버전 5.5.17 수정

SEED_CBC_Decrypt 함수
return null 전에 초기화

adm/config_form.php

@@ -409,6 +409,11 @@ if (!isset($config['cf_cert_kg_mid'])) {
             ADD COLUMN `cf_cert_kg_mid` VARCHAR(255) NOT NULL DEFAULT '' AFTER `cf_cert_kg_cd`; ";
     sql_query($sql, false);
 }
+if (!isset($config['cf_cert_use_seed'])) {
+    $sql = "ALTER TABLE `{$g5['config_table']}` 
+            ADD COLUMN `cf_cert_use_seed` TINYINT(4) NOT NULL DEFAULT '1' AFTER `cf_cert_kg_mid`; ";
+    sql_query($sql, false);
+}
 if (!$config['cf_faq_skin']) {
     $config['cf_faq_skin'] = "basic";
 }
@@ -1003,6 +1008,16 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                             </select>
                         </td>
                     </tr>
+                    <tr>
+                        <th scope="row" class="cf_cert_service"><label for="cf_cert_use_seed">통합인증 암호화 적용</label></th>
+                        <td class="cf_cert_service">
+                            <?php echo help('KG이니시스 통합인증서비스에 암호화를 적용합니다. 만일 글자가 깨지는 문제가 발생하면 사용안함으로 적용해 주세요.') ?>
+                            <select name="cf_cert_use_seed" id="cf_cert_use_seed">
+                                <?php echo option_selected("0", $config['cf_cert_use_seed'], "사용안함"); ?>
+                                <?php echo option_selected("1", $config['cf_cert_use_seed'], "사용함"); ?>
+                            </select>
+                        </td>
+                    </tr>
                     <tr>
                         <th scope="row" class="cf_cert_service"><label for="cf_cert_hp">휴대폰 본인확인</label></th>
                         <td class="cf_cert_service">

adm/config_form_update.php

@@ -12,7 +12,6 @@ if ($is_admin != 'super') {
 
 $cf_title = isset($_POST['cf_title']) ? strip_tags(clean_xss_attributes($_POST['cf_title'])) : '';
 $cf_admin = isset($_POST['cf_admin']) ? clean_xss_tags($_POST['cf_admin'], 1, 1) : '';
-$posts = array();
 
 $mb = get_member($cf_admin);
 
@@ -28,11 +27,11 @@ $check_keys = array('cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptc
 
 foreach ($check_keys as $key) {
     if (isset($_POST[$key]) && $_POST[$key]) {
-        $posts[$key] = $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
+        $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
     }
 }
 
-$posts['cf_icode_server_port'] = $_POST['cf_icode_server_port'] = isset($_POST['cf_icode_server_port']) ? preg_replace('/[^0-9]/', '', $_POST['cf_icode_server_port']) : '7295';
+$_POST['cf_icode_server_port'] = isset($_POST['cf_icode_server_port']) ? preg_replace('/[^0-9]/', '', $_POST['cf_icode_server_port']) : '7295';
 
 if (isset($_POST['cf_intercept_ip']) && $_POST['cf_intercept_ip']) {
     $pattern = explode("\n", trim($_POST['cf_intercept_ip']));
@@ -105,6 +104,7 @@ $check_keys = array(
     'cf_cert_ipin' => 'char',
     'cf_cert_hp' => 'char',
     'cf_cert_simple' => 'char',
+    'cf_cert_use_seed' => 'int',
     'cf_admin_email' => 'char',
     'cf_admin_email_name' => 'char',
     'cf_add_script' => 'text',
@@ -164,12 +164,12 @@ for ($i = 1; $i <= 10; $i++) {
 
 foreach ($check_keys as $k => $v) {
     if ($v === 'int') {
-        $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? (int) $_POST[$k] : 0;
+        $_POST[$k] = isset($_POST[$k]) ? (int) $_POST[$k] : 0;
     } else {
         if (in_array($k, array('cf_analytics', 'cf_add_meta', 'cf_add_script', 'cf_stipulation', 'cf_privacy'))) {
-            $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? $_POST[$k] : '';
+            $_POST[$k] = isset($_POST[$k]) ? $_POST[$k] : '';
         } else {
-            $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? strip_tags(clean_xss_attributes($_POST[$k])) : '';
+            $_POST[$k] = isset($_POST[$k]) ? strip_tags(clean_xss_attributes($_POST[$k])) : '';
         }
     }
 }
@@ -180,9 +180,9 @@ if ($_POST['cf_cert_use'] && !$_POST['cf_cert_ipin'] && !$_POST['cf_cert_hp'] &&
 }
 
 if (!$_POST['cf_cert_use']) {
-    $posts[$key] = $_POST['cf_cert_ipin'] = '';
-    $posts[$key] = $_POST['cf_cert_hp'] = '';
-    $posts[$key] = $_POST['cf_cert_simple'] = '';
+    $_POST['cf_cert_ipin'] = '';
+    $_POST['cf_cert_hp'] = '';
+   $_POST['cf_cert_simple'] = '';
 }
 
 $sql = " update {$g5['config_table']}
@@ -284,6 +284,7 @@ $sql = " update {$g5['config_table']}
                 cf_cert_ipin = '{$_POST['cf_cert_ipin']}',
                 cf_cert_hp = '{$_POST['cf_cert_hp']}',
                 cf_cert_simple = '{$_POST['cf_cert_simple']}',
+                cf_cert_use_seed = '".(int)$_POST['cf_cert_use_seed']."',
                 cf_cert_kg_cd = '{$_POST['cf_cert_kg_cd']}',
                 cf_cert_kg_mid = '" . trim($_POST['cf_cert_kg_mid']) . "',
                 cf_cert_kcb_cd = '{$_POST['cf_cert_kcb_cd']}',

adm/member_form.php

@@ -205,7 +205,7 @@ if (isset($mb_id) && $mb_id) {
 if ($mb['mb_intercept_date']) {
     $g5['title'] = "차단된 ";
 } else {
-    $g5['title'] .= "";
+    $g5['title'] = "";
 }
 $g5['title'] .= '회원 ' . $html_title;
 require_once './admin.head.php';

adm/shop_admin/itemstocklist.php

@@ -35,7 +35,7 @@ $sql_common .= $sql_search;
 // 테이블의 전체 레코드수만 얻음
 $sql = " select count(*) as cnt " . $sql_common;
 $row = sql_fetch($sql);
-$total_count = $row['cnt'];
+$total_count = isset($row['cnt']) ? $row['cnt'] : 0;
 
 $rows = $config['cf_page_rows'];
 $total_page  = ceil($total_count / $rows);  // 전체 페이지 계산
@@ -171,7 +171,7 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
             <?php echo $row['it_id']; ?>
         </td>
         <td class="td_left"><a href="<?php echo $href; ?>"><?php echo get_it_image($row['it_id'], 50, 50); ?> <?php echo cut_str(stripslashes($row['it_name']), 60, "&#133"); ?></a></td>
-        <td class="td_num<?php echo $it_stock_qty_st; ?>"><?php echo (int)$it_stock_qty; ?></td>
+        <td class="td_num<?php echo $it_stock_qty_st; ?>"><?php echo get_text($it_stock_qty); ?></td>
         <td class="td_num"><?php echo number_format((float)$wait_qty); ?></td>
         <td class="td_num"><?php echo number_format((float)$temporary_qty); ?></td>
         <td class="td_num">

bbs/ajax.autosave.php

@@ -4,8 +4,8 @@ include_once('./_common.php');
 if (!$is_member) die('0');
 
 $uid     = isset($_REQUEST['uid']) ? preg_replace('/[^0-9]/', '', $_REQUEST['uid']) : 0;
-$subject = isset($_REQUEST['subject']) ? trim($_REQUEST['subject']) : '';
-$content = isset($_REQUEST['content']) ? trim($_REQUEST['content']) : '';
+$subject = isset($_REQUEST['subject']) ? preg_replace("#[\\\]+$#", "", substr(trim($_POST['subject']),0,255)) : '';
+$content = isset($_REQUEST['content']) ? preg_replace("#[\\\]+$#", "", substr(trim($_POST['content']),0,65536)) : '';
 
 if ($subject && $content) {
     $sql = " select count(*) as cnt from {$g5['autosave_table']} where mb_id = '{$member['mb_id']}' and as_subject = '$subject' and as_content = '$content' ";

bbs/login_check.php

@@ -147,8 +147,16 @@ if(function_exists('set_cart_id')){
     cart_item_clean();
     set_cart_id('');
     $s_cart_id = get_session('ss_cart_id');
+
+    $add_cart_where = '';
+
+    // 장바구니에서 주문하기를 하는 경우
+    if (strpos($link, 'orderform.php') !== false) {
+        $add_cart_where = " and ct_select_time < '".date('Y-m-d H:i:s', strtotime('-1 hour', G5_SERVER_TIME))."' ";
+    }
+
     // 선택필드 초기화
-    $sql = " update {$g5['g5_shop_cart_table']} set ct_select = '0' where od_id = '$s_cart_id' ";
+    $sql = " update {$g5['g5_shop_cart_table']} set ct_select = '0' where od_id = '$s_cart_id' $add_cart_where ";
     sql_query($sql);
 }
 

bbs/member_confirm.php

@@ -31,6 +31,10 @@ if($url){
     if( preg_match('#^/{3,}#', $url) ){
         $url = preg_replace('#^/{3,}#', '/', $url);
     }
+
+    if (function_exists('safe_filter_url_host')) {
+        $url = safe_filter_url_host($url);
+    }
 }
 
 $url = get_text($url);

bbs/memo_form_update.php

@@ -14,24 +14,28 @@ $str_nick_list = '';
 $msg = '';
 $error_list  = array();
 $member_list = array('id'=>array(), 'nick'=>array());
+$me_memo = isset($_POST['me_memo']) ? preg_replace("#[\\\]+$#", "", substr(trim($_POST['me_memo']),0,65536)) : '';
 
 run_event('memo_form_update_before', $recv_list);
 
 for ($i=0; $i<count($recv_list); $i++) {
-    $row = sql_fetch(" select mb_id, mb_nick, mb_open, mb_leave_date, mb_intercept_date from {$g5['member_table']} where mb_id = '{$recv_list[$i]}' ");
+
+    $recv_list_id = substr(preg_replace("/[^a-zA-Z0-9_]*/", "", $recv_list[$i]), 0, 20);
+
+    $row = sql_fetch(" select mb_id, mb_nick, mb_open, mb_leave_date, mb_intercept_date from {$g5['member_table']} where mb_id = '{$recv_list_id}' ");
     if ($row) {
         if ($is_admin || ($row['mb_open'] && (!$row['mb_leave_date'] && !$row['mb_intercept_date']))) {
             $member_list['id'][]   = $row['mb_id'];
             $member_list['nick'][] = $row['mb_nick'];
         } else {
-            $error_list[]   = $recv_list[$i];
+            $error_list[]   = $recv_list_id;
         }
     }
     /*
     // 관리자가 아니면서
     // 가입된 회원이 아니거나 정보공개를 하지 않았거나 탈퇴한 회원이거나 차단된 회원에게 쪽지를 보내는것은 에러
     if ((!$row['mb_id'] || !$row['mb_open'] || $row['mb_leave_date'] || $row['mb_intercept_date']) && !$is_admin) {
-        $error_list[]   = $recv_list[$i];
+        $error_list[]   = $recv_list_id;
     } else {
         $member_list['id'][]   = $row['mb_id'];
         $member_list['nick'][] = $row['mb_nick'];
@@ -67,14 +71,14 @@ for ($i=0; $i<count($member_list['id']); $i++) {
     $recv_mb_nick = get_text($member_list['nick'][$i]);
 
     // 받는 회원 쪽지 INSERT
-    $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_type, me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}', '0000-00-00 00:00:00' , 'recv', '{$_SERVER['REMOTE_ADDR']}' ) ";
+    $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_type, me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$me_memo}', '0000-00-00 00:00:00' , 'recv', '{$_SERVER['REMOTE_ADDR']}' ) ";
 
     sql_query($sql);
 
     if( $me_id = sql_insert_id() ){
 
         // 보내는 회원 쪽지 INSERT
-        $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_send_id, me_type , me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$_POST['me_memo']}', '0000-00-00 00:00:00', '$me_id', 'send', '{$_SERVER['REMOTE_ADDR']}' ) ";
+        $sql = " insert into {$g5['memo_table']} ( me_recv_mb_id, me_send_mb_id, me_send_datetime, me_memo, me_read_datetime, me_send_id, me_type , me_send_ip ) values ( '$recv_mb_id', '{$member['mb_id']}', '".G5_TIME_YMDHIS."', '{$me_memo}', '0000-00-00 00:00:00', '$me_id', 'send', '{$_SERVER['REMOTE_ADDR']}' ) ";
         sql_query($sql);
 		
 		$member_list['me_id'][$i] = $me_id;

bbs/move_update.php

@@ -80,7 +80,7 @@ while ($row = sql_fetch_array($result))
             }
 
             $sql = " insert into $move_write_table
-                        set wr_num = " . ($next_wr_num ? "'$next_wr_num'" : "(SELECT IFNULL(MIN(wr_num) - 1, -1) FROM $move_write_table sq) ") . ",
+                        set wr_num = " . ($next_wr_num ? "'$next_wr_num'" : "(SELECT IFNULL(MIN(wr_num) - 1, -1) FROM $move_write_table as sq) ") . ",
                              wr_reply = '{$row2['wr_reply']}',
                              wr_is_comment = '{$row2['wr_is_comment']}',
                              wr_comment = '{$row2['wr_comment']}',

bbs/poll_update.php

@@ -3,7 +3,7 @@ include_once('./_common.php');
 
 $po_id = isset($_POST['po_id']) ? preg_replace('/[^0-9]/', '', $_POST['po_id']) : 0;
 
-$po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '{$_POST['po_id']}' ");
+$po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '$po_id' ");
 if (! (isset($po['po_id']) && $po['po_id']))
     alert('po_id 값이 제대로 넘어오지 않았습니다.');
 

extend/default.config.php

@@ -1,6 +1,8 @@
 <?php
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
 
+define('KGINICIS_USE_CERT_SEED', isset($config['cf_cert_use_seed']) ? (int) $config['cf_cert_use_seed'] : 1);
+
 // 유저 사이드뷰에서 아이콘 지정 안했을시 기본 no 프로필 이미지
 define('G5_NO_PROFILE_IMG', '<span class="profile_img"><img src="'.G5_IMG_URL.'/no_profile.gif" alt="no_profile" width="'.$config['cf_member_icon_width'].'" height="'.$config['cf_member_icon_height'].'"></span>');
 

install/gnuboard5.sql

@@ -292,6 +292,7 @@ CREATE TABLE IF NOT EXISTS `g5_config` (
   `cf_cert_simple` varchar(255) NOT NULL DEFAULT '',
   `cf_cert_kg_cd` varchar(255) NOT NULL DEFAULT '',
   `cf_cert_kg_mid` varchar(255) NOT NULL DEFAULT '',
+  `cf_cert_use_seed` tinyint(4) NOT NULL DEFAULT '1',
   `cf_cert_kcb_cd` varchar(255) NOT NULL DEFAULT '',
   `cf_cert_kcp_cd` varchar(255) NOT NULL DEFAULT '',
   `cf_lg_mid` varchar(100) NOT NULL DEFAULT '',

lib/common.lib.php

@@ -102,6 +102,10 @@ function goto_url($url)
 {
     run_event('goto_url', $url);
 
+    if (function_exists('safe_filter_url_host')) {
+        $url = safe_filter_url_host($url);
+    }
+
     $url = str_replace("&", "&", $url);
     //echo "<script> location.replace('$url'); </script>";
 
@@ -182,6 +186,10 @@ function alert($msg='', $url='', $error=true, $post=false)
 
     run_event('alert', $msg, $url, $error, $post);
 
+    if (function_exists('safe_filter_url_host')) {
+        $url = safe_filter_url_host($url);
+    }
+
     $msg = $msg ? strip_tags($msg, '<br>') : '올바른 방법으로 이용해 주십시오.';
 
     $header = '';
@@ -220,6 +228,12 @@ function confirm($msg, $url1='', $url2='', $url3='')
         alert($msg);
     }
 
+    if (function_exists('safe_filter_url_host')) {
+        $url1 = safe_filter_url_host($url1);
+        $url2 = safe_filter_url_host($url2);
+        $url3 = safe_filter_url_host($url3);
+    }
+
     if(!trim($url1) || !trim($url2)) {
         $msg = '$url1 과 $url2 를 지정해 주세요.';
         alert($msg);
@@ -712,7 +726,7 @@ function get_sql_search($search_ca_name, $search_field, $search_text, $search_op
     $tmp = explode(",", trim($search_field));
     $field = explode("||", $tmp[0]);
     $not_comment = "";
-    if (!empty($tmp[1]))
+    if (isset($tmp[1]))
         $not_comment = $tmp[1];
 
     $str .= "(";
@@ -768,8 +782,11 @@ function get_sql_search($search_ca_name, $search_field, $search_text, $search_op
         $op1 = " $search_operator ";
     }
     $str .= " ) ";
-    if ($not_comment)
+    if ($not_comment === '1') {
         $str .= " and wr_is_comment = '0' ";
+    } else if ($not_comment === '0') {
+        $str .= " and wr_is_comment = '1' ";
+    }
 
     return $str;
 }
@@ -1320,6 +1337,10 @@ function delete_point($mb_id, $rel_table, $rel_id, $rel_action)
                       and po_rel_action = '$rel_action' ";
         $row = sql_fetch($sql);
 
+        if (! (isset($row['po_id']) && $row['po_id'])) {
+            return true;
+        }
+
         if(isset($row['po_point']) && $row['po_point'] < 0) {
             $mb_id = $row['mb_id'];
             $po_point = abs($row['po_point']);
@@ -3594,6 +3615,13 @@ function login_password_check($mb, $pass, $hash)
     return check_password($pass, $hash);
 }
 
+function safe_filter_url_host($url) {
+
+    $regex = run_replace('safe_filter_url_regex', '\\', $url);
+
+    return $regex ? preg_replace('#'. preg_quote($regex, '#') .'#iu', '', $url) : '';
+}
+
 // 동일한 host url 인지
 function check_url_host($url, $msg='', $return_url=G5_URL, $is_redirect=false)
 {

lib/get_data.lib.php

@@ -145,6 +145,8 @@ function get_content_by_field($write_table, $type='bbs', $where_field='', $where
 {
     global $g5, $g5_object;
 
+    static $cache = array();
+
     $order_key = 'wr_id';
 
     if( $type === 'content' ){

mobile/shop/kcp/pp_ax_hub.php

@@ -9,7 +9,6 @@
     /* =   Copyright (c)  2010.05   KCP Inc.   All Rights Reserved.                 = */
     /* ============================================================================== */
 
-
     /* ============================================================================== */
     /* =   환경 설정 파일 Include                                                   = */
     /* = -------------------------------------------------------------------------- = */
@@ -110,6 +109,24 @@
     /* = -------------------------------------------------------------------------- = */
     if ( $req_tx == "pay" )
     {
+        /* 1004원은 실제로 업체에서 결제하셔야 될 원 금액을 넣어주셔야 합니다. 결제금액 유효성 검증 */
+        $c_PayPlus->mf_set_ordr_data( "ordr_mony",  $good_mny );
+
+        $kcp_pay_type = '';   // 결제수단 검증 파라미터 pay_type (신용카드 : PACA, 계좌이체 : PABK, 가상계좌 : PAVC, 휴대폰 : PAMC)
+
+        if ($use_pay_method == "100000000000" && (in_array($od_settle_case, array('신용카드', '간편결제')))) {  // 신용카드
+            $kcp_pay_type = 'PACA';
+        } else if ($use_pay_method == "010000000000" && $od_settle_case === '계좌이체') {   // 계좌이체
+            $kcp_pay_type = 'PABK';
+        } else if ($use_pay_method == "001000000000" && $od_settle_case === '가상계좌') {   // 가상계좌
+            $kcp_pay_type = 'PAVC';
+        } else if ($use_pay_method == "000010000000" && $od_settle_case === '휴대폰') {   // 휴대폰
+            $kcp_pay_type = 'PAMC';
+        }
+
+        $c_PayPlus->mf_set_ordr_data( "pay_type",  $kcp_pay_type );
+        $c_PayPlus->mf_set_ordr_data( "ordr_no",  $ordr_idxx );
+
         $post_enc_data = isset($_POST["enc_data"]) ? $_POST["enc_data"] : '';
         $post_enc_info = isset($_POST["enc_info"]) ? $_POST["enc_info"] : '';
 

mobile/shop/orderformupdate.php

@@ -843,7 +843,7 @@ if($config['cf_sms_use'] && ($default['de_sms_use2'] || $default['de_sms_use3'])
             $sms_content = str_replace("{보낸분}", $od_name, $sms_content);
             $sms_content = str_replace("{받는분}", $od_b_name, $sms_content);
             $sms_content = str_replace("{주문번호}", $od_id, $sms_content);
-            $sms_content = str_replace("{주문금액}", number_format($tot_ct_price + $od_send_cost + $od_send_cost2), $sms_content);
+            $sms_content = str_replace("{주문금액}", number_format($tot_ct_price + $od_send_cost + (int) $od_send_cost2), $sms_content);
             $sms_content = str_replace("{회원아이디}", $member['mb_id'], $sms_content);
             $sms_content = str_replace("{회사명}", $default['de_admin_company_name'], $sms_content);
 

plugin/htmlpurifier/extend.video.php

@@ -8,7 +8,7 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
  */
 
 if( !class_exists('HTMLPurifier_Filter_Iframevideo') ){
-	class HTMLPurifier_Filter_iframevideo extends HTMLPurifier_Filter
+	class HTMLPurifier_Filter_Iframevideo extends HTMLPurifier_Filter
 	{
 		public $name = 'Iframevideo';
 

plugin/inicert/ini_request.php

@@ -17,7 +17,7 @@ if($config['cf_cert_use'] == 2) { // 실서비스 일때
     $mTxId ='SIR_'.$max_cr_id;
 }
 $reqSvcCd ='01';    // 요청구분코드 ["01":간편인증, "02":전자서명]
-$reservedMsg ='isUseToken=Y';   // 결과조회 응답시 개인정보SEED 암호화 처리 요청
+$reservedMsg = (defined('KGINICIS_USE_CERT_SEED') && KGINICIS_USE_CERT_SEED) ? 'isUseToken=Y' : '';   // 결과조회 응답시 개인정보SEED 암호화 처리 요청
 
 // 등록가맹점 확인
 $plainText1 = hash("sha256",(string)$mid.(string)$mTxId.(string)$apiKey);

plugin/inicert/ini_result.php

@@ -6,7 +6,7 @@ require_once (dirname(__FILE__) .'/libs/INILib.php');
 $txId = isset($_POST['txId']) ? clean_xss_tags($_POST['txId'], 1, 1) : '';
 $mid  = substr($txId, 6, 10);
 $SEEDKEY = isset($_POST['token']) ? clean_xss_tags($_POST['token'], 1, 1) : '';
-$SEEDIV  = "SASKGINICIS00000";
+$SEEDIV = 'SASHOSTSIRIAS000';
 
 if ($txId && isset($_POST["resultCode"]) && $_POST["resultCode"] === "0000") {
 
@@ -54,11 +54,13 @@ if ($txId && isset($_POST["resultCode"]) && $_POST["resultCode"] === "0000") {
         $birth_day      = $res_data['userBirthday'];            // 생년월일
         $ci             = $res_data['userCi'];                  // CI
         
-        // 개인정보SEED 암호화 된것을 복호화 합니다.
-        $user_name = decrypt_SEED($user_name, $SEEDKEY, $SEEDIV);
-        $phone_no = decrypt_SEED($phone_no, $SEEDKEY, $SEEDIV);
-        $birth_day = decrypt_SEED($birth_day, $SEEDKEY, $SEEDIV);
-        $ci = decrypt_SEED($ci, $SEEDKEY, $SEEDIV);
+        if (defined('KGINICIS_USE_CERT_SEED') && KGINICIS_USE_CERT_SEED) {
+            // 개인정보SEED 암호화 된것을 복호화 합니다.
+            $user_name = decrypt_SEED($user_name, $SEEDKEY, $SEEDIV);
+            $phone_no = decrypt_SEED($phone_no, $SEEDKEY, $SEEDIV);
+            $birth_day = decrypt_SEED($birth_day, $SEEDKEY, $SEEDIV);
+            $ci = decrypt_SEED($ci, $SEEDKEY, $SEEDIV);
+        }
 
         @insert_cert_history($member['mb_id'], 'inicis', $cert_type); // 인증성공 시 내역 기록
 

plugin/inicert/libs/INILib.php

@@ -67,10 +67,11 @@ function decrypt_SEED($str, $bszUser_key, $bszIV) {
     $pdwRoundKey = array_pad(array(), 32, 0);
 
     $bszPlainText = null;
+    $planBytresMessage = array();
 
     // 방법 1
     $bszPlainText = KISA_SEED_CBC::SEED_CBC_Decrypt($keyBytes, $IVBytes, $planBytes, 0, count($planBytes));
-    for ($i = 0; $i < sizeof($bszPlainText); $i++) {
+    for ($i = 0; $i < sizeof((array) $bszPlainText); $i++) {
         $planBytresMessage[] = sprintf("%02X", $bszPlainText[$i]);
     }
     return Hex2String($planBytresMessage);

plugin/inicert/libs/KISA_SEED_CBC.php

@@ -171,7 +171,7 @@ if (!defined('_KISA_SEED_KEY_')) {
 
         var $key_data = null;
 
-        function KISA_SEED_KEY() {
+        function __construct() {
             $this->key_data = array_pad(array(), 32, 0);
         }
 
@@ -192,7 +192,7 @@ if (!defined('_KISA_SEED_INFO_')) {
         var $cbc_last_block = null;
         var $last_block_flag = 0;
 
-        function KISA_SEED_INFO() {
+        function __construct() {
             $this->ivec = array_pad(array(), 4, 0);
             $this->seed_key = new KISA_SEED_KEY();
             $this->cbc_buffer = array_pad(array(), 4, 0);
@@ -782,6 +782,7 @@ class KISA_SEED_CBC {
         $pbszCipherText = array_pad(array(), $message_length, 0);
         Common::arraycopy_system($message, $message_offset, $pbszCipherText, 0, $message_length);
         $nCipherTextLen = count($pbszCipherText);
+        $result = null;
 
         if ($nCipherTextLen % KISA_SEED_CBC::BLOCK_SIZE_SEED) {
             return $result;

plugin/social/Hybrid/thirdparty/OAuth/OAuth1Client.php

@@ -20,8 +20,8 @@ class OAuth1Client{
 	public $redirect_uri          = "";
 
 	public $decode_json           = true;
-	public $curl_time_out         = 30;
-	public $curl_connect_time_out = 30;
+	public $curl_time_out         = 10;
+	public $curl_connect_time_out = 15;
 	public $curl_ssl_verifypeer   = false;
 	public $curl_auth_header      = true;
 	public $curl_useragent        = "OAuth/1 Simple PHP Client v0.1; HybridAuth http://hybridauth.sourceforge.net/";
@@ -194,6 +194,7 @@ class OAuth1Client{
 		curl_setopt( $ci, CURLOPT_USERAGENT     , $this->curl_useragent );
 		curl_setopt( $ci, CURLOPT_CONNECTTIMEOUT, $this->curl_connect_time_out );
 		curl_setopt( $ci, CURLOPT_TIMEOUT       , $this->curl_time_out );
+		curl_setopt( $ci, CURLOPT_MAXREDIRS , 10);
 		curl_setopt( $ci, CURLOPT_RETURNTRANSFER, true );
 		curl_setopt( $ci, CURLOPT_HTTPHEADER    , array('Expect:') );
 		curl_setopt( $ci, CURLOPT_SSL_VERIFYPEER, $this->curl_ssl_verifypeer );

plugin/social/Hybrid/thirdparty/OAuth/OAuth2Client.php

@@ -26,8 +26,8 @@ class OAuth2Client
   //--
 
   public $sign_token_name          = "access_token";
-  public $curl_time_out            = 30;
-  public $curl_connect_time_out    = 30;
+  public $curl_time_out            = 10;
+  public $curl_connect_time_out    = 15;
   public $curl_ssl_verifypeer      = false;
   public $curl_ssl_verifyhost      = false;
   public $curl_header              = array();
@@ -221,6 +221,7 @@ class OAuth2Client
     curl_setopt($ch, CURLOPT_TIMEOUT        , $this->curl_time_out );
     curl_setopt($ch, CURLOPT_USERAGENT      , $this->curl_useragent );
     curl_setopt($ch, CURLOPT_CONNECTTIMEOUT , $this->curl_connect_time_out );
+    curl_setopt($ch, CURLOPT_MAXREDIRS , 10);
     curl_setopt($ch, CURLOPT_SSL_VERIFYPEER , $this->curl_ssl_verifypeer );
     curl_setopt($ch, CURLOPT_SSL_VERIFYHOST , $this->curl_ssl_verifyhost );
     curl_setopt($ch, CURLOPT_HTTPHEADER     , $this->curl_header );

shop/kcp/pp_ax_hub.php

@@ -146,7 +146,22 @@ if ( $req_tx == "pay" )
 {
         /* 1004원은 실제로 업체에서 결제하셔야 될 원 금액을 넣어주셔야 합니다. 결제금액 유효성 검증 */
         $c_PayPlus->mf_set_ordr_data( "ordr_mony",  $good_mny );
-        
+
+        $kcp_pay_type = '';   // 결제수단 검증 파라미터 pay_type (신용카드 : PACA, 계좌이체 : PABK, 가상계좌 : PAVC, 휴대폰 : PAMC)
+
+        if ($use_pay_method == "100000000000" && (in_array($od_settle_case, array('신용카드', '간편결제')))) {  // 신용카드
+            $kcp_pay_type = 'PACA';
+        } else if ($use_pay_method == "010000000000" && $od_settle_case === '계좌이체') {   // 계좌이체
+            $kcp_pay_type = 'PABK';
+        } else if ($use_pay_method == "001000000000" && $od_settle_case === '가상계좌') {   // 가상계좌
+            $kcp_pay_type = 'PAVC';
+        } else if ($use_pay_method == "000010000000" && $od_settle_case === '휴대폰') {   // 휴대폰
+            $kcp_pay_type = 'PAMC';
+        }
+
+        $c_PayPlus->mf_set_ordr_data( "pay_type",  $kcp_pay_type );
+        $c_PayPlus->mf_set_ordr_data( "ordr_no",  $ordr_idxx );
+
         $post_enc_data = isset($_POST['enc_data']) ? $_POST['enc_data'] : '';
         $post_enc_info = isset($_POST['enc_info']) ? $_POST['enc_info'] : '';
 

shop/orderformupdate.php

@@ -785,7 +785,7 @@ if($config['cf_sms_use'] && ($default['de_sms_use2'] || $default['de_sms_use3'])
             $sms_content = str_replace("{보낸분}", $od_name, $sms_content);
             $sms_content = str_replace("{받는분}", $od_b_name, $sms_content);
             $sms_content = str_replace("{주문번호}", $od_id, $sms_content);
-            $sms_content = str_replace("{주문금액}", number_format($tot_ct_price + $od_send_cost + $od_send_cost2), $sms_content);
+            $sms_content = str_replace("{주문금액}", number_format($tot_ct_price + $od_send_cost + (int) $od_send_cost2), $sms_content);
             $sms_content = str_replace("{회원아이디}", $member['mb_id'], $sms_content);
             $sms_content = str_replace("{회사명}", $default['de_admin_company_name'], $sms_content);
 

version.php

@@ -2,7 +2,7 @@
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
 
 define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.5.14');
+define('G5_GNUBOARD_VER', '5.5.17');
 // 그누보드5.4.5.5 버전과 영카트5.4.5.5.1 버전을 합쳐서 그누보드5.4.6 버전에서 시작함 (kagla-210617)
 // G5_YOUNGCART_VER 이 상수를 사용하는 곳이 있으므로 주석 처리 해제함
 // 그누보드5.4.6 이상 버전 부터는 영카트를 그누보드에 포함하여 배포하므로 영카트5의 버전은 의미가 없습니다.