Merge branch 'master' of github.com:gnuboard/g5-update

버전 5.6.16 수정
Merge pull request #47 from gnuboard/fix/sms5-table-prefix
2025-09-01 11:32:50 +09:00 · 2025-09-01 11:23:45 +09:00 · 2025-08-29 17:04:42 +09:00 · 2025-08-28 13:35:14 +09:00 · 2025-08-27 18:52:02 +09:00 · 2025-08-27 17:58:06 +09:00
51 changed files with 496 additions and 167 deletions
@@ -1447,12 +1447,12 @@ function frm_check_file(){

 jQuery(function($){
    if( window.self !== window.top ){   // frame 또는 iframe을 사용할 경우 체크
-        $("#bo_include_head, #bo_include_tail").on("change paste keyup", function(e) {
-            frm_check_file();
-        });
-
        use_captcha_check();
    }
+    
+    $("#bo_include_head, #bo_include_tail").on("change paste keyup", function(e) {
+        frm_check_file();
+    });
 });

 function fboardform_submit(f)
@@ -1487,10 +1487,14 @@ function fboardform_submit(f)
        return false;
    }

+    if (frm_check_file() == false) {
+        jQuery(window).scrollTop($('#bo_include_tail').offset().top - 30);
+    }
+    
    if( captcha_chk ) {
        <?php echo isset($captcha_js) ? $captcha_js : ''; // 캡챠 사용시 자바스크립트에서 입력된 캡챠를 검사함  ?>
    }
-
+    
    return true;
 }
 </script>
@@ -37,7 +37,7 @@ $bo_include_head = isset($_POST['bo_include_head']) ? preg_replace(array("#[\\\]
 $bo_include_tail = isset($_POST['bo_include_tail']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['bo_include_tail'], 0, 255)) : '';

 // 관리자가 자동등록방지를 사용해야 할 경우
-if ($board && (isset($board['bo_include_head']) && $board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()) {
+if ($board && (isset($board['bo_include_head']) && $board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail)) {
    include_once(G5_CAPTCHA_PATH . '/captcha.lib.php');

    if (!chk_captcha()) {
@@ -269,6 +269,26 @@ while ($row = sql_fetch_array($result)){
    }
 }

+// SMS5 테이블 G5_TABLE_PREFIX 적용
+if($g5['sms5_prefix'] != 'sms5_' && sql_num_rows(sql_query("show tables like 'sms5_config'")))
+{
+    $tables = array('config','write','history','book','book_group','form','form_group');
+
+    foreach($tables as $name){
+        $old_table = 'sms5_' . $name;
+        $new_table = $g5['sms5_prefix'] . $name;
+
+        // 기존 테이블이 있고, G5_TABLE_PREFIX 적용 테이블이 없을 경우 → 테이블명 변경
+        if(sql_num_rows(sql_query("SHOW TABLES LIKE '{$old_table}' "))){
+            if(!sql_num_rows(sql_query("SHOW TABLES LIKE '{$new_table}' "))){
+                sql_query("RENAME TABLE {$old_table} TO {$new_table}", false);
+            }
+        }
+    }
+
+    $is_check = true;
+}
+
 $is_check = run_replace('admin_dbupgrade', $is_check);

 $db_upgrade_msg = $is_check ? 'DB 업그레이드가 완료되었습니다.' : '더 이상 업그레이드 할 내용이 없습니다.<br>현재 DB 업그레이드가 완료된 상태입니다.';
@@ -117,6 +117,15 @@ if ($new == 'new' || !$code) {
        });
    });

+    function htmlEscape(str) {
+        return str
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#39;');
+    }
+
    function add_menu_list(name, link, code) {
        var $menulist = $("#menulist", opener.document);
        var ms = new Date().getTime();
@@ -126,7 +135,10 @@ if ($new == 'new' || !$code) {
        <?php } else { ?>
            sub_menu_class = " class=\"td_category sub_menu_class\"";
        <?php } ?>
-
+        
+        name = htmlEscape(name);
+        link = htmlEscape(link);
+        
        var list = "<tr class=\"menu_list menu_group_<?php echo $code; ?>\">";
        list += "<td" + sub_menu_class + ">";
        list += "<label for=\"me_name_" + ms + "\"  class=\"sound_only\">메뉴<strong class=\"sound_only\"> 필수</strong></label>";
@@ -835,7 +835,7 @@ if(!$default['de_kakaopay_cancelpwd']){
        <tr class="pg_info_fld lg_info_fld">
            <th scope="row"><label for="cf_lg_mert_key">토스페이먼츠 MERT KEY</label></th>
            <td>
-                <?php echo help("토스페이먼츠 상점MertKey는 상점관리자 -> 계약정보 -> 상점정보관리에서 확인하실 수 있습니다.\n예) 95160cce09854ef44d2edb2bfb05f9f3\n<a href=\"".G5_ADMIN_URL."/config_form.php#anc_cf_cert\">기본환경설정 &gt; 본인확인</a> 설정의 토스페이먼츠 MERT KEY와 동일합니다."); ?>
+                <?php echo help("토스페이먼츠 상점MertKey는 상점관리자 -> 개발자센터 -> API키 -> 머트 키에서 확인하실 수 있습니다.\n예) 95160cce09854ef44d2edb2bfb05f9f3"); ?>
                <input type="text" name="cf_lg_mert_key" value="<?php echo get_sanitize_input($config['cf_lg_mert_key']); ?>" id="cf_lg_mert_key" class="frm_input " size="36" maxlength="50">
            </td>
        </tr>
@@ -949,7 +949,7 @@ if(!$default['de_kakaopay_cancelpwd']){
        </tr>

        <tr class="pg_info_fld nicepay_info_fld" id="nicepay_info_anchor">
-            <th scope="row"><label for="de_nicepay_mid">NICEPAY MID</label><br><a href="http://sir.kr/main/service/inicis_pg.php" target="_blank" id="scf_nicepay_reg" class="nicepay_btn">NICEPAY 신청하기</a></th>
+            <th scope="row"><label for="de_nicepay_mid">NICEPAY MID</label><br><a href="http://sir.kr/main/service/nicepayments_pg.php" target="_blank" id="scf_nicepay_reg" class="nicepay_btn">NICEPAY 신청하기</a></th>
            <td>
                <span class="frm_info">NICEPAY로 부터 발급 받으신 상점MID를 SR 을 제외한 나머지 자리를 입력 합니다.<br>NICEPAY 상점관리자 > 가맹점정보 > KEY관리에서 확인 할수 있습니다.<br>만약, 상점아이디가 SR로 시작하지 않는다면 계약담당자에게 변경 요청을 해주시기 바랍니다. 예) SRpaytestm</span>
                <span class="sitecode">SR</span>
@@ -235,6 +235,14 @@ sql_query(" delete from {$g5['g5_shop_event_item_table']} where it_id = '$it_id'
 // 선택옵션
 sql_query(" delete from {$g5['g5_shop_item_option_table']} where io_type = '0' and it_id = '$it_id' "); // 기존선택옵션삭제

+// 금지할 패턴 목록
+$forbidden_patterns = array(
+    '/<\s*script/i',      // <script>
+    '/<\s*iframe/i',      // <iframe>
+    '/on\w+\s*=/i',       // onclick=, onerror= 등 이벤트 핸들러
+    '/javascript:/i'      // javascript: 프로토콜
+);
+
 $option_count = (isset($_POST['opt_id']) && is_array($_POST['opt_id'])) ? count($_POST['opt_id']) : array();
 $it_option_subject = '';
 $it_supply_subject = '';
@@ -243,8 +251,18 @@ if($option_count) {
    // 옵션명
    $opt1_cnt = $opt2_cnt = $opt3_cnt = 0;
    for($i=0; $i<$option_count; $i++) {
-        $post_opt_id = isset($_POST['opt_id'][$i]) ? preg_replace(G5_OPTION_ID_FILTER, '', strip_tags($_POST['opt_id'][$i])) : '';
-
+        $post_opt_id = isset($_POST['opt_id'][$i]) ? $_POST['opt_id'][$i] : '';
+        
+        foreach ($forbidden_patterns as $pattern) {
+            if (preg_match($pattern, $post_opt_id)) {
+                $post_opt_id = '';
+                $_POST['opt_id'][$i] = '';
+                continue 2;
+            }
+        }
+        
+        $post_opt_id = preg_replace(G5_OPTION_ID_FILTER, '', strip_tags($post_opt_id));
+            
        $opt_val = explode(chr(30), $post_opt_id);
        if(isset($opt_val[0]) && $opt_val[0])
            $opt1_cnt++;
@@ -271,8 +289,18 @@ if($supply_count) {
    // 추가옵션명
    $arr_spl = array();
    for($i=0; $i<$supply_count; $i++) {
-        $post_spl_id = isset($_POST['spl_id'][$i]) ? preg_replace(G5_OPTION_ID_FILTER, '', strip_tags($_POST['spl_id'][$i])) : '';
-
+        $post_spl_id = isset($_POST['spl_id'][$i]) ? $_POST['spl_id'][$i] : '';
+        
+        foreach ($forbidden_patterns as $pattern) {
+            if (preg_match($pattern, $post_spl_id)) {
+                $post_spl_id = '';
+                $_POST['spl_id'][$i] = '';
+                continue 2;
+            }
+        }
+        
+        $post_spl_id = preg_replace(G5_OPTION_ID_FILTER, '', strip_tags($post_spl_id));
+        
        $spl_val = explode(chr(30), $post_spl_id);
        if(!in_array($spl_val[0], $arr_spl))
            $arr_spl[] = $spl_val[0];
@@ -84,11 +84,11 @@ if($po_run) {
    ?>
    <tr>
        <td class="td_chk">
-            <input type="hidden" name="opt_id[]" value="<?php echo $opt_id; ?>">
+            <input type="hidden" name="opt_id[]" value="<?php echo get_text($opt_id); ?>">
            <label for="opt_chk_<?php echo $i; ?>" class="sound_only"></label>
            <input type="checkbox" name="opt_chk[]" id="opt_chk_<?php echo $i; ?>" value="1">
        </td>
-        <td class="opt-cell"><?php echo $opt_1; if ($opt_2_len) echo ' <small>&gt;</small> '.$opt_2; if ($opt_3_len) echo ' <small>&gt;</small> '.$opt_3; ?></td>
+        <td class="opt-cell"><?php echo get_text($opt_1); if ($opt_2_len) echo ' <small>&gt;</small> '.get_text($opt_2); if ($opt_3_len) echo ' <small>&gt;</small> '.get_text($opt_3); ?></td>
        <td class="td_numsmall">
            <label for="opt_price_<?php echo $i; ?>" class="sound_only"></label>
            <input type="text" name="opt_price[]" value="<?php echo $opt_price; ?>" id="opt_price_<?php echo $i; ?>" class="frm_input" size="9">
@@ -55,12 +55,12 @@ if($ps_run) {
    ?>
    <tr>
        <td class="td_chk">
-            <input type="hidden" name="spl_id[]" value="<?php echo $spl_id; ?>">
-            <label for="spl_chk_<?php echo $i; ?>" class="sound_only"><?php echo $spl_subject.' '.$spl; ?></label>
+            <input type="hidden" name="spl_id[]" value="<?php echo get_text($spl_id); ?>">
+            <label for="spl_chk_<?php echo $i; ?>" class="sound_only"><?php echo get_text($spl_subject.' '.$spl); ?></label>
            <input type="checkbox" name="spl_chk[]" id="spl_chk_<?php echo $i; ?>" value="1">
        </td>
-        <td class="spl-subject-cell"><?php echo $spl_subject; ?></td>
-        <td class="spl-cell"><?php echo $spl; ?></td>
+        <td class="spl-subject-cell"><?php echo get_text($spl_subject); ?></td>
+        <td class="spl-cell"><?php echo get_text($spl); ?></td>
        <td class="td_numsmall">
            <label for="spl_price_<?php echo $i; ?>" class="sound_only">상품금액</label>
            <input type="text" name="spl_price[]" value="<?php echo $spl_price; ?>" id="spl_price_<?php echo $i; ?>" class="frm_input" size="5">
@@ -16,6 +16,7 @@ $sort2 = (isset($_GET['sort2']) && in_array($_GET['sort2'], array('desc', 'asc')
 $sel_field = (isset($_GET['sel_field']) && in_array($_GET['sel_field'], array('od_id', 'mb_id', 'od_name', 'od_tel', 'od_hp', 'od_b_name', 'od_b_tel', 'od_b_hp', 'od_deposit_name', 'od_invoice')) ) ? $_GET['sel_field'] : ''; 
 $od_status = isset($_GET['od_status']) ? get_search_string($_GET['od_status']) : '';
 $search = isset($_GET['search']) ? get_search_string($_GET['search']) : '';
+$save_search = isset($_GET['save_search']) ? get_search_string($_GET['save_search']) : '';

 $fr_date = (isset($_GET['fr_date']) && preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $_GET['fr_date'])) ? $_GET['fr_date'] : '';
 $to_date = (isset($_GET['to_date']) && preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $_GET['to_date'])) ? $_GET['to_date'] : '';
@@ -5,6 +5,16 @@ include_once(G5_ADMIN_PATH.'/admin.lib.php');
 include_once(G5_SMS5_PATH.'/sms5.lib.php');

 if (!strstr($_SERVER['SCRIPT_NAME'], 'install.php')) {
+    // SMS5 테이블 G5_TABLE_PREFIX 적용
+    if($g5['sms5_prefix'] != 'sms5_' && sql_num_rows(sql_query("show tables like 'sms5_config'")))
+    {
+        echo '<script>
+            alert("기존 SMS5 테이블을 sms5 prefix 기준으로 변경합니다.\n(DB 업그레이드에서 자동 적용됩니다.)");
+            location.href = "'.G5_ADMIN_URL.'/dbupgrade.php";
+        </script>';
+        exit;
+    }
+
    if(!sql_num_rows(sql_query(" show tables like '{$g5['sms5_config_table']}' ")))
        goto_url('install.php');

@@ -14,7 +14,9 @@ if($config['cf_visit_del'] > 0) {
    $tmp_before_date = date("Y-m-d", G5_SERVER_TIME - ($config['cf_visit_del'] * 86400));
    $sql = " delete from {$g5['visit_table']} where vi_date < '$tmp_before_date' ";
    sql_query($sql);
-    sql_query(" OPTIMIZE TABLE `{$g5['visit_table']}`, `{$g5['visit_sum_table']}` ");
+    if (defined('G5_USE_OPTIMIZE_DBTABLE') && G5_USE_OPTIMIZE_DBTABLE) {
+        sql_query(" OPTIMIZE TABLE `{$g5['visit_table']}`, `{$g5['visit_sum_table']}` ");
+    }
 }

 // 설정일이 지난 인기검색어 삭제
@@ -22,21 +24,29 @@ if($config['cf_popular_del'] > 0) {
    $tmp_before_date = date("Y-m-d", G5_SERVER_TIME - ($config['cf_popular_del'] * 86400));
    $sql = " delete from {$g5['popular_table']} where pp_date < '$tmp_before_date' ";
    sql_query($sql);
-    sql_query(" OPTIMIZE TABLE `{$g5['popular_table']}` ");
+    if (defined('G5_USE_OPTIMIZE_DBTABLE') && G5_USE_OPTIMIZE_DBTABLE) {
+        sql_query(" OPTIMIZE TABLE `{$g5['popular_table']}` ");
+    }
 }

 // 설정일이 지난 최근게시물 삭제
 if($config['cf_new_del'] > 0) {
    $sql = " delete from {$g5['board_new_table']} where (TO_DAYS('".G5_TIME_YMDHIS."') - TO_DAYS(bn_datetime)) > '{$config['cf_new_del']}' ";
    sql_query($sql);
-    sql_query(" OPTIMIZE TABLE `{$g5['board_new_table']}` ");
+    
+    // 데이터가 많으면 처리시간 때문에 브라우저 응답이 늦을수 있음
+    if (defined('G5_USE_OPTIMIZE_DBTABLE') && G5_USE_OPTIMIZE_DBTABLE) {
+        sql_query(" OPTIMIZE TABLE `{$g5['board_new_table']}` ");
+    }
 }

 // 설정일이 지난 쪽지 삭제
 if($config['cf_memo_del'] > 0) {
    $sql = " delete from {$g5['memo_table']} where (TO_DAYS('".G5_TIME_YMDHIS."') - TO_DAYS(me_send_datetime)) > '{$config['cf_memo_del']}' ";
    sql_query($sql);
-    sql_query(" OPTIMIZE TABLE `{$g5['memo_table']}` ");
+    if (defined('G5_USE_OPTIMIZE_DBTABLE') && G5_USE_OPTIMIZE_DBTABLE) {
+        sql_query(" OPTIMIZE TABLE `{$g5['memo_table']}` ");
+    }
 }

 // 탈퇴회원 자동 삭제
@@ -65,4 +75,8 @@ if($captcha_mp3 && is_array($captcha_mp3)) {
 // 실행일 기록
 if(isset($config['cf_optimize_date'])) {
    sql_query(" update {$g5['config_table']} set cf_optimize_date = '".G5_TIME_YMD."' ");
-}
+    
+    run_event('cf_optimize_date_update', $config);
+}
+
+run_event('db_table_optimize_end', $config);
@@ -1,6 +1,8 @@
 <?php
 include_once('./_common.php');

+$good = isset($_REQUEST['good']) ? preg_replace('/[^a-z0-9]/i', '', $_REQUEST['good']) : '';
+
 run_event('bbs_good_before', $bo_table, $wr_id, $good);

@include_once($board_skin_path.'/good.head.skin.php');
@@ -1,7 +1,11 @@
 <?php
 include_once('./_common.php');

-$html_title = '링크 &gt; '.conv_subject($write['wr_subject'], 255);
+$html_title = '링크';
+
+if (isset($write['wr_subject']) && $write['wr_subject']) {
+    $html_title .= ' &gt; '.conv_subject($write['wr_subject'], 255);
+}

 $no = isset($_REQUEST['no']) ? preg_replace('/[^0-9]/i', '', $_REQUEST['no']) : '';

@@ -10,10 +14,10 @@ if (!($bo_table && $wr_id && $no))

 // SQL Injection 예방
 $row = sql_fetch(" select count(*) as cnt from {$g5['write_prefix']}{$bo_table} ", FALSE);
-if (!$row['cnt'])
+if (!(isset($row['cnt']) && $row['cnt']))
    alert_close('존재하는 게시판이 아닙니다.');

-if (!$write['wr_link'.$no])
+if (!(isset($write['wr_link'.$no]) && $write['wr_link'.$no]))
    alert_close('링크가 없습니다.');

 $ss_name = 'ss_link_'.$bo_table.'_'.$wr_id.'_'.$no;
@@ -86,6 +86,7 @@ $qa_related = 0;
 $qa_email_recv = (isset($_POST['qa_email_recv']) && $_POST['qa_email_recv']) ? 1 : 0;
 $qa_sms_recv = (isset($_POST['qa_sms_recv']) && $_POST['qa_sms_recv']) ? 1 : 0;
 $qa_status = 0;
+$qa_html = (isset($_POST['qa_html']) && $_POST['qa_html']) ? (int) $_POST['qa_html'] : 0;
 $answer_id = null;

 for ($i=1; $i<=5; $i++) {
@@ -64,15 +64,15 @@ $mb_8           = isset($_POST['mb_8'])             ? trim($_POST['mb_8'])
 $mb_9           = isset($_POST['mb_9'])             ? trim($_POST['mb_9'])           : "";
 $mb_10          = isset($_POST['mb_10'])            ? trim($_POST['mb_10'])          : "";

-$mb_name        = clean_xss_tags($mb_name);
+$mb_name        = clean_xss_tags($mb_name, 1, 1);
 $mb_email       = get_email_address($mb_email);
-$mb_homepage    = clean_xss_tags($mb_homepage);
-$mb_tel         = clean_xss_tags($mb_tel);
+$mb_homepage    = clean_xss_tags($mb_homepage, 1, 1);
+$mb_tel         = clean_xss_tags($mb_tel, 1, 1);
 $mb_zip1        = preg_replace('/[^0-9]/', '', $mb_zip1);
 $mb_zip2        = preg_replace('/[^0-9]/', '', $mb_zip2);
-$mb_addr1       = clean_xss_tags($mb_addr1);
-$mb_addr2       = clean_xss_tags($mb_addr2);
-$mb_addr3       = clean_xss_tags($mb_addr3);
+$mb_addr1       = clean_xss_tags($mb_addr1, 1, 1);
+$mb_addr2       = clean_xss_tags($mb_addr2, 1, 1);
+$mb_addr3       = clean_xss_tags($mb_addr3, 1, 1);
 $mb_addr_jibeon = preg_match("/^(N|R)$/", $mb_addr_jibeon) ? $mb_addr_jibeon : '';

 run_event('register_form_update_before', $mb_id, $w);
@@ -7,7 +7,7 @@ if ($is_guest && $board['bo_comment_level'] < 2) {
    $captcha_html = captcha_html('_comment');
 }

-$c_id = isset($_GET['c_id']) ? clean_xss_tags($_GET['c_id'], 1, 1) : '';
+$c_id = isset($_GET['c_id']) ? preg_replace('/[\'",]/', '', clean_xss_tags($_GET['c_id'], 1, 1)) : '';
 $c_wr_content = '';

@include_once($board_skin_path.'/view_comment.head.skin.php');
@@ -6,8 +6,8 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
 {
    set_cookie('ck_visit_ip', $_SERVER['REMOTE_ADDR'], 86400); // 하루동안 저장

-    $tmp_row = sql_fetch(" select max(vi_id) as max_vi_id from {$g5['visit_table']} ");
-    $vi_id = $tmp_row['max_vi_id'] + 1;
+    // $tmp_row = sql_fetch(" select max(vi_id) as max_vi_id from {$g5['visit_table']} ");
+    // $vi_id = $tmp_row['max_vi_id'] + 1;

    // $_SERVER 배열변수 값의 변조를 이용한 SQL Injection 공격을 막는 코드입니다. 110810
    $remote_addr = escape_trim($_SERVER['REMOTE_ADDR']);
@@ -23,7 +23,7 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
    if(version_compare(phpversion(), '5.3.0', '>=') && defined('G5_BROWSCAP_USE') && G5_BROWSCAP_USE) {
        include_once(G5_BBS_PATH.'/visit_browscap.inc.php');
    }
-    $sql = " insert {$g5['visit_table']} ( vi_id, vi_ip, vi_date, vi_time, vi_referer, vi_agent, vi_browser, vi_os, vi_device ) values ( '{$vi_id}', '{$remote_addr}', '".G5_TIME_YMD."', '".G5_TIME_HIS."', '{$referer}', '{$user_agent}', '{$vi_browser}', '{$vi_os}', '{$vi_device}' ) ";
+    $sql = " insert {$g5['visit_table']} ( vi_ip, vi_date, vi_time, vi_referer, vi_agent, vi_browser, vi_os, vi_device ) values ( '{$remote_addr}', '".G5_TIME_YMD."', '".G5_TIME_HIS."', '{$referer}', '{$user_agent}', '{$vi_browser}', '{$vi_os}', '{$vi_device}' ) ";

    $result = sql_query($sql, FALSE);
    // 정상으로 INSERT 되었다면 방문자 합계에 반영
@@ -20,7 +20,7 @@ if (!($w == '' || $w == 'u' || $w == 'r')) {
 }

 if ($w == 'u' || $w == 'r') {
-    if ($write['wr_id']) {
+    if (isset($write['wr_id']) && $write['wr_id']) {
        // 가변 변수로 $wr_1 .. $wr_10 까지 만든다.
        for ($i=1; $i<=10; $i++) {
            $vvar = "wr_".$i;
@@ -525,7 +525,6 @@ if (isset($_REQUEST['gr_id'])) {
 }
 //===================================

-
 // 자동로그인 부분에서 첫로그인에 포인트 부여하던것을 로그인중일때로 변경하면서 코드도 대폭 수정하였습니다.
 if (isset($_SESSION['ss_mb_id']) && $_SESSION['ss_mb_id']) { // 로그인중이라면
    $member = get_member($_SESSION['ss_mb_id']);
@@ -585,20 +584,8 @@ if (isset($_SESSION['ss_mb_id']) && $_SESSION['ss_mb_id']) { // 로그인중이
    // 자동로그인 end ---------------------------------------
 }

-// 회원, 비회원 구분
-$is_member = $is_guest = false;
-$is_admin = '';
-if (isset($member['mb_id']) && $member['mb_id']) {
-    $is_member = true;
-    $is_admin = is_admin($member['mb_id']);
-    $member['mb_dir'] = substr($member['mb_id'],0,2);
-} else {
-    $is_guest = true;
-    $member['mb_id'] = '';
-    $member['mb_level'] = 1; // 비회원의 경우 회원레벨을 가장 낮게 설정
-}
-
-if ($is_admin != 'super') {
+// 최고관리자가 아니면 IP를 체크한다.
+if (!(isset($member['mb_id']) && $config['cf_admin'] === $member['mb_id'])) {
    // 접근가능 IP
    $cf_possible_ip = trim($config['cf_possible_ip']);
    if ($cf_possible_ip) {
@@ -675,6 +662,19 @@ if ($config['cf_editor']) {
    define('G5_EDITOR_LIB', G5_LIB_PATH."/editor.lib.php");
 }

+// 회원, 비회원 구분
+$is_member = $is_guest = false;
+$is_admin = '';
+if (isset($member['mb_id']) && $member['mb_id']) {
+    $is_member = true;
+    $is_admin = is_admin($member['mb_id']);
+    $member['mb_dir'] = substr($member['mb_id'],0,2);
+} else {
+    $is_guest = true;
+    $member['mb_id'] = '';
+    $member['mb_level'] = 1; // 비회원의 경우 회원레벨을 가장 낮게 설정
+}
+
 // 테마경로
 if(defined('_THEME_PREVIEW_') && _THEME_PREVIEW_ === true)
    $config['cf_theme'] = isset($_GET['theme']) ? trim($_GET['theme']) : '';
@@ -812,6 +812,7 @@ box-shadow: 1px 2px 2px #eee;}
 #sod_frm_paysel .inicis_kakaopay em{position:absolute;top:15px;left:45px;width:70px;height:30px;background:url('../img/kakao.png') no-repeat 50% 50% #ffeb00;overflow:hidden;text-indent:-999px;border-radius:30px}
 #sod_frm_paysel .kakaopay_icon{background:url('../img/kakao.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .naverpay_icon{background:url('../img/ico-default-naverpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;background-position: 50% 30%;padding-top:35px;padding-left:0;text-align:center}
 #sod_frm_paysel .samsungpay_icon{background:url('../img/samsungpay.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .ssgpay_icon{background:url('../img/ssgpay_icon.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .skpay_icon{background:url('../img/skpay11_icon.png') no-repeat 50% 50% #fff; background-size: 70px;display:inline-block;overflow:hidden;text-indent:-999px}
@@ -1151,6 +1152,8 @@ box-shadow: 1px 2px 2px #eee;}
 .sod_frm_mobile #m_sod_frm_paysel .inicis_lpay{background:url(../img/lpay_logo.png) no-repeat;width:35px;height:12px;overflow:hidden;text-indent:-999px;display:inline-block;background-size:100%}
 .sod_frm_mobile #m_sod_frm_paysel .inicis_kakaopay{background:url(../img/kakao.png) no-repeat 50% 50% #f4dc34;border-radius:30px;height:22px;width:74px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
 .sod_frm_mobile #m_sod_frm_paysel .kakaopay_icon{background:url(../img/kakao.png) no-repeat 50% 50% #f4dc34;border-radius:30px;height:22px;width:74px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
+.sod_frm_mobile #m_sod_frm_paysel .naverpay_icon{background:url(../img/ico-default-naverpay.png) no-repeat 50% 50% #fff;border-radius:30px;height:22px;width:50px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
+.sod_frm_mobile #m_sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;padding-left:50px;padding-top:2px;width:83px}
 .sod_frm_mobile #m_sod_frm_paysel .applepay_icon{background:url(../img/ico-mobile-applepay.png) no-repeat 50% 50% #fff;border-radius:30px;height:23px;width:50px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
 .sod_frm_mobile #m_sod_frm_paysel .samsung_pay{margin-left:-23px;background:url(../img/samsungpay.png) no-repeat 24px 3px;height:25px;width:106px;display:inline-block;overflow:hidden;text-indent:-999px}
 .sod_frm_mobile #sod_frm_pay{border-top:1px solid #f3f3f3}
@@ -228,6 +228,7 @@ box-shadow: 0 0 6px rgba(0,0,0,0.2);}
 #m_sod_frm_paysel .inicis_kakaopay{background:url('../img/kakao.png') no-repeat 50% 50% #ffeb00;border-radius:30px;height:26px;width:74px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:36px auto}
 #m_sod_frm_paysel .kakaopay_icon{background:url('../img/ico-mobile-kakaopay.png') no-repeat #fff;height:23px;width:63px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:45px auto;background-position: 10% 40%}
 #m_sod_frm_paysel .naverpay_icon{background:url('../img/ico-mobile-naverpay.png') no-repeat #fff;height:23px;width:60px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:45px auto;background-position: 0% 30%}
+#m_sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;padding-left:50px;padding-top:2px;width:83px}
 #m_sod_frm_paysel .applepay_icon{background:url('../img/ico-mobile-applepay.png') no-repeat #fff;height:30px;width:60px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:43px auto}
 #m_sod_frm_paysel .ssgpay_icon{background:url('../img/ssgpay_icon.png') no-repeat 0px 3px #fff;width:55px;height:20px;background-size:100%;display:inline-block;overflow:hidden;text-indent:-999px}
 #m_sod_frm_paysel .skpay_icon{background:url('../img/skpay11_icon.png') no-repeat 0px 3px #fff;width:55px;height:20px;background-size:100%;display:inline-block;overflow:hidden;text-indent:-999px}
@@ -914,6 +915,7 @@ box-shadow:0 0 8px rgba(65,98,255,0.8)}
 #sod_frm_paysel .inicis_kakaopay{background:url('../img/kakao.png') no-repeat 50% 50% #f4dc34;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .kakaopay_icon{background:url('../img/kakao.png') no-repeat 50% 50% #f4dc34;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .naverpay_icon{background:url('../img/ico-default-naverpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;background-position: 50% 30%;padding-top:35px;padding-left:0;text-align:center}
 #sod_frm_paysel .samsungpay_icon{background:url('../img/samsungpay.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .ssgpay_icon{background:url('../img/ssgpay_icon.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .skpay_icon{background:url('../img/skpay11_icon.png') no-repeat 50% 50% #fff; background-size: 70px;display:inline-block;overflow:hidden;text-indent:-999px}
@@ -20,7 +20,7 @@ define('G5_ICODE_LMS_MAX_LENGTH', 1500);    // 구버전 LMS 최대길이
 define('G5_ICODE_JSON_MAX_LENGTH', 2000);   // JSON 버전 LMS 최대길이

 // SMS 테이블명
-$g5['sms5_prefix']                = 'sms5_';
+$g5['sms5_prefix']                = G5_TABLE_PREFIX.'sms5_';
 $g5['sms5_config_table']          = $g5['sms5_prefix'] . 'config';
 $g5['sms5_write_table']           = $g5['sms5_prefix'] . 'write';
 $g5['sms5_history_table']         = $g5['sms5_prefix'] . 'history';
@@ -257,7 +257,13 @@ function url_auto_link($str)
 {
    global $g5;
    global $config;
-
+    
+    if ($replace_str = run_replace('url_auto_link_before', '', $str)) {
+        return $replace_str;
+    }
+    
+    $ori_str = $str;
+    
    // 140326 유창화님 제안코드로 수정
    // http://sir.kr/pg_lecture/461
    // http://sir.kr/pg_lecture/463
@@ -290,7 +296,7 @@ function url_auto_link($str)
    $str = preg_replace("/\t_gt_\t/", "&gt;", $str);
    */

-    return run_replace('url_auto_link', $str);
+    return run_replace('url_auto_link', $str, $ori_str);
 }


@@ -685,6 +691,10 @@ function html_purifier($html)
    )
    );

+    // 커스텀 URI 필터 등록
+    $def = $config->getDefinition('URI', true); // URI 정의 가져오기
+    $def->addFilter(new HTMLPurifierContinueParamFilter(), $config); // 커스텀 필터 추가
+
    $purifier = new HTMLPurifier($config);

    return run_replace('html_purifier_result', $purifier->purify($html), $purifier, $html);
@@ -1131,7 +1141,11 @@ function insert_point($mb_id, $point, $content='', $rel_table='', $rel_id='', $r
 function insert_use_point($mb_id, $point, $po_id='')
 {
    global $g5, $config;
-
+    
+    if ($replace_insert = run_replace('insert_use_point_before', '', $mb_id, $point, $po_id)) {
+        return $replace_insert;
+    }
+    
    if($config['cf_point_term'])
        $sql_order = " order by po_expire_date asc, po_id asc ";
    else
@@ -2531,6 +2545,10 @@ function get_uniqid()
 {
    global $g5;

+    if ($get_uniqid_key = run_replace('get_uniqid_key', '')) {
+        return $get_uniqid_key;
+    }
+    
    sql_query(" LOCK TABLE {$g5['uniqid_table']} WRITE ");
    while (1) {
        // 년월일시분초에 100분의 1초 두자리를 추가함 (1/100 초 앞에 자리가 모자르면 0으로 채움)
@@ -3411,6 +3429,12 @@ function clean_xss_tags($str, $check_entities=0, $is_remove_tags=0, $cur_str_len
        $result = preg_replace('#([^\p{L}]|^)(?:javascript|jar|applescript|vbscript|vbs|wscript|jscript|behavior|mocha|livescript|view-source)\s*:(?:.*?([/\\\;()\'">]|$))#ius',
                '$1$2', $result);

+        // 이벤트 핸들러 속성 제거 (예: onclick=, onerror= 등)
+        $result = preg_replace('/on\w+\s*=\s*(".*?"|\'.*?\'|[^\s>]+)/i', '', $result);
+        
+        // 속성 제거 (CSS 기반 인젝션 차단)
+        $result = preg_replace('/\s*style\s*=\s*(".*?"|\'.*?\'|[^\s>]+)/i', '', $result);
+        
        if((string)$result === (string)$str) break;

        $str = $result;
@@ -3667,6 +3691,10 @@ function check_url_host($url, $msg='', $return_url=G5_URL, $is_redirect=false)
        alert('url 에 올바르지 않은 값이 포함되어 있습니다.');
    }

+    if (preg_match('#//[^/@]+@#', $url)) {
+        alert('url에 사용자 정보가 포함되어 있어 접근할 수 없습니다.');
+    }
+
    while ( ( $replace_url = preg_replace(array('/\/{2,}/', '/\\@/'), array('//', ''), urldecode($url)) ) != $url ) {
        $url = $replace_url;
    }
@@ -4111,15 +4139,9 @@ function safe_replace_regex($str, $str_case=''){
    return preg_replace('/[^0-9a-z_\-]/i', '', $str);
 }

-function get_real_client_ip(){
-
-    $real_ip = $_SERVER['REMOTE_ADDR'];
-
-    if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\z/', $_SERVER['HTTP_X_FORWARDED_FOR']) ){
-        $real_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
-    }
-
-    return preg_replace('/[^0-9.]/', '', $real_ip);
+function get_real_client_ip() {
+    
+    return run_replace('get_real_client_ip', $_SERVER['REMOTE_ADDR']);
 }

 function check_mail_bot($ip=''){
@@ -4188,7 +4210,14 @@ function is_include_path_check($path='', $is_input='')
            if ( $peer_count && $peer_count > $slash_count ){
                return false;
            }
-
+            
+            $dirname_doc_root = !empty($_SERVER['DOCUMENT_ROOT']) ? dirname($_SERVER['DOCUMENT_ROOT']) : dirname(dirname(dirname(__DIR__)));
+            
+            // 웹서버 폴더만 허용
+            if ($dirname_doc_root && file_exists($path) && strpos(realpath($path), realpath($dirname_doc_root)) !== 0) {
+                return false;
+            }
+            
            try {
                // whether $path is unix or not
                $unipath = strlen($path)==0 || substr($path, 0, 1) != '/';
@@ -4224,8 +4253,8 @@ function is_include_path_check($path='', $is_input='')
                //echo 'Caught exception: ',  $e->getMessage(), "\n";
                return false;
            }
-
-            if( preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $replace_path) ){
+            
+            if (preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $replace_path) || preg_match('/pe(?:ar|cl)(?:cmd)?\.php/i', $replace_path)){
                return false;
            }
            if( preg_match('/'.G5_PLUGIN_DIR.'\//i', $replace_path) && (preg_match('/'.G5_OKNAME_DIR.'\//i', $replace_path) || preg_match('/'.G5_KCPCERT_DIR.'\//i', $replace_path) || preg_match('/'.G5_LGXPAY_DIR.'\//i', $replace_path)) || (preg_match('/search\.skin\.php/i', $replace_path) ) ){
@@ -50,6 +50,7 @@ function create_hash($password, $force_compat = false)
        $salt = base64_encode(mcrypt_create_iv(PBKDF2_COMPAT_SALT_BYTES, MCRYPT_DEV_URANDOM));
    } elseif (@file_exists('/dev/urandom') && $fp = @fopen('/dev/urandom', 'r')) {
        $salt = base64_encode(fread($fp, PBKDF2_COMPAT_SALT_BYTES));
+        fclose($fp); // 파일 닫기
    } else {
        $salt = '';
        for ($i = 0; $i < PBKDF2_COMPAT_SALT_BYTES; $i += 2) {
@@ -1010,7 +1010,7 @@ function get_item_options($it_id, $subject, $is_div='', $is_first_option_title='
                for($k=0; $k<$opt_count; $k++) {
                    $opt_val = $opt[$k];
                    if(strlen($opt_val)) {
-                        $select .= '<option value="'.$opt_val.'">'.$opt_val.'</option>'.PHP_EOL;
+                        $select .= '<option value="'.get_text($opt_val).'">'.get_text($opt_val).'</option>'.PHP_EOL;
                    }
                }
                $select .= '</select>'.PHP_EOL;
@@ -1046,7 +1046,7 @@ function get_item_options($it_id, $subject, $is_div='', $is_first_option_title='
            else
                $soldout = '';

-            $select .= '<option value="'.$row['io_id'].','.$row['io_price'].','.$row['io_stock_qty'].'">'.$row['io_id'].$price.$soldout.'</option>'.PHP_EOL;
+            $select .= '<option value="'.get_text($row['io_id']).','.$row['io_price'].','.$row['io_stock_qty'].'">'.get_text($row['io_id']).$price.$soldout.'</option>'.PHP_EOL;
        }
        $select .= '</select>'.PHP_EOL;
        
@@ -1101,7 +1101,7 @@ function get_item_supply($it_id, $subject, $is_div='', $is_first_option_title=''
            else
                $soldout = '';

-            $options[$opt_id[0]][] = '<option value="'.$opt_id[1].','.$row['io_price'].','.$io_stock_qty.'">'.$opt_id[1].$price.$soldout.'</option>';
+            $options[$opt_id[0]][] = '<option value="'.get_text($opt_id[1]).','.$row['io_price'].','.$io_stock_qty.'">'.get_text($opt_id[1]).$price.$soldout.'</option>';
        }
    }

@@ -1122,7 +1122,7 @@ function get_item_supply($it_id, $subject, $is_div='', $is_first_option_title=''
            $first_option_title = $is_first_option_title ? $subj[$i] : '선택';

            $select = '<select id="it_supply_'.$seq.'" class="it_supply">'.PHP_EOL;
-            $select .= '<option value="">'.$first_option_title.'</option>'.PHP_EOL;
+            $select .= '<option value="">'.get_text($first_option_title).'</option>'.PHP_EOL;
            for($k=0; $k<$opt_count; $k++) {
                $opt_val = $opt[$k];
                if($opt_val) {
@@ -2641,10 +2641,10 @@ function make_order_field($data, $exclude)

        if(is_array($value)) {
            foreach($value as $k=>$v) {
-                $field .= '<input type="hidden" name="'.$key.'['.$k.']" value="'.get_text($v).'">'.PHP_EOL;
+                $field .= '<input type="hidden" name="'.get_text($key.'['.$k.']').'" value="'.get_text($v).'">'.PHP_EOL;
            }
        } else {
-            $field .= '<input type="hidden" name="'.$key.'" value="'.get_text($value).'">'.PHP_EOL;
+            $field .= '<input type="hidden" name="'.get_text($key).'" value="'.get_text($value).'">'.PHP_EOL;
        }
    }

@@ -2823,7 +2823,7 @@ function check_pay_name_replace($payname, $od=array(), $is_client=0){
        } else if( isset($od['od_pg']) && $od['od_pg'] === 'inicis' ){
            return 'KPAY';
        } else if( isset($od['od_pg']) && $od['od_pg'] === 'kcp' ){
-            if( isset($od['od_other_pay_type']) && $od['od_other_pay_type'] === 'OT16' ){
+            if( isset($od['od_other_pay_type']) && ($od['od_other_pay_type'] === 'OT16' || $od['od_other_pay_type'] === 'NHNKCP_NAVERMONEY')){
                return '네이버페이_NHNKCP'.$add_str;
            } else if( isset($od['od_other_pay_type']) && ($od['od_other_pay_type'] === 'OT13' || $od['od_other_pay_type'] === 'NHNKCP_KAKAOMONEY') ){
                return '카카오페이_NHNKCP'.$add_str;
@@ -130,13 +130,13 @@
    </wsdl:binding>
    <wsdl:service name="PayService">
        <wsdl:port name="PayServiceHttpSoap11Endpoint" binding="ns:PayServiceSoap11Binding">
-            <soap:address location="https://devpggw.kcp.co.kr:8100/services/KCPPaymentService"/>
+            <soap:address location="https://testsmpay.kcp.co.kr/services/KCPPaymentService"/>
        </wsdl:port>
        <wsdl:port name="PayServiceHttpSoap12Endpoint" binding="ns:PayServiceSoap12Binding">
-            <soap12:address location="https://devpggw.kcp.co.kr:8100/services/KCPPaymentService"/>
+            <soap12:address location="https://testsmpay.kcp.co.kr/services/KCPPaymentService"/>
        </wsdl:port>
        <wsdl:port name="PayServiceHttpEndpoint" binding="ns:PayServiceHttpBinding">
-            <http:address location="https://devpggw.kcp.co.kr:8100/services/KCPPaymentService"/>
+            <http:address location="https://testsmpay.kcp.co.kr/services/KCPPaymentService"/>
        </wsdl:port>
    </wsdl:service>
 </wsdl:definitions>
@@ -23,6 +23,14 @@ jQuery(function($){

            if( nhnkcp_settle_case == "naverpay" ){
                if(typeof nhnkcp_pay_form.naverpay_direct !== "undefined") nhnkcp_pay_form.naverpay_direct.value = "Y";
+                
+                 var is_money = jQuery("input[name='od_settle_case']:checked" ).attr("data-money");
+                
+                if (is_money) {     // 머니/포인트 결제
+                    jQuery(nhnkcp_pay_form).find("input[name='naverpay_point_direct']").val("Y");
+                } else {    // 카드 결제
+                    jQuery(nhnkcp_pay_form).find("input[name='naverpay_point_direct']").val("");
+                }
            }

            if( ! jQuery("form[name='sm_form']").length ){
@@ -37,7 +37,7 @@ include_once('./_common.php');
    $tran_cd         = isset($_POST["tran_cd"]) ? $_POST["tran_cd"] : ''; // 트랜잭션 코드
    $ordr_idxx       = isset($_POST["ordr_idxx"]) ? $_POST["ordr_idxx"] : ''; // 쇼핑몰 주문번호
    $good_name       = isset($_POST["good_name"]) ? $_POST["good_name"] : ''; // 상품명
-    $good_mny        = isset($_POST["good_mny"]) ? $_POST["good_mny"] : ''; // 결제 총금액
+    $good_mny        = isset($_POST["good_mny"]) ? (int) $_POST["good_mny"] : ''; // 결제 총금액
    $buyr_name       = isset($_POST["buyr_name"]) ? $_POST["buyr_name"] : ''; // 주문자명
    $buyr_tel1       = isset($_POST["buyr_tel1"]) ? $_POST["buyr_tel1"] : ''; // 주문자 전화번호
    $buyr_tel2       = isset($_POST["buyr_tel2"]) ? $_POST["buyr_tel2"] : ''; // 주문자 핸드폰 번호
@@ -60,9 +60,9 @@ include_once('./_common.php');
    $bask_cntx       = isset($_POST["bask_cntx"]) ? $_POST["bask_cntx"] : ''; // 장바구니 상품수
    $tablet_size     = isset($_POST["tablet_size"]) ? $_POST["tablet_size"] : ''; // 모바일기기 화면비율

-    $comm_tax_mny    = isset($_POST["comm_tax_mny"]) ? $_POST["comm_tax_mny"] : ''; // 과세금액
-    $comm_vat_mny    = isset($_POST["comm_vat_mny"]) ? $_POST["comm_vat_mny"] : ''; // 부가세
-    $comm_free_mny   = isset($_POST["comm_free_mny"]) ? $_POST["comm_free_mny"] : ''; // 비과세금액
+    $comm_tax_mny    = isset($_POST["comm_tax_mny"]) ? (int) $_POST["comm_tax_mny"] : ''; // 과세금액
+    $comm_vat_mny    = isset($_POST["comm_vat_mny"]) ? (int) $_POST["comm_vat_mny"] : ''; // 부가세
+    $comm_free_mny   = isset($_POST["comm_free_mny"]) ? (int) $_POST["comm_free_mny"] : ''; // 비과세금액

    $payco_direct    = isset($_POST["payco_direct"]) ? $_POST["payco_direct"] : ''; // PAYCO 결제창 호출
    $naverpay_direct = isset($_POST["naverpay_direct"]) ? $_POST["naverpay_direct"] : ''; // NAVERPAY 결제창 호출
@@ -253,7 +253,7 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
    echo make_order_field($data, $exclude);

    foreach($_POST as $key=>$value) {
-        echo '<input type="hidden" name="'.$key.'" value="'.$value.'">'.PHP_EOL;
+        echo '<input type="hidden" name="'.get_text($key).'" value="'.get_text($value).'">'.PHP_EOL;
    }

    echo '</form>'.PHP_EOL;
@@ -262,12 +262,12 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {

 <form name="sm_form" method="POST" accept-charset="euc-kr">

-<input type="hidden" name="good_name" value="<?php echo $good_name; ?>">
+<input type="hidden" name="good_name" value="<?php echo get_text($good_name); ?>">
 <input type="hidden" name="good_mny"  value="<?php echo $good_mny; ?>" >
-<input type="hidden" name='buyr_name' value="<?php echo $buyr_name; ?>">
-<input type="hidden" name="buyr_tel1" value="<?php echo $buyr_tel1; ?>">
-<input type="hidden" name="buyr_tel2" value="<?php echo $buyr_tel2; ?>">
-<input type="hidden" name="buyr_mail" value="<?php echo $buyr_mail; ?>">
+<input type="hidden" name='buyr_name' value="<?php echo get_text($buyr_name); ?>">
+<input type="hidden" name="buyr_tel1" value="<?php echo get_text($buyr_tel1); ?>">
+<input type="hidden" name="buyr_tel2" value="<?php echo get_text($buyr_tel2); ?>">
+<input type="hidden" name="buyr_mail" value="<?php echo get_text($buyr_mail); ?>">
 <?php
 // 가상계좌 입금 마감일을 설정하려면 아래 주석을 풀어서 사용해 주세요.
 //$ipgm_date = date("Ymd", (G5_SERVER_TIME + 86400 * 5));
@@ -279,7 +279,7 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
 <?php } ?>
 <?php if($naverpay_direct){ ?>
 <input type="hidden" name="naverpay_direct"   value="<?php echo get_text($naverpay_direct); ?>">      <!-- 네이버페이 결제창 호출 -->
-    <?php if(isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){     // 네이버페이 포인트 결제 옵션 ?>
+    <?php if(isset($_POST['naverpay_point_direct']) && $_POST['naverpay_point_direct'] && isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){     // 네이버페이 포인트 결제 옵션 ?>
    <input type="hidden" name="naverpay_point_direct" value="Y">    <!-- 네이버페이 포인트 결제를 하려면 naverpay_point_direct 를 Y  -->
    <?php } ?>
 <?php } ?>
@@ -294,13 +294,13 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
 <!-- 요청 구분 -->
 <input type="hidden" name="req_tx"       value="pay">
 <!-- 사이트 코드 -->
-<input type="hidden" name="site_cd"      value="<?php echo $g_conf_site_cd; ?>">
+<input type="hidden" name="site_cd"      value="<?php echo get_text($g_conf_site_cd); ?>">
 <!-- 사이트 이름 -->
-<input type="hidden" name="shop_name"    value="<?php echo $g_conf_site_name; ?>">
+<input type="hidden" name="shop_name"    value="<?php echo get_text($g_conf_site_name); ?>">
 <!-- 결제수단-->
-<input type="hidden" name="pay_method"   value="<?php echo $pay_method; ?>">
+<input type="hidden" name="pay_method"   value="<?php echo get_text($pay_method); ?>">
 <!-- 주문번호 -->
-<input type="hidden"   name="ordr_idxx"    value="<?php echo $ordr_idxx; ?>">
+<input type="hidden"   name="ordr_idxx"    value="<?php echo get_text($ordr_idxx); ?>">
 <!-- 최대 할부개월수 -->
 <input type="hidden" name="quotaopt"     value="12">
 <!-- 통화 코드 -->
@@ -311,29 +311,29 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
 <!-- 반드시 가맹점 주문페이지의 URL을 입력 해주시기 바랍니다. -->
 <input type="hidden" name="Ret_URL"      value="<?php echo G5_MSHOP_URL; ?>/kcp/order_approval_form.php">
 <!-- 인증시 필요한 파라미터(변경불가)-->
-<input type="hidden" name="ActionResult" value="<?php echo $ActionResult; ?>">
+<input type="hidden" name="ActionResult" value="<?php echo get_text($ActionResult); ?>">
 <!-- 에스크로 사용유무 에스크로 사용 업체(가상계좌만 해당)는 Y로 세팅 해주시기 바랍니다.-->
-<input type="hidden" name="escw_used"  value="<?php echo $escw_used; ?>">
+<input type="hidden" name="escw_used"  value="<?php echo get_text($escw_used); ?>">
 <!-- 에스크로 결제처리모드 -->
 <input type="hidden" name="pay_mod"   value="<?php echo ($default['de_escrow_use']?'O':'N'); ?>">
 <!-- 수취인이름 -->
-<input type="hidden" name="rcvr_name" value="<?php echo $rcvr_name; ?>">
+<input type="hidden" name="rcvr_name" value="<?php echo get_text($rcvr_name); ?>">
 <!-- 수취인 연락처 -->
-<input type="hidden" name="rcvr_tel1" value="<?php echo $rcvr_tel1; ?>">
+<input type="hidden" name="rcvr_tel1" value="<?php echo get_text($rcvr_tel1); ?>">
 <!-- 수취인 휴대폰 번호 -->
-<input type="hidden" name="rcvr_tel2" value="<?php echo $rcvr_tel2; ?>">
+<input type="hidden" name="rcvr_tel2" value="<?php echo get_text($rcvr_tel2); ?>">
 <!-- 수취인 E-MAIL -->
-<input type="hidden" name="rcvr_add1" value="<?php echo $rcvr_add1; ?>">
+<input type="hidden" name="rcvr_add1" value="<?php echo get_text($rcvr_add1); ?>">
 <!-- 수취인 우편번호 -->
-<input type="hidden" name="rcvr_add2" value="<?php echo $rcvr_add2; ?>">
+<input type="hidden" name="rcvr_add2" value="<?php echo get_text($rcvr_add2); ?>">
 <!-- 수취인 주소 -->
-<input type="hidden" name="rcvr_mail" value="<?php echo $rcvr_mail; ?>">
+<input type="hidden" name="rcvr_mail" value="<?php echo get_text($rcvr_mail); ?>">
 <!-- 수취인 상세 주소 -->
-<input type="hidden" name="rcvr_zipx" value="<?php echo $rcvr_zipx; ?>">
+<input type="hidden" name="rcvr_zipx" value="<?php echo get_text($rcvr_zipx); ?>">
 <!-- 장바구니 상품 개수 -->
-<input type="hidden" name="bask_cntx" value="<?php echo $bask_cntx; ?>">
+<input type="hidden" name="bask_cntx" value="<?php echo get_text($bask_cntx); ?>">
 <!-- 장바구니 정보(상단 스크립트 참조) -->
-<input type="hidden" name="good_info" value="<?php echo $good_info; ?>">
+<input type="hidden" name="good_info" value="<?php echo get_text($good_info); ?>">
 <!-- 배송소요기간 -->
 <input type="hidden" name="deli_term" value="03">
 <!-- 기타 파라메터 추가 부분 - Start - -->
@@ -343,7 +343,7 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
 <input type="hidden" name="disp_tax_yn"  value="N">
 <!-- 기타 파라메터 추가 부분 - End - -->
 <!-- 화면 크기조정 부분 - Start - -->
-<input type="hidden" name="tablet_size"	 value="<?php echo $tablet_size; ?>"/>
+<input type="hidden" name="tablet_size"	 value="<?php echo get_text($tablet_size); ?>"/>
 <!-- 화면 크기조정 부분 - End - -->
 <!--
 	사용 카드 설정
@@ -383,15 +383,15 @@ if($default['de_tax_flag_use']) {
 }
 ?>

-<input type="hidden" name="res_cd"         value="<?php echo $res_cd; ?>">      <!-- 결과 코드          -->
-<input type="hidden" name="tran_cd"        value="<?php echo $tran_cd; ?>">     <!-- 트랜잭션 코드      -->
-<input type="hidden" name="enc_info"       value="<?php echo $enc_info; ?>">    <!-- 암호화 정보        -->
-<input type="hidden" name="enc_data"       value="<?php echo $enc_data; ?>">    <!-- 암호화 데이터      -->
+<input type="hidden" name="res_cd"         value="<?php echo get_text($res_cd); ?>">      <!-- 결과 코드          -->
+<input type="hidden" name="tran_cd"        value="<?php echo get_text($tran_cd); ?>">     <!-- 트랜잭션 코드      -->
+<input type="hidden" name="enc_info"       value="<?php echo get_text($enc_info); ?>">    <!-- 암호화 정보        -->
+<input type="hidden" name="enc_data"       value="<?php echo get_text($enc_data); ?>">    <!-- 암호화 데이터      -->
 </form>

    <div id="pay_fail">
        <p>결제가 실패한 경우 아래 돌아가기 버튼을 클릭해주세요.</p>
-        <a href="<?php echo $js_return_url; ?>">돌아가기</a>
+        <a href="<?php echo get_text($js_return_url); ?>">돌아가기</a>
    </div>
    <div id="show_progress" style="display:none;">
        <span style="display:block; text-align:center;margin-top:120px"><img src="<?php echo G5_MOBILE_URL; ?>/shop/img/loading.gif" alt="" ></span>
@@ -23,6 +23,9 @@ $param_opt_3 = isset($_REQUEST['param_opt_3']) ? clean_xss_tags($_REQUEST['param
 <input type="hidden" name="settle_method" value="">
 <input type="hidden" name="payco_direct"   value="">      <!-- PAYCO 결제창 호출 -->
 <input type="hidden" name="naverpay_direct" value="A" >    <!-- NAVERPAY 결제창 호출 -->
+<?php if(isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){     // 네이버페이 포인트 결제 옵션 ?>
+<input type="hidden" name="naverpay_point_direct" value="Y">    <!-- 네이버페이 포인트 결제를 하려면 naverpay_point_direct 를 Y  -->
+<?php } ?>
 <input type="hidden" name="kakaopay_direct" value="A" >    <!-- KAKAOPAY 결제창 호출 -->
 <input type="hidden" name="applepay_direct" value="A" >    <!-- APPLEPAY 결제창 호출 -->
 <!-- 주문번호 -->
@@ -223,11 +223,14 @@

                $kcp_pay_method = $c_PayPlus->mf_get_res_data( "pay_method" ); // 카카오페이 결제수단
                // 카드 코드는 PACA, 카카오머니 코드는 PAKM
-
+                // https://developer.kcp.co.kr/page/document/directpay
+                
                if( $kcp_pay_method == "PAKM" ){    // 카카오머니
                    $card_mny = $kakaomny_mny = $c_PayPlus->mf_get_res_data( "kakaomny_mny" );
                    $app_time = $app_kakaomny_time = $c_PayPlus->mf_get_res_data( "app_kakaomny_time" );
                    $od_other_pay_type = 'NHNKCP_KAKAOMONEY';
+                } else if( $kcp_pay_method == "PANP" ){    // 네이버페이머니
+                    $od_other_pay_type = 'NHNKCP_NAVERMONEY';
                }
            }

@@ -54,8 +54,8 @@ echo '<form name="forderform" method="post" action="'.$order_action_url.'" autoc

 echo make_order_field($data, $exclude);

-echo '<input type="hidden" name="res_cd" value="'.$LGD_RESPCODE.'">'.PHP_EOL;
-echo '<input type="hidden" name="LGD_PAYKEY" value="'.$LGD_PAYKEY.'">'.PHP_EOL;
+echo '<input type="hidden" name="res_cd" value="'.get_text($LGD_RESPCODE).'">'.PHP_EOL;
+echo '<input type="hidden" name="LGD_PAYKEY" value="'.get_text($LGD_PAYKEY).'">'.PHP_EOL;

 echo '</form>'.PHP_EOL;
 ?>
@@ -167,7 +167,7 @@ function getFormObject() {
 <form method="post" name="LGD_PAYINFO" id="LGD_PAYINFO" action="">
 <?php
  foreach ($payReqMap as $key => $value) {
-    echo'"<input type="hidden" name="'.$key.'" id="'.$key.'" value="'.$value.'">';
+    echo'"<input type="hidden" name="'.get_text($key).'" id="'.get_text($key).'" value="'.get_text($value).'">';
  }
 ?>
 </form>
@@ -1,6 +1,16 @@
 <?php
 include_once('./_common.php');

+// 테마에 list.php 있으면 include
+if(defined('G5_THEME_MSHOP_PATH')) {
+    $theme_list_file = G5_THEME_MSHOP_PATH.'/list.php';
+    if(is_file($theme_list_file)) {
+        include_once($theme_list_file);
+        return;
+    }
+    unset($theme_list_file);
+}
+
 // 상품 리스트에서 다른 필드로 정렬을 하려면 아래의 배열 코드에서 해당 필드를 추가하세요.
 if( isset($sort) && ! in_array($sort, array('it_name', 'it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time')) ){
    $sort='';
@@ -621,7 +621,13 @@ if($is_kakaopay_use) {
                        $easypay_prints['nhnkcp_payco'] = '<li><input type="radio" id="od_settle_nhnkcp_payco" name="od_settle_case" data-pay="payco" value="간편결제"> <label for="od_settle_nhnkcp_payco" class="PAYCO nhnkcp_payco lb_icon" title="NHN_KCP - PAYCO">PAYCO</label></li>';
                    }
                    if( in_array('nhnkcp_naverpay', $de_easy_pay_service_array) ){
-                        $easypay_prints['nhnkcp_naverpay'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label></li>';
+                        if(isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){
+                            $easypay_prints['nhnkcp_naverpay_card'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_card" title="NHN_KCP - 네이버페이 카드결제">카드</label></li>';
+                            
+                            $easypay_prints['nhnkcp_naverpay_money'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay_money" name="od_settle_case" data-pay="naverpay" data-money="1" value="간편결제" > <label for="od_settle_nhnkcp_naverpay_money" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_money" title="NHN_KCP - 네이버페이 머니/포인트 결제">머니</label></li>';
+                        } else {
+                            $easypay_prints['nhnkcp_naverpay_card'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이 카드결제">네이버페이</label></li>';
+                        }
                    }
                    if( in_array('nhnkcp_kakaopay', $de_easy_pay_service_array) ){
                        $easypay_prints['nhnkcp_kakaopay'] = '<li><input type="radio" id="od_settle_nhnkcp_kakaopay" name="od_settle_case" data-pay="kakaopay" value="간편결제" > <label for="od_settle_nhnkcp_kakaopay" class="kakaopay_icon nhnkcp_kakaopay lb_icon" title="NHN_KCP - 카카오페이">카카오페이</label></li>';
@@ -663,7 +669,14 @@ if($is_kakaopay_use) {
        }

        if( ! isset($easypay_prints['nhnkcp_naverpay']) && function_exists('is_use_easypay') && is_use_easypay('global_nhnkcp') ){
-            $easypay_prints['nhnkcp_naverpay'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label></li>';
+            
+            if(isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){
+                $easypay_prints['nhnkcp_naverpay_card'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_card" title="NHN_KCP - 네이버페이 카드결제">카드</label></li>';
+                
+                $easypay_prints['nhnkcp_naverpay_money'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay_money" name="od_settle_case" data-pay="naverpay" data-money="1" value="간편결제" > <label for="od_settle_nhnkcp_naverpay_money" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_money" title="NHN_KCP - 네이버페이 머니/포인트 결제">머니</label></li>';
+            } else {
+                $easypay_prints['nhnkcp_naverpay'] = '<li><input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label></li>';
+            }
        }

        if($easypay_prints) {
@@ -1058,7 +1071,7 @@ $(function() {
        $("#show_pay_btn").css("display", "inline");
    });

-    $("#od_settle_iche,#od_settle_card,#od_settle_vbank,#od_settle_hp,#od_settle_easy_pay,#od_settle_kakaopay,#od_settle_samsungpay,#od_settle_nhnkcp_payco,#od_settle_nhnkcp_naverpay,#od_settle_nhnkcp_kakaopay,#od_settle_inicislpay,#od_settle_inicis_kakaopay").bind("click", function() {
+    $("#od_settle_iche,#od_settle_card,#od_settle_vbank,#od_settle_hp,#od_settle_easy_pay,#od_settle_kakaopay,#od_settle_samsungpay,#od_settle_nhnkcp_payco,#od_settle_nhnkcp_naverpay,#od_settle_nhnkcp_naverpay_money,#od_settle_nhnkcp_kakaopay,#od_settle_inicislpay,#od_settle_inicis_kakaopay").bind("click", function() {
        $("#settle_bank").hide();
        $("#show_req_btn").css("display", "inline");
        $("#show_pay_btn").css("display", "none");
@@ -1338,12 +1351,21 @@ function pay_approval()
        if(typeof f.pay_method !== "undefined") f.pay_method.value = "";

        if(settle_method == "간편결제"){
-            var nhnkcp_easy_pay = jQuery("input[name='od_settle_case']:checked" ).attr("data-pay");
+            var nhnkcp_easy_pay = jQuery("input[name='od_settle_case']:checked").attr("data-pay");

            if(nhnkcp_easy_pay === "naverpay"){
                if(typeof f.naverpay_direct !== "undefined"){
                    f.naverpay_direct.value = "Y";
                }
+                
+                var is_money = jQuery("input[name='od_settle_case']:checked").attr("data-money");
+                
+                if (is_money) {     // 머니/포인트 결제
+                    jQuery(f).find("input[name='naverpay_point_direct']").val("Y");
+                } else {    // 카드 결제
+                    jQuery(f).find("input[name='naverpay_point_direct']").val("");
+                }
+
            } else if(nhnkcp_easy_pay === "kakaopay"){
                if(typeof f.kakaopay_direct !== "undefined") f.kakaopay_direct.value = "Y";
            } else if(nhnkcp_easy_pay === "applepay"){
@@ -77,4 +77,33 @@ if( !class_exists('HTMLPurifier_Filter_Iframevideo') ){
 			}
 		}
 	}
+}
+
+if( !class_exists('HTMLPurifierContinueParamFilter') ){
+	class HTMLPurifierContinueParamFilter extends HTMLPurifier_URIFilter
+	{
+		public $name = 'ContinueParamFilter';
+        
+        public function filter(&$uri, $config, $context)
+        {
+            // 쿼리 파라미터 검사
+            $query = $uri->query;
+            $path = $uri->path;
+            
+            if ($path && preg_match('#[\\\\/]logout#i', $path)) {
+                return false;
+            }
+            
+            if ($query) {
+                
+                parse_str($query, $query_params);
+                
+                if (isset($query_params['continue']) || isset($query_params['pcurl'])) {
+                    return false;
+                }
+            }
+
+            return true; // 조건 통과 시 허용
+        }
+	}
 }
@@ -58,22 +58,22 @@ $g5['title'] = 'KG이니시스 간편인증';
 include_once(G5_PATH.'/head.sub.php'); 	
 ?>
    <form name="saForm">
-        <input type="hidden" name="mid" value="<?php echo $mid ?>"> <!-- 필수 값 -->
-        <input type="hidden" name="reqSvcCd" value="<?php echo $reqSvcCd ?>"> <!-- 필수 값 -->
-        <input type="hidden" name="mTxId" value="<?php echo $mTxId ?>"> <!-- 필수 값 -->
+        <input type="hidden" name="mid" value="<?php echo get_text($mid); ?>"> <!-- 필수 값 -->
+        <input type="hidden" name="reqSvcCd" value="<?php echo get_text($reqSvcCd); ?>"> <!-- 필수 값 -->
+        <input type="hidden" name="mTxId" value="<?php echo get_text($mTxId); ?>"> <!-- 필수 값 -->

-        <input type="hidden" name="authHash" value="<?php echo $authHash ?>"> <!-- 필수 값 -->
-        <input type="hidden" name="flgFixedUser" value="<?php echo $flgFixedUser ?>"> <!-- 필수 값 Y/N 특정사용자 인증 요청 여부 -->
-        <input type="hidden" name="userName" value="<?php echo $userName ?>">
-        <input type="hidden" name="userPhone" value="<?php echo $userPhone ?>">
-        <input type="hidden" name="userBirth" value="<?php echo $userBirth ?>">
-        <input type="hidden" name="userHash" value="<?php echo $userHash ?>">
-        <input type="hidden" name="reservedMsg" value="<?php echo $reservedMsg; ?>">
-        <input type="hidden" name="mbId" value="<?php echo $member['mb_id']; ?>">
-        <input type="hidden" name="directAgency" value="<?php echo isset($_GET['directAgency']) ? clean_xss_tags($_GET['directAgency'], 1, 1) : ''; ?>">
+        <input type="hidden" name="authHash" value="<?php echo get_text($authHash); ?>"> <!-- 필수 값 -->
+        <input type="hidden" name="flgFixedUser" value="<?php echo get_text($flgFixedUser); ?>"> <!-- 필수 값 Y/N 특정사용자 인증 요청 여부 -->
+        <input type="hidden" name="userName" value="<?php echo get_text($userName); ?>">
+        <input type="hidden" name="userPhone" value="<?php echo get_text($userPhone); ?>">
+        <input type="hidden" name="userBirth" value="<?php echo get_text($userBirth); ?>">
+        <input type="hidden" name="userHash" value="<?php echo get_text($userHash); ?>">
+        <input type="hidden" name="reservedMsg" value="<?php echo get_text($reservedMsg); ?>">
+        <input type="hidden" name="mbId" value="<?php echo get_text($member['mb_id']); ?>">
+        <input type="hidden" name="directAgency" value="<?php echo isset($_GET['directAgency']) ? get_text(clean_xss_tags($_GET['directAgency'], 1, 1)) : ''; ?>">

-        <input type="hidden" name="successUrl" value="<?php echo $resultUrl; ?>"> <!-- 필수 값 -->
-        <input type="hidden" name="failUrl" value="<?php echo $resultUrl; ?>"> <!-- 필수 값 -->
+        <input type="hidden" name="successUrl" value="<?php echo get_text($resultUrl); ?>"> <!-- 필수 값 -->
+        <input type="hidden" name="failUrl" value="<?php echo get_text($resultUrl); ?>"> <!-- 필수 값 -->
        <!-- successUrl / failUrl 은 분리 하여 이용가능!-->
    </form> 
    <script>
@@ -111,7 +111,7 @@ $ct_cert->mf_clear();
 <input type="hidden" name="param_opt_2"  value="opt2"/>
 <input type="hidden" name="param_opt_3"  value="opt3"/>

-<?php if ($config['cf_cert_kcp_enckey']) { ?>
+<?php if ($config['cf_cert_kcp_enckey'] || $kcp_enc_key) { ?>
 <!-- 리턴 암호화 고도화 -->
 <input type="hidden" name="cert_enc_use_ext" value="Y"/>
 <input type='hidden' name='kcp_cert_lib_ver' value="<?php echo $ct_cert->get_kcp_lib_ver( $home_dir ); ?>"/>
@@ -59,7 +59,7 @@ $payReqMap = $_SESSION['lgd_certify'];//결제 요청시, Session에 저장했
 	  foreach ($payReqMap as $key => $value) {
        $key = htmlspecialchars(strip_tags($key));
        $value = htmlspecialchars(strip_tags($value));
-      echo "<input type='hidden' name='$key' id='$key' value='$value'>";
+      echo "<input type='hidden' name='".get_text($key)."' id='".get_text($key)."' value='".get_text($value)."'>";
    }
 ?>
 </form>
@@ -22,18 +22,20 @@
        Contact @<a href='http://twitter.com/abraham'>abraham</a>
      </p>
      <hr />
-      <?php if (isset($menu)) { ?>
-        <?php echo $menu; ?>
+      <?php if (isset($menu) && is_string($menu)) { ?>
+        <?php echo htmlspecialchars($menu, ENT_QUOTES, 'UTF-8'); ?>
      <?php } ?>
    </div>
-    <?php if (isset($status_text)) { ?>
-      <?php echo '<h3>'.$status_text.'</h3>'; ?>
+    <?php if (isset($status_text) && is_string($status_text)) { ?>
+      <?php echo '<h3>'.htmlspecialchars($status_text, ENT_QUOTES, 'UTF-8').'</h3>'; ?>
    <?php } ?>
-    <p>
+    <div>
      <pre>
-        <?php print_r($content); ?>
+        <?php if (isset($content) && (is_array($content) || is_object($content))) {
+            echo htmlspecialchars(json_encode($content, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES), ENT_QUOTES, 'UTF-8');
+        } ?>
      </pre>
-    </p>
+    </div>

  </body>
 </html>
@@ -3,9 +3,12 @@ include_once('./_common.php');
 include_once(G5_SHOP_PATH.'/settle_inicis.inc.php');
 require_once(G5_SHOP_PATH.'/inicis/libs/HttpClient.php');
 require_once(G5_SHOP_PATH.'/inicis/libs/json_lib.php');
+require_once(G5_SHOP_PATH.'/inicis/libs/properties.php');

 $inicis_pay_result = false;

+$prop = new properties();
+
 try {

    //#############################
@@ -37,6 +40,18 @@ try {
        ///$mKey = $util->makeHash(signKey, "sha256"); // 가맹점 확인을 위한 signKey를 해시값으로 변경 (SHA-256방식 사용)
        $mKey = hash("sha256", $signKey);

+        //##########################################################################
+        // 승인요청 API url (authUrl) 리스트 는 properties 에 세팅하여 사용합니다.
+        // idc_name 으로 수신 받은 센터 네임을 properties 에서 include 하여 승인요청하시면 됩니다.
+        //##########################################################################
+        $idc_name 	= $_REQUEST["idc_name"];
+        $authUrl    = $prop->getAuthUrl($idc_name);
+        
+        if (strcmp($authUrl, $_REQUEST["authUrl"]) != 0) {
+            
+            die("authUrl check Fail\n");
+        }
+        
        //#####################
        // 2.signature 생성
        //#####################
@@ -172,22 +187,28 @@ try {
            //#####################

            $netcancelResultString = ""; // 망취소 요청 API url(고정, 임의 세팅 금지)
-            if ($httpUtil->processHTTP($netCancel, $authMap)) {
-                $netcancelResultString = $httpUtil->body;
-            } else {
-                echo "Http Connect Error\n";
-                echo $httpUtil->errormsg;
+            $netCancel    = $prop->getNetCancel($idc_name);
+            
+            if (strcmp($netCancel, $_REQUEST["netCancelUrl"]) == 0) {
+                
+                if ($httpUtil->processHTTP($netCancel, $authMap)) {
+                    $netcancelResultString = $httpUtil->body;
+                } else {
+                    echo "Http Connect Error\n";
+                    echo $httpUtil->errormsg;

-                throw new Exception("Http Connect Error");
+                    throw new Exception("Http Connect Error");
+                }
+
+                echo "<br/>## 망취소 API 결과 ##<br/>";
+                
+                /*##XML output##*/
+                //$netcancelResultString = str_replace("<", "&lt;", $$netcancelResultString);
+                //$netcancelResultString = str_replace(">", "&gt;", $$netcancelResultString);
+
+                // 취소 결과 확인
+                echo "<p>". $netcancelResultString . "</p>";
            }
-
-            echo "## 망취소 API 결과 ##";
-
-            $netcancelResultString = str_replace("<", "&lt;", $$netcancelResultString);
-            $netcancelResultString = str_replace(">", "&gt;", $$netcancelResultString);
-
-            echo "<pre>", $netcancelResultString . "</pre>";
-            // 취소 결과 확인
        }
    } else {

@@ -0,0 +1,42 @@
+<?php
+
+	class properties {
+
+		function getAuthUrl($idc_name)	{
+            $url = "stdpay.inicis.com/api/payAuth";
+			switch ($idc_name) {
+				case 'fc':
+                    $authUrl = "https://fc".$url;
+					break;
+				case 'ks':
+					$authUrl = "https://ks".$url;
+					break;
+				case 'stg':
+					$authUrl = "https://stg".$url;
+					break;
+				default:
+					break;
+			}			
+			return $authUrl;
+		}
+
+		function getNetCancel($idc_name)	{
+            $url = "stdpay.inicis.com/api/netCancel";
+			switch ($idc_name) {
+				case 'fc':
+                    $netCancel = "https://fc".$url;
+					break;
+				case 'ks':
+					$netCancel = "https://ks".$url;
+					break;
+				case 'stg':
+					$netCancel = "https://stg".$url;
+					break;
+				default:
+					break;
+			}			
+			return $netCancel;
+		}
+	}
+
+?>
@@ -28,6 +28,14 @@ jQuery(function($){

            if( nhnkcp_settle_case == "naverpay" ){
                if(typeof nhnkcp_pay_form.naverpay_direct !== "undefined") nhnkcp_pay_form.naverpay_direct.value = "Y";
+                
+                var is_money = jQuery("input[name='od_settle_case']:checked" ).attr("data-money");
+                
+                if (is_money) {     // 머니/포인트 결제
+                    jQuery(nhnkcp_pay_form).find("input[name='naverpay_point_direct']").val("Y");
+                } else {    // 카드 결제
+                    jQuery(nhnkcp_pay_form).find("input[name='naverpay_point_direct']").val("");
+                }
            }
            
            nhnkcp_pay_form.pay_method.value = "100000000000";
@@ -293,11 +293,14 @@ if ( $req_tx == "pay" )

            $kcp_pay_method = $c_PayPlus->mf_get_res_data( "pay_method" ); // 카카오페이 결제수단
            // 카드 코드는 PACA, 카카오머니 코드는 PAKM
-
+            // https://developer.kcp.co.kr/page/document/directpay
+            
            if( $kcp_pay_method == "PAKM" ){    // 카카오머니
                $card_mny = $kakaomny_mny = $c_PayPlus->mf_get_res_data( "kakaomny_mny" );
                $app_time = $app_kakaomny_time = $c_PayPlus->mf_get_res_data( "app_kakaomny_time" );
                $od_other_pay_type = 'NHNKCP_KAKAOMONEY';
+            } else if( $kcp_pay_method == "PANP" ){    // 네이버페이머니
+                $od_other_pay_type = 'NHNKCP_NAVERMONEY';
            }

            /* = -------------------------------------------------------------- = */
@@ -46,7 +46,7 @@ $payReqMap = $_SESSION['PAYREQ_MAP'];//결제 요청시, Session에 저장했던
 <form method="post" name="LGD_RETURNINFO" id="LGD_RETURNINFO">
 <?php
 	  foreach ($payReqMap as $key => $value) {
-      echo "<input type='hidden' name='$key' id='$key' value='$value'>";
+      echo "<input type='hidden' name='".get_text($key)."' id='".get_text($key)."' value='".get_text($value)."'>";
    }
 ?>
 </form>
@@ -14,6 +14,16 @@ if (G5_IS_MOBILE) {
    return;
 }

+// 테마에 list.php 있으면 include
+if(defined('G5_THEME_SHOP_PATH')) {
+    $theme_list_file = G5_THEME_SHOP_PATH.'/list.php';
+    if(is_file($theme_list_file)) {
+        include_once($theme_list_file);
+        return;
+    }
+    unset($theme_list_file);
+}
+
 $sql = " select * from {$g5['g5_shop_category_table']} where ca_id = '$ca_id' and ca_use = '1'  ";
 $ca = sql_fetch($sql);
 if (! (isset($ca['ca_id']) && $ca['ca_id']))
@@ -640,7 +640,15 @@ if($is_kakaopay_use) {
                                $easypay_prints['nhnkcp_payco'] = '<input type="radio" id="od_settle_nhnkcp_payco" name="od_settle_case" data-pay="payco" value="간편결제"> <label for="od_settle_nhnkcp_payco" class="PAYCO nhnkcp_payco lb_icon" title="NHN_KCP - PAYCO">PAYCO</label>';
                            }
                            if( in_array('nhnkcp_naverpay', $de_easy_pay_service_array) ){
-                                $easypay_prints['nhnkcp_naverpay'] = '<input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label>';
+                                
+                                if(isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){
+                                    $easypay_prints['nhnkcp_naverpay_card'] = '<input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_card" title="NHN_KCP - 네이버페이 카드결제">네이버페이 카드결제</label>';
+                                    
+                                    $easypay_prints['nhnkcp_naverpay_money'] = '<input type="radio" id="od_settle_nhnkcp_naverpay_money" name="od_settle_case" data-pay="naverpay" data-money="1" value="간편결제" > <label for="od_settle_nhnkcp_naverpay_money" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_money" title="NHN_KCP - 네이버페이 머니/포인트 결제">네이버페이 머니/포인트</label>';
+                                } else {
+                                    $easypay_prints['nhnkcp_naverpay_card'] = '<input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이 카드결제">네이버페이 카드결제</label>';
+                                }
+                                
                            }
                            if( in_array('nhnkcp_kakaopay', $de_easy_pay_service_array) ){
                                $easypay_prints['nhnkcp_kakaopay'] = '<input type="radio" id="od_settle_nhnkcp_kakaopay" name="od_settle_case" data-pay="kakaopay" value="간편결제" > <label for="od_settle_nhnkcp_kakaopay" class="kakaopay_icon nhnkcp_kakaopay lb_icon" title="NHN_KCP - 카카오페이">카카오페이</label>';
@@ -675,7 +683,14 @@ if($is_kakaopay_use) {
                }

                if( ! isset($easypay_prints['nhnkcp_naverpay']) && function_exists('is_use_easypay') && is_use_easypay('global_nhnkcp') ){
-                    $easypay_prints['nhnkcp_naverpay'] = '<input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label>';
+                    
+                    if(isset($default['de_easy_pay_services']) && in_array('used_nhnkcp_naverpay_point', explode(',', $default['de_easy_pay_services'])) ){
+                        $easypay_prints['nhnkcp_naverpay_card'] = '<input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_card" title="NHN_KCP - 네이버페이 카드결제">네이버페이 카드결제</label>';
+                        
+                        $easypay_prints['nhnkcp_naverpay_money'] = '<input type="radio" id="od_settle_nhnkcp_naverpay_money" name="od_settle_case" data-pay="naverpay" data-money="1" value="간편결제" > <label for="od_settle_nhnkcp_naverpay_money" class="naverpay_icon nhnkcp_naverpay lb_icon nhnkcp_icon nhnkcp_money" title="NHN_KCP - 네이버페이 머니/포인트 결제">네이버페이 머니/포인트</label>';
+                    } else {
+                        $easypay_prints['nhnkcp_naverpay'] = '<input type="radio" id="od_settle_nhnkcp_naverpay" name="od_settle_case" data-pay="naverpay" value="간편결제" > <label for="od_settle_nhnkcp_naverpay" class="naverpay_icon nhnkcp_naverpay lb_icon" title="NHN_KCP - 네이버페이">네이버페이</label>';
+                    }
                }

                if($easypay_prints) {
@@ -1049,7 +1064,7 @@ $(function() {
        $("#settle_bank").show();
    });

-    $("#od_settle_iche,#od_settle_card,#od_settle_vbank,#od_settle_hp,#od_settle_easy_pay,#od_settle_kakaopay,#od_settle_nhnkcp_payco,#od_settle_nhnkcp_naverpay,#od_settle_nhnkcp_kakaopay,#od_settle_inicislpay,#od_settle_inicis_kakaopay").bind("click", function() {
+    $("#od_settle_iche,#od_settle_card,#od_settle_vbank,#od_settle_hp,#od_settle_easy_pay,#od_settle_kakaopay,#od_settle_nhnkcp_payco,#od_settle_nhnkcp_naverpay,#od_settle_nhnkcp_naverpay_money,#od_settle_nhnkcp_kakaopay,#od_settle_inicislpay,#od_settle_inicis_kakaopay").bind("click", function() {
        $("#settle_bank").hide();
    });

@@ -1461,10 +1476,19 @@ function forderform_check(f)
            case "간편결제":
                f.pay_method.value   = "100000000000";
                
-                var nhnkcp_easy_pay = jQuery("input[name='od_settle_case']:checked" ).attr("data-pay");
+                var nhnkcp_easy_pay = jQuery("input[name='od_settle_case']:checked").attr("data-pay");
                
                if(nhnkcp_easy_pay === "naverpay"){
                    if(typeof f.naverpay_direct !== "undefined") f.naverpay_direct.value = "Y";
+                    
+                    var is_money = jQuery("input[name='od_settle_case']:checked").attr("data-money");
+                    
+                    if (is_money) {     // 머니/포인트 결제
+                        jQuery(f).find("input[name='naverpay_point_direct']").val("Y");
+                    } else {    // 카드 결제
+                        jQuery(f).find("input[name='naverpay_point_direct']").val("");
+                    }
+                    
                } else if(nhnkcp_easy_pay === "kakaopay"){
                    if(typeof f.kakaopay_direct !== "undefined") f.kakaopay_direct.value = "Y";
                } else {
@@ -57,7 +57,7 @@ $cardQuotaBase = '2:3:4:5:6:7:8:9:10:11:12';  // 가맹점에서 사용할 할

 $inicis_cardpoint = $default['de_inicis_cartpoint_use'] ? ':cardpoint' : '';   //신용카드 포인트 결제에 관한 옵션 ( 신청해야 함 )

-$acceptmethod = 'HPP(2):no_receipt:vbank('.date('Ymd', strtotime("+3 days", G5_SERVER_TIME)).'):below1000'.$useescrow.$inicis_cardpoint;
+$acceptmethod = 'HPP(2):no_receipt:vbank('.date('Ymd', strtotime("+3 days", G5_SERVER_TIME)).'):below1000:centerCd(Y)'.$useescrow.$inicis_cardpoint;

 /* 기타 */
 $siteDomain = G5_SHOP_URL.'/inicis'; //가맹점 도메인 입력
@@ -14,10 +14,19 @@ $INIpayLog  = false;                  // 로그를 기록하려면 true 로 수

 //**********************************************************************************

-$PG_IP = get_real_client_ip();
+$allowed_ips = array(
+    "203.238.37.3",     // TX5, TX4
+    "203.238.37.15",    // PC가상계좌(노티), 모바일 가상계좌, 에스크로
+    "203.238.37.16",    // 
+    "203.238.37.25",    //
+    "203.238.37.32",    // 에스크로
+    "183.109.71.153",   // PC가상계좌(노티), 모바일(노티), 에스크로
+    "118.129.210.25",   // 모바일(노티)
+    "39.115.212.9"      // PC가상계좌(노티)
+);
+
+if (in_array($_SERVER['REMOTE_ADDR'], $allowed_ips)) {   //PG에서 보냈는지 IP로 체크

-if( $PG_IP == "203.238.37.3" || $PG_IP == "203.238.37.15" || $PG_IP == "203.238.37.16" || $PG_IP == "203.238.37.25" || $PG_IP == "183.109.71.153" || $PG_IP == "39.115.212.9" )  //PG에서 보냈는지 IP로 체크
-{
        $msg_id = $msg_id;             //메세지 타입
        $no_tid = $no_tid;             //거래번호
        $no_oid = $no_oid;             //상점 주문번호
@@ -802,6 +802,7 @@ box-shadow: 1px 2px 2px #eee;}
 #sod_frm_paysel .inicis_kakaopay em{position:absolute;top:15px;left:45px;width:70px;height:30px;background:url('../../../img/kakao.png') no-repeat 50% 50% #ffeb00;overflow:hidden;text-indent:-999px;border-radius:30px}
 #sod_frm_paysel .kakaopay_icon{background:url('../../../img/kakao.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .naverpay_icon{background:url('../../../img/ico-default-naverpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;background-position: 50% 30%;padding-top:35px;padding-left:0;text-align:center}
 #sod_frm_paysel .samsungpay_icon{background:url('../../../img/samsungpay.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .ssgpay_icon{background:url('../../../img/ssgpay_icon.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .skpay_icon{background:url('../../../img/skpay11_icon.png') no-repeat 50% 50% #fff; background-size: 70px;display:inline-block;overflow:hidden;text-indent:-999px}
@@ -1170,6 +1171,7 @@ a.btn_frmline.is-long-text{height:auto;width:160px}
 .sod_frm_mobile #m_sod_frm_paysel .kakaopay_icon{background:url(../../../img/kakao.png) no-repeat 50% 50% #f4dc34;border-radius:30px;height:22px;width:74px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
 .sod_frm_mobile #m_sod_frm_paysel .applepay_icon{background:url(../../../img/ico-mobile-applepay.png) no-repeat 50% 50% #fff;border-radius:30px;height:23px;width:50px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
 .sod_frm_mobile #m_sod_frm_paysel .naverpay_icon{background:url(../../../img/ico-default-naverpay.png) no-repeat 50% 50% #fff;border-radius:30px;height:22px;width:50px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:35px auto}
+.sod_frm_mobile #m_sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;padding-left:50px;padding-top:2px;width:83px}
 .sod_frm_mobile #m_sod_frm_paysel .samsung_pay{margin-left:-23px;background:url(../../../img/samsungpay.png) no-repeat 24px 3px;height:25px;width:106px;display:inline-block;overflow:hidden;text-indent:-999px}
 .sod_frm_mobile #sod_frm_pay{border-top:1px solid #f3f3f3}
 .sod_frm_mobile #sod_frm_pay h2{margin:10px 0;font-size:1.25em}
@@ -226,6 +226,7 @@ box-shadow: 0 0 6px rgba(0,0,0,0.2);}
 #m_sod_frm_paysel .inicis_kakaopay{background:url('../../../img/kakao.png') no-repeat 50% 50% #ffeb00;border-radius:30px;height:26px;width:74px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:36px auto}
 #m_sod_frm_paysel .kakaopay_icon{background:url('../../../img/ico-mobile-kakaopay.png') no-repeat #fff;height:23px;width:63px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:45px auto;background-position: 10% 40%}
 #m_sod_frm_paysel .naverpay_icon{background:url('../../../img/ico-mobile-naverpay.png') no-repeat #fff;height:23px;width:60px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:45px auto;background-position: 0% 30%}
+#m_sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;padding-left:50px;padding-top:2px;width:83px}
 #m_sod_frm_paysel .applepay_icon{background:url('../../../img/ico-mobile-applepay.png') no-repeat #fff;height:30px;width:60px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:43px auto}
 #m_sod_frm_paysel .applepay_icon{background:url('../../../img/ico-mobile-applepay.png') no-repeat #fff;height:30px;width:60px;display:inline-block;overflow:hidden;text-indent:-999px;background-size:43px auto}
 #m_sod_frm_paysel .ssgpay_icon{background:url('../../../img/ssgpay_icon.png') no-repeat 0px 3px #fff;width:55px;height:20px;background-size:100%;display:inline-block;overflow:hidden;text-indent:-999px}
@@ -913,6 +914,7 @@ box-shadow:0 0 8px rgba(65,98,255,0.8)}
 #sod_frm_paysel .inicis_kakaopay{background:url('../../../img/kakao.png') no-repeat 50% 50% #f4dc34;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .kakaopay_icon{background:url('../../../img/kakao.png') no-repeat 50% 50% #f4dc34;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .naverpay_icon{background:url('../../../img/ico-default-naverpay.png') no-repeat 50% 50% #fff;overflow:hidden;text-indent:-999px}
+#sod_frm_paysel .naverpay_icon.nhnkcp_icon{text-indent:0;background-position: 50% 30%;padding-top:35px;padding-left:0;text-align:center}
 #sod_frm_paysel .samsungpay_icon{background:url('../../../img/samsungpay.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .ssgpay_icon{background:url('../../../img/ssgpay_icon.png') no-repeat 50% 50% #fff;display:inline-block;overflow:hidden;text-indent:-999px}
 #sod_frm_paysel .skpay_icon{background:url('../../../img/skpay11_icon.png') no-repeat 50% 50% #fff; background-size: 70px;display:inline-block;overflow:hidden;text-indent:-999px}
@@ -2,7 +2,7 @@
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가

 define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.6.12');
+define('G5_GNUBOARD_VER', '5.6.16');
 // 그누보드5.4.5.5 버전과 영카트5.4.5.5.1 버전을 합쳐서 그누보드5.4.6 버전에서 시작함 (kagla-210617)
 // G5_YOUNGCART_VER 이 상수를 사용하는 곳이 있으므로 주석 처리 해제함
 // 그누보드5.4.6 이상 버전 부터는 영카트를 그누보드에 포함하여 배포하므로 영카트5의 버전은 의미가 없습니다.
Author	SHA1	Message	Date
thisgun	44172c1d1f	Merge branch 'master' of github.com:gnuboard/g5-update	2025-09-01 11:32:50 +09:00
thisgun	41945c62f8	버전 5.6.16 수정	2025-09-01 11:23:45 +09:00
총andGitHub	37d0dcb48f	Merge pull request #47 from gnuboard/fix/sms5-table-prefix [#42] fix: sms5 TABLE 생성 및 패치 시 G5_TABLE_PREFIX 사용	2025-08-29 17:04:42 +09:00
thisgun	002e43e5fb	XSS 취약점 수정	2025-08-28 13:35:14 +09:00
thisgun	9510aa9cf1	Merge branch 'master' of github.com:gnuboard/g5-update	2025-08-27 18:52:02 +09:00
thisgun	6a3c2b1002	[KVE-2025-0464]영카트 XSS 취약점 수정	2025-08-27 17:58:06 +09:00
총	f69b66dced	[KVE-2025-0510] Stored XSS (bypass html_purify patch) to RCE 취약점 수정	2025-08-27 11:48:36 +09:00
chym1217	cb1fadba4c	fix: #42 SMS5 DB에 G5_TABLE_PREFIX 적용 - 기존 sms5_* 테이블 존재 시 dbupgrade에서 테이블명 변경	2025-08-19 15:31:58 +09:00
thisgun	5da91ab73e	버전 5.6.15 수정	2025-07-31 20:25:39 +09:00
thisgun	d5b541724f	create_hash 함수에 fclose 코드 추가	2025-07-31 20:23:59 +09:00
thisgun	9758007f91	NHN_KCP 네이버페이 간편결제 카드 또는 머니결제로 분리	2025-07-31 20:21:22 +09:00
thisgun	9d5f8e137f	관리자 로그인시 새글 테이블 OPIMIZE 실행시 딜레이 되는 문제 개선2	2025-07-31 17:12:43 +09:00
thisgun	f1da95f055	Open redirect 취약점 수정	2025-07-30 15:03:01 +09:00
thisgun	9602f3c7a7	php warning 메시지 코드 수정	2025-07-21 12:48:53 +09:00
thisgun	d357f5a0a4	Merge branch 'master' of github.com:gnuboard/gnuboard5	2025-07-08 11:41:40 +09:00
thisgun	a9eab8d86a	insert_use_point 함수에 hook 추가 #363	2025-07-08 11:40:47 +09:00
thisgun	9191199ef4	db_table.optimize.php 파일에 hook 추가 #362	2025-07-08 11:16:26 +09:00
thisgun	2556753530	url_auto_link함수에 url_auto_link_before hook 추가 #361	2025-07-08 11:02:34 +09:00
thisgun	57983a6dbc	토스페이먼츠 머트키 확인방법 설명문 수정	2025-07-08 10:45:10 +09:00
restarea92andGitHub	327e7ba7ba	feat: add list.php theme override (#358 ) * feat: add theme override in shop/list.php * feat: add theme override in mobile/shop/list.php	2025-06-27 09:35:52 +09:00
thisgun	67415cf8d3	get_uniqid 함수에 hook 추가	2025-06-18 10:53:46 +09:00
thisgun	aa88ff68a1	KG이니시스 IDC 센터코드 검증 추가2	2025-06-12 17:34:53 +09:00
thisgun	07a0245f85	버전 5.6.14 수정	2025-06-12 17:17:33 +09:00
thisgun	d3de613a8c	관리자 로그인시 새글 테이블 OPIMIZE 실행시 딜레이 되는 문제 개선	2025-06-12 17:05:55 +09:00
thisgun	bb1f69e86c	KG이니시스 IDC 센터코드 검증 추가	2025-06-05 16:11:20 +09:00
thisgun	dc4c2a79d9	XSS 취약점 수정 박재형님 제보	2025-06-05 14:12:55 +09:00
thisgun	38451a7d3d	[KVE-2025-0384]XSS lead to RCE 취약점 수정	2025-06-04 17:44:50 +09:00
thisgun	87d11d5c78	변수 초기화 되지 않아 warning 메시지 출려되는 현상 수정	2025-06-04 14:40:18 +09:00
thisgun	c1bbce1114	KG이니시스 가상계좌 에스크로 IP 추가	2025-05-28 11:27:59 +09:00
thisgun	61576d3e87	[KVE-2025-0351]ip 검증 취약점 수정	2025-05-28 10:57:33 +09:00
thisgun	c9100d2e38	NHN_KCP 본인인증 테스트 오류 수정	2025-05-23 12:19:22 +09:00
thisgun	7714153faf	버전 5.6.13 수정	2025-05-15 15:31:41 +09:00
thisgun	654fd7ba68	방문자 기록 sql 문 수정	2025-05-15 15:30:40 +09:00
thisgun	ea9f618de8	KG이니시스 모바일 가상계좌 IP 추가	2025-05-15 15:29:26 +09:00
thisgun	eea5a2477b	쇼핑몰관리자 나이스페이신청 URL 링크 수정	2025-05-15 14:23:38 +09:00
thisgun	8cc101b617	접근차단 ip코드 다시 재수정	2025-05-15 14:09:27 +09:00
thisgun	316d3542a9	[KVE-2025-0259]XSS 취약점 수정	2025-05-15 09:53:28 +09:00
thisgun	c2da219473	[KVE-2025-0286]XSS 취약점 수정	2025-05-14 12:49:03 +09:00
thisgun	6874e767c2	kcp 모바일 테스트결제 url 변경	2025-05-14 12:00:09 +09:00
thisgun	5a91d37365	php warning 메시지 코드 수정	2025-05-14 11:59:40 +09:00
thisgun	f9c972d866	[KVE-2025-0191] Stored XSS (bypass html_purify via Open Redirect) 취약점 수정	2025-04-17 16:04:01 +09:00