버전 5.5.8.2.4 수정

css 코드중 오타 수정
set_http 함수 코드 수정
2022-11-22 11:30:07 +09:00 · 2022-11-21 11:54:52 +09:00 · 2022-11-21 11:47:32 +09:00 · 2022-11-21 11:41:18 +09:00 · 2022-11-21 10:35:49 +09:00 · 2022-10-21 10:04:07 +09:00
115 changed files with 418 additions and 255 deletions
@@ -87,6 +87,7 @@ if (!empty($_COOKIE['g5_admin_btn_gnb'])) {
 ?>

 <script>
+    var g5_admin_csrf_token_key = "<?php echo (function_exists('admin_csrf_token_key')) ? admin_csrf_token_key() : ''; ?>";
    var tempX = 0;
    var tempY = 0;

@@ -83,11 +83,13 @@ function delete_confirm2(msg)

 function get_ajax_token()
 {
-    var token = "";
+    var token = "",
+        admin_csrf_token_key = (typeof g5_admin_csrf_token_key !== "undefined") ? g5_admin_csrf_token_key : "";

    $.ajax({
        type: "POST",
        url: g5_admin_url+"/ajax.token.php",
+        data : {admin_csrf_token_key:admin_csrf_token_key},
        cache: false,
        async: false,
        dataType: "json",
@@ -421,6 +421,16 @@ function get_sanitize_input($s, $is_html = false)
    return $s;
 }

+function domain_mail_host($is_at=true){
+    list($domain_host,) = explode(':', $_SERVER['HTTP_HOST']);
+
+    if ('www.' === substr($domain_host, 0, 4)) {
+        $domain_host = substr($domain_host, 4);
+    }
+
+    return $is_at ? '@'.$domain_host : $domain_host;
+}
+
 function check_log_folder($log_path, $is_delete = true)
 {

@@ -481,6 +491,18 @@ function check_admin_token()
    return true;
 }

+function admin_csrf_token_key($is_must=0){
+    global $member;
+
+    $key = '';
+
+    if($is_must || !((isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest'))){
+        $key = md5((isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '').(defined('G5_TOKEN_ENCRYPTION_KEY') ? G5_TOKEN_ENCRYPTION_KEY : '').$member['mb_id'].$_SERVER['DOCUMENT_ROOT']);
+    }
+
+    return run_replace('admin_csrf_token_key', $key, $is_must);
+}
+
 // 관리자 페이지 referer 체크
 function admin_referer_check($return = false)
 {
@@ -3,6 +3,12 @@ require_once './_common.php';

 set_session('ss_admin_token', '');

+$admin_csrf_token_key = isset($_POST['admin_csrf_token_key']) ? $_POST['admin_csrf_token_key'] : '';
+
+if(function_exists('admin_csrf_token_key') && $admin_csrf_token_key !== admin_csrf_token_key(1)){
+    die(json_encode(array('error' => '토큰키 에러!', 'url' => G5_URL)));
+}
+
 $error = admin_referer_check(true);
 if ($error) {
    die(json_encode(array('error' => $error, 'url' => G5_URL)));
@@ -7,12 +7,13 @@ auth_check_menu($auth, $sub_menu, 'w');
 $g5['title'] = '게시판 복사';
 require_once G5_PATH . '/head.sub.php';

-$bo_table = $_REQUEST['bo_table'];
 if (empty($bo_table)) {
    alert_close("정상적인 방법으로 이용해주세요.");
 }
 ?>
-
+<script>
+    var g5_admin_csrf_token_key = "<?php echo (function_exists('admin_csrf_token_key')) ? admin_csrf_token_key() : ''; ?>";
+</script>
 <script src="<?php echo G5_ADMIN_URL ?>/admin.js?ver=<?php echo G5_JS_VER; ?>"></script>

 <div class="new_win">
@@ -89,10 +89,10 @@ $sql = " insert into {$g5['board_table']}
                bo_new = '{$board['bo_new']}',
                bo_hot = '{$board['bo_hot']}',
                bo_image_width = '{$board['bo_image_width']}',
-                bo_skin = '{$board['bo_skin']}',
-                bo_mobile_skin = '{$board['bo_mobile_skin']}',
-                bo_include_head = '{$board['bo_include_head']}',
-                bo_include_tail = '{$board['bo_include_tail']}',
+                bo_skin = '" . sql_real_escape_string($board['bo_skin']). "',
+                bo_mobile_skin = '" . sql_real_escape_string($board['bo_mobile_skin']). "',
+                bo_include_head = '" . sql_real_escape_string($board['bo_include_head']). "',
+                bo_include_tail = '" . sql_real_escape_string($board['bo_include_tail']). "',
                bo_content_head = '" . addslashes($board['bo_content_head']) . "',
                bo_content_tail = '" . addslashes($board['bo_content_tail']) . "',
                bo_mobile_content_head = '" . addslashes($board['bo_mobile_content_head']) . "',
@@ -914,7 +914,7 @@ $pg_anchor = '<ul class="anchor">
        <tr>
            <th scope="row"><label for="bo_include_head">상단 파일 경로</label></th>
            <td>
-                <input type="text" name="bo_include_head" value="<?php echo $board['bo_include_head'] ?>" id="bo_include_head" class="frm_input" size="50">
+                <input type="text" name="bo_include_head" value="<?php echo get_sanitize_input($board['bo_include_head']); ?>" id="bo_include_head" class="frm_input" size="50">
            </td>
            <td class="td_grpset">
                <input type="checkbox" name="chk_grp_include_head" value="1" id="chk_grp_include_head">
@@ -926,7 +926,7 @@ $pg_anchor = '<ul class="anchor">
        <tr>
            <th scope="row"><label for="bo_include_tail">하단 파일 경로</label></th>
            <td>
-                <input type="text" name="bo_include_tail" value="<?php echo $board['bo_include_tail'] ?>" id="bo_include_tail" class="frm_input" size="50">
+                <input type="text" name="bo_include_tail" value="<?php echo get_sanitize_input($board['bo_include_tail']); ?>" id="bo_include_tail" class="frm_input" size="50">
            </td>
            <td class="td_grpset">
                <input type="checkbox" name="chk_grp_include_tail" value="1" id="chk_grp_include_tail">
@@ -1423,9 +1423,10 @@ function use_captcha_check(){
    });
 }

+var bo_include_head = jQuery.trim(jQuery("#bo_include_head").val()),
+    bo_include_tail = jQuery.trim(jQuery("#bo_include_tail").val());
+
 function frm_check_file(){
-    var bo_include_head = "<?php echo $board['bo_include_head']; ?>";
-    var bo_include_tail = "<?php echo $board['bo_include_tail']; ?>";
    var head = jQuery.trim(jQuery("#bo_include_head").val());
    var tail = jQuery.trim(jQuery("#bo_include_tail").val());

@@ -161,6 +161,10 @@ $bo_comment_min = isset($_POST['bo_comment_min']) ? (int) $_POST['bo_comment_min
 $bo_comment_max = isset($_POST['bo_comment_max']) ? (int) $_POST['bo_comment_max'] : 0;
 $bo_sort_field = isset($_POST['bo_sort_field']) ? clean_xss_tags($_POST['bo_sort_field'], 1, 1) : '';

+if (strpbrk($bo_skin.$bo_mobile_skin, "?%*:|\"<>") !== false) {
+    alert('스킨 디렉토리명 오류!');
+}
+
 $etcs = array();

 for ($i = 1; $i <= 10; $i++) {
@@ -475,6 +475,9 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                        <td colspan="3">
                            <?php echo help('관리자가 보내고 받는 용도로 사용하는 메일 주소를 입력합니다. (회원가입, 인증메일, 테스트, 회원메일발송 등에서 사용)') ?>
                            <input type="text" name="cf_admin_email" value="<?php echo get_sanitize_input($config['cf_admin_email']); ?>" id="cf_admin_email" required class="required email frm_input" size="40">
+                            <?php if (function_exists('domain_mail_host') && $config['cf_admin_email'] && stripos($config['cf_admin_email'], domain_mail_host()) === false) { ?>
+                            <?php echo help('외부메일설정이나 기타 설정을 하지 않았다면, 도메인과 다른 헤더로 여겨 스팸이나 차단될 가능성이 있습니다.<br>name'.domain_mail_host().' 과 같은 도메인 형식으로 설정할것을 권장합니다.') ?>
+                            <?php } ?>
                        </td>
                    </tr>
                    <tr>
@@ -137,14 +137,14 @@ require_once G5_ADMIN_PATH . '/admin.head.php';
                    <th scope="row"><label for="co_include_head">상단 파일 경로</label></th>
                    <td>
                        <?php echo help("설정값이 없으면 기본 상단 파일을 사용합니다."); ?>
-                        <input type="text" name="co_include_head" value="<?php echo $co['co_include_head']; ?>" id="co_include_head" class="frm_input" size="60">
+                        <input type="text" name="co_include_head" value="<?php echo get_sanitize_input($co['co_include_head']); ?>" id="co_include_head" class="frm_input" size="60">
                    </td>
                </tr>
                <tr>
                    <th scope="row"><label for="co_include_tail">하단 파일 경로</label></th>
                    <td>
                        <?php echo help("설정값이 없으면 기본 하단 파일을 사용합니다."); ?>
-                        <input type="text" name="co_include_tail" value="<?php echo $co['co_include_tail']; ?>" id="co_include_tail" class="frm_input" size="60">
+                        <input type="text" name="co_include_tail" value="<?php echo get_sanitize_input($co['co_include_tail']); ?>" id="co_include_tail" class="frm_input" size="60">
                    </td>
                </tr>
                <tr id="admin_captcha_box" style="display:none;">
@@ -447,6 +447,7 @@ tfoot th {}
 .td_delino {width:130px}
 .td_device {width:70px;text-align:center}
 .td_etc {width:80px;text-align:center}
+.td_use {width:80px;text-align:center}
 .td_extra label {display:inline-block;width:100px}
 .td_extra input {margin-right:5px;width:130px}
 .td_grid {width:60px;text-align:center}
@@ -876,20 +877,6 @@ strong.sodr_nonpay {display:block;padding:5px 0;text-align:right}
 .sbn_img {text-align:center}
 .sbn_image {display:none;margin:0 0 10px;text-align:left}

-/* SMS문자전송 */
-#sms_send {padding-bottom:100px;zoom:1}
-#sms_send:after {display:block;visibility:hidden;clear:both;content:""}
-
-#sms_frm {float:left;width:650px}
-#sms_frm table {margin:0 0 30px}
-#sms_frm textarea {height:70px}
-
-#sms_sm {position:relative;float:left;width:229px;height:418px;background:url('../shop_admin/img/mobilebg.jpg') no-repeat}
-#sms_sm_text {position:absolute;top:75px;left:27px;width:180px;color:#fff;font-size:2em;word-break:break-all}
-#sms_sm p {position:absolute;bottom:-70px;left:0;font-size:0.95em;letter-spacing:-0.1em}
-
-#sms_send .local_desc01 {min-width:320px}
-
 /* 가격비교사이트 */
 #anc_pricecompare_info li {margin:5px 0 5px -1px}

@@ -4,18 +4,20 @@ require_once './_common.php';

 auth_check_menu($auth, $sub_menu, 'r');

+$ma_id = isset($_REQUEST['ma_id']) ? (int) $_REQUEST['ma_id'] : 0;
+
 $ma_last_option = "";

 $sql_common = " from {$g5['member_table']} ";
 $sql_where = " where (1) ";

-$mb_id1         = isset($_POST['mb_id1'])       ? $_POST['mb_id1'] : 1;
+$mb_id1         = isset($_POST['mb_id1'])       ? (int) $_POST['mb_id1'] : 1;
 $mb_id1_from    = isset($_POST['mb_id1_from'])  ? clean_xss_tags($_POST['mb_id1_from'], 1, 1, 30) : '';
 $mb_id1_to      = isset($_POST['mb_id1_to'])    ? clean_xss_tags($_POST['mb_id1_to'], 1, 1, 30) : '';
 $mb_email       = isset($_POST['mb_email'])     ? clean_xss_tags($_POST['mb_email'], 1, 1, 100) : '';
 $mb_mailling    = isset($_POST['mb_mailling'])  ? clean_xss_tags($_POST['mb_mailling'], 1, 1, 100) : '';
-$mb_level_from  = isset($_POST['mb_level_from'])? $_POST['mb_level_from'] : 1;
-$mb_level_to    = isset($_POST['mb_level_to'])  ? $_POST['mb_level_to'] : 10;
+$mb_level_from  = isset($_POST['mb_level_from'])? (int) $_POST['mb_level_from'] : 1;
+$mb_level_to    = isset($_POST['mb_level_to'])  ? (int) $_POST['mb_level_to'] : 10;

 // 회원ID ..에서 ..까지
 if ($mb_id1 != 1) {
@@ -81,7 +83,7 @@ require_once './admin.head.php';

 <form name="fmailselectlist" id="fmailselectlist" method="post" action="./mail_select_update.php">
    <input type="hidden" name="token" value="">
-    <input type="hidden" name="ma_id" value="<?php echo $ma_id ?>">
+    <input type="hidden" name="ma_id" value="<?php echo get_text($ma_id); ?>">

    <div class="tbl_head01 tbl_wrap">
        <table>
@@ -240,7 +240,19 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                        <?php if ($w == 'u') { ?><a href="./boardgroupmember_form.php?mb_id=<?php echo $mb['mb_id'] ?>" class="btn_frmline">접근가능그룹보기</a><?php } ?>
                    </td>
                    <th scope="row"><label for="mb_password">비밀번호<?php echo $sound_only ?></label></th>
-                    <td><input type="password" name="mb_password" id="mb_password" <?php echo $required_mb_password ?> class="frm_input <?php echo $required_mb_password ?>" size="15" maxlength="20"></td>
+                    <td>
+                        <div>
+                        <input type="password" name="mb_password" id="mb_password" <?php echo $required_mb_password ?> class="frm_input <?php echo $required_mb_password ?>" size="15" maxlength="20">
+                        </div>
+                        <div id="mb_password_captcha_wrap" style="display:none">
+                            <?php
+                            require_once G5_CAPTCHA_PATH . '/captcha.lib.php';
+                            $captcha_html = captcha_html();
+                            $captcha_js   = chk_captcha_js();
+                            echo $captcha_html;
+                            ?>
+                        </div>
+                    </td>
                </tr>
                <tr>
                    <th scope="row"><label for="mb_name">이름(실명)<strong class="sound_only">필수</strong></label></th>
@@ -582,8 +594,35 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
            return false;
        }

+        if( jQuery("#mb_password").val() ){
+            <?php echo $captcha_js; // 캡챠 사용시 자바스크립트에서 입력된 캡챠를 검사함 ?>
+        }
+
        return true;
    }
+
+    jQuery(function($){
+        $("#captcha_key").prop('required', false).removeAttr("required").removeClass("required");
+
+        $("#mb_password").on("keyup", function(e) {
+            var $warp = $("#mb_password_captcha_wrap"),
+                tooptipid = "mp_captcha_tooltip",
+                $span_text = $("<span>", {id:tooptipid, style:"font-size:0.95em;letter-spacing:-0.1em"}).html("비밀번호를 수정할 경우 캡챠를 입력해야 합니다."),
+                $parent = $(this).parent(),
+                is_invisible_recaptcha = $("#captcha").hasClass("invisible_recaptcha");
+
+            if($(this).val()){
+                $warp.show();
+                if(! is_invisible_recaptcha) {
+                    $warp.css("margin-top","1em");
+                    if(! $("#"+tooptipid).length){ $parent.append($span_text) }
+                }
+            } else {
+                $warp.hide();
+                if($("#"+tooptipid).length && ! is_invisible_recaptcha){ $parent.find("#"+tooptipid).remove(); }
+            }
+        });
+    });
 </script>
 <?php
 run_event('admin_member_form_after', $mb, $w);
@@ -18,6 +18,15 @@ $mb_certify_case = isset($_POST['mb_certify_case']) ? preg_replace('/[^0-9a-z_]/
 $mb_certify     = isset($_POST['mb_certify']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_certify']) : '';
 $mb_zip         = isset($_POST['mb_zip']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_zip']) : '';

+// 관리자가 자동등록방지를 사용해야 할 경우 ( 회원의 비밀번호 변경시 캡챠를 체크한다 )
+if ($mb_password && function_exists('get_admin_captcha_by') && get_admin_captcha_by()) {
+    include_once(G5_CAPTCHA_PATH . '/captcha.lib.php');
+
+    if (!chk_captcha()) {
+        alert('자동등록방지 숫자가 틀렸습니다.');
+    }
+}
+
 // 휴대폰번호 체크
 $mb_hp = hyphen_hp_number($_POST['mb_hp']);
 if ($mb_hp) {
@@ -149,7 +158,13 @@ if ($w == '') {
    }

    if ($mb_id === $member['mb_id'] && $_POST['mb_level'] != $mb['mb_level']) {
-        alert($mb['mb_id'] . ' : 로그인 중인 관리자 레벨은 수정 할 수 없습니다.');
+        alert($mb['mb_id'] . ' : 로그인 중인 관리자 레벨은 수정할 수 없습니다.');
+    }
+
+    if ($posts['mb_leave_date'] || $posts['mb_intercept_date']){
+        if ($member['mb_id'] === $mb['mb_id'] || is_admin($mb['mb_id']) === 'super'){
+            alert('해당 관리자의 탈퇴 일자 또는 접근 차단 일자를 수정할 수 없습니다.');
+        }
    }

    // 닉네임중복체크
@@ -289,6 +304,10 @@ if ($w == '' || $w == 'u') {
    }
 }

+if (function_exists('get_admin_captcha_by')) {
+    get_admin_captcha_by('remove');
+}
+
 run_event('admin_member_form_update', $w, $mb_id);

 goto_url('./member_form.php?' . $qstr . '&amp;w=u&amp;mb_id=' . $mb_id, false);
@@ -23,6 +23,10 @@ if ($w == '') {
    alert('w 값이 제대로 넘어오지 않았습니다.');
 }

+if (!isset($po['po_use'])) {
+    sql_query(" alter table `{$g5['poll_table']}` add `po_use` tinyint not null default '0' after `mb_ids` ", false);
+}
+
 $g5['title'] = $html_title;
 require_once './admin.head.php';
 ?>
@@ -94,6 +98,10 @@ require_once './admin.head.php';
                </tr>

                <?php if ($w == 'u') { ?>
+                    <tr>
+                        <th scope="row">투표사용</th>
+                        <td><input type="checkbox" name="po_use" id="po_use" value="1" <?php if ($po['po_use']) { echo 'checked="checked"'; } ?>> <label for="po_use">사용</label></td>
+                    </tr>
                    <tr>
                        <th scope="row">투표등록일</th>
                        <td><?php echo $po['po_date']; ?></td>
@@ -51,8 +51,8 @@ $po_id = isset($_POST['po_id']) ? $_POST['po_id'] : '';

 if ($w == '') {
    $sql = " insert {$g5['poll_table']}
-                    ( po_subject, po_poll1, po_poll2, po_poll3, po_poll4, po_poll5, po_poll6, po_poll7, po_poll8, po_poll9, po_cnt1, po_cnt2, po_cnt3, po_cnt4, po_cnt5, po_cnt6, po_cnt7, po_cnt8, po_cnt9, po_etc, po_level, po_point, po_date )
-             values ( '{$_POST['po_subject']}', '{$_POST['po_poll1']}', '{$_POST['po_poll2']}', '{$_POST['po_poll3']}', '{$_POST['po_poll4']}', '{$_POST['po_poll5']}', '{$_POST['po_poll6']}', '{$_POST['po_poll7']}', '{$_POST['po_poll8']}', '{$_POST['po_poll9']}', '{$_POST['po_cnt1']}', '{$_POST['po_cnt2']}', '{$_POST['po_cnt3']}', '{$_POST['po_cnt4']}', '{$_POST['po_cnt5']}', '{$_POST['po_cnt6']}', '{$_POST['po_cnt7']}', '{$_POST['po_cnt8']}', '{$_POST['po_cnt9']}', '{$_POST['po_etc']}', '{$_POST['po_level']}', '{$_POST['po_point']}', '" . G5_TIME_YMD . "' ) ";
+                    ( po_subject, po_poll1, po_poll2, po_poll3, po_poll4, po_poll5, po_poll6, po_poll7, po_poll8, po_poll9, po_cnt1, po_cnt2, po_cnt3, po_cnt4, po_cnt5, po_cnt6, po_cnt7, po_cnt8, po_cnt9, po_etc, po_level, po_point, po_date, po_use )
+             values ( '{$_POST['po_subject']}', '{$_POST['po_poll1']}', '{$_POST['po_poll2']}', '{$_POST['po_poll3']}', '{$_POST['po_poll4']}', '{$_POST['po_poll5']}', '{$_POST['po_poll6']}', '{$_POST['po_poll7']}', '{$_POST['po_poll8']}', '{$_POST['po_poll9']}', '{$_POST['po_cnt1']}', '{$_POST['po_cnt2']}', '{$_POST['po_cnt3']}', '{$_POST['po_cnt4']}', '{$_POST['po_cnt5']}', '{$_POST['po_cnt6']}', '{$_POST['po_cnt7']}', '{$_POST['po_cnt8']}', '{$_POST['po_cnt9']}', '{$_POST['po_etc']}', '{$_POST['po_level']}', '{$_POST['po_point']}', '" . G5_TIME_YMD . "', 1 ) ";
    sql_query($sql);

    $po_id = sql_insert_id();
@@ -79,7 +79,8 @@ if ($w == '') {
                     po_cnt9 = '{$_POST['po_cnt9']}',
                     po_etc = '{$_POST['po_etc']}',
                     po_level = '{$_POST['po_level']}',
-                     po_point = '{$_POST['po_point']}'
+                     po_point = '{$_POST['po_point']}',
+                     po_use = '{$_POST['po_use']}'
                where po_id = '{$_POST['po_id']}' ";
    sql_query($sql);
 } elseif ($w == 'd') {
@@ -49,7 +49,7 @@ $listall = '<a href="' . $_SERVER['SCRIPT_NAME'] . '" class="ov_listall">전체
 $g5['title'] = '투표관리';
 require_once './admin.head.php';

-$colspan = 7;
+$colspan = 8;
 ?>

 <div class="local_ov01 local_ov">
@@ -92,6 +92,7 @@ $colspan = 7;
                    <th scope="col">투표권한</th>
                    <th scope="col">투표수</th>
                    <th scope="col">기타의견</th>
+                    <th scope="col">사용</th>
                    <th scope="col">관리</th>
                </tr>
            </thead>
@@ -101,6 +102,7 @@ $colspan = 7;
                    $sql2 = " select sum(po_cnt1+po_cnt2+po_cnt3+po_cnt4+po_cnt5+po_cnt6+po_cnt7+po_cnt8+po_cnt9) as sum_po_cnt from {$g5['poll_table']} where po_id = '{$row['po_id']}' ";
                    $row2 = sql_fetch($sql2);
                    $po_etc = ($row['po_etc']) ? "사용" : "미사용";
+                    $po_use = ($row['po_use']) ? "사용" : "미사용";

                    $s_mod = '<a href="./poll_form.php?' . $qstr . '&amp;w=u&amp;po_id=' . $row['po_id'] . '" class="btn btn_03">수정</a>';

@@ -117,6 +119,7 @@ $colspan = 7;
                        <td class="td_num"><?php echo $row['po_level'] ?></td>
                        <td class="td_num"><?php echo $row2['sum_po_cnt'] ?></td>
                        <td class="td_etc"><?php echo $po_etc ?></td>
+                        <td class="td_use"><?php echo $po_use ?></td>
                        <td class="td_mng td_mng_s"><?php echo $s_mod ?></td>
                    </tr>

@@ -266,13 +266,13 @@ if (!isset($qaconfig['qa_include_head'])) {
                    <tr>
                        <th scope="row"><label for="qa_include_head">상단 파일 경로</label></th>
                        <td>
-                            <input type="text" name="qa_include_head" value="<?php echo $qaconfig['qa_include_head'] ?>" id="qa_include_head" class="frm_input" size="50">
+                            <input type="text" name="qa_include_head" value="<?php echo get_sanitize_input($qaconfig['qa_include_head']); ?>" id="qa_include_head" class="frm_input" size="50">
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="qa_include_tail">하단 파일 경로</label></th>
                        <td>
-                            <input type="text" name="qa_include_tail" value="<?php echo $qaconfig['qa_include_tail'] ?>" id="qa_include_tail" class="frm_input" size="50">
+                            <input type="text" name="qa_include_tail" value="<?php echo get_sanitize_input($qaconfig['qa_include_tail']); ?>" id="qa_include_tail" class="frm_input" size="50">
                        </td>
                    </tr>
                    <tr id="admin_captcha_box" style="display:none;">
@@ -344,7 +344,9 @@ if (!isset($qaconfig['qa_include_head'])) {
 </form>

 <script>
-    var captcha_chk = false;
+    var captcha_chk = false,
+        qa_include_head = jQuery.trim(jQuery("#qa_include_head").val()),
+        qa_include_tail = jQuery.trim(jQuery("#qa_include_tail").val());

    function use_captcha_check() {
        $.ajax({
@@ -361,8 +363,6 @@ if (!isset($qaconfig['qa_include_head'])) {
    }

    function frm_check_file() {
-        var qa_include_head = "<?php echo $qaconfig['qa_include_head']; ?>";
-        var qa_include_tail = "<?php echo $qaconfig['qa_include_tail']; ?>";
        var head = jQuery.trim(jQuery("#qa_include_head").val());
        var tail = jQuery.trim(jQuery("#qa_include_tail").val());

@@ -41,6 +41,7 @@ if (isset($_POST['email'])) {
        echo '해당 주소로 테스트 메일이 도착했는지 확인해 주십시오.<br>';
        echo '만약, 테스트 메일이 오지 않는다면 더 다양한 계정의 메일 주소로 메일을 보내 보십시오.<br>';
        echo '그래도 메일이 하나도 도착하지 않는다면 메일 서버(sendmail server)의 오류일 가능성이 높으니, 웹 서버관리자에게 문의하여 주십시오.<br>';
+        echo '도메인을 소유하고 있을시 SPF, DKIM 설정이 필요할수 있습니다.<br>';
        echo '</p></div>';
        echo '</section>';
    }
@@ -53,6 +54,10 @@ if (isset($_POST['email'])) {
        <p>
            메일서버가 정상적으로 동작 중인지 확인할 수 있습니다.<br>
            아래 입력칸에 테스트 메일을 발송하실 메일 주소를 입력하시면, [메일검사] 라는 제목으로 테스트 메일을 발송합니다.<br>
+            보내는 메일주소 : <?php echo get_sanitize_input($config['cf_admin_email']); ?><br>
+            <?php if (function_exists('domain_mail_host') && $config['cf_admin_email'] && stripos($config['cf_admin_email'], domain_mail_host()) === false) { ?>
+            <?php echo '외부메일설정이나 기타 설정을 하지 않았다면, 도메인과 다른 헤더로 여겨 스팸이나 차단될 가능성이 있습니다.<br>기본환경설정에서 관리자 메일 주소를 name'.domain_mail_host().' 과 같은 도메인 형식으로 설정할것을 권장합니다.'; ?>
+            <?php } ?>
        </p>
    </div>
    <form name="fsendmailtest" method="post">
@@ -72,7 +72,7 @@ function order_update_delivery($od_id, $mb_id, $change_status, $delivery)
    if($change_status != '배송')
        return;

-    $sql = " update {$g5['g5_shop_order_table']} set od_delivery_company = '{$delivery['delivery_company']}', od_invoice = '{$delivery['invoice']}', od_invoice_time = '{$delivery['invoice_time']}' where od_id = '$od_id' and od_status = '준비' ";
+    $sql = " update {$g5['g5_shop_order_table']} set od_delivery_company = '".sql_real_escape_string($delivery['delivery_company'])."', od_invoice = '".sql_real_escape_string($delivery['invoice'])."', od_invoice_time = '".sql_real_escape_string($delivery['invoice_time'])."' where od_id = '$od_id' and od_status = '준비' ";
    sql_query($sql);

    $sql = " select * from {$g5['g5_shop_cart_table']} where od_id = '$od_id' ";
@@ -32,6 +32,8 @@ include_once(G5_PATH.'/head.sub.php');

 <script>
 // <![CDATA[
+var g5_admin_csrf_token_key = "<?php echo (function_exists('admin_csrf_token_key')) ? admin_csrf_token_key() : ''; ?>";
+
 function _copy(link)
 {
    var new_it_id = document.getElementById('new_it_id').value;
@@ -476,13 +476,13 @@ if ($w == "" || $w == "u")
        {
            $sql = " insert into {$g5['g5_shop_item_relation_table']}
                        set it_id  = '$it_id',
-                            it_id2 = '$it_id2[$i]',
+                            it_id2 = '".sql_real_escape_string($it_id2[$i])."',
                            ir_no = '$i' ";
            sql_query($sql, false);

            // 관련상품의 반대로도 등록
            $sql = " insert into {$g5['g5_shop_item_relation_table']}
-                        set it_id  = '$it_id2[$i]',
+                        set it_id  = '".sql_real_escape_string($it_id2[$i])."',
                            it_id2 = '$it_id',
                            ir_no = '$i' ";
            sql_query($sql, false);
@@ -496,7 +496,7 @@ if ($w == "" || $w == "u")
        if (trim($ev_id[$i]))
        {
            $sql = " insert into {$g5['g5_shop_event_item_table']}
-                        set ev_id = '$ev_id[$i]',
+                        set ev_id = '".sql_real_escape_string($ev_id[$i])."',
                            it_id = '$it_id' ";
            sql_query($sql, false);
        }
@@ -510,7 +510,7 @@ if($option_count) {
                    ( `io_id`, `io_type`, `it_id`, `io_price`, `io_stock_qty`, `io_noti_qty`, `io_use` )
                VALUES ";
    for($i=0; $i<$option_count; $i++) {
-        $sql .= $comma . " ( '{$_POST['opt_id'][$i]}', '0', '$it_id', '{$_POST['opt_price'][$i]}', '{$_POST['opt_stock_qty'][$i]}', '{$_POST['opt_noti_qty'][$i]}', '{$_POST['opt_use'][$i]}' )";
+        $sql .= $comma . " ( '".sql_real_escape_string($_POST['opt_id'][$i])."', '0', '$it_id', '".sql_real_escape_string($_POST['opt_price'][$i])."', '".sql_real_escape_string($_POST['opt_stock_qty'][$i])."', '".sql_real_escape_string($_POST['opt_noti_qty'][$i])."', '".sql_real_escape_string($_POST['opt_use'][$i])."' )";
        $comma = ' , ';
    }

@@ -524,7 +524,7 @@ if($supply_count) {
                    ( `io_id`, `io_type`, `it_id`, `io_price`, `io_stock_qty`, `io_noti_qty`, `io_use` )
                VALUES ";
    for($i=0; $i<$supply_count; $i++) {
-        $sql .= $comma . " ( '{$_POST['spl_id'][$i]}', '1', '$it_id', '{$_POST['spl_price'][$i]}', '{$_POST['spl_stock_qty'][$i]}', '{$_POST['spl_noti_qty'][$i]}', '{$_POST['spl_use'][$i]}' )";
+        $sql .= $comma . " ( '".sql_real_escape_string($_POST['spl_id'][$i])."', '1', '$it_id', '".sql_real_escape_string($_POST['spl_price'][$i])."', '".sql_real_escape_string($_POST['spl_stock_qty'][$i])."', '".sql_real_escape_string($_POST['spl_noti_qty'][$i])."', '".sql_real_escape_string($_POST['spl_use'][$i])."' )";
        $comma = ' , ';
    }

@@ -85,7 +85,7 @@ if($ps_run) {
        } // for
    } else {
        for($i=0; $i<$subject_count; $i++) {
-            $spl_subject = isset($_POST['subject'][$i]) ? preg_replace(G5_OPTION_ID_FILTER, '', trim(stripslashes($_POST['subject'][$i]))) : '';
+            $spl_subject = isset($_POST['subject'][$i]) ? preg_replace(G5_OPTION_ID_FILTER, '', strip_tags(trim(stripslashes($_POST['subject'][$i])))) : '';
            $spl_val = isset($_POST['supply'][$i]) ? explode(',', preg_replace(G5_OPTION_ID_FILTER, '', trim(stripslashes($_POST['supply'][$i])))) : '';
            $spl_count = count($spl_val);

@@ -103,7 +103,7 @@ if($ps_run) {
                        $sql = " select io_price, io_stock_qty, io_noti_qty, io_use
                                    from {$g5['g5_shop_item_option_table']}
                                    where it_id = '{$post_it_id}'
-                                      and io_id = '$spl_id'
+                                      and io_id = '".sql_real_escape_string($spl_id)."'
                                      and io_type = '1' ";
                        $row = sql_fetch($sql);

@@ -117,11 +117,11 @@ if($ps_run) {
    ?>
    <tr>
        <td class="td_chk">
-            <input type="hidden" name="spl_id[]" value="<?php echo $spl_id; ?>">
-            <label for="spl_chk_<?php echo $i; ?>" class="sound_only"><?php echo $spl_subject.' '.$spl; ?></label>
+            <input type="hidden" name="spl_id[]" value="<?php echo get_text($spl_id); ?>">
+            <label for="spl_chk_<?php echo $i; ?>" class="sound_only"><?php echo get_text($spl_subject.' '.$spl); ?></label>
            <input type="checkbox" name="spl_chk[]" id="spl_chk_<?php echo $i; ?>" value="1">
        </td>
-        <td class="spl-subject-cell"><?php echo $spl_subject; ?></td>
+        <td class="spl-subject-cell"><?php echo get_text($spl_subject); ?></td>
        <td class="spl-cell"><?php echo $spl; ?></td>
        <td class="td_numsmall">
            <label for="spl_price_<?php echo $i; ?>" class="sound_only">상품금액</label>
@@ -21,7 +21,7 @@ $fr_date = (isset($_GET['fr_date']) && preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0
 $to_date = (isset($_GET['to_date']) && preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $_GET['to_date'])) ? $_GET['to_date'] : '';

 $od_misu = isset($_GET['od_misu']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_misu']) : '';
-$od_cancel_price = isset($_GET['od_cancel_price']) ? preg_replace('/[^0-9a-z]/', '', $_GET['od_cancel_price']) : '';
+$od_cancel_price = isset($_GET['od_cancel_price']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_cancel_price']) : '';
 $od_refund_price = isset($_GET['od_refund_price']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_refund_price']) : '';
 $od_receipt_point = isset($_GET['od_receipt_point']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_receipt_point']) : '';
 $od_coupon = isset($_GET['od_coupon']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_coupon']) : ''; 
@@ -227,7 +227,7 @@ if(!sql_query(" select pp_cash from {$g5['g5_shop_personalpay_table']} limit 1 "
            <?php } ?>
            <tr>
                <th scope="row"><label for="pp_shop_memo">상점메모</label></th>
-                <td><textarea name="pp_shop_memo" id="pp_shop_memo" rows="8"><?php echo $pp['pp_shop_memo']; ?></textarea></td>
+                <td><textarea name="pp_shop_memo" id="pp_shop_memo" rows="8"><?php echo html_purifier($pp['pp_shop_memo']); ?></textarea></td>
            </tr>
            <tr>
                <th scope="row"><label for="pp_use">사용</label></th>
@@ -21,7 +21,7 @@ for ($kk=0;$row = sql_fetch_array($result);$kk++)
    $bk_no = $row['bk_no'];
    for ($i=0; $i<count($post_chk_bg_no); $i++)
    {
-        $bg_no = $post_chk_bg_no[$i];
+        $bg_no = (int) $post_chk_bg_no[$i];
        if( !$bg_no ) continue;

        $sql = " insert into {$g5['sms5_book_table']}
@@ -17,7 +17,17 @@ if($error) {

 <script>
 alert("<?php echo $msg; ?>");
-window.close();
+try {
+    window.close();
+} catch(error) {
+    history.back();
+}
+
+setTimeout(function() {
+    if (window.history.length) {
+        window.history.back();
+    }
+}, 500);
 </script>

 <noscript>
@@ -22,6 +22,14 @@ $file = sql_fetch($sql);
 if (!$file['bf_file'])
    alert_close('파일 정보가 존재하지 않습니다.');

+$nonce = isset($_REQUEST['nonce']) ? preg_replace('/[^0-9a-z\|]/i', '', $_REQUEST['nonce']) : '';
+
+if (function_exists('download_file_nonce_is_valid') && !defined('G5_DOWNLOAD_NONCE_CHECK')){
+    if(! download_file_nonce_is_valid($nonce, $bo_table, $wr_id)){
+        alert('토큰 유효시간이 지났거나 토큰이 유효하지 않습니다.\\n브라우저를 새로고침 후 다시 시도해 주세요.', G5_URL);
+    }
+}
+
 // JavaScript 불가일 때
 $js = (isset($_GET['js'])) ? $_GET['js'] : '';
 if($js != 'on' && $board['bo_download_point'] < 0) {
@@ -18,6 +18,7 @@ while ($row=sql_fetch_array($result))
 }

 if (isset($fm_id) && $fm_id){
+    $fm_id = (int) $fm_id;
    $qstr .= '&amp;fm_id=' . $fm_id; // 마스터faq key_id
 }

@@ -153,7 +153,7 @@ if( is_admin($mb['mb_id']) && is_dir(G5_DATA_PATH.'/tmp/') ){
            $tmp_data_check = false;
        }
    }
-    @fclose($tmp_data_check);
+    if (is_resource($tmp_data_check)) @fclose($tmp_data_check);
    @unlink($tmp_data_file);

    if(! $tmp_data_check){
@@ -77,6 +77,8 @@ if($result){
    }
 }

+run_event('cert_refresh_update_after', $mb_id);
+
 //===============================================================

 (empty($url))? goto_url(G5_URL) : goto_url($url);
@@ -4,7 +4,8 @@ include_once('./_common.php');

 if ($is_member) { alert("이미 로그인중입니다."); goto_url(G5_URL); }

-if(!$_POST['mb_id']) { alert("잘못된 접근입니다."); goto_url(G5_URL); }
+$ss_cert_mb_id = isset($_SESSION['ss_cert_mb_id']) ? trim(get_session('ss_cert_mb_id')) : '';
+if(!(isset($_POST['mb_id']) && $_POST['mb_id'] === $ss_cert_mb_id)) { alert("잘못된 접근입니다."); goto_url(G5_URL); }

 if($config['cf_cert_find'] != 1) alert("본인인증을 이용하여 아이디/비밀번호 찾기를 할 수 없습니다. 관리자에게 문의 하십시오.");

@@ -111,7 +111,7 @@ if ($w == '' || $w == 'u') {
    if ($msg = prohibit_mb_email($mb_email))alert($msg, "", true, true);

    // 휴대폰 필수입력일 경우 휴대폰번호 유효성 체크
-    if ($config['cf_use_hp'] || ($config['cf_cert_hp'] || $config['cf_cert_simple']) && $config['cf_req_hp']) {
+    if (($config['cf_use_hp'] || $config['cf_cert_hp'] || $config['cf_cert_simple']) && $config['cf_req_hp']) {
        if ($msg = valid_mb_hp($mb_hp))     alert($msg, "", true, true);
    }

@@ -362,7 +362,12 @@ if( $config['cf_cert_use'] || (defined('G5_YOUNGCART_VER') && G5_YOUNGCART_VER)

            // IE 브라우저 또는 엣지브라우저 또는 IOS 모바일과 http환경에서는 secure; SameSite=None을 설정하지 않습니다.
            if (isset($_SERVER['HTTP_USER_AGENT'])) {
-                if( preg_match('/Edge/i', $_SERVER['HTTP_USER_AGENT']) || preg_match('/(iPhone|iPod|iPad).*AppleWebKit.*Safari/i', $_SERVER['HTTP_USER_AGENT']) || preg_match('~MSIE|Internet Explorer~i', $_SERVER['HTTP_USER_AGENT']) || preg_match('~Trident/7.0(; Touch)?; rv:11.0~',$_SERVER['HTTP_USER_AGENT']) || ! (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ){
+                if (preg_match('/Edge/i', $_SERVER['HTTP_USER_AGENT'])
+                    || preg_match('/(iPhone|iPod|iPad).*AppleWebKit.*Safari/i', $_SERVER['HTTP_USER_AGENT'])
+                    || preg_match('~MSIE|Internet Explorer~i', $_SERVER['HTTP_USER_AGENT'])
+                    || preg_match('~Trident/7.0(; Touch)?; rv:11.0~',$_SERVER['HTTP_USER_AGENT'])
+                    || !(isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on')
+                    || !(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == "https")){
                    return $res;
                }
            }
@@ -233,9 +233,5 @@ define('G5_VISIT_BROWSCAP_USE', false);
 */
 define('G5_IP_DISPLAY', '\\1.♡.\\3.\\4');

-if ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') || 
-    (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO']==='https')) {   //https 통신일때 daum 주소 js
-    define('G5_POSTCODE_JS', '<script src="https://spi.maps.daum.net/imap/map_js_init/postcode.v2.js"></script>');
-} else {  //http 통신일때 daum 주소 js
-    define('G5_POSTCODE_JS', '<script src="http://dmaps.daum.net/map_js_init/postcode.v2.js"></script>');
-}
+// KAKAO 우편번호 서비스 CDN
+define('G5_POSTCODE_JS', '<script src="//t1.daumcdn.net/mapjsapi/bundle/postcode/prod/postcode.v2.js" async></script>');
@@ -83,7 +83,7 @@ input[type=radio] {-webkit-appearance: radio}

 /*카테고리*/
 .menu {display:none;position:fixed;top:0;height:100%;z-index:99999;-webkit-backface-visibility:hidden;width:100%;background:#efefef}
-.menu .menu_wr{;width:100%;height:100%;overflow-y:auto;background:#eee;position:relative;z-index:199919;
+.menu .menu_wr{width:100%;height:100%;overflow-y:auto;background:#eee;position:relative;z-index:199919;
 -webkit-box-shadow: 0 0 5px rgba(55,55,5,0.4));
    -moz-box-shadow: 0 0 5px rgba(55,55,5,0.4));
         box-shadow: 0 0 5px rgba(55,55,5,0.4);}
@@ -318,7 +318,7 @@ box-shadow: inset 0 1px 1px rgba(0, 0, 0, .075);
 }

 #sod_frm .sod_ta_wr{background: #fff}
-#sod_frm .btn_confirm{;margin:0 10px 10px}
+#sod_frm .btn_confirm{margin:0 10px 10px}
 #sod_frm .btn_submit{width:100%;height:45px;font-size: 1.167em;font-weight: bold;margin:5px 0;border-radius:4px}
 #sod_frm .btn_cancel,#sod_frm .btn01{width:100%;height:45px;line-height:43px;font-size:1.167em;font-weight: bold;padding:0;border-radius:4px}

@@ -9,19 +9,19 @@ if (!defined('G5_USE_SHOP') || !G5_USE_SHOP) return;
 */
 define('G5_DELIVERY_COMPANY',
     '(경동택배^https://kdexp.com/basicNewDelivery.kd?barcode=^080-873-2178)'
-    .'(대신택배^http://home.daesinlogistics.co.kr/daesin/jsp/d_freight_chase/d_general_process2.jsp?billno1=^043-222-4582)'
+    .'(대신택배^https://www.ds3211.co.kr/freight/internalFreightSearch.ht?billno=^043-222-4582)'
    .'(동부택배^http://www.dongbups.com/delivery/delivery_search_view.jsp?item_no=^1588-8848)'
    .'(로젠택배^https://www.ilogen.com/m/personal/trace.pop/^1588-9988)'
-    .'(우체국^http://service.epost.go.kr/trace.RetrieveRegiPrclDeliv.postal?sid1=^1588-1300)'
+    .'(우체국^https://m.epost.go.kr/postal/mobile/mobile.trace.RetrieveDomRigiTraceList.comm?ems_gubun=E&sid1=^1588-1300)'
    .'(이노지스택배^http://www.innogis.co.kr/tracking_view.asp?invoice=^1566-4082)'
-    .'(한진택배^http://www.hanjin.co.kr/Delivery_html/inquiry/result_waybill.jsp?wbl_num=^1588-0011)'
+    .'(한진택배^https://www.hanjin.co.kr/kor/CMS/DeliveryMgr/WaybillResult.do?mCode=MN038&schLang=KR&wblnumText2=^1588-0011)'
    .'(롯데택배^https://www.lotteglogis.com/open/tracking?invno=^1588-2121)'
    .'(CJ대한통운^https://www.doortodoor.co.kr/parcel/doortodoor.do?fsp_action=PARC_ACT_002&fsp_cmd=retrieveInvNoACT&invc_no=^1588-1255)'
-    .'(CVSnet편의점택배^http://was.cvsnet.co.kr/_ver2/board/ctod_status.jsp?invoice_no=^1577-1287)'
+    .'(CVSnet편의점택배^https://www.cvsnet.co.kr/invoice/tracking.do?invoice_no=^1577-1287)'
    .'(KG옐로우캡택배^http://www.yellowcap.co.kr/custom/inquiry_result.asp?invoice_no=^1588-0123)'
    .'(KGB택배^http://www.kgbls.co.kr/sub5/trace.asp?f_slipno=^1577-4577)'
    .'(KG로지스^http://www.kglogis.co.kr/contents/waybill.jsp?item_no=^1588-8848)'
-    .'(건영택배^http://www.kunyoung.com/goods/goods_01.php?mulno=^031-460-2700)'
+    .'(건영택배^https://www.kunyoung.com/goods/goods_01.php?mulno=^031-460-2700)'
    .'(호남택배^http://www.honamlogis.co.kr/04estimate/songjang_list.php?c_search1=^031-376-6070)'
 );

@@ -2,7 +2,7 @@
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가

 // 자바스크립트와 CSS 파일을 새로 다운로드 하도록 파일의 끝에 년월일 지정
-// 예) https://도메인/css/default.css?ver=210618
-// 예) https://도메인/js/common.js?ver=210618
-define('G5_CSS_VER', '210618');
-define('G5_JS_VER',  '210618');
+// 예) https://도메인/css/default.css?ver=220620
+// 예) https://도메인/js/common.js?ver=220620
+define('G5_CSS_VER', '220620');
+define('G5_JS_VER',  '221017');
@@ -71,7 +71,8 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
                <script>
                function fsearchbox_submit(f)
                {
-                    if (f.stx.value.length < 2) {
+                    var stx = f.stx.value.trim();
+                    if (stx.length < 2) {
                        alert("검색어는 두글자 이상 입력하십시오.");
                        f.stx.select();
                        f.stx.focus();
@@ -80,8 +81,8 @@ include_once(G5_LIB_PATH.'/popular.lib.php');

                    // 검색에 많은 부하가 걸리는 경우 이 주석을 제거하세요.
                    var cnt = 0;
-                    for (var i=0; i<f.stx.value.length; i++) {
-                        if (f.stx.value.charAt(i) == ' ')
+                    for (var i = 0; i < stx.length; i++) {
+                        if (stx.charAt(i) == ' ')
                            cnt++;
                    }

@@ -91,6 +92,7 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
                        f.stx.focus();
                        return false;
                    }
+                    f.stx.value = stx;

                    return true;
                }
@@ -617,6 +617,7 @@ CREATE TABLE IF NOT EXISTS `g5_poll` (
  `po_date` date NOT NULL default '0000-00-00',
  `po_ips` mediumtext NOT NULL,
  `mb_ids` text NOT NULL,
+  `po_use` tinyint(4) NOT NULL default '0',
  PRIMARY KEY  (`po_id`)
 ) ENGINE=MyISAM  DEFAULT CHARSET=utf8;

@@ -355,8 +355,8 @@ var win_homepage = function(href) {
 * 우편번호 창
 **/
 var win_zip = function(frm_name, frm_zip, frm_addr1, frm_addr2, frm_addr3, frm_jibeon) {
-    if(typeof daum === 'undefined'){
-        alert("다음 우편번호 postcode.v2.js 파일이 로드되지 않았습니다.");
+    if(typeof daum === "undefined"){
+        alert("KAKAO 우편번호 서비스 postcode.v2.js 파일이 로드되지 않았습니다.");
        return false;
    }

@@ -423,7 +423,7 @@ var win_zip = function(frm_name, frm_zip, frm_addr1, frm_addr2, frm_addr3, frm_j
                element_wrap = document.createElement("div");
                element_wrap.setAttribute("id", daum_pape_id);
                element_wrap.style.cssText = 'display:none;border:1px solid;left:0;width:100%;height:300px;margin:5px 0;position:relative;-webkit-overflow-scrolling:touch;';
-                element_wrap.innerHTML = '<img src="//i1.daumcdn.net/localimg/localimages/07/postcode/320/close.png" id="btnFoldWrap" style="cursor:pointer;position:absolute;right:0px;top:-21px;z-index:1" class="close_daum_juso" alt="접기 버튼">';
+                element_wrap.innerHTML = '<img src="//t1.daumcdn.net/postcode/resource/images/close.png" id="btnFoldWrap" style="cursor:pointer;position:absolute;right:0px;top:-21px;z-index:1" class="close_daum_juso" alt="접기 버튼">';
                jQuery('form[name="'+frm_name+'"]').find('input[name="'+frm_addr1+'"]').before(element_wrap);
                jQuery("#"+daum_pape_id).off("click", ".close_daum_juso").on("click", ".close_daum_juso", function(e){
                    e.preventDefault();
@@ -8,9 +8,4 @@ $(function() {
        window.open($(this).attr("href"), "win_twitter", "menubar=1,resizable=1,width=600,height=350");
        return false;
    });
-
-    $(".share-googleplus").click(function() {
-        window.open($(this).attr("href"), "win_googleplus", "menubar=1,resizable=1,width=600,height=600");
-        return false;
-    });
 });
@@ -269,12 +269,12 @@ function url_auto_link($str)


 // url에 http:// 를 붙인다
-function set_http($url)
+function set_http($url, $protocol="http://")
 {
    if (!trim($url)) return;

    if (!preg_match("/^(http|https|ftp|telnet|news|mms)\:\/\//i", $url))
-        $url = "http://" . $url;
+        $url = $protocol. $url;

    return $url;
 }
@@ -295,6 +295,30 @@ function get_filesize($size)
    return $size;
 }

+// 파일다운로드 링크 생성시 nonce 키 추가, 7200은 2시간동안 유효
+function download_file_nonce_key($bo_table, $wr_id, $timeoutSeconds=7200)
+{
+    $secret = get_token_encryption_key(sha1($bo_table.session_id().$wr_id));
+    $salt = get_random_token_string(10);
+    $maxTime = G5_SERVER_TIME + $timeoutSeconds;
+    $nonce = $salt . '|' . $maxTime . '|' . sha1($salt . $secret . $maxTime);
+
+    return $nonce;
+}
+
+// 파일다운로드시 nonce key를 체크한다.
+function download_file_nonce_is_valid($nonce, $bo_table, $wr_id)
+{
+    if (! is_string($nonce)) return false;
+    $secret = get_token_encryption_key(sha1($bo_table.session_id().$wr_id));
+    $a = explode('|', $nonce);
+    if (count($a) !== 3) return false;
+    list($salt, $maxTime, $hash) = $a;
+    if (sha1($salt . $secret . $maxTime) !== $hash) return false;
+    if (G5_SERVER_TIME > (int) $maxTime) return false;
+
+    return true;
+}

 // 게시글에 첨부된 파일을 얻는다. (배열로 반환)
 function get_file($bo_table, $wr_id)
@@ -304,11 +328,12 @@ function get_file($bo_table, $wr_id)
    $file['count'] = 0;
    $sql = " select * from {$g5['board_file_table']} where bo_table = '$bo_table' and wr_id = '$wr_id' order by bf_no ";
    $result = sql_query($sql);
+    $nonce = download_file_nonce_key($bo_table, $wr_id);
    while ($row = sql_fetch_array($result))
    {
        $no = (int) $row['bf_no'];
        $bf_content = $row['bf_content'] ? html_purifier($row['bf_content']) : '';
-        $file[$no]['href'] = G5_BBS_URL."/download.php?bo_table=$bo_table&amp;wr_id=$wr_id&amp;no=$no" . $qstr;
+        $file[$no]['href'] = G5_BBS_URL."/download.php?bo_table=$bo_table&amp;wr_id=$wr_id&amp;no=$no&amp;nonce=$nonce" . $qstr;
        $file[$no]['download'] = $row['bf_download'];
        // 4.00.11 - 파일 path 추가
        $file[$no]['path'] = G5_DATA_URL.'/file/'.$bo_table;
@@ -579,6 +604,8 @@ function check_html_link_nofollow($type=''){
 // Open  : HTML Purifier is open-source and highly customizable
 function html_purifier($html)
 {
+    global $is_admin, $write;
+
    $f = file(G5_PLUGIN_PATH.'/htmlpurifier/safeiframe.txt');
    $domains = array();
    foreach($f as $domain){
@@ -589,9 +616,9 @@ function html_purifier($html)
                array_push($domains, $domain);
        }
    }
-    // 내 도메인도 추가
-    array_push($domains, $_SERVER['HTTP_HOST'].'/');
-    $safeiframe = implode('|', $domains);
+    // 글쓴이가 관리자인 경우에만 현재 사이트 도메인을 허용
+    if (isset($write['mb_id']) && $write['mb_id'] && is_admin($write['mb_id'])) array_push($domains, $_SERVER['HTTP_HOST'].'/');
+    $safeiframe = implode('|', run_replace('html_purifier_safeiframes', $domains, $html));

    include_once(G5_PLUGIN_PATH.'/htmlpurifier/HTMLPurifier.standalone.php');
    include_once(G5_PLUGIN_PATH.'/htmlpurifier/extend.video.php');
@@ -1577,10 +1604,6 @@ function sql_data_seek($result, $offset=0)
        mysql_data_seek($result, $offset);
 }

-function _callback_sql_show_tables($m){
-    return "show tables like '".str_replace("`", "", $m[1])."'";
-}
-
 // mysqli_query 와 mysqli_error 를 한꺼번에 처리
 // mysql connect resource 지정 - 명랑폐인님 제안
 function sql_query($sql, $error=G5_DISPLAY_SQL_ERROR, $link=null)
@@ -1598,10 +1621,6 @@ function sql_query($sql, $error=G5_DISPLAY_SQL_ERROR, $link=null)
    // `information_schema` DB로의 접근을 허락하지 않습니다.
    $sql = preg_replace("#^select.*from.*where.*`?information_schema`?.*#i", "select 1", $sql);

-    if (preg_match("#^desc(?:ribe)?\s+(.*)#i", $sql)) {
-        $sql = preg_replace_callback("#^desc(?:ribe)?\s+(.*)#i", '_callback_sql_show_tables', trim($sql));
-    }
-
    $is_debug = get_permission_debug_show();
    
    $start_time = $is_debug ? get_microtime() : 0;
@@ -3343,12 +3362,18 @@ function check_url_host($url, $msg='', $return_url=G5_URL, $is_redirect=false)
    if(!$msg)
        $msg = 'url에 타 도메인을 지정할 수 없습니다.';

+    if(run_replace('check_url_host_before', '', $url, $msg, $return_url, $is_redirect) === 'is_checked'){
+        return;
+    }
+
    // KVE-2021-1277 Open Redirect 취약점 해결
    if (preg_match('#\\\0#', $url)) {
        alert('url 에 올바르지 않은 값이 포함되어 있습니다.');
    }

-    $url = urldecode($url);
+    while ( ( $replace_url = preg_replace(array('/\/{2,}/', '/\\@/'), array('//', ''), urldecode($url)) ) != $url ) {
+        $url = $replace_url;
+    }
    $p = @parse_url(trim($url));
    $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
    $is_host_check = false;
@@ -3393,7 +3418,7 @@ function check_url_host($url, $msg='', $return_url=G5_URL, $is_redirect=false)

    if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host']) || $is_host_check) {
        //if ($p['host'].(isset($p['port']) ? ':'.$p['port'] : '') != $_SERVER['HTTP_HOST']) {
-        if ( ($p['host'] != $host) || $is_host_check ) {
+        if (run_replace('check_same_url_host', (($p['host'] != $host) || $is_host_check), $p, $host, $is_host_check, $return_url, $is_redirect)) {
            echo '<script>'.PHP_EOL;
            echo 'alert("url에 타 도메인을 지정할 수 없습니다.");'.PHP_EOL;
            echo 'document.location.href = "'.$return_url.'";'.PHP_EOL;
@@ -3927,6 +3952,16 @@ function is_include_path_check($path='', $is_input='')
    return true;
 }

+function is_inicis_url_return($url){
+    $url_data = parse_url($url);
+
+    // KG 이니시스 url이 맞는지 체크하여 맞으면 url을 리턴하고 틀리면 '' 빈값을 리턴합니다.
+    if (isset($url_data['host']) && preg_match('#\.inicis\.com$#i', $url_data['host'])) {
+        return $url;
+    }
+    return '';
+}
+
 function check_auth_session_token($str=''){
    if (get_session('ss_mb_token_key') === get_token_encryption_key($str)) {
        return true;
@@ -3957,7 +3992,7 @@ function get_random_token_string($length=6)
 }

 function filter_input_include_path($path){
-    return str_replace('//', '/', $path);
+    return str_replace('//', '/', strip_tags($path));
 }

 function option_array_checked($option, $arr=array()){
@@ -8,8 +8,8 @@ function poll($skin_dir='basic', $po_id=false)

    // 투표번호가 넘어오지 않았다면 가장 큰(최근에 등록한) 투표번호를 얻는다
    if (!$po_id) {
-        $row = sql_fetch(" select MAX(po_id) as max_po_id from {$g5['poll_table']} ");
-        $po_id = $row['max_po_id'];
+        $row = sql_fetch(" select MAX(po_id) as max_po_id from {$g5['poll_table']} where po_use = 1 ", false);
+        $po_id = isset($row['max_po_id']) ? $row['max_po_id'] : 0;
    }

    if(!$po_id)
@@ -36,7 +36,7 @@ function poll($skin_dir='basic', $po_id=false)
        }
    }

-    $po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '$po_id' ");
+    $po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '$po_id' and po_use = 1 ");

    ob_start();
    include_once ($poll_skin_path.'/poll.skin.php');
@@ -1521,9 +1521,6 @@ function get_sns_share_link($sns, $url, $title, $img)
        case 'twitter':
            $str = '<a href="https://twitter.com/share?url='.urlencode($url).'&amp;text='.urlencode($title).'" class="share-twitter" target="_blank"><img src="'.$img.'" alt="트위터에 공유"></a>';
            break;
-        case 'googleplus':
-            $str = '<a href="https://plus.google.com/share?url='.urlencode($url).'" class="share-googleplus" target="_blank"><img src="'.$img.'" alt="구글플러스에 공유"></a>';
-            break;
        case 'kakaotalk':
            if($config['cf_kakao_js_apikey'])
                $str = '<a href="javascript:kakaolink_send(\''.str_replace('+', ' ', urlencode($title)).'\', \''.urlencode($url).'\');" class="share-kakaotalk"><img src="'.$img.'" alt="카카오톡 링크보내기"></a>';
@@ -95,7 +95,8 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
                <script>
                function fsearchbox_submit(f)
                {
-                    if (f.stx.value.length < 2) {
+                    var stx = f.stx.value.trim();
+                    if (stx.length < 2) {
                        alert("검색어는 두글자 이상 입력하십시오.");
                        f.stx.select();
                        f.stx.focus();
@@ -104,8 +105,8 @@ include_once(G5_LIB_PATH.'/popular.lib.php');

                    // 검색에 많은 부하가 걸리는 경우 이 주석을 제거하세요.
                    var cnt = 0;
-                    for (var i=0; i<f.stx.value.length; i++) {
-                        if (f.stx.value.charAt(i) == ' ')
+                    for (var i = 0; i < stx.length; i++) {
+                        if (stx.charAt(i) == ' ')
                            cnt++;
                    }

@@ -115,6 +116,7 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
                        f.stx.focus();
                        return false;
                    }
+                    f.stx.value = stx;

                    return true;
                }
@@ -1,6 +1,8 @@
 <?php
 include_once('./_common.php');

+$cart_action_url = G5_SHOP_URL.'/cartupdate.php';
+
 // 테마에 cart.php 있으면 include
 if(defined('G5_THEME_MSHOP_PATH')) {
    $theme_cart_file = G5_THEME_MSHOP_PATH.'/cart.php';
@@ -154,32 +156,32 @@ $cart_count = sql_num_rows($result);
    <div class="go_shopping"><a href="<?php echo G5_SHOP_URL; ?>/" class="btn01">쇼핑 계속하기</a></div>
    <?php } else { ?>
    <div class="sod_ta_wr">
-    <?php
-    $tot_price = $tot_sell_price + $send_cost; // 총계 = 주문상품금액합계 + 배송비
-    if ($tot_price > 0 || $send_cost > 0) {
-    ?>
-    <dl id="m_sod_bsk_tot">
-        <?php if ($send_cost > 0) { // 배송비가 0 보다 크다면 (있다면) ?>
-        <dt class="sod_bsk_dvr">배송비</dt>
-        <dd class="sod_bsk_dvr"><strong><?php echo number_format($send_cost); ?> 원</strong></dd>
+        <?php
+        $tot_price = $tot_sell_price + $send_cost; // 총계 = 주문상품금액합계 + 배송비
+        if ($tot_price > 0 || $send_cost > 0) {
+        ?>
+        <dl id="m_sod_bsk_tot">
+            <?php if ($send_cost > 0) { // 배송비가 0 보다 크다면 (있다면) ?>
+            <dt class="sod_bsk_dvr">배송비</dt>
+            <dd class="sod_bsk_dvr"><strong><?php echo number_format($send_cost); ?> 원</strong></dd>
+            <?php } ?>
+
+            <?php if ($tot_price > 0) { ?>
+            <dt>포인트</dt>
+            <dd><strong><?php echo number_format($tot_point); ?> 점</strong></dd>
+            <dt class="sod_bsk_cnt">총계</dt>
+            <dd class="sod_bsk_cnt"><strong><?php echo number_format($tot_price); ?></strong> 원</dd>
+            <?php } ?>
+        </dl>
        <?php } ?>

-        <?php if ($tot_price > 0) { ?>
-        <dt>포인트</dt>
-        <dd><strong><?php echo number_format($tot_point); ?> 점</strong></dd>
-        <dt class="sod_bsk_cnt">총계</dt>
-        <dd class="sod_bsk_cnt"><strong><?php echo number_format($tot_price); ?></strong> 원</dd>
-        <?php } ?>
-    </dl>
-    <?php } ?>
-
-    <div id="sod_bsk_act" class="btn_confirm">
-        <div class="total">총계 <strong class="total_cnt"><?php echo number_format($tot_price); ?>원</strong>
+        <div id="sod_bsk_act" class="btn_confirm">
+            <div class="total">총계 <strong class="total_cnt"><?php echo number_format($tot_price); ?>원</strong></div>
+            <input type="hidden" name="url" value="<?php echo G5_SHOP_URL; ?>/orderform.php">
+            <input type="hidden" name="act" value="">
+            <input type="hidden" name="records" value="<?php echo $i; ?>">
+            <button type="button" onclick="return form_check('buy');" class="btn_submit">주문하기</button>
        </div>
-        <input type="hidden" name="url" value="<?php echo G5_SHOP_URL; ?>/orderform.php">
-        <input type="hidden" name="act" value="">
-        <input type="hidden" name="records" value="<?php echo $i; ?>">
-        <button type="button" onclick="return form_check('buy');" class="btn_submit">주문하기</button>
    </div>
    <?php } ?>
        <?php if ($naverpay_button_js) { ?>
@@ -8,7 +8,7 @@ set_session('P_AMT',  '');
 set_session('P_HASH', '');

 $oid  = isset($_REQUEST['P_NOTI']) ? trim($_REQUEST['P_NOTI']) : '';
-$p_req_url = isset($_REQUEST['P_REQ_URL']) ? trim($_REQUEST['P_REQ_URL']) : '';
+$p_req_url = isset($_REQUEST['P_REQ_URL']) ? is_inicis_url_return(trim($_REQUEST['P_REQ_URL'])) : '';
 $p_status = isset($_REQUEST['P_STATUS']) ? trim($_REQUEST['P_STATUS']) : '';
 $p_tid = isset($_REQUEST['P_TID']) ? trim($_REQUEST['P_TID']) : '';
 $p_rmesg1 = isset($_REQUEST['P_RMESG1']) ? trim($_REQUEST['P_RMESG1']) : '';
@@ -2,7 +2,7 @@
 include_once('./_common.php');

 // 상품 리스트에서 다른 필드로 정렬을 하려면 아래의 배열 코드에서 해당 필드를 추가하세요.
-if( isset($sort) && ! in_array($sort, array('it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time')) ){
+if( isset($sort) && ! in_array($sort, array('it_name', 'it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time')) ){
    $sort='';
 }

@@ -1,6 +1,8 @@
 <?php
 include_once('./_common.php');

+$order_action_url = G5_HTTPS_SHOP_URL.'/orderaddressupdate.php';
+
 // 테마에 orderaddress.php 있으면 include
 if(defined('G5_THEME_MSHOP_PATH')) {
    $theme_orderaddress_file = G5_THEME_MSHOP_PATH.'/orderaddress.php';
@@ -922,7 +922,7 @@ $(function() {
        $("#od_coupon_frm").remove();
        $("#od_coupon_btn").text("변경").focus();
        if(!$("#od_coupon_cancel").length)
-            $("#od_coupon_btn").after("<button type=\"button\" id=\"od_coupon_cancel\" class=\"cp_cancel1\">취소</button>");
+            $("#od_coupon_btn").after("<button type=\"button\" id=\"od_coupon_cancel\" class=\"cp_cancel cp_cancel1\">취소</button>");
    });

    $(document).on("click", "#od_coupon_close", function() {
@@ -13,7 +13,7 @@ add_stylesheet('<link rel="stylesheet" href="' . $member_skin_url . '/style.css"
                <p>새로운 비밀번호를 입력해주세요.</p>
                <label for="mb_id" class="sound_only">아이디</label>
                <br>
-                <b>회원 아이디 : <?php echo $_POST['mb_id']; ?></b>
+                <b>회원 아이디 : <?php echo get_text($_POST['mb_id']); ?></b>
                <label for="mb_pw" class="sound_only">새 비밀번호<strong class="sound_only">필수</strong></label>
                <input type="password" name="mb_password" id="mb_pw" required class="required frm_input full_input" size="30" placeholder="새 비밀번호">
                <label for="mb_pw2" class="sound_only">새 비밀번호 확인<strong class="sound_only">필수</strong></label>
@@ -45,7 +45,8 @@ if ($stx) {
        <script>
        function fsearch_submit(f)
        {
-            if (f.stx.value.length < 2) {
+            var stx = f.stx.value.trim();
+            if (stx.length < 2) {
                alert("검색어는 두글자 이상 입력하십시오.");
                f.stx.select();
                f.stx.focus();
@@ -54,8 +55,8 @@ if ($stx) {

            // 검색에 많은 부하가 걸리는 경우 이 주석을 제거하세요.
            var cnt = 0;
-            for (var i=0; i<f.stx.value.length; i++) {
-                if (f.stx.value.charAt(i) == ' ')
+            for (var i = 0; i < stx.length; i++) {
+                if (stx.charAt(i) == ' ')
                    cnt++;
            }

@@ -65,6 +66,7 @@ if ($stx) {
                f.stx.focus();
                return false;
            }
+            f.stx.value = stx;

            f.action = "";
            return true;
@@ -7,7 +7,7 @@ add_javascript('<script src="'.G5_JS_URL.'/jquery.bxslider.js"></script>', 10);
 ?>

 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -77,7 +77,6 @@ add_javascript('<script src="'.G5_JS_URL.'/jquery.bxslider.js"></script>', 10);
                    <div class="sns_area">
                        <?php echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/facebook.png'); ?>
                        <?php echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/twitter.png'); ?>
-                        <?php echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/gplus.png'); ?>
                        <?php echo get_sns_share_link('kakaotalk', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/sns_kakao.png'); ?>
                        <?php
                        $href = G5_SHOP_URL.'/iteminfo.php?it_id='.$it_id;
@@ -9,7 +9,7 @@ add_javascript('<script src="'.G5_JS_URL.'/shop.list.action.js"></script>', 10);
 ?>

 <?php if(!defined('G5_IS_SHOP_AJAX_LIST') && $config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -116,7 +116,6 @@ foreach((array) $list as $row){
            echo "<h3>SNS 공유</h3>";
            echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/facebook.png');
            echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/twitter.png');
-            echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/gplus.png');
            echo get_sns_share_link('kakaotalk', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/sns_kakao.png');
            echo "<button type=\"button\" class=\"sct_sns_cls\"><span class=\"sound_only\">닫기</span><i class=\"fa fa-times\" aria-hidden=\"true\"></i></button>";
            echo "</div>\n";
@@ -9,7 +9,7 @@ add_javascript('<script src="'.G5_JS_URL.'/shop.list.action.js"></script>', 10);
 ?>

 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -108,7 +108,6 @@ foreach((array) $list as $row){
            echo "<h3>SNS 공유</h3>";
            echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/facebook.png');
            echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/twitter.png');
-            echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/gplus.png');
            echo get_sns_share_link('kakaotalk', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/sns_kakao.png');
            echo "<button type=\"button\" class=\"sct_sns_cls\"><span class=\"sound_only\">닫기</span><i class=\"fa fa-times\" aria-hidden=\"true\"></i></button>";
            echo "</div>\n";
@@ -10,7 +10,7 @@ add_javascript('<script src="'.G5_JS_URL.'/shop.list.action.js"></script>', 10);

 <script src="<?php echo G5_JS_URL ?>/jquery.fancylist.js"></script>
 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -104,7 +104,6 @@ foreach((array) $list as $row){
        echo "<div class=\"sct_sns\" style=\"top:{$sns_top}px\">";
        echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/facebook.png');
        echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/twitter.png');
-        echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/gplus.png');
        echo get_sns_share_link('kakaotalk', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/sns_kakao.png');
        echo "</div>\n";
    }
@@ -10,7 +10,7 @@ add_javascript('<script src="'.G5_JS_URL.'/shop.list.action.js"></script>', 10);
 ?>

 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -104,7 +104,6 @@ foreach((array) $list as $row){
        echo "<div class=\"sct_sns\" style=\"top:{$sns_top}px\">";
        echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/facebook.png');
        echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/twitter.png');
-        echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/gplus.png');
        echo get_sns_share_link('kakaotalk', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/sns_kakao.png');
        echo "</div>\n";
    }
@@ -7,7 +7,7 @@ add_stylesheet('<link rel="stylesheet" href="'.G5_MSHOP_SKIN_URL.'/style.css">',

 <script src="<?php echo G5_JS_URL ?>/jquery.fancylist.js"></script>
 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -69,7 +69,6 @@
 .sct_sns a {display:inline-block;margin:0 2px;width:28px;height:28px;line-height:28px;border-radius:3px;font-size:0;text-align:center}
 .share-facebook {background:#415b92}
 .share-twitter {background:#35b3dc}
-.share-googleplus {background:#d5503a}
 .share-kakaotalk {background:#ffeb00}
 .sct_sns img {width:20px;height:auto;vertical-align:middle}
 .sct_sns button {margin:0 4px 0 0;padding:0;border:0}
@@ -103,7 +102,6 @@
 .sct_10 .sct_sns a {display:inline-block;border-radius:50%;width:50px;height:50px;line-height:25px;text-align:center;padding:13px 0;margin:20px 5px}
 .sct_10 .sct_sns .share-facebook {background:#415b92}
 .sct_10 .sct_sns .share-twitter {background:#35b3dc}
-.sct_10 .sct_sns .share-googleplus {background:#ea3838}
 .sct_10 .sct_sns img {width:24px}
 .sct_10 .sct_sns_bg {background:rgba(0,0,0,0.1);width:100%;height:100%}
 .sct_10 .sct_sns_cls {position:absolute;right:0;top:0;color:#b5b8bb;border:0;padding:12px 15px;font-size:16px;background:#fff;margin:0;height:50px}
@@ -129,7 +127,6 @@
 .sct_10_list .sct_sns a {display:inline-block;border-radius:50%;width:50px;height:50px;line-height:25px;text-align:center;padding:13px 0;margin:20px 5px}
 .sct_10_list .sct_sns .share-facebook {background:#415b92}
 .sct_10_list .sct_sns .share-twitter {background:#35b3dc}
-.sct_10_list .sct_sns .share-googleplus {background:#ea3838}
 .sct_10_list .sct_sns img {width:24px}
 .sct_10_list .sct_sns_bg {background:rgba(0,0,0,0.1);width:100%;height:100%}
 .sct_10_list .sct_sns_cls {position:absolute;right:0;top:0;color:#b5b8bb;border:0;padding:12px 15px;font-size:16px;background:#fff}
@@ -332,7 +329,6 @@
 #sit_star_sns .sns_area a {display:inline-block;width:35px;height:35px;line-height:35px;background:#eee;text-align:center;border-radius:50%;padding-top:5px}
 #sit_star_sns .sns_area a img {width:24px;height:auto}
 #sit_star_sns .sns_area #sit_btn_rec {font-size:15px;padding-top:0}
-#sit_star_sns .sns_area .share-googleplus {background:#ea3838}
 #sit_star_sns .sns_area .share-facebook {background:#415b92}
 #sit_star_sns .sns_area .share-twitter {background:#35b3dc}

@@ -1,10 +1,10 @@
 <?php
 include_once('./_common.php');

-$txId = $_POST['txId'];
+$txId = isset($_POST['txId']) ? clean_xss_tags($_POST['txId'], 1, 1) : '';
 $mid  = substr($txId, 6, 10);

-if ($_POST["resultCode"] === "0000") { 
+if ($txId && isset($_POST["resultCode"]) && $_POST["resultCode"] === "0000") {

    $data = array(
        'mid' => $mid,        
@@ -13,9 +13,14 @@ if ($_POST["resultCode"] === "0000") {

    $post_data = json_encode($data);

+    $authRequestUrl = isset($_POST["authRequestUrl"]) ? is_inicis_url_return($_POST["authRequestUrl"]) : '';
+    if(!$authRequestUrl){
+        alert('잘못된 요청입니다.', G5_URL);
+    }
+
    // curl 통신 시작 
    $ch = curl_init();
-    curl_setopt($ch, CURLOPT_URL, $_POST["authRequestUrl"]);
+    curl_setopt($ch, CURLOPT_URL, $authRequestUrl);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
@@ -73,7 +78,7 @@ if ($_POST["resultCode"] === "0000") {
    }
 } else {   // resultCode===0000 아닐경우 아래 인증 실패를 출력함 
    // 인증실패
-    alert_close('코드 : '.$_POST['resultCode'].'  '.urldecode($_POST['resultMsg']));
+    alert_close('코드 : '.(isset($_POST['resultCode']) ? clean_xss_tags($_POST['resultCode'], 1, 1) : '').'  '.(isset($_POST['resultMsg']) ? clean_xss_tags(urldecode($_POST['resultMsg']), 1, 1) : ''));
    exit;
 }

@@ -81,7 +86,7 @@ $g5['title'] = 'KG이니시스 간편인증 결과';
 include_once(G5_PATH.'/head.sub.php'); 
 ?>
 <form name="mbFindForm" method="POST">
-<input type="hidden" name="mb_id" value="<?php echo $row["mb_id"]; ?>">    
+<input type="hidden" name="mb_id" value="<?php echo isset($row["mb_id"]) ? get_text($row["mb_id"]) : ''; ?>">
 </form>
 <script>
    jQuery(function($) {
@@ -67,7 +67,7 @@ include_once(G5_PATH.'/head.sub.php');
        <input type="hidden" name="userBirth" value="<?php echo $userBirth ?>">
        <input type="hidden" name="userHash" value="<?php echo $userHash ?>">
        <input type="hidden" name="mbId" value="<?php echo $member['mb_id'] ?>">
-        <input type="hidden" name="directAgency" value="<?php echo $_GET['directAgency']; ?>">
+        <input type="hidden" name="directAgency" value="<?php echo isset($_GET['directAgency']) ? clean_xss_tags($_GET['directAgency'], 1, 1) : ''; ?>">

        <input type="hidden" name="successUrl" value="<?php echo $resultUrl; ?>"> <!-- 필수 값 -->
        <input type="hidden" name="failUrl" value="<?php echo $resultUrl; ?>"> <!-- 필수 값 -->
@@ -1,10 +1,10 @@
 <?php
 include_once('./_common.php');

-$txId = $_POST['txId'];
+$txId = isset($_POST['txId']) ? clean_xss_tags($_POST['txId'], 1, 1) : '';
 $mid  = substr($txId, 6, 10);

-if ($_POST["resultCode"] === "0000") { 
+if ($txId && isset($_POST["resultCode"]) && $_POST["resultCode"] === "0000") {

    $data = array(
        'mid' => $mid,        
@@ -13,9 +13,14 @@ if ($_POST["resultCode"] === "0000") {

    $post_data = json_encode($data);

+    $authRequestUrl = isset($_POST["authRequestUrl"]) ? is_inicis_url_return($_POST["authRequestUrl"]) : '';
+    if(!$authRequestUrl){
+        alert('잘못된 요청입니다.', G5_URL);
+    }
+
    // curl 통신 시작 
    $ch = curl_init();
-    curl_setopt($ch, CURLOPT_URL, $_POST["authRequestUrl"]);
+    curl_setopt($ch, CURLOPT_URL, $authRequestUrl);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
@@ -81,7 +86,7 @@ if ($_POST["resultCode"] === "0000") {
    }
 } else {   // resultCode===0000 아닐경우 아래 인증 실패를 출력함 
    // 인증실패
-    alert_close('코드 : '.$_POST['resultCode'].'  '.urldecode($_POST['resultMsg']));
+    alert_close('코드 : '.(isset($_POST['resultCode']) ? clean_xss_tags($_POST['resultCode'], 1, 1) : '').'  '.(isset($_POST['resultMsg']) ? clean_xss_tags(urldecode($_POST['resultMsg']), 1, 1) : ''));
    exit;
 }

@@ -18,6 +18,8 @@

 class KCAPTCHA{

+    private $keystring;
+
 	// generates keystring and image
 	function image(){
        require(dirname(__FILE__).'/kcaptcha_config.php');
@@ -4,10 +4,13 @@ include_once('captcha.lib.php');

 $captcha = new KCAPTCHA();
 $ss_captcha_key = get_session("ss_captcha_key");
+$ss_captcha_key_decrypt = '';
 if( $ss_captcha_key && !preg_match('/^[0-9]/', $ss_captcha_key) && function_exists('get_string_decrypt') ){
    $ip = md5(sha1($_SERVER['REMOTE_ADDR']));
-    $ss_captcha_key = str_replace($ip, '', get_string_decrypt($ss_captcha_key));
+    $ss_captcha_key_decrypt = str_replace($ip, '', get_string_decrypt($ss_captcha_key));
 }
-$captcha->setKeyString($ss_captcha_key);
+# php 5.2 또는 5.3 버전에서 포인터처럼 해당 세션값이 변경되는 버그가 있어서 아래와 같이 조치함
+if(! $ss_captcha_key_decrypt) $ss_captcha_key_decrypt = $ss_captcha_key;
+$captcha->setKeyString($ss_captcha_key_decrypt);
 $captcha->getKeyString();
 $captcha->image();
@@ -24,7 +24,7 @@ $bo_v_sns_class = $config['cf_kakao_js_apikey'] ? 'show_kakao' : '';
 ?>

 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="//developers.kakao.com/sdk/js/kakao.min.js" charset="utf-8"></script>
+<script src="//developers.kakao.com/sdk/js/kakao.min.js" async charset="utf-8"></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js" charset="utf-8"></script>
 <script type='text/javascript'>
    //<![CDATA[
@@ -62,7 +62,6 @@ $bo_v_sns_class = $config['cf_kakao_js_apikey'] ? 'show_kakao' : '';
 <ul id="bo_v_sns" class="<?php echo $bo_v_sns_class; ?>">
 	<li><a href="<?php echo $facebook_url; ?>" target="_blank" class="sns_f"><img src="<?php echo G5_SNS_URL; ?>/icon/facebook.png" alt="페이스북으로 공유" width="20"><span>페이스북 공유</span></a></li>
    <li><a href="<?php echo $twitter_url; ?>" target="_blank" class="sns_t"><img src="<?php echo G5_SNS_URL; ?>/icon/twitter.png" alt="트위터로  공유" width="20"><span>트위터 공유</span></a></li>
-    <li><a href="<?php echo $gplus_url; ?>" target="_blank" class="sns_g"><img src="<?php echo G5_SNS_URL; ?>/icon/gplus.png" alt="구글플러스로 공유" width="20"><span>구글+ 공유</span></a></li>
    <?php if($config['cf_kakao_js_apikey']) { ?>
    <li><a href="javascript:Kakao_sendLink();" class="sns_k" ><img src="<?php echo G5_SNS_URL; ?>/icon/kakaotalk.png" alt="카카오톡으로 보내기" width="20"></a></li>
    <?php } ?>
@@ -6,7 +6,7 @@ $skin = isset($_GET['skin']) ? clean_xss_tags($_GET['skin'], 1, 1) : '';
 $ca_id = isset($_GET['ca_id']) ? clean_xss_tags($_GET['ca_id'], 1, 1) : '';

 // 상품 리스트에서 다른 필드로 정렬을 하려면 아래의 배열 코드에서 해당 필드를 추가하세요.
-if( isset($sort) && ! in_array($sort, array('it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time')) ){
+if( isset($sort) && ! in_array($sort, array('it_name', 'it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time')) ){
    $sort='';
 }

@@ -36,7 +36,7 @@ class HttpClient {
        // [scheme] => https
        // [host] => fcstdpay.inicis.com || stdpay.inicis.com || ksstdpay.inicis.com
        // [path] => /api/payAuth
-        if (preg_match("#\.inicis\.com$#", $url_data["host"]) == false) {
+        if (! is_inicis_url_return($url)) {
            return false;
        }

@@ -194,7 +194,6 @@ $sns_title = get_text($it['it_name']).' | '.get_text($config['cf_title']);
 $sns_url  = shop_item_url($it['it_id']);
 $sns_share_links = get_sns_share_link('facebook', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/facebook.png').' ';
 $sns_share_links .= get_sns_share_link('twitter', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/twitter.png').' ';
-$sns_share_links .= get_sns_share_link('googleplus', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/gplus.png');

 // 상품품절체크
 if(G5_SOLDOUT_CHECK)
@@ -62,6 +62,8 @@ if($cancelFlag == "true")

    }

+    if(! (isset($inipay) && method_exists($inipay, 'SetField'))) return;
+
    $TID = $tno;
    $inipay->SetField("type", "cancel"); // 고정
    if( $default['de_kakaopay_cancelpwd'] ){
@@ -13,7 +13,7 @@ set_session('P_AMT',  '');
 set_session('P_HASH', '');

 $oid  = isset($_REQUEST['P_NOTI']) ? trim($_REQUEST['P_NOTI']) : '';
-$p_req_url = isset($_REQUEST['P_REQ_URL']) ? trim($_REQUEST['P_REQ_URL']) : '';
+$p_req_url = isset($_REQUEST['P_REQ_URL']) ? is_inicis_url_return(trim($_REQUEST['P_REQ_URL'])) : '';

 if( ! $p_req_url || !preg_match('/^https\:\/\//i', $p_req_url)){
    alert("잘못된 요청 URL 입니다.");
@@ -91,7 +91,7 @@ if($_REQUEST['P_STATUS'] != '00') {

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_PORT, 443);
-    curl_setopt($ch, CURLOPT_URL, $_REQUEST['P_REQ_URL']);
+    curl_setopt($ch, CURLOPT_URL, $p_req_url);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
@@ -25,6 +25,12 @@ function m_Completepayment( FormOrJson, closeEvent )
    /********************************************************************/
    GetField( frm, FormOrJson );

+    $("body").css({
+        "position": "",
+        "width": "",
+        "top" : ""
+    });
+
    if( frm.res_cd.value == "0000" )
    {
        document.getElementById("display_pay_button").style.display = "none" ;
@@ -49,6 +55,11 @@ function jsf__pay( form )
    try
    {
        KCP_Pay_Execute( form );
+        $("body").css({
+            "position": "fixed",
+            "width": "100%",
+            "top" : "0"
+        });
    }
    catch (e)
    {
@@ -5,7 +5,7 @@ $ca_id = isset($_REQUEST['ca_id']) ? safe_replace_regex($_REQUEST['ca_id'], 'ca_
 $skin = isset($_REQUEST['skin']) ? safe_replace_regex($_REQUEST['skin'], 'skin') : '';

 // 상품 리스트에서 다른 필드로 정렬을 하려면 아래의 배열 코드에서 해당 필드를 추가하세요.
-if( isset($sort) && ! in_array($sort, array('it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time')) ){
+if( isset($sort) && ! in_array($sort, array('it_name', 'it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time')) ){
    $sort='';
 }

@@ -2,7 +2,7 @@
 include_once('./_common.php');

 // 상품 리스트에서 다른 필드로 정렬을 하려면 아래의 배열 코드에서 해당 필드를 추가하세요.
-$sort = (isset($_REQUEST['sort']) && in_array($_REQUEST['sort'], array('it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time'))) ? $_REQUEST['sort'] : '';
+$sort = (isset($_REQUEST['sort']) && in_array($_REQUEST['sort'], array('it_name', 'it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time'))) ? $_REQUEST['sort'] : '';
 $type = isset($_REQUEST['type']) ? preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\s]/", "", $_REQUEST['type']) : '';

 if (G5_IS_MOBILE) {
@@ -20,7 +20,7 @@ if ($is_member && $count) {
        $ad_subject = isset($_POST['ad_subject'][$k]) ? clean_xss_tags($_POST['ad_subject'][$k]) : '';

        $sql = " update {$g5['g5_shop_order_address_table']}
-                    set ad_subject = '$ad_subject' ";
+                    set ad_subject = '".sql_real_escape_string($ad_subject)."' ";

        if(!empty($_POST['ad_default']) && $ad_id === $_POST['ad_default']) {
            sql_query(" update {$g5['g5_shop_order_address_table']} set ad_default = '0' where mb_id = '{$member['mb_id']}' ");
@@ -16,7 +16,7 @@ $INIpayLog  = false;                  // 로그를 기록하려면 true 로 수

 $PG_IP = get_real_client_ip();

-if( $PG_IP == "203.238.37.3" || $PG_IP == "203.238.37.15" || $PG_IP == "203.238.37.16" || $PG_IP == "203.238.37.25" || $PG_IP == "39.115.212.9" )  //PG에서 보냈는지 IP로 체크
+if( $PG_IP == "203.238.37.3" || $PG_IP == "203.238.37.15" || $PG_IP == "203.238.37.16" || $PG_IP == "203.238.37.25" || $PG_IP == "183.109.71.153" || $PG_IP == "39.115.212.9" )  //PG에서 보냈는지 IP로 체크
 {
        $msg_id = $msg_id;             //메세지 타입
        $no_tid = $no_tid;             //거래번호
@@ -13,7 +13,7 @@ add_stylesheet('<link rel="stylesheet" href="' . $member_skin_url . '/style.css"
                <p>새로운 비밀번호를 입력해주세요.</p>
                <label for="mb_id" class="sound_only">아이디</label>
                <br>
-                <b>회원 아이디 : <?php echo $_POST['mb_id']; ?></b>
+                <b>회원 아이디 : <?php echo get_text($_POST['mb_id']); ?></b>
                <label for="mb_pw" class="sound_only">새 비밀번호<strong class="sound_only">필수</strong></label>
                <input type="password" name="mb_password" id="mb_pw" required class="required frm_input full_input" size="30" placeholder="새 비밀번호">
                <label for="mb_pw2" class="sound_only">새 비밀번호 확인<strong class="sound_only">필수</strong></label>
@@ -285,7 +285,7 @@
 #mb_confirm h1 {margin:60px 0 30px;font-size:2em}
 #mb_confirm p {padding:0 20px 40px;border-bottom:1px solid #e9e9e9;font-size:1.083em;line-height:1.4em;color:#656565}
 #mb_confirm p strong {display:block;color:#3ca1ff;font-size:1.167em;margin:0 0 5px}
-#mb_confirm fieldset {;padding:50px;text-align:left}
+#mb_confirm fieldset {padding:50px;text-align:left}
 #mb_confirm fieldset .frm_input {background-color:#fff !important}
 #mb_confirm label {letter-spacing:-0.1em}
 #mb_confirm_id {display:block;margin:5px 0 10px;font-weight:bold}
@@ -31,7 +31,8 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',
    <script>
    function fsearch_submit(f)
    {
-        if (f.stx.value.length < 2) {
+        var stx = f.stx.value.trim();
+        if (stx.length < 2) {
            alert("검색어는 두글자 이상 입력하십시오.");
            f.stx.select();
            f.stx.focus();
@@ -40,8 +41,8 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',

        // 검색에 많은 부하가 걸리는 경우 이 주석을 제거하세요.
        var cnt = 0;
-        for (var i=0; i<f.stx.value.length; i++) {
-            if (f.stx.value.charAt(i) == ' ')
+        for (var i = 0; i < stx.length; i++) {
+            if (stx.charAt(i) == ' ')
                cnt++;
        }

@@ -51,6 +52,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',
            f.stx.focus();
            return false;
        }
+        f.stx.value = stx;

        f.action = "";
        return true;
@@ -128,7 +128,6 @@ foreach((array) $list as $row){
            echo "<h3>SNS 공유</h3>";
            echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/facebook.png');
            echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/twitter.png');
-            echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/gplus.png');
            echo "<button type=\"button\" class=\"sct_sns_cls\"><span class=\"sound_only\">닫기</span><i class=\"fa fa-times\" aria-hidden=\"true\"></i></button>";
            echo "</div>\n";
        }
@@ -92,7 +92,6 @@ foreach((array) $list as $row){
        echo "<div class=\"sct_sns\">";
        echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/sns_fb_s.png');
        echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/sns_twt_s.png');
-        echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/sns_goo_s.png');
        echo "</div>\n";
    }

@@ -100,7 +100,6 @@ foreach((array) $list as $row){
        echo "<div class=\"sct_sns\">";
        echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/sns_fb_s.png');
        echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/sns_twt_s.png');
-        echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/sns_goo_s.png');
        echo "</div>\n";
    }

@@ -127,7 +127,6 @@ foreach((array) $list as $row){
            echo "<h3>SNS 공유</h3>";
            echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/facebook.png');
            echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/twitter.png');
-            echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/gplus.png');
            echo "<button type=\"button\" class=\"sct_sns_cls\"><span class=\"sound_only\">닫기</span><i class=\"fa fa-times\" aria-hidden=\"true\"></i></button>";
            echo "</div>\n";
        }
@@ -103,7 +103,6 @@ foreach((array) $list as $row){
        echo "<div class=\"sct_sns\" style=\"top:{$sns_top}px\">";
        echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/facebook.png');
        echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/twitter.png');
-        echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/gplus.png');
        echo "</div>\n";
    }
 	
@@ -125,7 +125,6 @@ foreach((array) $list as $row){
 		echo "<h3>SNS 공유</h3>";
        echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/facebook.png');
        echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/twitter.png');
-        echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/gplus.png');
        echo "<button type=\"button\" class=\"sct_sns_cls\"><span class=\"sound_only\">닫기</span><i class=\"fa fa-times\" aria-hidden=\"true\"></i></button>";
        echo "</div>\n";
    }
@@ -118,7 +118,6 @@ foreach((array) $list as $row){
 		echo "<h3>SNS 공유</h3>";
        echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/facebook.png');
        echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/twitter.png');
-        echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/gplus.png');
        echo "<button type=\"button\" class=\"sct_sns_cls\"><span class=\"sound_only\">닫기</span><i class=\"fa fa-times\" aria-hidden=\"true\"></i></button>";
        echo "</div>\n";
    }
@@ -84,7 +84,6 @@ for ($i=1; $row=sql_fetch_array($result); $i++) {
        echo "<div class=\"sct_sns\" style=\"top:{$sns_top}px\">";
        echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/sns_fb_s.png');
        echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/sns_twt_s.png');
-        echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_SHOP_SKIN_URL.'/img/sns_goo_s.png');
        echo "</div>\n";
    }

@@ -217,7 +217,6 @@
 .sct_10 .sct_sns a {display:inline-block;border-radius:50%;width:50px;height:50px;line-height:25px;text-align:center;padding:10px 0;margin:20px 5px}
 .sct_10 .sct_sns .share-facebook {background:#415b92}
 .sct_10 .sct_sns .share-twitter {background:#35b3dc}
-.sct_10 .sct_sns .share-googleplus {background:#ea3838}
 .sct_10 .sct_sns img {width:24px}
 .sct_10 .sct_sns_bg {background:rgba(0,0,0,0.1);width:100%;height:100%}
 .sct_10 .sct_sns_cls {position:absolute;right:0;top:0;color:#b5b8bb;border:0;padding:12px 15px;font-size:16px;background:#fff}
@@ -290,7 +289,6 @@
 .sct_40 .sct_sns a {display:inline-block;border-radius:50%;width:50px;height:50px;line-height:25px;text-align:center;padding:10px 0;margin:20px 5px}
 .sct_40 .sct_sns .share-facebook {background:#415b92}
 .sct_40 .sct_sns .share-twitter {background:#35b3dc}
-.sct_40 .sct_sns .share-googleplus {background:#ea3838}
 .sct_40 .sct_sns img {width:24px}
 .sct_40 .sct_sns_bg {background:rgba(0,0,0,0.1);width:100%;height:100%}
 .sct_40 .sct_sns_cls {position:absolute;right:0;top:0;color:#b5b8bb;border:0;padding:12px 15px;font-size:16px;background:#fff}
@@ -345,7 +343,6 @@
 .smt_10 .sct_sns a {display:inline-block;border-radius:50%;width:50px;height:50px;line-height:25px;text-align:center;padding:10px 0;margin:20px 5px}
 .smt_10 .sct_sns .share-facebook {background:#415b92}
 .smt_10 .sct_sns .share-twitter {background:#35b3dc}
-.smt_10 .sct_sns .share-googleplus {background:#ea3838}
 .smt_10 .sct_sns img {width:24px}
 .smt_10 .sct_sns_bg {background:rgba(0,0,0,0.1);width:100%;height:100%}
 .smt_10 .sct_sns_cls {position:absolute;right:0;top:0;color:#b5b8bb;border:0;padding:12px 15px;font-size:16px;background:#fff}
@@ -353,7 +350,7 @@
 .smt_10 .sct_op_btn {position:absolute;right:5px;bottom:0}
 .smt_10 .sct_op_btn>button {border:0;width:25px;height:20px;font-size:1.25em;text-align:center;color:#949494;background:transparent}

-.sct_cartop_wr {position:absolute;top:0;left:0;z-index:3;width:100%;height:100%;padding:10px;text-align:left;background:rgba(0,0,0,0.5);opacity:0.98}
+.sct_cartop_wr {position:absolute;top:0;left:0;z-index:9999;width:100%;height:100%;padding:10px;text-align:left;background:rgba(0,0,0,0.5);opacity:0.98}
 .sct_cartop_wr .it_option {width:100%;height:35px;margin-bottom:5px;}
 .sct_cartop_wr .cartopt_cart_btn {width:100%;border:1px solid #1c70e9;padding:8px 5px;margin-bottom:5px;background:#3a8afd;color:#fff;border-radius:3px}
 .sct_cartop_wr .cartopt_close_btn {width:100%;border:1px solid #1c70e9;padding:8px 5px;background:#fff;color:#1c70e9;border-radius:3px}
@@ -380,7 +377,6 @@
 .smt_20 .sct_sns a {display:inline-block;border-radius:50%;width:30px;height:30px;line-height:28px;margin-right:5px;text-align:center}
 .smt_20 .sct_sns .share-facebook {background:#415b92}
 .smt_20 .sct_sns .share-twitter {background:#35b3dc}
-.smt_20 .sct_sns .share-googleplus {background:#ea3838}
 .smt_20 .sct_sns img {width:20px}

 .smt_20 .sct_icon {margin:0 0 10px}
@@ -558,7 +554,6 @@
 #sit_star_sns .sns_area a {display:inline-block;width:35px;height:35px;line-height:35px;margin-bottom:5px;background:#eee;text-align:center;border-radius:50%}
 #sit_star_sns .sns_area a img {width:24px;height:auto}
 #sit_star_sns .sns_area #sit_btn_rec {font-size:15px}
-#sit_star_sns .sns_area .share-googleplus {background:#ea3838}
 #sit_star_sns .sns_area .share-facebook {background:#415b92}
 #sit_star_sns .sns_area .share-twitter {background:#35b3dc}

@@ -81,7 +81,7 @@ input, textarea {

 /*카테고리*/
 .menu {display:none;position:fixed;top:0;height:100%;z-index:99999;-webkit-backface-visibility:hidden;width:100%;background:#efefef}
-.menu .menu_wr{;width:100%;height:100%;overflow-y:auto;background:#eee;position:relative;z-index:199919;
+.menu .menu_wr{width:100%;height:100%;overflow-y:auto;background:#eee;position:relative;z-index:199919;
 -webkit-box-shadow: 0 0 5px rgba(55,55,5,0.4));
    -moz-box-shadow: 0 0 5px rgba(55,55,5,0.4));
         box-shadow: 0 0 5px rgba(55,55,5,0.4);}
@@ -316,7 +316,7 @@ box-shadow: inset 0 1px 1px rgba(0, 0, 0, .075);
 }

 #sod_frm .sod_ta_wr{background: #fff}
-#sod_frm .btn_confirm{;margin:0 10px 10px}
+#sod_frm .btn_confirm{margin:0 10px 10px}
 #sod_frm .btn_submit{width:100%;height:45px;font-size: 1.167em;font-weight: bold;margin:5px 0;border-radius:4px}
 #sod_frm .btn_cancel,#sod_frm .btn01{width:100%;height:45px;line-height:43px;font-size:1.167em;font-weight: bold;padding:0;border-radius:4px}

@@ -68,7 +68,8 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
                <script>
                function fsearchbox_submit(f)
                {
-                    if (f.stx.value.length < 2) {
+                    var stx = f.stx.value.trim();
+                    if (stx.length < 2) {
                        alert("검색어는 두글자 이상 입력하십시오.");
                        f.stx.select();
                        f.stx.focus();
@@ -77,8 +78,8 @@ include_once(G5_LIB_PATH.'/popular.lib.php');

                    // 검색에 많은 부하가 걸리는 경우 이 주석을 제거하세요.
                    var cnt = 0;
-                    for (var i=0; i<f.stx.value.length; i++) {
-                        if (f.stx.value.charAt(i) == ' ')
+                    for (var i = 0; i < stx.length; i++) {
+                        if (stx.charAt(i) == ' ')
                            cnt++;
                    }

@@ -88,6 +89,7 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
                        f.stx.focus();
                        return false;
                    }
+                    f.stx.value = stx;

                    return true;
                }
@@ -97,7 +97,8 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
                <script>
                function fsearchbox_submit(f)
                {
-                    if (f.stx.value.length < 2) {
+                    var stx = f.stx.value.trim();
+                    if (stx.length < 2) {
                        alert("검색어는 두글자 이상 입력하십시오.");
                        f.stx.select();
                        f.stx.focus();
@@ -106,8 +107,8 @@ include_once(G5_LIB_PATH.'/popular.lib.php');

                    // 검색에 많은 부하가 걸리는 경우 이 주석을 제거하세요.
                    var cnt = 0;
-                    for (var i=0; i<f.stx.value.length; i++) {
-                        if (f.stx.value.charAt(i) == ' ')
+                    for (var i = 0; i < stx.length; i++) {
+                        if (stx.charAt(i) == ' ')
                            cnt++;
                    }

@@ -117,6 +118,7 @@ include_once(G5_LIB_PATH.'/popular.lib.php');
                        f.stx.focus();
                        return false;
                    }
+                    f.stx.value = stx;

                    return true;
                }
@@ -13,7 +13,7 @@ add_stylesheet('<link rel="stylesheet" href="' . $member_skin_url . '/style.css"
                <p>새로운 비밀번호를 입력해주세요.</p>
                <label for="mb_id" class="sound_only">아이디</label>
                <br>
-                <b>회원 아이디 : <?php echo $_POST['mb_id']; ?></b>
+                <b>회원 아이디 : <?php echo get_text($_POST['mb_id']); ?></b>
                <label for="mb_pw" class="sound_only">새 비밀번호<strong class="sound_only">필수</strong></label>
                <input type="password" name="mb_password" id="mb_pw" required class="required frm_input full_input" size="30" placeholder="새 비밀번호">
                <label for="mb_pw2" class="sound_only">새 비밀번호 확인<strong class="sound_only">필수</strong></label>
@@ -45,7 +45,8 @@ if ($stx) {
        <script>
        function fsearch_submit(f)
        {
-            if (f.stx.value.length < 2) {
+            var stx = f.stx.value.trim();
+            if (stx.length < 2) {
                alert("검색어는 두글자 이상 입력하십시오.");
                f.stx.select();
                f.stx.focus();
@@ -54,8 +55,8 @@ if ($stx) {

            // 검색에 많은 부하가 걸리는 경우 이 주석을 제거하세요.
            var cnt = 0;
-            for (var i=0; i<f.stx.value.length; i++) {
-                if (f.stx.value.charAt(i) == ' ')
+            for (var i = 0; i < stx.length; i++) {
+                if (stx.charAt(i) == ' ')
                    cnt++;
            }

@@ -65,6 +66,7 @@ if ($stx) {
                f.stx.focus();
                return false;
            }
+            f.stx.value = stx;

            f.action = "";
            return true;
@@ -7,7 +7,7 @@ add_javascript('<script src="'.G5_JS_URL.'/jquery.bxslider.js"></script>', 10);
 ?>

 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -77,7 +77,6 @@ add_javascript('<script src="'.G5_JS_URL.'/jquery.bxslider.js"></script>', 10);
                    <div class="sns_area">
                        <?php echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/facebook.png'); ?>
                        <?php echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/twitter.png'); ?>
-                        <?php echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/gplus.png'); ?>
                        <?php echo get_sns_share_link('kakaotalk', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/sns_kakao.png'); ?>
                        <?php
                        $href = G5_SHOP_URL.'/iteminfo.php?it_id='.$it_id;
@@ -9,7 +9,7 @@ add_javascript('<script src="'.G5_THEME_JS_URL.'/theme.shop.list.js"></script>',
 ?>

 <?php if(!defined('G5_IS_SHOP_AJAX_LIST') && $config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -116,7 +116,6 @@ foreach((array) $list as $row){
            echo "<h3>SNS 공유</h3>";
            echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/facebook.png');
            echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/twitter.png');
-            echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/gplus.png');
            echo get_sns_share_link('kakaotalk', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/sns_kakao.png');
            echo "<button type=\"button\" class=\"sct_sns_cls\"><span class=\"sound_only\">닫기</span><i class=\"fa fa-times\" aria-hidden=\"true\"></i></button>";
            echo "</div>\n";
@@ -9,7 +9,7 @@ add_javascript('<script src="'.G5_THEME_JS_URL.'/theme.shop.list.js"></script>',
 ?>

 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -108,7 +108,6 @@ foreach((array) $list as $row){
            echo "<h3>SNS 공유</h3>";
            echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/facebook.png');
            echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/twitter.png');
-            echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/gplus.png');
            echo get_sns_share_link('kakaotalk', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/sns_kakao.png');
            echo "<button type=\"button\" class=\"sct_sns_cls\"><span class=\"sound_only\">닫기</span><i class=\"fa fa-times\" aria-hidden=\"true\"></i></button>";
            echo "</div>\n";
@@ -10,7 +10,7 @@ add_javascript('<script src="'.G5_THEME_JS_URL.'/theme.shop.list.js"></script>',

 <script src="<?php echo G5_JS_URL ?>/jquery.fancylist.js"></script>
 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -104,7 +104,6 @@ foreach((array) $list as $row){
        echo "<div class=\"sct_sns\" style=\"top:{$sns_top}px\">";
        echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/facebook.png');
        echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/twitter.png');
-        echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/gplus.png');
        echo get_sns_share_link('kakaotalk', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/sns_kakao.png');
        echo "</div>\n";
    }
@@ -10,7 +10,7 @@ add_javascript('<script src="'.G5_THEME_JS_URL.'/theme.shop.list.js"></script>',
 ?>

 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -104,7 +104,6 @@ foreach((array) $list as $row){
        echo "<div class=\"sct_sns\" style=\"top:{$sns_top}px\">";
        echo get_sns_share_link('facebook', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/facebook.png');
        echo get_sns_share_link('twitter', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/twitter.png');
-        echo get_sns_share_link('googleplus', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/gplus.png');
        echo get_sns_share_link('kakaotalk', $sns_url, $sns_title, G5_MSHOP_SKIN_URL.'/img/sns_kakao.png');
        echo "</div>\n";
    }
@@ -7,7 +7,7 @@ add_stylesheet('<link rel="stylesheet" href="'.G5_MSHOP_SKIN_URL.'/style.css">',

 <script src="<?php echo G5_JS_URL ?>/jquery.fancylist.js"></script>
 <?php if($config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="https://developers.kakao.com/sdk/js/kakao.min.js" async></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
    // 사용할 앱의 Javascript 키를 설정해 주세요.
@@ -69,7 +69,6 @@
 .sct_sns a {display:inline-block;margin:0 2px;width:28px;height:28px;line-height:28px;border-radius:3px;font-size:0;text-align:center}
 .share-facebook {background:#415b92}
 .share-twitter {background:#35b3dc}
-.share-googleplus {background:#d5503a}
 .share-kakaotalk {background:#ffeb00}
 .sct_sns img {width:20px;height:auto;vertical-align:middle}
 .sct_sns button {margin:0 4px 0 0;padding:0;border:0}
@@ -103,7 +102,6 @@
 .sct_10 .sct_sns a {display:inline-block;border-radius:50%;width:50px;height:50px;line-height:25px;text-align:center;padding:13px 0;margin:20px 5px}
 .sct_10 .sct_sns .share-facebook {background:#415b92}
 .sct_10 .sct_sns .share-twitter {background:#35b3dc}
-.sct_10 .sct_sns .share-googleplus {background:#ea3838}
 .sct_10 .sct_sns img {width:24px}
 .sct_10 .sct_sns_bg {background:rgba(0,0,0,0.1);width:100%;height:100%}
 .sct_10 .sct_sns_cls {position:absolute;right:0;top:0;color:#b5b8bb;border:0;padding:12px 15px;font-size:16px;background:#fff;margin:0;height:50px}
@@ -129,7 +127,6 @@
 .sct_10_list .sct_sns a {display:inline-block;border-radius:50%;width:50px;height:50px;line-height:25px;text-align:center;padding:13px 0;margin:20px 5px}
 .sct_10_list .sct_sns .share-facebook {background:#415b92}
 .sct_10_list .sct_sns .share-twitter {background:#35b3dc}
-.sct_10_list .sct_sns .share-googleplus {background:#ea3838}
 .sct_10_list .sct_sns img {width:24px}
 .sct_10_list .sct_sns_bg {background:rgba(0,0,0,0.1);width:100%;height:100%}
 .sct_10_list .sct_sns_cls {position:absolute;right:0;top:0;color:#b5b8bb;border:0;padding:12px 15px;font-size:16px;background:#fff}
@@ -332,7 +329,6 @@
 #sit_star_sns .sns_area a {display:inline-block;width:35px;height:35px;line-height:35px;background:#eee;text-align:center;border-radius:50%;padding-top:5px}
 #sit_star_sns .sns_area a img {width:24px;height:auto}
 #sit_star_sns .sns_area #sit_btn_rec {font-size:15px;padding-top:0}
-#sit_star_sns .sns_area .share-googleplus {background:#ea3838}
 #sit_star_sns .sns_area .share-facebook {background:#415b92}
 #sit_star_sns .sns_area .share-twitter {background:#35b3dc}

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kjh	cd50af93fd	버전 5.5.8.2.4 수정	2022-11-22 11:30:07 +09:00
thisgun	9c8f7128f2	css 코드중 오타 수정	2022-11-21 11:54:52 +09:00
thisgun	a93008d392	set_http 함수 코드 수정	2022-11-21 11:47:32 +09:00
thisgun	d3561623aa	휴대폰번호 입력 필수 입력 오류 수정	2022-11-21 11:41:18 +09:00
thisgun	311e879563	[KVE-2022-1984]관리자 개인결제 Stored XSS 취약점 수정	2022-11-21 10:35:49 +09:00
thisgun	9932b99a51	KG이니시스 가상계좌 노티 전송 IP 추가	2022-10-21 10:04:07 +09:00
thisgun	5c9ed36bf2	kakao cdn에 async 속성 추가	2022-10-17 11:56:41 +09:00
thisgun	dbc8e1676a	버전 5.5.8.2.3 수정	2022-10-17 10:59:59 +09:00
thisgun	749345e502	Merge branch 'master' of github.com:gnuboard/g5-update	2022-10-17 10:57:35 +09:00
thisgun	7c8a21ecc0	카카오 우편번호 서비스 url 수정 및 속성에 async 추가	2022-10-17 10:57:00 +09:00
KimTom89andGitHub	8751ab122a	Merge pull request #10 from gnuboard/G5-154/search-keyword-trim [fix] 사이트 내 전체검색 > 검색어 양 끝의 공백 제거	2022-10-05 12:20:50 +09:00
kjh	0f3e6125b5	[fix] 사이트 내 전체검색 > 검색어 양 끝의 공백 제거	2022-10-05 11:50:08 +09:00
kjh	a21d02f4c5	버전 5.5.8.2.2 수정	2022-10-04 15:14:35 +09:00
thisgun	2f9fb355e3	[KVE-2022-0992] 취약점 다시 재수정	2022-09-27 17:15:46 +09:00
thisgun	8074bce274	Merge branch 'master' of github.com:gnuboard/g5-update	2022-09-27 10:13:35 +09:00
thisgun	85dbbe946a	비번찾기 후 빈 페이지가 나오는 문제 수정	2022-09-27 10:12:18 +09:00
kjh	1f2e79b188	Merge branch 'master' of github.com:gnuboard/g5-update	2022-09-16 16:59:50 +09:00
thisgun	27434107e8	[KVE-2022-0992] 그누보드5 스크립트 실행 취약점 수정	2022-09-15 11:30:10 +09:00
thisgun	f1a303e445	버전 5.5.8.2.1 수정	2022-09-13 10:38:05 +09:00
thisgun	ba062ca5b6	[KVE-2022-0981] 그누보드 Reflected XSS 취약점	2022-09-01 16:08:08 +09:00
thisgun	34774f0fc3	Merge branch 'master' of github.com:gnuboard/gnuboard5	2022-09-01 15:15:00 +09:00
thisgunandGitHub	26b22ac9ca	Merge pull request #199 from 39hn/fix/delivery-company-url fix: 택배사 배송조회 주소 수정	2022-09-01 15:10:03 +09:00
thisgunandGitHub	9e4a8a95b0	Merge pull request #201 from KimTom89/fix/samesite-condition Fix gnuboard/gnuboard5#200 HTTP_X_FORWARDED_PROTO 조건 추가	2022-09-01 15:07:29 +09:00
thisgun	1bca642b33	모바일 쿠폰적용 후 취소 오류 수정	2022-09-01 15:05:41 +09:00
thisgun	3a59bca369	관리자 회원 수정에서 관리자는 탈퇴일자 또는 접근차단일자를 적용못하게 수정	2022-08-25 10:29:11 +09:00
thisgun	5ad2307175	메일보내기 메일주소를 도메인과 동일하게 권장하는 문구 추가	2022-08-25 10:10:29 +09:00
kjh	25b3d8f6ed	Fix gnuboard/gnuboard5#200 HTTP_X_FORWARDED_PROTO 조건 추가	2022-08-22 15:57:20 +09:00
thisgun	0d02afd712	장바구니 레이어 z-index 속성 수정	2022-08-19 09:55:22 +09:00
39hn	78d5dce761	fix: 택배사 배송조회 주소 수정 대신택배, 우체국, 한진택배, CVSnet편의점택배, 건영택배 주소 수정	2022-08-10 13:05:17 +09:00
kjh	45d5404520	Merge branch 'master' of github.com:gnuboard/g5-update	2022-08-05 14:50:01 +09:00
thisgun	1e6710a55b	투표에 사용, 미사용 기능 추가 (크레이티브님,210910) merge	2022-07-28 11:51:33 +09:00
thisgun	463ca06a21	버전 5.5.8.2 수정	2022-07-26 14:03:46 +09:00
thisgun	71f58f3108	KVE-2021-1116 그누보드 XSS 취약점 수정	2022-07-26 13:38:20 +09:00
thisgun	a6e302ff84	KCAPTCHA php5.3 버전 이하에서 나는 오류 수정	2022-07-26 11:35:33 +09:00
thisgun	0c275d0907	본인인증 업데이트시 hook 이벤트 추가	2022-07-25 10:34:51 +09:00
thisgun	fa7d0bc717	로그인시 쓰기권한 fclose전에 is_resource로 검사	2022-07-25 10:30:28 +09:00
thisgun	95492a5cd8	G5-82 <사용하지 않는 구글플러스 관련 코드 삭제>	2022-07-11 11:02:46 +09:00
thisgun	58dc48d3ea	영카트 상품리스트 sort 키에 it_name 추가	2022-07-11 10:32:49 +09:00
thisgun	281bb5427c	영카트 상품리스트 sort 키에 it_name 추가	2022-07-07 10:04:40 +09:00
thisgunandGitHub	0577882c6c	Merge pull request #185 from seeoya/master 프론트 버그 신고 내역 처리	2022-07-04 17:37:40 +09:00
thisgun	be758d57a5	버전 5.5.8.1.2 수정	2022-07-01 09:56:11 +09:00
thisgun	3cee6ede91	토큰 오류로 상품복사가 안되는 오류 수정	2022-07-01 09:55:11 +09:00
thisgun	5d86287069	영카트 주문내역에서 기타선택->반품,품절 검색이 안되는 오류 수정	2022-06-28 09:52:12 +09:00
thisgun	1a12b3e52b	버전 5.5.8.1.1 수정	2022-06-23 16:28:21 +09:00
thisgun	929183b3e3	[KVE-2022-0175] 그누보드 sql 취약점 수정	2022-06-23 14:29:14 +09:00
seeoya	c1a45a1bec	G5-137 모바일 쇼핑몰 장바구니 닫힘 태그 누락 (eyoom님, 220621)	2022-06-21 18:42:06 +09:00
Hailey KimandGitHub	444c6d88c2	Merge branch 'gnuboard:master' into master	2022-06-21 18:06:23 +09:00
thisgun	2366e8ebfb	버전 5.5.8.1 수정	2022-06-20 14:16:28 +09:00
thisgun	a0bfc2cf6a	sql_query 함수내 불필요한 코드 삭제	2022-06-20 11:32:35 +09:00
thisgun	22ea3d39c1	[KVE-2022-0193] 그누보드(영카트) SSRF & Business Logic Bug 취약점 수정	2022-06-17 17:11:05 +09:00
thisgun	d4f4612b22	안전하지 않는 변수에 필터링 추가	2022-06-17 12:23:21 +09:00
thisgun	e061ad852b	[KVE-2022-0158] 그누보드(영카트)5 Reflected XSS 및 SQL Injection 취약점 수정	2022-06-17 12:13:54 +09:00
thisgun	4883fb18ae	[KVE-2022-0133] 그누보드 XSS, CSRF 취약점 수정	2022-06-16 16:06:33 +09:00
thisgun	32e9797fef	[KVE-2022-0143] 그누보드 Open Redirect, Reflected XSS 취약점 수정	2022-06-16 14:15:07 +09:00
thisgun	bafa1c43bf	[KVE-2022-0120]그누보드_부적절한_권한_검증_취약점_수정	2022-06-15 16:11:06 +09:00
thisgun	d8b6297579	check_url_host 함수에 hook 적용	2022-06-15 13:40:18 +09:00
thisgun	251dfc26e8	[KVE-2022-0137] 그누보드 XSS, SQL Injection 취약점 수정	2022-06-14 18:18:05 +09:00
수영andGitHub	958b9342b5	Merge branch 'gnuboard:master' into master	2022-06-07 17:24:23 +09:00
seeoya	adc8e94774	G5-88 관리자 : 미사용 CSS 제거 (묵혼님, 220503)	2022-05-03 17:29:20 +09:00
seeoya	26857a8d50	G5-87 쇼핑몰 : KCP 결제창 표시될 때 화면이 스크롤되지 않도록 수정 (HSCOMM님, 220503)	2022-05-03 16:12:34 +09:00