버전 5.6.31 수정

- shop/ajax.orderdatasave.php에 check_request_origin() 적용하여
  외부 사이트발 자동 요청에 의한 임시 주문 데이터 교체 차단

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitattributes

@@ -1,2 +1,3 @@
 .gitattributes export-ignore
 .gitignore export-ignore
+*.php whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol

.gitignore

@@ -13,6 +13,17 @@ cheditor5.*/
 log/
 g5_tree/
 .vscode/
+.claude/
+.cursor/
+.windsurf/
+.idea/
+.playwright-mcp
+.mcp.json
+.agents
+.DS_Store
+*.swp
+*.swo
+CLAUDE.local.md
 naver*.html
 initests01/
 SIRsoft000/

adm/_common.php

@@ -3,6 +3,10 @@ define('G5_IS_ADMIN', true);
 require_once '../common.php';
 require_once G5_ADMIN_PATH . '/admin.lib.php';
 
+if (function_exists('g5_check_data_htaccess')) {
+    g5_check_data_htaccess();
+}
+
 if (isset($token)) {
     $token = @htmlspecialchars(strip_tags($token), ENT_QUOTES);
 }

adm/admin.head.php

@@ -42,7 +42,7 @@ function print_menu2($key, $no = '')
             continue;
         }
 
-        if ($is_admin != 'super' && (!array_key_exists($menu[$key][$i][0], $auth) || !strstr($auth[$menu[$key][$i][0]], 'r'))) {
+        if ($is_admin != 'super' && (!array_key_exists($menu[$key][$i][0], $auth) || strpos($auth[$menu[$key][$i][0]], 'r') === false)) {
             continue;
         }
 

adm/admin.lib.php

@@ -281,7 +281,7 @@ function auth_check($auth, $attr, $return = false)
 
     $attr = strtolower($attr);
 
-    if (!strstr($auth, $attr)) {
+    if (strpos($auth, $attr) === false) {
         if ($attr == 'r') {
             $msg = '읽을 권한이 없습니다.';
             if ($return) {
@@ -389,7 +389,7 @@ function order_select($fld, $sel = '')
 // 불법접근을 막도록 토큰을 생성하면서 토큰값을 리턴
 function get_admin_token()
 {
-    $token = md5(uniqid(rand(), true));
+    $token = get_random_token_string(16);
     set_session('ss_admin_token', $token);
 
     return $token;
@@ -610,6 +610,110 @@ function admin_menu_find_by($call, $search_key)
     return '';
 }
 
+function admin_menu_local_path($url)
+{
+    $url = (string) $url;
+
+    if (!$url) {
+        return '';
+    }
+
+    $url = preg_replace('/[?#].*$/', '', $url);
+
+    $maps = array(
+        G5_ADMIN_URL => G5_ADMIN_PATH,
+    );
+
+    if (defined('G5_SMS5_ADMIN_URL') && defined('G5_SMS5_ADMIN_PATH')) {
+        $maps[G5_SMS5_ADMIN_URL] = G5_SMS5_ADMIN_PATH;
+    }
+
+    foreach ($maps as $base_url => $base_path) {
+        if (strpos($url, $base_url) !== 0) {
+            continue;
+        }
+
+        $path = $base_path.substr($url, strlen($base_url));
+
+        if (substr($path, -1) === '/') {
+            $path .= 'index.php';
+        }
+
+        return $path;
+    }
+
+    return '';
+}
+
+function admin_menu_is_super_only($menu_item)
+{
+    static $cache = array();
+
+    $sub_menu = isset($menu_item[0]) ? (string) $menu_item[0] : '';
+    if (!$sub_menu) {
+        return false;
+    }
+
+    if (isset($cache[$sub_menu])) {
+        return $cache[$sub_menu];
+    }
+
+    // 향후 메뉴 정의에서 명시적으로 최고관리자 전용 표시가 필요할 때 사용한다.
+    if (isset($menu_item[4]) && $menu_item[4] === 'super') {
+        return $cache[$sub_menu] = true;
+    }
+
+    $path = admin_menu_local_path(isset($menu_item[2]) ? $menu_item[2] : '');
+    if (!$path || !is_readable($path)) {
+        return $cache[$sub_menu] = false;
+    }
+
+    $content = file_get_contents($path, false, null, 0, 12000);
+    if ($content === false) {
+        return $cache[$sub_menu] = false;
+    }
+
+    $pattern = '/if\s*\([^\)]*\$is_admin\s*(?:!==|!=)\s*[\'"]super[\'"][^\)]*\)\s*\{?[\s\S]{0,250}(?:alert|alert_close|die)\s*\([^\;]*(?:최고관리자만|최고관리자로)/u';
+
+    return $cache[$sub_menu] = (bool) preg_match($pattern, $content);
+}
+
+function admin_get_assignable_auth_menu()
+{
+    global $menu;
+
+    $assignable_auth_menu = array();
+
+    if (!isset($menu) || !is_array($menu)) {
+        return $assignable_auth_menu;
+    }
+
+    foreach ($menu as $menu_group) {
+        if (!is_array($menu_group)) {
+            continue;
+        }
+
+        for ($i=1; $i<count($menu_group); $i++) {
+            if (!isset($menu_group[$i]) || !is_array($menu_group[$i])) {
+                continue;
+            }
+
+            $sub_menu = isset($menu_group[$i][0]) ? $menu_group[$i][0] : '';
+            if (!$sub_menu || $sub_menu === '-' || substr($sub_menu, -3) === '000') {
+                continue;
+            }
+
+            if (admin_menu_is_super_only($menu_group[$i])) {
+                continue;
+            }
+
+            $assignable_auth_menu[$sub_menu] = isset($menu_group[$i][1]) ? $menu_group[$i][1] : '';
+        }
+    }
+
+    return $assignable_auth_menu;
+}
+
 // 접근 권한 검사
 if (!$member['mb_id']) {
     alert('로그인 하십시오.', G5_BBS_URL . '/login.php?url=' . urlencode(correct_goto_url(G5_ADMIN_URL)));
@@ -698,4 +802,4 @@ if (run_replace('safe_admin_add_script_boolean', false) === false) {
     $config['cf_analytics'] = '';
     $config['cf_add_script'] = '';
     $config['cf_add_meta'] = '';
-}
+}

adm/admin.tail.php

@@ -17,7 +17,7 @@ $print_version = ($is_admin == 'super') ? 'Version ' . G5_GNUBOARD_VER : '';
 </div>
 <footer id="ft">
     <p>
-        Copyright &copy; <?php echo $_SERVER['HTTP_HOST']; ?>. All rights reserved. <?php echo $print_version; ?><br>
+        Copyright &copy; <?php echo htmlspecialchars($_SERVER['HTTP_HOST']); ?>. All rights reserved. <?php echo $print_version; ?><br>
         <button type="button" class="scroll_top"><span class="top_img"></span><span class="top_txt">TOP</span></button>
     </p>
 </footer>

adm/auth_list.php

@@ -23,6 +23,9 @@ if (!$sst) {
     $sst  = "a.mb_id, au_menu";
     $sod = "";
 }
+$allowed_sst = array('a.mb_id', 'mb_nick', 'au_menu', 'au_auth', 'a.mb_id, au_menu');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'a.mb_id, au_menu';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by $sst $sod ";
 
 $sql = " select count(*) as cnt
@@ -51,6 +54,8 @@ $listall = '<a href="' . $_SERVER['SCRIPT_NAME'] . '" class="ov_listall btn_ov02
 $g5['title'] = "관리권한설정";
 require_once './admin.head.php';
 
+$assignable_auth_menu = admin_get_assignable_auth_menu();
+
 $colspan = 5;
 ?>
 
@@ -102,8 +107,8 @@ $colspan = 5;
                         $is_continue = true;
                     }
 
-                    // 메뉴번호가 바뀌는 경우에 현재 없는 저장된 메뉴는 삭제함
-                    if (!isset($auth_menu[$row['au_menu']])) {
+                    // 메뉴번호가 바뀌거나 권한 부여 대상이 아닌 메뉴는 삭제함
+                    if (!isset($assignable_auth_menu[$row['au_menu']])) {
                         sql_query(" delete from {$g5['auth_table']} where au_menu = '{$row['au_menu']}' ");
                         $is_continue = true;
                     }
@@ -127,7 +132,7 @@ $colspan = 5;
                         <td class="td_auth_mbnick"><?php echo $mb_nick ?></td>
                         <td class="td_menu">
                             <?php echo $row['au_menu'] ?>
-                            <?php echo $auth_menu[$row['au_menu']] ?>
+                            <?php echo $assignable_auth_menu[$row['au_menu']] ?>
                         </td>
                         <td class="td_auth"><?php echo $row['au_auth'] ?></td>
                     </tr>
@@ -151,7 +156,7 @@ $colspan = 5;
     //if (isset($stx))
     //    echo '<script>document.fsearch.sfl.value = "'.$sfl.'";</script>'."\n";
 
-    if (strstr($sfl, 'mb_id')) {
+    if (strpos($sfl, 'mb_id') !== false) {
         $mb_id = $stx;
     } else {
         $mb_id = '';
@@ -202,7 +207,7 @@ echo $pagelist;
                             <select id="au_menu" name="au_menu" required class="required">
                                 <option value=''>선택하세요</option>
                                 <?php
-                                foreach ($auth_menu as $key => $value) {
+                                foreach ($assignable_auth_menu as $key => $value) {
                                     if (!(substr($key, -3) == '000' || $key == '-' || !$key)) {
                                         echo '<option value="' . $key . '">' . $key . ' ' . $value . '</option>';
                                     }

adm/auth_update.php

@@ -19,6 +19,11 @@ if (!(isset($mb['mb_id']) && $mb['mb_id'])) {
 
 check_admin_token();
 
+$assignable_auth_menu = admin_get_assignable_auth_menu();
+if (!$au_menu || !isset($assignable_auth_menu[$au_menu])) {
+    alert('해당 메뉴는 관리권한을 부여할 수 없습니다.');
+}
+
 require_once G5_CAPTCHA_PATH . '/captcha.lib.php';
 
 if (!chk_captcha()) {

adm/board_copy_update.php

@@ -12,7 +12,7 @@ $bo_table       = isset($_POST['bo_table']) ? substr(preg_replace('/[^a-z0-9_]/i
 $target_table   = isset($_POST['target_table']) ? trim($_POST['target_table']) : '';
 $target_subject = isset($_POST['target_subject']) ? trim($_POST['target_subject']) : '';
 
-$target_subject = strip_tags(clean_xss_attributes($target_subject));
+$target_subject = addslashes(strip_tags(clean_xss_attributes(stripslashes($target_subject))));
 
 $file_copy      = array();
 

adm/board_form_update.php

@@ -12,8 +12,8 @@ check_admin_token();
 
 $gr_id              = isset($_POST['gr_id']) ? preg_replace('/[^a-z0-9_]/i', '', (string)$_POST['gr_id']) : '';
 $bo_admin           = isset($_POST['bo_admin']) ? preg_replace('/[^a-z0-9_\, \|\#]/i', '', $_POST['bo_admin']) : '';
-$bo_subject         = isset($_POST['bo_subject']) ? strip_tags(clean_xss_attributes($_POST['bo_subject'])) : '';
-$bo_mobile_subject  = isset($_POST['bo_mobile_subject']) ? strip_tags(clean_xss_attributes($_POST['bo_mobile_subject'])) : '';
+$bo_subject         = isset($_POST['bo_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['bo_subject'])))) : '';
+$bo_mobile_subject  = isset($_POST['bo_mobile_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['bo_mobile_subject'])))) : '';
 
 if (!$gr_id) {
     alert('그룹 ID는 반드시 선택하세요.');
@@ -39,14 +39,17 @@ $bo_include_tail = isset($_POST['bo_include_tail']) ? preg_replace(array("#[\\\]
 $check_captcha = false;
 
 // 관리자가 자동등록방지 CAPTCHA를 사용해야 할 경우
-if ($w === 'u') {
-    if (isset($board['bo_include_head'], $board['bo_include_tail']) &&
-        ($board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail)) {
-        $check_captcha = true;
-    }
-} elseif ($w === '') {
-    if ($bo_include_head !== '_head.php' || $bo_include_tail !== '_tail.php') {
-        $check_captcha = true;
+// 최고 관리자인 경우에만 수정가능
+if ($is_admin === 'super') {
+    if ($w === 'u') {
+        if (isset($board['bo_include_head'], $board['bo_include_tail']) &&
+            ($board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail)) {
+            $check_captcha = true;
+        }
+    } elseif ($w === '') {
+        if ($bo_include_head !== '_head.php' || $bo_include_tail !== '_tail.php') {
+            $check_captcha = true;
+        }
     }
 }
 
@@ -136,7 +139,7 @@ $bo_hot = isset($_POST['bo_hot']) ? (int) $_POST['bo_hot'] : 0;
 $bo_image_width = isset($_POST['bo_image_width']) ? (int) $_POST['bo_image_width'] : 0;
 $bo_use_search = isset($_POST['bo_use_search']) ? (int) $_POST['bo_use_search'] : 0;
 $bo_use_cert = isset($_POST['bo_use_cert']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['bo_use_cert']) : '';
-$bo_device = isset($_POST['bo_device']) ? clean_xss_tags($_POST['bo_device'], 1, 1) : '';
+$bo_device = isset($_POST['bo_device']) ? addslashes(clean_xss_tags(stripslashes($_POST['bo_device']), 1, 1)) : '';
 $bo_list_level = isset($_POST['bo_list_level']) ? (int) $_POST['bo_list_level'] : 0;
 $bo_read_level = isset($_POST['bo_read_level']) ? (int) $_POST['bo_read_level'] : 0;
 $bo_write_level = isset($_POST['bo_write_level']) ? (int) $_POST['bo_write_level'] : 0;
@@ -152,9 +155,9 @@ $bo_read_point = isset($_POST['bo_read_point']) ? (int) $_POST['bo_read_point']
 $bo_write_point = isset($_POST['bo_write_point']) ? (int) $_POST['bo_write_point'] : 0;
 $bo_comment_point = isset($_POST['bo_comment_point']) ? (int) $_POST['bo_comment_point'] : 0;
 $bo_download_point = isset($_POST['bo_download_point']) ? (int) $_POST['bo_download_point'] : 0;
-$bo_select_editor = isset($_POST['bo_select_editor']) ? clean_xss_tags($_POST['bo_select_editor'], 1, 1) : '';
-$bo_skin = isset($_POST['bo_skin']) ? clean_xss_tags($_POST['bo_skin'], 1, 1) : '';
-$bo_mobile_skin = isset($_POST['bo_mobile_skin']) ? clean_xss_tags($_POST['bo_mobile_skin'], 1, 1) : '';
+$bo_select_editor = isset($_POST['bo_select_editor']) ? addslashes(clean_xss_tags(stripslashes($_POST['bo_select_editor']), 1, 1)) : '';
+$bo_skin = isset($_POST['bo_skin']) ? addslashes(clean_xss_tags(stripslashes($_POST['bo_skin']), 1, 1)) : '';
+$bo_mobile_skin = isset($_POST['bo_mobile_skin']) ? addslashes(clean_xss_tags(stripslashes($_POST['bo_mobile_skin']), 1, 1)) : '';
 $bo_content_head = isset($_POST['bo_content_head']) ? $_POST['bo_content_head'] : '';
 $bo_content_tail = isset($_POST['bo_content_tail']) ? $_POST['bo_content_tail'] : '';
 $bo_mobile_content_head = isset($_POST['bo_mobile_content_head']) ? $_POST['bo_mobile_content_head'] : '';
@@ -173,7 +176,17 @@ $bo_write_min = isset($_POST['bo_write_min']) ? (int) $_POST['bo_write_min'] : 0
 $bo_write_max = isset($_POST['bo_write_max']) ? (int) $_POST['bo_write_max'] : 0;
 $bo_comment_min = isset($_POST['bo_comment_min']) ? (int) $_POST['bo_comment_min'] : 0;
 $bo_comment_max = isset($_POST['bo_comment_max']) ? (int) $_POST['bo_comment_max'] : 0;
-$bo_sort_field = isset($_POST['bo_sort_field']) ? clean_xss_tags($_POST['bo_sort_field'], 1, 1) : '';
+$bo_sort_field = isset($_POST['bo_sort_field']) ? trim(stripslashes($_POST['bo_sort_field'])) : '';
+$bo_allowed_sort_field = array('');
+if (function_exists('get_board_sort_fields')) {
+    foreach (get_board_sort_fields(isset($board) ? $board : array()) as $bo_sort_v) {
+        $bo_allowed_sort_field[] = $bo_sort_v[0];
+    }
+}
+if (!in_array($bo_sort_field, $bo_allowed_sort_field, true)) {
+    $bo_sort_field = '';
+}
+$bo_sort_field = addslashes($bo_sort_field);
 
 if (strpbrk($bo_skin.$bo_mobile_skin, "?%*:|\"<>") !== false) {
     alert('스킨 디렉토리명 오류!');

adm/board_list.php

@@ -32,6 +32,9 @@ if (!$sst) {
     $sst  = "a.gr_id, a.bo_table";
     $sod = "asc";
 }
+$allowed_sst = array('a.gr_id', 'bo_table', 'bo_skin', 'bo_mobile_skin', 'bo_subject', 'bo_use_sns', 'bo_use_search', 'bo_order', 'a.gr_id, a.bo_table');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'a.gr_id, a.bo_table';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by $sst $sod ";
 
 $sql = " select count(*) as cnt {$sql_common} {$sql_search} {$sql_order} ";

adm/board_list_update.php

@@ -46,7 +46,7 @@ if ($act_button === "선택수정") {
             }
         }
 
-        $p_bo_subject = is_array($_POST['bo_subject']) ? strip_tags(clean_xss_attributes($_POST['bo_subject'][$k])) : '';
+        $p_bo_subject = is_array($_POST['bo_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['bo_subject'][$k])))) : '';
 
         $sql = " update {$g5['board_table']}
                     set gr_id               = '" . sql_real_escape_string($post_gr_id) . "',

adm/boardgroup_form_update.php

@@ -39,7 +39,7 @@ for ($i = 1; $i <= 10; $i++) {
 
 foreach ($check_keys as $key => $value) {
     if ($key === 'gr_subject') {
-        $posts[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
+        $posts[$key] = isset($_POST[$key]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$key])))) : '';
     } else {
         $posts[$key] = isset($_POST[$key]) ? $_POST[$key] : '';
     }

adm/boardgroup_list.php

@@ -34,6 +34,9 @@ if ($stx) {
     $sql_search .= " ) ";
 }
 
+$allowed_sst = array('gr_id', 'gr_subject', 'gr_admin', 'gr_order');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = '';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 if ($sst) {
     $sql_order = " order by {$sst} {$sod} ";
 } else {

adm/boardgroup_list_update.php

@@ -21,7 +21,7 @@ if (!$chk_count) {
 for ($i = 0; $i < $chk_count; $i++) {
     $k              = isset($post_chk[$i]) ? (int) $post_chk[$i] : 0;
     $gr_id          = preg_replace('/[^a-z0-9_]/i', '', $post_group_id[$k]);
-    $gr_subject     = isset($_POST['gr_subject'][$k]) ? strip_tags(clean_xss_attributes($_POST['gr_subject'][$k])) : '';
+    $gr_subject     = isset($_POST['gr_subject'][$k]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['gr_subject'][$k])))) : '';
     $gr_admin       = isset($_POST['gr_admin'][$k]) ? strip_tags(clean_xss_attributes($_POST['gr_admin'][$k])) : '';
     $gr_device      = isset($_POST['gr_device'][$k]) ? clean_xss_tags($_POST['gr_device'][$k], 1, 1, 10) : '';
     $gr_use_access  = isset($_POST['gr_use_access'][$k]) ? (int) $_POST['gr_use_access'][$k] : 0;
@@ -36,7 +36,7 @@ for ($i = 0; $i < $chk_count; $i++) {
                         gr_order      = '" . $gr_order . "'
                   where gr_id         = '{$gr_id}' ";
         if ($is_admin != 'super') {
-            $sql .= " and gr_admin    = '{$gr_admin}' ";
+            $sql .= " and gr_admin    = '" . sql_real_escape_string($gr_admin) . "' ";
         }
         sql_query($sql);
     } elseif ($act_button == '선택삭제') {

adm/boardgroupmember_list.php

@@ -28,6 +28,9 @@ if (!$sst) {
     $sst = "gm_datetime";
     $sod = "desc";
 }
+$allowed_sst = array('gm_datetime', 'b.mb_id', 'b.mb_name', 'b.mb_nick', 'b.mb_today_login', 'a.gm_datetime');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'gm_datetime';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/browscap_converter.php

@@ -21,7 +21,7 @@ if (!is_file(G5_DATA_PATH . '/cache/browscap_cache.php')) {
 }
 
 require_once G5_PLUGIN_PATH . '/browscap/Browscap.php';
-$browscap = new phpbrowscap\Browscap(G5_DATA_PATH . '/cache');
+$browscap = new Browscap(G5_DATA_PATH . '/cache');
 $browscap->doAutoUpdate = false;
 $browscap->cacheFilename = 'browscap_cache.php';
 

adm/browscap_update.php

@@ -17,7 +17,7 @@ if ($is_admin != 'super') {
 
 require_once G5_PLUGIN_PATH . '/browscap/Browscap.php';
 
-$browscap = new phpbrowscap\Browscap(G5_DATA_PATH . '/cache');
+$browscap = new Browscap(G5_DATA_PATH . '/cache');
 $browscap->updateMethod = 'cURL';
 $browscap->cacheFilename = 'browscap_cache.php';
 $browscap->updateCache();

adm/config_form.php

@@ -415,10 +415,10 @@ if (!isset($config['cf_cert_use_seed'])) {
     sql_query($sql, false);
 }
 if (!isset($config['cf_cert_kcp_enckey'])) {
-    $sql = "ALTER TABLE `{$g5['config_table']}` 
+    $sql = "ALTER TABLE `{$g5['config_table']}`
             ADD COLUMN `cf_cert_kcp_enckey` VARCHAR(100) NOT NULL DEFAULT '' AFTER `cf_cert_kcp_cd`; ";
     sql_query($sql, false);
-    
+
     $config['cf_cert_kcp_enckey'] = '';
 }
 
@@ -1068,7 +1068,24 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                                 <?php echo option_selected("", $config['cf_cert_hp'], "사용안함"); ?>
                                 <?php echo option_selected("kcb", $config['cf_cert_hp'], "코리아크레딧뷰로(KCB) 휴대폰 본인확인"); ?>
                                 <?php echo option_selected("kcp", $config['cf_cert_hp'], "NHN KCP 휴대폰 본인확인"); ?>
+                                <?php echo option_selected("kcp_v2", $config['cf_cert_hp'], "NHN KCP 휴대폰 본인확인(api_v2)"); ?>
                             </select>
+                            <div id="cf_cert_hp_kcp_v2_notice" style="display:<?php echo ($config['cf_cert_hp'] == 'kcp_v2') ? 'block' : 'none'; ?>; margin-top:8px; padding:10px 12px; background:#fff8e1; border:1px solid #ffd54f; border-radius:4px; color:#5d4037; line-height:1.5;">
+                                <strong>NHN KCP 휴대폰 본인확인(api_v2)</strong> 사용 시,<br>
+                                NHN KCP 상점관리자 &gt; 부가서비스 &gt; 휴대폰본인확인 &gt; 연동방식 설정 에서 <strong>신규 연동방식(V2) 사용여부를 &lsquo;사용&rsquo;</strong> 으로 변경해야 정상 동작합니다.<br>
+                                PHP 7.0 이상 환경에서만 동작하며, PHP 7.0 미만에서는 사용할 수 없습니다.
+                            </div>
+                            <script>
+                            jQuery(function($){
+                                function toggle_kcp_v2_notice() {
+                                    var is_kcp_v2 = $('#cf_cert_hp').val() === 'kcp_v2';
+                                    $('#cf_cert_hp_kcp_v2_notice').toggle(is_kcp_v2);
+                                }
+
+                                $('#cf_cert_hp').on('change', toggle_kcp_v2_notice);
+                                toggle_kcp_v2_notice();
+                            });
+                            </script>
                         </td>
                     </tr>
                     <tr>
@@ -1104,16 +1121,22 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                     <tr>
                         <th scope="row" class="cf_cert_service"><label for="cf_cert_kcp_cd">NHN KCP 사이트코드</label></th>
                         <td class="cf_cert_service">
+                            <?php
+                            $cf_cert_kcp_cd = get_sanitize_input($config['cf_cert_kcp_cd']);
+                            if (preg_match('/^SM([A-Z0-9]{3})$/i', $cf_cert_kcp_cd, $matches)) {
+                                $cf_cert_kcp_cd = $matches[1];
+                            }
+                            ?>
                             <?php echo help('SM으로 시작하는 5자리 사이트 코드중 뒤의 3자리만 입력해 주십시오.<br>서비스에 가입되어 있지 않다면, 본인확인 서비스 신청페이지에서 서비스 신청 후 사이트코드를 발급 받으실 수 있습니다.') ?>
-                            <span class="sitecode">SM</span>
-                            <input type="text" name="cf_cert_kcp_cd" value="<?php echo get_sanitize_input($config['cf_cert_kcp_cd']); ?>" id="cf_cert_kcp_cd" class="frm_input" size="3"> <a href="http://sir.kr/main/service/p_cert.php" target="_blank" class="btn_frmline">NHN KCP 휴대폰 본인확인 서비스 신청페이지</a>
+                            <span class="sitecode" id="cf_cert_kcp_cd_prefix">SM</span>
+                            <input type="text" name="cf_cert_kcp_cd" value="<?php echo $cf_cert_kcp_cd; ?>" id="cf_cert_kcp_cd" class="frm_input" size="3" maxlength="3"> <a href="http://sir.kr/main/service/p_cert.php" target="_blank" class="btn_frmline">NHN KCP 휴대폰 본인확인 서비스 신청페이지</a>
                         </td>
                     </tr>
                     <tr>
                         <th scope="row" class="cf_cert_service"><label for="cf_cert_kcp_enckey">NHN KCP 가맹점 인증키</label></th>
                         <td class="cf_cert_service">
-                            <?php echo help('(선택사항, 추후 NHN_KCP 상점관리자에서 인증키 발급 메뉴 오픈일정 이후부터 적용되는 내용입니다.)<br>NHN_KCP 상점관리자 > 기술관리센터 > 인증센터 > 가맹점 인증키관리 에서 인증키 발급 후에 인증키 정보를 입력') ?>
-                            <input type="text" name="cf_cert_kcp_enckey" value="<?php echo get_sanitize_input($config['cf_cert_kcp_enckey']); ?>" id="cf_cert_kcp_enckey" class="frm_input" maxlength="100" size="40"> <a href="https://partner.kcp.co.kr" target="_blank" class="btn_frmline">NHN KCP 상점관리자</a>
+                            <?php echo help('NHN KCP 상점관리자 > 기술관리센터 > 인증센터 > 가맹점 인증키관리 에서 인증키를 발급받아 입력해 주십시오.<br>NHN KCP 휴대폰 본인확인(api_v2)도 이 인증키 값을 사용합니다.') ?>
+                            <input type="text" name="cf_cert_kcp_enckey" value="<?php echo get_sanitize_input($config['cf_cert_kcp_enckey']); ?>" id="cf_cert_kcp_enckey" class="frm_input" maxlength="100" size="70"> <a href="https://partner.kcp.co.kr" target="_blank" class="btn_frmline">NHN KCP 상점관리자</a>
                         </td>
                     </tr>
                     <tr>

adm/config_form_update.php

@@ -13,8 +13,8 @@ if ($is_admin != 'super') {
 $sql = " select * from {$g5['config_table']} limit 1";
 $ori_config = sql_fetch($sql);
 
-$cf_title = isset($_POST['cf_title']) ? strip_tags(clean_xss_attributes($_POST['cf_title'])) : '';
-$cf_admin = isset($_POST['cf_admin']) ? clean_xss_tags($_POST['cf_admin'], 1, 1) : '';
+$cf_title = isset($_POST['cf_title']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['cf_title'])))) : '';
+$cf_admin = isset($_POST['cf_admin']) ? safe_replace_regex($_POST['cf_admin']) : '';
 
 $mb = get_member($cf_admin);
 
@@ -173,7 +173,7 @@ foreach ($check_keys as $k => $v) {
         if (in_array($k, array('cf_analytics', 'cf_add_meta', 'cf_add_script', 'cf_stipulation', 'cf_privacy'))) {
             $_POST[$k] = isset($_POST[$k]) ? $_POST[$k] : '';
         } else {
-            $_POST[$k] = isset($_POST[$k]) ? strip_tags(clean_xss_attributes($_POST[$k])) : '';
+            $_POST[$k] = isset($_POST[$k]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$k])))) : '';
         }
     }
 }

adm/contentformupdate.php

@@ -26,17 +26,28 @@ if ($w == "" || $w == "u") {
 }
 
 $co_id = isset($_REQUEST['co_id']) ? preg_replace('/[^a-z0-9_]/i', '', $_REQUEST['co_id']) : '';
-$co_subject = isset($_POST['co_subject']) ? strip_tags(clean_xss_attributes($_POST['co_subject'])) : '';
+$co_subject = isset($_POST['co_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['co_subject'])))) : '';
 $co_include_head = isset($_POST['co_include_head']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['co_include_head'], 0, 255)) : '';
 $co_include_tail = isset($_POST['co_include_tail']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['co_include_tail'], 0, 255)) : '';
+
+// 최고 관리자가 아니면 include 경로 변경 불가 (board_form_update.php 와 동일 정책)
+if ($is_admin !== 'super') {
+    if ($w == 'u') {
+        $co_include_head = isset($co_row['co_include_head']) ? $co_row['co_include_head'] : '';
+        $co_include_tail = isset($co_row['co_include_tail']) ? $co_row['co_include_tail'] : '';
+    } else {
+        $co_include_head = '';
+        $co_include_tail = '';
+    }
+}
 $co_tag_filter_use = isset($_POST['co_tag_filter_use']) ? (int) $_POST['co_tag_filter_use'] : 1;
 $co_himg_del = (isset($_POST['co_himg_del']) && $_POST['co_himg_del']) ? 1 : 0;
 $co_timg_del = (isset($_POST['co_timg_del']) && $_POST['co_timg_del']) ? 1 : 0;
 $co_html = isset($_POST['co_html']) ? (int) $_POST['co_html'] : 0;
 $co_content = isset($_POST['co_content']) ? $_POST['co_content'] : '';
 $co_mobile_content = isset($_POST['co_mobile_content']) ? $_POST['co_mobile_content'] : '';
-$co_skin = isset($_POST['co_skin']) ? clean_xss_tags($_POST['co_skin'], 1, 1) : '';
-$co_mobile_skin = isset($_POST['co_mobile_skin']) ? clean_xss_tags($_POST['co_mobile_skin'], 1, 1) : '';
+$co_skin = isset($_POST['co_skin']) ? addslashes(clean_xss_tags(stripslashes($_POST['co_skin']), 1, 1)) : '';
+$co_mobile_skin = isset($_POST['co_mobile_skin']) ? addslashes(clean_xss_tags(stripslashes($_POST['co_mobile_skin']), 1, 1)) : '';
 
 // 관리자가 자동등록방지를 사용해야 할 경우
 if (((isset($co_row['co_include_head']) && $co_row['co_include_head'] !== $co_include_head) || (isset($co_row['co_include_tail']) && $co_row['co_include_tail'] !== $co_include_tail)) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()) {

adm/css/admin.css

@@ -586,7 +586,7 @@ td.td_grpset {width:160px;border-left:1px solid #e9ecee;text-align:center}
 .td_time{text-align:center;width:130px}
 .td_center{text-align:center;}
 .td_type{width:120px}
-.td_consent{width:200px}
+.td_consent{min-width:70px;max-width:200px}
 
 .td_mng_s{width:60px}
 .td_mng_m{width:100px}

adm/dbupgrade.php

@@ -317,6 +317,63 @@ if (!isset($member['mb_marketing_agree'])) {
     $is_check = true;
 }
 
+// 쿠폰 로그 테이블에 UNIQUE 인덱스 추가 (쿠폰 이중사용 방지)
+if (defined('G5_USE_SHOP') && G5_USE_SHOP) {
+    $result = sql_query("SHOW INDEX FROM `{$g5['g5_shop_coupon_log_table']}` WHERE Key_name = 'idx_coupon_use'", false);
+    if (!$result || !sql_num_rows($result)) {
+        // 기존에 동일 쿠폰이 중복 사용된 데이터가 있으면 UNIQUE 인덱스 생성 실패하므로 중복 데이터 정리
+        $dup_sql = " SELECT cp_id, mb_id, MIN(cl_id) as keep_id
+                       FROM `{$g5['g5_shop_coupon_log_table']}`
+                      GROUP BY cp_id, mb_id
+                     HAVING COUNT(*) > 1 ";
+
+        $dup_result = sql_query($dup_sql, false);
+        if ($dup_result && sql_num_rows($dup_result)) {
+            while ($dup_row = sql_fetch_array($dup_result)) {
+                
+                echo $dup_row['cp_id']." 의 동일 쿠폰이 중복 사용된 데이터가 있으므로 인덱스 생성이 불가합니다. <br>";
+                
+                $sql = " DELETE FROM `{$g5['g5_shop_coupon_log_table']}`
+                             WHERE cp_id = '{$dup_row['cp_id']}'
+                               AND mb_id = '{$dup_row['mb_id']}'
+                               AND cl_id != '{$dup_row['keep_id']}' ";
+                if ($is_admin === 'super') {
+                    echo "데이터베이스에서 검토후에 이 쿼리문을 실행해 주세요.<br>$sql<br>";
+                }
+                // sql_query($sql);
+            }
+        }
+
+        // MyISAM + utf8mb4 환경에서 키 길이 초과 방지: cp_id varchar(100), mb_id varchar(100)으로 조정
+        sql_query("ALTER TABLE `{$g5['g5_shop_coupon_log_table']}` MODIFY `cp_id` varchar(100) NOT NULL DEFAULT '', MODIFY `mb_id` varchar(100) NOT NULL DEFAULT ''", false);
+        sql_query("ALTER TABLE `{$g5['g5_shop_coupon_log_table']}` ADD UNIQUE KEY `idx_coupon_use` (`cp_id`, `mb_id`)", false);
+        $is_check = true;
+    }
+}
+
+// 자동 로그인 토큰 테이블 생성 (KVE-2026-0610: 추측 가능한 자동 로그인 쿠키 위조 방지)
+// 다중 디바이스 지원을 위해 회원당 여러 토큰을 별도 테이블로 관리
+if (!isset($g5['member_auto_login_table'])) {
+    $g5['member_auto_login_table'] = G5_TABLE_PREFIX.'member_auto_login';
+}
+if (!sql_query(" DESC `{$g5['member_auto_login_table']}` ", false)) {
+    sql_query(" CREATE TABLE IF NOT EXISTS `{$g5['member_auto_login_table']}` (
+                  `al_id` int(11) NOT NULL auto_increment,
+                  `mb_id` varchar(20) NOT NULL default '',
+                  `al_token` varchar(64) NOT NULL default '',
+                  `al_user_agent` varchar(255) NOT NULL default '',
+                  `al_ip` varchar(45) NOT NULL default '',
+                  `al_created` datetime DEFAULT NULL,
+                  `al_last_used` datetime DEFAULT NULL,
+                  `al_expire` datetime DEFAULT NULL,
+                  PRIMARY KEY  (`al_id`),
+                  UNIQUE KEY `al_token` (`al_token`),
+                  KEY `mb_id` (`mb_id`),
+                  KEY `al_expire` (`al_expire`)
+                ) ENGINE=MyISAM DEFAULT CHARSET=utf8 ", true);
+    $is_check = true;
+}
+
 $is_check = run_replace('admin_dbupgrade', $is_check);
 
 $db_upgrade_msg = $is_check ? 'DB 업그레이드가 완료되었습니다.' : '더 이상 업그레이드 할 내용이 없습니다.<br>현재 DB 업그레이드가 완료된 상태입니다.';

adm/faqmasterformupdate.php

@@ -20,7 +20,7 @@ check_admin_token();
 $fm_id = isset($_REQUEST['fm_id']) ? (int) $_REQUEST['fm_id'] : 0;
 $fm_himg_del = isset($_POST['fm_himg_del']) ? (int) $_POST['fm_himg_del'] : 0;
 $fm_timg_del = isset($_POST['fm_timg_del']) ? (int) $_POST['fm_timg_del'] : 0;
-$fm_subject = isset($_POST['fm_subject']) ? strip_tags(clean_xss_attributes($_POST['fm_subject'])) : '';
+$fm_subject = isset($_POST['fm_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['fm_subject'])))) : '';
 $fm_head_html = isset($_POST['fm_head_html']) ? $_POST['fm_head_html'] : '';
 $fm_tail_html = isset($_POST['fm_tail_html']) ? $_POST['fm_tail_html'] : '';
 $fm_mobile_head_html = isset($_POST['fm_mobile_head_html']) ? $_POST['fm_mobile_head_html'] : '';

adm/index.php

@@ -35,6 +35,10 @@ if (!auth_check_menu($auth, '200100', 'r', true)) {
         $sod = "desc";
     }
 
+    $allowed_sst = array('mb_datetime');
+    if ($sst && !in_array($sst, $allowed_sst)) $sst = 'mb_datetime';
+    if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
+
     $sql_order = " order by {$sst} {$sod} ";
 
     $sql = " SELECT count(*) as cnt {$sql_common} {$sql_search} {$sql_order} ";
@@ -284,14 +288,19 @@ if (!auth_check_menu($auth, '200200', 'r', true)) {
                 </thead>
                 <tbody>
                     <?php
-                    $row2['mb_id'] = '';
+                    $row2 = array('mb_id'=>'');
                     for ($i = 0; $row = sql_fetch_array($result); $i++) {
-                        if ($row2['mb_id'] != $row['mb_id']) {
+                        if (empty($row2) || $row2['mb_id'] != $row['mb_id']) {
                             $sql2 = " SELECT mb_id, mb_name, mb_nick, mb_email, mb_homepage, mb_point from {$g5['member_table']} where mb_id = '{$row['mb_id']}' ";
                             $row2 = sql_fetch($sql2);
                         }
 
-                        $mb_nick = get_sideview($row['mb_id'], $row2['mb_nick'], $row2['mb_email'], $row2['mb_homepage']);
+                        $mb_nick = get_sideview(
+                            $row['mb_id'], 
+                            isset($row2['mb_nick']) ? $row2['mb_nick'] : '', 
+                            isset($row2['mb_email']) ? $row2['mb_email'] : '', 
+                            isset($row2['mb_homepage']) ? $row2['mb_homepage'] : ''
+                        );
 
                         $link1 = $link2 = "";
                         if (!preg_match("/^\@/", $row['po_rel_table']) && $row['po_rel_table']) {
@@ -302,7 +311,7 @@ if (!auth_check_menu($auth, '200200', 'r', true)) {
 
                         <tr>
                             <td class="td_mbid"><a href="./point_list.php?sfl=mb_id&amp;stx=<?php echo $row['mb_id'] ?>"><?php echo $row['mb_id'] ?></a></td>
-                            <td class="td_mbname"><?php echo get_text($row2['mb_name']); ?></td>
+                            <td class="td_mbname"><?php echo isset($row2['mb_name']) ? get_text($row2['mb_name']) : ''; ?></td>
                             <td class="td_name sv_use">
                                 <div><?php echo $mb_nick ?></div>
                             </td>

adm/mail_select_form.php

@@ -80,7 +80,7 @@ require_once './admin.head.php';
                 <tr>
                     <th scope="row"><label for="mb_email">E-mail</label></th>
                     <td>
-                        <?php echo help("메일 주소에 단어 포함 (예 : @" . preg_replace('#^(www[^\.]*\.){1}#', '', $_SERVER['HTTP_HOST']) . ")") ?>
+                        <?php echo help("메일 주소에 단어 포함 (예 : @" . htmlspecialchars(preg_replace('#^(www[^\.]*\.){1}#', '', $_SERVER['HTTP_HOST'])) . ")") ?>
                         <input type="text" name="mb_email" value="<?php echo get_sanitize_input($mb_email); ?>" id="mb_email" class="frm_input" size="50">
                     </td>
                 </tr>

adm/mail_select_list.php

@@ -12,10 +12,10 @@ $sql_common = " from {$g5['member_table']} ";
 $sql_where = " where (1) ";
 
 $mb_id1         = isset($_POST['mb_id1'])       ? (int) $_POST['mb_id1'] : 1;
-$mb_id1_from    = isset($_POST['mb_id1_from'])  ? clean_xss_tags($_POST['mb_id1_from'], 1, 1, 30) : '';
-$mb_id1_to      = isset($_POST['mb_id1_to'])    ? clean_xss_tags($_POST['mb_id1_to'], 1, 1, 30) : '';
-$mb_email       = isset($_POST['mb_email'])     ? clean_xss_tags($_POST['mb_email'], 1, 1, 100) : '';
-$mb_mailling    = isset($_POST['mb_mailling'])  ? clean_xss_tags($_POST['mb_mailling'], 1, 1, 100) : '';
+$mb_id1_from    = isset($_POST['mb_id1_from'])  ? addslashes(clean_xss_tags(stripslashes($_POST['mb_id1_from']), 1, 1, 30)) : '';
+$mb_id1_to      = isset($_POST['mb_id1_to'])    ? addslashes(clean_xss_tags(stripslashes($_POST['mb_id1_to']), 1, 1, 30)) : '';
+$mb_email       = isset($_POST['mb_email'])     ? addslashes(clean_xss_tags(stripslashes($_POST['mb_email']), 1, 1, 100)) : '';
+$mb_mailling    = isset($_POST['mb_mailling'])  ? addslashes(clean_xss_tags(stripslashes($_POST['mb_mailling']), 1, 1, 100)) : '';
 $mb_level_from  = isset($_POST['mb_level_from'])? (int) $_POST['mb_level_from'] : 1;
 $mb_level_to    = isset($_POST['mb_level_to'])  ? (int) $_POST['mb_level_to'] : 10;
 

adm/mail_update.php

@@ -11,7 +11,7 @@ auth_check_menu($auth, $sub_menu, 'w');
 check_admin_token();
 
 $ma_id = isset($_POST['ma_id']) ? (int) $_POST['ma_id'] : 0;
-$ma_subject = isset($_POST['ma_subject']) ? strip_tags(clean_xss_attributes($_POST['ma_subject'])) : '';
+$ma_subject = isset($_POST['ma_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['ma_subject'])))) : '';
 $ma_content = isset($_POST['ma_content']) ? $_POST['ma_content'] : '';
 
 if ($w == '') {

adm/member_form.php

@@ -275,7 +275,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                     <th scope="row"><label for="mb_level">회원 권한</label></th>
                     <td><?php echo get_member_level_select('mb_level', 1, $member['mb_level'], $mb['mb_level']) ?></td>
                     <th scope="row">포인트</th>
-                    <td><a href="./point_list.php?sfl=mb_id&amp;stx=<?php echo $mb['mb_id'] ?>" target="_blank"><?php echo number_format($mb['mb_point']) ?></a> 점</td>
+                    <td><a href="./point_list.php?sfl=mb_id&amp;stx=<?php echo $mb['mb_id'] ?>" target="_blank"><?php echo number_format(isset($mb['mb_point']) ? $mb['mb_point'] : 0) ?></a> 점</td>
                 </tr>
                 <tr>
                     <th scope="row"><label for="mb_email">E-mail<strong class="sound_only">필수</strong></label></th>
@@ -338,7 +338,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                         <?php echo help('이미지 크기는 <strong>넓이 ' . $config['cf_member_icon_width'] . '픽셀 높이 ' . $config['cf_member_icon_height'] . '픽셀</strong>로 해주세요.') ?>
                         <input type="file" name="mb_icon" id="mb_icon">
                         <?php
-                        $mb_dir = substr($mb['mb_id'], 0, 2);
+                        $mb_dir = substr(isset($mb['mb_id']) ? $mb['mb_id'] : '', 0, 2);
                         $icon_file = G5_DATA_PATH . '/member/' . $mb_dir . '/' . get_mb_icon_name($mb['mb_id']) . '.gif';
                         if (file_exists($icon_file)) {
                             $icon_url = str_replace(G5_DATA_PATH, G5_DATA_URL, $icon_file);
@@ -355,7 +355,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                         <?php echo help('이미지 크기는 <strong>넓이 ' . $config['cf_member_img_width'] . '픽셀 높이 ' . $config['cf_member_img_height'] . '픽셀</strong>로 해주세요.') ?>
                         <input type="file" name="mb_img" id="mb_img">
                         <?php
-                        $mb_dir = substr($mb['mb_id'], 0, 2);
+                        $mb_dir = substr(isset($mb['mb_id']) ? $mb['mb_id'] : '', 0, 2);
                         $icon_file = G5_DATA_PATH . '/member_image/' . $mb_dir . '/' . get_mb_icon_name($mb['mb_id']) . '.gif';
                         if (file_exists($icon_file)) {
                             echo get_member_profile_img($mb['mb_id']);
@@ -559,7 +559,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                                                     <span class="provider_name"><?php echo $provider_name;   //서비스이름 ?> ( <?php echo $account['displayname']; ?> )</span>
                                                     <span class="account_hidden" style="display:none"><?php echo $account['mb_id']; ?></span>
                                                 </div>
-                                                <div class="btn_info"><a href="<?php echo G5_SOCIAL_LOGIN_URL . '/unlink.php?mp_no=' . $account['mp_no'] ?>" class="social_unlink" data-provider="<?php echo $account['mp_no']; ?>">연동해제</a> <span class="sound_only"><?php echo substr($account['mp_register_day'], 2, 14); ?></span></div>
+                                                <div class="btn_info"><a href="<?php echo G5_SOCIAL_LOGIN_URL . '/unlink.php?mp_no=' . $account['mp_no'] ?>" class="social_unlink" data-provider="<?php echo $account['mp_no']; ?>">연동해제</a> <span class="sound_only"><?php echo substr(isset($account['mp_register_day']) ? $account['mp_register_day'] : '', 2, 14); ?></span></div>
                                             </div>
                                         <?php } //end foreach ?>
                                     </li>

adm/member_form_update.php

@@ -19,8 +19,8 @@ $mb_certify     = isset($_POST['mb_certify']) ? preg_replace('/[^0-9a-z_]/i', ''
 $mb_zip         = isset($_POST['mb_zip']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_zip']) : '';
 
 // 광고성 정보 수신
-$mb_marketing_agree         = isset($_POST['mb_marketing_agree']) ? clean_xss_tags($_POST['mb_marketing_agree'], 1, 1) : '0';
-$mb_thirdparty_agree         = isset($_POST['mb_thirdparty_agree']) ? clean_xss_tags($_POST['mb_thirdparty_agree'], 1, 1) : '0';
+$mb_marketing_agree         = isset($_POST['mb_marketing_agree']) ? addslashes(clean_xss_tags(stripslashes($_POST['mb_marketing_agree']), 1, 1)) : '0';
+$mb_thirdparty_agree         = isset($_POST['mb_thirdparty_agree']) ? addslashes(clean_xss_tags(stripslashes($_POST['mb_thirdparty_agree']), 1, 1)) : '0';
 
 // 관리자가 자동등록방지를 사용해야 할 경우 ( 회원의 비밀번호 변경시 캡챠를 체크한다 )
 if ($mb_password) {
@@ -84,9 +84,9 @@ for ($i = 1; $i <= 10; $i++) {
 
 foreach ($check_keys as $key) {
     if( in_array($key, array('mb_signature', 'mb_profile')) ){
-        $posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1, 0, 0) : '';
+        $posts[$key] = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1, 0, 0)) : '';
     } else {
-        $posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
+        $posts[$key] = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : '';
     }
 }
 
@@ -127,6 +127,11 @@ $sql_common = "  mb_name = '{$posts['mb_name']}',
                  mb_9 = '{$posts['mb_9']}',
                  mb_10 = '{$posts['mb_10']}' ";
 
+// 부여하려는 mb_level 상한 검증 (자기보다 높은 권한 부여 차단)
+if ($is_admin !== 'super' && (int) $posts['mb_level'] >= (int) $member['mb_level']) {
+    alert('자신보다 권한이 높거나 같은 등급은 부여할 수 없습니다.');
+}
+
 if ($w == '') {
     $mb = get_member($mb_id);
     if (isset($mb['mb_id']) && $mb['mb_id']) {
@@ -147,7 +152,7 @@ if ($w == '') {
         alert('이미 존재하는 이메일입니다.\\nＩＤ : ' . $row['mb_id'] . '\\n이름 : ' . $row['mb_name'] . '\\n닉네임 : ' . $row['mb_nick'] . '\\n메일 : ' . $row['mb_email']);
     }
 
-    $agree_items = [];
+    $agree_items = array();
     // 마케팅 목적의 개인정보 수집 및 이용
     if ($mb_marketing_agree == 1) {
         $sql_common .=  " , mb_marketing_date = '".G5_TIME_YMDHIS."' ";
@@ -230,7 +235,7 @@ if ($w == '') {
 
     // 현재 데이터 조회
     $row = sql_fetch("select * from {$g5['member_table']} where mb_id = '{$mb_id}' ");
-    $agree_items = [];
+    $agree_items = array();
         
     // 마케팅 목적의 개인정보 수집 및 이용
     $sql_marketing_date = "";

adm/member_list.php

@@ -6,6 +6,12 @@ auth_check_menu($auth, $sub_menu, 'r');
 
 $sql_common = " from {$g5['member_table']} ";
 
+// $sfl 화이트리스트 검증 (KVE-2026-0340)
+$allowed_sfl = array('mb_id', 'mb_nick', 'mb_name', 'mb_level', 'mb_email', 'mb_tel', 'mb_hp', 'mb_point', 'mb_datetime', 'mb_ip', 'mb_recommend');
+if (!in_array($sfl, $allowed_sfl)) {
+    $sfl = 'mb_id';
+}
+
 $sql_search = " where (1) ";
 if ($stx) {
     $sql_search .= " and ( ";
@@ -36,6 +42,10 @@ if (!$sst) {
     $sod = "desc";
 }
 
+$allowed_sst = array('mb_datetime', 'mb_id', 'mb_name', 'mb_nick', 'mb_level', 'mb_point', 'mb_today_login', 'mb_open', 'mb_mailling', 'mb_sms', 'mb_adult', 'mb_certify', 'mb_email_certify', 'mb_intercept_date', 'mb_leave_date');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'mb_datetime';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
+
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt {$sql_common} {$sql_search} {$sql_order} ";
@@ -127,7 +137,7 @@ $colspan = 16;
                     <th scope="col" rowspan="2" id="mb_list_cert"><?php echo subject_sort_link('mb_certify', '', 'desc') ?>본인확인</a></th>
                     <th scope="col" id="mb_list_mailc"><?php echo subject_sort_link('mb_email_certify', '', 'desc') ?>메일인증</a></th>
                     <th scope="col" id="mb_list_open"><?php echo subject_sort_link('mb_open', '', 'desc') ?>정보공개</a></th>
-                    <th scope="col" id="mb_list_mailr"><?php echo subject_sort_link('mb_mailling', '', 'desc') ?>광고성이메일수신</a></th>
+                    <th scope="col" id="mb_list_mailr"><?php echo subject_sort_link('mb_mailling', '', 'desc') ?>광고성이메일</a></th>
                     <th scope="col" id="mb_list_auth">상태</th>
                     <th scope="col" id="mb_list_mobile">휴대폰</th>
                     <th scope="col" id="mb_list_lastcall"><?php echo subject_sort_link('mb_today_login', '', 'desc') ?>최종접속</a></th>
@@ -137,9 +147,9 @@ $colspan = 16;
                 <tr>
                     <th scope="col" id="mb_list_name"><?php echo subject_sort_link('mb_name') ?>이름</a></th>
                     <th scope="col" id="mb_list_nick"><?php echo subject_sort_link('mb_nick') ?>닉네임</a></th>
-                    <th scope="col" id="mb_list_sms"><?php echo subject_sort_link('mb_sms', '', 'desc') ?>광고성SMS/카카오톡수신</a></th>
                     <th scope="col" id="mb_list_adultc"><?php echo subject_sort_link('mb_adult', '', 'desc') ?>성인인증</a></th>
                     <th scope="col" id="mb_list_auth"><?php echo subject_sort_link('mb_intercept_date', '', 'desc') ?>접근차단</a></th>
+                    <th scope="col" id="mb_list_sms"><?php echo subject_sort_link('mb_sms', '', 'desc') ?>광고성SMS</a></th>
                     <th scope="col" id="mb_list_deny"><?php echo subject_sort_link('mb_level', '', 'desc') ?>권한</a></th>
                     <th scope="col" id="mb_list_tel">전화번호</th>
                     <th scope="col" id="mb_list_join"><?php echo subject_sort_link('mb_datetime', '', 'desc') ?>가입일</a></th>
@@ -258,7 +268,7 @@ $colspan = 16;
                             <input type="checkbox" name="mb_open[<?php echo $i; ?>]" <?php echo $row['mb_open'] ? 'checked' : ''; ?> value="1" id="mb_open_<?php echo $i; ?>">
                         </td>
                         <td headers="mb_list_mailr" class="td_consent">
-                            <label for="mb_mailling_<?php echo $i; ?>" class="sound_only">메일수신</label>
+                            <label for="mb_mailling_<?php echo $i; ?>" class="sound_only">광고성이메일수신</label>
                             <input type="checkbox" name="mb_mailling[<?php echo $i; ?>]" <?php echo $row['mb_mailling'] ? 'checked' : ''; ?> value="1" id="mb_mailling_<?php echo $i; ?>">
                             <input type="hidden" name="mb_mailling_default[<?php echo $i; ?>]" value="<?php echo isset($row['mb_mailling']) ? $row['mb_mailling'] : '0'; ?> " id="mb_mailling_default_<?php echo $i; ?>">
                         </td>
@@ -281,12 +291,6 @@ $colspan = 16;
                         <td headers="mb_list_nick" class="td_name sv_use">
                             <div><?php echo $mb_nick ?></div>
                         </td>
-
-                        <td headers="mb_list_sms">
-                            <label for="mb_sms_<?php echo $i; ?>" class="sound_only">SMS수신</label>
-                            <input type="checkbox" name="mb_sms[<?php echo $i; ?>]" <?php echo $row['mb_sms'] ? 'checked' : ''; ?> value="1" id="mb_sms_<?php echo $i; ?>">
-                            <input type="hidden" name="mb_sms_default[<?php echo $i; ?>]" value="<?php echo isset($row['mb_sms']) ? $row['mb_sms'] : '0'; ?> " id="mb_sms_default_<?php echo $i; ?>">
-                        </td>
                         <td headers="mb_list_adultc">
                             <label for="mb_adult_<?php echo $i; ?>" class="sound_only">성인인증</label>
                             <input type="checkbox" name="mb_adult[<?php echo $i; ?>]" <?php echo $row['mb_adult'] ? 'checked' : ''; ?> value="1" id="mb_adult_<?php echo $i; ?>">
@@ -297,6 +301,11 @@ $colspan = 16;
                                 <label for="mb_intercept_date_<?php echo $i; ?>" class="sound_only">접근차단</label>
                             <?php } ?>
                         </td>
+                        <td headers="mb_list_sms">
+                            <label for="mb_sms_<?php echo $i; ?>" class="sound_only">광고성SMS/카카오톡수신</label>
+                            <input type="checkbox" name="mb_sms[<?php echo $i; ?>]" <?php echo $row['mb_sms'] ? 'checked' : ''; ?> value="1" id="mb_sms_<?php echo $i; ?>">
+                            <input type="hidden" name="mb_sms_default[<?php echo $i; ?>]" value="<?php echo isset($row['mb_sms']) ? $row['mb_sms'] : '0'; ?> " id="mb_sms_default_<?php echo $i; ?>">
+                        </td>
                         <td headers="mb_list_auth" class="td_mbstat">
                             <?php echo get_member_level_select("mb_level[$i]", 1, $member['mb_level'], $row['mb_level']) ?>
                         </td>

adm/member_list_exel.lib.php

@@ -21,8 +21,8 @@ define('MEMBER_LOG_DIR', G5_DATA_PATH . "/" . MEMBER_BASE_DIR . "/" . "log");
  */
 function get_export_config($type = null)
 {
-    $config = [
-        'sfl_list' => [
+    $config = array(
+        'sfl_list' => array(
             'mb_id'=>'아이디',
             'mb_name'=>'이름',
             'mb_nick'=>'닉네임',
@@ -30,26 +30,26 @@ function get_export_config($type = null)
             'mb_tel'=>'전화번호',
             'mb_hp'=>'휴대폰번호',
             'mb_addr1'=>'주소'
-        ],
-        'point_cond_map' => [
+        ),
+        'point_cond_map' => array(
             'gte'=>'≥',
             'lte'=>'≤',
             'eq'=>'='
-        ],
-        'intercept_list' => [
+        ),
+        'intercept_list' => array(
             'exclude'=>'차단회원 제외',
             'only'=>'차단회원만'
-        ],
-        'ad_range_list' => [
+        ),
+        'ad_range_list' => array(
             'all'           => '수신동의 회원 전체',
             'mailling_only' => '이메일 수신동의 회원만',
             'sms_only'      => 'SMS/카카오톡 수신동의 회원만',
             'month_confirm' => date('m월').' 수신동의 확인 대상만',
             'custom_period' => '수신동의 기간 직접 입력'
-        ],
-    ];
+        ),
+    );
 
-    return $type ? (isset($config[$type]) ? $config[$type] : []) : $config;
+    return $type ? (isset($config[$type]) ? $config[$type] : array()) : $config;
 }
 
 /**
@@ -59,14 +59,14 @@ function get_member_export_params()
 {
     // 친구톡 양식 - 엑셀 양식에 포함할 항목
     $fieldArray = array_map('trim', explode(',',  isset($_GET['fields']) ? $_GET['fields'] : ''));
-    $vars = [];
+    $vars = array();
     foreach ($fieldArray as $index => $field) {
         if(!empty($field)){
             $vars['var' . ($index + 1)] = $field;
         }
     }
 
-    $params = [    
+    $params = array(
         'page'              => 1,
         'formatType'        => (int)(isset($_GET['formatType']) ? $_GET['formatType'] : 1),
         'use_stx'           => isset($_GET['use_stx']) ? $_GET['use_stx'] : 0,
@@ -92,24 +92,30 @@ function get_member_export_params()
         'use_intercept'     => isset($_GET['use_intercept']) ? $_GET['use_intercept'] : 0,
         'intercept'         => clean_xss_tags(isset($_GET['intercept']) ? $_GET['intercept'] : 'exclude'),
         'vars'              => $vars,
-    ];
+    );
     
     // 레벨 범위 검증
     if ($params['level_start'] > $params['level_end']) {
-            [$params['level_start'] , $params['level_end']] = [$params['level_end'], $params['level_start']];
+        $tmp_level = $params['level_start'];
+        $params['level_start'] = $params['level_end'];
+        $params['level_end'] = $tmp_level;
     }
     
     // 가입기간 - 날짜 범위 검증
     if ($params['use_date'] && $params['date_start'] && $params['date_end']) {
         if ($params['date_start'] > $params['date_end']) {
-            [$params['date_start'] , $params['date_end']] = [$params['date_end'], $params['date_start']];
+            $tmp_date = $params['date_start'];
+            $params['date_start'] = $params['date_end'];
+            $params['date_end'] = $tmp_date;
         }
     }
     
     // 수신동의기간 - 날짜 범위 검증
     if ($params['ad_range_type'] == 'custom_period' && $params['agree_date_start'] && $params['agree_date_end']) {
         if ($params['agree_date_start'] > $params['agree_date_end']) {
-            [$params['agree_date_start'] , $params['agree_date_end']] = [$params['agree_date_end'], $params['agree_date_start']];
+            $tmp_agree_date = $params['agree_date_start'];
+            $params['agree_date_start'] = $params['agree_date_end'];
+            $params['agree_date_end'] = $tmp_agree_date;
         }
     }
     
@@ -141,7 +147,7 @@ function member_export_get_total_count($params)
 function member_export_build_where($params) 
 {
     global $config;
-    $conditions = [];
+    $conditions = array();
     
     // 기본 조건 - 탈퇴하지 않은 사용자
     $conditions[] = "mb_leave_date = ''";
@@ -241,8 +247,8 @@ function member_export_build_where($params)
         
             } else {
                 // 수신동의기간 직접 입력 - custom_period
-                $date_start = isset($params['agree_date_start']) ? $params['agree_date_start'] : '';
-                $date_end   = isset($params['agree_date_end']) ? $params['agree_date_end'] : '';
+                $date_start = isset($params['agree_date_start']) ? sql_escape_string(trim($params['agree_date_start'])) : '';
+                $date_end   = isset($params['agree_date_end']) ? sql_escape_string(trim($params['agree_date_end'])) : '';
 
                 if ($date_start && $date_end) {
                     $emailDateCond = "mb_mailling_date BETWEEN '{$date_start} 00:00:00' AND '{$date_end} 23:59:59'";
@@ -263,7 +269,7 @@ function member_export_build_where($params)
                 $conditions[] = "0=1"; // 둘 다 해제 ⇒ 결과 0건
             } else {
                 // 조건 조립
-                $parts = [];
+                $parts = array();
                 if ($useEmail) $parts[] = "(mb_mailling = 1 AND {$emailDateCond})";
                 if ($useSms)   $parts[] = "(mb_sms = 1 AND {$smsDateCond})";
             

adm/member_list_exel.php

@@ -191,12 +191,12 @@ $colspan = 14;
                                 <?php
                                     $thirdpartyLbl = (!empty($config['cf_sms_use'])) ? ' / <b>개인정보 제3자 제공</b>' : '';
 
-                                    $ad_range_text = [
+                                    $ad_range_text = array(
                                         'all'           => "* <b>광고성 정보 수신(이메일 또는 SMS/카카오톡)</b> / <b>마케팅 목적의 개인정보 수집 및 이용</b>{$thirdpartyLbl}에 모두 동의한 회원을 선택합니다.",
                                         'mailling_only' => "* <b>광고성 이메일 수신</b> / <b>마케팅 목적의 개인정보 수집 및 이용</b>{$thirdpartyLbl}에 모두 동의한 회원을 선택합니다.",
                                         'sms_only'      => "* <b>광고성 SMS/카카오톡 수신</b> / <b>마케팅 목적의 개인정보 수집 및 이용</b>{$thirdpartyLbl}에 모두 동의한 회원을 선택합니다.",
                                         'month_confirm' => "* 23개월 전(" . date('Y년 m월', strtotime('-23 month')) . ") <b>광고성 정보 수신 동의(이메일 또는 SMS/카카오톡)</b>한 회원을 선택합니다."
-                                    ];
+                                    );
 
                                     if (isset($_GET['ad_range_only'], $_GET['ad_range_type']) && isset($ad_range_text[$_GET['ad_range_type']])) {
                                         echo '<div class="ad_range_box"><p>' . $ad_range_text[$_GET['ad_range_type']] . '</p></div>';
@@ -210,7 +210,7 @@ $colspan = 14;
             </div>
 
             <!-- 채널 체크박스 -->
-            <div class="sch_row <?php echo isset($_GET['ad_range_only']) && in_array($_GET['ad_range_type'], ['month_confirm', 'custom_period']) ? '' : 'is-hidden'; ?>">
+            <div class="sch_row <?php echo isset($_GET['ad_range_only']) && in_array($_GET['ad_range_type'], array('month_confirm', 'custom_period')) ? '' : 'is-hidden'; ?>">
                 <div class="ad_range_wrap">
                     <div class="ad_range_box">
                         <div class="label">
@@ -480,4 +480,4 @@ function triggerAutoDownload(url, filename) {
 </script>
 
 <?php
-require_once './admin.tail.php';
+require_once './admin.tail.php';

adm/member_list_exel_export.php

@@ -14,7 +14,7 @@ session_write_close(); // 세션 종료 및 잠금 해제 (백그라운드 작
 $params = get_member_export_params();
 if (!$params || !is_array($params)) {
     member_export_send_progress("error", "데이터가 올바르게 전달되지 않아 작업에 실패하였습니다.");
-    member_export_write_log([], ['success' => false, 'error' => '데이터가 올바르게 전달되지 않아 작업에 실패하였습니다.']);
+    member_export_write_log(array(), array('success' => false, 'error' => '데이터가 올바르게 전달되지 않아 작업에 실패하였습니다.'));
     exit;
 }
 
@@ -28,7 +28,7 @@ member_export_set_sse_headers();
 $mode = isset($_GET['mode']) ? $_GET['mode'] : '';
 if ($mode !== 'start') {
     member_export_send_progress("error", "잘못된 요청 입니다.");
-    member_export_write_log($params, ['success' => false, 'error' => '잘못된 요청 입니다.']);
+    member_export_write_log($params, array('success' => false, 'error' => '잘못된 요청 입니다.'));
     exit;
 }
 
@@ -43,7 +43,7 @@ catch (Exception $e)
     // 에러 로그 저장 및 SSE 에러 전송
     error_log("[Member Export Error] " . $e->getMessage());
     member_export_send_progress("error", $e->getMessage());
-    member_export_write_log($params, ['success' => false, 'error' => $e->getMessage()]);
+    member_export_write_log($params, array('success' => false, 'error' => $e->getMessage()));
 }
 
 /**
@@ -62,7 +62,7 @@ function main_member_export($params)
     }
 
     $fileName = 'member_'.MEMBER_BASE_DATE;
-    $fileList = [];
+    $fileList = array();
     $zipFileName = '';
     
     if ($total > MEMBER_EXPORT_PAGE_SIZE) {
@@ -88,7 +88,7 @@ function main_member_export($params)
             $zipResult = member_export_create_zip($fileList, $fileName); // 압축 파일 생성
 
             if($zipResult['error']){
-                member_export_write_log($params, ['success' => false, 'error' => $zipResult['error']]);
+                member_export_write_log($params, array('success' => false, 'error' => $zipResult['error']));
                 member_export_send_progress("zippingError", $zipResult['error']);
             }
             
@@ -107,19 +107,19 @@ function main_member_export($params)
         member_export_send_progress("progress", "", 1, $total, $total);                
     }
     
-    member_export_write_log($params, ['success' => true, 'total' => $total, 'files' => $fileList, 'zip' => isset($zipFileName) ? $zipFileName : null]);
+    member_export_write_log($params, array('success' => true, 'total' => $total, 'files' => $fileList, 'zip' => isset($zipFileName) ? $zipFileName : null));
     member_export_send_progress("done", "", 2, $total, $total, $pages, $pages, $fileList, $zipFileName);                
 }
 
 /**
  * 진행률 전송
  */
-function member_export_send_progress($status, $message = "", $downloadType = 1, $total = 1, $current = 1, $totalChunks = 1, $currentChunk = 1, $files = [], $zipFile = '') 
+function member_export_send_progress($status, $message = "", $downloadType = 1, $total = 1, $current = 1, $totalChunks = 1, $currentChunk = 1, $files = array(), $zipFile = '')
 {
     // 연결 상태 확인
     if (connection_aborted()) return;
     
-    $data = [
+    $data = array(
         'status' => $status,
         'message' => $message,
         'downloadType' => $downloadType,
@@ -130,9 +130,10 @@ function member_export_send_progress($status, $message = "", $downloadType = 1,
         'files' => $files,
         'zipFile' => $zipFile,
         'filePath' =>  G5_DATA_URL . "/" . MEMBER_BASE_DIR . "/" . MEMBER_BASE_DATE,
-    ];
+    );
     
-    echo "data: " . json_encode($data, JSON_UNESCAPED_UNICODE) . "\n\n";
+    $json_options = defined('JSON_UNESCAPED_UNICODE') ? JSON_UNESCAPED_UNICODE : 0;
+    echo "data: " . json_encode($data, $json_options) . "\n\n";
     
     // 더 안정적인 플러시
     if (ob_get_level()) ob_end_flush();
@@ -145,18 +146,18 @@ function member_export_send_progress($status, $message = "", $downloadType = 1,
 function member_export_get_config() 
 {
     $type = 1;
-    $configs = [
-        1 => [
-            'title'   => ["회원관리파일(일반)"],
-            'headers' => ['아이디', '이름', '닉네임', '휴대폰번호', '전화번호', '이메일', '주소', '회원권한', '포인트', '가입일', '차단', 
+    $configs = array(
+        1 => array(
+            'title'   => array("회원관리파일(일반)"),
+            'headers' => array('아이디', '이름', '닉네임', '휴대폰번호', '전화번호', '이메일', '주소', '회원권한', '포인트', '가입일', '차단',
                             '광고성 이메일 수신동의', '광고성 이메일 동의일자', '광고성 SMS/카카오톡 수신동의', '광고성 SMS/카카오톡 동의일자', 
-                            '마케팅목적의개인정보수집및이용동의', '마케팅목적의개인정보수집및이용동의일자', '개인정보제3자제공동의', '개인정보제3자제공동의일자'],
-            'fields'  => ['mb_id', 'mb_name', 'mb_nick', 'mb_hp', 'mb_tel', 'mb_email', 'mb_addr1', 'mb_level', 'mb_point', 'mb_datetime', 'mb_intercept_date',
+                            '마케팅목적의개인정보수집및이용동의', '마케팅목적의개인정보수집및이용동의일자', '개인정보제3자제공동의', '개인정보제3자제공동의일자'),
+            'fields'  => array('mb_id', 'mb_name', 'mb_nick', 'mb_hp', 'mb_tel', 'mb_email', 'mb_addr1', 'mb_level', 'mb_point', 'mb_datetime', 'mb_intercept_date',
                             'mb_mailling','mb_mailling_date', 'mb_sms','mb_sms_date', 'mb_marketing_agree', 
-                            'mb_marketing_date', 'mb_thirdparty_agree', 'mb_thirdparty_date'],
-            'widths'  => [20, 20, 20, 20, 20, 30, 30, 10, 15, 25, 10, 20, 25, 20, 25, 20, 25, 20, 25],
-        ],
-    ];
+                            'mb_marketing_date', 'mb_thirdparty_agree', 'mb_thirdparty_date'),
+            'widths'  => array(20, 20, 20, 20, 20, 30, 30, 10, 15, 25, 10, 20, 25, 20, 25, 20, 25, 20, 25),
+        ),
+    );
     
     return isset($configs[$type]) ? $configs[$type] : $configs[1];
 }
@@ -195,7 +196,7 @@ function member_export_get_data($params)
     $fields = array_unique($fields);
 
     // SQL 변환 맵 (가공이 필요한 필드만 정의)
-    $sqlTransformMap = [
+    $sqlTransformMap = array(
         'mb_datetime' => "IF(mb_datetime = '0000-00-00 00:00:00', '', mb_datetime) AS mb_datetime",
         'mb_intercept_date' => "IF(mb_intercept_date != '', '차단됨', '정상') AS mb_intercept_date",
         'mb_sms' => "IF(mb_sms = '1', '동의', '미동의') AS mb_sms",
@@ -206,10 +207,10 @@ function member_export_get_data($params)
         'mb_marketing_date' => "IF(mb_marketing_agree != '1' OR mb_marketing_date = '0000-00-00 00:00:00', '', mb_marketing_date) AS mb_marketing_date",
         'mb_thirdparty_agree' => "IF(mb_thirdparty_agree = '1', '동의', '미동의') AS mb_thirdparty_agree",
         'mb_thirdparty_date' => "IF(mb_thirdparty_agree != '1' OR mb_thirdparty_date = '0000-00-00 00:00:00', '', mb_thirdparty_date) AS mb_thirdparty_date",
-    ];
+    );
 
     // SQL 필드 생성
-    $sqlFields = [];
+    $sqlFields = array();
     foreach ($fields as $field) {
         $sqlFields[] = isset($sqlTransformMap[$field]) ? $sqlTransformMap[$field] : $field;
     }
@@ -228,12 +229,16 @@ function member_export_get_data($params)
         throw new Exception("데이터 조회에 실패하였습니다");
     }
 
-    $excelData = [$config['title'], $config['headers']];
+    $excelData = array($config['title'], $config['headers']);
 
     while ($row = sql_fetch_array($result)) {
-        $rowData = [];
+        $rowData = array();
         foreach ($fields as $field) {
-            $rowData[] = isset($row[$field]) ? $row[$field] : '';
+            if (isset($row[$field])) {
+                $rowData[] = function_exists('csv_safe_cell') ? csv_safe_cell($row[$field]) : $row[$field];
+            } else {
+                $rowData[] = '';
+            }
         }
         $excelData[] = $rowData;
     }
@@ -257,10 +262,10 @@ function member_export_create_excel($data, $fileName, $index = 0)
     $currentCache = PHPExcel_Settings::getCacheStorageMethod();
     
     // 캐싱 모드 설정 (엑셀 생성 전용)
-    $cacheMethods = [
+    $cacheMethods = array(
         PHPExcel_CachedObjectStorageFactory::cache_to_discISAM,
         PHPExcel_CachedObjectStorageFactory::cache_in_memory_serialized
-    ];
+    );
 
     foreach ($cacheMethods as $method) {
         if (PHPExcel_Settings::setCacheStorageMethod($method)) {
@@ -274,12 +279,12 @@ function member_export_create_excel($data, $fileName, $index = 0)
         
         // 헤더 스타일 적용
         $last_char = member_export_column_char(count($config['headers']) - 1);
-        $sheet->getStyle("A2:{$last_char}2")->applyFromArray([
-            'fill' => [
+        $sheet->getStyle("A2:{$last_char}2")->applyFromArray(array(
+            'fill' => array(
                 'type' => PHPExcel_Style_Fill::FILL_SOLID,
-                'startcolor' => ['rgb' => 'D9E1F2'], // 연파랑 배경
-            ],
-        ]);
+                'startcolor' => array('rgb' => 'D9E1F2'), // 연파랑 배경
+            ),
+        ));
         
         // 셀 정렬 및 줄바꿈 설정
         $sheet->getStyle("A:{$last_char}")->getAlignment()->setVertical(PHPExcel_Style_Alignment::VERTICAL_CENTER)->setWrapText(true);
@@ -309,14 +314,15 @@ function member_export_create_excel($data, $fileName, $index = 0)
     } 
     catch (Exception $e) 
     {
-        throw new Exception("엑셀 파일 생성에 실패하였습니다: " . $e->getMessage());
-    } 
-    finally 
-    {
-        // 캐싱 모드 원래 상태로 복원
         if ($currentCache) {
             PHPExcel_Settings::setCacheStorageMethod($currentCache);
         }
+        throw new Exception("엑셀 파일 생성에 실패하였습니다: " . $e->getMessage());
+    }
+
+    // 캐싱 모드 원래 상태로 복원
+    if ($currentCache) {
+        PHPExcel_Settings::setCacheStorageMethod($currentCache);
     }
     
     return $filename;
@@ -329,7 +335,7 @@ function member_export_create_zip($files, $zipFileName)
 {    
     if (!class_exists('ZipArchive')) {
         error_log('[Member Export Error]  ZipArchive 클래스를 사용할 수 없습니다.');
-        return ['error' => '파일을 압축하는 중 문제가 발생했습니다. 개별 파일로 제공됩니다.<br>: ZipArchive 클래스를 사용할 수 없습니다.'];
+        return array('error' => '파일을 압축하는 중 문제가 발생했습니다. 개별 파일로 제공됩니다.<br>: ZipArchive 클래스를 사용할 수 없습니다.');
     }
     
     member_export_ensure_directory(MEMBER_EXPORT_DIR);
@@ -337,7 +343,7 @@ function member_export_create_zip($files, $zipFileName)
     
     $zip = new ZipArchive();
     if ($zip->open($destinationZipPath, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== TRUE) {
-        return ['error' => "파일을 압축하는 중 문제가 발생했습니다. 개별 파일로 제공됩니다."];
+        return array('error' => "파일을 압축하는 중 문제가 발생했습니다. 개별 파일로 제공됩니다.");
     }
     
     foreach ($files as $file) {
@@ -349,11 +355,11 @@ function member_export_create_zip($files, $zipFileName)
     
     $result = $zip->close();
     
-    return [
+    return array(
         'result' => $result,
         'zipFile' => $zipFileName . ".zip",
         'zipPath' => $destinationZipPath,
-    ];
+    );
 }
 
 /**
@@ -378,7 +384,7 @@ function member_export_ensure_directory($dir)
  * - 알집 생성 완료 시 엑셀 파일 제거
  * - 작업 전 오늘 날짜 폴더 및 log 폴더를 제외한 나머지 파일 모두 제거
  */
-function member_export_delete($fileList = []) 
+function member_export_delete($fileList = array())
 {    
     $cnt = 0;
 
@@ -397,7 +403,7 @@ function member_export_delete($fileList = [])
 
         function deleteFolder($dir) {
             foreach (glob($dir . '/{.,}*', GLOB_BRACE) as $item) {
-                if (in_array(basename($item), ['.', '..'])) continue;
+                if (in_array(basename($item), array('.', '..'))) continue;
                 is_dir($item) ? deleteFolder($item) : unlink($item);
             }
             rmdir($dir);
@@ -424,7 +430,7 @@ function member_export_delete($fileList = [])
 /**
  * 로그 작성
  */
-function member_export_write_log($params, $result = [])
+function member_export_write_log($params, $result = array())
 {
     global $member;
 
@@ -438,10 +444,13 @@ function member_export_write_log($params, $result = [])
         @chmod(MEMBER_LOG_DIR, G5_DIR_PERMISSION);
     }
 
-    $logFiles = glob(MEMBER_LOG_DIR . "/export_log_*.log") ?: [];
+    $logFiles = glob(MEMBER_LOG_DIR . "/export_log_*.log");
+    if (!$logFiles) {
+        $logFiles = array();
+    }
 
     // 최신 파일 기준 정렬 (최신 → 오래된)
-    usort($logFiles, fn($a, $b) => filemtime($b) - filemtime($a));
+    usort($logFiles, 'member_export_compare_log_mtime');
     
     $latestLogFile = isset($logFiles[0]) ? $logFiles[0] : null;
 
@@ -464,7 +473,7 @@ function member_export_write_log($params, $result = [])
     $status = $success ? '성공' : '실패';
 
     // 조건 정리
-    $condition = [];    
+    $condition = array();
     
     // 검색 조건
     if ($params['use_stx'] == 1 && !empty($params['stx'])) {
@@ -506,11 +515,11 @@ function member_export_write_log($params, $result = [])
             $condition[] = "수신동의일: {$params['agree_date_start']}~{$params['agree_date_end']}";
         }
 
-        if (in_array($params['ad_range_type'], ["month_confirm", "custom_period"])){
-            $channels = array_filter([
+        if (in_array($params['ad_range_type'], array("month_confirm", "custom_period"))){
+            $channels = array_filter(array(
                 !empty($params['ad_mailling']) && (int)$params['ad_mailling'] === 1 ? '이메일' : null,
                 !empty($params['ad_sms']) && (int)$params['ad_sms'] === 1 ? 'SMS/카카오톡' : null,
-            ]);
+            ));
         
             if ($channels) {
                 $condition[] = '수신채널: ' . implode(', ', $channels);
@@ -531,7 +540,7 @@ function member_export_write_log($params, $result = [])
     // 성공일 경우 추가 정보
     if ($success) {
         $total = isset($result['total']) ? $result['total'] : 0;
-        $fileCount = isset($result['zip']) ? 1 : count(isset($result['files']) ? $result['files'] : []);
+        $fileCount = isset($result['zip']) ? 1 : count(isset($result['files']) ? $result['files'] : array());
         $line1 .= " | 총 {$total}건 | 파일: {$fileCount}개";
     }
 
@@ -548,4 +557,9 @@ function member_export_write_log($params, $result = [])
     if (@file_put_contents($latestLogFile, $logEntry, FILE_APPEND | LOCK_EX) === false) {
         error_log("[Member Export Error] 로그 파일 기록 실패: {$latestLogFile}");
     }
-}
+}
+
+function member_export_compare_log_mtime($a, $b)
+{
+    return filemtime($b) - filemtime($a);
+}

adm/member_list_update.php

@@ -27,7 +27,7 @@ if ($_POST['act_button'] == "선택수정") {
         $post_mb_sms = isset($_POST['mb_sms'][$k]) ? (int) $_POST['mb_sms'][$k] : 0;
         $post_mb_open = isset($_POST['mb_open'][$k]) ? (int) $_POST['mb_open'][$k] : 0;
 
-        $agree_items = [];
+        $agree_items = array();
         // 광고성 이메일 수신동의 일자 추가
         $post_mb_mailling_default = isset($_POST['mb_mailling_default'][$k]) ? (int) $_POST['mb_mailling_default'][$k] : 0;
         $sql_mailling_date = "";
@@ -57,6 +57,8 @@ if ($_POST['act_button'] == "선택수정") {
             $msg .= $mb['mb_id'] . ' : 회원자료가 존재하지 않습니다.\\n';
         } elseif ($is_admin != 'super' && $mb['mb_level'] >= $member['mb_level']) {
             $msg .= $mb['mb_id'] . ' : 자신보다 권한이 높거나 같은 회원은 수정할 수 없습니다.\\n';
+        } elseif ($is_admin != 'super' && $post_mb_level >= (int) $member['mb_level']) {
+            $msg .= $mb['mb_id'] . ' : 자신보다 권한이 높거나 같은 등급은 부여할 수 없습니다.\\n';
         } elseif ($member['mb_id'] == $mb['mb_id']) {
             $msg .= $mb['mb_id'] . ' : 로그인 중인 관리자는 수정 할 수 없습니다.\\n';
         } else {

adm/menu_list_update.php

@@ -30,7 +30,7 @@ for ($i = 0; $i < $count; $i++) {
 
     $code    = is_array($_POST['code']) ? strip_tags($_POST['code'][$i]) : '';
     $me_name = is_array($_POST['me_name']) ? strip_tags($_POST['me_name'][$i]) : '';
-    $me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : strip_tags(clean_xss_attributes($_POST['me_link'][$i]));
+    $me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['me_link'][$i]))));
 
     if (!$code || !$me_name || !$me_link) {
         continue;

adm/newwinformupdate.php

@@ -16,7 +16,7 @@ if ($w == 'd') {
 
 check_admin_token();
 
-$nw_subject = isset($_POST['nw_subject']) ? strip_tags(clean_xss_attributes($_POST['nw_subject'])) : '';
+$nw_subject = isset($_POST['nw_subject']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['nw_subject'])))) : '';
 $posts = array();
 
 $check_keys = array(
@@ -37,7 +37,7 @@ foreach ($check_keys as $key => $val) {
     if ($val === 'int') {
         $posts[$key] = isset($_POST[$key]) ? (int) $_POST[$key] : 0;
     } elseif ($val === 'str') {
-        $posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : 0;
+        $posts[$key] = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : 0;
     } else {
         $posts[$key] = isset($_POST[$key]) ? trim($_POST[$key]) : 0;
     }

adm/point_list.php

@@ -25,6 +25,9 @@ if (!$sst) {
     $sst  = "po_id";
     $sod = "desc";
 }
+$allowed_sst = array('po_id', 'mb_id', 'po_content', 'po_point', 'po_datetime');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'po_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt
@@ -66,7 +69,7 @@ if ($config['cf_point_term'] > 0) {
     $po_expire_term = $config['cf_point_term'];
 }
 
-if (strstr($sfl, "mb_id")) {
+if (strpos($sfl, "mb_id") !== false) {
     $mb_id = $stx;
 } else {
     $mb_id = "";

adm/poll_form_update.php

@@ -43,11 +43,16 @@ foreach ($_POST as $key => $value) {
     }
 
     if (in_array($key, $check_keys)) {
-        $_POST[$key] = strip_tags(clean_xss_attributes($value));
+        if (preg_match('/^po_cnt[1-9]$/', $key) || in_array($key, array('po_level', 'po_point', 'po_id'), true)) {
+            $_POST[$key] = (int) $value;
+        } else {
+            $_POST[$key] = addslashes(strip_tags(clean_xss_attributes(stripslashes($value))));
+        }
     }
 }
 
-$po_id = isset($_POST['po_id']) ? $_POST['po_id'] : '';
+$po_id = isset($_POST['po_id']) ? (int) $_POST['po_id'] : 0;
+$_POST['po_use'] = isset($_POST['po_use']) ? (int) $_POST['po_use'] : 0;
 
 if ($w == '') {
     $sql = " insert {$g5['poll_table']}

adm/poll_list.php

@@ -21,6 +21,9 @@ if (!$sst) {
     $sst = "po_id";
     $sod = "desc";
 }
+$allowed_sst = array('po_id', 'po_subject', 'po_level', 'po_use', 'po_etc');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'po_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/popular_list.php

@@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, 'r');
 
 // 체크된 자료 삭제
 if (isset($_POST['chk']) && is_array($_POST['chk'])) {
+    check_admin_token();
+
     for ($i = 0; $i < count($_POST['chk']); $i++) {
         $pp_id = (int) $_POST['chk'][$i];
 
@@ -36,6 +38,9 @@ if (!$sst) {
     $sst  = "pp_id";
     $sod = "desc";
 }
+$allowed_sst = array('pp_id', 'pp_word', 'pp_date', 'pp_ip');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'pp_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/qa_config_update.php

@@ -15,12 +15,18 @@ $qaconfig = get_qa_config();
 $check_keys = array('qa_title', 'qa_category', 'qa_skin', 'qa_mobile_skin', 'qa_use_email', 'qa_req_email', 'qa_use_hp', 'qa_req_hp', 'qa_use_sms', 'qa_send_number', 'qa_admin_hp', 'qa_admin_email', 'qa_subject_len', 'qa_mobile_subject_len', 'qa_page_rows', 'qa_mobile_page_rows', 'qa_image_width', 'qa_upload_size');
 
 foreach ($check_keys as $key) {
-    $$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
+    $$key = $_POST[$key] = isset($_POST[$key]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$key])))) : '';
 }
 
 $qa_include_head = isset($qa_include_head) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_head, 0, 255)) : '';
 $qa_include_tail = isset($qa_include_tail) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_tail, 0, 255)) : '';
 
+// 최고 관리자가 아니면 include 경로 변경 불가 (board_form_update.php 와 동일 정책)
+if ($is_admin !== 'super') {
+    $qa_include_head = isset($qaconfig['qa_include_head']) ? $qaconfig['qa_include_head'] : '';
+    $qa_include_tail = isset($qaconfig['qa_include_tail']) ? $qaconfig['qa_include_tail'] : '';
+}
+
 // 관리자가 자동등록방지를 사용해야 할 경우
 if ($board && ($qaconfig['qa_include_head'] !== $qa_include_head || $qaconfig['qa_include_tail'] !== $qa_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()) {
     include_once G5_CAPTCHA_PATH . '/captcha.lib.php';

adm/sendmail_test.php

@@ -9,40 +9,76 @@ if (!$config['cf_email_use'])
 
 include_once(G5_LIB_PATH.'/mailer.lib.php');
 
+$token = get_token();
+
 $g5['title'] = '메일 테스트';
 include_once('./admin.head.php');
 
 if (isset($_POST['email'])) {
+    check_admin_token();
+
     $_POST['email'] = strip_tags($_POST['email']);
     $email = explode(',', $_POST['email']);
 
-    $real_email = array();
+    $sent_email   = array(); // 발송 요청 성공
+    $failed_email = array(); // 발송 실패 (메일 서버에서 거부/오류)
 
     for ($i=0; $i<count($email); $i++){
 
         if (!preg_match("/([0-9a-zA-Z_-]+)@([0-9a-zA-Z_-]+)\.([0-9a-zA-Z_-]+)/", $email[$i])) continue;
-        
-        $real_email[] = $email[$i];
-        mailer($config['cf_admin_email_name'], $config['cf_admin_email'], trim($email[$i]), '[메일검사] 제목', '<span style="font-size:9pt;">[메일검사] 내용<p>이 내용이 제대로 보인다면 보내는 메일 서버에는 이상이 없는것입니다.<p>'.G5_TIME_YMDHIS.'<p>이 메일 주소로는 회신되지 않습니다.</span>', 1);
+
+        $to = trim($email[$i]);
+        $send_result = mailer($config['cf_admin_email_name'], $config['cf_admin_email'], $to, '[메일검사] 제목', '<span style="font-size:9pt;">[메일검사] 내용<p>이 내용이 제대로 보인다면 보내는 메일 서버에는 이상이 없는것입니다.<p>'.G5_TIME_YMDHIS.'<p>이 메일 주소로는 회신되지 않습니다.</span>', 1);
+
+        if ($send_result) {
+            $sent_email[] = $to;
+        } else {
+            $failed_email[] = $to;
+        }
     }
 
-    if( $real_email ){
+    if( $sent_email || $failed_email ){
         echo '<section>';
-        echo '<h2>결과메세지</h2>';
-        echo '<div class="local_desc01 local_desc"><p>';
-        echo '다음 '.count($real_email).'개의 메일 주소로 테스트 메일 발송이 완료되었습니다.';
-        echo '</p></div>';
-        echo '<ul>';
-        for ($i=0;$i<count($real_email);$i++) {
-            echo '<li>'.$real_email[$i].'</li>';
+        echo '<h2>결과 메시지</h2>';
+
+        if( $sent_email ){
+            echo '<div class="local_desc01 local_desc"><p>';
+            echo '다음 '.count($sent_email).'개의 메일 주소로 테스트 메일 <strong>발송 요청이 성공</strong>했습니다. <strong>수신함 도착 여부는 별도 확인이 필요합니다.</strong>';
+            echo '</p></div>';
+            echo '<ul>';
+            for ($i=0;$i<count($sent_email);$i++) {
+                echo '<li>'.get_text($sent_email[$i]).'</li>';
+            }
+            echo '</ul>';
+            echo '<div class="local_desc02 local_desc"><p>';
+            echo '<strong>발송 요청 성공은 사이트가 메일 서버에 메일을 넘겼다는 의미이며, 받은편지함 도착을 보장하지는 않습니다.</strong><br>';
+            echo '메일이 보이지 않는다면 아래 항목을 순서대로 확인해 주십시오.';
+            echo '</p></div>';
+            echo '<ol>';
+            echo '<li>받은편지함뿐 아니라 <strong>스팸함, 정크메일함, 프로모션함</strong>을 확인합니다.</li>';
+            echo '<li>네이버, 지메일, 회사메일 등 <strong>서로 다른 메일 주소</strong>로 다시 테스트합니다.</li>';
+            echo '<li>관리자 메일 주소가 사이트 도메인과 같은지 확인합니다. 도메인이 다르면 스팸으로 분류될 가능성이 높습니다.</li>';
+            echo '<li>도메인 메일을 사용한다면 <strong>SPF, DKIM, DMARC</strong> 설정을 확인합니다.</li>';
+            echo '<li>계속 도착하지 않으면 서버 개발자에게 메일 발송 로그를 확인해주세요.</li>';
+            echo '</ol>';
         }
-        echo '</ul>';
-        echo '<div class="local_desc02 local_desc"><p>';
-        echo '해당 주소로 테스트 메일이 도착했는지 확인해 주십시오.<br>';
-        echo '만약, 테스트 메일이 오지 않는다면 더 다양한 계정의 메일 주소로 메일을 보내 보십시오.<br>';
-        echo '그래도 메일이 하나도 도착하지 않는다면 메일 서버(sendmail server)의 오류일 가능성이 높으니, 웹 서버관리자에게 문의하여 주십시오.<br>';
-        echo '도메인을 소유하고 있을시 SPF, DKIM 설정이 필요할수 있습니다.<br>';
-        echo '</p></div>';
+
+        if( $failed_email ){
+            echo '<div class="local_desc01 local_desc" style="color:#d9534f"><p>';
+            echo '다음 '.count($failed_email).'개의 메일 주소는 <strong>발송에 실패</strong>했습니다.';
+            echo '</p></div>';
+            echo '<ul>';
+            for ($i=0;$i<count($failed_email);$i++) {
+                echo '<li>'.get_text($failed_email[$i]).'</li>';
+            }
+            echo '</ul>';
+            echo '<div class="local_desc02 local_desc"><p>';
+            echo '발송 실패는 받는 사람의 문제가 아니라 <strong>보내는 서버(메일 발송) 설정 문제</strong>일 가능성이 높습니다.<br>';
+            echo 'SMTP 정보(주소/포트/인증)가 올바른지, 서버에서 메일 발송(sendmail/mail 함수)이 허용되어 있는지 확인하시고, 웹 서버 관리자(호스팅 업체)에게 문의해 주십시오.<br>';
+            echo '자세한 오류 내용은 서버의 PHP error_log 에 기록됩니다.<br>';
+            echo '</p></div>';
+        }
+
         echo '</section>';
     }
 }
@@ -52,15 +88,16 @@ if (isset($_POST['email'])) {
     <h2>테스트 메일 발송</h2>
     <div class="local_desc02 local_desc">
         <p>
-            메일서버가 정상적으로 동작 중인지 확인할 수 있습니다.<br>
+            사이트에서 메일 서버로 메일을 전달할 수 있는지 확인합니다. 이 테스트는 받은편지함 도착을 보장하지 않습니다.<br>
             아래 입력칸에 테스트 메일을 발송하실 메일 주소를 입력하시면, [메일검사] 라는 제목으로 테스트 메일을 발송합니다.<br>
             보내는 메일주소 : <?php echo get_sanitize_input($config['cf_admin_email']); ?><br>
             <?php if (function_exists('domain_mail_host') && $config['cf_admin_email'] && stripos($config['cf_admin_email'], domain_mail_host()) === false) { ?>
-            <?php echo '외부메일설정이나 기타 설정을 하지 않았다면, 도메인과 다른 헤더로 여겨 스팸이나 차단될 가능성이 있습니다.<br>기본환경설정에서 관리자 메일 주소를 name'.domain_mail_host().' 과 같은 도메인 형식으로 설정할것을 권장합니다.'; ?>
+            <?php echo '외부메일설정이나 기타 설정을 하지 않았다면, 도메인과 다른 헤더로 여겨 스팸이나 차단될 가능성이 있습니다.<br>외부메일설정이나 기타 설정을 하지 않았다면, 기본환경설정에서 관리자 메일 주소를 name'.domain_mail_host().' 과 같은 도메인 형식으로 설정할것을 권장합니다.'; ?>
             <?php } ?>
         </p>
     </div>
     <form name="fsendmailtest" method="post">
+    <input type="hidden" name="token" value="<?php echo $token; ?>">
     <fieldset id="fsendmailtest">
         <legend>테스트메일 발송</legend>
         <label for="email">받는 메일주소<strong class="sound_only"> 필수</strong></label>
@@ -70,11 +107,11 @@ if (isset($_POST['email'])) {
     </form>
     <div class="local_desc02 local_desc">
         <p>
-            만약 [메일검사] 라는 내용으로 테스트 메일이 도착하지 않는다면 보내는 메일서버 혹은 받는 메일서버 중 문제가 발생했을 가능성이 있습니다.<br>
-            따라서 보다 정확한 테스트를 원하신다면 여러 곳으로 테스트 메일을 발송하시기 바랍니다.<br>
+            테스트 결과가 발송 요청 성공으로 표시되어도 수신 메일 서버의 스팸 정책에 따라 도착하지 않을 수 있습니다.<br>
+            정확한 확인을 위해 여러 메일 서비스로 테스트하고, 도착하지 않으면 스팸함과 도메인 인증(SPF, DKIM, DMARC)을 확인해 주십시오.<br>
         </p>
     </div>
 </section>
 
 <?php
-include_once('./admin.tail.php');
+include_once('./admin.tail.php');

adm/session_file_delete.php

@@ -31,7 +31,7 @@ include_once("./admin.head.php");
     echo $list_tag_st;
     while($file=readdir($dir)) {
 
-        if (!strstr($file,'sess_')) continue;
+        if (strpos($file,'sess_') === false) continue;
         if (strpos($file,'sess_')!=0) continue;
 
         $session_file = G5_DATA_PATH.'/session/'.$file;

adm/shop_admin/admin.shop.lib.php

@@ -1,6 +1,45 @@
 <?php
 if (!defined('_GNUBOARD_')) exit;
 
+function get_shop_skin_dirs($is_mobile=false)
+{
+    global $config;
+
+    $skin_path = $is_mobile ? G5_MOBILE_PATH.'/'.G5_SKIN_DIR : G5_SKIN_PATH;
+    $skins = get_skin_dir('shop', $skin_path);
+
+    if(defined('G5_THEME_PATH') && $config['cf_theme']) {
+        $theme_skin_path = $is_mobile ? G5_THEME_MOBILE_PATH.'/'.G5_SKIN_DIR : G5_THEME_PATH.'/'.G5_SKIN_DIR;
+        $dirs = get_skin_dir('shop', $theme_skin_path);
+        if(!empty($dirs)) {
+            foreach($dirs as $dir) {
+                $skins[] = 'theme/'.$dir;
+            }
+        }
+    }
+
+    return $skins;
+}
+
+function check_shop_skin_dir($skin_dir, $label, $is_mobile=false)
+{
+    if( $skin_dir === '' ) {
+        return;
+    }
+
+    if( preg_match('#\.+(\/|\\\)#', $skin_dir) ){
+        alert($label.' 폴더명에 포함될수 없는 문자가 들어있습니다.');
+    }
+
+    if( ! is_include_path_check($skin_dir, 1) ){
+        alert('오류 : 데이터폴더가 포함된 path 또는 잘못된 path 를 포함할수 없습니다.');
+    }
+
+    if( ! in_array($skin_dir, get_shop_skin_dirs($is_mobile), true) ){
+        alert($label.'을 올바르게 선택해 주십시오.');
+    }
+}
+
 // 상품옵션별재고 또는 상품재고에 더하기
 function add_io_stock($it_id, $ct_qty, $io_id="", $io_type=0)
 {
@@ -241,4 +280,4 @@ function check_order_inicis_tmps(){
 
         set_cookie('admin_visit_time', G5_SERVER_TIME, 3600);   //1시간 간격으로 체크
     }
-}   //end function check_order_inicis_tmps;
+}   //end function check_order_inicis_tmps;

adm/shop_admin/bannerformupdate.php

@@ -20,14 +20,14 @@ $bn_bimg      = isset($_FILES['bn_bimg']['tmp_name']) ? $_FILES['bn_bimg']['tmp_
 $bn_bimg_name = isset($_FILES['bn_bimg']['name']) ? $_FILES['bn_bimg']['name'] : '';
 $bn_id = isset($_REQUEST['bn_id']) ? preg_replace('/[^0-9]/', '', $_REQUEST['bn_id']) : 0;
 $bn_bimg_del = (isset($_POST['bn_bimg_del']) && $_POST['bn_bimg_del']) ? preg_replace('/[^0-9]/', '', $_POST['bn_id']) : 0;
-$bn_url = isset($_POST['bn_url']) ? strip_tags(clean_xss_attributes($bn_url)) : '';
-$bn_alt = isset($_POST['bn_alt']) ? strip_tags(clean_xss_attributes($bn_alt)) : '';
-$bn_device = isset($_POST['bn_device']) ? clean_xss_tags($_POST['bn_device'], 1, 1) : '';
-$bn_position = isset($_POST['bn_position']) ? clean_xss_tags($_POST['bn_position'], 1, 1) : '';
+$bn_url = isset($_POST['bn_url']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['bn_url'])))) : '';
+$bn_alt = isset($_POST['bn_alt']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['bn_alt'])))) : '';
+$bn_device = isset($_POST['bn_device']) ? safe_replace_regex($_POST['bn_device']) : '';
+$bn_position = isset($_POST['bn_position']) ? addslashes(clean_xss_tags(stripslashes($_POST['bn_position']), 1, 1)) : '';
 $bn_border = isset($_POST['bn_border']) ? (int) $_POST['bn_border'] : 0;
 $bn_new_win = isset($_POST['bn_new_win']) ? (int) $_POST['bn_new_win'] : 0;
-$bn_begin_time = isset($_POST['bn_begin_time']) ? clean_xss_tags($_POST['bn_begin_time'], 1, 1) : '';
-$bn_end_time = isset($_POST['bn_end_time']) ? clean_xss_tags($_POST['bn_end_time'], 1, 1) : '';
+$bn_begin_time = isset($_POST['bn_begin_time']) ? safe_replace_regex($_POST['bn_begin_time'], 'time') : '';
+$bn_end_time = isset($_POST['bn_end_time']) ? safe_replace_regex($_POST['bn_end_time'], 'time') : '';
 $bn_order = isset($_POST['bn_order']) ? (int) $_POST['bn_order'] : 0;
 
 if ($bn_bimg_del)  @unlink(G5_DATA_PATH."/banner/$bn_id");
@@ -99,4 +99,4 @@ if ($w == "" || $w == "u")
     goto_url("./bannerform.php?w=u&bn_id=$bn_id");
 } else {
     goto_url("./bannerlist.php");
-}
+}

adm/shop_admin/categoryformupdate.php

@@ -75,7 +75,7 @@ foreach( $check_str_keys as $key=>$val ){
     if( $val === 'int' ){
         $value = isset($_POST[$key]) ? (int) $_POST[$key] : 0;
     } else {
-        $value = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
+        $value = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : '';
     }
     $$key = $_POST[$key] = $value;
 }
@@ -123,7 +123,7 @@ if ($w == "" || $w == "u")
         $sql = " select mb_id from {$g5['member_table']} where mb_id = '$ca_mb_id' ";
         $row = sql_fetch($sql);
         if (!$row['mb_id'])
-            alert("\'$ca_mb_id\' 은(는) 존재하는 회원아이디가 아닙니다.");
+            alert("'$ca_mb_id' 은(는) 존재하는 회원아이디가 아닙니다.");
     }
 }
 
@@ -256,4 +256,4 @@ if ($w == "" || $w == "u")
     goto_url("./categoryform.php?w=u&ca_id=$ca_id&$qstr");
 } else {
     goto_url("./categorylist.php?$qstr");
-}
+}

adm/shop_admin/categorylist.php

@@ -42,6 +42,9 @@ if (!$sst)
     $sst  = "ca_id";
     $sod = "asc";
 }
+$allowed_sst = array('ca_id', 'ca_name', 'ca_mb_id', 'ca_use');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'ca_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = "order by $sst $sod";
 
 // 출력할 레코드를 얻음

adm/shop_admin/categorylistupdate.php

@@ -19,7 +19,7 @@ for ($i=0; $i<$post_ca_id_count; $i++)
         $sql = " select mb_id from {$g5['member_table']} where mb_id = '".sql_real_escape_string($str_ca_mb_id)."' ";
         $row = sql_fetch($sql);
         if (!$row['mb_id'])
-            alert("\'{$str_ca_mb_id}\' 은(는) 존재하는 회원아이디가 아닙니다.", "./categorylist.php?$qstr");
+            alert("'{$str_ca_mb_id}' 은(는) 존재하는 회원아이디가 아닙니다.", "./categorylist.php?$qstr");
     }
     
     $check_files =  array();
@@ -51,7 +51,7 @@ for ($i=0; $i<$post_ca_id_count; $i++)
             alert('스킨파일명에 포함될수 없는 문자가 들어있습니다.');
         }
 
-        if( ! is_include_path_check($file) ){
+        if( ! is_include_path_check($file, 1) ){
             alert('오류 : 데이터폴더가 포함된 path 또는 잘못된 path 를 포함할수 없습니다.');
         }
 
@@ -62,7 +62,7 @@ for ($i=0; $i<$post_ca_id_count; $i++)
         }
     }
     
-    $p_ca_name = is_array($_POST['ca_name']) ? strip_tags(clean_xss_attributes($_POST['ca_name'][$i])) : '';
+    $p_ca_name = is_array($_POST['ca_name']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['ca_name'][$i])))) : '';
     
     $posts = array();
 
@@ -94,4 +94,4 @@ for ($i=0; $i<$post_ca_id_count; $i++)
 
 }
 
-goto_url("./categorylist.php?$qstr");
+goto_url("./categorylist.php?$qstr");

adm/shop_admin/configform.php

@@ -640,7 +640,7 @@ if(!$default['de_kakaopay_cancelpwd']){
         <tr id="kcp_vbank_url" class="pg_vbank_url">
             <th scope="row">NHN KCP 가상계좌<br>입금통보 URL</th>
             <td>
-                <?php echo help("NHN KCP 가상계좌 사용시 다음 주소를 <strong><a href=\"http://admin.kcp.co.kr\" target=\"_blank\">NHN KCP 관리자</a> &gt; 상점정보관리 &gt; 정보변경 &gt; 공통URL 정보 &gt; 공통URL 변경후</strong>에 넣으셔야 상점에 자동으로 입금 통보됩니다."); ?>
+                <?php echo help("NHN KCP 가상계좌 사용시 다음 주소를 <strong><a href=\"https://partner.kcp.co.kr\" target=\"_blank\">NHN KCP 관리자</a> &gt; 상점정보관리 &gt; 정보변경 &gt; 공통URL 정보 &gt; 공통URL 변경후</strong>에 넣으셔야 상점에 자동으로 입금 통보됩니다."); ?>
                 <?php echo G5_SHOP_URL; ?>/settle_kcp_common.php</td>
         </tr>
         <tr id="inicis_vbank_url" class="pg_vbank_url">
@@ -694,7 +694,7 @@ if(!$default['de_kakaopay_cancelpwd']){
         <tr>
             <th scope="row"><label for="de_easy_pay_use">PG사 간편결제 버튼 사용</label></th>
             <td>
-                <?php echo help("주문서 작성 페이지에 PG사 간편결제(PAYCO, PAYNOW, KPAY) 버튼의 별도 사용 여부를 설정합니다.", 50); ?>
+                <?php echo help("주문서 작성 페이지에 PG사 간편결제(PAYCO, 토스, KPAY...) 버튼의 별도 사용 여부를 설정합니다.", 50); ?>
                 <select id="de_easy_pay_use" name="de_easy_pay_use">
                     <option value="0" <?php echo get_selected($default['de_easy_pay_use'], 0); ?>>노출안함</option>
                     <option value="1" <?php echo get_selected($default['de_easy_pay_use'], 1); ?>>노출함</option>
@@ -715,13 +715,13 @@ if(!$default['de_kakaopay_cancelpwd']){
         <?php
         $account_checked = $vbank_checked = $transfer_checked = '';
 
-        if (strstr($default['de_taxsave_types'], 'account')) {
+        if (strpos($default['de_taxsave_types'], 'account') !== false) {
             $account_checked = 'checked="checked"';
         }
-        if (strstr($default['de_taxsave_types'], 'vbank')) {
+        if (strpos($default['de_taxsave_types'], 'vbank') !== false) {
             $vbank_checked = 'checked="checked"';
         }
-        if (strstr($default['de_taxsave_types'], 'transfer')) {
+        if (strpos($default['de_taxsave_types'], 'transfer') !== false) {
             $transfer_checked = 'checked="checked"';
         }
         ?>
@@ -1097,8 +1097,7 @@ if(!$default['de_kakaopay_cancelpwd']){
                     <a href="http://testadmin8.kcp.co.kr/" target="_blank" class="btn_frmline">테스트 관리자</a>
                 </div>
                 <div class="scf_cardtest lg_cardtest">
-                    <a href="https://app.tosspayments.com/" target="_blank" class="btn_frmline">실결제 관리자</a>
-                    <a href="https://pgweb.tosspayments.com/tmert" target="_blank" class="btn_frmline">테스트 관리자</a>
+                    <a href="https://app.tosspayments.com/" target="_blank" class="btn_frmline">상점 관리자</a>
                 </div>
                 <div class="scf_cardtest toss_cardtest">
                     <a href="https://app.tosspayments.com/" target="_blank" class="btn_frmline">상점 관리자</a>
@@ -1122,14 +1121,14 @@ if(!$default['de_kakaopay_cancelpwd']){
                         <dt>휴대폰</dt><dd>테스트 지원되지 않음.</dd>
                     </dl>
                     <ul id="kcp_cardtest_tip" class="scf_cardtest_tip_adm scf_cardtest_tip_adm_hide">
-                        <li>테스트결제의 <a href="http://testadmin8.kcp.co.kr/assist/login.LoginAction.do" target="_blank">상점관리자</a> 로그인 정보는 NHN KCP로 문의하시기 바랍니다. (기술지원 1544-8661)</li>
+                        <li>테스트결제의 <a href="https://testpartner.kcp.co.kr/" target="_blank">상점관리자</a> 로그인 정보는 NHN KCP로 문의하시기 바랍니다. (기술지원 1544-8661)</li>
                         <li><b>일반결제</b>의 테스트 사이트코드는 <b>T0000</b> 이며, <b>에스크로 결제</b>의 테스트 사이트코드는 <b>T0007</b> 입니다.</li>
                     </ul>
                     <ul id="lg_cardtest_tip" class="scf_cardtest_tip_adm scf_cardtest_tip_adm_hide">
-                        <li>테스트결제의 <a href="https://pgweb.tosspayments.com/tmert" target="_blank">상점관리자</a> 로그인 정보는 토스페이먼츠 상점아이디 첫 글자에 t를 추가해서 로그인하시기 바랍니다. 예) tsi_lguplus</li>
+                        <li>테스트 결제건에 대한 <a href="https://app.tosspayments.com/" target="_blank">상점관리자</a> 접근은, 상점관리자 상단 '테스트 모드'를 활성화 하여서 접근할 수 있습니다.</li>
                     </ul>
                     <ul id="toss_cardtest_tip" class="scf_cardtest_tip_adm scf_cardtest_tip_adm_hide">
-                        <li>테스트 결제 시 <a href="https://app.tosspayments.com/" target="_blank">상점관리자</a> 로그인 정보는 실결제용 키와는 다르니 반드시 <b>[테스트] API 연동 키</b>로 로그인해야 합니다. 예) test_ck_toss</li>
+                        <li>테스트 결제건에 대한 <a href="https://app.tosspayments.com/" target="_blank">상점관리자</a> 접근은, 상점관리자 상단 '테스트 모드'를 활성화 하여서 접근할 수 있습니다.</li>
                     </ul>
                     <ul id="inicis_cardtest_tip" class="scf_cardtest_tip_adm scf_cardtest_tip_adm_hide">
                         <li><b>일반결제</b>의 테스트 사이트 mid는 <b>INIpayTest</b> 이며, <b>에스크로 결제</b>의 테스트 사이트 mid는 <b>iniescrow0</b> 입니다.</li>
@@ -2142,4 +2141,5 @@ if($default['de_iche_use'] || $default['de_vbank_use'] || $default['de_hp_use']
     }
 }
 
-include_once (G5_ADMIN_PATH.'/admin.tail.php');
+
+include_once (G5_ADMIN_PATH.'/admin.tail.php');

adm/shop_admin/configformupdate.php

@@ -64,6 +64,8 @@ foreach($check_skin_keys as $key){
     if( isset($_POST[$key]) && preg_match('#\.+(\/|\\\)#', $_POST[$key]) ){
         alert('스킨설정에 유효하지 문자가 포함되어 있습니다.');
     }
+    
+    $$key = $_POST[$key] = sql_real_escape_string($_POST[$key]);
 }
 
 // 현금영수증 발급수단
@@ -245,9 +247,9 @@ $check_sanitize_keys = array(
 
 foreach( $check_sanitize_keys as $key ){
     if( in_array($key, array('de_bank_account')) ){
-        $$key = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1, 0, 0) : '';
+        $$key = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1, 0, 0)) : '';
     } else {
-        $$key = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
+        $$key = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : '';
     }
 }
 
@@ -478,4 +480,4 @@ if( $warning_msg ){
     alert($warning_msg, "./configform.php");
 } else {
     goto_url("./configform.php");
-}
+}

adm/shop_admin/couponform.php

@@ -4,7 +4,7 @@ include_once('./_common.php');
 
 auth_check_menu($auth, $sub_menu, "w");
 
-$cp_id = isset($_REQUEST['cp_id']) ? clean_xss_tags($_REQUEST['cp_id'], 1, 1) : '';
+$cp_id = isset($_REQUEST['cp_id']) ? safe_replace_regex($_REQUEST['cp_id'], 'cp_id') : '';
 $cp = array(
 'cp_method'=>'',
 'cp_subject'=>'',
@@ -292,4 +292,4 @@ function form_check(f)
 </script>
 
 <?php
-include_once (G5_ADMIN_PATH.'/admin.tail.php');
+include_once (G5_ADMIN_PATH.'/admin.tail.php');

adm/shop_admin/couponformupdate.php

@@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, "w");
 
 check_admin_token();
 
+$cp_id = isset($_REQUEST['cp_id']) ? safe_replace_regex($_REQUEST['cp_id'], 'cp_id') : '';
+
 $_POST = array_map('trim', $_POST);
 
 $check_sanitize_keys = array(
@@ -25,7 +27,7 @@ $check_sanitize_keys = array(
 );
 
 foreach( $check_sanitize_keys as $key ){
-    $$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
+    $$key = $_POST[$key] = isset($_POST[$key]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$key])))) : '';
 }
 
 if(!$_POST['cp_subject'])
@@ -264,4 +266,4 @@ if ($w == '' && (isset($_POST['cp_sms_send']) || isset($_POST['cp_email_send']))
     }
 }
 
-goto_url('./couponlist.php');
+goto_url('./couponlist.php');

adm/shop_admin/couponlist.php

@@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, "r");
 
 $sql_common = " from {$g5['g5_shop_coupon_table']} ";
 
+if ($sfl && !in_array($sfl, array('mb_id', 'cp_subject', 'cp_id'))) $sfl = '';
+
 $sql_search = " where (1) ";
 if ($stx) {
     $sql_search .= " and ( ";
@@ -24,6 +26,9 @@ if (!$sst) {
     $sst  = "cp_no";
     $sod = "desc";
 }
+$allowed_sst = array('cp_no', 'cp_id', 'cp_subject', 'mb_id', 'cp_end', 'cp_start', 'cp_method');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'cp_no';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/shop_admin/couponzoneformupdate.php

@@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, "w");
 
 check_admin_token();
 
+$cz_id = isset($_REQUEST['cz_id']) ? (int) $_REQUEST['cz_id'] : 0;
+
 @mkdir(G5_DATA_PATH."/coupon", G5_DIR_PERMISSION);
 @chmod(G5_DATA_PATH."/coupon", G5_DIR_PERMISSION);
 
@@ -28,7 +30,7 @@ $check_sanitize_keys = array(
 );
 
 foreach( $check_sanitize_keys as $key ){
-    $$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
+    $$key = $_POST[$key] = isset($_POST[$key]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$key])))) : '';
 }
 
 if(!$_POST['cz_subject'])
@@ -150,4 +152,4 @@ if($_FILES['cp_img']['tmp_name']) {
     sql_query($sql);
 }
 
-goto_url('./couponzonelist.php?'.$qstr);
+goto_url('./couponzonelist.php?'.$qstr);

adm/shop_admin/couponzonelist.php

@@ -15,6 +15,9 @@ if (!$sst) {
     $sst  = "cz_id";
     $sod = "desc";
 }
+$allowed_sst = array('cz_id');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'cz_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/shop_admin/inorderform.php

@@ -20,6 +20,8 @@ if (!$od['od_id']) {
 
 // 주문정보
 $data = unserialize(base64_decode($od['dt_data']));
+$data_od_cp_id = isset($data['od_cp_id']) ? safe_replace_regex($data['od_cp_id'], 'cp_id') : '';
+$data_sc_cp_id = isset($data['sc_cp_id']) ? safe_replace_regex($data['sc_cp_id'], 'cp_id') : '';
 
 $sql_common = " from {$g5['g5_shop_cart_table']} where od_id = '{$od['cart_id']}' and ct_status = '쇼핑' and ct_select = '1' ";
 
@@ -38,8 +40,8 @@ if($od['mb_id']) {
     $it_cp_cnt = (isset($data['cp_id']) && is_array($data['cp_id'])) ? count($data['cp_id']) : 0;
     $arr_it_cp_prc = array();
     for($i=0; $i<$it_cp_cnt; $i++) {
-        $cid = $data['cp_id'][$i];
-        $it_id = $data['it_id'][$i];
+        $cid = isset($data['cp_id'][$i]) ? safe_replace_regex($data['cp_id'][$i], 'cp_id') : '';
+        $it_id = isset($data['it_id'][$i]) ? safe_replace_regex($data['it_id'][$i], 'it_id') : '';
         $sql = " select cp_id, cp_method, cp_target, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
                     from {$g5['g5_shop_coupon_table']}
                     where cp_id = '$cid'
@@ -98,10 +100,10 @@ if($od['mb_id']) {
     $tot_od_price -= $tot_it_cp_price;
 
     // 주문쿠폰
-    if(isset($data['od_cp_id']) && $data['od_cp_id']) {
+    if($data_od_cp_id) {
         $sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
                     from {$g5['g5_shop_coupon_table']}
-                    where cp_id = '{$data['od_cp_id']}'
+                    where cp_id = '$data_od_cp_id'
                       and mb_id IN ( '{$od['mb_id']}', '전체회원' )
                       and cp_method = '2' ";
         $cp = sql_fetch($sql);
@@ -134,10 +136,10 @@ $od_send_cost = get_sendcost($od['cart_id']);
 $tot_sc_cp_price = 0;
 if($od['mb_id'] && $od_send_cost > 0) {
     // 배송쿠폰
-    if($data['sc_cp_id']) {
+    if($data_sc_cp_id) {
         $sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
                     from {$g5['g5_shop_coupon_table']}
-                    where cp_id = '{$data['sc_cp_id']}'
+                    where cp_id = '$data_sc_cp_id'
                       and mb_id IN ( '{$od['mb_id']}', '전체회원' )
                       and cp_method = '3' ";
         $cp = sql_fetch($sql);
@@ -571,4 +573,4 @@ function del_confirm()
 </script>
 
 <?php
-include_once(G5_ADMIN_PATH.'/admin.tail.php');
+include_once(G5_ADMIN_PATH.'/admin.tail.php');

adm/shop_admin/inorderformupdate.php

@@ -30,6 +30,8 @@ if($w == 'd') {
 
 // 주문정보
 $data = unserialize(base64_decode($od['dt_data']));
+$data_od_cp_id = isset($data['od_cp_id']) ? safe_replace_regex($data['od_cp_id'], 'cp_id') : '';
+$data_sc_cp_id = isset($data['sc_cp_id']) ? safe_replace_regex($data['sc_cp_id'], 'cp_id') : '';
 
 $sql_common = " from {$g5['g5_shop_cart_table']} where od_id = '{$od['cart_id']}' and ct_status = '쇼핑' ";
 
@@ -53,8 +55,8 @@ if($od['mb_id']) {
     $it_cp_cnt = (isset($data['cp_id']) && is_array($data['cp_id'])) ? count($data['cp_id']) : 0;
     $arr_it_cp_prc = array();
     for($i=0; $i<$it_cp_cnt; $i++) {
-        $cid = $data['cp_id'][$i];
-        $it_id = $data['it_id'][$i];
+        $cid = isset($data['cp_id'][$i]) ? safe_replace_regex($data['cp_id'][$i], 'cp_id') : '';
+        $it_id = isset($data['it_id'][$i]) ? safe_replace_regex($data['it_id'][$i], 'it_id') : '';
         $sql = " select cp_id, cp_method, cp_target, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
                     from {$g5['g5_shop_coupon_table']}
                     where cp_id = '$cid'
@@ -113,10 +115,10 @@ if($od['mb_id']) {
     $tot_od_price -= $tot_it_cp_price;
 
     // 주문쿠폰
-    if(isset($data['od_cp_id']) && $data['od_cp_id']) {
+    if($data_od_cp_id) {
         $sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
                     from {$g5['g5_shop_coupon_table']}
-                    where cp_id = '{$data['od_cp_id']}'
+                    where cp_id = '$data_od_cp_id'
                       and mb_id IN ( '{$od['mb_id']}', '전체회원' )
                       and cp_method = '2' ";
         $cp = sql_fetch($sql);
@@ -149,10 +151,10 @@ $od_send_cost = get_sendcost($od['cart_id']);
 $tot_sc_cp_price = 0;
 if($od['mb_id'] && $od_send_cost > 0) {
     // 배송쿠폰
-    if($data['sc_cp_id']) {
+    if($data_sc_cp_id) {
         $sql = " select cp_id, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
                     from {$g5['g5_shop_coupon_table']}
-                    where cp_id = '{$data['sc_cp_id']}'
+                    where cp_id = '$data_sc_cp_id'
                       and mb_id IN ( '{$od['mb_id']}', '전체회원' )
                       and cp_method = '3' ";
         $cp = sql_fetch($sql);
@@ -212,38 +214,38 @@ if($data['od_settle_case'] == 'KAKAOPAY')
     $od_pg = 'KAKAOPAY';
 
 $od_email         = get_email_address($data['od_email']);
-$od_name          = clean_xss_tags($data['od_name']);
-$od_tel           = clean_xss_tags($data['od_tel']);
-$od_hp            = clean_xss_tags($data['od_hp']);
+$od_name          = addslashes(clean_xss_tags($data['od_name']));
+$od_tel           = addslashes(clean_xss_tags($data['od_tel']));
+$od_hp            = addslashes(clean_xss_tags($data['od_hp']));
 $od_zip           = preg_replace('/[^0-9]/', '', $data['od_zip']);
 $od_zip1          = substr($od_zip, 0, 3);
 $od_zip2          = substr($od_zip, 3);
-$od_addr1         = clean_xss_tags($data['od_addr1']);
-$od_addr2         = clean_xss_tags($data['od_addr2']);
-$od_addr3         = clean_xss_tags($data['od_addr3']);
-$od_addr_jibeon   = preg_match("/^(N|R)$/", $data['od_addr_jibeon']) ? $data['od_addr_jibeon'] : '';
-$od_b_name        = clean_xss_tags($data['od_b_name']);
-$od_b_tel         = clean_xss_tags($data['od_b_tel']);
-$od_b_hp          = clean_xss_tags($data['od_b_hp']);
+$od_addr1         = addslashes(clean_xss_tags($data['od_addr1']));
+$od_addr2         = addslashes(clean_xss_tags($data['od_addr2']));
+$od_addr3         = addslashes(clean_xss_tags($data['od_addr3']));
+$od_addr_jibeon   = preg_match("/^(N|R|J)$/", $data['od_addr_jibeon']) ? $data['od_addr_jibeon'] : '';
+$od_b_name        = addslashes(clean_xss_tags($data['od_b_name']));
+$od_b_tel         = addslashes(clean_xss_tags($data['od_b_tel']));
+$od_b_hp          = addslashes(clean_xss_tags($data['od_b_hp']));
 $od_b_zip		  = preg_replace('/[^0-9]/', '', $data['od_b_zip']);
 $od_b_zip1        = substr($od_b_zip, 0, 3);
 $od_b_zip2        = substr($od_b_zip, 3);
-$od_b_addr1       = clean_xss_tags($data['od_b_addr1']);
-$od_b_addr2       = clean_xss_tags($data['od_b_addr2']);
-$od_b_addr3       = clean_xss_tags($data['od_b_addr3']);
-$od_b_addr_jibeon = preg_match("/^(N|R)$/", $data['od_b_addr_jibeon']) ? $data['od_b_addr_jibeon'] : '';
-$od_memo          = clean_xss_tags($data['od_memo'], 0, 1, 0, 0);
-$od_deposit_name  = clean_xss_tags($data['od_deposit_name']);
+$od_b_addr1       = addslashes(clean_xss_tags($data['od_b_addr1']));
+$od_b_addr2       = addslashes(clean_xss_tags($data['od_b_addr2']));
+$od_b_addr3       = addslashes(clean_xss_tags($data['od_b_addr3']));
+$od_b_addr_jibeon = preg_match("/^(N|R|J)$/", $data['od_b_addr_jibeon']) ? $data['od_b_addr_jibeon'] : '';
+$od_memo          = addslashes(clean_xss_tags($data['od_memo'], 0, 1, 0, 0));
+$od_deposit_name  = addslashes(clean_xss_tags($data['od_deposit_name']));
 $od_tax_flag      = $default['de_tax_flag_use'];
 $od_receipt_price = $tot_ct_price + $od_send_cost + $od_send_cost2 - ($od_temp_point + $tot_cp_price + $tot_sc_cp_price);
 $od_receipt_point = $od_temp_point;
 $od_receipt_time  = $od['dt_time'];
 $od_misu          = 0;
 $od_status        = '입금';
-$od_bank_account  = isset($data['od_bank_account']) ? clean_xss_tags($data['od_bank_account'], 1, 1) : '';
+$od_bank_account  = isset($data['od_bank_account']) ? addslashes(clean_xss_tags(stripslashes($data['od_bank_account']), 1, 1)) : '';
 $od_tno = '';
 $od_app_no = '';
-$od_hope_date = isset($data['od_hope_date']) ? clean_xss_tags($data['od_hope_date'], 1, 1) : '';
+$od_hope_date = isset($data['od_hope_date']) ? addslashes(clean_xss_tags(stripslashes($data['od_hope_date']), 1, 1)) : '';
 
 // 주문서에 입력
 $sql = " insert {$g5['g5_shop_order_table']}
@@ -321,8 +323,8 @@ if ($od['mb_id'] && $od_receipt_point)
 if($od['mb_id']) {
     $it_cp_cnt = (isset($data['cp_id']) && is_array($data['cp_id'])) ? count($data['cp_id']) : 0;
     for($i=0; $i<$it_cp_cnt; $i++) {
-        $cid = $data['cp_id'][$i];
-        $cp_it_id = $data['it_id'][$i];
+        $cid = isset($data['cp_id'][$i]) ? safe_replace_regex($data['cp_id'][$i], 'cp_id') : '';
+        $cp_it_id = isset($data['it_id'][$i]) ? safe_replace_regex($data['it_id'][$i], 'it_id') : '';
         $cp_prc = isset($arr_it_cp_prc[$cp_it_id]) ? (int) $arr_it_cp_prc[$cp_it_id] : 0;
 
         if(trim($cid)) {
@@ -346,9 +348,9 @@ if($od['mb_id']) {
         sql_query($sql);
     }
 
-    if(isset($data['od_cp_id']) && $data['od_cp_id']) {
+    if($data_od_cp_id) {
         $sql = " insert into {$g5['g5_shop_coupon_log_table']}
-                    set cp_id       = '{$data['od_cp_id']}',
+                    set cp_id       = '$data_od_cp_id',
                         mb_id       = '{$od['mb_id']}',
                         od_id       = '$od_id',
                         cp_price    = '$tot_od_cp_price',
@@ -356,9 +358,9 @@ if($od['mb_id']) {
         sql_query($sql);
     }
 
-    if(isset($data['sc_cp_id']) && $data['sc_cp_id']) {
+    if($data_sc_cp_id) {
         $sql = " insert into {$g5['g5_shop_coupon_log_table']}
-                    set cp_id       = '{$data['sc_cp_id']}',
+                    set cp_id       = '$data_sc_cp_id',
                         mb_id       = '{$od['mb_id']}',
                         od_id       = '$od_id',
                         cp_price    = '$tot_sc_cp_price',
@@ -384,10 +386,16 @@ sql_query($sql);
 $sql = " delete from {$g5['g5_shop_order_data_table']} where od_id = '$od_id' and dt_pg = '$od_pg' ";
 sql_query($sql, true);
 
+$orderform_url = './orderform.php?od_id='.$od_id;
+$inorderlist_url = './inorderlist.php?'.str_replace('&amp;', '&', $qstr);
+$js_replace = array('\\' => '\\\\', '"' => '\\"', "'" => '\\u0027', '/' => '\\/', "\r" => '\\r', "\n" => '\\n', "\t" => '\\t', '<' => '\\u003C', '>' => '\\u003E', '&' => '\\u0026', "\xE2\x80\xA8" => '\\u2028', "\xE2\x80\xA9" => '\\u2029');
+$js_orderform_url = function_exists('get_js_safe_string') ? get_js_safe_string($orderform_url) : '"'.strtr((string)$orderform_url, $js_replace).'"';
+$js_inorderlist_url = function_exists('get_js_safe_string') ? get_js_safe_string($inorderlist_url) : '"'.strtr((string)$inorderlist_url, $js_replace).'"';
+
 echo '<meta http-equiv="content-type" content="text/html; charset=utf-8">'.PHP_EOL;
 echo '<script>'.PHP_EOL;
 echo 'if(confirm("복구하신 주문 상세페이지로 이동하시겠습니까?"))'.PHP_EOL;
-echo 'document.location.href = "./orderform.php?od_id='.$od_id.'";'.PHP_EOL;
+echo 'document.location.href = '.$js_orderform_url.';'.PHP_EOL;
 echo 'else'.PHP_EOL;
-echo 'document.location.href = "./inorderlist.php?'.str_replace('&amp;', '&', $qstr).'";'.PHP_EOL;
-echo '</script>'.PHP_EOL;
+echo 'document.location.href = '.$js_inorderlist_url.';'.PHP_EOL;
+echo '</script>'.PHP_EOL;

adm/shop_admin/inorderlist.php

@@ -24,6 +24,9 @@ if (!$sst) {
     $sst  = "od_id";
     $sod = "desc";
 }
+$allowed_sst = array('od_id');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'od_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt
@@ -104,6 +107,12 @@ $colspan = 10;
             case 'lg':
                 $pg = 'LGU+';
                 break;
+            case 'toss':
+                $pg = '토스페이먼츠';
+                break;
+            case 'nicepay':
+                $pg = 'NICEPAY';
+                break;
             default:
                 $pg = 'KCP';
                 break;

adm/shop_admin/itemeventform.php

@@ -67,7 +67,9 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
     for ($i=0; $i<$len; $i++)
         $nbsp .= "&nbsp;&nbsp;&nbsp;";
 
-    $category_select .= "<option value=\"{$row['ca_id']}\">$nbsp{$row['ca_name']}</option>\n";
+    // 전체 카테고리 경로 표시
+    $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row['ca_id']) : $row['ca_name'];
+    $category_select .= "<option value=\"{$row['ca_id']}\">$nbsp{$category_path}</option>\n";
 }
 
 // 모바일 1줄당 이미지수 필드 추가

adm/shop_admin/itemeventformupdate.php

@@ -33,7 +33,7 @@ $ev_mobile_list_row = isset($_POST['ev_mobile_list_row']) ? (int) $_POST['ev_mob
 $ev_use = isset($_POST['ev_use']) ? (int) $_POST['ev_use'] : 0;
 $ev_subject_strong = isset($_POST['ev_subject_strong']) ? (int) $_POST['ev_subject_strong'] : 0;
 
-$ev_subject = isset($_POST['ev_subject']) ? clean_xss_tags($_POST['ev_subject'], 1, 1) : '';
+$ev_subject = isset($_POST['ev_subject']) ? addslashes(clean_xss_tags(stripslashes($_POST['ev_subject']), 1, 1)) : '';
 $ev_head_html = isset($_POST['ev_head_html']) ? $_POST['ev_head_html'] : '';
 $ev_tail_html = isset($_POST['ev_tail_html']) ? $_POST['ev_tail_html'] : '';
 
@@ -129,4 +129,4 @@ if ($w == "" || $w == "u")
 else
 {
     goto_url("./itemevent.php");
-}
+}

adm/shop_admin/itemeventlist.php

@@ -107,7 +107,9 @@ if($ev_id) {
         $len = strlen($row1['ca_id']) / 2 - 1;
         $nbsp = "";
         for ($i=0; $i<$len; $i++) $nbsp .= "&nbsp;&nbsp;&nbsp;";
-        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sel_ca_id, $row1['ca_id']).'>'.$nbsp.$row1['ca_name'].'</option>'.PHP_EOL;
+        // 전체 카테고리 경로 표시
+        $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row1['ca_id']) : $row1['ca_name'];
+        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sel_ca_id, $row1['ca_id']).'>'.$nbsp.$category_path.'</option>'.PHP_EOL;
     }
     ?>
 </select>

adm/shop_admin/itemform.php

@@ -105,7 +105,7 @@ else if ($w == "u")
                     and b.ca_mb_id = '{$member['mb_id']}' ";
         $row = sql_fetch($sql);
         if (!$row['it_id'])
-            alert("\'{$member['mb_id']}\' 님께서 수정 할 권한이 없는 상품입니다.");
+            alert("'{$member['mb_id']}' 님께서 수정 할 권한이 없는 상품입니다.");
     }
 
     $it = get_shop_item($it_id);
@@ -146,9 +146,11 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
     $nbsp = "";
     for ($i=0; $i<$len; $i++)
         $nbsp .= "&nbsp;&nbsp;&nbsp;";
-
-    $category_select .= "<option value=\"{$row['ca_id']}\">$nbsp{$row['ca_name']}</option>\n";
-
+    
+    // 전체 카테고리 경로 표시 (예: 남성의류 > 상의 > 셔츠)
+    $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row['ca_id']) : $row['ca_name'];
+    $category_select .= "<option value=\"{$row['ca_id']}\">$nbsp{$category_path}</option>\n";
+    
     $script .= "ca_use['{$row['ca_id']}'] = {$row['ca_use']};\n";
     $script .= "ca_stock_qty['{$row['ca_id']}'] = {$row['ca_stock_qty']};\n";
     //$script .= "ca_explan_html['$row[ca_id]'] = $row[ca_explan_html];\n";
@@ -1394,7 +1396,9 @@ $(function(){
                             for ($i=0; $i<$len; $i++)
                                 $nbsp .= "&nbsp;&nbsp;&nbsp;";
 
-                            echo "<option value=\"{$row['ca_id']}\">$nbsp{$row['ca_name']}</option>\n";
+                            // 전체 카테고리 경로 표시
+                            $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row['ca_id']) : $row['ca_name'];
+                            echo "<option value=\"{$row['ca_id']}\">$nbsp{$category_path}</option>\n";
                         }
                     ?>
                 </select>
@@ -1897,4 +1901,4 @@ categorychange(document.fitemform);
 </script>
 
 <?php
-include_once (G5_ADMIN_PATH.'/admin.tail.php');
+include_once (G5_ADMIN_PATH.'/admin.tail.php');

adm/shop_admin/itemformupdate.php

@@ -319,7 +319,7 @@ for($i=0; $i<$count_ii_article; $i++) {
 }
 $it_info_value = addslashes(serialize($value_array));
 
-$it_name = isset($_POST['it_name']) ? strip_tags(clean_xss_attributes(trim($_POST['it_name']))) : '';
+$it_name = isset($_POST['it_name']) ? addslashes(strip_tags(clean_xss_attributes(trim(stripslashes($_POST['it_name']))))) : '';
 
 // KVE-2019-0708
 $check_sanitize_keys = array(
@@ -356,7 +356,7 @@ $check_sanitize_keys = array(
 );
 
 foreach( $check_sanitize_keys as $key ){
-    $$key = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
+    $$key = isset($_POST[$key]) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST[$key])))) : '';
 }
 
 $it_basic = preg_replace('#<script(.*?)>(.*?)<\/script>#is', '', $it_basic);
@@ -365,6 +365,18 @@ $it_explan = isset($_POST['it_explan']) ? $_POST['it_explan'] : '';
 if ($it_name == "")
     alert("상품명을 입력해 주십시오.");
 
+// 상품 스킨은 파일 경로가 아니라 스킨 디렉토리명(basic, theme/basic 등)을 저장한다.
+$it_skin = isset($_POST['it_skin']) ? trim(strip_tags(clean_xss_attributes(stripslashes($_POST['it_skin'])))) : '';
+$it_mobile_skin = isset($_POST['it_mobile_skin']) ? trim(strip_tags(clean_xss_attributes(stripslashes($_POST['it_mobile_skin'])))) : '';
+
+if (function_exists('check_shop_skin_dir')) {
+    check_shop_skin_dir($it_skin, 'PC용 스킨');
+    check_shop_skin_dir($it_mobile_skin, '모바일용 스킨', true);
+}
+
+$it_skin = addslashes($it_skin);
+$it_mobile_skin = addslashes($it_mobile_skin);
+
 $sql_common = " ca_id               = '$ca_id',
                 ca_id2              = '$ca_id2',
                 ca_id3              = '$ca_id3',
@@ -384,7 +396,7 @@ $sql_common = " ca_id               = '$ca_id',
                 it_type5            = '$it_type5',
                 it_basic            = '$it_basic',
                 it_explan           = '$it_explan',
-                it_explan2          = '".strip_tags(trim(clean_xss_attributes($it_explan)))."',
+                it_explan2          = '".addslashes(strip_tags(trim(clean_xss_attributes(stripslashes($it_explan)))))."',
                 it_mobile_explan    = '$it_mobile_explan',
                 it_cust_price       = '$it_cust_price',
                 it_price            = '$it_price',
@@ -487,7 +499,7 @@ else if ($w == "d")
                     and b.ca_mb_id = '{$member['mb_id']}' ";
         $row = sql_fetch($sql);
         if (!$row['it_id'])
-            alert("\'{$member['mb_id']}\' 님께서 삭제 할 권한이 없는 상품입니다.");
+            alert("'{$member['mb_id']}' 님께서 삭제 할 권한이 없는 상품입니다.");
     }
 
     itemdelete($it_id);

adm/shop_admin/itemlist.php

@@ -25,7 +25,8 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
     for ($i=0; $i<$len; $i++) {
         $nbsp .= '&nbsp;&nbsp;&nbsp;';
     }
-    $ca_list .= '<option value="'.$row['ca_id'].'">'.$nbsp.$row['ca_name'].'</option>'.PHP_EOL;
+    $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row['ca_id']) : $row['ca_name'];
+    $ca_list .= '<option value="'.$row['ca_id'].'">'.$nbsp.$category_path.'</option>'.PHP_EOL;
 }
 
 $where = " and ";
@@ -67,6 +68,9 @@ if (!$sst) {
     $sst  = "it_id";
     $sod = "desc";
 }
+$allowed_sst = array('it_id', 'it_name', 'it_order', 'it_use', 'it_soldout', 'it_hit', 'it_price', 'it_cust_price', 'it_point', 'it_stock_qty');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'it_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = "order by $sst $sod";
 
 
@@ -100,7 +104,9 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
         $len = strlen($row1['ca_id']) / 2 - 1;
         $nbsp = '';
         for ($i=0; $i<$len; $i++) $nbsp .= '&nbsp;&nbsp;&nbsp;';
-        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sca, $row1['ca_id']).'>'.$nbsp.$row1['ca_name'].'</option>'.PHP_EOL;
+        // 전체 카테고리 경로 표시
+        $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row1['ca_id']) : $row1['ca_name'];
+        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sca, $row1['ca_id']).'>'.$nbsp.$category_path.'</option>'.PHP_EOL;
     }
     ?>
 </select>

adm/shop_admin/itemlistupdate.php

@@ -29,17 +29,22 @@ if ($post_act_button == "선택수정") {
         $p_ca_id = (isset($_POST['ca_id']) && is_array($_POST['ca_id'])) ? strip_tags($_POST['ca_id'][$k]) : '';
         $p_ca_id2 = (isset($_POST['ca_id2']) && is_array($_POST['ca_id2'])) ? strip_tags($_POST['ca_id2'][$k]) : '';
         $p_ca_id3 = (isset($_POST['ca_id3']) && is_array($_POST['ca_id3'])) ? strip_tags($_POST['ca_id3'][$k]) : '';
-        $p_it_name = (isset($_POST['it_name']) && is_array($_POST['it_name'])) ? strip_tags(clean_xss_attributes($_POST['it_name'][$k])) : '';
+        $p_it_name = (isset($_POST['it_name']) && is_array($_POST['it_name'])) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['it_name'][$k])))) : '';
         $p_it_cust_price = (isset($_POST['it_cust_price']) && is_array($_POST['it_cust_price'])) ? strip_tags($_POST['it_cust_price'][$k]) : '';
         $p_it_price = (isset($_POST['it_price']) && is_array($_POST['it_price'])) ? strip_tags($_POST['it_price'][$k]) : '';
         $p_it_stock_qty = (isset($_POST['it_stock_qty']) && is_array($_POST['it_stock_qty'])) ? strip_tags($_POST['it_stock_qty'][$k]) : '';
-        $p_it_skin = (isset($_POST['it_skin']) && is_array($_POST['it_skin'])) ? strip_tags($_POST['it_skin'][$k]) : '';
-        $p_it_mobile_skin = (isset($_POST['it_mobile_skin']) && is_array($_POST['it_mobile_skin'])) ? strip_tags($_POST['it_mobile_skin'][$k]) : '';
+        $p_it_skin = (isset($_POST['it_skin']) && is_array($_POST['it_skin'])) ? trim(strip_tags(clean_xss_attributes(stripslashes($_POST['it_skin'][$k])))) : '';
+        $p_it_mobile_skin = (isset($_POST['it_mobile_skin']) && is_array($_POST['it_mobile_skin'])) ? trim(strip_tags(clean_xss_attributes(stripslashes($_POST['it_mobile_skin'][$k])))) : '';
         $p_it_use       = isset($_POST['it_use'][$k])       ? clean_xss_tags($_POST['it_use'][$k], 1, 1)        : 0;
         $p_it_soldout   = isset($_POST['it_soldout'][$k])   ? clean_xss_tags($_POST['it_soldout'][$k], 1, 1)    : 0;
         $p_it_order = (isset($_POST['it_order']) && is_array($_POST['it_order'])) ? strip_tags($_POST['it_order'][$k]) : '';
         $p_it_id = isset($_POST['it_id'][$k]) ? preg_replace('/[^a-z0-9_\-]/i', '', $_POST['it_id'][$k]) : '';
 
+        if (function_exists('check_shop_skin_dir')) {
+            check_shop_skin_dir($p_it_skin, 'PC용 스킨');
+            check_shop_skin_dir($p_it_mobile_skin, '모바일용 스킨', true);
+        }
+
         if ($is_admin != 'super') {     // 최고관리자가 아니면 체크
             $sql = "select a.it_id, b.ca_mb_id from {$g5['g5_shop_item_table']} a , {$g5['g5_shop_category_table']} b where (a.ca_id = b.ca_id) and a.it_id = '$p_it_id'";
             $checks = sql_fetch($sql);
@@ -89,4 +94,4 @@ if ($post_act_button == "선택수정") {
     }
 }
 
-goto_url("./itemlist.php?sca=$sca&sst=$sst&sod=$sod&sfl=$sfl&stx=$stx&page=$page");
+goto_url("./itemlist.php?sca=$sca&sst=$sst&sod=$sod&sfl=$sfl&stx=$stx&page=$page");

adm/shop_admin/itemqalist.php

@@ -31,6 +31,9 @@ if (!$sst) {
     $sst = "iq_id";
     $sod = "desc";
 }
+$allowed_sst = array('iq_id', 'a.it_id', 'it_name', 'iq_time');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'iq_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 
 $sql_common = "  from {$g5['g5_shop_item_qa_table']} a
                  left join {$g5['g5_shop_item_table']} b on (a.it_id = b.it_id)
@@ -79,7 +82,9 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
         $nbsp = "";
         for ($i=0; $i<$len; $i++) $nbsp .= "&nbsp;&nbsp;&nbsp;";
         $selected = ($row1['ca_id'] == $sca) ? ' selected="selected"' : '';
-        echo '<option value="'.$row1['ca_id'].'"'.$selected.'>'.$nbsp.$row1['ca_name'].'</option>'.PHP_EOL;
+        // 전체 카테고리 경로 표시
+        $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row1['ca_id']) : $row1['ca_name'];
+        echo '<option value="'.$row1['ca_id'].'"'.$selected.'>'.$nbsp.$category_path.'</option>'.PHP_EOL;
     }
     ?>
 </select>

adm/shop_admin/itemsellrank.php

@@ -83,7 +83,9 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
         $len = strlen($row1['ca_id']) / 2 - 1;
         $nbsp = "";
         for ($i=0; $i<$len; $i++) $nbsp .= "&nbsp;&nbsp;&nbsp;";
-        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sel_ca_id, $row1['ca_id']).'>'.$nbsp.$row1['ca_name'].'</option>'.PHP_EOL;
+        // 전체 카테고리 경로 표시
+        $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row1['ca_id']) : $row1['ca_name'];
+        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sel_ca_id, $row1['ca_id']).'>'.$nbsp.$category_path.'</option>'.PHP_EOL;
     }
     ?>
 </select>

adm/shop_admin/itemstocklist.php

@@ -82,7 +82,9 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
         $len = strlen($row1['ca_id']) / 2 - 1;
         $nbsp = "";
         for ($i=0; $i<$len; $i++) $nbsp .= "&nbsp;&nbsp;&nbsp;";
-        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sel_ca_id, $row1['ca_id']).'>'.$nbsp.$row1['ca_name'].'</option>'.PHP_EOL;
+        // 전체 카테고리 경로 표시
+        $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row1['ca_id']) : $row1['ca_name'];
+        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sel_ca_id, $row1['ca_id']).'>'.$nbsp.$category_path.'</option>'.PHP_EOL;
     }
     ?>
 </select>

adm/shop_admin/itemtypelist.php

@@ -46,6 +46,9 @@ if (!$sst)  {
     $sst  = "it_id";
     $sod = "desc";
 }
+$allowed_sst = array('it_id', 'it_name', 'it_type1', 'it_type2', 'it_type3', 'it_type4', 'it_type5', 'ca_id');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'it_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = "order by $sst $sod";
 
 $sql_common = "  from {$g5['g5_shop_item_table']} ";
@@ -98,7 +101,9 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
         $len = strlen($row1['ca_id']) / 2 - 1;
         $nbsp = "";
         for ($i=0; $i<$len; $i++) $nbsp .= "&nbsp;&nbsp;&nbsp;";
-        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sca, $row1['ca_id']).'>'.$nbsp.$row1['ca_name'].PHP_EOL;
+        // 전체 카테고리 경로 표시
+        $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row1['ca_id']) : $row1['ca_name'];
+        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sca, $row1['ca_id']).'>'.$nbsp.$category_path.PHP_EOL;
     }
     ?>
 </select>

adm/shop_admin/itemuseformupdate.php

@@ -18,8 +18,10 @@ foreach($check_keys as $key){
 
     if( in_array($key, array('is_content', 'is_reply_content')) ){
         $posts[$key] = isset($_POST[$key]) ? $_POST[$key] : '';
+    } else if( $key === 'is_id' ) {
+        $posts[$key] = isset($_POST[$key]) ? (int) $_POST[$key] : 0;
     } else {
-        $posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
+        $posts[$key] = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : '';
     }
 }
 
@@ -46,4 +48,4 @@ if ($w == "u")
 else
 {
     alert();
-}
+}

adm/shop_admin/itemuselist.php

@@ -33,6 +33,9 @@ if (!$sst) {
     $sst = "is_id";
     $sod = "desc";
 }
+$allowed_sst = array('is_id', 'a.it_id', 'it_name', 'is_name', 'is_score', 'is_time');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'is_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 
 $sql_common = "  from {$g5['g5_shop_item_use_table']} a
                  left join {$g5['g5_shop_item_table']} b on (a.it_id = b.it_id)
@@ -81,7 +84,9 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
         $nbsp = "";
         for ($i=0; $i<$len; $i++) $nbsp .= "&nbsp;&nbsp;&nbsp;";
         $selected = ($row1['ca_id'] == $sca) ? ' selected="selected"' : '';
-        echo '<option value="'.$row1['ca_id'].'"'.$selected.'>'.$nbsp.$row1['ca_name'].'</option>'.PHP_EOL;
+        // 전체 카테고리 경로 표시
+        $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row1['ca_id']) : $row1['ca_name'];
+        echo '<option value="'.$row1['ca_id'].'"'.$selected.'>'.$nbsp.$category_path.PHP_EOL;
     }
     ?>
 </select>

adm/shop_admin/optionstocklist.php

@@ -84,7 +84,9 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
         $len = strlen($row1['ca_id']) / 2 - 1;
         $nbsp = "";
         for ($i=0; $i<$len; $i++) $nbsp .= "&nbsp;&nbsp;&nbsp;";
-        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sel_ca_id, $row1['ca_id']).'>'.$nbsp.$row1['ca_name'].'</option>'.PHP_EOL;
+        // 전체 카테고리 경로 표시
+        $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row1['ca_id']) : $row1['ca_name'];
+        echo '<option value="'.$row1['ca_id'].'" '.get_selected($sel_ca_id, $row1['ca_id']).'>'.$nbsp.$category_path.'</option>'.PHP_EOL;
     }
     ?>
 </select>

adm/shop_admin/orderdeliveryexcel.php

@@ -30,17 +30,17 @@ if(! function_exists('column_char')) {
     $rows = array();
 
     for($i=1; $row=sql_fetch_array($result); $i++) {
-        $rows[] = 
-                    array(' '.$row['od_id'], 
-                          $row['od_name'], 
-                          ' '.$row['od_tel'], 
-                          ' '.$row['od_hp'], 
-                          $row['od_b_name'], 
-                          ' '.$row['od_b_tel'], 
-                          ' '.$row['od_b_hp'], 
-                          print_address($row['od_b_addr1'], $row['od_b_addr2'], $row['od_b_addr3'], $row['od_b_addr_jibeon']),
-                          $row['od_delivery_company'],
-                          $row['od_invoice']);
+        $rows[] =
+                    array(' '.$row['od_id'],
+                          function_exists('csv_safe_cell') ? csv_safe_cell($row['od_name']) : $row['od_name'],
+                          ' '.$row['od_tel'],
+                          ' '.$row['od_hp'],
+                          function_exists('csv_safe_cell') ? csv_safe_cell($row['od_b_name']) : $row['od_b_name'],
+                          ' '.$row['od_b_tel'],
+                          ' '.$row['od_b_hp'],
+                          function_exists('csv_safe_cell') ? csv_safe_cell(print_address($row['od_b_addr1'], $row['od_b_addr2'], $row['od_b_addr3'], $row['od_b_addr_jibeon'])) : print_address($row['od_b_addr1'], $row['od_b_addr2'], $row['od_b_addr3'], $row['od_b_addr_jibeon']),
+                          function_exists('csv_safe_cell') ? csv_safe_cell($row['od_delivery_company']) : $row['od_delivery_company'],
+                          function_exists('csv_safe_cell') ? csv_safe_cell($row['od_invoice']) : $row['od_invoice']);
     }
 
     $data = array_merge(array($headers), $rows);

adm/shop_admin/orderdeliveryupdate.php

@@ -6,6 +6,8 @@ include_once(G5_LIB_PATH.'/mailer.lib.php');
 
 auth_check_menu($auth, $sub_menu, "w");
 
+check_admin_token();
+
 define("_ORDERMAIL_", true);
 
 $sms_count = 0;

adm/shop_admin/orderform.php

@@ -382,8 +382,8 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
     <input type="hidden" name="sel_field" value="<?php echo $sel_field; ?>">
     <input type="hidden" name="search" value="<?php echo $search; ?>">
     <input type="hidden" name="page" value="<?php echo $page; ?>">
-    <input type="hidden" name="od_name" value="<?php echo $od['od_name']; ?>">
-    <input type="hidden" name="od_hp" value="<?php echo $od['od_hp']; ?>">
+    <input type="hidden" name="od_name" value="<?php echo get_text($od['od_name']); ?>">
+    <input type="hidden" name="od_hp" value="<?php echo get_text($od['od_hp']); ?>">
     <input type="hidden" name="od_tno" value="<?php echo $od['od_tno']; ?>">
     <input type="hidden" name="od_escrow" value="<?php echo $od['od_escrow']; ?>">
     <input type="hidden" name="od_pg" value="<?php echo $od['od_pg']; ?>">
@@ -509,39 +509,33 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                         <?php
                         if ($od['od_settle_case'] != '무통장') {
                             switch($od['od_pg']) {
-                                case 'lg':
-                                    $pg_url  = 'https://app.tosspayments.com';
-                                    $pg_test = '토스페이먼츠(구버전)';
-                                    if ($default['de_card_test']) {
-                                        $pg_url = 'https://pgweb.tosspayments.com/tmert';
-                                        $pg_test .= ' 테스트 ';
-                                    }
-                                    break;
                                 case 'inicis':
                                     $pg_url  = 'https://iniweb.inicis.com/';
-                                    $pg_test = 'KG이니시스';
+                                    $pg_test = 'KG이니시스 ';
                                     break;
                                 case 'KAKAOPAY':
                                     $pg_url  = 'https://mms.cnspay.co.kr';
-                                    $pg_test = 'KAKAOPAY';
+                                    $pg_test = 'KAKAOPAY ';
                                     break;
                                 case 'nicepay':
                                     $pg_url  = 'https://npg.nicepay.co.kr/';
-                                    $pg_test = 'NICEPAY';
+                                    $pg_test = 'NICEPAY ';
                                     break;
+                                case 'lg':
                                 case 'toss':
                                     $pg_url  = 'https://app.tosspayments.com';
                                     $pg_test = '토스페이먼츠 ';
+                                    // 상점관리자 로그인 후 상단 '테스트 모드' 활성화 시 테스트 화면 노출
                                     break;
                                 default:
-                                    $pg_url  = 'http://admin8.kcp.co.kr';
-                                    $pg_test = 'KCP';
+                                    $pg_url  = 'https://partner.kcp.co.kr';
+                                    $pg_test = 'KCP ';
                                     if ($default['de_card_test']) {
                                         // 로그인 아이디 / 비번
                                         // 일반 : test1234 / test12345
                                         // 에스크로 : escrow / escrow913
-                                        $pg_url = 'http://testadmin8.kcp.co.kr';
-                                        $pg_test .= ' 테스트 ';
+                                        $pg_url = 'https://testpartner.kcp.co.kr';
+                                        $pg_test .= '테스트 ';
                                     }
 
                                 }
@@ -1170,4 +1164,4 @@ function chk_receipt_price()
 </script>
 
 <?php
-include_once(G5_ADMIN_PATH.'/admin.tail.php');
+include_once(G5_ADMIN_PATH.'/admin.tail.php');

adm/shop_admin/orderformreceiptupdate.php

@@ -35,7 +35,7 @@ $check_keys = array(
 $posts = array();
 
 foreach($check_keys as $key){
-    $posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
+    $posts[$key] = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : '';
 }
 
 $od_send_mail = $posts['od_send_mail'];
@@ -175,4 +175,4 @@ if($posts['od_tno'] && $posts['od_escrow'] == 1)
 
 $qstr = "sort1=$sort1&sort2=$sort2&sel_field=$sel_field&search=$search&page=$page";
 
-goto_url("./orderform.php?od_id=$od_id&$qstr");
+goto_url("./orderform.php?od_id=$od_id&$qstr");

adm/shop_admin/orderformupdate.php

@@ -4,7 +4,7 @@ include_once('./_common.php');
 
 check_admin_token();
 
-$od_shop_memo = isset($_POST['od_shop_memo']) ? strip_tags($_POST['od_shop_memo']) : '';
+$od_shop_memo = isset($_POST['od_shop_memo']) ? addslashes(strip_tags(stripslashes($_POST['od_shop_memo']))) : '';
 $od_id = isset($_POST['od_id']) ? safe_replace_regex($_POST['od_id'], 'od_id') : '';
 
 $search = isset($_REQUEST['search']) ? get_search_string($_REQUEST['search']) : '';
@@ -17,22 +17,22 @@ if(isset($_POST['mod_type']) && $_POST['mod_type'] === 'info') {
     $od_zip2   = isset($_POST['od_zip']) ? preg_replace('/[^0-9]/', '', substr($_POST['od_zip'], 3)) : '';
     $od_b_zip1 = isset($_POST['od_b_zip']) ? preg_replace('/[^0-9]/', '', substr($_POST['od_b_zip'], 0, 3)) : '';
     $od_b_zip2 = isset($_POST['od_b_zip']) ? preg_replace('/[^0-9]/', '', substr($_POST['od_b_zip'], 3)) : '';
-    $od_email = isset($_POST['od_email']) ? strip_tags(clean_xss_attributes($_POST['od_email'])) : '';
-    $od_name = isset($_POST['od_name']) ? clean_xss_tags($_POST['od_name'], 1, 1) : '';
-    $od_tel = isset($_POST['od_tel']) ? clean_xss_tags($_POST['od_tel'], 1, 1) : '';
-    $od_hp = isset($_POST['od_hp']) ? clean_xss_tags($_POST['od_hp'], 1, 1) : '';
-    $od_addr1 = isset($_POST['od_addr1']) ? clean_xss_tags($_POST['od_addr1'], 1, 1) : '';
-    $od_addr2 = isset($_POST['od_addr2']) ? clean_xss_tags($_POST['od_addr2'], 1, 1) : '';
-    $od_addr3 = isset($_POST['od_addr3']) ? clean_xss_tags($_POST['od_addr3'], 1, 1) : '';
-    $od_addr_jibeon = isset($_POST['od_addr_jibeon']) ? clean_xss_tags($_POST['od_addr_jibeon'], 1, 1) : '';
-    $od_b_name = isset($_POST['od_b_name']) ? clean_xss_tags($_POST['od_b_name'], 1, 1) : '';
-    $od_b_tel = isset($_POST['od_b_tel']) ? clean_xss_tags($_POST['od_b_tel'], 1, 1) : '';
-    $od_b_hp = isset($_POST['od_b_hp']) ? clean_xss_tags($_POST['od_b_hp'], 1, 1) : '';
-    $od_b_addr1 = isset($_POST['od_b_addr1']) ? clean_xss_tags($_POST['od_b_addr1'], 1, 1) : '';
-    $od_b_addr2 = isset($_POST['od_b_addr2']) ? clean_xss_tags($_POST['od_b_addr2'], 1, 1) : '';
-    $od_b_addr3 = isset($_POST['od_b_addr3']) ? clean_xss_tags($_POST['od_b_addr3'], 1, 1) : '';
-    $od_b_addr_jibeon = isset($_POST['od_b_addr_jibeon']) ? clean_xss_tags($_POST['od_b_addr_jibeon'], 1, 1) : '';
-    $od_hope_date = isset($_POST['od_hope_date']) ? clean_xss_tags($_POST['od_hope_date'], 1, 1) : '';
+    $od_email = isset($_POST['od_email']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['od_email'])))) : '';
+    $od_name = isset($_POST['od_name']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_name']), 1, 1)) : '';
+    $od_tel = isset($_POST['od_tel']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_tel']), 1, 1)) : '';
+    $od_hp = isset($_POST['od_hp']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_hp']), 1, 1)) : '';
+    $od_addr1 = isset($_POST['od_addr1']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_addr1']), 1, 1)) : '';
+    $od_addr2 = isset($_POST['od_addr2']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_addr2']), 1, 1)) : '';
+    $od_addr3 = isset($_POST['od_addr3']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_addr3']), 1, 1)) : '';
+    $od_addr_jibeon = isset($_POST['od_addr_jibeon']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_addr_jibeon']), 1, 1)) : '';
+    $od_b_name = isset($_POST['od_b_name']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_name']), 1, 1)) : '';
+    $od_b_tel = isset($_POST['od_b_tel']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_tel']), 1, 1)) : '';
+    $od_b_hp = isset($_POST['od_b_hp']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_hp']), 1, 1)) : '';
+    $od_b_addr1 = isset($_POST['od_b_addr1']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_addr1']), 1, 1)) : '';
+    $od_b_addr2 = isset($_POST['od_b_addr2']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_addr2']), 1, 1)) : '';
+    $od_b_addr3 = isset($_POST['od_b_addr3']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_addr3']), 1, 1)) : '';
+    $od_b_addr_jibeon = isset($_POST['od_b_addr_jibeon']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_b_addr_jibeon']), 1, 1)) : '';
+    $od_hope_date = isset($_POST['od_hope_date']) ? addslashes(clean_xss_tags(stripslashes($_POST['od_hope_date']), 1, 1)) : '';
 
     $sql = " update {$g5['g5_shop_order_table']}
                 set od_name = '$od_name',
@@ -66,4 +66,4 @@ sql_query($sql);
 
 $qstr = "sort1=$sort1&sort2=$sort2&sel_field=$sel_field&search=$search&page=$page";
 
-goto_url("./orderform.php?od_id=$od_id&$qstr");
+goto_url("./orderform.php?od_id=$od_id&$qstr");

adm/shop_admin/orderlist.php

@@ -26,8 +26,8 @@ $od_cancel_price = isset($_GET['od_cancel_price']) ? preg_replace('/[^0-9a-z]/i'
 $od_refund_price = isset($_GET['od_refund_price']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_refund_price']) : '';
 $od_receipt_point = isset($_GET['od_receipt_point']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_receipt_point']) : '';
 $od_coupon = isset($_GET['od_coupon']) ? preg_replace('/[^0-9a-z]/i', '', $_GET['od_coupon']) : ''; 
-$od_settle_case = isset($_GET['od_settle_case']) ? clean_xss_tags($_GET['od_settle_case'], 1, 1) : ''; 
-$od_escrow = isset($_GET['od_escrow']) ? clean_xss_tags($_GET['od_escrow'], 1, 1) : ''; 
+$od_settle_case = isset($_GET['od_settle_case']) ? addslashes(clean_xss_tags(stripslashes($_GET['od_settle_case']), 1, 1)) : '';
+$od_escrow = isset($_GET['od_escrow']) ? addslashes(clean_xss_tags(stripslashes($_GET['od_escrow']), 1, 1)) : '';
 
 $tot_itemcount = $tot_orderprice = $tot_receiptprice = $tot_ordercancel = $tot_misu = $tot_couponprice = 0;
 $sql_search = "";
@@ -350,7 +350,7 @@ if( function_exists('pg_setting_check') ){
         if($default['de_escrow_use'] && $row['od_escrow'])
             $od_paytype .= '<span class="list_escrow">에스크로</span>';
 
-        $uid = md5($row['od_id'].$row['od_time'].$row['od_ip']);
+        $uid = function_exists('get_shop_uid') ? get_shop_uid('order', $row['od_id'], $row['od_time'], $row['od_ip']) : md5($row['od_id'].$row['od_time'].$row['od_ip']);
 
         $invoice_time = is_null_time($row['od_invoice_time']) ? G5_TIME_YMDHIS : $row['od_invoice_time'];
         $delivery_company = $row['od_delivery_company'] ? $row['od_delivery_company'] : $default['de_delivery_company'];

adm/shop_admin/orderpartcancelupdate.php

@@ -4,6 +4,8 @@ include_once('./_common.php');
 
 auth_check_menu($auth, $sub_menu, "w");
 
+check_admin_token();
+
 $tax_mny = isset($_POST['mod_tax_mny']) ? preg_replace('/[^0-9]/', '', $_POST['mod_tax_mny']) : 0;
 $free_mny = isset($_POST['mod_free_mny']) ? preg_replace('/[^0-9]/', '', $_POST['mod_free_mny']) : 0;
 

adm/shop_admin/orderprintresult.php

@@ -118,21 +118,21 @@ if ($csv == 'csv')
         }
 
         echo '"\''.$row['od_b_zip1'].$row['od_b_zip2'].'"\''.',';
-        echo '"'.$pull_address.'"'.',';
-        echo '"'.$row['od_b_name'].'"'.',';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell($pull_address) : $pull_address).'"'.',';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell($row['od_b_name']) : $row['od_b_name']).'"'.',';
         //echo '"'.multibyte_digit((string)$row[od_b_tel]).'"'.',';
         //echo '"'.multibyte_digit((string)$row[od_b_hp]).'"'.',';
         echo '"'.conv_telno($row['od_b_tel']) . '"'.',';
         echo '"'.conv_telno($row['od_b_hp']) . '"'.',';
-        echo '"'.preg_replace("/\"/", """, $row['it_name']) . '"'.',';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell(preg_replace("/\"/", """, $row['it_name'])) : preg_replace("/\"/", """, $row['it_name'])) . '"'.',';
         echo '"'.$row['ct_qty'].'"'.',';
-        echo '"'.$row['ct_option'].'"'.',';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell($row['ct_option']) : $row['ct_option']).'"'.',';
         echo '"'.$ct_send_cost.'"'.',';
         echo '"\''.$row['it_id'].'\'"'.',';
         echo '"\''.$row['od_id'].'\'"'.',';
-        echo '"'.$row['od_invoice'].'"'.',';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell($row['od_invoice']) : $row['od_invoice']).'"'.',';
         //echo '"'.preg_replace("/\"/", """, preg_replace("/\n/", "", $row[od_memo])).'"';
-        echo '"'.preg_replace("/\"/", """, $row['od_memo']).'"';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell(preg_replace("/\"/", """, $row['od_memo'])) : preg_replace("/\"/", """, $row['od_memo'])).'"';
         echo "\n";
     }
     if ($i == 0)
@@ -217,18 +217,18 @@ if ($csv == 'xls')
             }
 
             $rows[] = array(' '.$row['od_b_zip1'].$row['od_b_zip2'],
-                            $pull_address,
-                            $row['od_b_name'], 
-                            ' '.conv_telno($row['od_b_tel']), 
-                            ' '.conv_telno($row['od_b_hp']), 
-                            preg_replace("/\"/", """, $row['it_name']), 
-                            ' '.$row['ct_qty'], 
-                            $row['ct_option'], 
+                            function_exists('csv_safe_cell') ? csv_safe_cell($pull_address) : $pull_address,
+                            function_exists('csv_safe_cell') ? csv_safe_cell($row['od_b_name']) : $row['od_b_name'],
+                            ' '.conv_telno($row['od_b_tel']),
+                            ' '.conv_telno($row['od_b_hp']),
+                            function_exists('csv_safe_cell') ? csv_safe_cell(preg_replace("/\"/", """, $row['it_name'])) : preg_replace("/\"/", """, $row['it_name']),
+                            ' '.$row['ct_qty'],
+                            function_exists('csv_safe_cell') ? csv_safe_cell($row['ct_option']) : $row['ct_option'],
                             $ct_send_cost,
                             ' '.$row['it_id'],
                             ' '.$row['od_id'],
                             ' '.$row['od_invoice'],
-                            preg_replace("/\"/", """, $row['od_memo']));
+                            function_exists('csv_safe_cell') ? csv_safe_cell(preg_replace("/\"/", """, $row['od_memo'])) : preg_replace("/\"/", """, $row['od_memo']));
         }
 
         $data = array_merge(array($headers), $rows);

adm/shop_admin/personalpayformupdate.php

@@ -4,7 +4,7 @@ include_once('./_common.php');
 
 check_admin_token();
 
-$pp_name = isset($_POST['pp_name']) ? strip_tags(clean_xss_attributes($_POST['pp_name'])) : '';
+$pp_name = isset($_POST['pp_name']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_POST['pp_name'])))) : '';
 $pp_id = isset($_REQUEST['pp_id']) ? preg_replace('/[^0-9]/', '', $_REQUEST['pp_id']) : 0;
 $pp_price = isset($_POST['pp_price']) ? preg_replace('/[^0-9]/', '', $_REQUEST['pp_price']) : 0;
 
@@ -40,8 +40,8 @@ if($w == 'd') {
 
     $post_pp_content = isset($_POST['pp_content']) ? $_POST['pp_content'] : '';
     $post_pp_receipt_price = isset($_POST['pp_receipt_price']) ? (int) $_POST['pp_receipt_price'] : 0;
-    $post_pp_settle_case = isset($_POST['pp_settle_case']) ? clean_xss_tags($_POST['pp_settle_case'], 1, 1) : '';
-    $post_pp_receipt_time = isset($_POST['pp_receipt_time']) ? clean_xss_tags($_POST['pp_receipt_time'], 1, 1) : '';
+    $post_pp_settle_case = isset($_POST['pp_settle_case']) ? addslashes(clean_xss_tags(stripslashes($_POST['pp_settle_case']), 1, 1)) : '';
+    $post_pp_receipt_time = isset($_POST['pp_receipt_time']) ? safe_replace_regex($_POST['pp_receipt_time'], 'time') : '';
     $post_pp_shop_memo = isset($_POST['pp_shop_memo']) ? $_POST['pp_shop_memo'] : '';
     $post_pp_use = isset($_POST['pp_use']) ? (int) $_POST['pp_use'] : 0;
 
@@ -79,4 +79,4 @@ if($w == '') {
 if($popup == 'yes')
     alert_close('개인결제가 추가됐습니다.');
 else
-    goto_url('./personalpayform.php?w=u&pp_id='.$pp_id.'&'.$qstr);
+    goto_url('./personalpayform.php?w=u&pp_id='.$pp_id.'&'.$qstr);

adm/shop_admin/personalpaylist.php

@@ -27,6 +27,9 @@ if (!$sst) {
     $sst  = "pp_id";
     $sod = "desc";
 }
+$allowed_sst = array('pp_id', 'od_id', 'pp_receipt_time');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'pp_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/shop_admin/sale1today.php

@@ -87,7 +87,7 @@ $result = sql_query($sql);
     ?>
         <tr>
             <td class="td_alignc"><a href="./orderform.php?od_id=<?php echo $row['od_id']; ?>"><?php echo $row['od_id']; ?></a></td>
-            <td class="td_name"><?php echo $href; ?><?php echo $row['od_name']; ?></a></td>
+            <td class="td_name"><?php echo $href; ?><?php echo get_text($row['od_name']); ?></a></td>
             <td class="td_numsum"><?php echo number_format($row['orderprice']); ?></td>
             <td class="td_numincome"><?php echo number_format($row['couponprice']); ?></td>
             <td class="td_numincome"><?php echo number_format($receipt_bank); ?></td>

adm/shop_admin/sendcostupdate.php

@@ -22,7 +22,7 @@ if($w == 'd') {
         sql_query(" delete from {$g5['g5_shop_sendcost_table']} where sc_id = '$sc_id' ");
     }
 } else {
-    $sc_name = isset($_POST['sc_name']) ? trim(strip_tags(clean_xss_attributes($_POST['sc_name']))) : '';
+    $sc_name = isset($_POST['sc_name']) ? addslashes(trim(strip_tags(clean_xss_attributes(stripslashes($_POST['sc_name']))))) : '';
     $sc_zip1 = isset($_POST['sc_zip1']) ? preg_replace('/[^0-9]/', '', $_POST['sc_zip1']) : '';
     $sc_zip2 = isset($_POST['sc_zip2']) ? preg_replace('/[^0-9]/', '', $_POST['sc_zip2']) : '';
     $sc_price = isset($_POST['sc_price']) ? preg_replace('/[^0-9]/', '', $_POST['sc_price']) : '';
@@ -43,4 +43,4 @@ if($w == 'd') {
     sql_query($sql);
 }
 
-goto_url('./sendcostlist.php?page='.$page);
+goto_url('./sendcostlist.php?page='.$page);

adm/shop_admin/wishlist.php

@@ -71,7 +71,9 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
         $len = strlen($row1['ca_id']) / 2 - 1;
         $nbsp = "";
         for ($i=0; $i<$len; $i++) $nbsp .= "&nbsp;&nbsp;&nbsp;";
-        echo "<option value='{$row1['ca_id']}'".get_selected($row1['ca_id'], $sel_ca_id).">$nbsp{$row1['ca_name']}\n";
+        // 전체 카테고리 경로 표시
+        $category_path = function_exists('get_shop_category_path') ? get_shop_category_path($row1['ca_id']) : $row1['ca_name'];
+        echo "<option value='{$row1['ca_id']}'".get_selected($row1['ca_id'], $sel_ca_id).">$nbsp{$category_path}\n";
     }
     ?>
 </select>

adm/sms_admin/_common.php

@@ -4,7 +4,7 @@ include_once ('../../common.php');
 include_once(G5_ADMIN_PATH.'/admin.lib.php');
 include_once(G5_SMS5_PATH.'/sms5.lib.php');
 
-if (!strstr($_SERVER['SCRIPT_NAME'], 'install.php')) {
+if (strpos($_SERVER['SCRIPT_NAME'], 'install.php') === false) {
     // SMS5 테이블 G5_TABLE_PREFIX 적용
     if($g5['sms5_prefix'] != 'sms5_' && sql_num_rows(sql_query("show tables like 'sms5_config'")))
     {

adm/sms_admin/config_update.php

@@ -10,14 +10,14 @@ check_admin_token();
 
 $g5['title'] = "SMS 기본설정";
 
-$cf_phone = isset($_REQUEST['cf_phone']) ? clean_xss_tags($_REQUEST['cf_phone'], 1, 1) : '';
-$cf_sms_use = isset($_REQUEST['cf_sms_use']) ? clean_xss_tags($_REQUEST['cf_sms_use'], 1, 1) : '';
-$cf_sms_type = isset($_REQUEST['cf_sms_type']) ? clean_xss_tags($_REQUEST['cf_sms_type'], 1, 1) : '';
-$cf_icode_id = isset($_REQUEST['cf_icode_id']) ? clean_xss_tags($_REQUEST['cf_icode_id'], 1, 1) : '';
-$cf_icode_pw = isset($_REQUEST['cf_icode_pw']) ? clean_xss_tags($_REQUEST['cf_icode_pw'], 1, 1) : '';
-$cf_icode_server_ip = isset($_REQUEST['cf_icode_server_ip']) ? clean_xss_tags($_REQUEST['cf_icode_server_ip'], 1, 1) : '';
+$cf_phone = isset($_REQUEST['cf_phone']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_phone']), 1, 1)) : '';
+$cf_sms_use = isset($_REQUEST['cf_sms_use']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_sms_use']), 1, 1)) : '';
+$cf_sms_type = isset($_REQUEST['cf_sms_type']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_sms_type']), 1, 1)) : '';
+$cf_icode_id = isset($_REQUEST['cf_icode_id']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_icode_id']), 1, 1)) : '';
+$cf_icode_pw = isset($_REQUEST['cf_icode_pw']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_icode_pw']), 1, 1)) : '';
+$cf_icode_server_ip = isset($_REQUEST['cf_icode_server_ip']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_icode_server_ip']), 1, 1)) : '';
 $cf_icode_server_port = isset($_REQUEST['cf_icode_server_port']) ? clean_xss_tags($_REQUEST['cf_icode_server_port'], 1, 1) : '';
-$cf_icode_token_key = isset($_REQUEST['cf_icode_token_key']) ? clean_xss_tags($_REQUEST['cf_icode_token_key'], 1, 1) : '';
+$cf_icode_token_key = isset($_REQUEST['cf_icode_token_key']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['cf_icode_token_key']), 1, 1)) : '';
 
 // 회신번호 체크
 if(!check_vaild_callback($cf_phone))

adm/sms_admin/form_list.php

@@ -22,13 +22,14 @@ else
 
 $st = clean_xss_tags($st);
 $sv = clean_xss_tags($sv);
+$sql_sv = sql_real_escape_string(stripslashes($sv));
 
 if ($st == 'all') {
-    $sql_search = "and (fo_name like '%{$sv}%' or fo_content like '%{$sv}%')";
+    $sql_search = "and (fo_name like '%{$sql_sv}%' or fo_content like '%{$sql_sv}%')";
 } else if ($st == 'name') {
-    $sql_search = "and fo_name like '%{$sv}%'";
+    $sql_search = "and fo_name like '%{$sql_sv}%'";
 } else if ($st == 'content') {
-    $sql_search = "and fo_content like '%{$sv}%'";
+    $sql_search = "and fo_content like '%{$sql_sv}%'";
 } else {
     $sql_search = '';
 }
@@ -65,7 +66,7 @@ function book_all_checked(chk)
 function book_del(fo_no)
 {
     if (confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n그래도 삭제하시겠습니까?"))
-        location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=<?php echo $page?>&fg_no=<?php echo $fg_no?>&st=<?php echo get_text($st); ?>&sv=<?php echo get_text($sv); ?>";
+        location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=<?php echo $page?>&fg_no=<?php echo $fg_no?>&st=<?php echo get_text($st); ?>&sv=<?php echo get_text($sv); ?>&token=<?php echo $token; ?>";
 }
 
 function multi_update(sel)
@@ -114,7 +115,7 @@ function multi_update(sel)
 <div class="local_sch01 local_sch sms_preset_sch">
     <form>
     <label for="fg_no" class="sound_only">그룹명</label>
-    <select name="fg_no" id="fg_no" onchange="location.href='<?php echo $_SERVER['SCRIPT_NAME']?>?fg_no='+this.value;">
+    <select name="fg_no" id="fg_no" onchange="location.href='<?php echo htmlspecialchars($_SERVER['SCRIPT_NAME'])?>?fg_no='+this.value;">
         <option value="" <?php echo $fg_no?'':'selected'?>> 전체 </option>
         <option value="0" <?php echo $fg_no=='0'?'selected':''?>> 미분류 (<?php echo number_format($no_count)?>) </option>
         <?php for($i=0; $i<count($group); $i++) {?>
@@ -238,4 +239,4 @@ function select_copy(sw, f) {
 <?php
 echo get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $page, $total_page, $_SERVER['SCRIPT_NAME']."?fg_no=$fg_no&amp;st=$st&amp;sv=$sv&amp;page=");
 
-include_once(G5_ADMIN_PATH.'/admin.tail.php');
+include_once(G5_ADMIN_PATH.'/admin.tail.php');

adm/sms_admin/form_update.php

@@ -4,8 +4,12 @@ include_once("./_common.php");
 
 auth_check_menu($auth, $sub_menu, "w");
 
-$fo_name = isset($_REQUEST['fo_name']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_name'])) : '';
-$fo_content = isset($_REQUEST['fo_content']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_content'])) : '';
+check_admin_token();
+
+$fo_no = isset($_REQUEST['fo_no']) ? (int) $_REQUEST['fo_no'] : 0;
+$fg_no = isset($_REQUEST['fg_no']) ? (int) $_REQUEST['fg_no'] : 0;
+$fo_name = isset($_REQUEST['fo_name']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_REQUEST['fo_name'])))) : '';
+$fo_content = isset($_REQUEST['fo_content']) ? addslashes(strip_tags(clean_xss_attributes(stripslashes($_REQUEST['fo_content'])))) : '';
 $fo_receipt = isset($_REQUEST['fo_receipt']) ? clean_xss_tags($_REQUEST['fo_receipt'], 1, 1) : '';
 $get_fg_no = '';
 
@@ -79,4 +83,4 @@ else // 등록
 }
 
 $go_url = './form_list.php?page='.$page.'&fg_no='.$get_fg_no;
-goto_url($go_url);
+goto_url($go_url);

adm/sms_admin/form_write.php

@@ -4,6 +4,8 @@ include_once("./_common.php");
 
 auth_check_menu($auth, $sub_menu, "w");
 
+$token = get_token();
+
 $g5['title'] = "이모티콘 ";
 
 $fo_no = isset($_REQUEST['fo_no']) ? (int) $_REQUEST['fo_no'] : 0;
@@ -34,6 +36,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
 <input type="hidden" name="page" value="<?php echo $page?>">
 <input type="hidden" name="fo_no" value="<?php echo $write['fo_no']; ?>">
 <input type="hidden" name="get_fg_no" value="<?php echo $fg_no?>">
+<input type="hidden" name="token" value="<?php echo $token; ?>">
 
     <div class="tbl_frm01 tbl_wrap">
     <table>

adm/sms_admin/history_view.php

@@ -161,11 +161,12 @@ function all_send()
     if( $write['wr_memo'] ){
         $tmp_wr_memo = @unserialize($write['wr_memo']);
         if( count($tmp_wr_memo) && is_array($tmp_wr_memo) ){
-            if(function_exists('array_fill_keys')){
-                $tmp_wr_hp = array_replace($tmp_wr_memo['hp'],array_fill_keys(array_keys($tmp_wr_memo['hp'], null),''));
-            } else {
-                $tmp_wr_hp = $tmp_wr_memo['hp'];
-            }
+            $tmp_wr_hp = $tmp_wr_memo['hp'];
+            if (is_array($tmp_wr_hp)) {
+                foreach (array_keys($tmp_wr_hp, null) as $empty_key) {
+                    $tmp_wr_hp[$empty_key] = '';
+                }
+            }
             $arr_wr_memo = @array_count_values( $tmp_wr_hp );
     ?>
     <h2>중복번호 <?php echo $tmp_wr_memo['total'];?>건</h2>
@@ -265,4 +266,4 @@ function all_send()
 <?php echo sms5_sub_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $spage, $total_spage, $_SERVER['SCRIPT_NAME']."?wr_no=$wr_no&amp;wr_renum=$wr_renum&amp;page=$page&amp;st=$st&amp;sv=$sv&amp;sst=$sst&amp;ssv=$ssv", "", "spage"); ?>
 
 <?php
-include_once(G5_ADMIN_PATH.'/admin.tail.php');
+include_once(G5_ADMIN_PATH.'/admin.tail.php');

adm/sms_admin/member_update.php

@@ -37,21 +37,39 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
     $( "#mb_update_form" ).submit(function( e ) {
         e.preventDefault();
         $("#res_msg").html('업데이트 중입니다. 잠시만 기다려 주십시오...');
-        var params = { mtype : 'json' };
+        var action = $(this).attr("action");
         $.ajax({
-            url: $(this).attr("action"),
-            cache:false,
-            timeout : 30000,
-            dataType:"json",
-            data:params,
-            success: function(data) {
-                if(data.error){
-                    alert( data.error );
+            url: '<?php echo G5_ADMIN_URL; ?>/ajax.token.php',
+            type: 'POST',
+            dataType: 'json',
+            data: { admin_csrf_token_key: '<?php echo admin_csrf_token_key(1); ?>' },
+            success: function(tokenData) {
+                if(tokenData.error){
+                    alert(tokenData.error);
                     $("#res_msg").html("");
-                } else {
-                    $("#datetime").html( data.datetime );
-                    $("#res_msg").html( data.res_msg );
+                    return;
                 }
+                $.ajax({
+                    url: action,
+                    type: 'POST',
+                    cache:false,
+                    timeout : 30000,
+                    dataType:"json",
+                    data: { mtype : 'json', token : tokenData.token },
+                    success: function(data) {
+                        if(data.error){
+                            alert( data.error );
+                            $("#res_msg").html("");
+                        } else {
+                            $("#datetime").html( data.datetime );
+                            $("#res_msg").html( data.res_msg );
+                        }
+                    },
+                    error: function (xhr, ajaxOptions, thrownError) {
+                        alert(xhr.status);
+                        alert(thrownError);
+                    }
+                });
             },
             error: function (xhr, ajaxOptions, thrownError) {
                 alert(xhr.status);

adm/sms_admin/member_update_run.php

@@ -26,6 +26,8 @@ if( $mtype == "json" ){
     auth_check_menu($auth, $sub_menu, "w");
 }
 
+check_admin_token();
+
 $count      = 0;
 $hp_yes     = 0;
 $hp_no      = 0;

adm/sms_admin/num_book.php

@@ -130,7 +130,7 @@ function no_hp_click(val)
 
 <form name="search_form" class="local_sch01 local_sch">
 <label for="bg_no" class="sound_only">그룹명</label>
-<select name="bg_no" id="bg_no" onchange="location.href='<?php echo $_SERVER['SCRIPT_NAME']?>?bg_no='+this.value;">
+<select name="bg_no" id="bg_no" onchange="location.href='<?php echo htmlspecialchars($_SERVER['SCRIPT_NAME'])?>?bg_no='+this.value;">
     <option value=""<?php echo get_selected('', $bg_no); ?>> 전체 </option>
     <option value="<?php echo $no_group['bg_no']?>"<?php echo get_selected($no_group['bg_no'], $bg_no); ?>> <?php echo $no_group['bg_name']?> (<?php echo number_format($no_group['bg_count'])?> 명) </option>
     <?php for($i=0; $i<count($group); $i++) {?>

adm/sms_admin/num_book_file_download.php

@@ -3,6 +3,7 @@ $sub_menu = "900900";
 include_once("./_common.php");
 
 $bg_no = isset($_REQUEST['bg_no']) ? clean_xss_tags($_REQUEST['bg_no'], 1, 1) : '';
+$bg_no = ($bg_no === 'all') ? 'all' : (int) $bg_no;
 $no_hp = isset($_REQUEST['no_hp']) ? clean_xss_tags($_REQUEST['no_hp'], 1, 1) : '';
 
 auth_check_menu($auth, $sub_menu, "r");
@@ -46,7 +47,7 @@ for($i=1; $res=sql_fetch_array($qry); $i++)
 
     if ($no_hp && $res['bk_hp'] != '' && !$hp) continue;
 
-    $rows[] = array($res['bk_name'], ' '.$hp);
+    $rows[] = array(function_exists('csv_safe_cell') ? csv_safe_cell($res['bk_name']) : $res['bk_name'], ' '.$hp);
 }
 
 $data = array_merge(array($headers), $rows);
@@ -66,4 +67,4 @@ header("Cache-Control: max-age=0");
 $writer = PHPExcel_IOFactory::createWriter($excel, 'Excel5');
 $writer->save('php://output');
 
-exit;
+exit;

adm/sms_admin/num_book_file_upload.php

@@ -4,7 +4,7 @@ include_once("./_common.php");
 
 auth_check_menu($auth, $sub_menu, "w");
 
-$upload_bg_no = isset($_REQUEST['upload_bg_no']) ? clean_xss_tags($_REQUEST['upload_bg_no'], 1, 1) : '';
+$upload_bg_no = isset($_REQUEST['upload_bg_no']) ? (int) $_REQUEST['upload_bg_no'] : 0;
 $confirm = isset($_REQUEST['confirm']) ? clean_xss_tags($_REQUEST['confirm'], 1, 1) : '';
 
 if (!$upload_bg_no)

adm/sms_admin/num_group_update.php

@@ -13,7 +13,7 @@ if ($w == 'u') // 업데이트
         // 실제 번호를 넘김
         $k = $post_chk[$i];
         $bg_no = isset($_POST['bg_no'][$k]) ? (int) $_POST['bg_no'][$k] : 0;
-        $bg_name = isset($_POST['bg_name'][$k]) ? strip_tags(clean_xss_attributes($_POST['bg_name'][$k])) : '';
+        $bg_name = isset($_POST['bg_name'][$k]) ? strip_tags(clean_xss_attributes(stripslashes($_POST['bg_name'][$k]))) : '';
 
         if (!is_numeric($bg_no))
             alert('그룹 고유번호가 없습니다.');
@@ -65,16 +65,16 @@ else if ($w == 'em') // 비우기
 }
 else // 등록
 {
-    $bg_name = isset($_REQUEST['bg_name']) ? strip_tags(clean_xss_attributes($_REQUEST['bg_name'])) : '';
+    $bg_name = isset($_REQUEST['bg_name']) ? strip_tags(clean_xss_attributes(stripslashes($_REQUEST['bg_name']))) : '';
 
     if (!strlen(trim($bg_name)))
         alert('그룹명을 입력해주세요');
 
-    $res = sql_fetch("select bg_name from {$g5['sms5_book_group_table']} where bg_name='$bg_name'");
+    $res = sql_fetch("select bg_name from {$g5['sms5_book_group_table']} where bg_name='".sql_real_escape_string($bg_name)."'");
     if ($res)
         alert('같은 그룹명이 존재합니다.');
 
-    sql_query("insert into {$g5['sms5_book_group_table']} set bg_name='$bg_name'");
+    sql_query("insert into {$g5['sms5_book_group_table']} set bg_name='".sql_real_escape_string($bg_name)."'");
 }
 
-goto_url('./num_group.php');
+goto_url('./num_group.php');

adm/sms_admin/sms_write_overlap_check.php

@@ -8,7 +8,7 @@ $list = $hps = array();
 
 $overlap = 0;
 
-$send_list = isset($_REQUEST['send_list']) ? clean_xss_tags($_REQUEST['send_list'], 1, 1) : '';
+$send_list = isset($_REQUEST['send_list']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['send_list']), 1, 1)) : '';
 
 if( !$send_list ){
     die("넘어온 데이터 값이 없습니다.");

adm/sms_admin/sms_write_send.php

@@ -25,8 +25,8 @@ if ( ! (($config['cf_icode_id'] && $config['cf_icode_pw']) || $config['cf_icode_
 }
 
 $wr_reply   = isset($_REQUEST['wr_reply']) ? preg_replace('#[^0-9\-]#', '', trim($_REQUEST['wr_reply'])) : '';
-$wr_message = isset($_REQUEST['wr_message']) ? clean_xss_tags(trim($_REQUEST['wr_message']), 1, 1, 0, 0) : '';
-$send_list = isset($_REQUEST['send_list']) ? clean_xss_tags(trim($_REQUEST['send_list']), 1, 1) : '';
+$wr_message = isset($_REQUEST['wr_message']) ? addslashes(clean_xss_tags(stripslashes(trim($_REQUEST['wr_message'])), 1, 1, 0, 0)) : '';
+$send_list = isset($_REQUEST['send_list']) ? addslashes(clean_xss_tags(stripslashes(trim($_REQUEST['send_list'])), 1, 1)) : '';
 
 $wr_by = isset($_REQUEST['wr_by']) ? clean_xss_tags(trim($_REQUEST['wr_by']), 1, 1) : '';
 $wr_bm = isset($_REQUEST['wr_bm']) ? clean_xss_tags(trim($_REQUEST['wr_bm']), 1, 1) : '';
@@ -125,7 +125,7 @@ while ($row = array_shift($send_list))
                     continue 2;
                 }
 
-                array_push($list, array('bk_hp' => $hp, 'bk_name' => $name));
+                array_push($list, array('bk_hp' => $hp, 'bk_name' => $name, 'mb_id' => '', 'bg_no' => '', 'bk_no' => ''));
                 array_push($hps, $hp);
                 break;