버전 5.6.10 수정

쇼핑몰 가상계좌 정보(toss)에 은행이름이 하나 더 붙은 문제 수정
사이드뷰에서 잘못된 닉네임 또는 이름이 출력되는 오류 수정
2025-02-04 11:17:21 +09:00 · 2025-02-04 11:01:41 +09:00 · 2025-02-04 10:49:01 +09:00 · 2025-02-03 17:56:42 +09:00 · 2025-02-03 11:36:01 +09:00 · 2025-01-21 16:26:06 +09:00
199 changed files with 33491 additions and 29294 deletions
@@ -0,0 +1,3 @@
+# Gnuboard5 Security Policy
+
+Please ask [https://sir.kr/security/.](https://sir.kr/co_qa)
@@ -554,7 +554,7 @@ function admin_check_xss_params($params)

        if (is_array($value)) {
            admin_check_xss_params($value);
-        } else if ((preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/[onload|onerror]=.*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || (preg_match('/[onload|onerror|focus]=.*/ius', $value) && preg_match('/(eval|expression|exec|prompt)(\s*)\((.*)\)/ius', $value))) {
+        } else if ((preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/(onload|onerror)=.*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || (preg_match('/(onload|onerror|focus)=.*/ius', $value) && preg_match('/(eval|expression|exec|prompt)(\s*)\((.*)\)/ius', $value))) {
            alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.', G5_URL);
            die();
        }
@@ -617,13 +617,12 @@ if (!$member['mb_id']) {
    }
 }

-// 관리자의 아이피, 브라우저와 다르다면 세션을 끊고 관리자에게 메일을 보낸다.
-$admin_key = md5($member['mb_datetime'] . get_real_client_ip() . $_SERVER['HTTP_USER_AGENT']);
-if (get_session('ss_mb_key') !== $admin_key) {
-
+// 관리자의 클라이언트를 검증하여 일치하지 않으면 세션을 끊고 관리자에게 메일을 보낸다.
+if (!verify_mb_key($member)) {
    session_destroy();

    include_once G5_LIB_PATH . '/mailer.lib.php';
+
    // 메일 알림
    mailer($member['mb_nick'], $member['mb_email'], $member['mb_email'], 'XSS 공격 알림', $_SERVER['REMOTE_ADDR'] . ' 아이피로 XSS 공격이 있었습니다.<br><br>관리자 권한을 탈취하려는 접근이므로 주의하시기 바랍니다.<br><br>해당 아이피는 차단하시고 의심되는 게시물이 있는지 확인하시기 바랍니다.' . G5_URL, 0);

@@ -5,7 +5,7 @@ if (!defined('_GNUBOARD_')) {

 // 그누보드5.4.5.5 버전과 영카트5.4.5.5.1 버전이 통합됨에 따라 그누보드 버전만 표시
 // $print_version = defined('G5_YOUNGCART_VER') ? 'YoungCart Version '.G5_YOUNGCART_VER : 'Version '.G5_GNUBOARD_VER;
-$print_version = 'Version ' . G5_GNUBOARD_VER;
+$print_version = ($is_admin == 'super') ? 'Version ' . G5_GNUBOARD_VER : '';
 ?>

 <noscript>
@@ -8,7 +8,7 @@ auth_check_menu($auth, $sub_menu, 'w');

 check_admin_token();

-$bo_table       = isset($_POST['bo_table']) ? $_POST['bo_table'] : null;
+$bo_table       = isset($_POST['bo_table']) ? substr(preg_replace('/[^a-z0-9_]/i', '', $_POST['bo_table']), 0, 20) : null;
 $target_table   = isset($_POST['target_table']) ? trim($_POST['target_table']) : '';
 $target_subject = isset($_POST['target_subject']) ? trim($_POST['target_subject']) : '';

@@ -24,6 +24,8 @@ if (!preg_match('/[A-Za-z0-9_]{1,20}/', $target_table)) {
    alert('게시판 TABLE명은 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (20자 이내)');
 }

+$target_table = substr(preg_replace('/[^a-z0-9_]/i', '', $target_table), 0, 20);
+
 // 게시판명이 금지된 단어로 되어 있으면
 if ($w == '' && in_array($target_table, get_bo_table_banned_word())) {
    alert('입력한 게시판 TABLE명을 사용할수 없습니다. 다른 이름으로 입력해 주세요.');
@@ -191,7 +193,6 @@ if ($copy_case == 'schema_data_both') {
    sql_query($sql, false);

    // 4.00.01
-    // 위의 코드는 같은 테이블명을 사용하였다는 오류가 발생함. (희한하네 ㅡㅡ;)
    $sql = " select * from {$g5['board_file_table']} where bo_table = '$bo_table' ";
    $result = sql_query($sql, false);
    for ($i = 0; $row = sql_fetch_array($result); $i++) {
@@ -8,7 +8,9 @@ if ($is_admin != 'super') {
    alert('최고관리자만 접근 가능합니다.');
 }

-$copy_config = get_config(true);
+// https://github.com/gnuboard/gnuboard5/issues/296 이슈처리
+$sql = " select * from {$g5['config_table']} limit 1";
+$config = sql_fetch($sql);

 if (!isset($config['cf_add_script'])) {
    sql_query(
@@ -407,6 +409,19 @@ if (!isset($config['cf_cert_kg_mid'])) {
            ADD COLUMN `cf_cert_kg_mid` VARCHAR(255) NOT NULL DEFAULT '' AFTER `cf_cert_kg_cd`; ";
    sql_query($sql, false);
 }
+if (!isset($config['cf_cert_use_seed'])) {
+    $sql = "ALTER TABLE `{$g5['config_table']}` 
+            ADD COLUMN `cf_cert_use_seed` TINYINT(4) NOT NULL DEFAULT '1' AFTER `cf_cert_kg_mid`; ";
+    sql_query($sql, false);
+}
+if (!isset($config['cf_cert_kcp_enckey'])) {
+    $sql = "ALTER TABLE `{$g5['config_table']}` 
+            ADD COLUMN `cf_cert_kcp_enckey` VARCHAR(100) NOT NULL DEFAULT '' AFTER `cf_cert_kcp_cd`; ";
+    sql_query($sql, false);
+    
+    $config['cf_cert_kcp_enckey'] = '';
+}
+
 if (!$config['cf_faq_skin']) {
    $config['cf_faq_skin'] = "basic";
 }
@@ -699,14 +714,14 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                        <th scope="row"><label for="cf_analytics">방문자분석 스크립트</label></th>
                        <td colspan="3">
                            <?php echo help('방문자분석 스크립트 코드를 입력합니다. 예) 구글 애널리틱스<br>관리자 페이지에서는 이 코드를 사용하지 않습니다.'); ?>
-                            <textarea name="cf_analytics" id="cf_analytics"><?php echo get_text($copy_config['cf_analytics']); ?></textarea>
+                            <textarea name="cf_analytics" id="cf_analytics"><?php echo get_text($config['cf_analytics']); ?></textarea>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="cf_add_meta">추가 메타태그</label></th>
                        <td colspan="3">
                            <?php echo help('추가로 사용하실 meta 태그를 입력합니다.<br>관리자 페이지에서는 이 코드를 사용하지 않습니다.'); ?>
-                            <textarea name="cf_add_meta" id="cf_add_meta"><?php echo get_text($copy_config['cf_add_meta']); ?></textarea>
+                            <textarea name="cf_add_meta" id="cf_add_meta"><?php echo get_text($config['cf_add_meta']); ?></textarea>
                        </td>
                    </tr>
                    <tr>
@@ -1001,6 +1016,16 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                            </select>
                        </td>
                    </tr>
+                    <tr>
+                        <th scope="row" class="cf_cert_service"><label for="cf_cert_use_seed">통합인증 암호화 적용</label></th>
+                        <td class="cf_cert_service">
+                            <?php echo help('KG이니시스 통합인증서비스에 암호화를 적용합니다. 만일 글자가 깨지는 문제가 발생하면 사용안함으로 적용해 주세요.') ?>
+                            <select name="cf_cert_use_seed" id="cf_cert_use_seed">
+                                <?php echo option_selected("0", $config['cf_cert_use_seed'], "사용안함"); ?>
+                                <?php echo option_selected("1", $config['cf_cert_use_seed'], "사용함"); ?>
+                            </select>
+                        </td>
+                    </tr>
                    <tr>
                        <th scope="row" class="cf_cert_service"><label for="cf_cert_hp">휴대폰 본인확인</label></th>
                        <td class="cf_cert_service">
@@ -1049,6 +1074,13 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                            <input type="text" name="cf_cert_kcp_cd" value="<?php echo get_sanitize_input($config['cf_cert_kcp_cd']); ?>" id="cf_cert_kcp_cd" class="frm_input" size="3"> <a href="http://sir.kr/main/service/p_cert.php" target="_blank" class="btn_frmline">NHN KCP 휴대폰 본인확인 서비스 신청페이지</a>
                        </td>
                    </tr>
+                    <tr>
+                        <th scope="row" class="cf_cert_service"><label for="cf_cert_kcp_enckey">NHN KCP 가맹점 인증키</label></th>
+                        <td class="cf_cert_service">
+                            <?php echo help('(선택사항, 추후 NHN_KCP 상점관리자에서 인증키 발급 메뉴 오픈일정 이후부터 적용되는 내용입니다.)<br>NHN_KCP 상점관리자 > 기술관리센터 > 인증센터 > 가맹점 인증키관리 에서 인증키 발급 후에 인증키 정보를 입력') ?>
+                            <input type="text" name="cf_cert_kcp_enckey" value="<?php echo get_sanitize_input($config['cf_cert_kcp_enckey']); ?>" id="cf_cert_kcp_enckey" class="frm_input" maxlength="100" size="40"> <a href="https://partner.kcp.co.kr" target="_blank" class="btn_frmline">NHN KCP 상점관리자</a>
+                        </td>
+                    </tr>
                    <tr>
                        <th scope="row" class="cf_cert_service"><label for="cf_cert_limit">본인확인 이용제한</label></th>
                        <td class="cf_cert_service">
@@ -1392,7 +1424,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                        <th scope="row"><label for="cf_add_script">추가 script, css</label></th>
                        <td>
                            <?php echo help('HTML의 &lt;/HEAD&gt; 태그위로 추가될 JavaScript와 css 코드를 설정합니다.<br>관리자 페이지에서는 이 코드를 사용하지 않습니다.') ?>
-                            <textarea name="cf_add_script" id="cf_add_script"><?php echo get_text($copy_config['cf_add_script']); ?></textarea>
+                            <textarea name="cf_add_script" id="cf_add_script"><?php echo get_text($config['cf_add_script']); ?></textarea>
                        </td>
                    </tr>
                </tbody>
@@ -1652,16 +1684,19 @@ if ($config['cf_cert_use']) {

    // kcp일 때
    if ($config['cf_cert_hp'] == 'kcp') {
+        
+        $bin_path = ((int)$config['cf_cert_use'] === 2 && !$config['cf_cert_kcp_enckey']) ? 'bin_old' : 'bin';
+        
        if (strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
            if (PHP_INT_MAX == 2147483647) { // 32-bit
-                $exe = G5_KCPCERT_PATH . '/bin/ct_cli';
+                $exe = G5_KCPCERT_PATH . '/'.$bin_path.'/ct_cli';
            } else {
-                $exe = G5_KCPCERT_PATH . '/bin/ct_cli_x64';
+                $exe = G5_KCPCERT_PATH . '/'.$bin_path.'/ct_cli_x64';
            }
        } else {
-            $exe = G5_KCPCERT_PATH . '/bin/ct_cli_exe.exe';
+            $exe = G5_KCPCERT_PATH . '/'.$bin_path.'/ct_cli_exe.exe';
        }
-
+        
        echo module_exec_check($exe, 'ct_cli');
    }

@@ -12,7 +12,6 @@ if ($is_admin != 'super') {

 $cf_title = isset($_POST['cf_title']) ? strip_tags(clean_xss_attributes($_POST['cf_title'])) : '';
 $cf_admin = isset($_POST['cf_admin']) ? clean_xss_tags($_POST['cf_admin'], 1, 1) : '';
-$posts = array();

 $mb = get_member($cf_admin);

@@ -24,15 +23,15 @@ check_admin_token();

 $cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',', $_POST['cf_social_servicelist']) : '';

-$check_keys = array('cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret', 'cf_cert_kg_cd', 'cf_cert_kg_mid');
+$check_keys = array('cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_cert_kcp_enckey', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret', 'cf_cert_kg_cd', 'cf_cert_kg_mid');

 foreach ($check_keys as $key) {
    if (isset($_POST[$key]) && $_POST[$key]) {
-        $posts[$key] = $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
+        $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
    }
 }

-$posts['cf_icode_server_port'] = $_POST['cf_icode_server_port'] = isset($_POST['cf_icode_server_port']) ? preg_replace('/[^0-9]/', '', $_POST['cf_icode_server_port']) : '7295';
+$_POST['cf_icode_server_port'] = isset($_POST['cf_icode_server_port']) ? preg_replace('/[^0-9]/', '', $_POST['cf_icode_server_port']) : '7295';

 if (isset($_POST['cf_intercept_ip']) && $_POST['cf_intercept_ip']) {
    $pattern = explode("\n", trim($_POST['cf_intercept_ip']));
@@ -105,6 +104,7 @@ $check_keys = array(
    'cf_cert_ipin' => 'char',
    'cf_cert_hp' => 'char',
    'cf_cert_simple' => 'char',
+    'cf_cert_use_seed' => 'int',
    'cf_admin_email' => 'char',
    'cf_admin_email_name' => 'char',
    'cf_add_script' => 'text',
@@ -164,12 +164,12 @@ for ($i = 1; $i <= 10; $i++) {

 foreach ($check_keys as $k => $v) {
    if ($v === 'int') {
-        $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? (int) $_POST[$k] : 0;
+        $_POST[$k] = isset($_POST[$k]) ? (int) $_POST[$k] : 0;
    } else {
        if (in_array($k, array('cf_analytics', 'cf_add_meta', 'cf_add_script', 'cf_stipulation', 'cf_privacy'))) {
-            $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? $_POST[$k] : '';
+            $_POST[$k] = isset($_POST[$k]) ? $_POST[$k] : '';
        } else {
-            $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? strip_tags(clean_xss_attributes($_POST[$k])) : '';
+            $_POST[$k] = isset($_POST[$k]) ? strip_tags(clean_xss_attributes($_POST[$k])) : '';
        }
    }
 }
@@ -180,9 +180,9 @@ if ($_POST['cf_cert_use'] && !$_POST['cf_cert_ipin'] && !$_POST['cf_cert_hp'] &&
 }

 if (!$_POST['cf_cert_use']) {
-    $posts[$key] = $_POST['cf_cert_ipin'] = '';
-    $posts[$key] = $_POST['cf_cert_hp'] = '';
-    $posts[$key] = $_POST['cf_cert_simple'] = '';
+    $_POST['cf_cert_ipin'] = '';
+    $_POST['cf_cert_hp'] = '';
+   $_POST['cf_cert_simple'] = '';
 }

 $sql = " update {$g5['config_table']}
@@ -284,10 +284,12 @@ $sql = " update {$g5['config_table']}
                cf_cert_ipin = '{$_POST['cf_cert_ipin']}',
                cf_cert_hp = '{$_POST['cf_cert_hp']}',
                cf_cert_simple = '{$_POST['cf_cert_simple']}',
+                cf_cert_use_seed = '".(int)$_POST['cf_cert_use_seed']."',
                cf_cert_kg_cd = '{$_POST['cf_cert_kg_cd']}',
                cf_cert_kg_mid = '" . trim($_POST['cf_cert_kg_mid']) . "',
                cf_cert_kcb_cd = '{$_POST['cf_cert_kcb_cd']}',
                cf_cert_kcp_cd = '{$_POST['cf_cert_kcp_cd']}',
+                cf_cert_kcp_enckey = '{$_POST['cf_cert_kcp_enckey']}',
                cf_cert_limit = '{$_POST['cf_cert_limit']}',
                cf_cert_req = '{$_POST['cf_cert_req']}',
                cf_sms_use = '{$_POST['cf_sms_use']}',
@@ -57,6 +57,9 @@ if ($w == "u") {
    if (!$co['co_id']) {
        alert('등록된 자료가 없습니다.');
    }
+
+    if (function_exists('check_case_exist_title')) check_case_exist_title($co, G5_CONTENT_DIR, false);
+
 } else {
    $html_title .= ' 입력';
    $co = array(
@@ -113,17 +113,20 @@ if ($w == "") {
                set co_id = '$co_id',
                    $sql_common ";
    sql_query($sql);
+    run_event('admin_content_created', $co_id);
 } elseif ($w == "u") {
    $sql = " update {$g5['content_table']}
                set $sql_common
              where co_id = '$co_id' ";
    sql_query($sql);
+    run_event('admin_content_updated', $co_id);
 } elseif ($w == "d") {
    @unlink(G5_DATA_PATH . "/content/{$co_id}_h");
    @unlink(G5_DATA_PATH . "/content/{$co_id}_t");

    $sql = " delete from {$g5['content_table']} where co_id = '$co_id' ";
    sql_query($sql);
+    run_event('admin_content_deleted', $co_id);
 }

 if (function_exists('get_admin_captcha_by')) {
@@ -624,6 +624,7 @@ a.lg_btn{display:inline-block;margin:5px 0 0;padding:5px 10px;background:#ED008C
 a.kg_btn{display:inline-block;margin:5px 0 0;padding:5px 10px;background:#4A2C7C;color:#fff;font-weight:normal;text-decoration:none}
 a.kakao_btn{display:inline-block;margin:5px 0 0;padding:5px 10px;background:#FDDC2F;color:#3B1E1E;font-weight:normal;text-decoration:none}
 a.naver_btn {display:inline-block;margin:5px 0 0;padding:5px 10px;background:#00C73C;color:#fff;font-weight:normal;text-decoration:none}
+a.nicepay_btn{display:inline-block;margin:5px 0 0;padding:5px 10px;background:#0057bf;color:#fff;font-weight:normal;text-decoration:none}

 .scf_cardtest {margin:5px 0 0}
 .scf_cardtest_btn {margin-left:5px;vertical-align:middle}
@@ -666,6 +667,7 @@ ul.de_pg_tab li.tab-current a{background:#2CC185;color:#fff}
 .inicis_info_fld th{background-color:#F6F1FF}
 .kakao_info_fld th{background-color:#FFFCED}
 .naver_info_fld th{background-color:#F3FFF3}
+.nicepay_info_fld th{background-color:#d1e6ff}

 /* 주문내역 */
 #sodr_list td {text-align:center}
@@ -205,6 +205,68 @@ if (defined('G5_USE_SHOP') && G5_USE_SHOP) {
            break;
        }
    }
+
+    if (!isset($default['de_id'])) {
+        sql_query(" ALTER TABLE `{$g5['g5_shop_default_table']}`
+                        ADD COLUMN `de_id` INT(11) NOT NULL AUTO_INCREMENT FIRST,
+                        ADD PRIMARY KEY (`de_id`); ", true);
+
+        $is_check = true;
+    }
+}
+
+// auth.au_menu 컬럼 크기 조정
+$sql = " SHOW COLUMNS FROM `{$g5['auth_table']}` LIKE 'au_menu' ";
+$row = sql_fetch($sql);
+if (
+    stripos($row['Type'], 'varchar') !== false
+    && (int) preg_replace('/[^0-9]/', '', $row['Type']) < 50
+) {
+    sql_query(" ALTER TABLE `{$g5['auth_table']}` CHANGE `au_menu` `au_menu` VARCHAR(50) NOT NULL; ", true);
+
+    $is_check = true;
+}
+
+// qa config 테이블 auto id key 추가
+$row = sql_fetch("select * from `{$g5['qa_config_table']}` limit 1");
+if (!isset($row['qa_id'])) {
+    sql_query(" ALTER TABLE `{$g5['qa_config_table']}` ADD COLUMN `qa_id` INT(11) NOT NULL AUTO_INCREMENT FIRST,
+                ADD PRIMARY KEY (`qa_id`); ", true);
+
+    $is_check = true;
+}
+
+// config 기본 테이블 auto id key 추가
+if (!isset($config['cf_id'])) {
+    sql_query(" ALTER TABLE `{$g5['config_table']}`
+                    ADD COLUMN `cf_id` INT(11) NOT NULL AUTO_INCREMENT FIRST,
+                    ADD PRIMARY KEY (`cf_id`); ", true);
+
+	$is_check = true;
+}
+
+// login 테이블 auto id key 추가
+$row = sql_fetch("select * from `{$g5['login_table']}` limit 1");
+if (!isset($row['lo_id'])) {
+    sql_query(" ALTER TABLE `{$g5['login_table']}`
+                    ADD COLUMN `lo_id` INT(11) NOT NULL AUTO_INCREMENT FIRST,
+                    DROP PRIMARY KEY,
+                    ADD PRIMARY KEY (`lo_id`),
+                    ADD UNIQUE KEY `lo_ip_unique` (`lo_ip`) ", true);
+
+	$is_check = true;
+}
+
+// visit 테이블 auto id key 로 변경
+$result = sql_query("describe `{$g5['visit_table']}`");
+while ($row = sql_fetch_array($result)){
+    if (isset($row['Field']) && $row['Field'] === 'vi_id' && (isset($row['Default']) && $row['Default'] == 0)){
+        sql_query("ALTER TABLE `{$g5['visit_table']}`
+                    CHANGE COLUMN `vi_id` `vi_id` INT(11) NOT NULL AUTO_INCREMENT;
+        ", false);
+
+        $is_check = true;
+    }
 }

 $is_check = run_replace('admin_dbupgrade', $is_check);
@@ -30,6 +30,7 @@ if ($w == "")
    sql_query($sql);

    $fa_id = sql_insert_id();
+    run_event('admin_faq_item_created', $fa_id, $fm_id);
 }
 else if ($w == "u")
 {
@@ -37,11 +38,14 @@ else if ($w == "u")
                set $sql_common
              where fa_id = '$fa_id' ";
    sql_query($sql);
+    run_event('admin_faq_item_updated', $fa_id, $fm_id);
+
 }
 else if ($w == "d")
 {
 	$sql = " delete from {$g5['faq_table']} where fa_id = '$fa_id' ";
    sql_query($sql);
+    run_event('admin_faq_item_deleted', $fa_id, $fm_id);
 }

 if ($w == 'd')
@@ -49,9 +49,13 @@ if ($w == "") {
    sql_query($sql);

    $fm_id = sql_insert_id();
+    run_event('admin_faq_master_created', $fm_id);
+
 } elseif ($w == "u") {
    $sql = " update {$g5['faq_master_table']} $sql_common where fm_id = '$fm_id' ";
    sql_query($sql);
+    run_event('admin_faq_master_updated', $fm_id);
+
 } elseif ($w == "d") {
    @unlink(G5_DATA_PATH . "/faq/{$fm_id}_h");
    @unlink(G5_DATA_PATH . "/faq/{$fm_id}_t");
@@ -63,6 +67,8 @@ if ($w == "") {
    // FAQ상세삭제
    $sql = " delete from {$g5['faq_table']} where fm_id = '$fm_id' ";
    sql_query($sql);
+
+    run_event('admin_faq_master_deleted', $fm_id);
 }

 if ($w == "" || $w == "u") {
@@ -3,8 +3,10 @@ $sub_menu = '100000';
 require_once './_common.php';

@require_once './safe_check.php';
+
 if (function_exists('social_log_file_delete')) {
-    social_log_file_delete(86400);      //소셜로그인 디버그 파일 24시간 지난것은 삭제
+    //소셜로그인 디버그 파일 24시간 지난것은 삭제
+    social_log_file_delete(86400);
 }

 $g5['title'] = '관리자메인';
@@ -14,304 +16,323 @@ $new_member_rows = 5;
 $new_point_rows = 5;
 $new_write_rows = 5;

-$sql_common = " from {$g5['member_table']} ";
-
-$sql_search = " where (1) ";
-
-if ($is_admin != 'super') {
-    $sql_search .= " and mb_level <= '{$member['mb_level']}' ";
+$addtional_content_before = run_replace('adm_index_addtional_content_before', '', $is_admin, $auth, $member);
+if ($addtional_content_before) {
+    echo $addtional_content_before;
 }

-if (!$sst) {
-    $sst = "mb_datetime";
-    $sod = "desc";
-}
+if (!auth_check_menu($auth, '200100', 'r', true)) {
+    $sql_common = " from {$g5['member_table']} ";

-$sql_order = " order by {$sst} {$sod} ";
+    $sql_search = " where (1) ";

-$sql = " select count(*) as cnt {$sql_common} {$sql_search} {$sql_order} ";
-$row = sql_fetch($sql);
-$total_count = $row['cnt'];
-
-// 탈퇴회원수
-$sql = " select count(*) as cnt {$sql_common} {$sql_search} and mb_leave_date <> '' {$sql_order} ";
-$row = sql_fetch($sql);
-$leave_count = $row['cnt'];
-
-// 차단회원수
-$sql = " select count(*) as cnt {$sql_common} {$sql_search} and mb_intercept_date <> '' {$sql_order} ";
-$row = sql_fetch($sql);
-$intercept_count = $row['cnt'];
-
-$sql = " select * {$sql_common} {$sql_search} {$sql_order} limit {$new_member_rows} ";
-$result = sql_query($sql);
-
-$colspan = 12;
-?>
-
-<section>
-    <h2>신규가입회원 <?php echo $new_member_rows ?>건 목록</h2>
-    <div class="local_desc02 local_desc">
-        총회원수 <?php echo number_format($total_count) ?>명 중 차단 <?php echo number_format($intercept_count) ?>명, 탈퇴 : <?php echo number_format($leave_count) ?>명
-    </div>
-
-    <div class="tbl_head01 tbl_wrap">
-        <table>
-            <caption>신규가입회원</caption>
-            <thead>
-                <tr>
-                    <th scope="col">회원아이디</th>
-                    <th scope="col">이름</th>
-                    <th scope="col">닉네임</th>
-                    <th scope="col">권한</th>
-                    <th scope="col">포인트</th>
-                    <th scope="col">수신</th>
-                    <th scope="col">공개</th>
-                    <th scope="col">인증</th>
-                    <th scope="col">차단</th>
-                    <th scope="col">그룹</th>
-                </tr>
-            </thead>
-            <tbody>
-                <?php
-                for ($i = 0; $row = sql_fetch_array($result); $i++) {
-                    // 접근가능한 그룹수
-                    $sql2 = " select count(*) as cnt from {$g5['group_member_table']} where mb_id = '{$row['mb_id']}' ";
-                    $row2 = sql_fetch($sql2);
-                    $group = "";
-                    if ($row2['cnt']) {
-                        $group = '<a href="./boardgroupmember_form.php?mb_id=' . $row['mb_id'] . '">' . $row2['cnt'] . '</a>';
-                    }
-
-                    if ($is_admin == 'group') {
-                        $s_mod = '';
-                        $s_del = '';
-                    } else {
-                        $s_mod = '<a href="./member_form.php?$qstr&amp;w=u&amp;mb_id=' . $row['mb_id'] . '">수정</a>';
-                        $s_del = '<a href="./member_delete.php?' . $qstr . '&amp;w=d&amp;mb_id=' . $row['mb_id'] . '&amp;url=' . $_SERVER['SCRIPT_NAME'] . '" onclick="return delete_confirm(this);">삭제</a>';
-                    }
-                    $s_grp = '<a href="./boardgroupmember_form.php?mb_id=' . $row['mb_id'] . '">그룹</a>';
-
-                    $leave_date = $row['mb_leave_date'] ? $row['mb_leave_date'] : date("Ymd", G5_SERVER_TIME);
-                    $intercept_date = $row['mb_intercept_date'] ? $row['mb_intercept_date'] : date("Ymd", G5_SERVER_TIME);
-
-                    $mb_nick = get_sideview($row['mb_id'], get_text($row['mb_nick']), $row['mb_email'], $row['mb_homepage']);
-
-                    $mb_id = $row['mb_id'];
-                ?>
-                    <tr>
-                        <td class="td_mbid"><?php echo $mb_id ?></td>
-                        <td class="td_mbname"><?php echo get_text($row['mb_name']); ?></td>
-                        <td class="td_mbname sv_use">
-                            <div><?php echo $mb_nick ?></div>
-                        </td>
-                        <td class="td_num"><?php echo $row['mb_level'] ?></td>
-                        <td><a href="./point_list.php?sfl=mb_id&amp;stx=<?php echo $row['mb_id'] ?>"><?php echo number_format($row['mb_point']) ?></a></td>
-                        <td class="td_boolean"><?php echo $row['mb_mailling'] ? '예' : '아니오'; ?></td>
-                        <td class="td_boolean"><?php echo $row['mb_open'] ? '예' : '아니오'; ?></td>
-                        <td class="td_boolean"><?php echo preg_match('/[1-9]/', $row['mb_email_certify']) ? '예' : '아니오'; ?></td>
-                        <td class="td_boolean"><?php echo $row['mb_intercept_date'] ? '예' : '아니오'; ?></td>
-                        <td class="td_category"><?php echo $group ?></td>
-                    </tr>
-                <?php
-                }
-                if ($i == 0) {
-                    echo '<tr><td colspan="' . $colspan . '" class="empty_table">자료가 없습니다.</td></tr>';
-                }
-                ?>
-            </tbody>
-        </table>
-    </div>
-
-    <div class="btn_list03 btn_list">
-        <a href="./member_list.php">회원 전체보기</a>
-    </div>
-
-</section>
-
-<?php
-$sql_common = " from {$g5['board_new_table']} a, {$g5['board_table']} b, {$g5['group_table']} c where a.bo_table = b.bo_table and b.gr_id = c.gr_id ";
-
-if ($gr_id) {
-    $sql_common .= " and b.gr_id = '$gr_id' ";
-}
-if (isset($view) && $view) {
-    if ($view == 'w') {
-        $sql_common .= " and a.wr_id = a.wr_parent ";
-    } elseif ($view == 'c') {
-        $sql_common .= " and a.wr_id <> a.wr_parent ";
+    if ($is_admin != 'super') {
+        $sql_search .= " and mb_level <= '{$member['mb_level']}' ";
    }
-}
-$sql_order = " order by a.bn_id desc ";

-$sql = " select count(*) as cnt {$sql_common} ";
-$row = sql_fetch($sql);
-$total_count = $row['cnt'];
+    if (!$sst) {
+        $sst = "mb_datetime";
+        $sod = "desc";
+    }

-$colspan = 5;
-?>
+    $sql_order = " order by {$sst} {$sod} ";

-<section>
-    <h2>최근게시물</h2>
+    $sql = " SELECT count(*) as cnt {$sql_common} {$sql_search} {$sql_order} ";
+    $row = sql_fetch($sql);
+    $total_count = $row['cnt'];

-    <div class="tbl_head01 tbl_wrap">
-        <table>
-            <caption>최근게시물</caption>
-            <thead>
-                <tr>
-                    <th scope="col">그룹</th>
-                    <th scope="col">게시판</th>
-                    <th scope="col">제목</th>
-                    <th scope="col">이름</th>
-                    <th scope="col">일시</th>
-                </tr>
-            </thead>
-            <tbody>
-                <?php
-                $sql = " select a.*, b.bo_subject, c.gr_subject, c.gr_id {$sql_common} {$sql_order} limit {$new_write_rows} ";
-                $result = sql_query($sql);
-                for ($i = 0; $row = sql_fetch_array($result); $i++) {
-                    $tmp_write_table = $g5['write_prefix'] . $row['bo_table'];
+    // 탈퇴회원수
+    $sql = " select count(*) as cnt {$sql_common} {$sql_search} and mb_leave_date <> '' {$sql_order} ";
+    $row = sql_fetch($sql);
+    $leave_count = $row['cnt'];

-                     // 원글
-                    if ($row['wr_id'] == $row['wr_parent']) {
-                        $comment = "";
-                        $comment_link = "";
-                        $row2 = sql_fetch(" select * from $tmp_write_table where wr_id = '{$row['wr_id']}' ");
+    // 차단회원수
+    $sql = " SELECT count(*) as cnt {$sql_common} {$sql_search} and mb_intercept_date <> '' {$sql_order} ";
+    $row = sql_fetch($sql);
+    $intercept_count = $row['cnt'];

-                        $name = get_sideview($row2['mb_id'], get_text(cut_str($row2['wr_name'], $config['cf_cut_name'])), $row2['wr_email'], $row2['wr_homepage']);
-                        // 당일인 경우 시간으로 표시함
-                        $datetime = substr($row2['wr_datetime'], 0, 10);
-                        $datetime2 = $row2['wr_datetime'];
-                        if ($datetime == G5_TIME_YMD) {
-                            $datetime2 = substr($datetime2, 11, 5);
-                        } else {
-                            $datetime2 = substr($datetime2, 5, 5);
-                        }
-                    } else // 코멘트
-                    {
-                        $comment = '댓글. ';
-                        $comment_link = '#c_' . $row['wr_id'];
-                        $row2 = sql_fetch(" select * from {$tmp_write_table} where wr_id = '{$row['wr_parent']}' ");
-                        $row3 = sql_fetch(" select mb_id, wr_name, wr_email, wr_homepage, wr_datetime from {$tmp_write_table} where wr_id = '{$row['wr_id']}' ");
+    $sql = " SELECT * {$sql_common} {$sql_search} {$sql_order} limit {$new_member_rows} ";
+    $result = sql_query($sql);

-                        $name = get_sideview($row3['mb_id'], get_text(cut_str($row3['wr_name'], $config['cf_cut_name'])), $row3['wr_email'], $row3['wr_homepage']);
-                        // 당일인 경우 시간으로 표시함
-                        $datetime = substr($row3['wr_datetime'], 0, 10);
-                        $datetime2 = $row3['wr_datetime'];
-                        if ($datetime == G5_TIME_YMD) {
-                            $datetime2 = substr($datetime2, 11, 5);
-                        } else {
-                            $datetime2 = substr($datetime2, 5, 5);
-                        }
-                    }
-                ?>
+    $colspan = 12;
+    ?>

+    <section>
+        <h2>신규가입회원 <?php echo $new_member_rows ?>건 목록</h2>
+        <div class="local_desc02 local_desc">
+            총회원수 <?php echo number_format($total_count) ?>명 중 차단 <?php echo number_format($intercept_count) ?>명, 탈퇴 : <?php echo number_format($leave_count) ?>명
+        </div>
+
+        <div class="tbl_head01 tbl_wrap">
+            <table>
+                <caption>신규가입회원</caption>
+                <thead>
                    <tr>
-                        <td class="td_category"><a href="<?php echo G5_BBS_URL ?>/new.php?gr_id=<?php echo $row['gr_id'] ?>"><?php echo cut_str($row['gr_subject'], 10) ?></a></td>
-                        <td class="td_category"><a href="<?php echo get_pretty_url($row['bo_table']) ?>"><?php echo cut_str($row['bo_subject'], 20) ?></a></td>
-                        <td><a href="<?php echo get_pretty_url($row['bo_table'], $row2['wr_id']); ?><?php echo $comment_link ?>"><?php echo $comment ?><?php echo conv_subject($row2['wr_subject'], 100) ?></a></td>
-                        <td class="td_mbname">
-                            <div><?php echo $name ?></div>
-                        </td>
-                        <td class="td_datetime"><?php echo $datetime ?></td>
+                        <th scope="col">회원아이디</th>
+                        <th scope="col">이름</th>
+                        <th scope="col">닉네임</th>
+                        <th scope="col">권한</th>
+                        <th scope="col">포인트</th>
+                        <th scope="col">수신</th>
+                        <th scope="col">공개</th>
+                        <th scope="col">인증</th>
+                        <th scope="col">차단</th>
+                        <th scope="col">그룹</th>
                    </tr>
-
-                <?php
-                }
-                if ($i == 0) {
-                    echo '<tr><td colspan="' . $colspan . '" class="empty_table">자료가 없습니다.</td></tr>';
-                }
-                ?>
-            </tbody>
-        </table>
-    </div>
-
-    <div class="btn_list03 btn_list">
-        <a href="<?php echo G5_BBS_URL ?>/new.php">최근게시물 더보기</a>
-    </div>
-</section>
-
-<?php
-$sql_common = " from {$g5['point_table']} ";
-$sql_search = " where (1) ";
-$sql_order = " order by po_id desc ";
-
-$sql = " select count(*) as cnt {$sql_common} {$sql_search} {$sql_order} ";
-$row = sql_fetch($sql);
-$total_count = $row['cnt'];
-
-$sql = " select * {$sql_common} {$sql_search} {$sql_order} limit {$new_point_rows} ";
-$result = sql_query($sql);
-
-$colspan = 7;
-?>
-
-<section>
-    <h2>최근 포인트 발생내역</h2>
-    <div class="local_desc02 local_desc">
-        전체 <?php echo number_format($total_count) ?> 건 중 <?php echo $new_point_rows ?>건 목록
-    </div>
-
-    <div class="tbl_head01 tbl_wrap">
-        <table>
-            <caption>최근 포인트 발생내역</caption>
-            <thead>
-                <tr>
-                    <th scope="col">회원아이디</th>
-                    <th scope="col">이름</th>
-                    <th scope="col">닉네임</th>
-                    <th scope="col">일시</th>
-                    <th scope="col">포인트 내용</th>
-                    <th scope="col">포인트</th>
-                    <th scope="col">포인트합</th>
-                </tr>
-            </thead>
-            <tbody>
-                <?php
-                $row2['mb_id'] = '';
-                for ($i = 0; $row = sql_fetch_array($result); $i++) {
-                    if ($row2['mb_id'] != $row['mb_id']) {
-                        $sql2 = " select mb_id, mb_name, mb_nick, mb_email, mb_homepage, mb_point from {$g5['member_table']} where mb_id = '{$row['mb_id']}' ";
+                </thead>
+                <tbody>
+                    <?php
+                    for ($i = 0; $row = sql_fetch_array($result); $i++) {
+                        // 접근가능한 그룹수
+                        $sql2 = " SELECT count(*) as cnt from {$g5['group_member_table']} where mb_id = '{$row['mb_id']}' ";
                        $row2 = sql_fetch($sql2);
+                        $group = "";
+                        if ($row2['cnt']) {
+                            $group = '<a href="./boardgroupmember_form.php?mb_id=' . $row['mb_id'] . '">' . $row2['cnt'] . '</a>';
+                        }
+
+                        if ($is_admin == 'group') {
+                            $s_mod = '';
+                            $s_del = '';
+                        } else {
+                            $s_mod = '<a href="./member_form.php?$qstr&amp;w=u&amp;mb_id=' . $row['mb_id'] . '">수정</a>';
+                            $s_del = '<a href="./member_delete.php?' . $qstr . '&amp;w=d&amp;mb_id=' . $row['mb_id'] . '&amp;url=' . $_SERVER['SCRIPT_NAME'] . '" onclick="return delete_confirm(this);">삭제</a>';
+                        }
+                        $s_grp = '<a href="./boardgroupmember_form.php?mb_id=' . $row['mb_id'] . '">그룹</a>';
+
+                        $leave_date = $row['mb_leave_date'] ? $row['mb_leave_date'] : date("Ymd", G5_SERVER_TIME);
+                        $intercept_date = $row['mb_intercept_date'] ? $row['mb_intercept_date'] : date("Ymd", G5_SERVER_TIME);
+
+                        $mb_nick = get_sideview($row['mb_id'], get_text($row['mb_nick']), $row['mb_email'], $row['mb_homepage']);
+
+                        $mb_id = $row['mb_id'];
+                        ?>
+                        <tr>
+                            <td class="td_mbid"><?php echo $mb_id ?></td>
+                            <td class="td_mbname"><?php echo get_text($row['mb_name']); ?></td>
+                            <td class="td_mbname sv_use">
+                                <div><?php echo $mb_nick ?></div>
+                            </td>
+                            <td class="td_num"><?php echo $row['mb_level'] ?></td>
+                            <td><a href="./point_list.php?sfl=mb_id&amp;stx=<?php echo $row['mb_id'] ?>"><?php echo number_format($row['mb_point']) ?></a></td>
+                            <td class="td_boolean"><?php echo $row['mb_mailling'] ? '예' : '아니오'; ?></td>
+                            <td class="td_boolean"><?php echo $row['mb_open'] ? '예' : '아니오'; ?></td>
+                            <td class="td_boolean"><?php echo preg_match('/[1-9]/', $row['mb_email_certify']) ? '예' : '아니오'; ?></td>
+                            <td class="td_boolean"><?php echo $row['mb_intercept_date'] ? '예' : '아니오'; ?></td>
+                            <td class="td_category"><?php echo $group ?></td>
+                        </tr>
+                        <?php
                    }
-
-                    $mb_nick = get_sideview($row['mb_id'], $row2['mb_nick'], $row2['mb_email'], $row2['mb_homepage']);
-
-                    $link1 = $link2 = "";
-                    if (!preg_match("/^\@/", $row['po_rel_table']) && $row['po_rel_table']) {
-                        $link1 = '<a href="' . get_pretty_url($row['po_rel_table'], $row['po_rel_id']) . '" target="_blank">';
-                        $link2 = '</a>';
+                    if ($i == 0) {
+                        echo '<tr><td colspan="' . $colspan . '" class="empty_table">자료가 없습니다.</td></tr>';
                    }
-                ?>
+                    ?>
+                </tbody>
+            </table>
+        </div>

+        <div class="btn_list03 btn_list">
+            <a href="./member_list.php">회원 전체보기</a>
+        </div>
+    </section>
+
+    <?php
+} //endif 최신 회원
+
+if (!auth_check_menu($auth, '300100', 'r', true)) {
+
+    $sql_common = " from {$g5['board_new_table']} a, {$g5['board_table']} b, {$g5['group_table']} c where a.bo_table = b.bo_table and b.gr_id = c.gr_id ";
+
+    if ($gr_id) {
+        $sql_common .= " and b.gr_id = '{$gr_id}' ";
+    }
+    if (isset($view) && $view) {
+        if ($view == 'w') {
+            $sql_common .= " and a.wr_id = a.wr_parent ";
+        } elseif ($view == 'c') {
+            $sql_common .= " and a.wr_id <> a.wr_parent ";
+        }
+    }
+    $sql_order = " order by a.bn_id desc ";
+
+    $sql = " SELECT count(*) as cnt {$sql_common} ";
+    $row = sql_fetch($sql);
+    $total_count = $row['cnt'];
+
+    $colspan = 5;
+    ?>
+
+    <section>
+        <h2>최근게시물</h2>
+
+        <div class="tbl_head01 tbl_wrap">
+            <table>
+                <caption>최근게시물</caption>
+                <thead>
                    <tr>
-                        <td class="td_mbid"><a href="./point_list.php?sfl=mb_id&amp;stx=<?php echo $row['mb_id'] ?>"><?php echo $row['mb_id'] ?></a></td>
-                        <td class="td_mbname"><?php echo get_text($row2['mb_name']); ?></td>
-                        <td class="td_name sv_use">
-                            <div><?php echo $mb_nick ?></div>
-                        </td>
-                        <td class="td_datetime"><?php echo $row['po_datetime'] ?></td>
-                        <td><?php echo $link1 . $row['po_content'] . $link2 ?></td>
-                        <td class="td_numbig"><?php echo number_format($row['po_point']) ?></td>
-                        <td class="td_numbig"><?php echo number_format($row['po_mb_point']) ?></td>
+                        <th scope="col">그룹</th>
+                        <th scope="col">게시판</th>
+                        <th scope="col">제목</th>
+                        <th scope="col">이름</th>
+                        <th scope="col">일시</th>
                    </tr>
+                </thead>
+                <tbody>
+                    <?php
+                    $sql = " SELECT a.*, b.bo_subject, c.gr_subject, c.gr_id {$sql_common} {$sql_order} limit {$new_write_rows} ";
+                    $result = sql_query($sql);
+                    for ($i = 0; $row = sql_fetch_array($result); $i++) {
+                        $tmp_write_table = $g5['write_prefix'] . $row['bo_table'];

-                <?php
-                }
+                        if ($row['wr_id'] == $row['wr_parent']) {
+                            // 원글
+                            $comment = "";
+                            $comment_link = "";
+                            $row2 = sql_fetch(" SELECT * from {$tmp_write_table} where wr_id = '{$row['wr_id']}' ");

-                if ($i == 0) {
-                    echo '<tr><td colspan="' . $colspan . '" class="empty_table">자료가 없습니다.</td></tr>';
-                }
-                ?>
-            </tbody>
-        </table>
-    </div>
+                            $name = get_sideview($row2['mb_id'], get_text(cut_str($row2['wr_name'], $config['cf_cut_name'])), $row2['wr_email'], $row2['wr_homepage']);
+                            // 당일인 경우 시간으로 표시함
+                            $datetime = substr($row2['wr_datetime'], 0, 10);
+                            $datetime2 = $row2['wr_datetime'];
+                            if ($datetime == G5_TIME_YMD) {
+                                $datetime2 = substr($datetime2, 11, 5);
+                            } else {
+                                $datetime2 = substr($datetime2, 5, 5);
+                            }
+                        } else {
+                            // 코멘트
+                            $comment = '댓글. ';
+                            $comment_link = '#c_' . $row['wr_id'];
+                            $row2 = sql_fetch(" SELECT * from {$tmp_write_table} where wr_id = '{$row['wr_parent']}' ");
+                            $row3 = sql_fetch(" SELECT mb_id, wr_name, wr_email, wr_homepage, wr_datetime from {$tmp_write_table} where wr_id = '{$row['wr_id']}' ");

-    <div class="btn_list03 btn_list">
-        <a href="./point_list.php">포인트내역 전체보기</a>
-    </div>
-</section>
+                            $name = get_sideview($row3['mb_id'], get_text(cut_str($row3['wr_name'], $config['cf_cut_name'])), $row3['wr_email'], $row3['wr_homepage']);
+                            // 당일인 경우 시간으로 표시함
+                            $datetime = substr($row3['wr_datetime'], 0, 10);
+                            $datetime2 = $row3['wr_datetime'];
+                            if ($datetime == G5_TIME_YMD) {
+                                $datetime2 = substr($datetime2, 11, 5);
+                            } else {
+                                $datetime2 = substr($datetime2, 5, 5);
+                            }
+                        }
+                        ?>

-<?php
-require_once './admin.tail.php';
+                        <tr>
+                            <td class="td_category"><a href="<?php echo G5_BBS_URL ?>/new.php?gr_id=<?php echo $row['gr_id'] ?>"><?php echo cut_str($row['gr_subject'], 10) ?></a></td>
+                            <td class="td_category"><a href="<?php echo get_pretty_url($row['bo_table']) ?>"><?php echo cut_str($row['bo_subject'], 20) ?></a></td>
+                            <td><a href="<?php echo get_pretty_url($row['bo_table'], $row2['wr_id']); ?><?php echo $comment_link ?>"><?php echo $comment ?><?php echo conv_subject($row2['wr_subject'], 100) ?></a></td>
+                            <td class="td_mbname">
+                                <div><?php echo $name ?></div>
+                            </td>
+                            <td class="td_datetime"><?php echo $datetime ?></td>
+                        </tr>
+
+                        <?php
+                    }
+                    if ($i == 0) {
+                        echo '<tr><td colspan="' . $colspan . '" class="empty_table">자료가 없습니다.</td></tr>';
+                    }
+                    ?>
+                </tbody>
+            </table>
+        </div>
+
+        <div class="btn_list03 btn_list">
+            <a href="<?php echo G5_BBS_URL ?>/new.php">최근게시물 더보기</a>
+        </div>
+    </section>
+
+    <?php
+} //endif 최근게시물
+
+if (!auth_check_menu($auth, '200200', 'r', true)) {
+
+    $sql_common = " from {$g5['point_table']} ";
+    $sql_search = " where (1) ";
+    $sql_order = " order by po_id desc ";
+
+    $sql = " SELECT count(*) as cnt {$sql_common} {$sql_search} {$sql_order} ";
+    $row = sql_fetch($sql);
+    $total_count = $row['cnt'];
+
+    $sql = " SELECT * {$sql_common} {$sql_search} {$sql_order} limit {$new_point_rows} ";
+    $result = sql_query($sql);
+
+    $colspan = 7;
+    ?>
+
+    <section>
+        <h2>최근 포인트 발생내역</h2>
+        <div class="local_desc02 local_desc">
+            전체 <?php echo number_format($total_count) ?> 건 중 <?php echo $new_point_rows ?>건 목록
+        </div>
+
+        <div class="tbl_head01 tbl_wrap">
+            <table>
+                <caption>최근 포인트 발생내역</caption>
+                <thead>
+                    <tr>
+                        <th scope="col">회원아이디</th>
+                        <th scope="col">이름</th>
+                        <th scope="col">닉네임</th>
+                        <th scope="col">일시</th>
+                        <th scope="col">포인트 내용</th>
+                        <th scope="col">포인트</th>
+                        <th scope="col">포인트합</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    <?php
+                    $row2['mb_id'] = '';
+                    for ($i = 0; $row = sql_fetch_array($result); $i++) {
+                        if ($row2['mb_id'] != $row['mb_id']) {
+                            $sql2 = " SELECT mb_id, mb_name, mb_nick, mb_email, mb_homepage, mb_point from {$g5['member_table']} where mb_id = '{$row['mb_id']}' ";
+                            $row2 = sql_fetch($sql2);
+                        }
+
+                        $mb_nick = get_sideview($row['mb_id'], $row2['mb_nick'], $row2['mb_email'], $row2['mb_homepage']);
+
+                        $link1 = $link2 = "";
+                        if (!preg_match("/^\@/", $row['po_rel_table']) && $row['po_rel_table']) {
+                            $link1 = '<a href="' . get_pretty_url($row['po_rel_table'], $row['po_rel_id']) . '" target="_blank">';
+                            $link2 = '</a>';
+                        }
+                        ?>
+
+                        <tr>
+                            <td class="td_mbid"><a href="./point_list.php?sfl=mb_id&amp;stx=<?php echo $row['mb_id'] ?>"><?php echo $row['mb_id'] ?></a></td>
+                            <td class="td_mbname"><?php echo get_text($row2['mb_name']); ?></td>
+                            <td class="td_name sv_use">
+                                <div><?php echo $mb_nick ?></div>
+                            </td>
+                            <td class="td_datetime"><?php echo $row['po_datetime'] ?></td>
+                            <td><?php echo $link1 . $row['po_content'] . $link2 ?></td>
+                            <td class="td_numbig"><?php echo number_format($row['po_point']) ?></td>
+                            <td class="td_numbig"><?php echo number_format($row['po_mb_point']) ?></td>
+                        </tr>
+
+                        <?php
+                    }
+
+                    if ($i == 0) {
+                        echo '<tr><td colspan="' . $colspan . '" class="empty_table">자료가 없습니다.</td></tr>';
+                    }
+                    ?>
+                </tbody>
+            </table>
+        </div>
+
+        <div class="btn_list03 btn_list">
+            <a href="./point_list.php">포인트내역 전체보기</a>
+        </div>
+    </section>
+
+    <?php
+} //endif
+
+$addtional_content_after = run_replace('adm_index_addtional_content_after', '', $is_admin, $auth, $member);
+if ($addtional_content_after) {
+    echo $addtional_content_after;
+}
+require_once './admin.tail.php';
@@ -19,6 +19,7 @@ for ($i = 0; $i < $post_count_chk; $i++) {

    $sql = " delete from {$g5['mail_table']} where ma_id = '$ma_id' ";
    sql_query($sql);
+    run_event('admin_mail_deleted', $ma_id);
 }

 goto_url('./mail_list.php');
@@ -21,6 +21,10 @@ if ($w == '') {
                     ma_time = '" . G5_TIME_YMDHIS . "',
                     ma_ip = '{$_SERVER['REMOTE_ADDR']}' ";
    sql_query($sql);
+
+    $ma_id = sql_insert_id();
+    run_event('admin_mail_created', $ma_id);
+
 } elseif ($w == 'u') {
    $sql = " update {$g5['mail_table']}
                set ma_subject = '{$ma_subject}',
@@ -29,9 +33,12 @@ if ($w == '') {
                     ma_ip = '{$_SERVER['REMOTE_ADDR']}'
                where ma_id = '{$ma_id}' ";
    sql_query($sql);
+    run_event('admin_mail_updated', $ma_id);
+
 } elseif ($w == 'd') {
    $sql = " delete from {$g5['mail_table']} where ma_id = '{$ma_id}' ";
    sql_query($sql);
+    run_event('admin_mail_deleted', $ma_id);
 }

 goto_url('./mail_list.php');
@@ -205,7 +205,7 @@ if (isset($mb_id) && $mb_id) {
 if ($mb['mb_intercept_date']) {
    $g5['title'] = "차단된 ";
 } else {
-    $g5['title'] .= "";
+    $g5['title'] = "";
 }
 $g5['title'] .= '회원 ' . $html_title;
 require_once './admin.head.php';
@@ -455,7 +455,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                <?php if ($config['cf_use_recommend']) { // 추천인 사용 ?>
                    <tr>
                        <th scope="row">추천인</th>
-                        <td colspan="3"><?php echo ($mb['mb_recommend'] ? get_text($mb['mb_recommend']) : '없음'); // 081022 : CSRF 보안 결함으로 인한 코드 수정 ?></td>
+                        <td colspan="3"><?php echo ((isset($mb['mb_recommend']) && $mb['mb_recommend']) ? get_text($mb['mb_recommend']) : '없음'); // 081022 : CSRF 보안 결함으로 인한 코드 수정 ?></td>
                    </tr>
                <?php } ?>

@@ -59,14 +59,16 @@ $sql_common = " nw_device = '{$posts['nw_device']}',
 if ($w == "") {
    $sql = " insert {$g5['new_win_table']} set $sql_common ";
    sql_query($sql);
-
    $nw_id = sql_insert_id();
+    run_event('admin_newwin_created', $nw_id);
 } elseif ($w == "u") {
    $sql = " update {$g5['new_win_table']} set $sql_common where nw_id = '$nw_id' ";
    sql_query($sql);
+    run_event('admin_newwin_updated', $nw_id);
 } elseif ($w == "d") {
    $sql = " delete from {$g5['new_win_table']} where nw_id = '$nw_id' ";
    sql_query($sql);
+    run_event('admin_newwin_deleted', $nw_id);
 }

 if ($w == "d") {
@@ -12,6 +12,7 @@ require_once './admin.head.php';
 if (!sql_query(" DESCRIBE `{$g5['qa_config_table']}` ", false)) {
    sql_query(
        " CREATE TABLE IF NOT EXISTS `{$g5['qa_config_table']}` (
+                  `qa_id` int(11) NOT NULL auto_increment,
                  `qa_title` varchar(255) NOT NULL DEFAULT'',
                  `qa_category` varchar(255) NOT NULL DEFAULT'',
                  `qa_skin` varchar(255) NOT NULL DEFAULT '',
@@ -46,7 +47,8 @@ if (!sql_query(" DESCRIBE `{$g5['qa_config_table']}` ", false)) {
                  `qa_2` varchar(255) NOT NULL DEFAULT '',
                  `qa_3` varchar(255) NOT NULL DEFAULT '',
                  `qa_4` varchar(255) NOT NULL DEFAULT '',
-                  `qa_5` varchar(255) NOT NULL DEFAULT ''
+                  `qa_5` varchar(255) NOT NULL DEFAULT '',
+                  PRIMARY KEY (`qa_id`)
                )",
        true
    );
@@ -108,6 +108,8 @@ $sql = " update {$g5['qa_config_table']}
                qa_5                    = '{$_POST['qa_5']}' ";
 sql_query($sql);

+run_event('admin_qa_config_updated');
+
 if (function_exists('get_admin_captcha_by')) {
    get_admin_captcha_by('remove');
 }
@@ -133,6 +133,8 @@ function pg_setting_check($is_print=false){
 			$pg_msg = 'LG유플러스';
 		} else if ( $default['de_pg_service'] === 'inicis' && $default['de_inicis_mid'] && $default['de_inicis_sign_key'] ){
 			$pg_msg = 'KG이니시스';
+		} else if ( $default['de_pg_service'] === 'nicepay' && $default['de_nicepay_mid'] && $default['de_nicepay_key'] ){
+			$pg_msg = 'NICEPAY';
 		}
 	}

@@ -156,6 +158,21 @@ function pg_setting_check($is_print=false){
 	}
 }

+function is_cancel_shop_pg_order($od){
+
+    $is_od_pg_cancel = false;
+
+    if (($od['od_settle_case'] == '신용카드' || $od['od_settle_case'] == '간편결제' || $od['od_settle_case'] == 'KAKAOPAY') || ($od['od_pg'] == 'inicis' && is_inicis_order_pay($od['od_settle_case']))) {
+        $is_od_pg_cancel = true;
+    }
+
+    if ($od['od_pg'] === 'nicepay' && in_array($od['od_settle_case'], array('계좌이체', '휴대폰'))) {
+        $is_od_pg_cancel = true;
+    }
+
+    return $is_od_pg_cancel;
+}
+
 function check_order_inicis_tmps(){
    global $g5, $config, $default, $member;

@@ -193,6 +193,7 @@ if ($w == "")
                    ca_name = '$ca_name',
                    $sql_common ";
    sql_query($sql);
+    run_event('shop_admin_category_created', $ca_id);
 }
 else if ($w == "u")
 {
@@ -212,6 +213,7 @@ else if ($w == "u")
            $sql .= " and ca_mb_id = '{$member['mb_id']}' ";
        sql_query($sql);
    }
+    run_event('shop_admin_category_updated', $ca_id);
 }
 else if ($w == "d")
 {
@@ -243,6 +245,7 @@ else if ($w == "d")
    // 분류 삭제
    $sql = " delete from {$g5['g5_shop_category_table']} where ca_id = '$ca_id' ";
    sql_query($sql);
+    run_event('shop_admin_category_deleted', $ca_id);
 }

 if(function_exists('get_admin_captcha_by'))
@@ -207,6 +207,14 @@ if( ! isset($default['de_inicis_iniapi_key']) ){
    sql_query($sql, false);
 }

+// NICEPAY mid, key 추가
+if (! isset($default['de_nicepay_mid'])) {
+    $sql = "ALTER TABLE `{$g5['g5_shop_default_table']}` 
+            ADD COLUMN `de_nicepay_mid` VARCHAR(20) NOT NULL DEFAULT '' AFTER `de_inicis_cartpoint_use`,
+            ADD COLUMN `de_nicepay_key` VARCHAR(150) NOT NULL DEFAULT '' AFTER `de_nicepay_mid`; ";
+    sql_query($sql, false);
+}
+
 if( function_exists('pg_setting_check') ){
    pg_setting_check(true);
 }
@@ -633,6 +641,12 @@ if(!$default['de_kakaopay_cancelpwd']){
                <?php echo help("KG이니시스 가상계좌 사용시 다음 주소를 <strong><a href=\"https://iniweb.inicis.com/\" target=\"_blank\">KG이니시스 관리자</a> &gt; 거래내역 &gt; 가상계좌 &gt; 입금통보방식선택 &gt; URL 수신 설정</strong>에 넣으셔야 상점에 자동으로 입금 통보됩니다."); ?>
                <?php echo G5_SHOP_URL; ?>/settle_inicis_common.php</td>
        </tr>
+        <tr id="nicepay_vbank_url" class="pg_vbank_url">
+            <th scope="row">NICEPAY 가상계좌 입금통보 URL</th>
+            <td>
+                <?php echo help("NICEPAY 가상계좌 사용시 다음 주소를 <strong><a href=\"https://npg.nicepay.co.kr/\" target=\"_blank\">NICEPAY 관리자</a> &gt; 가맹점관리자페이지 설정 (메인화면 → 가맹점정보 클릭)</strong>에 넣으셔야 상점에 자동으로 입금 통보됩니다."); ?>
+                <?php echo G5_SHOP_URL; ?>/settle_nicepay_common.php</td>
+        </tr>
        <tr>
            <th scope="row"><label for="de_hp_use">휴대폰결제사용</label></th>
            <td>
@@ -763,6 +777,7 @@ if(!$default['de_kakaopay_cancelpwd']){
                    <li class="<?php if($default['de_pg_service'] == 'kcp') echo 'tab-current'; ?>"><a href="#kcp_info_anchor" data-value="kcp" title="NHN KCP 선택하기" >NHN KCP</a></li>
                    <li class="<?php if($default['de_pg_service'] == 'lg') echo 'tab-current'; ?>"><a href="#lg_info_anchor" data-value="lg" title="토스페이먼츠 선택하기">토스페이먼츠</a></li>
                    <li class="<?php if($default['de_pg_service'] == 'inicis') echo 'tab-current'; ?>"><a href="#inicis_info_anchor" data-value="inicis" title="KG이니시스 선택하기">KG이니시스</a></li>
+                    <li class="<?php if($default['de_pg_service'] == 'nicepay') echo 'tab-current'; ?>"><a href="#nicepay_info_anchor" data-value="nicepay" title="NICEPAY 선택하기">NICEPAY</a></li>
                </ul>
            </td>
        </tr>
@@ -918,7 +933,7 @@ if(!$default['de_kakaopay_cancelpwd']){
        </tr>
        <tr class="kakao_info_fld">
            <th scope="row">
-                <label for="de_kakaopay_enckey">카카오페이 사용</label>
+                <label for="de_kakaopay_enckey">KG이니시스<br>카카오페이 사용</label>
            </th>
            <td>
                <?php echo help("체크시 카카오페이 (KG 이니시스)를 사용합니다. <br >KG 이니시스의 SIRK****** 아이디를 받은 상점만 해당됩니다.", 50); ?>
@@ -932,6 +947,38 @@ if(!$default['de_kakaopay_cancelpwd']){
                <input type="text" name="de_kakaopay_hashkey" value="<?php echo get_sanitize_input($default['de_kakaopay_hashkey']); ?>" id="de_kakaopay_hashkey" class="frm_input" size="20">
            </td>
        </tr>
+
+        <tr class="pg_info_fld nicepay_info_fld" id="nicepay_info_anchor">
+            <th scope="row"><label for="de_nicepay_mid">NICEPAY MID</label><br><a href="http://sir.kr/main/service/inicis_pg.php" target="_blank" id="scf_nicepay_reg" class="nicepay_btn">NICEPAY 신청하기</a></th>
+            <td>
+                <span class="frm_info">NICEPAY로 부터 발급 받으신 상점MID를 SR 을 제외한 나머지 자리를 입력 합니다.<br>NICEPAY 상점관리자 > 가맹점정보 > KEY관리에서 확인 할수 있습니다.<br>만약, 상점아이디가 SR로 시작하지 않는다면 계약담당자에게 변경 요청을 해주시기 바랍니다. 예) SRpaytestm</span>
+                <span class="sitecode">SR</span>
+                <input type="text" name="de_nicepay_mid" value="<?php echo get_sanitize_input($default['de_nicepay_mid']); ?>" id="de_nicepay_mid" class="frm_input" size="12" maxlength="12">
+                영문소문자(숫자포함 가능)
+            </td>
+        </tr>
+        <tr class="pg_info_fld nicepay_info_fld">
+            <th scope="row"><label for="de_nicepay_key">NICEPAY KEY</label></th>
+            <td>
+                <input type="text" name="de_nicepay_key" value="<?php echo get_sanitize_input($default['de_nicepay_key']); ?>" id="de_nicepay_key" class="frm_input" size="100" maxlength="100">
+            </td>
+        </tr>
+
+        <tr class="pg_info_fld nicepay_info_fld">
+            <th scope="row"><label for="de_nicepay_easy_pays">NICEPAY 간편결제</label></th>
+            <td>
+                <?php echo help("체크시 NICEPAY 간편결제들을 활성화 합니다.\nNICEPAY > 간편결제는 테스트결제가 되지 않습니다. 실결제에만 정상작동 합니다.\n애플페이는 IOS 기기에 모바일결제만 가능합니다."); ?>
+                <input type="checkbox" id="de_easy_nicepay_samsungpay" name="de_easy_pays[]" value="nicepay_samsungpay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_samsungpay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_samsungpay" disabled>삼성페이</label><br>
+                <input type="checkbox" id="de_easy_nicepay_naverpay" name="de_easy_pays[]" value="nicepay_naverpay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_naverpay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_naverpay">NAVERPAY (네이버페이)</label><br>
+                <input type="checkbox" id="de_easy_nicepay_kakaopay" name="de_easy_pays[]" value="nicepay_kakaopay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_kakaopay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_kakaopay">KAKAOPAY (카카오페이)</label><br>
+                <input type="checkbox" id="de_easy_nicepay_applepay" name="de_easy_pays[]" value="nicepay_applepay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_applepay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_applepay">APPLEPAY (애플페이)</label><br>
+                <input type="checkbox" id="de_easy_nicepay_paycopay" name="de_easy_pays[]" value="nicepay_paycopay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_paycopay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_paycopay">페이코</label><br>
+                <input type="checkbox" id="de_easy_nicepay_skpay" name="de_easy_pays[]" value="nicepay_skpay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_skpay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_skpay">SK페이</label><br>
+                <input type="checkbox" id="de_easy_nicepay_ssgpay" name="de_easy_pays[]" value="nicepay_ssgpay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_ssgpay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_ssgpay">SSG페이</label><br>
+                <input type="checkbox" id="de_easy_nicepay_lpay" name="de_easy_pays[]" value="nicepay_lpay" <?php if(stripos($default['de_easy_pay_services'], 'nicepay_lpay') !== false){ echo 'checked="checked"'; } ?> > <label for="de_easy_nicepay_lpay">LPAY</label>
+            </td>
+        </tr>
+
        <?php if (defined('G5_SHOP_DIRECT_NAVERPAY') && G5_SHOP_DIRECT_NAVERPAY) { ?>
        <tr class="naver_info_fld">
            <th scope="row">
@@ -1020,8 +1067,8 @@ if(!$default['de_kakaopay_cancelpwd']){
                    <a href="http://testadmin8.kcp.co.kr/" target="_blank" class="btn_frmline">테스트 관리자</a>
                </div>
                <div class="scf_cardtest lg_cardtest">
-                    <a href="https://pgweb.uplus.co.kr/" target="_blank" class="btn_frmline">실결제 관리자</a>
-                    <a href="https://pgweb.uplus.co.kr/tmert" target="_blank" class="btn_frmline">테스트 관리자</a>
+                    <a href="https://app.tosspayments.com/" target="_blank" class="btn_frmline">실결제 관리자</a>
+                    <a href="https://pgweb.tosspayments.com/tmert" target="_blank" class="btn_frmline">테스트 관리자</a>
                </div>
                <div class="scf_cardtest inicis_cardtest">
                    <a href="https://iniweb.inicis.com/" target="_blank" class="btn_frmline">상점 관리자</a>
@@ -1046,7 +1093,7 @@ if(!$default['de_kakaopay_cancelpwd']){
                        <li><b>일반결제</b>의 테스트 사이트코드는 <b>T0000</b> 이며, <b>에스크로 결제</b>의 테스트 사이트코드는 <b>T0007</b> 입니다.</li>
                    </ul>
                    <ul id="lg_cardtest_tip" class="scf_cardtest_tip_adm scf_cardtest_tip_adm_hide">
-                        <li>테스트결제의 <a href="http://pgweb.dacom.net:7085/" target="_blank">상점관리자</a> 로그인 정보는 토스페이먼츠 상점아이디 첫 글자에 t를 추가해서 로그인하시기 바랍니다. 예) tsi_lguplus</li>
+                        <li>테스트결제의 <a href="https://pgweb.tosspayments.com/tmert" target="_blank">상점관리자</a> 로그인 정보는 토스페이먼츠 상점아이디 첫 글자에 t를 추가해서 로그인하시기 바랍니다. 예) tsi_lguplus</li>
                    </ul>
                    <ul id="inicis_cardtest_tip" class="scf_cardtest_tip_adm scf_cardtest_tip_adm_hide">
                        <li><b>일반결제</b>의 테스트 사이트 mid는 <b>INIpayTest</b> 이며, <b>에스크로 결제</b>의 테스트 사이트 mid는 <b>iniescrow0</b> 입니다.</li>
@@ -1728,6 +1775,10 @@ function fconfig_check(f)
        if( f.de_inicis_mid.value && f.de_inicis_sign_key.value && parseInt(f.de_card_test.value) > 0 ){
            pg_msg = "KG이니시스";
        }
+    } else if ( f.de_pg_service.value == "nicepay" ) {
+        if( f.de_nicepay_mid.value && f.de_nicepay_key.value && parseInt(f.de_card_test.value) > 0 ){
+            pg_msg = "NICEPAY";
+        }
    }

    if( pg_msg ){
@@ -28,8 +28,8 @@ if ($_FILES['mobile_logo_img2']['name']) upload_file($_FILES['mobile_logo_img2']
 $de_kcp_mid = isset($_POST['de_kcp_mid']) ? substr($_POST['de_kcp_mid'], 0, 3) : '';
 $cf_icode_server_port = isset($cf_icode_server_port) ? preg_replace('/[^0-9]/', '', $cf_icode_server_port) : '7295';

-$de_shop_skin = isset($_POST['de_shop_skin']) ? preg_replace('#\.+(\/|\\\)#', '', $_POST['de_shop_skin']) : 'basic';
-$de_shop_mobile_skin = isset($_POST['de_shop_mobile_skin']) ? preg_replace('#\.+(\/|\\\)#', '', $_POST['de_shop_mobile_skin']) : 'basic';
+$de_shop_skin = isset($_POST['de_shop_skin']) ? preg_replace(array('#\.+(\/|\\\)#', '#[\'\"]#'), array('', ''), $_POST['de_shop_skin']) : 'basic';
+$de_shop_mobile_skin = isset($_POST['de_shop_mobile_skin']) ? preg_replace(array('#\.+(\/|\\\)#', '#[\'\"]#'), array('', ''), $_POST['de_shop_mobile_skin']) : 'basic';

 $skins = get_skin_dir('shop');

@@ -59,7 +59,7 @@ $de_shop_mobile_skin = in_array($de_shop_mobile_skin, $mobile_skins) ? $de_shop_
 $check_skin_keys = array('de_type1_list_skin', 'de_type2_list_skin', 'de_type3_list_skin', 'de_type4_list_skin', 'de_type5_list_skin', 'de_mobile_type1_list_skin', 'de_mobile_type2_list_skin', 'de_mobile_type3_list_skin', 'de_mobile_type4_list_skin', 'de_mobile_type5_list_skin', 'de_rel_list_skin', 'de_mobile_rel_list_skin', 'de_search_list_skin', 'de_mobile_search_list_skin', 'de_listtype_list_skin', 'de_mobile_listtype_list_skin');

 foreach($check_skin_keys as $key){
-    $$key = $_POST[$key] = isset($_POST[$key]) ? preg_replace('#\.+(\/|\\\)#', '', strip_tags($_POST[$key])) : '';
+    $$key = $_POST[$key] = isset($_POST[$key]) ? preg_replace(array('#\.+(\/|\\\)#', '#[\'\"]#'), array('', ''), strip_tags($_POST[$key])) : '';

    if( isset($_POST[$key]) && preg_match('#\.+(\/|\\\)#', $_POST[$key]) ){
        alert('스킨설정에 유효하지 문자가 포함되어 있습니다.');
@@ -167,6 +167,8 @@ $check_sanitize_keys = array(
 'de_inicis_lpay_use',           //KG이니시스 Lpay 사용
 'de_inicis_kakaopay_use',       //KG이니시스 카카오페이 사용
 'de_inicis_cartpoint_use',      //KG이니시스 신용카드 포인트 결제
+'de_nicepay_mid',               //NICEPAY 상점아이디
+'de_nicepay_key',               //NICEPAY 상점키
 'de_kakaopay_mid',              //카카오페이 상점MID
 'de_kakaopay_key',              //카카오페이 상점키
 'de_kakaopay_enckey',           //카카오페이 상점 EncKey
@@ -377,6 +379,8 @@ $sql = " update {$g5['g5_shop_default_table']}
                de_inicis_lpay_use            = '{$de_inicis_lpay_use}',
                de_inicis_kakaopay_use        = '{$de_inicis_kakaopay_use}',
                de_inicis_cartpoint_use       = '{$de_inicis_cartpoint_use}',
+                de_nicepay_mid                = '{$de_nicepay_mid}',
+                de_nicepay_key                = '{$de_nicepay_key}',
                de_card_noint_use             = '{$de_card_noint_use}',
                de_card_point                 = '{$de_card_point}',
                de_settle_min_point           = '{$de_settle_min_point}',
@@ -112,7 +112,7 @@ function get_max_value($arr)
    return array_pop($arr);
 }
 ?>
-
+<?php if (! auth_check_menu($auth, '400400', 'r', true)) { ?>
 <div class="sidx">
    <section id="anc_sidx_ord">
        <h2>주문현황</h2>
@@ -368,6 +368,66 @@ function get_max_value($arr)
    </div>
 </section>

+<script>
+jQuery(function($) {
+    graph_draw();
+
+    $("#sidx_graph_area div").hover(
+        function() {
+            if($(this).is(":animated"))
+                return false;
+
+            var title = $(this).attr("title");
+            if(title && $(this).data("title") == undefined)
+                $(this).data("title", title);
+            var left = parseInt($(this).css("left")) + 10;
+            var bottom = $(this).height() + 5;
+
+            $(this)
+                .attr("title", "")
+                .append("<div id=\"price_tooltip\"><div></div></div>");
+            $("#price_tooltip")
+                .find("div")
+                .html(title)
+                .end()
+//                .css({ left: left+"px", bottom: bottom+"px" })
+                .show(200);
+        },
+        function() {
+            if($(this).is(":animated"))
+                return false;
+
+            $(this).attr("title", $(this).data("title"));
+            $("#price_tooltip").remove();
+        }
+    );
+});
+
+function graph_draw()
+{
+    var g_h1 = new Array("<?php echo implode('", "', $h_val['order']); ?>");
+    var g_h2 = new Array("<?php echo implode('", "', $h_val['cancel']); ?>");
+    var duration = 600;
+
+    var $el = $("#sidx_graph_area li");
+    var h1, h2;
+    var $g1, $g2;
+
+    $el.each(function(index) {
+        h1 = g_h1[index];
+        h2 = g_h2[index];
+
+        $g1 = $(this).find(".order");
+        $g2 = $(this).find(".cancel");
+
+        $g1.animate({ height: h1+"px" }, duration);
+        $g2.animate({ height: h2+"px" }, duration);
+    });
+}
+</script>
+
+<?php } //endif ?>
+<?php if ($is_admin === 'super') { ?>
 <div class="sidx sidx_cs">
    <section id="anc_sidx_oneq">
        <h2>1:1문의</h2>
@@ -480,64 +540,6 @@ function get_max_value($arr)
        </div>
    </section>
 </div>
-
-<script>
-$(function() {
-    graph_draw();
-
-    $("#sidx_graph_area div").hover(
-        function() {
-            if($(this).is(":animated"))
-                return false;
-
-            var title = $(this).attr("title");
-            if(title && $(this).data("title") == undefined)
-                $(this).data("title", title);
-            var left = parseInt($(this).css("left")) + 10;
-            var bottom = $(this).height() + 5;
-
-            $(this)
-                .attr("title", "")
-                .append("<div id=\"price_tooltip\"><div></div></div>");
-            $("#price_tooltip")
-                .find("div")
-                .html(title)
-                .end()
-//                .css({ left: left+"px", bottom: bottom+"px" })
-                .show(200);
-        },
-        function() {
-            if($(this).is(":animated"))
-                return false;
-
-            $(this).attr("title", $(this).data("title"));
-            $("#price_tooltip").remove();
-        }
-    );
-});
-
-function graph_draw()
-{
-    var g_h1 = new Array("<?php echo implode('", "', $h_val['order']); ?>");
-    var g_h2 = new Array("<?php echo implode('", "', $h_val['cancel']); ?>");
-    var duration = 600;
-
-    var $el = $("#sidx_graph_area li");
-    var h1, h2;
-    var $g1, $g2;
-
-    $el.each(function(index) {
-        h1 = g_h1[index];
-        h2 = g_h2[index];
-
-        $g1 = $(this).find(".order");
-        $g2 = $(this).find(".cancel");
-
-        $g1.animate({ height: h1+"px" }, duration);
-        $g2.animate({ height: h2+"px" }, duration);
-    });
-}
-</script>
-
 <?php
+}   //end if
 include_once (G5_ADMIN_PATH.'/admin.tail.php');
@@ -53,6 +53,7 @@ $opt_sql = " insert ignore into {$g5['g5_shop_item_option_table']} ( io_id, io_t
 sql_query($opt_sql);

 // html 에디터로 첨부된 이미지 파일 복사
+$copied_editor_images = array();
 if($cp['it_explan']) {
    $matchs = get_editor_image($cp['it_explan'], false);
    $count_matchs = (isset($matchs[1]) && is_array($matchs[1])) ? count($matchs[1]) : 0;
@@ -73,7 +74,13 @@ if($cp['it_explan']) {

            $newfile = preg_replace("/\.([^\.]+)$/", "_".$new_it_id.".\\1", $matchs[1][$i]);
            $cp['it_explan'] = str_replace($matchs[1][$i], $newfile, $cp['it_explan']);
+
+            $copied_editor_images[] = array(
+                'original' => $srcfile,
+                'new' => $dstfile
+            );
        }
+        
    }

    $sql = " update {$g5['g5_shop_item_table']} set it_explan = '".addslashes($cp['it_explan'])."' where it_id = '$new_it_id' ";
@@ -100,6 +107,11 @@ if($cp['it_mobile_explan']) {

            $newfile = preg_replace("/\.([^\.]+)$/", "_".$new_it_id.".\\1", $matchs[1][$i]);
            $cp['it_mobile_explan'] = str_replace($matchs[1][$i], $newfile, $cp['it_mobile_explan']);
+
+            $copied_editor_images[] = array(
+                'original' => $srcfile,
+                'new' => $dstfile
+            );
        }
    }

@@ -140,6 +152,7 @@ function copy_directory($src_dir, $dest_dir)
 }

 // 파일복사
+$copied_item_files = array();
 $dest_path = G5_DATA_PATH.'/item/'.$new_it_id;
@mkdir($dest_path, G5_DIR_PERMISSION);
@chmod($dest_path, G5_DIR_PERMISSION);
@@ -155,6 +168,11 @@ for($i=1; $i<=10; $i++) {
        copy($file, $dstfile);
        @chmod($dstfile, G5_FILE_PERMISSION);
        $new_img = $new_it_id.'/'.basename($file);
+
+        $copied_item_files[] = array(
+            'original' => $file,
+            'new' => $dstfile,
+        );
    }

    $sql_img .= $comma." it_img{$i} = '$new_img' ";
@@ -166,6 +184,24 @@ $sql = " update {$g5['g5_shop_item_table']}
            where it_id = '$new_it_id' ";
 sql_query($sql);

+if( function_exists('shop_seo_title_update') ) shop_seo_title_update($new_it_id, true);
+
+/**
+ * 아이템 복사 처리 후 Event Hook
+ * @var string $it_id 원본 아이템 ID
+ * @var string $new_it_id 복사한 새로운 아이템 ID
+ * @var array $cp 복사한 아이템 정보
+ * @var array $copied_item_files 복사한 파일 목록
+ * @var array $copied_editor_images 복사한 에디터 이미지 목록
+ */
+run_event('shop_admin_itemcopy', array(
+    'it_id' => (string) $it_id,
+    'new_it_id' => (string) $new_it_id,
+    'cp' => $cp,
+    'copied_item_files' => $copied_item_files,
+    'copied_editor_images' => $copied_editor_images
+));
+
 $qstr = "ca_id=$ca_id&amp;sfl=$sfl&amp;sca=$sca&amp;page=$page&amp;stx=".urlencode($stx);

 goto_url("itemlist.php?$qstr");
@@ -41,8 +41,8 @@ if ($ev_mimg_del)  @unlink(G5_DATA_PATH."/event/{$ev_id}_m");
 if ($ev_himg_del)  @unlink(G5_DATA_PATH."/event/{$ev_id}_h");
 if ($ev_timg_del)  @unlink(G5_DATA_PATH."/event/{$ev_id}_t");

-$ev_skin = preg_replace('#\.+(\/|\\\)#', '', $ev_skin);
-$ev_mobile_skin = preg_replace('#\.+(\/|\\\)#', '', $ev_mobile_skin);
+$ev_skin = preg_replace(array('#\.+(\/|\\\)#', '#[\'\"]#'), array('', ''), $ev_skin);
+$ev_mobile_skin = preg_replace(array('#\.+(\/|\\\)#', '#[\'\"]#'), array('', ''), $ev_mobile_skin);

 $skin_regex_patten = "^list.[0-9]+\.skin\.php";

@@ -75,6 +75,7 @@ if ($w == "")
                    $sql_common
                  , ev_id = '$ev_id' ";
    sql_query($sql);
+    run_event('shop_admin_event_created', $ev_id);
 }
 else if ($w == "u")
 {
@@ -82,6 +83,7 @@ else if ($w == "u")
                $sql_common
              where ev_id = '$ev_id' ";
    sql_query($sql);
+    run_event('shop_admin_event_updated', $ev_id);
 }
 else if ($w == "d")
 {
@@ -92,6 +94,7 @@ else if ($w == "d")
    // 이벤트상품삭제
    $sql = " delete from {$g5['g5_shop_event_item_table']} where ev_id = '$ev_id' ";
    sql_query($sql);
+    run_event('shop_admin_event_deleted', $ev_id);

    $sql = " delete from {$g5['g5_shop_event_table']} where ev_id = '$ev_id' ";
    sql_query($sql);
@@ -112,6 +112,8 @@ else if ($w == "u")

    if(!$it)
        alert('상품정보가 존재하지 않습니다.');
+    
+    if (function_exists('check_case_exist_title')) check_case_exist_title($it, G5_SHOP_DIR, false);

    if (! (isset($ca_id) && $ca_id))
        $ca_id = $it['ca_id'];
@@ -285,8 +285,8 @@ if($supply_count) {
 $value_array = array();
 $count_ii_article = (isset($_POST['ii_article']) && is_array($_POST['ii_article'])) ? count($_POST['ii_article']) : 0;
 for($i=0; $i<$count_ii_article; $i++) {
-    $key = isset($_POST['ii_article'][$i]) ? strip_tags($_POST['ii_article'][$i], '<br><span><strong><b>') : '';
-    $val = isset($_POST['ii_value'][$i]) ? strip_tags($_POST['ii_value'][$i], '<br><span><strong><b>') : '';
+    $key = isset($_POST['ii_article'][$i]) ? html_purifier($_POST['ii_article'][$i]) : '';
+    $val = isset($_POST['ii_value'][$i]) ? html_purifier($_POST['ii_value'][$i]) : '';
    $value_array[$key] = $val;
 }
 $it_info_value = addslashes(serialize($value_array));
@@ -4,6 +4,10 @@ include_once('./_common.php');

 auth_check_menu($auth, $sub_menu, "r");

+if (isset($sfl) && $sfl && !in_array($sfl, array('it_name','it_id','it_maker','it_brand','it_model','it_origin','it_sell_email'))) {
+    $sfl = '';
+}
+
 $g5['title'] = '상품관리';
 include_once (G5_ADMIN_PATH.'/admin.head.php');

@@ -19,6 +19,7 @@ if ($w == "u")
                   iq_answer = '$iq_answer'
             where iq_id = '$iq_id' ";
    sql_query($sql);
+    run_event('shop_admin_item_qa_updated', $iq_id);

    if(trim($iq_answer)) {
        $sql = " select a.iq_email, a.iq_hp, b.it_name
@@ -4,6 +4,10 @@ include_once('./_common.php');

 auth_check_menu($auth, $sub_menu, "r");

+if (isset($sfl) && $sfl && !in_array($sfl, array('it_name','a.it_id'))) {
+    $sfl = '';
+}
+
 $g5['title'] = '상품문의';
 include_once (G5_ADMIN_PATH.'/admin.head.php');

@@ -23,6 +23,7 @@ if ($_POST['act_button'] == "선택삭제") {

        $sql = "delete from {$g5['g5_shop_item_qa_table']} where iq_id = '{$iiq_id}' ";
        sql_query($sql);
+        run_event('shop_admin_item_qa_deleted', $iiq_id);
    }
 }

@@ -35,7 +35,7 @@ $sql_common .= $sql_search;
 // 테이블의 전체 레코드수만 얻음
 $sql = " select count(*) as cnt " . $sql_common;
 $row = sql_fetch($sql);
-$total_count = $row['cnt'];
+$total_count = isset($row['cnt']) ? $row['cnt'] : 0;

 $rows = $config['cf_page_rows'];
 $total_page  = ceil($total_count / $rows);  // 전체 페이지 계산
@@ -159,7 +159,6 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
        $it_stock_qty_st = ''; // 스타일 정의
        if($row['it_stock_qty'] <= $row['it_noti_qty']) {
            $it_stock_qty_st = ' sit_stock_qty_alert';
-            $it_stock_qty = ''.$it_stock_qty.' !<span class="sound_only"> 재고부족 </span>';
        }

        $bg = 'bg'.($i%2);
@@ -171,7 +170,7 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
            <?php echo $row['it_id']; ?>
        </td>
        <td class="td_left"><a href="<?php echo $href; ?>"><?php echo get_it_image($row['it_id'], 50, 50); ?> <?php echo cut_str(stripslashes($row['it_name']), 60, "&#133"); ?></a></td>
-        <td class="td_num<?php echo $it_stock_qty_st; ?>"><?php echo (int)$it_stock_qty; ?></td>
+        <td class="td_num<?php echo $it_stock_qty_st; ?>"><?php echo $it_stock_qty; ?></td>
        <td class="td_num"><?php echo number_format((float)$wait_qty); ?></td>
        <td class="td_num"><?php echo number_format((float)$temporary_qty); ?></td>
        <td class="td_num">
@@ -34,6 +34,7 @@ if ($w == "u")
                   is_reply_name = '".$member['mb_nick']."'
             where is_id = '".$posts['is_id']."'";
    sql_query($sql);
+    run_event('shop_admin_item_use_updated', $posts['is_id']);

    if( isset($_POST['it_id']) ) {
        update_use_cnt($_POST['it_id']);
@@ -4,6 +4,10 @@ include_once('./_common.php');

 auth_check_menu($auth, $sub_menu, "r");

+if (isset($sfl) && $sfl && !in_array($sfl, array('it_name','a.it_id','is_name'))) {
+    $sfl = '';
+}
+
 $g5['title'] = '사용후기';
 include_once (G5_ADMIN_PATH.'/admin.head.php');

@@ -40,6 +40,7 @@ for ($i=0; $i<$count_post_chk; $i++)
    {
        $sql = "delete from {$g5['g5_shop_item_use_table']} where is_id = '{$iis_id}' ";
        sql_query($sql);
+        run_event('shop_admin_item_use_deleted', $iis_id);
    }
    
    if($iit_id){
@@ -107,6 +107,12 @@ if($od['od_pg'] == 'lg') {
    }
 }

+$print_od_deposit_name = $od['od_deposit_name'];
+// nicepay 로 주문하고 가상계좌인 경우
+if ($od['od_pg'] === 'nicepay' && $od['od_settle_case'] === '가상계좌' && $od['od_deposit_name']){
+    $print_od_deposit_name .= '_NICE';
+}
+
 // add_javascript('js 구문', 출력순서); 숫자가 작을 수록 먼저 출력됨
 add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
 ?>
@@ -408,7 +414,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                </tr>
                <tr>
                    <th scope="row">입금자</th>
-                    <td><?php echo get_text($od['od_deposit_name']); ?></td>
+                    <td><?php echo get_text($print_od_deposit_name); ?></td>
                </tr>
                <tr>
                    <th scope="row">입금확인일시</th>
@@ -504,10 +510,10 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                        if ($od['od_settle_case'] != '무통장') {
                            switch($od['od_pg']) {
                                case 'lg':
-                                    $pg_url  = 'http://pgweb.uplus.co.kr';
+                                    $pg_url  = 'https://app.tosspayments.com';
                                    $pg_test = '토스페이먼츠';
                                    if ($default['de_card_test']) {
-                                        $pg_url = 'http://pgweb.uplus.co.kr/tmert';
+                                        $pg_url = 'https://pgweb.tosspayments.com/tmert';
                                        $pg_test .= ' 테스트 ';
                                    }
                                    break;
@@ -519,6 +525,10 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                                    $pg_url  = 'https://mms.cnspay.co.kr';
                                    $pg_test = 'KAKAOPAY';
                                    break;
+                                case 'nicepay':
+                                    $pg_url  = 'https://npg.nicepay.co.kr/';
+                                    $pg_test = 'NICEPAY';
+                                    break;
                                default:
                                    $pg_url  = 'http://admin8.kcp.co.kr';
                                    $pg_test = 'KCP';
@@ -623,6 +633,18 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                        } else if($od['od_pg'] == 'inicis') {
                            $cash = unserialize($od['od_cash_info']);
                            $cash_receipt_script = 'window.open(\'https://iniweb.inicis.com/DefaultWebApp/mall/cr/cm/Cash_mCmReceipt.jsp?noTid='.$cash['TID'].'&clpaymethod=22\',\'showreceipt\',\'width=380,height=540,scrollbars=no,resizable=no\');';
+                        } else if($od['od_pg'] == 'nicepay') {
+                            
+                            $od_tid = $od['od_tno'];
+                            $cash_type = 0;
+
+                            if (! $od_tid) {
+                                $cash = unserialize($od['od_cash_info']);
+                                $od_tid = isset($cash['TID']) ? $cash['TID'] : '';
+                                $cash_type = $od_tid ? 1 : 0;
+                            }
+
+                            $cash_receipt_script = 'window.open(\'https://npg.nicepay.co.kr/issue/IssueLoader.do?type='.$cash_type.'&TID='.$od_tid.'&noMethod=1\',\'receipt\',\'width=430,height=700\');';
                        } else {
                            require G5_SHOP_PATH.'/settle_kcp.inc.php';

@@ -1075,7 +1097,7 @@ function form_submit(f)

    var msg = "";

-    <?php if($od['od_settle_case'] == '신용카드' || $od['od_settle_case'] == 'KAKAOPAY' || $od['od_settle_case'] == '간편결제' || ($od['od_pg'] == 'inicis' && is_inicis_order_pay($od['od_settle_case']) )) { ?>
+    <?php if (is_cancel_shop_pg_order($od)) { ?>
    if(status == "취소" || status == "반품" || status == "품절") {
        var $ct_chk = $("input[name^=ct_chk]");
        var chk_cnt = $ct_chk.length;
@@ -191,7 +191,7 @@ if (in_array($_POST['ct_status'], $status_cancel)) {
            $sql = " select * from {$g5['g5_shop_order_table']} where od_id = '$od_id' ";
            $od = sql_fetch($sql);

-            if($od['od_tno'] && ($od['od_settle_case'] == '신용카드' || $od['od_settle_case'] == '간편결제' || $od['od_settle_case'] == 'KAKAOPAY') || ($od['od_pg'] == 'inicis' && is_inicis_order_pay($od['od_settle_case']) )) {
+            if ($od['od_tno'] && is_cancel_shop_pg_order($od)) {
                switch($od['od_pg']) {
                    case 'lg':
                        include_once(G5_SHOP_PATH.'/settle_lg.inc.php');
@@ -243,6 +243,32 @@ if (in_array($_POST['ct_status'], $status_cancel)) {
                            $pg_res_msg = 'curl 로 데이터를 받지 못했습니다.';
                        }

+                        break;
+                    case 'nicepay':
+                        include_once(G5_SHOP_PATH.'/settle_nicepay.inc.php');
+                        $cancel_msg = '쇼핑몰 운영자 승인 취소';
+                        
+                        $tno = $od['od_tno'];
+                        
+                        $cancelAmt = $od['od_receipt_price'];
+
+                        // 0:전체 취소, 1:부분 취소(별도 계약 필요)
+                        $partialCancelCode = 0;
+
+
+                        include G5_SHOP_PATH.'/nicepay/cancel_process.php';
+
+                        if (isset($result['ResultCode'])) {
+                            // 실패했다면
+                            if ($result['ResultCode'] !== '2001') {
+                                $pg_res_cd = $result['ResultCode'];
+                                $pg_res_msg = $result['ResultMsg'];
+                            }
+                        } else {
+                            $pg_res_cd = '';
+                            $pg_res_msg = 'curl 로 데이터를 받지 못하거나 통신에 실패했습니다.';
+                        }
+
                        break;
                    case 'KAKAOPAY':
                        include_once(G5_SHOP_PATH.'/settle_kakaopay.inc.php');
@@ -296,7 +322,7 @@ if (in_array($_POST['ct_status'], $status_cancel)) {

                // PG 취소요청 성공했으면
                if($pg_res_cd == '') {
-                    $pg_cancel_log = ' PG 신용카드 승인취소 처리';
+                    $pg_cancel_log = ' PG '.$od['od_settle_case'].' 승인취소 처리';
                    $sql = " update {$g5['g5_shop_order_table']}
                                set od_refund_price = '{$od['od_receipt_price']}'
                                where od_id = '$od_id' ";
@@ -49,7 +49,7 @@ if ($csv == 'csv')
    $to_date = date_conv($to_date);


-    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, a.od_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
+    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
               FROM {$g5['g5_shop_order_table']} a, {$g5['g5_shop_cart_table']} b
              where a.od_id = b.od_id ";
    if ($case == 1) // 출력기간
@@ -65,7 +65,7 @@ if ($csv == 'csv')
        alert("출력할 내역이 없습니다.");

    //header('Content-Type: text/x-csv');
-    header("Content-charset=utf-8");
+    header("Content-Type: text/csv; charset=utf-8");
    header('Content-Type: doesn/matter');
    header('Expires: ' . gmdate('D, d M Y H:i:s') . ' GMT');
    header('Content-Disposition: attachment; filename="orderlist-' . date("ymd", time()) . '.csv"');
@@ -153,7 +153,7 @@ if ($csv == 'xls')
    $fr_date = date_conv($fr_date);
    $to_date = date_conv($to_date);

-    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, a.od_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
+    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
               FROM {$g5['g5_shop_order_table']} a, {$g5['g5_shop_cart_table']} b
              where a.od_id = b.od_id ";
    if ($case == 1) // 출력기간
@@ -44,6 +44,12 @@ if($popup == 'yes') { // 팝업창일 때
        $pp['pp_price'] = $od['od_misu'];
    $wrp_tag_st = '<div class="new_win">'.PHP_EOL.'<h1 id="new_win_title">'.$html_title.'</h1>';
    $wrp_tag_end = '</div>';
+
+    echo '<script>
+        if (typeof g5_admin_csrf_token_key === "undefined") {
+            var g5_admin_csrf_token_key = "' . (function_exists('admin_csrf_token_key') ? admin_csrf_token_key() : '') . '";
+        }
+    </script>';
 }
 else { // 현재페이지일 때
    include_once (G5_ADMIN_PATH.'/admin.head.php');
@@ -16,13 +16,13 @@ if( ! $is_admin ){
 	}
 }

-run_event('admin_request_handler_'.$call, $arr_query, $token);
-
 $sub_menu = admin_menu_find_by($call, 'sub_menu');
 $g5['title'] = admin_menu_find_by($call, 'title');

+run_event('admin_request_handler_'.$call, $arr_query, $token);
+
 include_once ('./admin.head.php');

 run_event('admin_get_page_'.$call, $arr_query, $token);

-include_once ('./admin.tail.php');
+include_once ('./admin.tail.php');
@@ -4,8 +4,8 @@ include_once('./_common.php');
 if (!$is_member) die('0');

 $uid     = isset($_REQUEST['uid']) ? preg_replace('/[^0-9]/', '', $_REQUEST['uid']) : 0;
-$subject = isset($_REQUEST['subject']) ? trim($_REQUEST['subject']) : '';
-$content = isset($_REQUEST['content']) ? trim($_REQUEST['content']) : '';
+$subject = isset($_REQUEST['subject']) ? preg_replace("#[\\\]+$#", "", substr(trim($_POST['subject']),0,255)) : '';
+$content = isset($_REQUEST['content']) ? preg_replace("#[\\\]+$#", "", substr(trim($_POST['content']),0,65536)) : '';

 if ($subject && $content) {
    $sql = " select count(*) as cnt from {$g5['autosave_table']} where mb_id = '{$member['mb_id']}' and as_subject = '$subject' and as_content = '$content' ";
@@ -104,6 +104,13 @@ if (!$is_search_bbs) {

        $list[$i] = get_list($row, $board, $board_skin_url, G5_IS_MOBILE ? $board['bo_mobile_subject_len'] : $board['bo_subject_len']);
        $list[$i]['is_notice'] = true;
+        $list[$i]['list_content'] = $list[$i]['wr_content'];
+
+        // 비밀글인 경우 리스트에서 내용이 출력되지 않게 글 내용을 지웁니다. 
+        if (strstr($list[$i]['wr_option'], "secret")) {
+            $list[$i]['wr_content'] = '';
+        }
+
        $list[$i]['num'] = 0;
        $i++;
        $notice_count++;
@@ -197,6 +204,13 @@ if($page_rows > 0) {
            $list[$i]['subject'] = search_font($stx, $list[$i]['subject']);
        }
        $list[$i]['is_notice'] = false;
+        $list[$i]['list_content'] = $list[$i]['wr_content'];
+
+        // 비밀글인 경우 리스트에서 내용이 출력되지 않게 글 내용을 지웁니다. 
+        if (strstr($list[$i]['wr_option'], "secret")) {
+            $list[$i]['wr_content'] = '';
+        }
+
        $list_num = $total_count - ($page - 1) * $list_page_rows - $notice_count;
        $list[$i]['num'] = $list_num - $k;

@@ -8,7 +8,6 @@ if( function_exists('social_check_login_before') ){
 $g5['title'] = '로그인';
 include_once('./_head.sub.php');

-$url = isset($_GET['url']) ? strip_tags($_GET['url']) : '';
 $od_id = isset($_POST['od_id']) ? safe_replace_regex($_POST['od_id'], 'od_id') : '';

 // url 체크
@@ -62,10 +62,18 @@ run_event('login_session_before', $mb, $is_social_login);

@include_once($member_skin_path.'/login_check.skin.php');

+if (! (defined('SKIP_SESSION_REGENERATE_ID') && SKIP_SESSION_REGENERATE_ID)) {
+    session_regenerate_id(false);
+    if (function_exists('session_start_samesite')) {
+        session_start_samesite();
+    }
+}
+
 // 회원아이디 세션 생성
 set_session('ss_mb_id', $mb['mb_id']);
-// FLASH XSS 공격에 대응하기 위하여 회원의 고유키를 생성해 놓는다. 관리자에서 검사함 - 110106
-set_session('ss_mb_key', md5($mb['mb_datetime'] . get_real_client_ip() . $_SERVER['HTTP_USER_AGENT']));
+// FLASH XSS 공격에 대응하기 위하여 회원의 고유키를 생성해 놓는다. 관리자에서 검사함
+generate_mb_key($mb);
+
 // 회원의 토큰키를 세션에 저장한다. /common.php 에서 해당 회원의 토큰값을 검사한다.
 if(function_exists('update_auth_session_token')) update_auth_session_token($mb['mb_datetime']);

@@ -139,8 +147,16 @@ if(function_exists('set_cart_id')){
    cart_item_clean();
    set_cart_id('');
    $s_cart_id = get_session('ss_cart_id');
+
+    $add_cart_where = '';
+
+    // 장바구니에서 주문하기를 하는 경우
+    if (strpos($link, 'orderform.php') !== false) {
+        $add_cart_where = " and ct_select_time < '".date('Y-m-d H:i:s', strtotime('-1 hour', G5_SERVER_TIME))."' ";
+    }
+
    // 선택필드 초기화
-    $sql = " update {$g5['g5_shop_cart_table']} set ct_select = '0' where od_id = '$s_cart_id' ";
+    $sql = " update {$g5['g5_shop_cart_table']} set ct_select = '0' where od_id = '$s_cart_id' $add_cart_where ";
    sql_query($sql);
 }

@@ -19,7 +19,11 @@ if ($url) {
    if ( substr($url, 0, 2) == '//' )
        $url = 'http:' . $url;

-    $p = @parse_url(urldecode($url));
+    if (preg_match('#\\\0#', $url) || preg_match('/^\/{1,}\\\/', $url)) {
+        alert('url 에 올바르지 않은 값이 포함되어 있습니다.', G5_URL);
+    }
+
+    $p = @parse_url(urldecode(str_replace('\\', '', $url)));
    /*
        // OpenRediect 취약점관련, PHP 5.3 이하버전에서는 parse_url 버그가 있음 ( Safflower 님 제보 ) 아래 url 예제
        // http://localhost/bbs/logout.php?url=http://sir.kr%23@/
@@ -4,8 +4,6 @@ include_once('./_common.php');
 if ($is_guest)
    alert('로그인 한 회원만 접근하실 수 있습니다.', G5_BBS_URL.'/login.php');

-$url = isset($_GET['url']) ? clean_xss_tags($_GET['url']) : '';
-
 while (1) {
    $tmp = preg_replace('/&#[^;]+;/', '', $url);
    if ($tmp == $url) break;
@@ -31,6 +29,10 @@ if($url){
    if( preg_match('#^/{3,}#', $url) ){
        $url = preg_replace('#^/{3,}#', '/', $url);
    }
+
+    if (function_exists('safe_filter_url_host')) {
+        $url = safe_filter_url_host($url);
+    }
 }

 $url = get_text($url);
@@ -14,24 +14,28 @@ $str_nick_list = '';
 $msg = '';
 $error_list  = array();
 $member_list = array('id'=>array(), 'nick'=>array());
+$me_memo = isset($_POST['me_memo']) ? preg_replace("#[\\\]+$#", "", substr(trim($_POST['me_memo']),0,65536)) : '';

 run_event('memo_form_update_before', $recv_list);

 for ($i=0; $i<count($recv_list); $i++) {
-    $row = sql_fetch(" select mb_id, mb_nick, mb_open, mb_leave_date, mb_intercept_date from {$g5['member_table']} where mb_id = '{$recv_list[$i]}' ");
+
+    $recv_list_id = substr(preg_replace("/[^a-zA-Z0-9_]*/", "", $recv_list[$i]), 0, 20);
+
+    $row = sql_fetch(" select mb_id, mb_nick, mb_open, mb_leave_date, mb_intercept_date from {$g5['member_table']} where mb_id = '{$recv_list_id}' ");
    if ($row) {
        if ($is_admin || ($row['mb_open'] && (!$row['mb_leave_date'] && !$row['mb_intercept_date']))) {
            $member_list['id'][]   = $row['mb_id'];
            $member_list['nick'][] = $row['mb_nick'];
        } else {
-            $error_list[]   = $recv_list[$i];
+            $error_list[]   = $recv_list_id;
        }
    }
    /*
    // 관리자가 아니면서
    // 가입된 회원이 아니거나 정보공개를 하지 않았거나 탈퇴한 회원이거나 차단된 회원에게 쪽지를 보내는것은 에러
    if ((!$row['mb_id'] || !$row['mb_open'] || $row['mb_leave_date'] || $row['mb_intercept_date']) && !$is_admin) {
-        $error_list[]   = $recv_list[$i];
+        $error_list[]   = $recv_list_id;
    } else {
        $member_list['id'][]   = $row['mb_id'];
        $member_list['nick'][] = $row['mb_nick'];
@@ -67,14 +71,14 @@ for ($i=0; $i<count($member_list['id']); $i++) {
    $recv_mb_nick = get_text($member_list['nick'][$i]);

    // 받는 회원 쪽지 INSERT
-    $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_type, me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}', '0000-00-00 00:00:00' , 'recv', '{$_SERVER['REMOTE_ADDR']}' ) ";
+    $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_type, me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$me_memo}', '0000-00-00 00:00:00' , 'recv', '{$_SERVER['REMOTE_ADDR']}' ) ";

    sql_query($sql);

    if( $me_id = sql_insert_id() ){

        // 보내는 회원 쪽지 INSERT
-        $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_send_id, me_type , me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}', '0000-00-00 00:00:00', '$me_id', 'send', '{$_SERVER['REMOTE_ADDR']}' ) ";
+        $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_send_id, me_type , me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$me_memo}', '0000-00-00 00:00:00', '$me_id', 'send', '{$_SERVER['REMOTE_ADDR']}' ) ";
        sql_query($sql);
 		
 		$member_list['me_id'][$i] = $me_id;
@@ -49,7 +49,9 @@ while ($row = sql_fetch_array($result))
        $count_write = 0;
        $count_comment = 0;

-        $next_wr_num = get_next_num($move_write_table);
+        // get_next_num 함수는 mysql 지연시 중복이 될수 있는 문제로 더 이상 사용하지 않습니다.
+        // $next_wr_num = get_next_num($move_write_table);
+        $next_wr_num = 0;

        $sql2 = " select * from $write_table where wr_num = '$wr_num' order by wr_parent, wr_is_comment, wr_comment desc, wr_id ";
        $result2 = sql_query($sql2);
@@ -78,7 +80,7 @@ while ($row = sql_fetch_array($result))
            }

            $sql = " insert into $move_write_table
-                        set wr_num = '$next_wr_num',
+                        set wr_num = " . ($next_wr_num ? "'$next_wr_num'" : "(SELECT IFNULL(MIN(wr_num) - 1, -1) FROM $move_write_table as sq) ") . ",
                             wr_reply = '{$row2['wr_reply']}',
                             wr_is_comment = '{$row2['wr_is_comment']}',
                             wr_comment = '{$row2['wr_comment']}',
@@ -116,6 +118,11 @@ while ($row = sql_fetch_array($result))
            sql_query($sql);

            $insert_id = sql_insert_id();
+            
+            if ($next_wr_num === 0) {
+                $tmp = sql_fetch("select wr_num from $move_write_table where wr_id = '$insert_id'");
+                $next_wr_num = $tmp['wr_num'];
+            }

            // 코멘트가 아니라면
            if (!$row2['wr_is_comment'])
@@ -126,6 +133,8 @@ while ($row = sql_fetch_array($result))
                $result3 = sql_query($sql3);
                for ($k=0; $row3 = sql_fetch_array($result3); $k++)
                {
+                    $copy_file_name = '';
+                    
                    if ($row3['bf_file'])
                    {
                        // 원본파일을 복사하고 퍼미션을 변경
@@ -3,7 +3,7 @@ include_once('./_common.php');

 $po_id = isset($_POST['po_id']) ? preg_replace('/[^0-9]/', '', $_POST['po_id']) : 0;

-$po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '{$_POST['po_id']}' ");
+$po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '$po_id' ");
 if (! (isset($po['po_id']) && $po['po_id']))
    alert('po_id 값이 제대로 넘어오지 않았습니다.');

@@ -15,6 +15,7 @@ if (!($token && $delete_token === $token))
    alert('토큰 에러로 삭제 불가합니다.');

 $tmp_array = array();
+$deleted = array();
 if ($qa_id) // 건별삭제
    $tmp_array[0] = $qa_id;
 else // 일괄삭제
@@ -56,21 +57,23 @@ for($i=0; $i<$count; $i++) {
    delete_editor_thumbnail($row['qa_content']);

    // 답변이 있는 질문글이라면 답변글 삭제
-    if(!$row['qa_type'] && $row['qa_status']) {
-        $row2 = sql_fetch(" select qa_content, qa_file1, qa_file2 from {$g5['qa_content_table']} where qa_parent = '$qa_id' ");
+    if (!$row['qa_type'] && $row['qa_status']) {
+        $answer = sql_fetch(" SELECT qa_id, qa_content, qa_file1, qa_file2 from {$g5['qa_content_table']} where qa_type = 1 AND qa_parent = {$qa_id} ");
        // 첨부파일 삭제
-        for($k=1; $k<=2; $k++) {
-            @unlink(G5_DATA_PATH.'/qa/'.clean_relative_paths($row2['qa_file'.$k]));
+        for ($k = 1; $k <= 2; $k++) {
+            @unlink(G5_DATA_PATH . '/qa/' . clean_relative_paths($answer['qa_file' . $k]));
            // 썸네일삭제
-            if(preg_match("/\.({$config['cf_image_extension']})$/i", $row2['qa_file'.$k])) {
-                delete_qa_thumbnail($row2['qa_file'.$k]);
+            if (preg_match("/\.({$config['cf_image_extension']})$/i", $answer['qa_file' . $k])) {
+                delete_qa_thumbnail($answer['qa_file' . $k]);
            }
        }

        // 에디터 썸네일 삭제
-        delete_editor_thumbnail($row2['qa_content']);
+        delete_editor_thumbnail($answer['qa_content']);

-        sql_query(" delete from {$g5['qa_content_table']} where qa_type = '1' and qa_parent = '$qa_id' ");
+        // 답변글 삭제
+        sql_query(" DELETE from {$g5['qa_content_table']} where qa_type = 1 and qa_parent = {$qa_id} ");
+        $deleted[] = (int) $answer['qa_id'];
    }

    // 답변글 삭제시 질문글의 상태변경
@@ -80,8 +83,14 @@ for($i=0; $i<$count; $i++) {

    // 글삭제
    sql_query(" delete from {$g5['qa_content_table']} where qa_id = '$qa_id' ");
+    $deleted[] = $qa_id;
 }

-run_event('qa_delete', $tmp_array);
+/**
+ * QA 글 삭제 후 Event Hook
+ * @var array $tmp_array 삭제 요청된 qa_id 목록. 소유자 확인, 답변글 존재 여부 등의 이유로 실제로 삭제처리가 안 된 ID가 포함될 수 있으며, 삭제처리 되었더라도 답변글은 이 목록에 포함되지 않음
+ * @var array $deleted 답변글을 포함한 삭제가 완료된 qa_id 목록
+ */
+run_event('qa_delete', $tmp_array, $deleted);

 goto_url(G5_BBS_URL.'/qalist.php'.preg_replace('/^&amp;/', '?', $qstr));
@@ -86,6 +86,7 @@ $qa_related = 0;
 $qa_email_recv = (isset($_POST['qa_email_recv']) && $_POST['qa_email_recv']) ? 1 : 0;
 $qa_sms_recv = (isset($_POST['qa_sms_recv']) && $_POST['qa_sms_recv']) ? 1 : 0;
 $qa_status = 0;
+$answer_id = null;

 for ($i=1; $i<=5; $i++) {
    $var = "qa_$i";
@@ -301,6 +302,7 @@ if($w == '' || $w == 'a' || $w == 'r') {
    }

    if($w == 'a') {
+        $answer_id = (int) sql_insert_id();
        $sql = " update {$g5['qa_content_table']}
                    set qa_status = '1'
                    where qa_id = '{$write['qa_parent']}' ";
@@ -339,7 +341,15 @@ if($w == '' || $w == 'a' || $w == 'r') {
    sql_query($sql);
 }

-run_event('qawrite_update', $qa_id, $write, $w, $qaconfig);
+/**
+ * 1:1 문의/답변의 변경 시 Event Hook
+ * @var int $qa_id 삽입/수정 또는 답글/추가질문 대상 글의 ID
+ * @var array $write 삽입/수정 또는 답글/추가질문 대상 글의 데이터
+ * @var string $w 동작 모드 ('': 질문글 작성, 'a': 답변글 작성, 'u': 질문/답변 수정, 'r': 추가(관련) 질문)
+ * @var array $qaconfig 1:1 문의 설정
+ * @var ?int $answer_id 답변글 작성($w = 'a') 시 답변글의 ID
+*/
+run_event('qawrite_update', $qa_id, $write, $w, $qaconfig, ($w === 'a') ? $answer_id : null);

 // SMS 알림
 if($config['cf_sms_use'] == 'icode' && $qaconfig['qa_use_sms']) {
@@ -1,6 +1,8 @@
 <?php
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가

+if (function_exists('check_case_exist_title')) check_case_exist_title($write, G5_BBS_DIR, true);
+
 // 게시판에서 두단어 이상 검색 후 검색된 게시물에 코멘트를 남기면 나오던 오류 수정
 $sop = strtolower($sop);
 if ($sop != 'and' && $sop != 'or')
@@ -31,6 +31,9 @@ $wr_subject = '';
 if (isset($_POST['wr_subject'])) {
    $wr_subject = substr(trim($_POST['wr_subject']),0,255);
    $wr_subject = preg_replace("#[\\\]+$#", "", $wr_subject);
+    if (function_exists('normalize_utf8_string')) {
+        $wr_subject = normalize_utf8_string($wr_subject);
+    }
 }
 if ($wr_subject == '') {
    $msg[] = '<strong>제목</strong>을 입력하세요.';
@@ -40,6 +43,9 @@ $wr_content = '';
 if (isset($_POST['wr_content'])) {
    $wr_content = substr(trim($_POST['wr_content']),0,65536);
    $wr_content = preg_replace("#[\\\]+$#", "", $wr_content);
+    if (function_exists('normalize_utf8_string')) {
+        $wr_content = normalize_utf8_string($wr_content);
+    }
 }
 if ($wr_content == '') {
    $msg[] = '<strong>내용</strong>을 입력하세요.';
@@ -252,12 +258,14 @@ if ($w == '' || $w == 'r') {
        $wr_num = $write['wr_num'];
        $wr_reply = $reply;
    } else {
-        $wr_num = get_next_num($write_table);
+        // get_next_num 함수는 mysql 지연시 중복이 될수 있는 문제로 더 이상 사용하지 않습니다.
+        // $wr_num = get_next_num($write_table);
+        $wr_num = 0;
        $wr_reply = '';
    }
-
+    
    $sql = " insert into $write_table
-                set wr_num = '$wr_num',
+                set wr_num = " . ($w == 'r' ? "'$wr_num'" : "(SELECT IFNULL(MIN(wr_num) - 1, -1) FROM $write_table as sq) ") . ",
                     wr_reply = '$wr_reply',
                     wr_comment = 0,
                     ca_name = '$ca_name',
@@ -676,8 +684,14 @@ sql_query(" delete from {$g5['autosave_table']} where as_uid = '{$uid}' ");
 //------------------------------------------------------------------------------

 // 비밀글이라면 세션에 비밀글의 아이디를 저장한다. 자신의 글은 다시 비밀번호를 묻지 않기 위함
-if ($secret)
+if ($secret) {
+    if (! $wr_num) {
+        $write = get_write($write_table, $wr_id, true);
+        $wr_num = $write['wr_num'];
+    }
+
    set_session("ss_secret_{$bo_table}_{$wr_num}", TRUE);
+}

 // 메일발송 사용 (수정글은 발송하지 않음)
 if (!($w == 'u' || $w == 'cu') && $config['cf_email_use'] && $board['bo_use_email']) {
@@ -0,0 +1,110 @@
+<?php
+// CloudFlare를 사용시, 사용자 환경에 맞는 $_SERVER['REMOTE_ADDR']과 $_SERVER['HTTPS'] 사용 여부를 수정합니다.
+class G5CloudflareRequestHandler {
+    public static function check_cloudflare_ips($user_ip){
+        
+        // 클라우드플레어 IP, https://www.cloudflare.com/ips
+        $cloudflare_ips = array(
+            // IPv4
+            '173.245.48.0/20',
+            '103.21.244.0/22',
+            '103.22.200.0/22',
+            '103.31.4.0/22',
+            '141.101.64.0/18',
+            '108.162.192.0/18',
+            '190.93.240.0/20',
+            '188.114.96.0/20',
+            '197.234.240.0/22',
+            '198.41.128.0/17',
+            '162.158.0.0/15',
+            '104.16.0.0/12',
+            '104.24.0.0/14',
+            '172.64.0.0/13',
+            '131.0.72.0/22',
+            // IPv6
+            '2400:cb00::/32',
+            '2606:4700::/32',
+            '2803:f800::/32',
+            '2405:b500::/32',
+            '2405:8100::/32',
+            '2a06:98c0::/29',
+            '2c0f:f248::/32',
+        );
+            
+        // 사용자 IP가 Cloudflare IP 대역 범위에 있는지 확인
+        $is_cloudflare_ip = false;
+        foreach ($cloudflare_ips as $cidr) {
+            if (self::ip_in_range($user_ip, $cidr)) {
+                $is_cloudflare_ip = true;
+                break;
+            }
+        }
+        
+        return $is_cloudflare_ip;
+    }
+
+    // IP 주소가 CIDR 범위 내에 있는지 확인하는 함수 (IPv4, IPv6 모두 가능)
+    public static function ip_in_range($ip, $range) {
+        // IPv4와 IPv6를 구분
+        if (strpos($range, ':') === false && preg_match('/^([0-9]{1,3}\.){3}[0-9]{1,3}$/', $ip)) {
+            // IPv4 처리
+            return self::ipv4_in_range($ip, $range);
+        } elseif (strpos($range, ':') !== false && strpos($ip, ':') !== false) {
+            // IPv6 처리
+            return self::ipv6_in_range($ip, $range);
+        }
+        
+        return false;
+    }
+
+    // IPv4 CIDR 범위 검사
+    public static function ipv4_in_range($ip, $range) {
+        list($range, $netmask) = explode('/', $range, 2);
+        $range_decimal = ip2long($range);
+        $ip_decimal = ip2long($ip);
+        $wildcard_decimal = pow(2, (32 - $netmask)) - 1;
+        $netmask_decimal = ~$wildcard_decimal;
+        
+        return (($ip_decimal & $netmask_decimal) == ($range_decimal & $netmask_decimal));
+    }
+
+    // IPv6 CIDR 범위 검사
+    public static function ipv6_in_range($ip, $range) {
+        list($range_ip, $netmask) = explode('/', $range, 2);
+        $netmask = (int) $netmask;
+
+        $ip_bin = @inet_pton($ip);
+        $range_bin = @inet_pton($range_ip);
+        
+        // IPv6 주소는 128비트이므로, 비트마스크를 적용
+        $unpacked = unpack('A16', $ip_bin);
+        $ip_bits = $unpacked[1];
+        $unpacked2 = unpack('A16', $range_bin);
+        $range_bits = $unpacked2[1];
+
+        for ($i = 0; $i < (int)($netmask / 8); $i++) {
+            if ($ip_bits[$i] !== $range_bits[$i]) {
+                return false;
+            }
+        }
+
+        $remainder = $netmask % 8;
+        if ($remainder) {
+            $mask = 0xFF << (8 - $remainder);
+            return (ord($ip_bits[$i]) & $mask) === (ord($range_bits[$i]) & $mask);
+        }
+
+        return true;
+    }
+
+}
+if ($_SERVER['HTTP_CF_CONNECTING_IP'] && G5CloudflareRequestHandler::check_cloudflare_ips($_SERVER['REMOTE_ADDR'])) {
+    $_SERVER['REMOTE_ADDR'] = preg_replace('/[^0-9a-fA-F:.]/', '', $_SERVER['HTTP_CF_CONNECTING_IP']);
+    
+    // Cloudflare 환경을 고려한 https 사용여부
+    if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === "https") {
+        $_SERVER['HTTPS'] = 'on';
+    } elseif (isset($_SERVER['HTTP_CF_VISITOR']) && stripos($_SERVER['HTTP_CF_VISITOR'], 'https') !== false) {
+        $_SERVER['HTTPS'] = 'on';
+    }
+}
@@ -29,6 +29,10 @@ for ($i=0; $i<$ext_cnt; $i++) {
 }
 //==========================================================================================================================

+// Cloudflare 사용시 REMOTE_ADDR 에 사용자 IP 적용과 https 사용 여부
+if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
+    include_once('cloudflare.check.php');    // cloudflare 의 ip 대역인지 체크
+}

 function g5_path()
 {
@@ -58,7 +62,7 @@ include_once($g5_path['path'].'/config.php');   // 설정 파일
 unset($g5_path);

 // IIS 에서 SERVER_ADDR 서버변수가 없다면
-if(! isset($_SERVER['SERVER_ADDR'])) {
+if (!isset($_SERVER['SERVER_ADDR'])) {
    $_SERVER['SERVER_ADDR'] = isset($_SERVER['LOCAL_ADDR']) ? $_SERVER['LOCAL_ADDR'] : '';
 }

@@ -221,7 +225,12 @@ ini_set("session.gc_maxlifetime", 10800); // session data의 garbage collection
 ini_set("session.gc_probability", 1); // session.gc_probability는 session.gc_divisor와 연계하여 gc(쓰레기 수거) 루틴의 시작 확률을 관리합니다. 기본값은 1입니다. 자세한 내용은 session.gc_divisor를 참고하십시오.
 ini_set("session.gc_divisor", 100); // session.gc_divisor는 session.gc_probability와 결합하여 각 세션 초기화 시에 gc(쓰레기 수거) 프로세스를 시작할 확률을 정의합니다. 확률은 gc_probability/gc_divisor를 사용하여 계산합니다. 즉, 1/100은 각 요청시에 GC 프로세스를 시작할 확률이 1%입니다. session.gc_divisor의 기본값은 100입니다.

-session_set_cookie_params(0, '/');
+if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') {
+    session_set_cookie_params(0, '/', null, true, true);
+} else {
+    session_set_cookie_params(0, '/', null, false, true);
+}
+
 ini_set("session.cookie_domain", G5_COOKIE_DOMAIN);

 function chrome_domain_session_name(){
@@ -366,8 +375,7 @@ if( $config['cf_cert_use'] || (defined('G5_YOUNGCART_VER') && G5_YOUNGCART_VER)
                    || preg_match('/(iPhone|iPod|iPad).*AppleWebKit.*Safari/i', $_SERVER['HTTP_USER_AGENT'])
                    || preg_match('~MSIE|Internet Explorer~i', $_SERVER['HTTP_USER_AGENT'])
                    || preg_match('~Trident/7.0(; Touch)?; rv:11.0~',$_SERVER['HTTP_USER_AGENT'])
-                    || !(isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on')
-                    || !(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == "https")){
+                    || !(isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on')) {
                    return $res;
                }
            }
@@ -377,7 +385,7 @@ if( $config['cf_cert_use'] || (defined('G5_YOUNGCART_VER') && G5_YOUNGCART_VER)
            $cookie_session_name = method_exists('XenoPostToForm', 'g5_session_name') ? XenoPostToForm::g5_session_name() : 'PHPSESSID'; 
            foreach ($headers as $header) {
                if (!preg_match('~^Set-Cookie: '.$cookie_session_name.'=~', $header)) continue;
-                $header = preg_replace('~; secure(; HttpOnly)?$~', '', $header) . '; secure; SameSite=None';
+                $header = preg_replace('~(; secure; HttpOnly)?$~', '; secure; HttpOnly; SameSite=None', $header);
                header($header, false);
                $g5['session_cookie_samesite'] = 'none';
                break;
@@ -417,7 +425,7 @@ if (isset($_REQUEST['sca']))  {

 if (isset($_REQUEST['sfl']))  {
    $sfl = trim($_REQUEST['sfl']);
-    $sfl = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*\s]/", "", $sfl);
+    $sfl = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*\s\#]/", "", $sfl);
    if ($sfl)
        $qstr .= '&amp;sfl=' . urlencode($sfl); // search field (검색 필드)
 } else {
@@ -480,6 +488,7 @@ if (isset($_REQUEST['w'])) {
    $w = '';
 }

+/** @var int $wr_id 게시판 글의 ID */
 if (isset($_REQUEST['wr_id'])) {
    $wr_id = (int)$_REQUEST['wr_id'];
 } else {
@@ -495,7 +504,7 @@ if (isset($_REQUEST['bo_table']) && ! is_array($_REQUEST['bo_table'])) {

 // URL ENCODING
 if (isset($_REQUEST['url'])) {
-    $url = strip_tags(trim($_REQUEST['url']));
+    $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\x80-\\xff]|i', '', trim($_REQUEST['url']));
    $urlencode = urlencode($url);
 } else {
    $url = '';
@@ -503,7 +512,7 @@ if (isset($_REQUEST['url'])) {
    if (G5_DOMAIN) {
        $p = @parse_url(G5_DOMAIN);
        $p['path'] = isset($p['path']) ? $p['path'] : '/';
-        $urlencode = G5_DOMAIN.urldecode(preg_replace("/^".urlencode($p['path'])."/", "", $urlencode));
+        $urlencode = rtrim(G5_DOMAIN, '%2F').'%2F'.ltrim(urldecode(preg_replace("/^".urlencode($p['path'])."/", "", $urlencode)), '%2F');
    }
 }

@@ -577,27 +586,30 @@ if (isset($_SESSION['ss_mb_id']) && $_SESSION['ss_mb_id']) { // 로그인중이
 }


+/** @var array $write 글 데이터 */
 $write = array();
+/** @var string $write_table 게시판 테이블 전체이름 */
 $write_table = '';
 if ($bo_table) {
    $board = get_board_db($bo_table, true);
    if (isset($board['bo_table']) && $board['bo_table']) {
        set_cookie("ck_bo_table", $board['bo_table'], 86400 * 1);
        $gr_id = $board['gr_id'];
-        $write_table = $g5['write_prefix'] . $bo_table; // 게시판 테이블 전체이름
+        // 게시판 테이블 전체이름
+        $write_table = $g5['write_prefix'] . $bo_table; 

        if (isset($wr_id) && $wr_id) {
            $write = get_write($write_table, $wr_id);
        } else if (isset($wr_seo_title) && $wr_seo_title) {
            $write = get_content_by_field($write_table, 'bbs', 'wr_seo_title', generate_seo_title($wr_seo_title));
-            if( isset($write['wr_id']) ){
-                $wr_id = $write['wr_id'];
+            if (isset($write['wr_id'])) {
+                $wr_id = (int) $write['wr_id'];
            }
        }
    }
-    
-    // 게시판에서 
-    if (isset($board['bo_select_editor']) && $board['bo_select_editor']){
+
+    // 게시판에서 사용하는 에디터를 설정
+    if (isset($board['bo_select_editor']) && $board['bo_select_editor']) {
        $config['cf_editor'] = $board['bo_select_editor'];
    }
 }
@@ -799,19 +799,22 @@ box-shadow: 1px 2px 2px #eee;}
 #od_tot_price strong{font-size:1.5em;color:#ff006c}
 #sod_frm #sod_frm_pt_alert {margin:5px 0;color:#38b2bb }
 #od_pay_sl h3{font-size:1.167em;margin:20px 0 5px}
-#od_pay_sl input[type="radio"]{position:absolute;width:0;height:0;overflow:hidden;visibility:hidden;text-indent:-999px;left: 0;z-index: -1px;}
+#od_pay_sl input[type="radio"]{position:absolute;width:0;height:0;overflow:hidden;visibility:hidden;text-indent:-999px;left: 0;z-index: -1;}
 #od_pay_sl .lb_icon {display: inline-block;float:left;width:50%;background:#fff;border:1px solid #eceff4;margin:-1px 0 0 -1px;cursor: pointer;height:60px;position:relative;padding-left:65px;padding-top:20px;z-index:1}
 #od_pay_sl input[type="radio"]:checked+.lb_icon {border:1px solid #ff006c;z-index:3}
 #sod_frm_paysel {}
 #sod_frm_paysel legend {position:absolute;font-size:0;line-height:0;overflow:hidden}
 #sod_frm_paysel .KPAY{background:url('../img/kpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .PAYNOW{background:url('../img/paynow.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
-#sod_frm_paysel .PAYCO{background:url('../img/payco.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
-#sod_frm_paysel .inicis_lpay{background:url('../img/lpay_logo.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .PAYCO, #sod_frm_paysel .paycopay_icon{background:url('../img/payco.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .inicis_lpay, #sod_frm_paysel .lpay_icon{background:url('../img/lpay_logo.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .inicis_kakaopay{position:relative;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .inicis_kakaopay em{position:absolute;top:15px;left:45px;width:70px;height:30px;background:url('../img/kakao.png') no-repeat 50% 50% #ffeb00;overflow:hidden;text-indent:-999px;border-radius:30px}
 #sod_frm_paysel .kakaopay_icon{background:url('../img/kakao.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .naverpay_icon{background:url('../img/ico-default-naverpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .samsungpay_icon{background:url('../img/samsungpay.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .ssgpay_icon{background:url('../img/ssgpay_icon.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .skpay_icon{background:url('../img/skpay11_icon.png') no-repeat 50% 50% #fff; background-size: 70px;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .bank_icon{background:url('../img/pay_icon1.png') no-repeat 15px 50% #fff}
 #sod_frm_paysel .vbank_icon{background:url('../img/pay_icon2.png') no-repeat 15px 50% #fff;padding-top:13px}
 #sod_frm_paysel .iche_icon{background:url('../img/pay_icon2.png') no-repeat 15px 50% #fff;padding-top:13px}
@@ -84,8 +84,8 @@ input[type=radio] {-webkit-appearance: radio}
 /*카테고리*/
 .menu {display:none;position:fixed;top:0;height:100%;z-index:99999;-webkit-backface-visibility:hidden;width:100%;background:#efefef}
 .menu .menu_wr{width:100%;height:100%;overflow-y:auto;background:#eee;position:relative;z-index:199919;
- -webkit-box-shadow: 0 0 5px rgba(55,55,5,0.4));
-    -moz-box-shadow: 0 0 5px rgba(55,55,5,0.4));
+ -webkit-box-shadow: 0 0 5px rgba(55,55,5,0.4);
+    -moz-box-shadow: 0 0 5px rgba(55,55,5,0.4);
         box-shadow: 0 0 5px rgba(55,55,5,0.4);}
 .menu .menu_close {position:absolute;top:50%;right:0px;width:40px;height:40px;background:none;color:#fff;font-size:20px;margin-top:-20px;border:0;z-index:199999}

@@ -223,13 +223,15 @@ box-shadow: 0 0 6px rgba(0,0,0,0.2);}
 #m_sod_frm_paysel li {float:left;padding:5px;width:46%;height:35px}
 #m_sod_frm_paysel .KPAY{background:url('../img/kpay.png') no-repeat;width:37px;height:15px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%}
 #m_sod_frm_paysel .PAYNOW{background:url('../img/paynow.png') no-repeat;width:46px;height:15px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%;}
-#m_sod_frm_paysel .PAYCO{background:url('../img/payco.png') no-repeat 1px;width:50px;height:15px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%}
-#m_sod_frm_paysel .inicis_lpay{background:url('../img/lpay_logo.png') no-repeat;width:35px;height:12px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%;}
+#m_sod_frm_paysel .PAYCO, #m_sod_frm_paysel .paycopay_icon{background:url('../img/payco.png') no-repeat 1px;width:50px;height:15px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%}
+#m_sod_frm_paysel .inicis_lpay, #m_sod_frm_paysel .lpay_icon{background:url('../img/lpay_logo.png') no-repeat;width:35px;height:12px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%;}
 #m_sod_frm_paysel .inicis_kakaopay{background:url('../img/kakao.png') no-repeat 50% 50% #ffeb00;border-radius:30px;height:26px;width:74px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:36px auto}
 #m_sod_frm_paysel .kakaopay_icon{background:url('../img/ico-mobile-kakaopay.png') no-repeat #fff;height:23px;width:63px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:45px auto;background-position: 10% 40%}
 #m_sod_frm_paysel .naverpay_icon{background:url('../img/ico-mobile-naverpay.png') no-repeat #fff;height:23px;width:60px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:45px auto;background-position: 0% 30%}
 #m_sod_frm_paysel .applepay_icon{background:url('../img/ico-mobile-applepay.png') no-repeat #fff;height:30px;width:60px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:43px auto}
-#m_sod_frm_paysel .samsung_pay{margin-left:-23px;background:url('../img/samsungpay.png') no-repeat 24px 3px;height:25px;width:106px;display:inline-block;overflow:hidden;text-indent:-999px}
+#m_sod_frm_paysel .ssgpay_icon{background:url('../img/ssgpay_icon.png') no-repeat 0px 3px #fff;width:55px;height:20px;background-size:100%;display:inline-block;overflow:hidden;text-indent:-999px}
+#m_sod_frm_paysel .skpay_icon{background:url('../img/skpay11_icon.png') no-repeat 0px 3px #fff;width:55px;height:20px;background-size:100%;display:inline-block;overflow:hidden;text-indent:-999px}
+#m_sod_frm_paysel .samsung_pay, #m_sod_frm_paysel .samsungpay_icon{margin-left:-23px;background:url('../img/samsungpay.png') no-repeat 24px 7px;height:25px;width:106px;display:inline-block;overflow:hidden;text-indent:-999px}

 #sod_frm_pay{padding:10px;;border-top:1px solid #f3f3f3}
 #sod_frm_pay h2{margin:10px 0;font-size:1.25em}
@@ -359,7 +361,7 @@ box-shadow: inset 0 1px 1px rgba(0, 0, 0, .075);
 #sod_addr .addr_btn:after {display:block;visibility:hidden;clear:both;content:""}
 #sod_addr .sel_address {width:32%;float:left;margin-right:1%;height:30px;background:none;border:1px solid #333;color:#333;padding:0 5px}
 #sod_addr .del_address {display:block;width:32%;text-align:center;float:left;margin-right:1%;border:1px solid #aaa;background:none;color:#888;padding:0 5px;height:30px;line-height:28px;vertical-align:middle}
-#sod_addr input[type="radio"] {position:absolute;width:0;height:0;overflow:hidden;visibility:hidden;text-indent:-999px;left:0;z-index:-1px}
+#sod_addr input[type="radio"] {position:absolute;width:0;height:0;overflow:hidden;visibility:hidden;text-indent:-999px;left:0;z-index:-1}
 #sod_addr .add_lb {display:inline-block;float:left;width:32%;text-align:center;border:1px solid #4162ff;color:#4162ff;height:30px;line-height:28px}
 #sod_addr input[type="radio"]:checked+.add_lb {z-index:3;background:#4162ff;color:#fff}

@@ -579,7 +581,7 @@ a.btn02 {display:inline-block;padding:8px 7px 7px;border:1px solid #3b3c3f;backg
 a.btn02:focus, .btn02:hover {text-decoration:none}
 button.btn02 {display:inline-block;margin:0;padding:7px;border:1px solid #3b3c3f;background:#4b545e;color:#fff;text-decoration:none}
 .btn_confirm {text-align:center} /* 서식단계 진행 */
-.btn_submit {padding:0 5px;border:0;background:#3a8afd;border:1px solid #1c70e9;color:#fff;letter-spacing:-0.1em;border-radius:3px}}
+.btn_submit {padding:0 5px;border:0;background:#3a8afd;border:1px solid #1c70e9;color:#fff;letter-spacing:-0.1em;border-radius:3px}
 fieldset .btn_submit {padding:0 7px;height:24px;line-height:1em}
 a.btn_cancel {display:inline-block;padding:8px 7px 7px;border:1px solid #ccc;background:#fff;color:#000;text-decoration:none;vertical-align:middle}
 button.btn_cancel {display:inline-block;padding:7px;border:1px solid #ccc;background:#fafafa;color:#000;vertical-align:top;text-decoration:none}
@@ -821,7 +823,7 @@ box-shadow:0 0 8px rgba(65,98,255,0.8)}
 .sod_right #sod_bsk_tot{margin:10px}
 #sod_frm_taker textarea{width:100%;height:80px}

-#od_pay_sl input[type="radio"] {position:absolute;width:0;height:0;overflow:hidden;visibility:hidden;text-indent:-999px;left:0;z-index:-1px}
+#od_pay_sl input[type="radio"] {position:absolute;width:0;height:0;overflow:hidden;visibility:hidden;text-indent:-999px;left:0;z-index:-1}
 #od_pay_sl .lb_icon {display:inline-block;float:left;width:150px;background:#fff;border:1px solid #eceff4;margin:-1px 0 0 -1px;cursor:pointer;height:60px;position:relative;padding-left:65px;padding-top:20px;z-index:1}
 #od_pay_sl input[type="radio"]:checked+.lb_icon {border:1px solid #ff006c;z-index:3}

@@ -900,17 +902,21 @@ box-shadow:0 0 8px rgba(65,98,255,0.8)}
 #od_tot_price span{float:left;font-weight:bold}
 #od_tot_price strong{font-size:1.5em;color:#ff006c}
 #od_pay_sl h3{font-size:1.167em;margin:20px 0 5px}
-#od_pay_sl input[type="radio"]{position:absolute;width:0;height:0;overflow:hidden;visibility:hidden;text-indent:-999px;left: 0;z-index: -1px;}
+#od_pay_sl input[type="radio"]{position:absolute;width:0;height:0;overflow:hidden;visibility:hidden;text-indent:-999px;left: 0;z-index: -1;}
 #od_pay_sl .lb_icon {display: inline-block;float:left;width:50%;background:#fff;border:1px solid #eceff4;margin:-1px 0 0 -1px;cursor: pointer;height:60px;position:relative;padding-left:65px;padding-top:20px;z-index:1}
 #od_pay_sl input[type="radio"]:checked+.lb_icon {border:1px solid #ff006c;z-index:3}
 #sod_frm_paysel {}
 #sod_frm_paysel legend {position:absolute;font-size:0;line-height:0;overflow:hidden}
 #sod_frm_paysel .KPAY{background:url('../img/kpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .PAYNOW{background:url('../img/paynow.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
-#sod_frm_paysel .PAYCO{background:url('../img/payco.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
-#sod_frm_paysel .inicis_lpay{background:url('../img/lpay_logo.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .PAYCO, #sod_frm_paysel .paycopay_icon{background:url('../img/payco.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .inicis_lpay, #sod_frm_paysel .lpay_icon{background:url('../img/lpay_logo.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .inicis_kakaopay{background:url('../img/kakao.png') no-repeat 50% 50% #f4dc34;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .kakaopay_icon{background:url('../img/kakao.png') no-repeat 50% 50% #f4dc34;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .naverpay_icon{background:url('../img/ico-default-naverpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .samsungpay_icon{background:url('../img/samsungpay.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .ssgpay_icon{background:url('../img/ssgpay_icon.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .skpay_icon{background:url('../img/skpay11_icon.png') no-repeat 50% 50% #fff; background-size: 70px;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .bank_icon{background:url('../img/pay_icon1.png') no-repeat 15px 50% #fff}
 #sod_frm_paysel .vbank_icon{background:url('../img/pay_icon2.png') no-repeat 15px 50% #fff;padding-top:13px}
 #sod_frm_paysel .iche_icon{background:url('../img/pay_icon2.png') no-repeat 15px 50% #fff;padding-top:13px}
@@ -1,6 +1,8 @@
 <?php
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가

+define('KGINICIS_USE_CERT_SEED', isset($config['cf_cert_use_seed']) ? (int) $config['cf_cert_use_seed'] : 1);
+
 // 유저 사이드뷰에서 아이콘 지정 안했을시 기본 no 프로필 이미지
 define('G5_NO_PROFILE_IMG', '<span class="profile_img"><img src="'.G5_IMG_URL.'/no_profile.gif" alt="no_profile" width="'.$config['cf_member_icon_width'].'" height="'.$config['cf_member_icon_height'].'"></span>');

@@ -8,21 +8,24 @@ if (!defined('G5_USE_SHOP') || !G5_USE_SHOP) return;
 .'(배송업체명^택배조회URL^연락처)'
 */
 define('G5_DELIVERY_COMPANY',
-     '(경동택배^https://kdexp.com/basicNewDelivery.kd?barcode=^080-873-2178)'
+     '(경동택배^https://kdexp.com/service/delivery/etc/delivery.do?barcode=^1899-5368)'
    .'(대신택배^https://www.ds3211.co.kr/freight/internalFreightSearch.ht?billno=^043-222-4582)'
-    .'(동부택배^http://www.dongbups.com/delivery/delivery_search_view.jsp?item_no=^1588-8848)'
    .'(로젠택배^https://www.ilogen.com/m/personal/trace.pop/^1588-9988)'
    .'(우체국^https://m.epost.go.kr/postal/mobile/mobile.trace.RetrieveDomRigiTraceList.comm?ems_gubun=E&sid1=^1588-1300)'
-    .'(이노지스택배^http://www.innogis.co.kr/tracking_view.asp?invoice=^1566-4082)'
    .'(한진택배^https://www.hanjin.co.kr/kor/CMS/DeliveryMgr/WaybillResult.do?mCode=MN038&schLang=KR&wblnumText2=^1588-0011)'
    .'(롯데택배^https://www.lotteglogis.com/open/tracking?invno=^1588-2121)'
-    .'(CJ대한통운^https://www.doortodoor.co.kr/parcel/doortodoor.do?fsp_action=PARC_ACT_002&fsp_cmd=retrieveInvNoACT&invc_no=^1588-1255)'
-    .'(CVSnet편의점택배^https://www.cvsnet.co.kr/invoice/tracking.do?invoice_no=^1577-1287)'
-    .'(KG옐로우캡택배^http://www.yellowcap.co.kr/custom/inquiry_result.asp?invoice_no=^1588-0123)'
-    .'(KGB택배^http://www.kgbls.co.kr/sub5/trace.asp?f_slipno=^1577-4577)'
-    .'(KG로지스^http://www.kglogis.co.kr/contents/waybill.jsp?item_no=^1588-8848)'
+    .'(CJ대한통운^https://trace.cjlogistics.com/next/tracking.html?wblNo=^1588-1255)'
+    .'(GS25편의점택배^https://www.cvsnet.co.kr/invoice/tracking.do?invoice_no=^1577-1287)'
+    .'(합동택배^https://hdexp.co.kr/deliverySearch2.hd?barcode=^1899-3392)'
+    .'(CU편의점택배^https://www.cupost.co.kr/postbox/delivery/localResult.cupost?invoice_no=^1577-1287)'
+    .'(천일택배^http://www.chunil.co.kr/HTrace/HTrace.jsp?transNo=^1877-6606)'
    .'(건영택배^https://www.kunyoung.com/goods/goods_01.php?mulno=^031-460-2700)'
-    .'(호남택배^http://www.honamlogis.co.kr/04estimate/songjang_list.php?c_search1=^031-376-6070)'
+    .'(우리택배^http://www.honamlogis.co.kr/04estimate/songjang_list.php?c_search1=^031-376-6070)'
+    .'(일양로지스^https://www.ilyanglogis.com/functionality/popup_result.asp?hawb_no=^1588-0002)'
+    .'(EMS^https://service.epost.go.kr/trace.RetrieveEmsRigiTraceList.comm?POST_CODE=^1588-1300)'
+    .'(DHL^https://www.dhl.com/kr-ko/home/tracking.html?tracking-id=^1588-1588-0001)'
+    .'(FedEx^https://www.fedex.com/fedextrack/?trknbr=^02-3496-7777)'
+    .'(UPS^https://www.fedex.com/fedextrack/?trknbr=^02-3496-7777)'
 );

 include_once(G5_LIB_PATH.'/shop.data.lib.php');
@@ -1,2 +0,0 @@
-<?php
-if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가;
@@ -1,5 +1,6 @@
 <?php
 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once('../config.php');
 include_once('./install.function.php');    // 인스톨 과정 함수 모음
 include_once('../lib/common.lib.php');    // 공통 라이브러리
@@ -7,7 +7,7 @@
 DROP TABLE IF EXISTS `g5_auth`;
 CREATE TABLE IF NOT EXISTS `g5_auth` (
  `mb_id` varchar(20) NOT NULL default '',
-  `au_menu` varchar(20) NOT NULL default '',
+  `au_menu` varchar(50) NOT NULL default '',
  `au_auth` set('r','w','d') NOT NULL default '',
  PRIMARY KEY  (`mb_id`,`au_menu`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;
@@ -189,6 +189,7 @@ CREATE TABLE IF NOT EXISTS `g5_board_new` (

 DROP TABLE IF EXISTS `g5_config`;
 CREATE TABLE IF NOT EXISTS `g5_config` (
+  `cf_id` int(11) NOT NULL auto_increment,
  `cf_title` varchar(255) NOT NULL DEFAULT '',
  `cf_theme` varchar(100) NOT NULL DEFAULT '',
  `cf_admin` varchar(100) NOT NULL DEFAULT '',
@@ -291,8 +292,10 @@ CREATE TABLE IF NOT EXISTS `g5_config` (
  `cf_cert_simple` varchar(255) NOT NULL DEFAULT '',
  `cf_cert_kg_cd` varchar(255) NOT NULL DEFAULT '',
  `cf_cert_kg_mid` varchar(255) NOT NULL DEFAULT '',
+  `cf_cert_use_seed` tinyint(4) NOT NULL DEFAULT '1',
  `cf_cert_kcb_cd` varchar(255) NOT NULL DEFAULT '',
  `cf_cert_kcp_cd` varchar(255) NOT NULL DEFAULT '',
+  `cf_cert_kcp_enckey` varchar(100) NOT NULL DEFAULT '',
  `cf_lg_mid` varchar(100) NOT NULL DEFAULT '',
  `cf_lg_mert_key` varchar(100) NOT NULL DEFAULT '',
  `cf_cert_limit` int(11) NOT NULL DEFAULT '0',
@@ -342,7 +345,8 @@ CREATE TABLE IF NOT EXISTS `g5_config` (
  `cf_7` varchar(255) NOT NULL DEFAULT '',
  `cf_8` varchar(255) NOT NULL DEFAULT '',
  `cf_9` varchar(255) NOT NULL DEFAULT '',
-  `cf_10` varchar(255) NOT NULL DEFAULT ''
+  `cf_10` varchar(255) NOT NULL DEFAULT '',
+  PRIMARY KEY  (`cf_id`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;

 -- --------------------------------------------------------
@@ -445,12 +449,14 @@ CREATE TABLE IF NOT EXISTS `g5_group_member` (

 DROP TABLE IF EXISTS `g5_login`;
 CREATE TABLE IF NOT EXISTS `g5_login` (
+  `lo_id` int(11) NOT NULL AUTO_INCREMENT,
  `lo_ip` varchar(100) NOT NULL default '',
  `mb_id` varchar(20) NOT NULL default '',
  `lo_datetime` datetime NOT NULL default '0000-00-00 00:00:00',
  `lo_location` text NOT NULL,
  `lo_url` text NOT NULL,
-  PRIMARY KEY  (`lo_ip`)
+  PRIMARY KEY (`lo_id`),
+  UNIQUE KEY `lo_ip_unique` (`lo_ip`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;

 -- --------------------------------------------------------
@@ -679,7 +685,7 @@ CREATE TABLE IF NOT EXISTS `g5_scrap` (

 DROP TABLE IF EXISTS `g5_visit`;
 CREATE TABLE IF NOT EXISTS `g5_visit` (
-  `vi_id` int(11) NOT NULL default '0',
+  `vi_id` int(11) NOT NULL AUTO_INCREMENT,
  `vi_ip` varchar(100) NOT NULL default '',
  `vi_date` date NOT NULL default '0000-00-00',
  `vi_time` time NOT NULL default '00:00:00',
@@ -747,6 +753,7 @@ CREATE TABLE IF NOT EXISTS `g5_autosave` (

 DROP TABLE IF EXISTS `g5_qa_config`;
 CREATE TABLE IF NOT EXISTS `g5_qa_config` (
+  `qa_id` int(11) NOT NULL AUTO_INCREMENT,
  `qa_title` varchar(255) NOT NULL DEFAULT'',
  `qa_category` varchar(255) NOT NULL DEFAULT'',
  `qa_skin` varchar(255) NOT NULL DEFAULT '',
@@ -782,7 +789,8 @@ CREATE TABLE IF NOT EXISTS `g5_qa_config` (
  `qa_2` varchar(255) NOT NULL DEFAULT '',
  `qa_3` varchar(255) NOT NULL DEFAULT '',
  `qa_4` varchar(255) NOT NULL DEFAULT '',
-  `qa_5` varchar(255) NOT NULL DEFAULT ''
+  `qa_5` varchar(255) NOT NULL DEFAULT '',
+  PRIMARY KEY (`qa_id`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;

 -- --------------------------------------------------------
@@ -902,7 +910,7 @@ CREATE TABLE IF NOT EXISTS `g5_member_social_profiles` (
  `description` varchar(255) NOT NULL DEFAULT '',
  `mp_register_day` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
  `mp_latest_day` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
-  UNIQUE KEY `mp_no` (`mp_no`),
+  PRIMARY KEY (`mp_no`),
  KEY `mb_id` (`mb_id`),
  KEY `provider` (`provider`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;
@@ -209,6 +209,7 @@ CREATE TABLE IF NOT EXISTS `g5_shop_coupon_zone` (

 DROP TABLE IF EXISTS `g5_shop_default`;
 CREATE TABLE IF NOT EXISTS `g5_shop_default` (
+  `de_id` int(11) NOT NULL auto_increment,
  `de_admin_company_owner` varchar(255) NOT NULL DEFAULT '',
  `de_admin_company_name` varchar(255) NOT NULL DEFAULT '',
  `de_admin_company_saupja_no` varchar(255) NOT NULL DEFAULT '',
@@ -359,6 +360,8 @@ CREATE TABLE IF NOT EXISTS `g5_shop_default` (
  `de_inicis_lpay_use` tinyint(4) NOT NULL DEFAULT '0',
  `de_inicis_kakaopay_use` tinyint(4) NOT NULL DEFAULT '0',
  `de_inicis_cartpoint_use` tinyint(4) NOT NULL DEFAULT '0',
+  `de_nicepay_mid` varchar(30) NOT NULL DEFAULT '',
+  `de_nicepay_key` varchar(255) NOT NULL DEFAULT '',
  `de_item_use_use` tinyint(4) NOT NULL DEFAULT '0',
  `de_item_use_write` tinyint(4) NOT NULL DEFAULT '0',
  `de_code_dup_use` tinyint(4) NOT NULL DEFAULT '0',
@@ -386,7 +389,8 @@ CREATE TABLE IF NOT EXISTS `g5_shop_default` (
  `de_member_reg_coupon_use` tinyint(4) NOT NULL DEFAULT '0',
  `de_member_reg_coupon_term` int(11) NOT NULL DEFAULT '0',
  `de_member_reg_coupon_price` int(11) NOT NULL DEFAULT '0',
-  `de_member_reg_coupon_minimum` int(11) NOT NULL DEFAULT '0'
+  `de_member_reg_coupon_minimum` int(11) NOT NULL DEFAULT '0',
+  PRIMARY KEY  (`de_id`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;

 -- --------------------------------------------------------
@@ -2,6 +2,7 @@
@header('Content-Type: text/html; charset=utf-8');
@header('X-Robots-Tag: noindex');
 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once ('../config.php');
 $title = G5_VERSION." 라이센스 확인 1/3";
 include_once ('./install.inc.php');
@@ -0,0 +1,4 @@
+<?php
+if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
+    include_once('../cloudflare.check.php');    // cloudflare 의 ip 대역인지 체크
+}
@@ -9,6 +9,7 @@ header('Pragma: no-cache'); // HTTP/1.0
@header('X-Robots-Tag: noindex');

 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once ('../config.php');
 $title = G5_VERSION." 초기환경설정 2/3";
 include_once ('./install.inc.php');
@@ -10,6 +10,7 @@ header('Pragma: no-cache'); // HTTP/1.0
@header('X-Robots-Tag: noindex');

 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once('../config.php');
 include_once('../lib/common.lib.php');
 include_once('./install.function.php');    // 인스톨 과정 함수 모음
@@ -134,7 +134,7 @@ function no_comma(data)
 function del(href)
 {
    if(confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n정말 삭제하시겠습니까?")) {
-        document.location.href = href;
+        window.location.href = href;
    }
 }

@@ -1,5 +1,11 @@
 function kakaolink_send(text, url, image)
 {
+    if (window.Kakao && (kakao_javascript_apikey !== undefined)) {
+        if (! Kakao.isInitialized()) {
+            Kakao.init(kakao_javascript_apikey);
+        }
+    }
+
    if( image === undefined ){
        image = '';
    }
@@ -72,7 +72,6 @@ Class G5_object_cache {
     * @param string $key
     * @param string $group
     * @return bool
-     * kkigomi 님이 고쳐주심
     */
    function delete($type, $key, $group = 'default')
    {
@@ -19,7 +19,7 @@ Class GML_Hook extends Hook {

        $args = $this->getArguments($argsNumber, $args);

-        if (! ($class && $method) && function_exists($function)) {
+        if (! ($class && $method) && is_callable($function)) {
            return call_user_func_array($function, $args);
        } elseif ($obj = call_user_func(array($class, $this->singleton))) {
            if ($obj !== false) {
@@ -161,4 +161,4 @@ Class GML_Hook extends Hook {
    }
 }

-// end  Hook Class;
+// end  Hook Class;
@@ -9,11 +9,14 @@ include_once(dirname(__FILE__) .'/pbkdf2.compat.php');
 **
 *************************************************************************/

-// 마이크로 타임을 얻어 계산 형식으로 만듦
+/**
+ * 마이크로타임을 반환
+ * @return float
+ * @deprecated use `microtime(true)`
+ */
 function get_microtime()
 {
-    list($usec, $sec) = explode(" ",microtime());
-    return ((float)$usec + (float)$sec);
+    return microtime(true);
 }


@@ -99,6 +102,10 @@ function goto_url($url)
 {
    run_event('goto_url', $url);

+    if (function_exists('safe_filter_url_host')) {
+        $url = safe_filter_url_host($url);
+    }
+
    $url = str_replace("&amp;", "&", $url);
    //echo "<script> location.replace('$url'); </script>";

@@ -152,6 +159,10 @@ function set_cookie($cookie_name, $value, $expire, $path='/', $domain=G5_COOKIE_
    global $g5;
    
    $c = run_replace('set_cookie_params', array('path'=>$path, 'domain'=>$domain, 'secure'=>$secure, 'httponly'=>$httponly), $cookie_name);
+    
+    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') {
+        $c['secure'] = true;
+    }

    setcookie(md5($cookie_name), base64_encode($value), G5_SERVER_TIME + $expire, $c['path'], $c['domain'], $c['secure'], $c['httponly']);
 }
@@ -175,6 +186,10 @@ function alert($msg='', $url='', $error=true, $post=false)

    run_event('alert', $msg, $url, $error, $post);

+    if (function_exists('safe_filter_url_host')) {
+        $url = safe_filter_url_host($url);
+    }
+
    $msg = $msg ? strip_tags($msg, '<br>') : '올바른 방법으로 이용해 주십시오.';

    $header = '';
@@ -213,6 +228,12 @@ function confirm($msg, $url1='', $url2='', $url3='')
        alert($msg);
    }

+    if (function_exists('safe_filter_url_host')) {
+        $url1 = safe_filter_url_host($url1);
+        $url2 = safe_filter_url_host($url2);
+        $url3 = safe_filter_url_host($url3);
+    }
+
    if(!trim($url1) || !trim($url2)) {
        $msg = '$url1 과 $url2 를 지정해 주세요.';
        alert($msg);
@@ -648,7 +669,7 @@ function html_purifier($html)
    if ((function_exists('check_html_link_nofollow') && check_html_link_nofollow('html_purifier'))) {
        $config->set('HTML.Nofollow', true); // rel=nofollow 으로 스팸유입을 줄임
    }
-    $config->set('URI.SafeIframeRegexp', '%^(https?:)?//(' . $safeiframe . ')%');
+    $config->set('URI.SafeIframeRegexp', '%^(https?:)?//(' . preg_replace('/\\\?\./', '\.', $safeiframe) . ')%');
    $config->set('Attr.AllowedFrameTargets', array('_blank'));
    //유튜브, 비메오 전체화면 가능하게 하기
    $config->set('Filter.Custom', array(new HTMLPurifier_Filter_Iframevideo()));
@@ -705,7 +726,7 @@ function get_sql_search($search_ca_name, $search_field, $search_text, $search_op
    $tmp = explode(",", trim($search_field));
    $field = explode("||", $tmp[0]);
    $not_comment = "";
-    if (!empty($tmp[1]))
+    if (isset($tmp[1]))
        $not_comment = $tmp[1];

    $str .= "(";
@@ -761,8 +782,11 @@ function get_sql_search($search_ca_name, $search_field, $search_text, $search_op
        $op1 = " $search_operator ";
    }
    $str .= " ) ";
-    if ($not_comment)
+    if ($not_comment === '1') {
        $str .= " and wr_is_comment = '0' ";
+    } else if ($not_comment === '0') {
+        $str .= " and wr_is_comment = '1' ";
+    }

    return $str;
 }
@@ -825,23 +849,33 @@ function get_group($gr_id, $is_cache=false)
 }


-// 회원 정보를 얻는다.
-function get_member($mb_id, $fields='*', $is_cache=false)
+/**
+ * 회원 정보를 얻는다
+ * 
+ * @param string $mb_id
+ * @param string $fields
+ * @param bool $is_cache
+ * 
+ * @return array
+ */
+function get_member($mb_id, $fields = '*', $is_cache = false)
 {
    global $g5;
-    
-    if (preg_match("/[^0-9a-z_]+/i", $mb_id))
+
+    $mb_id = trim($mb_id);
+    if (preg_match("/[^0-9a-z_]+/i", $mb_id)) {
        return array();
+    }

    static $cache = array();

    $key = md5($fields);

-    if( $is_cache && isset($cache[$mb_id]) && isset($cache[$mb_id][$key]) ){
+    if ($is_cache && isset($cache[$mb_id]) && isset($cache[$mb_id][$key])) {
        return $cache[$mb_id][$key];
    }

-    $sql = " select $fields from {$g5['member_table']} where mb_id = TRIM('$mb_id') ";
+    $sql = " SELECT {$fields} from {$g5['member_table']} where mb_id = '{$mb_id}' ";

    $cache[$mb_id][$key] = run_replace('get_member', sql_fetch($sql), $mb_id, $fields, $is_cache);

@@ -1313,6 +1347,10 @@ function delete_point($mb_id, $rel_table, $rel_id, $rel_action)
                      and po_rel_action = '$rel_action' ";
        $row = sql_fetch($sql);

+        if (! (isset($row['po_id']) && $row['po_id'])) {
+            return true;
+        }
+
        if(isset($row['po_point']) && $row['po_point'] < 0) {
            $mb_id = $row['mb_id'];
            $po_point = abs($row['po_point']);
@@ -1360,15 +1398,14 @@ function get_sideview($mb_id, $name='', $email='', $homepage='')
    static $cache = array();

    $name = get_text($name, 0, true);
-
-    if (isset($cache['id:' . $mb_id]) && $cache['id:' . $mb_id]) {
+    $namekey = ($mb_id && $name) ? $mb_id."\t".$name : '';
+    
+    // id는 유니크하지만 닉네임 또는 이름은 변경이 가능하다
+    // name의 경우 비회원은 게시판에 동일한 이름을 등록할수 있다.
+    if ($namekey && isset($cache['idname:' . $namekey]) && $cache['idname:' . $namekey]) {
+        return $cache['idname:' . $namekey];
+    } else if (isset($cache['id:' . $mb_id]) && $cache['id:' . $mb_id]) {
        return $cache['id:' . $mb_id];
-    } else if (
-        isset($name)
-        && isset($cache['name:' . $name])
-        && $cache['name:' . $name]
-    ) {
-        return $cache['name:' . $name];
    }

    $email = get_string_encrypt($email);
@@ -1482,11 +1519,11 @@ function get_sideview($mb_id, $name='', $email='', $homepage='')
    $str .= $str2;
    $str .= '<noscript class="sv_nojs">' . $str2 . '</noscript>';
    $str .= "</span>";
-
-    if ($mb_id) {
+    
+    if ($namekey) {
+        $cache['idname:' . $namekey] = $str;
+    } else if ($mb_id && !$name) {
        $cache['id:' . $mb_id] = $str;
-    } else {
-        $cache['name:' . $name] = $str;
    }

    return $str;
@@ -1645,7 +1682,10 @@ function sql_connect($host, $user, $pass, $db=G5_MYSQL_DB)
            die('Connect Error: '.mysqli_connect_error());
        }
    } else {
-        $link = mysql_connect($host, $user, $pass);
+        if (!function_exists('mysql_connect')) {
+            die('MySQL이 설치되지 않아 mysql_connect 함수를 사용할 수 없습니다.');
+        }
+        $link = mysql_connect($host, $user, $pass) or die('MySQL Host, User, Password 정보에 오류가 있습니다.');
    }

    return $link;
@@ -1840,11 +1880,22 @@ function sql_free_result($result)
 }


+/**
+ * MySQL PASSWORD() 함수로 생성된 비밀번호의 hash 값을 반환
+ * 
+ * MySQL 버전에 따라 결과가 다르게 나올 수 있음.
+ * MySQL 8.0.11 버전 이상에서는 오류 발생(PASSWORD 함수가 제거됨)으로 사용할 수 없음.
+ * 
+ * @deprecated 이 함수는 안전하지 않으므로 사용하지 않는 것을 권장 함
+ * @see get_encrypt_string() and check_password()
+ * @param string $value
+ * @return string
+ */
 function sql_password($value)
 {
    // mysql 4.0x 이하 버전에서는 password() 함수의 결과가 16bytes
    // mysql 4.1x 이상 버전에서는 password() 함수의 결과가 41bytes
-    $row = sql_fetch(" select password('$value') as pass ");
+    $row = sql_fetch(" SELECT password('{$value}') as pass ");

    return $row['pass'];
 }
@@ -2080,7 +2131,7 @@ function time_select($time, $name="")
    preg_match("/([0-9]{2}):([0-9]{2}):([0-9]{2})/", $time, $m);

    // 시
-    $s .= "<select name='{$name}_h'>";
+    $s = "<select name='{$name}_h'>";
    for ($i=0; $i<=23; $i++) {
        $s .= "<option value='$i'";
        if ($i == $m['0']) {
@@ -2228,6 +2279,24 @@ function _callback_bad_tag_convert($matches){
    return "<div class=\"embedx\">보안문제로 인하여 관리자 아이디로는 embed 또는 object 태그를 볼 수 없습니다. 확인하시려면 관리권한이 없는 다른 아이디로 접속하세요.</div>";
 }

+function normalize_utf8_string($string) {
+    // utf8mb4 환경과 mb_ord 함수가 지원되지 않는 환경에서는 제외한다.
+    if (G5_DB_CHARSET === 'utf8mb4' || !function_exists('mb_ord')) {
+        return $string;
+    }
+    
+    // Unicode 특수 문자를 일반 문자로 변환
+    $normalized = preg_replace_callback('/[\x{1D400}-\x{1D7FF}]/u', '_callback_normalizeString', $string);
+
+    return $normalized;
+}
+
+function _callback_normalizeString($matches){
+    $charCode = mb_ord($matches[0], 'UTF-8');
+    // 변환 테이블에서 일반 문자로 매핑
+    return chr(($charCode - 0x1D400) % 26 + ord('A'));
+}
+
 // 토큰 생성
 function _token()
 {
@@ -2252,6 +2321,53 @@ function check_token()
    return true;
 }

+/**
+ * 브라우저 검증을 위한 세션 반환 및 재생성
+ * @param array $member 로그인 된 회원의 정보. 가입일시(mb_datetime)를 반드시 포함해야 한다.
+ * @param bool $regenerate true 이면 재생성
+ * @return string
+ */
+function ss_mb_key($member, $regenerate = false)
+{
+    $client_key = ($regenerate) ? null : get_cookie('mb_client_key');
+
+    if (!$client_key) {
+        $client_key = get_random_token_string(16);
+        set_cookie('mb_client_key', $client_key, G5_SERVER_TIME * -1);
+    }
+
+    $mb_key = md5($member['mb_datetime'] . $client_key) . run_replace('ss_mb_key_user_agent', md5($_SERVER['HTTP_USER_AGENT']));
+
+    return $mb_key;
+}
+
+/**
+ * 회원의 클라이언트 검증
+ * @param array $member 로그인 된 회원의 정보. 가입일시(mb_datetime)를 반드시 포함해야 한다.
+ * @return bool
+ */
+function verify_mb_key($member)
+{
+    $mb_key = ss_mb_key($member);
+    $verified = get_session('ss_mb_key') === $mb_key;
+
+    if (!$verified) {
+        ss_mb_key($member, true);
+    }
+
+    return $verified;
+}
+
+/**
+ * 회원의 클라이언트 검증 키 생성
+ * 클라이언트 키를 다시 생성하여 생성된 키는 `ss_mb_key` 세션에 저장됨
+ * @param array $member 로그인 된 회원의 정보. 가입일시(mb_datetime)를 반드시 포함해야 한다.
+ */
+function generate_mb_key($member)
+{
+    $mb_key = ss_mb_key($member, true);
+    set_session('ss_mb_key', $mb_key);
+}

 // 문자열에 utf8 문자가 들어 있는지 검사하는 함수
 // 코드 : http://in2.php.net/manual/en/function.mb-check-encoding.php#95289
@@ -2461,14 +2577,19 @@ function check_device($device)
 }


-// 게시판 최신글 캐시 파일 삭제
+/**
+ * 게시판 최신글 캐시 파일 삭제
+ * @param string $bo_table 게시판 ID
+ */
 function delete_cache_latest($bo_table)
 {
    if (!preg_match("/^([A-Za-z0-9_]{1,20})$/", $bo_table)) {
        return;
    }

-    g5_delete_cache_by_prefix('latest-'.$bo_table.'-');
+    run_event('delete_cache_latest', $bo_table);
+
+    g5_delete_cache_by_prefix('latest-' . $bo_table . '-');
 }

 // 게시판 첨부파일 썸네일 삭제
@@ -3524,6 +3645,13 @@ function login_password_check($mb, $pass, $hash)
    return check_password($pass, $hash);
 }

+function safe_filter_url_host($url) {
+
+    $regex = run_replace('safe_filter_url_regex', '\\', $url);
+
+    return $regex ? preg_replace('#'. preg_quote($regex, '#') .'#iu', '', $url) : '';
+}
+
 // 동일한 host url 인지
 function check_url_host($url, $msg='', $return_url=G5_URL, $is_redirect=false)
 {
@@ -3535,14 +3663,15 @@ function check_url_host($url, $msg='', $return_url=G5_URL, $is_redirect=false)
    }

    // KVE-2021-1277 Open Redirect 취약점 해결
-    if (preg_match('#\\\0#', $url)) {
+    if (preg_match('#\\\0#', $url) || preg_match('/^\/{1,}\\\/', $url)) {
        alert('url 에 올바르지 않은 값이 포함되어 있습니다.');
    }

    while ( ( $replace_url = preg_replace(array('/\/{2,}/', '/\\@/'), array('//', ''), urldecode($url)) ) != $url ) {
        $url = $replace_url;
    }
-    $p = @parse_url(trim($url));
+
+    $p = @parse_url(trim(str_replace('\\', '', $url)));
    $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
    $is_host_check = false;
    
@@ -3801,7 +3930,7 @@ function check_vaild_callback($callback){
 class str_encrypt
 {
    var $salt;
-    var $lenght;
+    var $length;

    function __construct($salt='')
    {
@@ -4154,7 +4283,7 @@ function get_random_token_string($length=6)
    }

    $characters = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
-    $output = substr(str_shuffle($characters), 0, $length);     // jihan001 님 제안코드로 수정
+    $output = substr(str_shuffle($characters), 0, $length);

    return bin2hex($output);
 }
@@ -145,8 +145,14 @@ function get_content_by_field($write_table, $type='bbs', $where_field='', $where
 {
    global $g5, $g5_object;

+    static $cache = array();
+
+    $order_key = 'wr_id';
+
    if( $type === 'content' ){
        $check_array = array('co_id', 'co_html', 'co_subject', 'co_content', 'co_seo_title', 'co_mobile_content', 'co_skin', 'co_mobile_skin', 'co_tag_filter_use', 'co_hit', 'co_include_head', 'co_include_tail');
+
+        $order_key = 'co_id';
    } else {
        $check_array = array('wr_id', 'wr_num', 'wr_reply', 'wr_parent', 'wr_is_comment', 'ca_name', 'wr_option', 'wr_subject', 'wr_content', 'wr_seo_title', 'wr_link1', 'wr_link2', 'wr_hit', 'wr_good', 'wr_nogood', 'mb_id', 'wr_name', 'wr_email', 'wr_homepage', 'wr_datetime', 'wr_ip', 'wr_1', 'wr_2', 'wr_3', 'wr_4', 'wr_5', 'wr_6', 'wr_7', 'wr_8', 'wr_9', 'wr_10');
    }
@@ -162,7 +168,7 @@ function get_content_by_field($write_table, $type='bbs', $where_field='', $where
        return $cache[$key];
    }

-    $sql = " select * from {$write_table} where $where_field = '".sql_real_escape_string($where_value)."' ";
+    $sql = " select * from {$write_table} where $where_field = '".sql_real_escape_string($where_value)."' order by $order_key desc limit 1 ";

    $cache[$key] = sql_fetch($sql);

@@ -394,7 +400,7 @@ function get_mb_icon_name($mb_id){
 // 생성되면 안되는 게시판명
 function get_bo_table_banned_word(){

-    $folders = array();
+    $folders = array(G5_CONTENT_DIR, 'rss');

    foreach(glob(G5_PATH.'/*', GLOB_ONLYDIR) as $dir) {
        $folders[] = basename($dir);
@@ -65,7 +65,7 @@ function run_event($tag, $arg = ''){
    }
 }

-function add_replace($tag, $func, $priority=G5_HOOK_DEFAULT_PRIORITY, $args=0){
+function add_replace($tag, $func, $priority=G5_HOOK_DEFAULT_PRIORITY, $args=1){

    if( $hook = get_hook_class() ){
        return $hook->addFilter($tag, $func, $priority, $args);
@@ -130,4 +130,4 @@ function get_hook_datas($type='', $is_callback=''){
    }

    return null;
-}
+}
@@ -4,7 +4,7 @@ if (!defined('_GNUBOARD_')) exit;

 // 최신글 추출
 // $cache_time 캐시 갱신시간
-function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time=1, $options='')
+function latest($skin_dir='', $bo_table='', $rows=10, $subject_len=40, $cache_time=1, $options='')
 {
    global $g5;

@@ -52,9 +52,12 @@ function mailer($fname, $fmail, $to, $subject, $content, $type=0, $file="", $cc=

        $mail = run_replace('mail_options', $mail, $fname, $fmail, $to, $subject, $content, $type, $file, $cc, $bcc);

-        $mail_send_result = $mail->send();
-
+        if (!($mail_send_result = $mail->send())) {
+            throw new Exception($mail->ErrorInfo);
+        }
+        
    } catch (Exception $e) {
+        error_log("Mail sending error: " . $e->getMessage());
    }

    run_event('mail_send_result', $mail_send_result, $mail, $to, $cc, $bcc);
@@ -32,9 +32,9 @@ function get_shop_item_with_category($it_id, $seo_title='', $add_query=''){
    global $g5, $default;

    if( $seo_title ){
-        $sql = " select a.*, b.ca_name, b.ca_use from {$g5['g5_shop_item_table']} a, {$g5['g5_shop_category_table']} b where a.it_seo_title = '".sql_real_escape_string(generate_seo_title($seo_title))."' and a.ca_id = b.ca_id $add_query";
+        $sql = " select a.*, b.ca_name, b.ca_use from {$g5['g5_shop_item_table']} a, {$g5['g5_shop_category_table']} b where a.it_seo_title = '".sql_real_escape_string(generate_seo_title($seo_title))."' and a.ca_id = b.ca_id $add_query order by it_id desc limit 1";
    } else {
-        $sql = " select a.*, b.ca_name, b.ca_use from {$g5['g5_shop_item_table']} a, {$g5['g5_shop_category_table']} b where a.it_id = '$it_id' and a.ca_id = b.ca_id $add_query";
+        $sql = " select a.*, b.ca_name, b.ca_use from {$g5['g5_shop_item_table']} a, {$g5['g5_shop_category_table']} b where a.it_id = '$it_id' and a.ca_id = b.ca_id $add_query order by it_id desc limit 1";
    }
    
    $item = sql_fetch($sql);
@@ -1943,8 +1943,9 @@ function is_soldout($it_id, $is_cache=false)
    // 상품정보
    $it = get_shop_item($it_id, $is_cache);

-    if($it['it_soldout'] || $it['it_stock_qty'] <= 0)
+    if ($it['it_soldout']) {
        return true;
+    }

    $count = 0;
    $soldout = false;
@@ -1953,7 +1954,7 @@ function is_soldout($it_id, $is_cache=false)
    $sql = " select count(*) as cnt from {$g5['g5_shop_item_option_table']} where it_id = '$it_id' and io_type = '0' ";
    $row = sql_fetch($sql);

-    if($row['cnt']) {
+    if (isset($row['cnt']) && $row['cnt']) {
        $sql = " select io_id, io_type, io_stock_qty
                    from {$g5['g5_shop_item_option_table']}
                    where it_id = '$it_id'
@@ -1972,12 +1973,18 @@ function is_soldout($it_id, $is_cache=false)
        // 모든 선택옵션 품절이면 상품 품절
        if($i == $count)
            $soldout = true;
-    } else {
-        // 상품 재고수량
-        $stock_qty = get_it_stock_qty($it_id);

-        if($stock_qty <= 0)
+    } else {
+
+        if ($it['it_stock_qty'] <= 0) {
            $soldout = true;
+        } else {
+            // 상품 재고수량
+            $stock_qty = get_it_stock_qty($it_id);
+
+            if($stock_qty <= 0)
+                $soldout = true;
+        }
    }
    
    $cache[$key] = $soldout;
@@ -2480,6 +2487,15 @@ function shop_is_taxsave($od, $is_view_receipt=false){
 	return 0;
 }

+// 해당 주문에 현금영수증이 발급되었다면 마이페이지 주문
+function is_order_cashreceipt($od) {
+    if ($od['od_cash'] && $od['od_cash_no'] && $od['od_cash_info'] && $od['od_receipt_price'] && in_array($od['od_settle_case'], array('무통장', '계좌이체', '가상계좌'))) {
+        return true;
+    }
+
+    return false;
+}
+
 // 장바구니 금액 체크 $is_price_update 가 true 이면 장바구니 가격 업데이트한다. 
 function before_check_cart_price($s_cart_id, $is_ct_select_condition=false, $is_price_update=false, $is_item_cache=false){
    global $g5, $default, $config;
@@ -2635,6 +2651,15 @@ function make_order_field($data, $exclude)
    return $field;
 }

+function shop_order_data_fields($is_personal=0) {
+
+    if ($is_personal){
+        return array('pp_name', 'pp_email', 'pp_hp', 'pp_settle_case');
+    }
+
+    return array('od_price', 'od_name', 'od_tel', 'od_hp', 'od_email', 'od_memo', 'od_settle_case', 'max_temp_point', 'od_temp_point', 'od_bank_account', 'od_deposit_name', 'od_test', 'od_ip', 'od_zip', 'od_addr1', 'od_addr2', 'od_addr3', 'od_addr_jibeon', 'od_b_name', 'od_b_tel', 'od_b_hp', 'od_b_addr1', 'od_b_addr2', 'od_b_addr3', 'od_b_addr_jibeon', 'od_b_zip', 'od_send_cost', 'od_send_cost2', 'od_hope_date');
+}
+
 // 주문요청기록 로그를 남깁니다.
 function add_order_post_log($msg='', $code='error'){
    global $g5, $member;
@@ -2722,7 +2747,7 @@ function is_inicis_order_pay($type){
    return false;
 }

-function get_item_images_info($it, $size=array(), $image_width, $image_height){
+function get_item_images_info($it, $size=array(), $image_width=0, $image_height=0){
    
    if( !(is_array($it) && $it) ) return array();
    $images = array();
@@ -2745,6 +2770,39 @@ function get_item_images_info($it, $size=array(), $image_width, $image_height){
    return $images; 
 }

+function check_payment_method($od_settle_case) {
+    global $default;
+
+    $is_block = 0;
+
+    if ($od_settle_case === '무통장') {
+        if (! $default['de_bank_use']) {
+            $is_block = 1;
+        }
+    } else if ($od_settle_case === '계좌이체') {
+        if (! $default['de_iche_use']) {
+            $is_block = 1;
+        }
+    } else if ($od_settle_case === '가상계좌') {
+        if (! $default['de_vbank_use']) {
+            $is_block = 1;
+        }
+    } else if ($od_settle_case === '휴대폰') {
+        if (! $default['de_hp_use']) {
+            $is_block = 1;
+        }
+    } else if ($od_settle_case === '신용카드') {
+        if (! $default['de_card_use']) {
+            $is_block = 1;
+        }
+    }
+
+    if ($is_block) {
+        alert($od_settle_case.' 은 결제수단에서 사용이 금지되어 있습니다.', G5_SHOP_URL);
+        die('');
+    }
+}
+
 //결제방식 이름을 체크하여 치환 대상인 문자열은 따로 리턴합니다.
 function check_pay_name_replace($payname, $od=array(), $is_client=0){

@@ -10,15 +10,22 @@ function get_list_thumbnail($bo_table, $wr_id, $thumb_width, $thumb_height, $is_
    $filename = $alt = $data_path = '';
    $edt = false;

-    $row = get_thumbnail_find_cache($bo_table, $wr_id, 'file');
    $empty_array = array('src'=>'', 'ori'=>'', 'alt'=>'');

-    if(isset($row['bf_file']) && $row['bf_file']) {
+    $write = get_thumbnail_find_cache($bo_table, $wr_id, 'content');
+
+    // 비밀글이면 썸네일을 노출하지 않습니다.
+    if (isset($write['wr_option']) && strstr($write['wr_option'], "secret")) {
+        return run_replace('is_secret_list_thumbnail', $empty_array, $bo_table, $write);
+    }
+
+    $row = get_thumbnail_find_cache($bo_table, $wr_id, 'file');
+
+    if (isset($row['bf_file']) && $row['bf_file']) {
        $filename = $row['bf_file'];
        $filepath = G5_DATA_PATH.'/file/'.$bo_table;
        $alt = get_text($row['bf_content']);
    } else {
-        $write = get_thumbnail_find_cache($bo_table, $wr_id, 'content');
        $edt = true;
        
        if( $matches = get_editor_image($write['wr_content'], false) ){
@@ -253,10 +253,61 @@ function exist_seo_url($type, $seo_title, $write_table, $sql_id=0){
        return '';
 }

+function check_case_exist_title($data, $case=G5_BBS_DIR, $is_redirect=false) {
+    global $config, $g5, $board;
+
+    if ((int) $config['cf_bbs_rewrite'] !== 2) {
+        return;
+    }
+
+    $seo_title = '';
+    $redirect_url = '';
+
+    if ($case == G5_BBS_DIR && isset($data['wr_seo_title'])) {
+        $db_table = $g5['write_prefix'].$board['bo_table'];
+
+        if (exist_seo_url($case, $data['wr_seo_title'], $db_table, $data['wr_id'])) {
+            $seo_title = $data['wr_seo_title'].'-'.$data['wr_id'];
+            $sql = " update `{$db_table}` set wr_seo_title = '".sql_real_escape_string($seo_title)."' where wr_id = '{$data['wr_id']}' ";
+            sql_query($sql, false);
+
+            get_write($db_table, $data['wr_id'], false);
+            $redirect_url = get_pretty_url($board['bo_table'], $data['wr_id']);
+        }
+    } else if ($case == G5_CONTENT_DIR && isset($data['co_seo_title'])) {
+        $db_table = $g5['content_table'];
+
+        if (exist_seo_url($case, $data['co_seo_title'], $db_table, $data['co_id'])) {
+            $seo_title = $data['co_seo_title'].'-'.substr(get_random_token_string(4), 4);
+            $sql = " update `{$db_table}` set co_seo_title = '".sql_real_escape_string($seo_title)."' where co_id = '{$data['co_id']}' ";
+            sql_query($sql, false);
+            
+            get_content_db($data['co_id'], false);
+            g5_delete_cache_by_prefix('content-' . $data['co_id'] . '-');
+            $redirect_url = get_pretty_url($case, $data['co_id']);
+        }
+    } else if (defined('G5_SHOP_DIR') && $case == G5_SHOP_DIR && isset($data['it_seo_title'])) {
+        $db_table = $g5['g5_shop_item_table'];
+
+        if (shop_exist_check_seo_title($data['it_seo_title'], $case, $db_table, $data['it_id'])) {
+            $seo_title = $data['it_seo_title'].'-'.substr(get_random_token_string(4), 4);
+            $sql = " update `{$db_table}` set it_seo_title = '".sql_real_escape_string($seo_title)."' where it_id = '{$data['it_id']}' ";
+            sql_query($sql, false);
+
+            get_shop_item($data['it_id'], false);
+            $redirect_url = get_pretty_url($case, $data['it_id']);
+        }
+    }
+
+    if ($is_redirect && $seo_title && $redirect_url) {
+        goto_url($redirect_url);
+    }
+}
+
 function exist_seo_title_recursive($type, $seo_title, $write_table, $sql_id=0){
    static $count = 0;

-    $seo_title_add = ($count > 0) ? utf8_strcut($seo_title, 200 - ($count+1), '')."-$count" : $seo_title;
+    $seo_title_add = ($count > 0) ? utf8_strcut($seo_title, 100000 - ($count+1), '')."-$count" : $seo_title;

    if( ! exist_seo_url($type, $seo_title_add, $write_table, $sql_id) ){
        return $seo_title_add;
@@ -264,7 +315,7 @@ function exist_seo_title_recursive($type, $seo_title, $write_table, $sql_id=0){
    
    $count++;

-    if( $count > 198 ){
+    if( $count > 99998 ){
        return $seo_title_add;
    }

@@ -33,7 +33,7 @@ else
    $order_by = 'b.it_order, b.it_id desc';

 if ($skin) {
-    $skin = preg_replace('#\.+(\/|\\\)#', '', $skin);
+    $skin = preg_replace(array('#\.+(\/|\\\)#', '#[\'\"]#'), array('', ''), $skin);
    $ev['ev_skin'] = $skin;
 }

@@ -16,6 +16,8 @@ if( isset($row['it_seo_title']) && ! $row['it_seo_title'] ){
    shop_seo_title_update($row['it_id']);
 }

+if (function_exists('check_case_exist_title')) check_case_exist_title($it, G5_SHOP_DIR, true);
+
 if (!($it['ca_use'] && $it['it_use'])) {
    if (!$is_admin)
        alert('판매가능한 상품이 아닙니다.');
@@ -99,7 +99,7 @@ class PayService extends  SoapClient
    var   $resMsg;


-    public  function  PayService( $wsdl = "", $options = array() )
+    public function __construct( $wsdl = "", $options = array() )
    {
        foreach( self::$classmap as $key => $value )
        {
@@ -9,7 +9,6 @@
    /* =   Copyright (c)  2010.05   KCP Inc.   All Rights Reserved.                 = */
    /* ============================================================================== */

-
    /* ============================================================================== */
    /* =   환경 설정 파일 Include                                                   = */
    /* = -------------------------------------------------------------------------- = */
@@ -110,6 +109,24 @@
    /* = -------------------------------------------------------------------------- = */
    if ( $req_tx == "pay" )
    {
+        /* 1004원은 실제로 업체에서 결제하셔야 될 원 금액을 넣어주셔야 합니다. 결제금액 유효성 검증 */
+        $c_PayPlus->mf_set_ordr_data( "ordr_mony",  $good_mny );
+
+        $kcp_pay_type = '';   // 결제수단 검증 파라미터 pay_type (신용카드 : PACA, 계좌이체 : PABK, 가상계좌 : PAVC, 휴대폰 : PAMC)
+
+        if ($use_pay_method == "100000000000" && (in_array($od_settle_case, array('신용카드', '간편결제')))) {  // 신용카드
+            $kcp_pay_type = 'PACA';
+        } else if ($use_pay_method == "010000000000" && $od_settle_case === '계좌이체') {   // 계좌이체
+            $kcp_pay_type = 'PABK';
+        } else if ($use_pay_method == "001000000000" && $od_settle_case === '가상계좌') {   // 가상계좌
+            $kcp_pay_type = 'PAVC';
+        } else if ($use_pay_method == "000010000000" && $od_settle_case === '휴대폰') {   // 휴대폰
+            $kcp_pay_type = 'PAMC';
+        }
+
+        $c_PayPlus->mf_set_ordr_data( "pay_type",  $kcp_pay_type );
+        $c_PayPlus->mf_set_ordr_data( "ordr_no",  $ordr_idxx );
+
        $post_enc_data = isset($_POST["enc_data"]) ? $_POST["enc_data"] : '';
        $post_enc_info = isset($_POST["enc_info"]) ? $_POST["enc_info"] : '';

@@ -2,7 +2,7 @@
 // 해당 페이지는 사용자가 ISP{국민/BC) 카드 결제를 성공하였을 때, 사용자에게 보여지는 페이지입니다.
 include_once('./_common.php');

-$LGD_OID    = clean_xss_tags($_GET['LGD_OID']);
+$LGD_OID    = clean_xss_tags($_GET['LGD_OID'], 1, 1);

 echo "LGD_OID = ".$LGD_OID;

@@ -80,6 +80,8 @@ $payReqMap['LGD_HASHDATA']           = $LGD_HASHDATA;              // MD5 해쉬
 $payReqMap['LGD_RETURNURL']          = $LGD_RETURNURL;             // 응답수신페이지
 $payReqMap['LGD_VERSION']            = "PHP_SmartXPay_1.0";        // 버전정보 (삭제하지 마세요)
 $payReqMap['LGD_CUSTOM_FIRSTPAY']    = $LGD_CUSTOM_FIRSTPAY;       // 디폴트 결제수단
+// 2024년 7월에 모바일 결제수단 키가 LGD_CUSTOM_USABLEPAY 키로 쓰이는 것을 확인함
+$payReqMap['LGD_CUSTOM_USABLEPAY'] = $LGD_CUSTOM_FIRSTPAY;       // 디폴트 결제수단
 $payReqMap['LGD_CUSTOM_SWITCHINGTYPE']  = "SUBMIT";        // 신용카드 카드사 인증 페이지 연동 방식
 $payReqMap['LGD_ENCODING']           = "UTF-8";
 $payReqMap['LGD_ENCODING_NOTEURL']   = "UTF-8";
@@ -137,9 +139,9 @@ include_once(G5_PATH.'/head.sub.php');
 ?>

 <?php if ($default['de_card_test']) {   // 테스트 결제시 ?>
-<script language="javascript" src="https://pretest.uplus.co.kr:9443/xpay/js/xpay_crossplatform.js" type="text/javascript"></script>
+<script language="javascript" src="https://js.tosspayments.com/xpay_crossplatform/sandbox/v1" type="text/javascript"></script>
 <?php } else {      //실 결제시 ?>
-<script language="javascript" src="//xpay.uplus.co.kr/xpay/js/xpay_crossplatform.js" type="text/javascript"></script>
+<script language="javascript" src="https://xpay.tosspayments.com/xpay/js/xpay_crossplatform.js" type="text/javascript"></script>
 <?php } ?>

 <script type="text/javascript">
@@ -168,7 +168,7 @@ var g5_shop_url = "<?php echo G5_SHOP_URL; ?>";

    <?php
    $qstr1 = '';
-    if($i > 0 && $total_count > $items) {
+    if($total_count > $items) {
        $qstr1 .= 'ca_id='.$ca_id;
        $qstr1 .='&sort='.$sort.'&sortodr='.$sortodr;
        $ajax_url = G5_SHOP_URL.'/ajax.list.php?'.$qstr1.'&use_sns=1';
@@ -32,7 +32,7 @@ else
 if (!$skin)
    $skin = $default['de_mobile_listtype_list_skin'];
 else
-    $skin = preg_replace('#\.+[\\\/]#', '', $skin);
+    $skin = preg_replace('#\.+[\\\/]#', '', strip_tags($skin));

 define('G5_SHOP_CSS_URL', G5_MSHOP_SKIN_URL);

@@ -65,7 +65,7 @@ if (file_exists($list_file)) {
 }
 else
 {
-    echo '<div align="center">'.$skin.' 파일을 찾을 수 없습니다.<br>관리자에게 알려주시면 감사하겠습니다.</div>';
+    echo '<div align="center">'.get_text($skin).' 파일을 찾을 수 없습니다.<br>관리자에게 알려주시면 감사하겠습니다.</div>';
 }
 ?>
 </div>
@@ -0,0 +1,6 @@
+<?php
+include_once('../../../common.php');
+
+if (!defined('G5_USE_SHOP') || !G5_USE_SHOP)
+    die('<p>쇼핑몰 설치 후 이용해 주십시오.</p>');
+define('_SHOP_', true);
@@ -0,0 +1,2 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
@@ -0,0 +1,190 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
+
+// 나이스페이 공통 설정
+require_once(G5_MSHOP_PATH.'/settle_nicepay.inc.php');
+
+/*
+****************************************************************************************
+* <Authentication Result Parameter>
+****************************************************************************************
+*/
+$authResultCode = isset($_POST['AuthResultCode']) ? clean_xss_tags($_POST['AuthResultCode']) : '';		// authentication result code 0000:success
+$authResultMsg = isset($_POST['AuthResultMsg']) ? clean_xss_tags($_POST['AuthResultMsg']) : '';		// authentication result message
+$nextAppURL = isset($_POST['NextAppURL']) ? clean_xss_tags($_POST['NextAppURL']) : '';				// authorization request URL
+$txTid = isset($_POST['TxTid']) ? clean_xss_tags($_POST['TxTid']) : '';						// transaction ID
+$authToken = isset($_POST['AuthToken']) ? clean_xss_tags($_POST['AuthToken']) : '';				// authentication TOKEN
+$payMethod = isset($_POST['PayMethod']) ? clean_xss_tags($_POST['PayMethod']) : '';				// payment method
+$mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : '';							// merchant id
+$moid = isset($_POST['Moid']) ? clean_xss_tags($_POST['Moid']) : '';							// order number
+$amt = isset($_POST['Amt']) ? (int) preg_replace('/[^0-9]/', '', $_POST['Amt']) : 0;							// Amount of payment
+$reqReserved = isset($_POST['ReqReserved']) ? clean_xss_tags($_POST['ReqReserved']) : '';			// mall custom field 
+$netCancelURL = isset($_POST['NetCancelURL']) ? clean_xss_tags($_POST['NetCancelURL']) : '';			// netCancelURL
+
+if (isset($pp['pp_id']) && $pp['pp_id']) {   //개인결제
+    $session_order_id = get_session('ss_personalpay_id');
+    $order_price = (int) $pp['pp_price'];
+} else {
+    $session_order_id = get_session('ss_order_id');     // 쇼핑몰 일반결제
+}
+
+if ($session_order_id != $moid){
+    alert("요청한 주문번호가 틀려서 결제를 진행할수 없습니다.\\n다시 장바구니에서 시도해 주세요.", G5_SHOP_URL);
+}
+
+if ($default['de_nicepay_mid'] != $mid) {
+    alert("요청한 상점 mid와 설정된 mid가 틀리므로 결제를 진행할수 없습니다.", G5_SHOP_URL);
+}
+
+if ($order_price != $amt) {
+    alert("요청한 결제금액이 틀리므로 결제를 진행할수 없습니다.", G5_SHOP_URL);
+}
+
+// API CALL foreach example
+if (! function_exists('jsonRespDump')) {
+    function jsonRespDump($resp){
+        $respArr = json_decode($resp);
+        foreach ( $respArr as $key => $value ){
+            echo "$key=". $value."<br />";
+        }
+    }
+}
+
+if (! function_exists('nicepay_res')) {
+    function nicepay_res($key, $data, $default_val='') {
+        $response_val = isset($data[$key]) ? $data[$key] : $default_val;
+
+        return ($response_val ? $response_val : $default_val);
+    }
+}
+
+/*
+****************************************************************************************
+* <authorization parameters init>
+****************************************************************************************
+*/
+$response = "";
+
+if($authResultCode === "0000"){
+	/*
+	****************************************************************************************
+	* <Hash encryption> (do not modify)
+	****************************************************************************************
+	*/
+	$ediDate = preg_replace('/[^0-9]/', '', G5_TIME_YMDHIS);
+	$merchantKey = $default['de_nicepay_key']; // 상점키
+	$signData = bin2hex(hash('sha256', $authToken . $mid . $amt . $ediDate . $merchantKey, true));
+
+	try{
+		$data = Array(
+			'TID' => $txTid,
+			'AuthToken' => $authToken,
+			'MID' => $mid,
+			'Amt' => $amt,
+			'EdiDate' => $ediDate,
+			'SignData' => $signData,
+			'CharSet' => 'utf-8'
+		);		
+		/*
+		****************************************************************************************
+		* <authorization request>
+		* authorization through server to server communication.
+		****************************************************************************************
+
+        // 3001 : 신용카드 성공코드
+        // 4000 : 계좌이체 성공코드
+        // 4100 : 가상계좌 발급 성공코드
+        // A000 : 휴대폰 소액결제 성공코드
+        // 7001 : 현금영수증
+        // https://developers.nicepay.co.kr/manual-auth.php
+		*/			
+		$response = nicepay_reqPost($data, $nextAppURL);
+        $respArr = json_decode($response, true);
+        
+        $ResultCode = nicepay_res('ResultCode', $respArr);
+        $ResultMsg = nicepay_res('ResultMsg', $respArr);
+        $tno             = nicepay_res('TID', $respArr);
+        $amount          = (int) nicepay_res('Amt', $respArr, 0);
+        $app_time        = nicepay_res('AuthDate', $respArr);
+        $pay_method = nicepay_res('PayMethod', $respArr);
+        $od_app_no = $app_no    = nicepay_res('AuthCode', $respArr); // 승인 번호  (신용카드, 계좌이체, 휴대폰)
+        $pay_type   = $NICEPAY_METHOD[$pay_method];
+
+        // 승인된 코드가 아니면 결제가 되지 않게 합니다.
+        if (! in_array($ResultCode, array('3001', '4000', '4100', 'A000', '7001'))) {
+            alert($ResultMsg.' 코드 : '.$ResultCode, G5_SHOP_URL);
+            die();
+        }
+
+        if ($ResultCode == '3001') {    // 신용카드
+
+            $card_cd   = nicepay_res('CardCode', $respArr); // 카드사 코드
+            $card_name = nicepay_res('CardName', $respArr); // 카드 종류
+
+        } else if ($ResultCode == '4100') {    // 가상계좌
+
+            $bank_name = $bankname = nicepay_res('VbankBankName', $respArr);
+            $account   = nicepay_res('VbankNum', $respArr);
+            $va_date   = nicepay_res('VbankExpDate', $respArr).' '.nicepay_res('VbankExpTime', $respArr); // 가상계좌 입금마감시간
+            $app_no    = nicepay_res('VbankNum', $respArr);
+
+            if ($default['de_escrow_use'] == 1)
+                $escw_yn         = 'Y';
+
+        } else if ($ResultCode == '4000') {     // 계좌이체
+            $bank_name = $bankname = nicepay_res('BankName', $respArr);
+            $bank_code = nicepay_res('BankCode', $respArr);
+
+            $RcptType = nicepay_res('RcptType', $respArr); // 현금영수증타입 (0:발행안함,1:소득공제,2:지출증빙)
+            $RcptTID = nicepay_res('RcptTID', $respArr); // 현금영수증 TID, 현금영수증 거래인 경우 리턴
+            $RcptAuthCode = nicepay_res('RcptAuthCode', $respArr); // 현금영수증 승인번호, 현금영수증 거래인 경우 리턴
+            $AuthDate = nicepay_res('AuthDate', $respArr); // 현금영수증 승인번호, 현금영수증 거래인 경우 리턴
+
+            // 현금영수증 발급시 1 또는 2 이면
+            if ($RcptType) {
+                $pg_receipt_infos['od_cash'] = 1;   // 현금영수증 발급인것으로 처리
+                $pg_receipt_infos['od_cash_no'] = $RcptAuthCode;    // 현금영수증 승인번호
+                $pg_receipt_infos['od_cash_info'] = serialize(array('TID'=>$RcptTID, 'ApplNum'=>$RcptAuthCode, 'AuthDate'=>$AuthDate));
+            }
+
+            if ($default['de_escrow_use'] == 1)
+                $escw_yn         = 'Y';
+
+        }
+        $depositor       = '';  // 입금할 계좌 예금주 (나이스페이 경우 가상계좌의 예금주명을 리턴받지 못합니다. )
+        $account         = nicepay_res('VbankNum', $respArr);
+        $commid          = '';    // 통신사 코드
+        $mobile_no       = '';    // 휴대폰결제시 휴대폰번호 (나이스페이 경우 결제한 휴대폰번호를 리턴받지 못합니다.)
+        $card_name       = nicepay_res('CardName', $respArr);
+
+	} catch(Exception $e) {
+		$e->getMessage();
+		$data = Array(
+			'TID' => $txTid,
+			'AuthToken' => $authToken,
+			'MID' => $mid,
+			'Amt' => $amt,
+			'EdiDate' => $ediDate,
+			'SignData' => $signData,
+			'NetCancel' => '1',
+			'CharSet' => 'utf-8'
+		);
+		/*
+		*************************************************************************************
+		* <NET CANCEL>
+		* If an exception occurs during communication, cancelation is recommended
+		*************************************************************************************
+		*/			
+		$response = nicepay_reqPost($data, $netCancelURL);
+		// jsonRespDump($response);
+
+        alert("결제 오류로 더 이상 진행할수 없습니다.");
+	}	
+	
+} else {
+	//When authentication fail
+	$ResultCode = $authResultCode; 	
+	$ResultMsg = $authResultMsg;
+
+    alert($ResultMsg.' 실패 코드 : '.$ResultCode);
+}
@@ -0,0 +1,140 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
+?>
+
+<!-- PC payment window only (not required for mobile payment window)-->
+<script src="https://web.nicepay.co.kr/v3/webstd/js/nicepay-3.0.js" type="text/javascript"></script>
+<script type="text/javascript">
+//It is executed when call payment window.
+function nicepayStart(f){
+	if(checkPlatform(window.navigator.userAgent) == "mobile"){
+		document.sm_form.action = "https://web.nicepay.co.kr/v3/v3Payment.jsp";
+		document.sm_form.acceptCharset="euc-kr";
+		document.sm_form.submit();
+	}else{
+		goPay(document.sm_form);
+	}
+}
+
+//[PC Only]When pc payment window is closed, nicepay-3.0.js call back nicepaySubmit() function <<'nicepaySubmit()' DO NOT CHANGE>>
+function nicepaySubmit(){
+	document.sm_form.submit();
+}
+
+//[PC Only]payment window close function <<'nicepayClose()' DO NOT CHANGE>>
+function nicepayClose(){
+	alert("payment window is closed");
+}
+
+//pc, mobile chack script (sample code)
+function checkPlatform(ua) {
+	if(ua === undefined) {
+		ua = window.navigator.userAgent;
+	}
+	
+	ua = ua.toLowerCase();
+	var platform = {};
+	var matched = {};
+	var userPlatform = "pc";
+	var platform_match = /(ipad)/.exec(ua) || /(ipod)/.exec(ua) 
+		|| /(windows phone)/.exec(ua) || /(iphone)/.exec(ua) 
+		|| /(kindle)/.exec(ua) || /(silk)/.exec(ua) || /(android)/.exec(ua) 
+		|| /(win)/.exec(ua) || /(mac)/.exec(ua) || /(linux)/.exec(ua)
+		|| /(cros)/.exec(ua) || /(playbook)/.exec(ua)
+		|| /(bb)/.exec(ua) || /(blackberry)/.exec(ua)
+		|| [];
+	
+	matched.platform = platform_match[0] || "";
+	
+	if(matched.platform) {
+		platform[matched.platform] = true;
+	}
+	
+	if(platform.android || platform.bb || platform.blackberry
+			|| platform.ipad || platform.iphone 
+			|| platform.ipod || platform.kindle 
+			|| platform.playbook || platform.silk
+			|| platform["windows phone"]) {
+		userPlatform = "mobile";
+	}
+	
+	if(platform.cros || platform.mac || platform.linux || platform.win) {
+		userPlatform = "pc";
+	}
+	
+	return userPlatform;
+}
+
+function nicepay_create_signdata(frm)
+{
+    // 데이터 암호화 처리
+    var result = true;
+    $.ajax({
+        url: g5_url+"/shop/nicepay/createsigndata.php",
+        type: "POST",
+        data: {
+            price : frm.good_mny.value
+        },
+        dataType: "json",
+        async: false,
+        cache: false,
+        success: function(data) {
+            if(data.error == "") {
+                frm.EdiDate.value = data.ediDate;
+                frm.SignData.value = data.SignData;
+            } else {
+                alert(data.error);
+                result = false;
+            }
+        }
+    });
+
+    return result;
+}
+</script>
+
+<form name="sm_form" method="post" action="" accept-charset="euc-kr">
+<input type="hidden" name="PayMethod" value="CARD">
+<input type="hidden" name="GoodsName" value="<?php echo get_text($goods); ?>">
+<input type="hidden" name="Amt" value="<?php echo $tot_price; ?>">
+<input type="hidden" name="MID" value="<?php echo $default['de_nicepay_mid']; ?>">
+<input type="hidden" name="Moid" value="<?php echo $od_id; ?>">
+<input type="hidden" name="BuyerName" value="">
+<input type="hidden" name="BuyerEmail" value="">
+<input type="hidden" name="BuyerTel" value="">
+<input type="hidden" name="ReturnURL" value="<?php echo $nicepay_returnURL; ?>">
+<input type="hidden" name="VbankExpDate" value="">
+<input type="hidden" name="NpLang" value="KO"> <!-- EN:English, CN:Chinese, KO:Korean -->
+<input type="hidden" name="GoodsCl" value="1">	<!-- products(1), contents(0)) -->
+<input type="hidden" name="TransType" value="<?php echo $default['de_escrow_use'] ? '1' : '0';?>">	<!-- USE escrow false(0)/true(1) --> 
+<input type="hidden" name="CharSet" value="utf-8">	<!-- Return CharSet -->
+<input type="hidden" name="ReqReserved" value="">	<!-- mall custom field -->
+<input type="hidden" name="EdiDate" value=""> <!-- YYYYMMDDHHMISS -->
+<input type="hidden" name="SignData" value="">	<!-- EncryptData -->
+
+<input type="hidden" name="DirectShowOpt" value=""> 
+<input type="hidden" name="SelectCardCode" value=""> <!-- 카드사 노출 제한, 카드코드 값(ex 비씨:01, 삼성:04) -->
+<input type="hidden" name="NicepayReserved" value="">   <!-- 간편결제 (카카오페이에 사용됨) -->
+<input type="hidden" name="DirectEasyPay"> <!-- 간편결제 요청 값 (네이버페이에 사용됨) -->
+<input type="hidden" name="EasyPayMethod">  <!-- 간편결제 (네이버페이에 사용됨) -->
+<input type="hidden" name="EasyPayCardCode"> <!-- 간편결제 카드 코드 -->
+<input type="hidden" name="EasyPayQuota"> <!-- 간편결제 할부개월 (3개월일 경우 03 으로 설정) -->
+<input type="hidden" name="MultiEasyPayQuota"> <!-- 간편결제 할부개월 다중 설정 옵션 PAYCO와 네이버페이만 가능 -->
+
+<input type="hidden" name="good_mny"     value="<?php echo $tot_price; ?>" >
+
+<?php if ($default['de_tax_flag_use']) { ?>
+<!-- 필드명:SupplyAmt / 사이즈:12 / 설명:공급가 액 -->
+<input type="hidden" name="SupplyAmt" value="<?php echo $comm_tax_mny; ?>"> <!-- 과세금액    -->
+<!-- 필드명:GoodsVat / 사이즈:12 / 설명:부가가 치세 -->
+<input type="hidden" name="GoodsVat" value="<?php echo $comm_vat_mny; ?>">  <!-- 부가세	    -->
+<!-- 필드명:ServiceAmt / 사이즈:12 / 설명:봉사료 -->
+<input type="hidden" name="ServiceAmt" value="0">
+<!-- 필드명:TaxFreeAmt / 사이즈:12 / 설명:면세 금액 -->
+<input type="hidden" name="TaxFreeAmt" value="<?php echo $comm_free_mny; ?>">
+
+<input type="hidden" name="comm_tax_mny"	  value="<?php echo $comm_tax_mny; ?>">         <!-- 과세금액    -->
+<input type="hidden" name="comm_vat_mny"      value="<?php echo $comm_vat_mny; ?>">         <!-- 부가세	    -->
+<input type="hidden" name="comm_free_mny"     value="<?php echo $comm_free_mny; ?>">        <!-- 비과세 금액 -->
+<?php } ?>
+</form>
@@ -0,0 +1,17 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
+?>
+
+<input type="hidden" name="good_mny"          value="<?php echo $tot_price ?>" >
+
+<?php if($default['de_tax_flag_use']) { ?>
+<input type="hidden" name="comm_tax_mny"      value="<?php echo $comm_tax_mny; ?>">         <!-- 과세금액    -->
+<input type="hidden" name="comm_vat_mny"      value="<?php echo $comm_vat_mny; ?>">         <!-- 부가세     -->
+<input type="hidden" name="comm_free_mny"     value="<?php echo $comm_free_mny; ?>">        <!-- 비과세 금액 -->
+<?php } ?>
+
+<div id="display_pay_button" class="btn_confirm">
+    <span id="show_req_btn"><input type="button" name="submitChecked" onClick="pay_approval();" value="결제등록" class="btn_submit"></span>
+    <span id="show_pay_btn" style="display:none;"><input type="button" onClick="forderform_check();" value="주문하기" class="btn_submit"></span>
+    <a href="<?php echo G5_SHOP_URL; ?>" class="btn_cancel">취소</a>
+</div>
@@ -0,0 +1,2 @@
+<?php
+if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가;
@@ -0,0 +1,87 @@
+<?php
+include_once('./_common.php');
+include_once(G5_MSHOP_PATH.'/settle_nicepay.inc.php');
+
+$authResultCode = isset($_POST['AuthResultCode']) ? clean_xss_tags($_POST['AuthResultCode']) : '';		// authentication result code 0000:success
+$authResultMsg = isset($_POST['AuthResultMsg']) ? clean_xss_tags($_POST['AuthResultMsg']) : '';		// authentication result message
+$mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : '';							// merchant id
+$moid = isset($_POST['Moid']) ? clean_xss_tags($_POST['Moid']) : '';							// order number
+
+$sql = " select * from {$g5['g5_shop_order_data_table']} where od_id = '$moid' ";
+$row = sql_fetch($sql);
+
+if (empty($row)) {
+    die('');
+}
+
+$data = unserialize(base64_decode($row['dt_data']));
+
+if(isset($data['pp_id']) && $data['pp_id']) {
+    $order_action_url = G5_HTTPS_MSHOP_URL.'/personalpayformupdate.php';
+    $page_return_url  = G5_SHOP_URL.'/personalpayform.php?pp_id='.$data['pp_id'];
+} else {
+    $order_action_url = G5_HTTPS_MSHOP_URL.'/orderformupdate.php';
+    $page_return_url  = G5_SHOP_URL.'/orderform.php';
+    if($_SESSION['ss_direct'])
+        $page_return_url .= '?sw_direct=1';
+}
+
+$params = array();
+$var_datas = array();
+
+foreach($data as $key=>$value) {
+    if(is_array($value)) {
+        foreach($value as $k=>$v) {
+            $_POST[$key][$k] = $params[$key][$k] = clean_xss_tags(strip_tags($v));
+        }
+    } else {
+        if(in_array($key, array('od_memo'))){
+            $_POST[$key] = $params[$key] = clean_xss_tags(strip_tags($value), 0, 0, 0, 0);
+        } else {
+            $_POST[$key] = $params[$key] = clean_xss_tags(strip_tags($value));
+        }
+    }
+}
+
+// 성공했다면
+if ($authResultCode === '0000') {
+
+    if(isset($data['pp_id']) && $data['pp_id']) {   //개인결제
+
+        foreach($params as $key=>$value){
+
+            if( in_array($key, shop_order_data_fields(1)) ){
+
+                $var_datas[$key] = $value;
+                
+                $$key = $value;
+            }
+
+        }
+        
+        include_once(G5_MSHOP_PATH.'/personalpayformupdate.php');
+
+    } else {    //상점주문
+
+        foreach($params as $key=>$value){
+
+            if( in_array($key, shop_order_data_fields()) ){
+
+                $var_datas[$key] = $value;
+                
+                $$key = $value;
+            }
+
+        }
+
+        $od_send_cost = (int) $_POST['od_send_cost'];
+        $od_send_cost2 = (int) $_POST['od_send_cost2'];
+
+        include_once(G5_MSHOP_PATH.'/orderformupdate.php');
+    }
+
+} else {
+    // 실패시
+
+    alert('오류 : '.$authResultMsg.' 코드 : '.$authResultCode, $page_return_url);
+}
@@ -613,19 +613,49 @@ if($is_kakaopay_use) {

            $multi_settle++;

-            if($default['de_pg_service'] === 'kcp' && isset($default['de_easy_pay_services']) && $default['de_easy_pay_services']){
+            if (in_array($default['de_pg_service'], array('kcp', 'nicepay')) && isset($default['de_easy_pay_services']) && $default['de_easy_pay_services']) {
                $de_easy_pay_service_array = explode(',', $default['de_easy_pay_services']);
-                if( in_array('nhnkcp_payco', $de_easy_pay_service_array) ){
-                    $easypay_prints['nhnkcp_payco'] = '<li><input type="radio" id="od_settle_nhnkcp_payco" name="od_settle_case" data-pay="payco" value="간편결제"> <label for="od_settle_nhnkcp_payco" class="PAYCO nhnkcp_payco lb_icon" title="NHN_KCP - PAYCO">PAYCO</label></li>';
+
+                if ($default['de_pg_service'] === 'kcp') {
+                    if( in_array('nhnkcp_payco', $de_easy_pay_service_array) ){
+                        $easypay_prints['nhnkcp_payco'] = '<li><input type="radio" id="od_settle_nhnkcp_payco" name="od_settle_case" data-pay="payco" value="간편결제"> <label for="od_settle_nhnkcp_payco" class="PAYCO nhnkcp_payco lb_icon" title="NHN_KCP - PAYCO">PAYCO</label></li>';
+                    }
+                    if( in_array('nhnkcp_naverpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nhnkcp_naverpay'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label></li>';
+                    }
+                    if( in_array('nhnkcp_kakaopay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nhnkcp_kakaopay'] = '<li><input type="radio" id="od_settle_nhnkcp_kakaopay" name="od_settle_case" data-pay="kakaopay" value="간편결제" > <label for="od_settle_nhnkcp_kakaopay" class="kakaopay_icon nhnkcp_kakaopay lb_icon" title="NHN_KCP - 카카오페이">카카오페이</label></li>';
+                    }
+                } else if ($default['de_pg_service'] === 'nicepay') {
+                    if( in_array('nicepay_samsungpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_samsungpay'] = '<li><input type="radio" id="od_settle_nicepay_samsungpay" name="od_settle_case" data-pay="nice_samsungpay" value="간편결제"> <label for="od_settle_nicepay_samsungpay" class="samsung_pay nice_samsungpay lb_icon" title="NICEPAY - 삼성페이">삼성페이</label></li>';
+                    }
+                    if( in_array('nicepay_naverpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_naverpay'] = '<li><input type="radio" id="od_settle_nicepay_naverpay" name="od_settle_case" data-pay="nice_naverpay" value="간편결제" > <label for="od_settle_nicepay_naverpay" class="naverpay_icon nicepay_naverpay lb_icon" title="NICEPAY - 네이버페이">네이버페이</label></li>';
+                    }
+                    if( in_array('nicepay_kakaopay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_kakaopay'] = '<li><input type="radio" id="od_settle_nicepay_kakaopay" name="od_settle_case" data-pay="nice_kakaopay" value="간편결제" > <label for="od_settle_nicepay_kakaopay" class="kakaopay_icon nicepay_kakaopay lb_icon" title="NICEPAY - 카카오페이">카카오페이</label></li>';
+                    }
+                    if( in_array('nicepay_paycopay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_paycopay'] = '<li><input type="radio" id="od_settle_nicepay_paycopay" name="od_settle_case" data-pay="nice_paycopay" value="간편결제" > <label for="od_settle_nicepay_paycopay" class="paycopay_icon nicepay_paycopay lb_icon" title="NICEPAY - 페이코">페이코</label></li>';
+                    }
+                    if( in_array('nicepay_skpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_skpay'] = '<li><input type="radio" id="od_settle_nicepay_skpay" name="od_settle_case" data-pay="nice_skpay" value="간편결제" > <label for="od_settle_nicepay_skpay" class="skpay_icon nicepay_skpay lb_icon" title="NICEPAY - SK페이">SK페이</label></li>';
+                    }
+                    if( in_array('nicepay_ssgpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_ssgpay'] = '<li><input type="radio" id="od_settle_nicepay_ssgpay" name="od_settle_case" data-pay="nice_ssgpay" value="간편결제" > <label for="od_settle_nicepay_ssgpay" class="ssgpay_icon nicepay_ssgpay lb_icon" title="NICEPAY - SSGPAY">SSGPAY</label></li>';
+                    }
+                    if( in_array('nicepay_lpay', $de_easy_pay_service_array) ){
+                        $easypay_prints['nicepay_lpay'] = '<li><input type="radio" id="od_settle_nicepay_lpay" name="od_settle_case" data-pay="nice_lpay" value="간편결제" > <label for="od_settle_nicepay_lpay" class="lpay_icon nicepay_lpay lb_icon" title="NICEPAY - LPAY">LPAY</label></li>';
+                    }
                }
-                if( in_array('nhnkcp_naverpay', $de_easy_pay_service_array) ){
-                    $easypay_prints['nhnkcp_naverpay'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label></li>';
-                }
-                if( in_array('nhnkcp_kakaopay', $de_easy_pay_service_array) ){
-                    $easypay_prints['nhnkcp_kakaopay'] = '<li><input type="radio" id="od_settle_nhnkcp_kakaopay" name="od_settle_case" data-pay="kakaopay" value="간편결제" > <label for="od_settle_nhnkcp_kakaopay" class="kakaopay_icon nhnkcp_kakaopay lb_icon" title="NHN_KCP - 카카오페이">카카오페이</label></li>';
-                }
-                if( in_array('nhnkcp_applepay', $de_easy_pay_service_array) && preg_match('~^(?:(?:(?:Mozilla/\d\.\d\s*\()+|Mobile\s*Safari\s*\d+\.\d+(\.\d+)?\s*)(?:iPhone(?:\s+Simulator)?|iPad|iPod);\s*(?:U;\s*)?(?:[a-z]+(?:-[a-z]+)?;\s*)?CPU\s*(?:iPhone\s*)?(?:OS\s*\d+_\d+(?:_\d+)?\s*)?(?:like|comme)\s*Mac\s*O?S?\s*X(?:;\s*[a-z]+(?:-[a-z]+)?)?\)\s*)?(?:AppleWebKit/\d+(?:\.\d+(?:\.\d+)?|\s*\+)?\s*)?(?:\(KHTML,\s*(?:like|comme)\s*Gecko\s*\)\s*)?(?:Version/\d+\.\d+(?:\.\d+)?\s*)?(?:Mobile/\w+\s*)?(?:Safari/\d+\.\d+(?:\.\d+)?.*)?$~', $_SERVER['HTTP_USER_AGENT']) ){
-                    $easypay_prints['nhnkcp_applepay'] = '<li><input type="radio" id="od_settle_nhnkcp_applepay" name="od_settle_case" data-pay="applepay" value="간편결제" > <label for="od_settle_nhnkcp_applepay" class="applepay_icon nhnkcp_applepay lb_icon" title="NHN_KCP - 애플페이">애플페이</label></li>';
+
+                if( (in_array('nhnkcp_applepay', $de_easy_pay_service_array) || in_array('nicepay_applepay', $de_easy_pay_service_array)) && preg_match('~^(?:(?:(?:Mozilla/\d\.\d\s*\()+|Mobile\s*Safari\s*\d+\.\d+(\.\d+)?\s*)(?:iPhone(?:\s+Simulator)?|iPad|iPod);\s*(?:U;\s*)?(?:[a-z]+(?:-[a-z]+)?;\s*)?CPU\s*(?:iPhone\s*)?(?:OS\s*\d+_\d+(?:_\d+)?\s*)?(?:like|comme)\s*Mac\s*O?S?\s*X(?:;\s*[a-z]+(?:-[a-z]+)?)?\)\s*)?(?:AppleWebKit/\d+(?:\.\d+(?:\.\d+)?|\s*\+)?\s*)?(?:\(KHTML,\s*(?:like|comme)\s*Gecko\s*\)\s*)?(?:Version/\d+\.\d+(?:\.\d+)?\s*)?(?:Mobile/\w+\s*)?(?:Safari/\d+\.\d+(?:\.\d+)?.*)?$~', $_SERVER['HTTP_USER_AGENT']) ){
+                    if ($default['de_pg_service'] === 'kcp' && in_array('nhnkcp_applepay', $de_easy_pay_service_array)) {
+                        $easypay_prints['nhnkcp_applepay'] = '<li><input type="radio" id="od_settle_nhnkcp_applepay" name="od_settle_case" data-pay="applepay" value="간편결제" > <label for="od_settle_nhnkcp_applepay" class="applepay_icon nhnkcp_applepay lb_icon" title="NHN_KCP - 애플페이">애플페이</label></li>';
+                    } else if ($default['de_pg_service'] === 'nicepay' && in_array('nicepay_applepay', $de_easy_pay_service_array)) {
+                        $easypay_prints['nicepay_applepay'] = '<li><input type="radio" id="od_settle_nicepay_applepay" name="od_settle_case" data-pay="nice_applepay" value="간편결제" > <label for="od_settle_nicepay_applepay" class="applepay_icon nicepay_applepay lb_icon" title="NICEPAY - 애플페이">애플페이</label></li>';
+                    }
                }
            } else {
                $easypay_prints[strtolower($pg_easy_pay_name)] = '<li><input type="radio" id="od_settle_easy_pay" name="od_settle_case" value="간편결제" '.$checked.'> <label for="od_settle_easy_pay" class="'.$pg_easy_pay_name.' lb_icon">'.$pg_easy_pay_name.'</label></li>';
@@ -1263,7 +1293,7 @@ function pay_approval()
        var send_coupon = parseInt(pf.od_send_coupon.value);
        f.good_mny.value = od_price + send_cost + send_cost2 - send_coupon - temp_point;
    }
-
+    
    // 카카오페이 지불
    if(settle_method == "KAKAOPAY") {
        <?php if($default['de_tax_flag_use']) { ?>
@@ -1417,6 +1447,86 @@ function pay_approval()
        <?php } ?>
        f.P_RETURN_URL.value = "<?php echo $return_url.$od_id; ?>";
        f.action = "https://mobile.inicis.com/smart/" + paymethod + "/";
+        <?php } else if($default['de_pg_service'] == 'nicepay') { ?>
+
+        f.Amt.value       = f.good_mny.value;
+        f.BuyerName.value   = pf.od_name.value;
+        f.BuyerEmail.value  = pf.od_email.value;
+        f.BuyerTel.value    = pf.od_hp.value ? pf.od_hp.value : pf.od_tel.value;
+
+        f.DirectShowOpt.value = "";     // 간편결제 요청 값 초기화
+        f.DirectEasyPay.value = "";     // 간편결제 요청 값 초기화
+        f.NicepayReserved.value = "";   // 간편결제 요청 값 초기화
+        f.EasyPayMethod.value = "";   // 간편결제 요청 값 초기화
+
+            <?php if ($default['de_escrow_use']) {  // 간편결제시 에스크로값이 0이 되므로 기본설정값을 지정 ?>
+            f.TransType.value = "1";
+            <?php } ?>
+
+        switch(settle_method) {
+            case "계좌이체":
+                paymethod = "BANK";
+                break;
+            case "가상계좌":
+                paymethod = "VBANK";
+                break;
+            case "휴대폰":
+                paymethod = "CELLPHONE";
+                break;
+            case "신용카드":
+                paymethod = "CARD";
+                break;
+            case "간편결제":
+                paymethod = "CARD";
+                f.DirectShowOpt.value = "CARD";
+                f.TransType.value = "0";    // 간편결제의 경우 에스크로를 사용할수 없다.
+
+                var nicepay_easy_pay = jQuery("input[name='od_settle_case']:checked" ).attr("data-pay");
+
+                if(nicepay_easy_pay === "nice_naverpay"){
+                    if(typeof f.DirectEasyPay !== "undefined") f.DirectEasyPay.value = "E020";
+                    
+                    <?php 
+                        // * 카드 선택 시 전액 카드로 결제, 포인트 선택 시 전액 포인트로 결제.
+                        // (카드와 포인트를 같이 사용하는 복합결제 형태의 결제는 불가함.)
+                        // - 카드: EasyPayMethod=”E020=CARD”, 포인트: EasyPayMethod=”E020=POINT”
+                    ?>
+                    
+                    if(typeof f.EasyPayMethod !== "undefined") f.EasyPayMethod.value = "E020=CARD";
+
+                } else if(nicepay_easy_pay === "nice_kakaopay"){
+                    if(typeof f.NicepayReserved !== "undefined") f.NicepayReserved.value = "DirectKakao=Y";
+                } else if(nicepay_easy_pay === "nice_samsungpay"){
+                    if(typeof f.DirectEasyPay !== "undefined") f.DirectEasyPay.value = "E021";
+                } else if(nicepay_easy_pay === "nice_applepay"){
+                    if(typeof f.DirectEasyPay !== "undefined") f.DirectEasyPay.value = "E022";
+                } else if(nicepay_easy_pay === "nice_paycopay"){
+                    if(typeof f.NicepayReserved !== "undefined") f.NicepayReserved.value = "DirectPayco=Y";
+                } else if(nicepay_easy_pay === "nice_skpay"){
+                    if(typeof f.NicepayReserved !== "undefined") f.NicepayReserved.value = "DirectPay11=Y";
+                } else if(nicepay_easy_pay === "nice_ssgpay"){
+                    if(typeof f.DirectEasyPay !== "undefined") f.DirectEasyPay.value = "E007";
+                } else if(nicepay_easy_pay === "nice_lpay"){
+                    if(typeof f.DirectEasyPay !== "undefined") f.DirectEasyPay.value = "E018";
+                }
+
+                break;
+            default:
+                paymethod = "무통장";
+                break;
+        }
+        
+        f.PayMethod.value = paymethod;
+
+        <?php if($default['de_tax_flag_use']) { ?>
+        f.SupplyAmt.value = pf.comm_tax_mny.value;
+        f.GoodsVat.value = pf.comm_vat_mny.value;
+        f.TaxFreeAmt.value = pf.comm_free_mny.value;
+        <?php } ?>
+
+        if (! nicepay_create_signdata(f)) {
+            return false;
+        }
        <?php } ?>

        // 주문 정보 임시저장
@@ -1438,6 +1548,11 @@ function pay_approval()
            return false;
        }

+        <?php if ($default['de_pg_service'] == 'nicepay') { ?>
+        nicepayStart(f);
+        return false;
+        <?php } ?>
+
        f.submit();
    }

--- a/Show More
+++ b/Show More