->
-<input type="hidden" name="escw_used"  value="<?php echo $escw_used; ?>">
+<input type="hidden" name="escw_used"  value="<?php echo get_text($escw_used); ?>">
 <!-- 에스크로 결제처리모드 -->
 <input type="hidden" name="pay_mod"   value="<?php echo ($default['de_escrow_use']?'O':'N'); ?>">
 <!-- 수취인이름 -->
-<input type="hidden" name="rcvr_name" value="<?php echo $rcvr_name; ?>">
+<input type="hidden" name="rcvr_name" value="<?php echo get_text($rcvr_name); ?>">
 <!-- 수취인 연락처 -->
-<input type="hidden" name="rcvr_tel1" value="<?php echo $rcvr_tel1; ?>">
+<input type="hidden" name="rcvr_tel1" value="<?php echo get_text($rcvr_tel1); ?>">
 <!-- 수취인 휴대폰 번호 -->
-<input type="hidden" name="rcvr_tel2" value="<?php echo $rcvr_tel2; ?>">
+<input type="hidden" name="rcvr_tel2" value="<?php echo get_text($rcvr_tel2); ?>">
 <!-- 수취인 E-MAIL -->
-<input type="hidden" name="rcvr_add1" value="<?php echo $rcvr_add1; ?>">
+<input type="hidden" name="rcvr_add1" value="<?php echo get_text($rcvr_add1); ?>">
 <!-- 수취인 우편번호 -->
-<input type="hidden" name="rcvr_add2" value="<?php echo $rcvr_add2; ?>">
+<input type="hidden" name="rcvr_add2" value="<?php echo get_text($rcvr_add2); ?>">
 <!-- 수취인 주소 -->
-<input type="hidden" name="rcvr_mail" value="<?php echo $rcvr_mail; ?>">
+<input type="hidden" name="rcvr_mail" value="<?php echo get_text($rcvr_mail); ?>">
 <!-- 수취인 상세 주소 -->
-<input type="hidden" name="rcvr_zipx" value="<?php echo $rcvr_zipx; ?>">
+<input type="hidden" name="rcvr_zipx" value="<?php echo get_text($rcvr_zipx); ?>">
 <!-- 장바구니 상품 개수 -->
-<input type="hidden" name="bask_cntx" value="<?php echo $bask_cntx; ?>">
+<input type="hidden" name="bask_cntx" value="<?php echo get_text($bask_cntx); ?>">
 <!-- 장바구니 정보(상단 스크립트 참조) -->
-<input type="hidden" name="good_info" value="<?php echo $good_info; ?>">
+<input type="hidden" name="good_info" value="<?php echo get_text($good_info); ?>">
 <!-- 배송소요기간 -->
 <input type="hidden" name="deli_term" value="03">
 <!-- 기타 파라메터 추가 부분 - Start - -->
@@ -343,7 +343,7 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
 <input type="hidden" name="disp_tax_yn"  value="N">
 <!-- 기타 파라메터 추가 부분 - End - -->
 <!-- 화면 크기조정 부분 - Start - -->
-<input type="hidden" name="tablet_size"	 value="<?php echo $tablet_size; ?>"/>
+<input type="hidden" name="tablet_size"	 value="<?php echo get_text($tablet_size); ?>"/>
 <!-- 화면 크기조정 부분 - End - -->
 <!--
 	사용 카드 설정
@@ -383,15 +383,15 @@ if($default['de_tax_flag_use']) {
 }
 ?>
 
-<input type="hidden" name="res_cd"         value="<?php echo $res_cd; ?>">      <!-- 결과 코드          -->
-<input type="hidden" name="tran_cd"        value="<?php echo $tran_cd; ?>">     <!-- 트랜잭션 코드      -->
-<input type="hidden" name="enc_info"       value="<?php echo $enc_info; ?>">    <!-- 암호화 정보        -->
-<input type="hidden" name="enc_data"       value="<?php echo $enc_data; ?>">    <!-- 암호화 데이터      -->
+<input type="hidden" name="res_cd"         value="<?php echo get_text($res_cd); ?>">      <!-- 결과 코드          -->
+<input type="hidden" name="tran_cd"        value="<?php echo get_text($tran_cd); ?>">     <!-- 트랜잭션 코드      -->
+<input type="hidden" name="enc_info"       value="<?php echo get_text($enc_info); ?>">    <!-- 암호화 정보        -->
+<input type="hidden" name="enc_data"       value="<?php echo get_text($enc_data); ?>">    <!-- 암호화 데이터      -->
 </form>
 
     <div id="pay_fail">
         <p>결제가 실패한 경우 아래 돌아가기 버튼을 클릭해주세요.</p>
-        <a href="<?php echo $js_return_url; ?>">돌아가기</a>
+        <a href="<?php echo get_text($js_return_url); ?>">돌아가기</a>
     </div>
     <div id="show_progress" style="display:none;">
         <span style="display:block; text-align:center;margin-top:120px"><img src="<?php echo G5_MOBILE_URL; ?>/shop/img/loading.gif" alt="" ></span>

mobile/shop/kcp/orderform.1.php

@@ -23,6 +23,9 @@ $param_opt_3 = isset($_REQUEST['param_opt_3']) ? clean_xss_tags($_REQUEST['param
 <input type="hidden" name="settle_method" value="">
 <input type="hidden" name="payco_direct"   value="">      <!-- PAYCO 결제창 호출 -->
 <input type="hidden" name="naverpay_direct" value="A" >    <!-- NAVERPAY 결제창 호출 -->
+<?php if(isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){     // 네이버페이 포인트 결제 옵션 ?>
+<input type="hidden" name="naverpay_point_direct" value="Y">    <!-- 네이버페이 포인트 결제를 하려면 naverpay_point_direct 를 Y  -->
+<?php } ?>
 <input type="hidden" name="kakaopay_direct" value="A" >    <!-- KAKAOPAY 결제창 호출 -->
 <input type="hidden" name="applepay_direct" value="A" >    <!-- APPLEPAY 결제창 호출 -->
 <!-- 주문번호 -->

mobile/shop/kcp/pp_ax_hub.php

@@ -9,7 +9,6 @@
     /* =   Copyright (c)  2010.05   KCP Inc.   All Rights Reserved.                 = */
     /* ============================================================================== */
 
-
     /* ============================================================================== */
     /* =   환경 설정 파일 Include                                                   = */
     /* = -------------------------------------------------------------------------- = */
@@ -110,6 +109,24 @@
     /* = -------------------------------------------------------------------------- = */
     if ( $req_tx == "pay" )
     {
+        /* 1004원은 실제로 업체에서 결제하셔야 될 원 금액을 넣어주셔야 합니다. 결제금액 유효성 검증 */
+        $c_PayPlus->mf_set_ordr_data( "ordr_mony",  $good_mny );
+
+        $kcp_pay_type = '';   // 결제수단 검증 파라미터 pay_type (신용카드 : PACA, 계좌이체 : PABK, 가상계좌 : PAVC, 휴대폰 : PAMC)
+
+        if ($use_pay_method == "100000000000" && (in_array($od_settle_case, array('신용카드', '간편결제')))) {  // 신용카드
+            $kcp_pay_type = 'PACA';
+        } else if ($use_pay_method == "010000000000" && $od_settle_case === '계좌이체') {   // 계좌이체
+            $kcp_pay_type = 'PABK';
+        } else if ($use_pay_method == "001000000000" && $od_settle_case === '가상계좌') {   // 가상계좌
+            $kcp_pay_type = 'PAVC';
+        } else if ($use_pay_method == "000010000000" && $od_settle_case === '휴대폰') {   // 휴대폰
+            $kcp_pay_type = 'PAMC';
+        }
+
+        $c_PayPlus->mf_set_ordr_data( "pay_type",  $kcp_pay_type );
+        $c_PayPlus->mf_set_ordr_data( "ordr_no",  $ordr_idxx );
+
         $post_enc_data = isset($_POST["enc_data"]) ? $_POST["enc_data"] : '';
         $post_enc_info = isset($_POST["enc_info"]) ? $_POST["enc_info"] : '';
 
@@ -206,11 +223,14 @@
 
                 $kcp_pay_method = $c_PayPlus->mf_get_res_data( "pay_method" ); // 카카오페이 결제수단
                 // 카드 코드는 PACA, 카카오머니 코드는 PAKM
-
+                // https://developer.kcp.co.kr/page/document/directpay
+                
                 if( $kcp_pay_method == "PAKM" ){    // 카카오머니
                     $card_mny = $kakaomny_mny = $c_PayPlus->mf_get_res_data( "kakaomny_mny" );
                     $app_time = $app_kakaomny_time = $c_PayPlus->mf_get_res_data( "app_kakaomny_time" );
                     $od_other_pay_type = 'NHNKCP_KAKAOMONEY';
+                } else if( $kcp_pay_method == "PANP" ){    // 네이버페이머니
+                    $od_other_pay_type = 'NHNKCP_NAVERMONEY';
                 }
             }
 

mobile/shop/lg/returnurl.php

@@ -54,8 +54,8 @@ echo '<form name="forderform" method="post" action="'.$order_action_url.'" autoc
 
 echo make_order_field($data, $exclude);
 
-echo '<input type="hidden" name="res_cd" value="'.$LGD_RESPCODE.'">'.PHP_EOL;
-echo '<input type="hidden" name="LGD_PAYKEY" value="'.$LGD_PAYKEY.'">'.PHP_EOL;
+echo '<input type="hidden" name="res_cd" value="'.get_text($LGD_RESPCODE).'">'.PHP_EOL;
+echo '<input type="hidden" name="LGD_PAYKEY" value="'.get_text($LGD_PAYKEY).'">'.PHP_EOL;
 
 echo '</form>'.PHP_EOL;
 ?>

mobile/shop/lg/xpay_approval.php

@@ -80,6 +80,8 @@ $payReqMap['LGD_HASHDATA']           = $LGD_HASHDATA;              // MD5 해쉬
 $payReqMap['LGD_RETURNURL']          = $LGD_RETURNURL;             // 응답수신페이지
 $payReqMap['LGD_VERSION']            = "PHP_SmartXPay_1.0";        // 버전정보 (삭제하지 마세요)
 $payReqMap['LGD_CUSTOM_FIRSTPAY']    = $LGD_CUSTOM_FIRSTPAY;       // 디폴트 결제수단
+// 2024년 7월에 모바일 결제수단 키가 LGD_CUSTOM_USABLEPAY 키로 쓰이는 것을 확인함
+$payReqMap['LGD_CUSTOM_USABLEPAY'] = $LGD_CUSTOM_FIRSTPAY;       // 디폴트 결제수단
 $payReqMap['LGD_CUSTOM_SWITCHINGTYPE']  = "SUBMIT";        // 신용카드 카드사 인증 페이지 연동 방식
 $payReqMap['LGD_ENCODING']           = "UTF-8";
 $payReqMap['LGD_ENCODING_NOTEURL']   = "UTF-8";
@@ -137,9 +139,9 @@ include_once(G5_PATH.'/head.sub.php');
 ?>
 
 <?php if ($default['de_card_test']) {   // 테스트 결제시 ?>
-<script language="javascript" src="https://pretest.uplus.co.kr:9443/xpay/js/xpay_crossplatform.js" type="text/javascript"></script>
+<script language="javascript" src="https://js.tosspayments.com/xpay_crossplatform/sandbox/v1" type="text/javascript"></script>
 <?php } else {      //실 결제시 ?>
-<script language="javascript" src="//xpay.uplus.co.kr/xpay/js/xpay_crossplatform.js" type="text/javascript"></script>
+<script language="javascript" src="https://xpay.tosspayments.com/xpay/js/xpay_crossplatform.js" type="text/javascript"></script>
 <?php } ?>
 
 <script type="text/javascript">
@@ -165,7 +167,7 @@ function getFormObject() {
 <form method="post" name="LGD_PAYINFO" id="LGD_PAYINFO" action="">
 <?php
   foreach ($payReqMap as $key => $value) {
-    echo'"<input type="hidden" name="'.$key.'" id="'.$key.'" value="'.$value.'">';
+    echo'"<input type="hidden" name="'.get_text($key).'" id="'.get_text($key).'" value="'.get_text($value).'">';
   }
 ?>
 </form>

mobile/shop/list.php

@@ -1,6 +1,16 @@
 <?php
 include_once('./_common.php');
 
+// 테마에 list.php 있으면 include
+if(defined('G5_THEME_MSHOP_PATH')) {
+    $theme_list_file = G5_THEME_MSHOP_PATH.'/list.php';
+    if(is_file($theme_list_file)) {
+        include_once($theme_list_file);
+        return;
+    }
+    unset($theme_list_file);
+}
+
 // 상품 리스트에서 다른 필드로 정렬을 하려면 아래의 배열 코드에서 해당 필드를 추가하세요.
 if( isset($sort) && ! in_array($sort, array('it_name', 'it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time')) ){
     $sort='';

mobile/shop/nicepay/_common.php

@@ -0,0 +1,6 @@
+<?php
+include_once('../../../common.php');
+
+if (!defined('G5_USE_SHOP') || !G5_USE_SHOP)
+    die('<p>쇼핑몰 설치 후 이용해 주십시오.</p>');
+define('_SHOP_', true);

mobile/shop/nicepay/index.php

@@ -0,0 +1,2 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가

mobile/shop/nicepay/nicepay_result.php

@@ -0,0 +1,190 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
+
+// 나이스페이 공통 설정
+require_once(G5_MSHOP_PATH.'/settle_nicepay.inc.php');
+
+/*
+****************************************************************************************
+* <Authentication Result Parameter>
+****************************************************************************************
+*/
+$authResultCode = isset($_POST['AuthResultCode']) ? clean_xss_tags($_POST['AuthResultCode']) : '';		// authentication result code 0000:success
+$authResultMsg = isset($_POST['AuthResultMsg']) ? clean_xss_tags($_POST['AuthResultMsg']) : '';		// authentication result message
+$nextAppURL = isset($_POST['NextAppURL']) ? clean_xss_tags($_POST['NextAppURL']) : '';				// authorization request URL
+$txTid = isset($_POST['TxTid']) ? clean_xss_tags($_POST['TxTid']) : '';						// transaction ID
+$authToken = isset($_POST['AuthToken']) ? clean_xss_tags($_POST['AuthToken']) : '';				// authentication TOKEN
+$payMethod = isset($_POST['PayMethod']) ? clean_xss_tags($_POST['PayMethod']) : '';				// payment method
+$mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : '';							// merchant id
+$moid = isset($_POST['Moid']) ? clean_xss_tags($_POST['Moid']) : '';							// order number
+$amt = isset($_POST['Amt']) ? (int) preg_replace('/[^0-9]/', '', $_POST['Amt']) : 0;							// Amount of payment
+$reqReserved = isset($_POST['ReqReserved']) ? clean_xss_tags($_POST['ReqReserved']) : '';			// mall custom field 
+$netCancelURL = isset($_POST['NetCancelURL']) ? clean_xss_tags($_POST['NetCancelURL']) : '';			// netCancelURL
+
+if (isset($pp['pp_id']) && $pp['pp_id']) {   //개인결제
+    $session_order_id = get_session('ss_personalpay_id');
+    $order_price = (int) $pp['pp_price'];
+} else {
+    $session_order_id = get_session('ss_order_id');     // 쇼핑몰 일반결제
+}
+
+if ($session_order_id != $moid){
+    alert("요청한 주문번호가 틀려서 결제를 진행할수 없습니다.\\n다시 장바구니에서 시도해 주세요.", G5_SHOP_URL);
+}
+
+if ($default['de_nicepay_mid'] != $mid) {
+    alert("요청한 상점 mid와 설정된 mid가 틀리므로 결제를 진행할수 없습니다.", G5_SHOP_URL);
+}
+
+if ($order_price != $amt) {
+    alert("요청한 결제금액이 틀리므로 결제를 진행할수 없습니다.", G5_SHOP_URL);
+}
+
+// API CALL foreach example
+if (! function_exists('jsonRespDump')) {
+    function jsonRespDump($resp){
+        $respArr = json_decode($resp);
+        foreach ( $respArr as $key => $value ){
+            echo "$key=". $value."<br />";
+        }
+    }
+}
+
+if (! function_exists('nicepay_res')) {
+    function nicepay_res($key, $data, $default_val='') {
+        $response_val = isset($data[$key]) ? $data[$key] : $default_val;
+
+        return ($response_val ? $response_val : $default_val);
+    }
+}
+
+/*
+****************************************************************************************
+* <authorization parameters init>
+****************************************************************************************
+*/
+$response = "";
+
+if($authResultCode === "0000"){
+	/*
+	****************************************************************************************
+	* <Hash encryption> (do not modify)
+	****************************************************************************************
+	*/
+	$ediDate = preg_replace('/[^0-9]/', '', G5_TIME_YMDHIS);
+	$merchantKey = $default['de_nicepay_key']; // 상점키
+	$signData = bin2hex(hash('sha256', $authToken . $mid . $amt . $ediDate . $merchantKey, true));
+
+	try{
+		$data = Array(
+			'TID' => $txTid,
+			'AuthToken' => $authToken,
+			'MID' => $mid,
+			'Amt' => $amt,
+			'EdiDate' => $ediDate,
+			'SignData' => $signData,
+			'CharSet' => 'utf-8'
+		);		
+		/*
+		****************************************************************************************
+		* <authorization request>
+		* authorization through server to server communication.
+		****************************************************************************************
+
+        // 3001 : 신용카드 성공코드
+        // 4000 : 계좌이체 성공코드
+        // 4100 : 가상계좌 발급 성공코드
+        // A000 : 휴대폰 소액결제 성공코드
+        // 7001 : 현금영수증
+        // https://developers.nicepay.co.kr/manual-auth.php
+		*/			
+		$response = nicepay_reqPost($data, $nextAppURL);
+        $respArr = json_decode($response, true);
+        
+        $ResultCode = nicepay_res('ResultCode', $respArr);
+        $ResultMsg = nicepay_res('ResultMsg', $respArr);
+        $tno             = nicepay_res('TID', $respArr);
+        $amount          = (int) nicepay_res('Amt', $respArr, 0);
+        $app_time        = nicepay_res('AuthDate', $respArr);
+        $pay_method = nicepay_res('PayMethod', $respArr);
+        $od_app_no = $app_no    = nicepay_res('AuthCode', $respArr); // 승인 번호  (신용카드, 계좌이체, 휴대폰)
+        $pay_type   = $NICEPAY_METHOD[$pay_method];
+
+        // 승인된 코드가 아니면 결제가 되지 않게 합니다.
+        if (! in_array($ResultCode, array('3001', '4000', '4100', 'A000', '7001'))) {
+            alert($ResultMsg.' 코드 : '.$ResultCode, G5_SHOP_URL);
+            die();
+        }
+
+        if ($ResultCode == '3001') {    // 신용카드
+
+            $card_cd   = nicepay_res('CardCode', $respArr); // 카드사 코드
+            $card_name = nicepay_res('CardName', $respArr); // 카드 종류
+
+        } else if ($ResultCode == '4100') {    // 가상계좌
+
+            $bank_name = $bankname = nicepay_res('VbankBankName', $respArr);
+            $account   = nicepay_res('VbankNum', $respArr);
+            $va_date   = nicepay_res('VbankExpDate', $respArr).' '.nicepay_res('VbankExpTime', $respArr); // 가상계좌 입금마감시간
+            $app_no    = nicepay_res('VbankNum', $respArr);
+
+            if ($default['de_escrow_use'] == 1)
+                $escw_yn         = 'Y';
+
+        } else if ($ResultCode == '4000') {     // 계좌이체
+            $bank_name = $bankname = nicepay_res('BankName', $respArr);
+            $bank_code = nicepay_res('BankCode', $respArr);
+
+            $RcptType = nicepay_res('RcptType', $respArr); // 현금영수증타입 (0:발행안함,1:소득공제,2:지출증빙)
+            $RcptTID = nicepay_res('RcptTID', $respArr); // 현금영수증 TID, 현금영수증 거래인 경우 리턴
+            $RcptAuthCode = nicepay_res('RcptAuthCode', $respArr); // 현금영수증 승인번호, 현금영수증 거래인 경우 리턴
+            $AuthDate = nicepay_res('AuthDate', $respArr); // 현금영수증 승인번호, 현금영수증 거래인 경우 리턴
+
+            // 현금영수증 발급시 1 또는 2 이면
+            if ($RcptType) {
+                $pg_receipt_infos['od_cash'] = 1;   // 현금영수증 발급인것으로 처리
+                $pg_receipt_infos['od_cash_no'] = $RcptAuthCode;    // 현금영수증 승인번호
+                $pg_receipt_infos['od_cash_info'] = serialize(array('TID'=>$RcptTID, 'ApplNum'=>$RcptAuthCode, 'AuthDate'=>$AuthDate));
+            }
+
+            if ($default['de_escrow_use'] == 1)
+                $escw_yn         = 'Y';
+
+        }
+        $depositor       = '';  // 입금할 계좌 예금주 (나이스페이 경우 가상계좌의 예금주명을 리턴받지 못합니다. )
+        $account         = nicepay_res('VbankNum', $respArr);
+        $commid          = '';    // 통신사 코드
+        $mobile_no       = '';    // 휴대폰결제시 휴대폰번호 (나이스페이 경우 결제한 휴대폰번호를 리턴받지 못합니다.)
+        $card_name       = nicepay_res('CardName', $respArr);
+
+	} catch(Exception $e) {
+		$e->getMessage();
+		$data = Array(
+			'TID' => $txTid,
+			'AuthToken' => $authToken,
+			'MID' => $mid,
+			'Amt' => $amt,
+			'EdiDate' => $ediDate,
+			'SignData' => $signData,
+			'NetCancel' => '1',
+			'CharSet' => 'utf-8'
+		);
+		/*
+		*************************************************************************************
+		* <NET CANCEL>
+		* If an exception occurs during communication, cancelation is recommended
+		*************************************************************************************
+		*/			
+		$response = nicepay_reqPost($data, $netCancelURL);
+		// jsonRespDump($response);
+
+        alert("결제 오류로 더 이상 진행할수 없습니다.");
+	}	
+	
+} else {
+	//When authentication fail
+	$ResultCode = $authResultCode; 	
+	$ResultMsg = $authResultMsg;
+
+    alert($ResultMsg.' 실패 코드 : '.$ResultCode);
+}

mobile/shop/nicepay/orderform.1.php

@@ -0,0 +1,140 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
+?>
+
+<!-- PC payment window only (not required for mobile payment window)-->
+<script src="https://web.nicepay.co.kr/v3/webstd/js/nicepay-3.0.js" type="text/javascript"></script>
+<script type="text/javascript">
+//It is executed when call payment window.
+function nicepayStart(f){
+	if(checkPlatform(window.navigator.userAgent) == "mobile"){
+		document.sm_form.action = "https://web.nicepay.co.kr/v3/v3Payment.jsp";
+		document.sm_form.acceptCharset="euc-kr";
+		document.sm_form.submit();
+	}else{
+		goPay(document.sm_form);
+	}
+}
+
+//[PC Only]When pc payment window is closed, nicepay-3.0.js call back nicepaySubmit() function <<'nicepaySubmit()' DO NOT CHANGE>>
+function nicepaySubmit(){
+	document.sm_form.submit();
+}
+
+//[PC Only]payment window close function <<'nicepayClose()' DO NOT CHANGE>>
+function nicepayClose(){
+	alert("payment window is closed");
+}
+
+//pc, mobile chack script (sample code)
+function checkPlatform(ua) {
+	if(ua === undefined) {
+		ua = window.navigator.userAgent;
+	}
+	
+	ua = ua.toLowerCase();
+	var platform = {};
+	var matched = {};
+	var userPlatform = "pc";
+	var platform_match = /(ipad)/.exec(ua) || /(ipod)/.exec(ua) 
+		|| /(windows phone)/.exec(ua) || /(iphone)/.exec(ua) 
+		|| /(kindle)/.exec(ua) || /(silk)/.exec(ua) || /(android)/.exec(ua) 
+		|| /(win)/.exec(ua) || /(mac)/.exec(ua) || /(linux)/.exec(ua)
+		|| /(cros)/.exec(ua) || /(playbook)/.exec(ua)
+		|| /(bb)/.exec(ua) || /(blackberry)/.exec(ua)
+		|| [];
+	
+	matched.platform = platform_match[0] || "";
+	
+	if(matched.platform) {
+		platform[matched.platform] = true;
+	}
+	
+	if(platform.android || platform.bb || platform.blackberry
+			|| platform.ipad || platform.iphone 
+			|| platform.ipod || platform.kindle 
+			|| platform.playbook || platform.silk
+			|| platform["windows phone"]) {
+		userPlatform = "mobile";
+	}
+	
+	if(platform.cros || platform.mac || platform.linux || platform.win) {
+		userPlatform = "pc";
+	}
+	
+	return userPlatform;
+}
+
+function nicepay_create_signdata(frm)
+{
+    // 데이터 암호화 처리
+    var result = true;
+    $.ajax({
+        url: g5_url+"/shop/nicepay/createsigndata.php",
+        type: "POST",
+        data: {
+            price : frm.good_mny.value
+        },
+        dataType: "json",
+        async: false,
+        cache: false,
+        success: function(data) {
+            if(data.error == "") {
+                frm.EdiDate.value = data.ediDate;
+                frm.SignData.value = data.SignData;
+            } else {
+                alert(data.error);
+                result = false;
+            }
+        }
+    });
+
+    return result;
+}
+</script>
+
+<form name="sm_form" method="post" action="" accept-charset="euc-kr">
+<input type="hidden" name="PayMethod" value="CARD">
+<input type="hidden" name="GoodsName" value="<?php echo get_text($goods); ?>">
+<input type="hidden" name="Amt" value="<?php echo $tot_price; ?>">
+<input type="hidden" name="MID" value="<?php echo $default['de_nicepay_mid']; ?>">
+<input type="hidden" name="Moid" value="<?php echo $od_id; ?>">
+<input type="hidden" name="BuyerName" value="">
+<input type="hidden" name="BuyerEmail" value="">
+<input type="hidden" name="BuyerTel" value="">
+<input type="hidden" name="ReturnURL" value="<?php echo $nicepay_returnURL; ?>">
+<input type="hidden" name="VbankExpDate" value="">
+<input type="hidden" name="NpLang" value="KO"> <!-- EN:English, CN:Chinese, KO:Korean -->
+<input type="hidden" name="GoodsCl" value="1">	<!-- products(1), contents(0)) -->
+<input type="hidden" name="TransType" value="<?php echo $default['de_escrow_use'] ? '1' : '0';?>">	<!-- USE escrow false(0)/true(1) --> 
+<input type="hidden" name="CharSet" value="utf-8">	<!-- Return CharSet -->
+<input type="hidden" name="ReqReserved" value="">	<!-- mall custom field -->
+<input type="hidden" name="EdiDate" value=""> <!-- YYYYMMDDHHMISS -->
+<input type="hidden" name="SignData" value="">	<!-- EncryptData -->
+
+<input type="hidden" name="DirectShowOpt" value=""> 
+<input type="hidden" name="SelectCardCode" value=""> <!-- 카드사 노출 제한, 카드코드 값(ex 비씨:01, 삼성:04) -->
+<input type="hidden" name="NicepayReserved" value="">   <!-- 간편결제 (카카오페이에 사용됨) -->
+<input type="hidden" name="DirectEasyPay"> <!-- 간편결제 요청 값 (네이버페이에 사용됨) -->
+<input type="hidden" name="EasyPayMethod">  <!-- 간편결제 (네이버페이에 사용됨) -->
+<input type="hidden" name="EasyPayCardCode"> <!-- 간편결제 카드 코드 -->
+<input type="hidden" name="EasyPayQuota"> <!-- 간편결제 할부개월 (3개월일 경우 03 으로 설정) -->
+<input type="hidden" name="MultiEasyPayQuota"> <!-- 간편결제 할부개월 다중 설정 옵션 PAYCO와 네이버페이만 가능 -->
+
+<input type="hidden" name="good_mny"     value="<?php echo $tot_price; ?>" >
+
+<?php if ($default['de_tax_flag_use']) { ?>
+<!-- 필드명:SupplyAmt / 사이즈:12 / 설명:공급가 액 -->
+<input type="hidden" name="SupplyAmt" value="<?php echo $comm_tax_mny; ?>"> <!-- 과세금액    -->
+<!-- 필드명:GoodsVat / 사이즈:12 / 설명:부가가 치세 -->
+<input type="hidden" name="GoodsVat" value="<?php echo $comm_vat_mny; ?>">  <!-- 부가세	    -->
+<!-- 필드명:ServiceAmt / 사이즈:12 / 설명:봉사료 -->
+<input type="hidden" name="ServiceAmt" value="0">
+<!-- 필드명:TaxFreeAmt / 사이즈:12 / 설명:면세 금액 -->
+<input type="hidden" name="TaxFreeAmt" value="<?php echo $comm_free_mny; ?>">
+
+<input type="hidden" name="comm_tax_mny"	  value="<?php echo $comm_tax_mny; ?>">         <!-- 과세금액    -->
+<input type="hidden" name="comm_vat_mny"      value="<?php echo $comm_vat_mny; ?>">         <!-- 부가세	    -->
+<input type="hidden" name="comm_free_mny"     value="<?php echo $comm_free_mny; ?>">        <!-- 비과세 금액 -->
+<?php } ?>
+</form>

mobile/shop/nicepay/orderform.2.php

@@ -0,0 +1,17 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
+?>
+
+<input type="hidden" name="good_mny"          value="<?php echo $tot_price ?>" >
+
+<?php if($default['de_tax_flag_use']) { ?>
+<input type="hidden" name="comm_tax_mny"      value="<?php echo $comm_tax_mny; ?>">         <!-- 과세금액    -->
+<input type="hidden" name="comm_vat_mny"      value="<?php echo $comm_vat_mny; ?>">         <!-- 부가세     -->
+<input type="hidden" name="comm_free_mny"     value="<?php echo $comm_free_mny; ?>">        <!-- 비과세 금액 -->
+<?php } ?>
+
+<div id="display_pay_button" class="btn_confirm">
+    <span id="show_req_btn"><input type="button" name="submitChecked" onClick="pay_approval();" value="결제등록" class="btn_submit"></span>
+    <span id="show_pay_btn" style="display:none;"><input type="button" onClick="forderform_check();" value="주문하기" class="btn_submit"></span>
+    <a href="<?php echo G5_SHOP_URL; ?>" class="btn_cancel">취소</a>
+</div>

mobile/shop/nicepay/orderform.3.php

@@ -0,0 +1,2 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가;

mobile/shop/nicepay/return_url_result.php

@@ -0,0 +1,87 @@
+<?php
+include_once('./_common.php');
+include_once(G5_MSHOP_PATH.'/settle_nicepay.inc.php');
+
+$authResultCode = isset($_POST['AuthResultCode']) ? clean_xss_tags($_POST['AuthResultCode']) : '';		// authentication result code 0000:success
+$authResultMsg = isset($_POST['AuthResultMsg']) ? clean_xss_tags($_POST['AuthResultMsg']) : '';		// authentication result message
+$mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : '';							// merchant id
+$moid = isset($_POST['Moid']) ? clean_xss_tags($_POST['Moid']) : '';							// order number
+
+$sql = " select * from {$g5['g5_shop_order_data_table']} where od_id = '$moid' ";
+$row = sql_fetch($sql);
+
+if (empty($row)) {
+    die('');
+}
+
+$data = unserialize(base64_decode($row['dt_data']));
+
+if(isset($data['pp_id']) && $data['pp_id']) {
+    $order_action_url = G5_HTTPS_MSHOP_URL.'/personalpayformupdate.php';
+    $page_return_url  = G5_SHOP_URL.'/personalpayform.php?pp_id='.$data['pp_id'];
+} else {
+    $order_action_url = G5_HTTPS_MSHOP_URL.'/orderformupdate.php';
+    $page_return_url  = G5_SHOP_URL.'/orderform.php';
+    if($_SESSION['ss_direct'])
+        $page_return_url .= '?sw_direct=1';
+}
+
+$params = array();
+$var_datas = array();
+
+foreach($data as $key=>$value) {
+    if(is_array($value)) {
+        foreach($value as $k=>$v) {
+            $_POST[$key][$k] = $params[$key][$k] = clean_xss_tags(strip_tags($v));
+        }
+    } else {
+        if(in_array($key, array('od_memo'))){
+            $_POST[$key] = $params[$key] = clean_xss_tags(strip_tags($value), 0, 0, 0, 0);
+        } else {
+            $_POST[$key] = $params[$key] = clean_xss_tags(strip_tags($value));
+        }
+    }
+}
+
+// 성공했다면
+if ($authResultCode === '0000') {
+
+    if(isset($data['pp_id']) && $data['pp_id']) {   //개인결제
+
+        foreach($params as $key=>$value){
+
+            if( in_array($key, shop_order_data_fields(1)) ){
+
+                $var_datas[$key] = $value;
+                
+                $$key = $value;
+            }
+
+        }
+        
+        include_once(G5_MSHOP_PATH.'/personalpayformupdate.php');
+
+    } else {    //상점주문
+
+        foreach($params as $key=>$value){
+
+            if( in_array($key, shop_order_data_fields()) ){
+
+                $var_datas[$key] = $value;
+                
+                $$key = $value;
+            }
+
+        }
+
+        $od_send_cost = (int) $_POST['od_send_cost'];
+        $od_send_cost2 = (int) $_POST['od_send_cost2'];
+
+        include_once(G5_MSHOP_PATH.'/orderformupdate.php');
+    }
+
+} else {
+    // 실패시
+
+    alert('오류 : '.$authResultMsg.' 코드 : '.$authResultCode, $page_return_url);
+}

mobile/shop/orderform.sub.php

@@ -613,19 +613,55 @@ if($is_kakaopay_use) {
 
             $multi_settle++;
 
-            if($default['de_pg_service'] === 'kcp' && isset($default['de_easy_pay_services']) && $default['de_easy_pay_services']){
+            if (in_array($default['de_pg_service'], array('kcp', 'nicepay')) && isset($default['de_easy_pay_services']) && $default['de_easy_pay_services']) {
                 $de_easy_pay_service_array = explode(',', $default['de_easy_pay_services']);
-                if( in_array('nhnkcp_payco', $de_easy_pay_service_array) ){
-                    $easypay_prints['nhnkcp_payco'] = '<li><input type="radio" id="od_settle_nhnkcp_payco" name="od_settle_case" data-pay="payco" value="간편결제"> <label for="od_settle_nhnkcp_payco" class="PAYCO nhnkcp_payco lb_icon" title="NHN_KCP - PAYCO">PAYCO</label></li>';
+
+                if ($default['de_pg_service'] === 'kcp') {
+                    if( in_array('nhnkcp_payco', $de_easy_pay_service_array) ){
+                        $easypay_prints['nhnkcp_payco'] = '<li><input type="radio" id="od_settle_nhnkcp_payco" name="od_settle_case" data-pay="payco" value="간편결제"> <label for="od_settle_nhnkcp_payco" class="PAYCO nhnkcp_payco lb_icon" title="NHN_KCP - PAYCO">PAYCO</label></li>';
+                    }
+                    if( in_array('nhnkcp_naverpay', $de_easy_pay_service_array) ){
+                        if(isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){
+                            $easypay_prints['nhnkcp_naverpay_card'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_card" title="NHN_KCP - 네이버페이 카드결제">카드</label></li>';
+                            
+                            $easypay_prints['nhnkcp_naverpay_money'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay_money" name="od_settle_case" data-pay="naverpay" data-money="1" value="간편결제" > <label for="od_settle_nhnkcp_naverpay_money" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_money" title="NHN_KCP - 네이버페이 머니/포인트 결제">머니</label></li>';
+                        } else {
+                            $easypay_prints['nhnkcp_naverpay_card'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이 카드결제">네이버페이</label></li>';
+                        }
+                    }
+                    if( in_array('nhnkcp_kakaopay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nhnkcp_kakaopay'] = '<li><input type="radio" id="od_settle_nhnkcp_kakaopay" name="od_settle_case" data-pay="kakaopay" value="간편결제" > <label for="od_settle_nhnkcp_kakaopay" class="kakaopay_icon nhnkcp_kakaopay lb_icon" title="NHN_KCP - 카카오페이">카카오페이</label></li>';
+                    }
+                } else if ($default['de_pg_service'] === 'nicepay') {
+                    if( in_array('nicepay_samsungpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_samsungpay'] = '<li><input type="radio" id="od_settle_nicepay_samsungpay" name="od_settle_case" data-pay="nice_samsungpay" value="간편결제"> <label for="od_settle_nicepay_samsungpay" class="samsung_pay nice_samsungpay lb_icon" title="NICEPAY - 삼성페이">삼성페이</label></li>';
+                    }
+                    if( in_array('nicepay_naverpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_naverpay'] = '<li><input type="radio" id="od_settle_nicepay_naverpay" name="od_settle_case" data-pay="nice_naverpay" value="간편결제" > <label for="od_settle_nicepay_naverpay" class="naverpay_icon nicepay_naverpay lb_icon" title="NICEPAY - 네이버페이">네이버페이</label></li>';
+                    }
+                    if( in_array('nicepay_kakaopay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_kakaopay'] = '<li><input type="radio" id="od_settle_nicepay_kakaopay" name="od_settle_case" data-pay="nice_kakaopay" value="간편결제" > <label for="od_settle_nicepay_kakaopay" class="kakaopay_icon nicepay_kakaopay lb_icon" title="NICEPAY - 카카오페이">카카오페이</label></li>';
+                    }
+                    if( in_array('nicepay_paycopay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_paycopay'] = '<li><input type="radio" id="od_settle_nicepay_paycopay" name="od_settle_case" data-pay="nice_paycopay" value="간편결제" > <label for="od_settle_nicepay_paycopay" class="paycopay_icon nicepay_paycopay lb_icon" title="NICEPAY - 페이코">페이코</label></li>';
+                    }
+                    if( in_array('nicepay_skpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_skpay'] = '<li><input type="radio" id="od_settle_nicepay_skpay" name="od_settle_case" data-pay="nice_skpay" value="간편결제" > <label for="od_settle_nicepay_skpay" class="skpay_icon nicepay_skpay lb_icon" title="NICEPAY - SK페이">SK페이</label></li>';
+                    }
+                    if( in_array('nicepay_ssgpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_ssgpay'] = '<li><input type="radio" id="od_settle_nicepay_ssgpay" name="od_settle_case" data-pay="nice_ssgpay" value="간편결제" > <label for="od_settle_nicepay_ssgpay" class="ssgpay_icon nicepay_ssgpay lb_icon" title="NICEPAY - SSGPAY">SSGPAY</label></li>';
+                    }
+                    if( in_array('nicepay_lpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_lpay'] = '<li><input type="radio" id="od_settle_nicepay_lpay" name="od_settle_case" data-pay="nice_lpay" value="간편결제" > <label for="od_settle_nicepay_lpay" class="lpay_icon nicepay_lpay lb_icon" title="NICEPAY - LPAY">LPAY</label></li>';
+                    }
                 }
-                if( in_array('nhnkcp_naverpay', $de_easy_pay_service_array) ){
-                    $easypay_prints['nhnkcp_naverpay'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label></li>';
-                }
-                if( in_array('nhnkcp_kakaopay', $de_easy_pay_service_array) ){
-                    $easypay_prints['nhnkcp_kakaopay'] = '<li><input type="radio" id="od_settle_nhnkcp_kakaopay" name="od_settle_case" data-pay="kakaopay" value="간편결제" > <label for="od_settle_nhnkcp_kakaopay" class="kakaopay_icon nhnkcp_kakaopay lb_icon" title="NHN_KCP - 카카오페이">카카오페이</label></li>';
-                }
-                if( in_array('nhnkcp_applepay', $de_easy_pay_service_array) && preg_match('~^(?:(?:(?:Mozilla/\d\.\d\s*\()+|Mobile\s*Safari\s*\d+\.\d+(\.\d+)?\s*)(?:iPhone(?:\s+Simulator)?|iPad|iPod);\s*(?:U;\s*)?(?:[a-z]+(?:-[a-z]+)?;\s*)?CPU\s*(?:iPhone\s*)?(?:OS\s*\d+_\d+(?:_\d+)?\s*)?(?:like|comme)\s*Mac\s*O?S?\s*X(?:;\s*[a-z]+(?:-[a-z]+)?)?\)\s*)?(?:AppleWebKit/\d+(?:\.\d+(?:\.\d+)?|\s*\+)?\s*)?(?:\(KHTML,\s*(?:like|comme)\s*Gecko\s*\)\s*)?(?:Version/\d+\.\d+(?:\.\d+)?\s*)?(?:Mobile/\w+\s*)?(?:Safari/\d+\.\d+(?:\.\d+)?.*)?$~', $_SERVER['HTTP_USER_AGENT']) ){
-                    $easypay_prints['nhnkcp_applepay'] = '<li><input type="radio" id="od_settle_nhnkcp_applepay" name="od_settle_case" data-pay="applepay" value="간편결제" > <label for="od_settle_nhnkcp_applepay" class="applepay_icon nhnkcp_applepay lb_icon" title="NHN_KCP - 애플페이">애플페이</label></li>';
+
+                if( (in_array('nhnkcp_applepay', $de_easy_pay_service_array) || in_array('nicepay_applepay', $de_easy_pay_service_array)) && preg_match('~^(?:(?:(?:Mozilla/\d\.\d\s*\()+|Mobile\s*Safari\s*\d+\.\d+(\.\d+)?\s*)(?:iPhone(?:\s+Simulator)?|iPad|iPod);\s*(?:U;\s*)?(?:[a-z]+(?:-[a-z]+)?;\s*)?CPU\s*(?:iPhone\s*)?(?:OS\s*\d+_\d+(?:_\d+)?\s*)?(?:like|comme)\s*Mac\s*O?S?\s*X(?:;\s*[a-z]+(?:-[a-z]+)?)?\)\s*)?(?:AppleWebKit/\d+(?:\.\d+(?:\.\d+)?|\s*\+)?\s*)?(?:\(KHTML,\s*(?:like|comme)\s*Gecko\s*\)\s*)?(?:Version/\d+\.\d+(?:\.\d+)?\s*)?(?:Mobile/\w+\s*)?(?:Safari/\d+\.\d+(?:\.\d+)?.*)?$~', $_SERVER['HTTP_USER_AGENT']) ){
+                    if ($default['de_pg_service'] === 'kcp' && in_array('nhnkcp_applepay', $de_easy_pay_service_array)) {
+                        $easypay_prints['nhnkcp_applepay'] = '<li><input type="radio" id="od_settle_nhnkcp_applepay" name="od_settle_case" data-pay="applepay" value="간편결제" > <label for="od_settle_nhnkcp_applepay" class="applepay_icon nhnkcp_applepay lb_icon" title="NHN_KCP - 애플페이">애플페이</label></li>';
+                    } else if ($default['de_pg_service'] === 'nicepay' && in_array('nicepay_applepay', $de_easy_pay_service_array)) {
+                        $easypay_prints['nicepay_applepay'] = '<li><input type="radio" id="od_settle_nicepay_applepay" name="od_settle_case" data-pay="nice_applepay" value="간편결제" > <label for="od_settle_nicepay_applepay" class="applepay_icon nicepay_applepay lb_icon" title="NICEPAY - 애플페이">애플페이</label></li>';
+                    }
                 }
             } else {
                 $easypay_prints[strtolower($pg_easy_pay_name)] = '<li><input type="radio" id="od_settle_easy_pay" name="od_settle_case" value="간편결제" '.$checked.'> <label for="od_settle_easy_pay" class="'.$pg_easy_pay_name.' lb_icon">'.$pg_easy_pay_name.'</label></li>';
@@ -633,7 +669,14 @@ if($is_kakaopay_use) {
         }
 
         if( ! isset($easypay_prints['nhnkcp_naverpay']) && function_exists('is_use_easypay') && is_use_easypay('global_nhnkcp') ){
-            $easypay_prints['nhnkcp_naverpay'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label></li>';
+            
+            if(isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){
+                $easypay_prints['nhnkcp_naverpay_card'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_card" title="NHN_KCP - 네이버페이 카드결제">카드</label></li>';
+                
+                $easypay_prints['nhnkcp_naverpay_money'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay_money" name="od_settle_case" data-pay="naverpay" data-money="1" value="간편결제" > <label for="od_settle_nhnkcp_naverpay_money" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_money" title="NHN_KCP - 네이버페이 머니/포인트 결제">머니</label></li>';
+            } else {
+                $easypay_prints['nhnkcp_naverpay'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label></li>';
+            }
         }
 
         if($easypay_prints) {
@@ -1028,7 +1071,7 @@ $(function() {
         $("#show_pay_btn").css("display", "inline");
     });
 
-    $("#od_settle_iche,#od_settle_card,#od_settle_vbank,#od_settle_hp,#od_settle_easy_pay,#od_settle_kakaopay,#od_settle_samsungpay,#od_settle_nhnkcp_payco,#od_settle_nhnkcp_naverpay,#od_settle_nhnkcp_kakaopay,#od_settle_inicislpay,#od_settle_inicis_kakaopay").bind("click", function() {
+    $("#od_settle_iche,#od_settle_card,#od_settle_vbank,#od_settle_hp,#od_settle_easy_pay,#od_settle_kakaopay,#od_settle_samsungpay,#od_settle_nhnkcp_payco,#od_settle_nhnkcp_naverpay,#od_settle_nhnkcp_naverpay_money,#od_settle_nhnkcp_kakaopay,#od_settle_inicislpay,#od_settle_inicis_kakaopay").bind("click", function() {
         $("#settle_bank").hide();
         $("#show_req_btn").css("display", "inline");
         $("#show_pay_btn").css("display", "none");
@@ -1263,7 +1306,7 @@ function pay_approval()
         var send_coupon = parseInt(pf.od_send_coupon.value);
         f.good_mny.value = od_price + send_cost + send_cost2 - send_coupon - temp_point;
     }
-
+    
     // 카카오페이 지불
     if(settle_method == "KAKAOPAY") {
         <?php if($default['de_tax_flag_use']) { ?>
@@ -1308,12 +1351,21 @@ function pay_approval()
         if(typeof f.pay_method !== "undefined") f.pay_method.value = "";
 
         if(settle_method == "간편결제"){
-            var nhnkcp_easy_pay = jQuery("input[name='od_settle_case']:checked" ).attr("data-pay");
+            var nhnkcp_easy_pay = jQuery("input[name='od_settle_case']:checked").attr("data-pay");
 
             if(nhnkcp_easy_pay === "naverpay"){
                 if(typeof f.naverpay_direct !== "undefined"){
                     f.naverpay_direct.value = "Y";
                 }
+                
+                var is_money = jQuery("input[name='od_settle_case']:checked").attr("data-money");
+                
+                if (is_money) {     // 머니/포인트 결제
+                    jQuery(f).find("input[name='naverpay_point_direct']").val("Y");
+                } else {    // 카드 결제
+                    jQuery(f).find("input[name='naverpay_point_direct']").val("");
+                }
+
             } else if(nhnkcp_easy_pay === "kakaopay"){
                 if(typeof f.kakaopay_direct !== "undefined") f.kakaopay_direct.value = "Y";
             } else if(nhnkcp_easy_pay === "applepay"){
@@ -1417,6 +1469,86 @@ function pay_approval()
         <?php } ?>
         f.P_RETURN_URL.value = "<?php echo $return_url.$od_id; ?>";
         f.action = "https://mobile.inicis.com/smart/" + paymethod + "/";
+        <?php } else if($default['de_pg_service'] == 'nicepay') { ?>
+
+        f.Amt.value       = f.good_mny.value;
+        f.BuyerName.value   = pf.od_name.value;
+        f.BuyerEmail.value  = pf.od_email.value;
+        f.BuyerTel.value    = pf.od_hp.value ? pf.od_hp.value : pf.od_tel.value;
+
+        f.DirectShowOpt.value = "";     // 간편결제 요청 값 초기화
+        f.DirectEasyPay.value = "";     // 간편결제 요청 값 초기화
+        f.NicepayReserved.value = "";   // 간편결제 요청 값 초기화
+        f.EasyPayMethod.value = "";   // 간편결제 요청 값 초기화
+
+            <?php if ($default['de_escrow_use']) {  // 간편결제시 에스크로값이 0이 되므로 기본설정값을 지정 ?>
+            f.TransType.value = "1";
+            <?php } ?>
+
+        switch(settle_method) {
+            case "계좌이체":
+                paymethod = "BANK";
+                break;
+            case "가상계좌":
+                paymethod = "VBANK";
+                break;
+            case "휴대폰":
+                paymethod = "CELLPHONE";
+                break;
+            case "신용카드":
+                paymethod = "CARD";
+                break;
+            case "간편결제":
+                paymethod = "CARD";
+                f.DirectShowOpt.value = "CARD";
+                f.TransType.value = "0";    // 간편결제의 경우 에스크로를 사용할수 없다.
+
+                var nicepay_easy_pay = jQuery("input[name='od_settle_case']:checked" ).attr("data-pay");
+
+                if(nicepay_easy_pay === "nice_naverpay"){
+                    if(typeof f.DirectEasyPay !== "undefined") f.DirectEasyPay.value = "E020";
+                    
+                    <?php 
+                        // * 카드 선택 시 전액 카드로 결제, 포인트 선택 시 전액 포인트로 결제.
+                        // (카드와 포인트를 같이 사용하는 복합결제 형태의 결제는 불가함.)
+                        // - 카드: EasyPayMethod=”E020=CARD”, 포인트: EasyPayMethod=”E020=POINT”
+                    ?>
+                    
+                    if(typeof f.EasyPayMethod !== "undefined") f.EasyPayMethod.value = "E020=CARD";
+
+                } else if(nicepay_easy_pay === "nice_kakaopay"){
+                    if(typeof f.NicepayReserved !== "undefined") f.NicepayReserved.value = "DirectKakao=Y";
+                } else if(nicepay_easy_pay === "nice_samsungpay"){
+                    if(typeof f.DirectEasyPay !== "undefined") f.DirectEasyPay.value = "E021";
+                } else if(nicepay_easy_pay === "nice_applepay"){
+                    if(typeof f.DirectEasyPay !== "undefined") f.DirectEasyPay.value = "E022";
+                } else if(nicepay_easy_pay === "nice_paycopay"){
+                    if(typeof f.NicepayReserved !== "undefined") f.NicepayReserved.value = "DirectPayco=Y";
+                } else if(nicepay_easy_pay === "nice_skpay"){
+                    if(typeof f.NicepayReserved !== "undefined") f.NicepayReserved.value = "DirectPay11=Y";
+                } else if(nicepay_easy_pay === "nice_ssgpay"){
+                    if(typeof f.DirectEasyPay !== "undefined") f.DirectEasyPay.value = "E007";
+                } else if(nicepay_easy_pay === "nice_lpay"){
+                    if(typeof f.DirectEasyPay !== "undefined") f.DirectEasyPay.value = "E018";
+                }
+
+                break;
+            default:
+                paymethod = "무통장";
+                break;
+        }
+        
+        f.PayMethod.value = paymethod;
+
+        <?php if($default['de_tax_flag_use']) { ?>
+        f.SupplyAmt.value = pf.comm_tax_mny.value;
+        f.GoodsVat.value = pf.comm_vat_mny.value;
+        f.TaxFreeAmt.value = pf.comm_free_mny.value;
+        <?php } ?>
+
+        if (! nicepay_create_signdata(f)) {
+            return false;
+        }
         <?php } ?>
 
         // 주문 정보 임시저장
@@ -1438,6 +1570,11 @@ function pay_approval()
             return false;
         }
 
+        <?php if ($default['de_pg_service'] == 'nicepay') { ?>
+        nicepayStart(f);
+        return false;
+        <?php } ?>
+
         f.submit();
     }
 

mobile/shop/orderformupdate.php

@@ -360,6 +360,9 @@ else if ($od_settle_case == "계좌이체")
         case 'inicis':
             include G5_MSHOP_PATH.'/inicis/pay_result.php';
             break;
+        case 'nicepay':
+            include G5_MSHOP_PATH.'/nicepay/nicepay_result.php';
+            break;
         default:
             include G5_MSHOP_PATH.'/kcp/pp_ax_hub.php';
             $bank_name  = iconv("cp949", "utf-8", $bank_name);
@@ -386,6 +389,9 @@ else if ($od_settle_case == "가상계좌")
         case 'inicis':
             include G5_MSHOP_PATH.'/inicis/pay_result.php';
             break;
+        case 'nicepay':
+            include G5_MSHOP_PATH.'/nicepay/nicepay_result.php';
+            break;
         default:
             include G5_MSHOP_PATH.'/kcp/pp_ax_hub.php';
             $bankname   = iconv("cp949", "utf-8", $bankname);
@@ -412,6 +418,9 @@ else if ($od_settle_case == "휴대폰")
         case 'inicis':
             include G5_MSHOP_PATH.'/inicis/pay_result.php';
             break;
+        case 'nicepay':
+            include G5_MSHOP_PATH.'/nicepay/nicepay_result.php';
+            break;
         default:
             include G5_MSHOP_PATH.'/kcp/pp_ax_hub.php';
             break;
@@ -436,6 +445,9 @@ else if ($od_settle_case == "신용카드")
         case 'inicis':
             include G5_MSHOP_PATH.'/inicis/pay_result.php';
             break;
+        case 'nicepay':
+            include G5_MSHOP_PATH.'/nicepay/nicepay_result.php';
+            break;
         default:
             include G5_MSHOP_PATH.'/kcp/pp_ax_hub.php';
             $card_name  = iconv("cp949", "utf-8", $card_name);
@@ -462,6 +474,9 @@ else if ($od_settle_case == "간편결제")
         case 'inicis':
             include G5_MSHOP_PATH.'/inicis/pay_result.php';
             break;
+        case 'nicepay':
+            include G5_MSHOP_PATH.'/nicepay/nicepay_result.php';
+            break;
         default:
             include G5_MSHOP_PATH.'/kcp/pp_ax_hub.php';
             $card_name  = iconv("cp949", "utf-8", $card_name);
@@ -530,6 +545,10 @@ if($tno) {
             case 'inicis':
                 include G5_SHOP_PATH.'/inicis/inipay_cancel.php';
                 break;
+            case 'nicepay':
+                $cancelAmt = (int)$pg_price;
+                include G5_SHOP_PATH.'/nicepay/cancel_process.php';
+                break;
             case 'KAKAOPAY':
                 $_REQUEST['TID']               = $tno;
                 $_REQUEST['Amt']               = $amount;
@@ -679,6 +698,10 @@ if(! $result || ! (isset($exists_order['od_id']) && $od_id && $exists_order['od_
             case 'inicis':
                 include G5_SHOP_PATH.'/inicis/inipay_cancel.php';
                 break;
+            case 'nicepay':
+                $cancelAmt = (int)$pg_price;
+                include G5_SHOP_PATH.'/nicepay/cancel_process.php';
+                break;
             case 'KAKAOPAY':
                 $_REQUEST['TID']               = $tno;
                 $_REQUEST['Amt']               = $amount;
@@ -737,6 +760,10 @@ if(!$result) {
             case 'inicis':
                 include G5_SHOP_PATH.'/inicis/inipay_cancel.php';
                 break;
+            case 'nicepay':
+                $cancelAmt = (int)$pg_price;
+                include G5_SHOP_PATH.'/nicepay/cancel_process.php';
+                break;
             case 'KAKAOPAY':
                 $_REQUEST['TID']               = $tno;
                 $_REQUEST['Amt']               = $amount;
@@ -843,7 +870,7 @@ if($config['cf_sms_use'] && ($default['de_sms_use2'] || $default['de_sms_use3'])
             $sms_content = str_replace("{보낸분}", $od_name, $sms_content);
             $sms_content = str_replace("{받는분}", $od_b_name, $sms_content);
             $sms_content = str_replace("{주문번호}", $od_id, $sms_content);
-            $sms_content = str_replace("{주문금액}", number_format($tot_ct_price + $od_send_cost + $od_send_cost2), $sms_content);
+            $sms_content = str_replace("{주문금액}", number_format($tot_ct_price + $od_send_cost + (int) $od_send_cost2), $sms_content);
             $sms_content = str_replace("{회원아이디}", $member['mb_id'], $sms_content);
             $sms_content = str_replace("{회사명}", $default['de_admin_company_name'], $sms_content);
 

mobile/shop/orderinquiryview.php

@@ -248,6 +248,7 @@ if($od['od_pg'] == 'lg') {
             $app_no_subj = '승인번호';
             $app_no = $od['od_app_no'];
             $disp_bank = false;
+            $disp_receipt = true;
         } else if($od['od_settle_case'] == '휴대폰') {
             $app_no_subj = '휴대폰번호';
             $app_no = $od['od_bank_account'];
@@ -297,7 +298,7 @@ if($od['od_pg'] == 'lg') {
                 }
 
                 // 승인번호, 휴대폰번호, 거래번호
-                if($app_no_subj && $app_no)
+                if($app_no_subj && trim($app_no))
                 {
                 ?>
                 <tr>
@@ -339,6 +340,8 @@ if($od['od_pg'] == 'lg') {
                                 $hp_receipt_script = 'showReceiptByTID(\''.$LGD_MID.'\', \''.$LGD_TID.'\', \''.$LGD_HASHDATA.'\');';
                             } else if($od['od_pg'] == 'inicis') {
                                 $hp_receipt_script = 'window.open(\'https://iniweb.inicis.com/DefaultWebApp/mall/cr/cm/mCmReceipt_head.jsp?noTid='.$od['od_tno'].'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
+                            } else if($od['od_pg'] == 'nicepay') {
+                                $hp_receipt_script = 'window.open(\'https://npg.nicepay.co.kr/issue/IssueLoader.do?type=0&TID='.$od['od_tno'].'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
                             } else {
                                 $hp_receipt_script = 'window.open(\''.G5_BILL_RECEIPT_URL.'mcash_bill&tno='.$od['od_tno'].'&order_no='.$od['od_id'].'&trade_mony='.$od['od_receipt_price'].'\', \'winreceipt\', \'width=500,height=690,scrollbars=yes,resizable=yes\');';
                             }
@@ -347,7 +350,7 @@ if($od['od_pg'] == 'lg') {
                         <?php
                         }
 
-                        if($od['od_settle_case'] == '신용카드' || is_inicis_order_pay($od['od_settle_case']) || (shop_is_taxsave($od, true) && $misu_price == 0) )
+                        if($od['od_settle_case'] == '신용카드' || $od['od_settle_case'] == '간편결제' || is_inicis_order_pay($od['od_settle_case']) || (shop_is_taxsave($od, true) && $misu_price == 0) )
                         {
                             if($od['od_pg'] == 'lg') {
                                 require_once G5_SHOP_PATH.'/settle_lg.inc.php';
@@ -356,6 +359,8 @@ if($od['od_pg'] == 'lg') {
                                 $LGD_HASHDATA = md5($LGD_MID.$LGD_TID.$LGD_MERTKEY);
 
                                 $card_receipt_script = 'showReceiptByTID(\''.$LGD_MID.'\', \''.$LGD_TID.'\', \''.$LGD_HASHDATA.'\');';
+                            } else if($od['od_pg'] == 'nicepay') {
+                                $card_receipt_script = 'window.open(\'https://npg.nicepay.co.kr/issue/IssueLoader.do?type=0&TID='.$od['od_tno'].'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
                             } else if($od['od_pg'] == 'inicis') {
                                 $card_receipt_script = 'window.open(\'https://iniweb.inicis.com/DefaultWebApp/mall/cr/cm/mCmReceipt_head.jsp?noTid='.$od['od_tno'].'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
                             } else {
@@ -401,10 +406,10 @@ if($od['od_pg'] == 'lg') {
                 <?php
                 }
 
-                // 현금영수증 발급을 사용하는 경우에만
-                if (function_exists('shop_is_taxsave') && shop_is_taxsave($od)) {
+                // 현금영수증 발급을 사용하는 경우 또는 현금영수증 발급을 한 주문건이면
+                if ((function_exists('shop_is_taxsave') && shop_is_taxsave($od)) || (function_exists('is_order_cashreceipt') && is_order_cashreceipt($od))) {
                     // 미수금이 없고 현금일 경우에만 현금영수증을 발급 할 수 있습니다.
-                    if ($misu_price == 0 && $od['od_receipt_price'] && ($od['od_settle_case'] == '무통장' || $od['od_settle_case'] == '계좌이체' || $od['od_settle_case'] == '가상계좌')) {
+                    if ($misu_price == 0 && is_order_cashreceipt($od)) {
                 ?>
                 <tr>
                     <th scope="row">현금영수증</th>
@@ -430,6 +435,8 @@ if($od['od_pg'] == 'lg') {
                         } else if($od['od_pg'] == 'inicis') {
                             $cash = unserialize($od['od_cash_info']);
                             $cash_receipt_script = 'window.open(\'https://iniweb.inicis.com/DefaultWebApp/mall/cr/cm/Cash_mCmReceipt.jsp?noTid='.$cash['TID'].'&clpaymethod=22\',\'showreceipt\',\'width=380,height=540,scrollbars=no,resizable=no\');';
+                        } else if($od['od_pg'] == 'nicepay') {
+                            $cash_receipt_script = 'window.open(\'https://npg.nicepay.co.kr/issue/IssueLoader.do?type=1&TID='.$od['od_tno'].'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
                         } else {
                             require_once G5_SHOP_PATH.'/settle_kcp.inc.php';
 
@@ -440,7 +447,7 @@ if($od['od_pg'] == 'lg') {
                         <a href="javascript:;" onclick="<?php echo $cash_receipt_script; ?>">현금영수증 확인하기</a>
                     <?php
                     }
-                    else
+                    else if (shop_is_taxsave($od))
                     {
                     ?>
                         <a href="javascript:;" onclick="window.open('<?php echo G5_SHOP_URL; ?>/taxsave.php?od_id=<?php echo $od_id; ?>', 'taxsave', 'width=550,height=400,scrollbars=1,menus=0');">현금영수증을 발급하시려면 클릭하십시오.</a>

mobile/shop/personalpayform.sub.php

@@ -206,6 +206,52 @@ function pay_approval()
     <?php } ?>
     f.P_RETURN_URL.value = "<?php echo $return_url.$pp_id; ?>";
     f.action = "https://mobile.inicis.com/smart/" + paymethod + "/";
+    <?php } else if($default['de_pg_service'] == 'nicepay') { ?>
+
+    f.Amt.value       = f.good_mny.value;
+    f.BuyerName.value   = pf.pp_name.value;
+    f.BuyerEmail.value  = pf.pp_email.value;
+    f.BuyerTel.value    = pf.pp_hp.value;
+
+    f.DirectShowOpt.value = "";     // 간편결제 요청 값 초기화
+    f.DirectEasyPay.value = "";     // 간편결제 요청 값 초기화
+    f.NicepayReserved.value = "";   // 간편결제 요청 값 초기화
+    f.EasyPayMethod.value = "";   // 간편결제 요청 값 초기화
+
+        <?php if ($default['de_escrow_use']) {  // 간편결제시 에스크로값이 0이 되므로 기본설정값을 지정 ?>
+        f.TransType.value = "1";
+        <?php } ?>
+
+    switch(settle_method) {
+        case "계좌이체":
+            paymethod = "BANK";
+            break;
+        case "가상계좌":
+            paymethod = "VBANK";
+            break;
+        case "휴대폰":
+            paymethod = "CELLPHONE";
+            break;
+        case "신용카드":
+            paymethod = "CARD";
+            break;
+        default:
+            paymethod = "무통장";
+            break;
+    }
+    
+    f.PayMethod.value = paymethod;
+
+    <?php if($default['de_tax_flag_use']) { ?>
+    f.SupplyAmt.value = pf.comm_tax_mny.value;
+    f.GoodsVat.value = pf.comm_vat_mny.value;
+    f.TaxFreeAmt.value = pf.comm_free_mny.value;
+    <?php } ?>
+
+    if (! nicepay_create_signdata(f)) {
+        return false;
+    }
+
     <?php } ?>
 
     //var new_win = window.open("about:blank", "tar_opener", "scrollbars=yes,resizable=yes");
@@ -229,7 +275,12 @@ function pay_approval()
         alert(save_result);
         return false;
     }
+    
+    <?php if($default['de_pg_service'] == 'nicepay') { ?>
+        nicepayStart(f);
 
+        return;
+    <?php } ?>
     f.submit();
 }
 

mobile/shop/personalpayformupdate.php

@@ -57,6 +57,9 @@ if ($pp_settle_case == "계좌이체")
         case 'inicis':
             include G5_MSHOP_PATH.'/inicis/pay_result.php';
             break;
+        case 'nicepay':
+            include G5_MSHOP_PATH.'/nicepay/nicepay_result.php';
+            break;
         default:
             include G5_MSHOP_PATH.'/kcp/pp_ax_hub.php';
             $bank_name  = iconv("cp949", "utf-8", $bank_name);
@@ -79,6 +82,9 @@ else if ($pp_settle_case == "가상계좌")
         case 'inicis':
             include G5_MSHOP_PATH.'/inicis/pay_result.php';
             break;
+        case 'nicepay':
+            include G5_MSHOP_PATH.'/nicepay/nicepay_result.php';
+            break;
         default:
             include G5_MSHOP_PATH.'/kcp/pp_ax_hub.php';
             $bankname   = iconv("cp949", "utf-8", $bankname);
@@ -102,6 +108,9 @@ else if ($pp_settle_case == "휴대폰")
         case 'inicis':
             include G5_MSHOP_PATH.'/inicis/pay_result.php';
             break;
+        case 'nicepay':
+            include G5_MSHOP_PATH.'/nicepay/nicepay_result.php';
+            break;
         default:
             include G5_MSHOP_PATH.'/kcp/pp_ax_hub.php';
             break;
@@ -122,6 +131,9 @@ else if ($pp_settle_case == "신용카드")
         case 'inicis':
             include G5_MSHOP_PATH.'/inicis/pay_result.php';
             break;
+        case 'nicepay':
+            include G5_MSHOP_PATH.'/nicepay/nicepay_result.php';
+            break;
         default:
             include G5_MSHOP_PATH.'/kcp/pp_ax_hub.php';
             $card_name  = iconv("cp949", "utf-8", $card_name);
@@ -150,6 +162,10 @@ if((int)$pp['pp_price'] !== (int)$pg_price) {
         case 'inicis':
             include G5_SHOP_PATH.'/inicis/inipay_cancel.php';
             break;
+        case 'nicepay':
+            $cancelAmt = (int)$pg_price;
+            include G5_SHOP_PATH.'/nicepay/cancel_process.php';
+            break;
         default:
             include G5_SHOP_PATH.'/kcp/pp_ax_hub_cancel.php';
             break;

mobile/shop/personalpayresult.php

@@ -147,6 +147,8 @@ if($pp['pp_pg'] == 'lg') {
                                 $hp_receipt_script = 'showReceiptByTID(\''.$LGD_MID.'\', \''.$LGD_TID.'\', \''.$LGD_HASHDATA.'\');';
                             } else if($pp['pp_pg'] == 'inicis') {
                                 $hp_receipt_script = 'window.open(\'https://iniweb.inicis.com/DefaultWebApp/mall/cr/cm/mCmReceipt_head.jsp?noTid='.$pp['pp_tno'].'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
+                            } else if($pp['pp_pg'] == 'nicepay') {
+                                $hp_receipt_script = 'window.open(\'https://npg.nicepay.co.kr/issue/IssueLoader.do?type=0&TID='.$pp['pp_tno'].'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
                             } else {
                                 $hp_receipt_script = 'window.open(\''.G5_BILL_RECEIPT_URL.'mcash_bill&tno='.$pp['pp_tno'].'&order_no='.$pp['pp_id'].'&trade_mony='.$pp['pp_receipt_price'].'\', \'winreceipt\', \'width=500,height=690,scrollbars=yes,resizable=yes\');';
                             }
@@ -164,6 +166,8 @@ if($pp['pp_pg'] == 'lg') {
                                 $LGD_HASHDATA = md5($LGD_MID.$LGD_TID.$LGD_MERTKEY);
 
                                 $card_receipt_script = 'showReceiptByTID(\''.$LGD_MID.'\', \''.$LGD_TID.'\', \''.$LGD_HASHDATA.'\');';
+                            } else if($pp['pp_pg'] == 'nicepay') {
+                                $card_receipt_script = 'window.open(\'https://npg.nicepay.co.kr/issue/IssueLoader.do?type=0&TID='.$pp['pp_tno'].'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
                             } else if($pp['pp_pg'] == 'inicis') {
                                 $card_receipt_script = 'window.open(\'https://iniweb.inicis.com/DefaultWebApp/mall/cr/cm/mCmReceipt_head.jsp?noTid='.$pp['pp_tno'].'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
                             } else {
@@ -220,6 +224,8 @@ if($pp['pp_pg'] == 'lg') {
                         } else if($pp['pp_pg'] == 'inicis') {
                             $cash = unserialize($pp['pp_cash_info']);
                             $cash_receipt_script = 'window.open(\'https://iniweb.inicis.com/DefaultWebApp/mall/cr/cm/Cash_mCmReceipt.jsp?noTid='.$cash['TID'].'&clpaymethod=22\',\'showreceipt\',\'width=380,height=540,scrollbars=no,resizable=no\');';
+                        } else if($pp['pp_pg'] == 'nicepay') {
+                            $cash_receipt_script = 'window.open(\'https://npg.nicepay.co.kr/issue/IssueLoader.do?type=1&TID='.$od['od_tno'].'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
                         } else {
                             require_once G5_SHOP_PATH.'/settle_kcp.inc.php';
 

mobile/shop/settle_nicepay.inc.php

@@ -0,0 +1,6 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
+
+include_once(G5_SHOP_PATH.'/settle_nicepay.inc.php');
+
+$nicepay_returnURL = G5_MSHOP_URL.'/nicepay/return_url_result.php';

plugin/editor/cheditor5/template.xml

@@ -361,12 +361,6 @@
                     <Execution method="windowOpen" value="Embed" />
                 </Attribute>
             </Button>
-            <Button name="Map" tooltip="지도">
-                <Attribute class="cheditor-tb-bg" width="23" height="23">
-                    <Icon position="694" width="16" class="cheditor-tb-icon" />
-                    <Execution method="windowOpen" value="GoogleMap" />
-                </Attribute>
-            </Button>
         </Group>
         <Group name="PageBreak">
             <Button name="PageBreak" tooltip="인쇄 쪽 나눔">

plugin/htmlpurifier/extend.video.php

@@ -8,7 +8,7 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
  */
 
 if( !class_exists('HTMLPurifier_Filter_Iframevideo') ){
-	class HTMLPurifier_Filter_iframevideo extends HTMLPurifier_Filter
+	class HTMLPurifier_Filter_Iframevideo extends HTMLPurifier_Filter
 	{
 		public $name = 'Iframevideo';
 
@@ -77,4 +77,33 @@ if( !class_exists('HTMLPurifier_Filter_Iframevideo') ){
 			}
 		}
 	}
+}
+
+if( !class_exists('HTMLPurifierContinueParamFilter') ){
+	class HTMLPurifierContinueParamFilter extends HTMLPurifier_URIFilter
+	{
+		public $name = 'ContinueParamFilter';
+        
+        public function filter(&$uri, $config, $context)
+        {
+            // 쿼리 파라미터 검사
+            $query = $uri->query;
+            $path = $uri->path;
+            
+            if ($path && preg_match('#[\\\\/]logout#i', $path)) {
+                return false;
+            }
+            
+            if ($query) {
+                
+                parse_str($query, $query_params);
+                
+                if (isset($query_params['continue']) || isset($query_params['pcurl'])) {
+                    return false;
+                }
+            }
+
+            return true; // 조건 통과 시 허용
+        }
+	}
 }

plugin/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt

@@ -1,15 +1,15 @@
-AutoFormat.RemoveEmpty.RemoveNbsp
-TYPE: bool
-VERSION: 4.0.0
-DEFAULT: false
---DESCRIPTION--
-<p>
-  When enabled, HTML Purifier will treat any elements that contain only
-  non-breaking spaces as well as regular whitespace as empty, and remove
-  them when %AutoFormat.RemoveEmpty is enabled.
-</p>
-<p>
-  See %AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions for a list of elements
-  that don't have this behavior applied to them.
-</p>
---# vim: et sw=4 sts=4
+AutoFormat.RemoveEmpty.RemoveNbsp
+TYPE: bool
+VERSION: 4.0.0
+DEFAULT: false
+--DESCRIPTION--
+<p>
+  When enabled, HTML Purifier will treat any elements that contain only
+  non-breaking spaces as well as regular whitespace as empty, and remove
+  them when %AutoFormat.RemoveEmpty is enabled.
+</p>
+<p>
+  See %AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions for a list of elements
+  that don't have this behavior applied to them.
+</p>
+--# vim: et sw=4 sts=4

plugin/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.AllowParseManyTags.txt

@@ -1,12 +1,12 @@
-Core.AllowParseManyTags
-TYPE: bool
-DEFAULT: false
-VERSION: 4.10.1
---DESCRIPTION--
-<p>
-    This directive allows parsing of many nested tags.
-    If you set true, relaxes any hardcoded limit from the parser.
-    However, in that case it may cause a Dos attack.
-    Be careful when enabling it.
-</p>
---# vim: et sw=4 sts=4
+Core.AllowParseManyTags
+TYPE: bool
+DEFAULT: false
+VERSION: 4.10.1
+--DESCRIPTION--
+<p>
+    This directive allows parsing of many nested tags.
+    If you set true, relaxes any hardcoded limit from the parser.
+    However, in that case it may cause a Dos attack.
+    Be careful when enabling it.
+</p>
+--# vim: et sw=4 sts=4