버전 5.6.12 수정

접근차단 ip 코드의 위치 다시 재수정
Merge branch 'master' of github.com:gnuboard/gnuboard5
2025-04-15 16:33:05 +09:00 · 2025-04-15 16:31:27 +09:00 · 2025-04-15 12:06:31 +09:00 · 2025-04-15 11:56:53 +09:00 · 2025-04-15 11:44:40 +09:00 · 2025-04-15 11:20:44 +09:00
59 changed files with 29017 additions and 28588 deletions
@@ -554,9 +554,18 @@ function admin_check_xss_params($params)

        if (is_array($value)) {
            admin_check_xss_params($value);
-        } else if ((preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/(onload|onerror)=.*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || (preg_match('/(onload|onerror|focus)=.*/ius', $value) && preg_match('/(eval|expression|exec|prompt)(\s*)\((.*)\)/ius', $value))) {
+        } else if (
+            (preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/on[a-z]+=*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || 
+            (preg_match('/(on[a-z]+|focus)=.*/ius', $value) && preg_match('/(eval|atob|fetch|expression|exec|prompt)(\s*)\((.*)\)/ius', $value))) {
            alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.', G5_URL);
            die();
+        } else if (preg_match('/atob\s*\(\s*[\'"]?([a-zA-Z0-9+\/=]+)[\'"]?\s*\)/ius', $value, $matches)) {
+            $decoded = base64_decode($matches[1], true);
+            if ($decoded && preg_match('/(eval|fetch|script|alert|settimeout|setinterval)/ius', $decoded)) {
+                // error_log("Base64 XSS 시도 감지: key=$key, decoded=$decoded, IP=" . $_SERVER['REMOTE_ADDR']);
+                alert('Base64로 인코딩된 위험한 스크립트가 발견되었습니다.', G5_URL);
+                die();
+            }
        }
    }

@@ -414,6 +414,14 @@ if (!isset($config['cf_cert_use_seed'])) {
            ADD COLUMN `cf_cert_use_seed` TINYINT(4) NOT NULL DEFAULT '1' AFTER `cf_cert_kg_mid`; ";
    sql_query($sql, false);
 }
+if (!isset($config['cf_cert_kcp_enckey'])) {
+    $sql = "ALTER TABLE `{$g5['config_table']}` 
+            ADD COLUMN `cf_cert_kcp_enckey` VARCHAR(100) NOT NULL DEFAULT '' AFTER `cf_cert_kcp_cd`; ";
+    sql_query($sql, false);
+    
+    $config['cf_cert_kcp_enckey'] = '';
+}
+
 if (!$config['cf_faq_skin']) {
    $config['cf_faq_skin'] = "basic";
 }
@@ -1066,6 +1074,13 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                            <input type="text" name="cf_cert_kcp_cd" value="<?php echo get_sanitize_input($config['cf_cert_kcp_cd']); ?>" id="cf_cert_kcp_cd" class="frm_input" size="3"> <a href="http://sir.kr/main/service/p_cert.php" target="_blank" class="btn_frmline">NHN KCP 휴대폰 본인확인 서비스 신청페이지</a>
                        </td>
                    </tr>
+                    <tr>
+                        <th scope="row" class="cf_cert_service"><label for="cf_cert_kcp_enckey">NHN KCP 가맹점 인증키</label></th>
+                        <td class="cf_cert_service">
+                            <?php echo help('(선택사항, 추후 NHN_KCP 상점관리자에서 인증키 발급 메뉴 오픈일정 이후부터 적용되는 내용입니다.)<br>NHN_KCP 상점관리자 > 기술관리센터 > 인증센터 > 가맹점 인증키관리 에서 인증키 발급 후에 인증키 정보를 입력') ?>
+                            <input type="text" name="cf_cert_kcp_enckey" value="<?php echo get_sanitize_input($config['cf_cert_kcp_enckey']); ?>" id="cf_cert_kcp_enckey" class="frm_input" maxlength="100" size="40"> <a href="https://partner.kcp.co.kr" target="_blank" class="btn_frmline">NHN KCP 상점관리자</a>
+                        </td>
+                    </tr>
                    <tr>
                        <th scope="row" class="cf_cert_service"><label for="cf_cert_limit">본인확인 이용제한</label></th>
                        <td class="cf_cert_service">
@@ -1542,7 +1557,17 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
            </table>
        </div>
    </section>
-
+    
+    <div id="config_captcha_wrap" style="display:none">
+        <h2>캡챠입력</h2>
+        <?php
+        require_once G5_CAPTCHA_PATH . '/captcha.lib.php';
+        $captcha_html = captcha_html();
+        $captcha_js   = chk_captcha_js();
+        echo $captcha_html;
+        ?>
+    </div>
+    
    <div class="btn_fixed_top btn_confirm">
        <input type="submit" value="확인" class="btn_submit btn" accesskey="s">
    </div>
@@ -1614,10 +1639,61 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
        });
    });

+    // 각 요소의 초기값 저장
+    var initialValues = {
+        cf_admin: $('#cf_admin').val(),
+        cf_analytics: $('#cf_analytics').val(),
+        cf_add_meta: $('#cf_add_meta').val(),
+        cf_add_script: $('#cf_add_script').val()
+    };
+
+    function check_config_captcha_open() {
+        var isChanged = false;
+
+        // 현재 값이 있는 경우에만 변경 여부 체크
+        if ($('#cf_admin').val()) {
+            isChanged = isChanged || $('#cf_admin').val() !== initialValues.cf_admin;
+        }
+        if ($('#cf_analytics').val()) {
+            isChanged = isChanged || $('#cf_analytics').val() !== initialValues.cf_analytics;
+        }
+        if ($('#cf_add_meta').val()) {
+            isChanged = isChanged || $('#cf_add_meta').val() !== initialValues.cf_add_meta;
+        }
+        if ($('#cf_add_script').val()) {
+            isChanged = isChanged || $('#cf_add_script').val() !== initialValues.cf_add_script;
+        }
+        
+        var $wrap = $("#config_captcha_wrap"),
+            tooptipid = "mp_captcha_tooltip",
+            $p_text = $("<p>", {id:tooptipid, style:"font-size:0.95em;letter-spacing:-0.1em"}).html("중요정보를 수정할 경우 캡챠를 입력해야 합니다."),
+            $children = $wrap.children(':first'),
+            is_invisible_recaptcha = $("#captcha").hasClass("invisible_recaptcha");
+
+        if(isChanged){
+            $wrap.show();
+            if(! is_invisible_recaptcha) {
+                $wrap.css("margin-top","1em");
+                if(! $("#"+tooptipid).length){ $children.after($p_text) }
+            }
+        } else {
+            $wrap.hide();
+            if($("#"+tooptipid).length && ! is_invisible_recaptcha){ $children.next("#"+tooptipid).remove(); }
+        }
+        
+        return isChanged;
+    }
+        
    function fconfigform_submit(f) {
        var current_user_ip = "<?php echo $_SERVER['REMOTE_ADDR']; ?>";
        var cf_intercept_ip_val = f.cf_intercept_ip.value;
-
+        
+        if (check_config_captcha_open()){
+            jQuery("html, body").scrollTop(jQuery("#config_captcha_wrap").offset().top);
+            
+            <?php echo $captcha_js; // 캡챠 사용시 자바스크립트에서 입력된 캡챠를 검사함 ?>
+        }
+        
        if (cf_intercept_ip_val && current_user_ip) {
            var cf_intercept_ips = cf_intercept_ip_val.split("\n");

@@ -1638,6 +1714,22 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
        f.action = "./config_form_update.php";
        return true;
    }
+    
+    jQuery(function($){
+        $("#captcha_key").prop('required', false).removeAttr("required").removeClass("required");
+        
+        // 최고관리자 변경시
+        $(document).on('change', '#cf_admin', check_config_captcha_open);
+
+        // 방문자분석 스크립트 변경시
+        $(document).on('input', '#cf_analytics', check_config_captcha_open);
+        
+        // 추가 메타태그 변경시
+        $(document).on('input', '#cf_add_meta', check_config_captcha_open);
+        
+        // 추가 script, css 변경시
+        $(document).on('input', '#cf_add_script', check_config_captcha_open);
+    });
 </script>

 <?php
@@ -1669,16 +1761,19 @@ if ($config['cf_cert_use']) {

    // kcp일 때
    if ($config['cf_cert_hp'] == 'kcp') {
+        
+        $bin_path = ((int)$config['cf_cert_use'] === 2 && !$config['cf_cert_kcp_enckey']) ? 'bin_old' : 'bin';
+        
        if (strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
            if (PHP_INT_MAX == 2147483647) { // 32-bit
-                $exe = G5_KCPCERT_PATH . '/bin/ct_cli';
+                $exe = G5_KCPCERT_PATH . '/'.$bin_path.'/ct_cli';
            } else {
-                $exe = G5_KCPCERT_PATH . '/bin/ct_cli_x64';
+                $exe = G5_KCPCERT_PATH . '/'.$bin_path.'/ct_cli_x64';
            }
        } else {
-            $exe = G5_KCPCERT_PATH . '/bin/ct_cli_exe.exe';
+            $exe = G5_KCPCERT_PATH . '/'.$bin_path.'/ct_cli_exe.exe';
        }
-
+        
        echo module_exec_check($exe, 'ct_cli');
    }

@@ -10,6 +10,9 @@ if ($is_admin != 'super') {
    alert('최고관리자만 접근 가능합니다.');
 }

+$sql = " select * from {$g5['config_table']} limit 1";
+$ori_config = sql_fetch($sql);
+
 $cf_title = isset($_POST['cf_title']) ? strip_tags(clean_xss_attributes($_POST['cf_title'])) : '';
 $cf_admin = isset($_POST['cf_admin']) ? clean_xss_tags($_POST['cf_admin'], 1, 1) : '';

@@ -23,7 +26,7 @@ check_admin_token();

 $cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',', $_POST['cf_social_servicelist']) : '';

-$check_keys = array('cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret', 'cf_cert_kg_cd', 'cf_cert_kg_mid');
+$check_keys = array('cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_cert_kcp_enckey', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret', 'cf_cert_kg_cd', 'cf_cert_kg_mid');

 foreach ($check_keys as $key) {
    if (isset($_POST[$key]) && $_POST[$key]) {
@@ -185,6 +188,33 @@ if (!$_POST['cf_cert_use']) {
   $_POST['cf_cert_simple'] = '';
 }

+// 관리자가 자동등록방지를 사용해야 할 경우 ( 기본환경설정에서 최고관리자, 방문자분석 스크립트, 추가 메타태그, 추가 script, css 변경시 )
+$check_captcha = 0;
+
+if ($cf_admin && $ori_config['cf_admin'] !== $cf_admin) {
+    $check_captcha = 1;
+}
+
+if ($_POST['cf_analytics'] && $ori_config['cf_analytics'] !== stripslashes($_POST['cf_analytics'])) {
+    $check_captcha = 1;
+}
+
+if ($_POST['cf_add_meta'] && $ori_config['cf_add_meta'] !== stripslashes($_POST['cf_add_meta'])) {
+    $check_captcha = 1;
+}
+
+if ($_POST['cf_add_script'] && $ori_config['cf_add_script'] !== stripslashes($_POST['cf_add_script'])) {
+    $check_captcha = 1;
+}
+
+if ($check_captcha) {
+    include_once(G5_CAPTCHA_PATH . '/captcha.lib.php');
+
+    if (!chk_captcha()) {
+        alert('자동등록방지 숫자가 틀렸습니다.');
+    }
+}
+
 $sql = " update {$g5['config_table']}
            set cf_title = '{$cf_title}',
                cf_admin = '{$cf_admin}',
@@ -289,6 +319,7 @@ $sql = " update {$g5['config_table']}
                cf_cert_kg_mid = '" . trim($_POST['cf_cert_kg_mid']) . "',
                cf_cert_kcb_cd = '{$_POST['cf_cert_kcb_cd']}',
                cf_cert_kcp_cd = '{$_POST['cf_cert_kcp_cd']}',
+                cf_cert_kcp_enckey = '{$_POST['cf_cert_kcp_enckey']}',
                cf_cert_limit = '{$_POST['cf_cert_limit']}',
                cf_cert_req = '{$_POST['cf_cert_req']}',
                cf_sms_use = '{$_POST['cf_sms_use']}',
@@ -345,6 +376,10 @@ if (isset($_POST['cf_bbs_rewrite'])) {
    g5_delete_all_cache();
 }

+if (function_exists('get_admin_captcha_by')) {
+    get_admin_captcha_by('remove');
+}
+
 run_event('admin_config_form_update');

 update_rewrite_rules();
@@ -455,7 +455,7 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                <?php if ($config['cf_use_recommend']) { // 추천인 사용 ?>
                    <tr>
                        <th scope="row">추천인</th>
-                        <td colspan="3"><?php echo ($mb['mb_recommend'] ? get_text($mb['mb_recommend']) : '없음'); // 081022 : CSRF 보안 결함으로 인한 코드 수정 ?></td>
+                        <td colspan="3"><?php echo ((isset($mb['mb_recommend']) && $mb['mb_recommend']) ? get_text($mb['mb_recommend']) : '없음'); // 081022 : CSRF 보안 결함으로 인한 코드 수정 ?></td>
                    </tr>
                <?php } ?>

@@ -19,7 +19,7 @@ $mb_certify     = isset($_POST['mb_certify']) ? preg_replace('/[^0-9a-z_]/i', ''
 $mb_zip         = isset($_POST['mb_zip']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_zip']) : '';

 // 관리자가 자동등록방지를 사용해야 할 경우 ( 회원의 비밀번호 변경시 캡챠를 체크한다 )
-if ($mb_password && function_exists('get_admin_captcha_by') && get_admin_captcha_by()) {
+if ($mb_password) {
    include_once(G5_CAPTCHA_PATH . '/captcha.lib.php');

    if (!chk_captcha()) {
@@ -1067,7 +1067,7 @@ if(!$default['de_kakaopay_cancelpwd']){
                    <a href="http://testadmin8.kcp.co.kr/" target="_blank" class="btn_frmline">테스트 관리자</a>
                </div>
                <div class="scf_cardtest lg_cardtest">
-                    <a href="https://pgweb.tosspayments.com/" target="_blank" class="btn_frmline">실결제 관리자</a>
+                    <a href="https://app.tosspayments.com/" target="_blank" class="btn_frmline">실결제 관리자</a>
                    <a href="https://pgweb.tosspayments.com/tmert" target="_blank" class="btn_frmline">테스트 관리자</a>
                </div>
                <div class="scf_cardtest inicis_cardtest">
@@ -1093,7 +1093,7 @@ if(!$default['de_kakaopay_cancelpwd']){
                        <li><b>일반결제</b>의 테스트 사이트코드는 <b>T0000</b> 이며, <b>에스크로 결제</b>의 테스트 사이트코드는 <b>T0007</b> 입니다.</li>
                    </ul>
                    <ul id="lg_cardtest_tip" class="scf_cardtest_tip_adm scf_cardtest_tip_adm_hide">
-                        <li>테스트결제의 <a href="http://pgweb.dacom.net:7085/" target="_blank">상점관리자</a> 로그인 정보는 토스페이먼츠 상점아이디 첫 글자에 t를 추가해서 로그인하시기 바랍니다. 예) tsi_lguplus</li>
+                        <li>테스트결제의 <a href="https://pgweb.tosspayments.com/tmert" target="_blank">상점관리자</a> 로그인 정보는 토스페이먼츠 상점아이디 첫 글자에 t를 추가해서 로그인하시기 바랍니다. 예) tsi_lguplus</li>
                    </ul>
                    <ul id="inicis_cardtest_tip" class="scf_cardtest_tip_adm scf_cardtest_tip_adm_hide">
                        <li><b>일반결제</b>의 테스트 사이트 mid는 <b>INIpayTest</b> 이며, <b>에스크로 결제</b>의 테스트 사이트 mid는 <b>iniescrow0</b> 입니다.</li>
@@ -46,13 +46,13 @@ include_once(G5_PLUGIN_PATH.'/jquery-ui/datepicker.php');
 ?>

 <form name="fcouponform" action="./couponformupdate.php" method="post" onsubmit="return form_check(this);">
-<input type="hidden" name="w" value="<?php echo $w; ?>">
-<input type="hidden" name="cp_id" value="<?php echo $cp_id; ?>">
-<input type="hidden" name="sst" value="<?php echo $sst; ?>">
-<input type="hidden" name="sod" value="<?php echo $sod; ?>">
-<input type="hidden" name="sfl" value="<?php echo $sfl; ?>">
-<input type="hidden" name="stx" value="<?php echo $stx; ?>">
-<input type="hidden" name="page" value="<?php echo $page;?>">
+<input type="hidden" name="w" value="<?php echo get_sanitize_input($w); ?>">
+<input type="hidden" name="cp_id" value="<?php echo get_sanitize_input($cp_id); ?>">
+<input type="hidden" name="sst" value="<?php echo get_sanitize_input($sst); ?>">
+<input type="hidden" name="sod" value="<?php echo get_sanitize_input($sod); ?>">
+<input type="hidden" name="sfl" value="<?php echo get_sanitize_input($sfl); ?>">
+<input type="hidden" name="stx" value="<?php echo get_sanitize_input($stx); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page);?>">

 <div class="tbl_frm01 tbl_wrap">
    <table>
@@ -68,10 +68,10 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>

 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="sort1" value="<?php echo $sort1; ?>">
-<input type="hidden" name="sort2" value="<?php echo $sort2; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="sort1" value="<?php echo get_sanitize_input($sort1); ?>">
+<input type="hidden" name="sort2" value="<?php echo get_sanitize_input($sort2); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">

 <label for="sel_ca_id" class="sound_only">검색대상</label>
 <select name="sel_ca_id" id="sel_ca_id">
@@ -67,10 +67,10 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>

 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="sort1" value="<?php echo $sort1; ?>">
-<input type="hidden" name="sort2" value="<?php echo $sort2; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="sort1" value="<?php echo get_sanitize_input($sort1); ?>">
+<input type="hidden" name="sort2" value="<?php echo get_sanitize_input($sort2); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">

 <label for="sel_ca_id" class="sound_only">분류선택</label>
 <select name="sel_ca_id" id="sel_ca_id">
@@ -74,10 +74,10 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>

 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="sort1" value="<?php echo $sort1; ?>">
-<input type="hidden" name="sort2" value="<?php echo $sort2; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="sort1" value="<?php echo get_sanitize_input($sort1); ?>">
+<input type="hidden" name="sort2" value="<?php echo get_sanitize_input($sort2); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">

 <label for="sel_field" class="sound_only">검색대상</label>
 <select name="sel_field" id="sel_field">
@@ -85,8 +85,8 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>

 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">

 <label for="sca" class="sound_only">분류선택</label>
 <select name="sca" id="sca">
@@ -69,10 +69,10 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>

 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="sort1" value="<?php echo $sort1; ?>">
-<input type="hidden" name="sort2" value="<?php echo $sort2; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="sort1" value="<?php echo get_sanitize_input($sort1); ?>">
+<input type="hidden" name="sort2" value="<?php echo get_sanitize_input($sort2); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">

 <label for="sel_ca_id" class="sound_only">분류선택</label>
 <select name="sel_ca_id" id="sel_ca_id">
@@ -510,10 +510,10 @@ add_javascript(G5_POSTCODE_JS, 0);    //다음 주소 js
                        if ($od['od_settle_case'] != '무통장') {
                            switch($od['od_pg']) {
                                case 'lg':
-                                    $pg_url  = 'http://pgweb.tosspayments.com';
+                                    $pg_url  = 'https://app.tosspayments.com';
                                    $pg_test = '토스페이먼츠';
                                    if ($default['de_card_test']) {
-                                        $pg_url = 'http://pgweb.tosspayments.com/tmert';
+                                        $pg_url = 'https://pgweb.tosspayments.com/tmert';
                                        $pg_test .= ' 테스트 ';
                                    }
                                    break;
@@ -160,11 +160,11 @@ if( function_exists('pg_setting_check') ){
 </div>

 <form name="frmorderlist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="sort1" value="<?php echo $sort1; ?>">
-<input type="hidden" name="sort2" value="<?php echo $sort2; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
-<input type="hidden" name="save_search" value="<?php echo $search; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="sort1" value="<?php echo get_sanitize_input($sort1); ?>">
+<input type="hidden" name="sort2" value="<?php echo get_sanitize_input($sort2); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
+<input type="hidden" name="save_search" value="<?php echo get_sanitize_input($search); ?>">

 <label for="sel_field" class="sound_only">검색대상</label>
 <select name="sel_field" id="sel_field">
@@ -49,7 +49,7 @@ if ($csv == 'csv')
    $to_date = date_conv($to_date);


-    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, a.od_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
+    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
               FROM {$g5['g5_shop_order_table']} a, {$g5['g5_shop_cart_table']} b
              where a.od_id = b.od_id ";
    if ($case == 1) // 출력기간
@@ -65,7 +65,7 @@ if ($csv == 'csv')
        alert("출력할 내역이 없습니다.");

    //header('Content-Type: text/x-csv');
-    header("Content-charset=utf-8");
+    header("Content-Type: text/csv; charset=utf-8");
    header('Content-Type: doesn/matter');
    header('Expires: ' . gmdate('D, d M Y H:i:s') . ' GMT');
    header('Content-Disposition: attachment; filename="orderlist-' . date("ymd", time()) . '.csv"');
@@ -153,7 +153,7 @@ if ($csv == 'xls')
    $fr_date = date_conv($fr_date);
    $to_date = date_conv($to_date);

-    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, a.od_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
+    $sql = " SELECT a.od_id, od_b_zip1, od_b_zip2, od_b_addr1, od_b_addr2, od_b_addr3, od_b_addr_jibeon, od_b_name, od_b_tel, od_b_hp, b.it_name, ct_qty, b.it_id, od_memo, od_invoice, b.ct_option, b.ct_send_cost, b.it_sc_type
               FROM {$g5['g5_shop_order_table']} a, {$g5['g5_shop_cart_table']} b
              where a.od_id = b.od_id ";
    if ($case == 1) // 출력기간
@@ -58,8 +58,8 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'" class="ov_listall">전체목
 </div>

 <form name="flist" class="local_sch01 local_sch">
-<input type="hidden" name="doc" value="<?php echo $doc; ?>">
-<input type="hidden" name="page" value="<?php echo $page; ?>">
+<input type="hidden" name="doc" value="<?php echo get_sanitize_input($doc); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">

 <label for="sel_ca_id" class="sound_only">검색대상</label>
 <select name="sel_ca_id" id="sel_ca_id">
@@ -3,6 +3,7 @@
 include_once('./_common.php');

 $comment_id = isset($_REQUEST['comment_id']) ? (int) $_REQUEST['comment_id'] : 0;
+$token = isset($_REQUEST['token']) ? clean_xss_tags($_REQUEST['token']) : 0;

 $delete_comment_token = get_session('ss_delete_comment_'.$comment_id.'_token');
 set_session('ss_delete_comment_'.$comment_id.'_token', '');
@@ -23,7 +23,7 @@ switch ($w) {
        break;
    case 's' :
        // 비밀번호 창에서 로그인 하는 경우 관리자 또는 자신의 글이면 바로 글보기로 감
-        if ($is_admin || ($member['mb_id'] == $write['mb_id'] && $write['mb_id']))
+        if ($is_admin || (isset($write['mb_id']) && $write['mb_id'] && $member['mb_id'] == $write['mb_id']))
            goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id));
        else {
            $action = https_url(G5_BBS_DIR).'/password_check.php';
@@ -32,7 +32,7 @@ switch ($w) {
        break;
    case 'sc' :
        // 비밀번호 창에서 로그인 하는 경우 관리자 또는 자신의 글이면 바로 글보기로 감
-        if ($is_admin || ($member['mb_id'] == $write['mb_id'] && $write['mb_id']))
+        if ($is_admin || (isset($write['mb_id']) && $write['mb_id'] && $member['mb_id'] == $write['mb_id']))
            goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?bo_table='.$bo_table.'&amp;wr_id='.$wr_id));
        else {
            $action = https_url(G5_BBS_DIR).'/password_check.php';
@@ -338,7 +338,7 @@ if ($w == '') {
        $sql_nick_date =  " , mb_nick_date = '".G5_TIME_YMD."' ";

    $sql_open_date = "";
-    if ($mb_open_default != $mb_open)
+    if (isset($mb_open_default) && $mb_open_default != $mb_open)
        $sql_open_date =  " , mb_open_date = '".G5_TIME_YMD."' ";

    // 이전 메일주소와 수정한 메일주소가 틀리다면 인증을 다시 해야하므로 값을 삭제
@@ -531,7 +531,7 @@ if ($config['cf_use_email_certify'] && $old_email != $mb_email) {


 // 신규회원 쿠폰발생
-if($w == '' && $default['de_member_reg_coupon_use'] && $default['de_member_reg_coupon_term'] > 0 && $default['de_member_reg_coupon_price'] > 0) {
+if($w == '' && isset($default['de_member_reg_coupon_use']) && $default['de_member_reg_coupon_use'] && $default['de_member_reg_coupon_term'] > 0 && $default['de_member_reg_coupon_price'] > 0) {
    $j = 0;
    $create_coupon = false;

@@ -5,7 +5,7 @@ if (isset($_SESSION['ss_mb_reg']))
    $mb = get_member($_SESSION['ss_mb_reg']);

 // 회원정보가 없다면 초기 페이지로 이동
-if (!$mb['mb_id'])
+if (!(isset($mb['mb_id']) && $mb['mb_id']))
    goto_url(G5_URL);

 $g5['title'] = '회원가입 완료';
@@ -31,6 +31,9 @@ $wr_subject = '';
 if (isset($_POST['wr_subject'])) {
    $wr_subject = substr(trim($_POST['wr_subject']),0,255);
    $wr_subject = preg_replace("#[\\\]+$#", "", $wr_subject);
+    if (function_exists('normalize_utf8_string')) {
+        $wr_subject = normalize_utf8_string($wr_subject);
+    }
 }
 if ($wr_subject == '') {
    $msg[] = '<strong>제목</strong>을 입력하세요.';
@@ -40,6 +43,9 @@ $wr_content = '';
 if (isset($_POST['wr_content'])) {
    $wr_content = substr(trim($_POST['wr_content']),0,65536);
    $wr_content = preg_replace("#[\\\]+$#", "", $wr_content);
+    if (function_exists('normalize_utf8_string')) {
+        $wr_content = normalize_utf8_string($wr_content);
+    }
 }
 if ($wr_content == '') {
    $msg[] = '<strong>내용</strong>을 입력하세요.';
@@ -679,7 +685,7 @@ sql_query(" delete from {$g5['autosave_table']} where as_uid = '{$uid}' ");

 // 비밀글이라면 세션에 비밀글의 아이디를 저장한다. 자신의 글은 다시 비밀번호를 묻지 않기 위함
 if ($secret) {
-    if (! $wr_num) {
+    if (!(isset($wr_num) && $wr_num)) {
        $write = get_write($write_table, $wr_id, true);
        $wr_num = $write['wr_num'];
    }
@@ -0,0 +1,110 @@
+<?php
+// CloudFlare를 사용시, 사용자 환경에 맞는 $_SERVER['REMOTE_ADDR']과 $_SERVER['HTTPS'] 사용 여부를 수정합니다.
+class G5CloudflareRequestHandler {
+    public static function check_cloudflare_ips($user_ip){
+        
+        // 클라우드플레어 IP, https://www.cloudflare.com/ips
+        $cloudflare_ips = array(
+            // IPv4
+            '173.245.48.0/20',
+            '103.21.244.0/22',
+            '103.22.200.0/22',
+            '103.31.4.0/22',
+            '141.101.64.0/18',
+            '108.162.192.0/18',
+            '190.93.240.0/20',
+            '188.114.96.0/20',
+            '197.234.240.0/22',
+            '198.41.128.0/17',
+            '162.158.0.0/15',
+            '104.16.0.0/12',
+            '104.24.0.0/14',
+            '172.64.0.0/13',
+            '131.0.72.0/22',
+            // IPv6
+            '2400:cb00::/32',
+            '2606:4700::/32',
+            '2803:f800::/32',
+            '2405:b500::/32',
+            '2405:8100::/32',
+            '2a06:98c0::/29',
+            '2c0f:f248::/32',
+        );
+            
+        // 사용자 IP가 Cloudflare IP 대역 범위에 있는지 확인
+        $is_cloudflare_ip = false;
+        foreach ($cloudflare_ips as $cidr) {
+            if (self::ip_in_range($user_ip, $cidr)) {
+                $is_cloudflare_ip = true;
+                break;
+            }
+        }
+        
+        return $is_cloudflare_ip;
+    }
+
+    // IP 주소가 CIDR 범위 내에 있는지 확인하는 함수 (IPv4, IPv6 모두 가능)
+    public static function ip_in_range($ip, $range) {
+        // IPv4와 IPv6를 구분
+        if (strpos($range, ':') === false && preg_match('/^([0-9]{1,3}\.){3}[0-9]{1,3}$/', $ip)) {
+            // IPv4 처리
+            return self::ipv4_in_range($ip, $range);
+        } elseif (strpos($range, ':') !== false && strpos($ip, ':') !== false) {
+            // IPv6 처리
+            return self::ipv6_in_range($ip, $range);
+        }
+        
+        return false;
+    }
+
+    // IPv4 CIDR 범위 검사
+    public static function ipv4_in_range($ip, $range) {
+        list($range, $netmask) = explode('/', $range, 2);
+        $range_decimal = ip2long($range);
+        $ip_decimal = ip2long($ip);
+        $wildcard_decimal = pow(2, (32 - $netmask)) - 1;
+        $netmask_decimal = ~$wildcard_decimal;
+        
+        return (($ip_decimal & $netmask_decimal) == ($range_decimal & $netmask_decimal));
+    }
+
+    // IPv6 CIDR 범위 검사
+    public static function ipv6_in_range($ip, $range) {
+        list($range_ip, $netmask) = explode('/', $range, 2);
+        $netmask = (int) $netmask;
+
+        $ip_bin = @inet_pton($ip);
+        $range_bin = @inet_pton($range_ip);
+        
+        // IPv6 주소는 128비트이므로, 비트마스크를 적용
+        $unpacked = unpack('A16', $ip_bin);
+        $ip_bits = $unpacked[1];
+        $unpacked2 = unpack('A16', $range_bin);
+        $range_bits = $unpacked2[1];
+
+        for ($i = 0; $i < (int)($netmask / 8); $i++) {
+            if ($ip_bits[$i] !== $range_bits[$i]) {
+                return false;
+            }
+        }
+
+        $remainder = $netmask % 8;
+        if ($remainder) {
+            $mask = 0xFF << (8 - $remainder);
+            return (ord($ip_bits[$i]) & $mask) === (ord($range_bits[$i]) & $mask);
+        }
+
+        return true;
+    }
+
+}
+if ($_SERVER['HTTP_CF_CONNECTING_IP'] && G5CloudflareRequestHandler::check_cloudflare_ips($_SERVER['REMOTE_ADDR'])) {
+    $_SERVER['REMOTE_ADDR'] = preg_replace('/[^0-9a-fA-F:.]/', '', $_SERVER['HTTP_CF_CONNECTING_IP']);
+    
+    // Cloudflare 환경을 고려한 https 사용여부
+    if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === "https") {
+        $_SERVER['HTTPS'] = 'on';
+    } elseif (isset($_SERVER['HTTP_CF_VISITOR']) && stripos($_SERVER['HTTP_CF_VISITOR'], 'https') !== false) {
+        $_SERVER['HTTPS'] = 'on';
+    }
+}
@@ -29,6 +29,10 @@ for ($i=0; $i<$ext_cnt; $i++) {
 }
 //==========================================================================================================================

+// Cloudflare 사용시 REMOTE_ADDR 에 사용자 IP 적용과 https 사용 여부
+if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
+    include_once('cloudflare.check.php');    // cloudflare 의 ip 대역인지 체크
+}

 function g5_path()
 {
@@ -62,16 +66,6 @@ if (!isset($_SERVER['SERVER_ADDR'])) {
    $_SERVER['SERVER_ADDR'] = isset($_SERVER['LOCAL_ADDR']) ? $_SERVER['LOCAL_ADDR'] : '';
 }

-// Cloudflare 환경을 고려한 https 사용여부
-if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === "https") {
-    $_SERVER['HTTPS'] = 'on';
-}
-
-// Cloudflare 사용시 REMOTE_ADDR 에 사용자 IP 적용
-if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
-    $_SERVER['REMOTE_ADDR'] = preg_replace('/[^0-9.]/', '', $_SERVER['HTTP_CF_CONNECTING_IP']);
-}
-
 // multi-dimensional array에 사용자지정 함수적용
 function array_map_deep($fn, $array)
 {
@@ -591,45 +585,6 @@ if (isset($_SESSION['ss_mb_id']) && $_SESSION['ss_mb_id']) { // 로그인중이
    // 자동로그인 end ---------------------------------------
 }

-
-/** @var array $write 글 데이터 */
-$write = array();
-/** @var string $write_table 게시판 테이블 전체이름 */
-$write_table = '';
-if ($bo_table) {
-    $board = get_board_db($bo_table, true);
-    if (isset($board['bo_table']) && $board['bo_table']) {
-        set_cookie("ck_bo_table", $board['bo_table'], 86400 * 1);
-        $gr_id = $board['gr_id'];
-        // 게시판 테이블 전체이름
-        $write_table = $g5['write_prefix'] . $bo_table; 
-
-        if (isset($wr_id) && $wr_id) {
-            $write = get_write($write_table, $wr_id);
-        } else if (isset($wr_seo_title) && $wr_seo_title) {
-            $write = get_content_by_field($write_table, 'bbs', 'wr_seo_title', generate_seo_title($wr_seo_title));
-            if (isset($write['wr_id'])) {
-                $wr_id = (int) $write['wr_id'];
-            }
-        }
-    }
-
-    // 게시판에서 사용하는 에디터를 설정
-    if (isset($board['bo_select_editor']) && $board['bo_select_editor']) {
-        $config['cf_editor'] = $board['bo_select_editor'];
-    }
-}
-
-if ($gr_id && !is_array($gr_id)) {
-    $group = get_group($gr_id, true);
-}
-
-if ($config['cf_editor']) {
-    define('G5_EDITOR_LIB', G5_EDITOR_PATH."/{$config['cf_editor']}/editor.lib.php");
-} else {
-    define('G5_EDITOR_LIB', G5_LIB_PATH."/editor.lib.php");
-}
-
 // 회원, 비회원 구분
 $is_member = $is_guest = false;
 $is_admin = '';
@@ -643,7 +598,6 @@ if (isset($member['mb_id']) && $member['mb_id']) {
    $member['mb_level'] = 1; // 비회원의 경우 회원레벨을 가장 낮게 설정
 }

-
 if ($is_admin != 'super') {
    // 접근가능 IP
    $cf_possible_ip = trim($config['cf_possible_ip']);
@@ -683,6 +637,43 @@ if ($is_admin != 'super') {
    }
 }

+/** @var array $write 글 데이터 */
+$write = array();
+/** @var string $write_table 게시판 테이블 전체이름 */
+$write_table = '';
+if ($bo_table) {
+    $board = get_board_db($bo_table, true);
+    if (isset($board['bo_table']) && $board['bo_table']) {
+        set_cookie("ck_bo_table", $board['bo_table'], 86400 * 1);
+        $gr_id = $board['gr_id'];
+        // 게시판 테이블 전체이름
+        $write_table = $g5['write_prefix'] . $bo_table; 
+
+        if (isset($wr_id) && $wr_id) {
+            $write = get_write($write_table, $wr_id);
+        } else if (isset($wr_seo_title) && $wr_seo_title) {
+            $write = get_content_by_field($write_table, 'bbs', 'wr_seo_title', generate_seo_title($wr_seo_title));
+            if (isset($write['wr_id'])) {
+                $wr_id = (int) $write['wr_id'];
+            }
+        }
+    }
+
+    // 게시판에서 사용하는 에디터를 설정
+    if (isset($board['bo_select_editor']) && $board['bo_select_editor']) {
+        $config['cf_editor'] = $board['bo_select_editor'];
+    }
+}
+
+if ($gr_id && !is_array($gr_id)) {
+    $group = get_group($gr_id, true);
+}
+
+if ($config['cf_editor']) {
+    define('G5_EDITOR_LIB', G5_EDITOR_PATH."/{$config['cf_editor']}/editor.lib.php");
+} else {
+    define('G5_EDITOR_LIB', G5_LIB_PATH."/editor.lib.php");
+}

 // 테마경로
 if(defined('_THEME_PREVIEW_') && _THEME_PREVIEW_ === true)
@@ -8,21 +8,24 @@ if (!defined('G5_USE_SHOP') || !G5_USE_SHOP) return;
 .'(배송업체명^택배조회URL^연락처)'
 */
 define('G5_DELIVERY_COMPANY',
-     '(경동택배^https://kdexp.com/basicNewDelivery.kd?barcode=^080-873-2178)'
+     '(경동택배^https://kdexp.com/service/delivery/etc/delivery.do?barcode=^1899-5368)'
    .'(대신택배^https://www.ds3211.co.kr/freight/internalFreightSearch.ht?billno=^043-222-4582)'
-    .'(동부택배^http://www.dongbups.com/delivery/delivery_search_view.jsp?item_no=^1588-8848)'
    .'(로젠택배^https://www.ilogen.com/m/personal/trace.pop/^1588-9988)'
    .'(우체국^https://m.epost.go.kr/postal/mobile/mobile.trace.RetrieveDomRigiTraceList.comm?ems_gubun=E&sid1=^1588-1300)'
-    .'(이노지스택배^http://www.innogis.co.kr/tracking_view.asp?invoice=^1566-4082)'
    .'(한진택배^https://www.hanjin.co.kr/kor/CMS/DeliveryMgr/WaybillResult.do?mCode=MN038&schLang=KR&wblnumText2=^1588-0011)'
    .'(롯데택배^https://www.lotteglogis.com/open/tracking?invno=^1588-2121)'
-    .'(CJ대한통운^https://www.doortodoor.co.kr/parcel/doortodoor.do?fsp_action=PARC_ACT_002&fsp_cmd=retrieveInvNoACT&invc_no=^1588-1255)'
-    .'(CVSnet편의점택배^https://www.cvsnet.co.kr/invoice/tracking.do?invoice_no=^1577-1287)'
-    .'(KG옐로우캡택배^http://www.yellowcap.co.kr/custom/inquiry_result.asp?invoice_no=^1588-0123)'
-    .'(KGB택배^http://www.kgbls.co.kr/sub5/trace.asp?f_slipno=^1577-4577)'
-    .'(KG로지스^http://www.kglogis.co.kr/contents/waybill.jsp?item_no=^1588-8848)'
+    .'(CJ대한통운^https://trace.cjlogistics.com/next/tracking.html?wblNo=^1588-1255)'
+    .'(GS25편의점택배^https://www.cvsnet.co.kr/invoice/tracking.do?invoice_no=^1577-1287)'
+    .'(합동택배^https://hdexp.co.kr/deliverySearch2.hd?barcode=^1899-3392)'
+    .'(CU편의점택배^https://www.cupost.co.kr/postbox/delivery/localResult.cupost?invoice_no=^1577-1287)'
+    .'(천일택배^http://www.chunil.co.kr/HTrace/HTrace.jsp?transNo=^1877-6606)'
    .'(건영택배^https://www.kunyoung.com/goods/goods_01.php?mulno=^031-460-2700)'
-    .'(호남택배^http://www.honamlogis.co.kr/04estimate/songjang_list.php?c_search1=^031-376-6070)'
+    .'(우리택배^http://www.honamlogis.co.kr/04estimate/songjang_list.php?c_search1=^031-376-6070)'
+    .'(일양로지스^https://www.ilyanglogis.com/functionality/popup_result.asp?hawb_no=^1588-0002)'
+    .'(EMS^https://service.epost.go.kr/trace.RetrieveEmsRigiTraceList.comm?POST_CODE=^1588-1300)'
+    .'(DHL^https://www.dhl.com/kr-ko/home/tracking.html?tracking-id=^1588-1588-0001)'
+    .'(FedEx^https://www.fedex.com/fedextrack/?trknbr=^02-3496-7777)'
+    .'(UPS^https://www.fedex.com/fedextrack/?trknbr=^02-3496-7777)'
 );

 include_once(G5_LIB_PATH.'/shop.data.lib.php');
@@ -1,5 +1,6 @@
 <?php
 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once('../config.php');
 include_once('./install.function.php');    // 인스톨 과정 함수 모음
 include_once('../lib/common.lib.php');    // 공통 라이브러리
@@ -295,6 +295,7 @@ CREATE TABLE IF NOT EXISTS `g5_config` (
  `cf_cert_use_seed` tinyint(4) NOT NULL DEFAULT '1',
  `cf_cert_kcb_cd` varchar(255) NOT NULL DEFAULT '',
  `cf_cert_kcp_cd` varchar(255) NOT NULL DEFAULT '',
+  `cf_cert_kcp_enckey` varchar(100) NOT NULL DEFAULT '',
  `cf_lg_mid` varchar(100) NOT NULL DEFAULT '',
  `cf_lg_mert_key` varchar(100) NOT NULL DEFAULT '',
  `cf_cert_limit` int(11) NOT NULL DEFAULT '0',
@@ -909,7 +910,7 @@ CREATE TABLE IF NOT EXISTS `g5_member_social_profiles` (
  `description` varchar(255) NOT NULL DEFAULT '',
  `mp_register_day` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
  `mp_latest_day` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
-  UNIQUE KEY `mp_no` (`mp_no`),
+  PRIMARY KEY (`mp_no`),
  KEY `mb_id` (`mb_id`),
  KEY `provider` (`provider`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;
@@ -2,6 +2,7 @@
@header('Content-Type: text/html; charset=utf-8');
@header('X-Robots-Tag: noindex');
 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once ('../config.php');
 $title = G5_VERSION." 라이센스 확인 1/3";
 include_once ('./install.inc.php');
@@ -0,0 +1,4 @@
+<?php
+if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
+    include_once('../cloudflare.check.php');    // cloudflare 의 ip 대역인지 체크
+}
@@ -9,6 +9,7 @@ header('Pragma: no-cache'); // HTTP/1.0
@header('X-Robots-Tag: noindex');

 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once ('../config.php');
 $title = G5_VERSION." 초기환경설정 2/3";
 include_once ('./install.inc.php');
@@ -10,6 +10,7 @@ header('Pragma: no-cache'); // HTTP/1.0
@header('X-Robots-Tag: noindex');

 $g5_path['path'] = '..';
+include_once('install_common.php');
 include_once('../config.php');
 include_once('../lib/common.lib.php');
 include_once('./install.function.php');    // 인스톨 과정 함수 모음
@@ -134,7 +134,7 @@ function no_comma(data)
 function del(href)
 {
    if(confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n정말 삭제하시겠습니까?")) {
-        document.location.href = href;
+        window.location.href = href;
    }
 }

@@ -24,6 +24,9 @@
            var width = $this.width();

            $img.each(function() {
+				
+				if ($(this).attr("loading") === "lazy") return; // loading="lazy" 속성이 있는 경우 건너뜀
+				
                if($(this).data("width") == undefined)
                    $(this).data("width", $(this).width());

@@ -73,6 +76,9 @@
            var width = $this.width();

            $img.each(function() {
+				
+				if ($(this).attr("loading") === "lazy") return; // loading="lazy" 속성이 있는 경우 건너뜀
+				
                $(this).removeAttr("width")
                       .removeAttr("height")
                       .css("width","")
@@ -1398,15 +1398,14 @@ function get_sideview($mb_id, $name='', $email='', $homepage='')
    static $cache = array();

    $name = get_text($name, 0, true);
-
-    if (isset($cache['id:' . $mb_id]) && $cache['id:' . $mb_id]) {
+    $namekey = ($mb_id && $name) ? $mb_id."\t".$name : '';
+    
+    // id는 유니크하지만 닉네임 또는 이름은 변경이 가능하다
+    // name의 경우 비회원은 게시판에 동일한 이름을 등록할수 있다.
+    if ($namekey && isset($cache['idname:' . $namekey]) && $cache['idname:' . $namekey]) {
+        return $cache['idname:' . $namekey];
+    } else if (isset($cache['id:' . $mb_id]) && $cache['id:' . $mb_id]) {
        return $cache['id:' . $mb_id];
-    } else if (
-        isset($name)
-        && isset($cache['name:' . $name])
-        && $cache['name:' . $name]
-    ) {
-        return $cache['name:' . $name];
    }

    $email = get_string_encrypt($email);
@@ -1520,11 +1519,11 @@ function get_sideview($mb_id, $name='', $email='', $homepage='')
    $str .= $str2;
    $str .= '<noscript class="sv_nojs">' . $str2 . '</noscript>';
    $str .= "</span>";
-
-    if ($mb_id) {
+    
+    if ($namekey) {
+        $cache['idname:' . $namekey] = $str;
+    } else if ($mb_id && !$name) {
        $cache['id:' . $mb_id] = $str;
-    } else {
-        $cache['name:' . $name] = $str;
    }

    return $str;
@@ -2280,6 +2279,24 @@ function _callback_bad_tag_convert($matches){
    return "<div class=\"embedx\">보안문제로 인하여 관리자 아이디로는 embed 또는 object 태그를 볼 수 없습니다. 확인하시려면 관리권한이 없는 다른 아이디로 접속하세요.</div>";
 }

+function normalize_utf8_string($string) {
+    // utf8mb4 환경과 mb_ord 함수가 지원되지 않는 환경에서는 제외한다.
+    if (G5_DB_CHARSET === 'utf8mb4' || !function_exists('mb_ord')) {
+        return $string;
+    }
+    
+    // Unicode 특수 문자를 일반 문자로 변환
+    $normalized = preg_replace_callback('/[\x{1D400}-\x{1D7FF}]/u', '_callback_normalizeString', $string);
+
+    return $normalized;
+}
+
+function _callback_normalizeString($matches){
+    $charCode = mb_ord($matches[0], 'UTF-8');
+    // 변환 테이블에서 일반 문자로 매핑
+    return chr(($charCode - 0x1D400) % 26 + ord('A'));
+}
+
 // 토큰 생성
 function _token()
 {
@@ -4,7 +4,7 @@ if (!defined('_GNUBOARD_')) exit;

 // 최신글 추출
 // $cache_time 캐시 갱신시간
-function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time=1, $options='')
+function latest($skin_dir='', $bo_table='', $rows=10, $subject_len=40, $cache_time=1, $options='')
 {
    global $g5;

@@ -52,9 +52,12 @@ function mailer($fname, $fmail, $to, $subject, $content, $type=0, $file="", $cc=

        $mail = run_replace('mail_options', $mail, $fname, $fmail, $to, $subject, $content, $type, $file, $cc, $bcc);

-        $mail_send_result = $mail->send();
-
+        if (!($mail_send_result = $mail->send())) {
+            throw new Exception($mail->ErrorInfo);
+        }
+        
    } catch (Exception $e) {
+        error_log("Mail sending error: " . $e->getMessage());
    }

    run_event('mail_send_result', $mail_send_result, $mail, $to, $cc, $bcc);
@@ -361,12 +361,6 @@
                    <Execution method="windowOpen" value="Embed" />
                </Attribute>
            </Button>
-            <Button name="Map" tooltip="지도">
-                <Attribute class="cheditor-tb-bg" width="23" height="23">
-                    <Icon position="694" width="16" class="cheditor-tb-icon" />
-                    <Execution method="windowOpen" value="GoogleMap" />
-                </Attribute>
-            </Button>
        </Group>
        <Group name="PageBreak">
            <Button name="PageBreak" tooltip="인쇄 쪽 나눔">
@@ -1,15 +1,15 @@
-AutoFormat.RemoveEmpty.RemoveNbsp
-TYPE: bool
-VERSION: 4.0.0
-DEFAULT: false
--DESCRIPTION--
-<p>
-  When enabled, HTML Purifier will treat any elements that contain only
-  non-breaking spaces as well as regular whitespace as empty, and remove
-  them when %AutoFormat.RemoveEmpty is enabled.
-</p>
-<p>
-  See %AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions for a list of elements
-  that don't have this behavior applied to them.
-</p>
--# vim: et sw=4 sts=4
+AutoFormat.RemoveEmpty.RemoveNbsp
+TYPE: bool
+VERSION: 4.0.0
+DEFAULT: false
+--DESCRIPTION--
+<p>
+  When enabled, HTML Purifier will treat any elements that contain only
+  non-breaking spaces as well as regular whitespace as empty, and remove
+  them when %AutoFormat.RemoveEmpty is enabled.
+</p>
+<p>
+  See %AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions for a list of elements
+  that don't have this behavior applied to them.
+</p>
+--# vim: et sw=4 sts=4
@@ -1,12 +1,12 @@
-Core.AllowParseManyTags
-TYPE: bool
-DEFAULT: false
-VERSION: 4.10.1
--DESCRIPTION--
-<p>
-    This directive allows parsing of many nested tags.
-    If you set true, relaxes any hardcoded limit from the parser.
-    However, in that case it may cause a Dos attack.
-    Be careful when enabling it.
-</p>
--# vim: et sw=4 sts=4
+Core.AllowParseManyTags
+TYPE: bool
+DEFAULT: false
+VERSION: 4.10.1
+--DESCRIPTION--
+<p>
+    This directive allows parsing of many nested tags.
+    If you set true, relaxes any hardcoded limit from the parser.
+    However, in that case it may cause a Dos attack.
+    Be careful when enabling it.
+</p>
+--# vim: et sw=4 sts=4
@@ -1,160 +1,160 @@
-Core.ColorKeywords
-TYPE: hash
-VERSION: 2.0.0
--DEFAULT--
-array (
-  'aliceblue' => '#F0F8FF',
-  'antiquewhite' => '#FAEBD7',
-  'aqua' => '#00FFFF',
-  'aquamarine' => '#7FFFD4',
-  'azure' => '#F0FFFF',
-  'beige' => '#F5F5DC',
-  'bisque' => '#FFE4C4',
-  'black' => '#000000',
-  'blanchedalmond' => '#FFEBCD',
-  'blue' => '#0000FF',
-  'blueviolet' => '#8A2BE2',
-  'brown' => '#A52A2A',
-  'burlywood' => '#DEB887',
-  'cadetblue' => '#5F9EA0',
-  'chartreuse' => '#7FFF00',
-  'chocolate' => '#D2691E',
-  'coral' => '#FF7F50',
-  'cornflowerblue' => '#6495ED',
-  'cornsilk' => '#FFF8DC',
-  'crimson' => '#DC143C',
-  'cyan' => '#00FFFF',
-  'darkblue' => '#00008B',
-  'darkcyan' => '#008B8B',
-  'darkgoldenrod' => '#B8860B',
-  'darkgray' => '#A9A9A9',
-  'darkgrey' => '#A9A9A9',
-  'darkgreen' => '#006400',
-  'darkkhaki' => '#BDB76B',
-  'darkmagenta' => '#8B008B',
-  'darkolivegreen' => '#556B2F',
-  'darkorange' => '#FF8C00',
-  'darkorchid' => '#9932CC',
-  'darkred' => '#8B0000',
-  'darksalmon' => '#E9967A',
-  'darkseagreen' => '#8FBC8F',
-  'darkslateblue' => '#483D8B',
-  'darkslategray' => '#2F4F4F',
-  'darkslategrey' => '#2F4F4F',
-  'darkturquoise' => '#00CED1',
-  'darkviolet' => '#9400D3',
-  'deeppink' => '#FF1493',
-  'deepskyblue' => '#00BFFF',
-  'dimgray' => '#696969',
-  'dimgrey' => '#696969',
-  'dodgerblue' => '#1E90FF',
-  'firebrick' => '#B22222',
-  'floralwhite' => '#FFFAF0',
-  'forestgreen' => '#228B22',
-  'fuchsia' => '#FF00FF',
-  'gainsboro' => '#DCDCDC',
-  'ghostwhite' => '#F8F8FF',
-  'gold' => '#FFD700',
-  'goldenrod' => '#DAA520',
-  'gray' => '#808080',
-  'grey' => '#808080',
-  'green' => '#008000',
-  'greenyellow' => '#ADFF2F',
-  'honeydew' => '#F0FFF0',
-  'hotpink' => '#FF69B4',
-  'indianred' => '#CD5C5C',
-  'indigo' => '#4B0082',
-  'ivory' => '#FFFFF0',
-  'khaki' => '#F0E68C',
-  'lavender' => '#E6E6FA',
-  'lavenderblush' => '#FFF0F5',
-  'lawngreen' => '#7CFC00',
-  'lemonchiffon' => '#FFFACD',
-  'lightblue' => '#ADD8E6',
-  'lightcoral' => '#F08080',
-  'lightcyan' => '#E0FFFF',
-  'lightgoldenrodyellow' => '#FAFAD2',
-  'lightgray' => '#D3D3D3',
-  'lightgrey' => '#D3D3D3',
-  'lightgreen' => '#90EE90',
-  'lightpink' => '#FFB6C1',
-  'lightsalmon' => '#FFA07A',
-  'lightseagreen' => '#20B2AA',
-  'lightskyblue' => '#87CEFA',
-  'lightslategray' => '#778899',
-  'lightslategrey' => '#778899',
-  'lightsteelblue' => '#B0C4DE',
-  'lightyellow' => '#FFFFE0',
-  'lime' => '#00FF00',
-  'limegreen' => '#32CD32',
-  'linen' => '#FAF0E6',
-  'magenta' => '#FF00FF',
-  'maroon' => '#800000',
-  'mediumaquamarine' => '#66CDAA',
-  'mediumblue' => '#0000CD',
-  'mediumorchid' => '#BA55D3',
-  'mediumpurple' => '#9370DB',
-  'mediumseagreen' => '#3CB371',
-  'mediumslateblue' => '#7B68EE',
-  'mediumspringgreen' => '#00FA9A',
-  'mediumturquoise' => '#48D1CC',
-  'mediumvioletred' => '#C71585',
-  'midnightblue' => '#191970',
-  'mintcream' => '#F5FFFA',
-  'mistyrose' => '#FFE4E1',
-  'moccasin' => '#FFE4B5',
-  'navajowhite' => '#FFDEAD',
-  'navy' => '#000080',
-  'oldlace' => '#FDF5E6',
-  'olive' => '#808000',
-  'olivedrab' => '#6B8E23',
-  'orange' => '#FFA500',
-  'orangered' => '#FF4500',
-  'orchid' => '#DA70D6',
-  'palegoldenrod' => '#EEE8AA',
-  'palegreen' => '#98FB98',
-  'paleturquoise' => '#AFEEEE',
-  'palevioletred' => '#DB7093',
-  'papayawhip' => '#FFEFD5',
-  'peachpuff' => '#FFDAB9',
-  'peru' => '#CD853F',
-  'pink' => '#FFC0CB',
-  'plum' => '#DDA0DD',
-  'powderblue' => '#B0E0E6',
-  'purple' => '#800080',
-  'rebeccapurple' => '#663399',
-  'red' => '#FF0000',
-  'rosybrown' => '#BC8F8F',
-  'royalblue' => '#4169E1',
-  'saddlebrown' => '#8B4513',
-  'salmon' => '#FA8072',
-  'sandybrown' => '#F4A460',
-  'seagreen' => '#2E8B57',
-  'seashell' => '#FFF5EE',
-  'sienna' => '#A0522D',
-  'silver' => '#C0C0C0',
-  'skyblue' => '#87CEEB',
-  'slateblue' => '#6A5ACD',
-  'slategray' => '#708090',
-  'slategrey' => '#708090',
-  'snow' => '#FFFAFA',
-  'springgreen' => '#00FF7F',
-  'steelblue' => '#4682B4',
-  'tan' => '#D2B48C',
-  'teal' => '#008080',
-  'thistle' => '#D8BFD8',
-  'tomato' => '#FF6347',
-  'turquoise' => '#40E0D0',
-  'violet' => '#EE82EE',
-  'wheat' => '#F5DEB3',
-  'white' => '#FFFFFF',
-  'whitesmoke' => '#F5F5F5',
-  'yellow' => '#FFFF00',
-  'yellowgreen' => '#9ACD32'
-)
--DESCRIPTION--
-
-Lookup array of color names to six digit hexadecimal number corresponding
-to color, with preceding hash mark. Used when parsing colors.  The lookup
-is done in a case-insensitive manner.
--# vim: et sw=4 sts=4
+Core.ColorKeywords
+TYPE: hash
+VERSION: 2.0.0
+--DEFAULT--
+array (
+  'aliceblue' => '#F0F8FF',
+  'antiquewhite' => '#FAEBD7',
+  'aqua' => '#00FFFF',
+  'aquamarine' => '#7FFFD4',
+  'azure' => '#F0FFFF',
+  'beige' => '#F5F5DC',
+  'bisque' => '#FFE4C4',
+  'black' => '#000000',
+  'blanchedalmond' => '#FFEBCD',
+  'blue' => '#0000FF',
+  'blueviolet' => '#8A2BE2',
+  'brown' => '#A52A2A',
+  'burlywood' => '#DEB887',
+  'cadetblue' => '#5F9EA0',
+  'chartreuse' => '#7FFF00',
+  'chocolate' => '#D2691E',
+  'coral' => '#FF7F50',
+  'cornflowerblue' => '#6495ED',
+  'cornsilk' => '#FFF8DC',
+  'crimson' => '#DC143C',
+  'cyan' => '#00FFFF',
+  'darkblue' => '#00008B',
+  'darkcyan' => '#008B8B',
+  'darkgoldenrod' => '#B8860B',
+  'darkgray' => '#A9A9A9',
+  'darkgrey' => '#A9A9A9',
+  'darkgreen' => '#006400',
+  'darkkhaki' => '#BDB76B',
+  'darkmagenta' => '#8B008B',
+  'darkolivegreen' => '#556B2F',
+  'darkorange' => '#FF8C00',
+  'darkorchid' => '#9932CC',
+  'darkred' => '#8B0000',
+  'darksalmon' => '#E9967A',
+  'darkseagreen' => '#8FBC8F',
+  'darkslateblue' => '#483D8B',
+  'darkslategray' => '#2F4F4F',
+  'darkslategrey' => '#2F4F4F',
+  'darkturquoise' => '#00CED1',
+  'darkviolet' => '#9400D3',
+  'deeppink' => '#FF1493',
+  'deepskyblue' => '#00BFFF',
+  'dimgray' => '#696969',
+  'dimgrey' => '#696969',
+  'dodgerblue' => '#1E90FF',
+  'firebrick' => '#B22222',
+  'floralwhite' => '#FFFAF0',
+  'forestgreen' => '#228B22',
+  'fuchsia' => '#FF00FF',
+  'gainsboro' => '#DCDCDC',
+  'ghostwhite' => '#F8F8FF',
+  'gold' => '#FFD700',
+  'goldenrod' => '#DAA520',
+  'gray' => '#808080',
+  'grey' => '#808080',
+  'green' => '#008000',
+  'greenyellow' => '#ADFF2F',
+  'honeydew' => '#F0FFF0',
+  'hotpink' => '#FF69B4',
+  'indianred' => '#CD5C5C',
+  'indigo' => '#4B0082',
+  'ivory' => '#FFFFF0',
+  'khaki' => '#F0E68C',
+  'lavender' => '#E6E6FA',
+  'lavenderblush' => '#FFF0F5',
+  'lawngreen' => '#7CFC00',
+  'lemonchiffon' => '#FFFACD',
+  'lightblue' => '#ADD8E6',
+  'lightcoral' => '#F08080',
+  'lightcyan' => '#E0FFFF',
+  'lightgoldenrodyellow' => '#FAFAD2',
+  'lightgray' => '#D3D3D3',
+  'lightgrey' => '#D3D3D3',
+  'lightgreen' => '#90EE90',
+  'lightpink' => '#FFB6C1',
+  'lightsalmon' => '#FFA07A',
+  'lightseagreen' => '#20B2AA',
+  'lightskyblue' => '#87CEFA',
+  'lightslategray' => '#778899',
+  'lightslategrey' => '#778899',
+  'lightsteelblue' => '#B0C4DE',
+  'lightyellow' => '#FFFFE0',
+  'lime' => '#00FF00',
+  'limegreen' => '#32CD32',
+  'linen' => '#FAF0E6',
+  'magenta' => '#FF00FF',
+  'maroon' => '#800000',
+  'mediumaquamarine' => '#66CDAA',
+  'mediumblue' => '#0000CD',
+  'mediumorchid' => '#BA55D3',
+  'mediumpurple' => '#9370DB',
+  'mediumseagreen' => '#3CB371',
+  'mediumslateblue' => '#7B68EE',
+  'mediumspringgreen' => '#00FA9A',
+  'mediumturquoise' => '#48D1CC',
+  'mediumvioletred' => '#C71585',
+  'midnightblue' => '#191970',
+  'mintcream' => '#F5FFFA',
+  'mistyrose' => '#FFE4E1',
+  'moccasin' => '#FFE4B5',
+  'navajowhite' => '#FFDEAD',
+  'navy' => '#000080',
+  'oldlace' => '#FDF5E6',
+  'olive' => '#808000',
+  'olivedrab' => '#6B8E23',
+  'orange' => '#FFA500',
+  'orangered' => '#FF4500',
+  'orchid' => '#DA70D6',
+  'palegoldenrod' => '#EEE8AA',
+  'palegreen' => '#98FB98',
+  'paleturquoise' => '#AFEEEE',
+  'palevioletred' => '#DB7093',
+  'papayawhip' => '#FFEFD5',
+  'peachpuff' => '#FFDAB9',
+  'peru' => '#CD853F',
+  'pink' => '#FFC0CB',
+  'plum' => '#DDA0DD',
+  'powderblue' => '#B0E0E6',
+  'purple' => '#800080',
+  'rebeccapurple' => '#663399',
+  'red' => '#FF0000',
+  'rosybrown' => '#BC8F8F',
+  'royalblue' => '#4169E1',
+  'saddlebrown' => '#8B4513',
+  'salmon' => '#FA8072',
+  'sandybrown' => '#F4A460',
+  'seagreen' => '#2E8B57',
+  'seashell' => '#FFF5EE',
+  'sienna' => '#A0522D',
+  'silver' => '#C0C0C0',
+  'skyblue' => '#87CEEB',
+  'slateblue' => '#6A5ACD',
+  'slategray' => '#708090',
+  'slategrey' => '#708090',
+  'snow' => '#FFFAFA',
+  'springgreen' => '#00FF7F',
+  'steelblue' => '#4682B4',
+  'tan' => '#D2B48C',
+  'teal' => '#008080',
+  'thistle' => '#D8BFD8',
+  'tomato' => '#FF6347',
+  'turquoise' => '#40E0D0',
+  'violet' => '#EE82EE',
+  'wheat' => '#F5DEB3',
+  'white' => '#FFFFFF',
+  'whitesmoke' => '#F5F5F5',
+  'yellow' => '#FFFF00',
+  'yellowgreen' => '#9ACD32'
+)
+--DESCRIPTION--
+
+Lookup array of color names to six digit hexadecimal number corresponding
+to color, with preceding hash mark. Used when parsing colors.  The lookup
+is done in a case-insensitive manner.
+--# vim: et sw=4 sts=4
@@ -1,11 +1,11 @@
-HTML.Forms
-TYPE: bool
-VERSION: 4.13.0
-DEFAULT: false
--DESCRIPTION--
-<p>
-    Whether or not to permit form elements in the user input, regardless of
-    %HTML.Trusted value. Please be very careful when using this functionality, as
-    enabling forms in untrusted documents may allow for phishing attacks.
-</p>
--# vim: et sw=4 sts=4
+HTML.Forms
+TYPE: bool
+VERSION: 4.13.0
+DEFAULT: false
+--DESCRIPTION--
+<p>
+    Whether or not to permit form elements in the user input, regardless of
+    %HTML.Trusted value. Please be very careful when using this functionality, as
+    enabling forms in untrusted documents may allow for phishing attacks.
+</p>
+--# vim: et sw=4 sts=4
@@ -1,451 +1,451 @@
-<?php
-
-/**
- * @todo Rewrite to use Interchange objects
- */
-class HTMLPurifier_Printer_ConfigForm extends HTMLPurifier_Printer
-{
-
-    /**
-     * Printers for specific fields.
-     * @type HTMLPurifier_Printer[]
-     */
-    protected $fields = array();
-
-    /**
-     * Documentation URL, can have fragment tagged on end.
-     * @type string
-     */
-    protected $docURL;
-
-    /**
-     * Name of form element to stuff config in.
-     * @type string
-     */
-    protected $name;
-
-    /**
-     * Whether or not to compress directive names, clipping them off
-     * after a certain amount of letters. False to disable or integer letters
-     * before clipping.
-     * @type bool
-     */
-    protected $compress = false;
-
-    /**
-     * @param string $name Form element name for directives to be stuffed into
-     * @param string $doc_url String documentation URL, will have fragment tagged on
-     * @param bool $compress Integer max length before compressing a directive name, set to false to turn off
-     */
-    public function __construct(
-        $name,
-        $doc_url = null,
-        $compress = false
-    ) {
-        parent::__construct();
-        $this->docURL = $doc_url;
-        $this->name = $name;
-        $this->compress = $compress;
-        // initialize sub-printers
-        $this->fields[0] = new HTMLPurifier_Printer_ConfigForm_default();
-        $this->fields[HTMLPurifier_VarParser::C_BOOL] = new HTMLPurifier_Printer_ConfigForm_bool();
-    }
-
-    /**
-     * Sets default column and row size for textareas in sub-printers
-     * @param $cols Integer columns of textarea, null to use default
-     * @param $rows Integer rows of textarea, null to use default
-     */
-    public function setTextareaDimensions($cols = null, $rows = null)
-    {
-        if ($cols) {
-            $this->fields['default']->cols = $cols;
-        }
-        if ($rows) {
-            $this->fields['default']->rows = $rows;
-        }
-    }
-
-    /**
-     * Retrieves styling, in case it is not accessible by webserver
-     */
-    public static function getCSS()
-    {
-        return file_get_contents(HTMLPURIFIER_PREFIX . '/HTMLPurifier/Printer/ConfigForm.css');
-    }
-
-    /**
-     * Retrieves JavaScript, in case it is not accessible by webserver
-     */
-    public static function getJavaScript()
-    {
-        return file_get_contents(HTMLPURIFIER_PREFIX . '/HTMLPurifier/Printer/ConfigForm.js');
-    }
-
-    /**
-     * Returns HTML output for a configuration form
-     * @param HTMLPurifier_Config|array $config Configuration object of current form state, or an array
-     *        where [0] has an HTML namespace and [1] is being rendered.
-     * @param array|bool $allowed Optional namespace(s) and directives to restrict form to.
-     * @param bool $render_controls
-     * @return string
-     */
-    public function render($config, $allowed = true, $render_controls = true)
-    {
-        if (is_array($config) && isset($config[0])) {
-            $gen_config = $config[0];
-            $config = $config[1];
-        } else {
-            $gen_config = $config;
-        }
-
-        $this->config = $config;
-        $this->genConfig = $gen_config;
-        $this->prepareGenerator($gen_config);
-
-        $allowed = HTMLPurifier_Config::getAllowedDirectivesForForm($allowed, $config->def);
-        $all = array();
-        foreach ($allowed as $key) {
-            list($ns, $directive) = $key;
-            $all[$ns][$directive] = $config->get($ns . '.' . $directive);
-        }
-
-        $ret = '';
-        $ret .= $this->start('table', array('class' => 'hp-config'));
-        $ret .= $this->start('thead');
-        $ret .= $this->start('tr');
-        $ret .= $this->element('th', 'Directive', array('class' => 'hp-directive'));
-        $ret .= $this->element('th', 'Value', array('class' => 'hp-value'));
-        $ret .= $this->end('tr');
-        $ret .= $this->end('thead');
-        foreach ($all as $ns => $directives) {
-            $ret .= $this->renderNamespace($ns, $directives);
-        }
-        if ($render_controls) {
-            $ret .= $this->start('tbody');
-            $ret .= $this->start('tr');
-            $ret .= $this->start('td', array('colspan' => 2, 'class' => 'controls'));
-            $ret .= $this->elementEmpty('input', array('type' => 'submit', 'value' => 'Submit'));
-            $ret .= '[<a href="?">Reset</a>]';
-            $ret .= $this->end('td');
-            $ret .= $this->end('tr');
-            $ret .= $this->end('tbody');
-        }
-        $ret .= $this->end('table');
-        return $ret;
-    }
-
-    /**
-     * Renders a single namespace
-     * @param $ns String namespace name
-     * @param array $directives array of directives to values
-     * @return string
-     */
-    protected function renderNamespace($ns, $directives)
-    {
-        $ret = '';
-        $ret .= $this->start('tbody', array('class' => 'namespace'));
-        $ret .= $this->start('tr');
-        $ret .= $this->element('th', $ns, array('colspan' => 2));
-        $ret .= $this->end('tr');
-        $ret .= $this->end('tbody');
-        $ret .= $this->start('tbody');
-        foreach ($directives as $directive => $value) {
-            $ret .= $this->start('tr');
-            $ret .= $this->start('th');
-            if ($this->docURL) {
-                $url = str_replace('%s', urlencode("$ns.$directive"), $this->docURL);
-                $ret .= $this->start('a', array('href' => $url));
-            }
-            $attr = array('for' => "{$this->name}:$ns.$directive");
-
-            // crop directive name if it's too long
-            if (!$this->compress || (strlen($directive) < $this->compress)) {
-                $directive_disp = $directive;
-            } else {
-                $directive_disp = substr($directive, 0, $this->compress - 2) . '...';
-                $attr['title'] = $directive;
-            }
-
-            $ret .= $this->element(
-                'label',
-                $directive_disp,
-                // component printers must create an element with this id
-                $attr
-            );
-            if ($this->docURL) {
-                $ret .= $this->end('a');
-            }
-            $ret .= $this->end('th');
-
-            $ret .= $this->start('td');
-            $def = $this->config->def->info["$ns.$directive"];
-            if (is_int($def)) {
-                $allow_null = $def < 0;
-                $type = abs($def);
-            } else {
-                $type = $def->type;
-                $allow_null = isset($def->allow_null);
-            }
-            if (!isset($this->fields[$type])) {
-                $type = 0;
-            } // default
-            $type_obj = $this->fields[$type];
-            if ($allow_null) {
-                $type_obj = new HTMLPurifier_Printer_ConfigForm_NullDecorator($type_obj);
-            }
-            $ret .= $type_obj->render($ns, $directive, $value, $this->name, array($this->genConfig, $this->config));
-            $ret .= $this->end('td');
-            $ret .= $this->end('tr');
-        }
-        $ret .= $this->end('tbody');
-        return $ret;
-    }
-
-}
-
-/**
- * Printer decorator for directives that accept null
- */
-class HTMLPurifier_Printer_ConfigForm_NullDecorator extends HTMLPurifier_Printer
-{
-    /**
-     * Printer being decorated
-     * @type HTMLPurifier_Printer
-     */
-    protected $obj;
-
-    /**
-     * @param HTMLPurifier_Printer $obj Printer to decorate
-     */
-    public function __construct($obj)
-    {
-        parent::__construct();
-        $this->obj = $obj;
-    }
-
-    /**
-     * @param string $ns
-     * @param string $directive
-     * @param string $value
-     * @param string $name
-     * @param HTMLPurifier_Config|array $config
-     * @return string
-     */
-    public function render($ns, $directive, $value, $name, $config)
-    {
-        if (is_array($config) && isset($config[0])) {
-            $gen_config = $config[0];
-            $config = $config[1];
-        } else {
-            $gen_config = $config;
-        }
-        $this->prepareGenerator($gen_config);
-
-        $ret = '';
-        $ret .= $this->start('label', array('for' => "$name:Null_$ns.$directive"));
-        $ret .= $this->element('span', "$ns.$directive:", array('class' => 'verbose'));
-        $ret .= $this->text(' Null/Disabled');
-        $ret .= $this->end('label');
-        $attr = array(
-            'type' => 'checkbox',
-            'value' => '1',
-            'class' => 'null-toggle',
-            'name' => "$name" . "[Null_$ns.$directive]",
-            'id' => "$name:Null_$ns.$directive",
-            'onclick' => "toggleWriteability('$name:$ns.$directive',checked)" // INLINE JAVASCRIPT!!!!
-        );
-        if ($this->obj instanceof HTMLPurifier_Printer_ConfigForm_bool) {
-            // modify inline javascript slightly
-            $attr['onclick'] =
-                "toggleWriteability('$name:Yes_$ns.$directive',checked);" .
-                "toggleWriteability('$name:No_$ns.$directive',checked)";
-        }
-        if ($value === null) {
-            $attr['checked'] = 'checked';
-        }
-        $ret .= $this->elementEmpty('input', $attr);
-        $ret .= $this->text(' or ');
-        $ret .= $this->elementEmpty('br');
-        $ret .= $this->obj->render($ns, $directive, $value, $name, array($gen_config, $config));
-        return $ret;
-    }
-}
-
-/**
- * Swiss-army knife configuration form field printer
- */
-class HTMLPurifier_Printer_ConfigForm_default extends HTMLPurifier_Printer
-{
-    /**
-     * @type int
-     */
-    public $cols = 18;
-
-    /**
-     * @type int
-     */
-    public $rows = 5;
-
-    /**
-     * @param string $ns
-     * @param string $directive
-     * @param string $value
-     * @param string $name
-     * @param HTMLPurifier_Config|array $config
-     * @return string
-     */
-    public function render($ns, $directive, $value, $name, $config)
-    {
-        if (is_array($config) && isset($config[0])) {
-            $gen_config = $config[0];
-            $config = $config[1];
-        } else {
-            $gen_config = $config;
-        }
-        $this->prepareGenerator($gen_config);
-        // this should probably be split up a little
-        $ret = '';
-        $def = $config->def->info["$ns.$directive"];
-        if (is_int($def)) {
-            $type = abs($def);
-        } else {
-            $type = $def->type;
-        }
-        if (is_array($value)) {
-            switch ($type) {
-                case HTMLPurifier_VarParser::LOOKUP:
-                    $array = $value;
-                    $value = array();
-                    foreach ($array as $val => $b) {
-                        $value[] = $val;
-                    }
-                    //TODO does this need a break?
-                case HTMLPurifier_VarParser::ALIST:
-                    $value = implode(PHP_EOL, $value);
-                    break;
-                case HTMLPurifier_VarParser::HASH:
-                    $nvalue = '';
-                    foreach ($value as $i => $v) {
-                        if (is_array($v)) {
-                            // HACK
-                            $v = implode(";", $v);
-                        }
-                        $nvalue .= "$i:$v" . PHP_EOL;
-                    }
-                    $value = $nvalue;
-                    break;
-                default:
-                    $value = '';
-            }
-        }
-        if ($type === HTMLPurifier_VarParser::C_MIXED) {
-            return 'Not supported';
-            $value = serialize($value);
-        }
-        $attr = array(
-            'name' => "$name" . "[$ns.$directive]",
-            'id' => "$name:$ns.$directive"
-        );
-        if ($value === null) {
-            $attr['disabled'] = 'disabled';
-        }
-        if (isset($def->allowed)) {
-            $ret .= $this->start('select', $attr);
-            foreach ($def->allowed as $val => $b) {
-                $attr = array();
-                if ($value == $val) {
-                    $attr['selected'] = 'selected';
-                }
-                $ret .= $this->element('option', $val, $attr);
-            }
-            $ret .= $this->end('select');
-        } elseif ($type === HTMLPurifier_VarParser::TEXT ||
-                $type === HTMLPurifier_VarParser::ITEXT ||
-                $type === HTMLPurifier_VarParser::ALIST ||
-                $type === HTMLPurifier_VarParser::HASH ||
-                $type === HTMLPurifier_VarParser::LOOKUP) {
-            $attr['cols'] = $this->cols;
-            $attr['rows'] = $this->rows;
-            $ret .= $this->start('textarea', $attr);
-            $ret .= $this->text($value);
-            $ret .= $this->end('textarea');
-        } else {
-            $attr['value'] = $value;
-            $attr['type'] = 'text';
-            $ret .= $this->elementEmpty('input', $attr);
-        }
-        return $ret;
-    }
-}
-
-/**
- * Bool form field printer
- */
-class HTMLPurifier_Printer_ConfigForm_bool extends HTMLPurifier_Printer
-{
-    /**
-     * @param string $ns
-     * @param string $directive
-     * @param string $value
-     * @param string $name
-     * @param HTMLPurifier_Config|array $config
-     * @return string
-     */
-    public function render($ns, $directive, $value, $name, $config)
-    {
-        if (is_array($config) && isset($config[0])) {
-            $gen_config = $config[0];
-            $config = $config[1];
-        } else {
-            $gen_config = $config;
-        }
-        $this->prepareGenerator($gen_config);
-        $ret = '';
-        $ret .= $this->start('div', array('id' => "$name:$ns.$directive"));
-
-        $ret .= $this->start('label', array('for' => "$name:Yes_$ns.$directive"));
-        $ret .= $this->element('span', "$ns.$directive:", array('class' => 'verbose'));
-        $ret .= $this->text(' Yes');
-        $ret .= $this->end('label');
-
-        $attr = array(
-            'type' => 'radio',
-            'name' => "$name" . "[$ns.$directive]",
-            'id' => "$name:Yes_$ns.$directive",
-            'value' => '1'
-        );
-        if ($value === true) {
-            $attr['checked'] = 'checked';
-        }
-        if ($value === null) {
-            $attr['disabled'] = 'disabled';
-        }
-        $ret .= $this->elementEmpty('input', $attr);
-
-        $ret .= $this->start('label', array('for' => "$name:No_$ns.$directive"));
-        $ret .= $this->element('span', "$ns.$directive:", array('class' => 'verbose'));
-        $ret .= $this->text(' No');
-        $ret .= $this->end('label');
-
-        $attr = array(
-            'type' => 'radio',
-            'name' => "$name" . "[$ns.$directive]",
-            'id' => "$name:No_$ns.$directive",
-            'value' => '0'
-        );
-        if ($value === false) {
-            $attr['checked'] = 'checked';
-        }
-        if ($value === null) {
-            $attr['disabled'] = 'disabled';
-        }
-        $ret .= $this->elementEmpty('input', $attr);
-
-        $ret .= $this->end('div');
-
-        return $ret;
-    }
-}
-
-// vim: et sw=4 sts=4
+<?php
+
+/**
+ * @todo Rewrite to use Interchange objects
+ */
+class HTMLPurifier_Printer_ConfigForm extends HTMLPurifier_Printer
+{
+
+    /**
+     * Printers for specific fields.
+     * @type HTMLPurifier_Printer[]
+     */
+    protected $fields = array();
+
+    /**
+     * Documentation URL, can have fragment tagged on end.
+     * @type string
+     */
+    protected $docURL;
+
+    /**
+     * Name of form element to stuff config in.
+     * @type string
+     */
+    protected $name;
+
+    /**
+     * Whether or not to compress directive names, clipping them off
+     * after a certain amount of letters. False to disable or integer letters
+     * before clipping.
+     * @type bool
+     */
+    protected $compress = false;
+
+    /**
+     * @param string $name Form element name for directives to be stuffed into
+     * @param string $doc_url String documentation URL, will have fragment tagged on
+     * @param bool $compress Integer max length before compressing a directive name, set to false to turn off
+     */
+    public function __construct(
+        $name,
+        $doc_url = null,
+        $compress = false
+    ) {
+        parent::__construct();
+        $this->docURL = $doc_url;
+        $this->name = $name;
+        $this->compress = $compress;
+        // initialize sub-printers
+        $this->fields[0] = new HTMLPurifier_Printer_ConfigForm_default();
+        $this->fields[HTMLPurifier_VarParser::C_BOOL] = new HTMLPurifier_Printer_ConfigForm_bool();
+    }
+
+    /**
+     * Sets default column and row size for textareas in sub-printers
+     * @param $cols Integer columns of textarea, null to use default
+     * @param $rows Integer rows of textarea, null to use default
+     */
+    public function setTextareaDimensions($cols = null, $rows = null)
+    {
+        if ($cols) {
+            $this->fields['default']->cols = $cols;
+        }
+        if ($rows) {
+            $this->fields['default']->rows = $rows;
+        }
+    }
+
+    /**
+     * Retrieves styling, in case it is not accessible by webserver
+     */
+    public static function getCSS()
+    {
+        return file_get_contents(HTMLPURIFIER_PREFIX . '/HTMLPurifier/Printer/ConfigForm.css');
+    }
+
+    /**
+     * Retrieves JavaScript, in case it is not accessible by webserver
+     */
+    public static function getJavaScript()
+    {
+        return file_get_contents(HTMLPURIFIER_PREFIX . '/HTMLPurifier/Printer/ConfigForm.js');
+    }
+
+    /**
+     * Returns HTML output for a configuration form
+     * @param HTMLPurifier_Config|array $config Configuration object of current form state, or an array
+     *        where [0] has an HTML namespace and [1] is being rendered.
+     * @param array|bool $allowed Optional namespace(s) and directives to restrict form to.
+     * @param bool $render_controls
+     * @return string
+     */
+    public function render($config, $allowed = true, $render_controls = true)
+    {
+        if (is_array($config) && isset($config[0])) {
+            $gen_config = $config[0];
+            $config = $config[1];
+        } else {
+            $gen_config = $config;
+        }
+
+        $this->config = $config;
+        $this->genConfig = $gen_config;
+        $this->prepareGenerator($gen_config);
+
+        $allowed = HTMLPurifier_Config::getAllowedDirectivesForForm($allowed, $config->def);
+        $all = array();
+        foreach ($allowed as $key) {
+            list($ns, $directive) = $key;
+            $all[$ns][$directive] = $config->get($ns . '.' . $directive);
+        }
+
+        $ret = '';
+        $ret .= $this->start('table', array('class' => 'hp-config'));
+        $ret .= $this->start('thead');
+        $ret .= $this->start('tr');
+        $ret .= $this->element('th', 'Directive', array('class' => 'hp-directive'));
+        $ret .= $this->element('th', 'Value', array('class' => 'hp-value'));
+        $ret .= $this->end('tr');
+        $ret .= $this->end('thead');
+        foreach ($all as $ns => $directives) {
+            $ret .= $this->renderNamespace($ns, $directives);
+        }
+        if ($render_controls) {
+            $ret .= $this->start('tbody');
+            $ret .= $this->start('tr');
+            $ret .= $this->start('td', array('colspan' => 2, 'class' => 'controls'));
+            $ret .= $this->elementEmpty('input', array('type' => 'submit', 'value' => 'Submit'));
+            $ret .= '[<a href="?">Reset</a>]';
+            $ret .= $this->end('td');
+            $ret .= $this->end('tr');
+            $ret .= $this->end('tbody');
+        }
+        $ret .= $this->end('table');
+        return $ret;
+    }
+
+    /**
+     * Renders a single namespace
+     * @param $ns String namespace name
+     * @param array $directives array of directives to values
+     * @return string
+     */
+    protected function renderNamespace($ns, $directives)
+    {
+        $ret = '';
+        $ret .= $this->start('tbody', array('class' => 'namespace'));
+        $ret .= $this->start('tr');
+        $ret .= $this->element('th', $ns, array('colspan' => 2));
+        $ret .= $this->end('tr');
+        $ret .= $this->end('tbody');
+        $ret .= $this->start('tbody');
+        foreach ($directives as $directive => $value) {
+            $ret .= $this->start('tr');
+            $ret .= $this->start('th');
+            if ($this->docURL) {
+                $url = str_replace('%s', urlencode("$ns.$directive"), $this->docURL);
+                $ret .= $this->start('a', array('href' => $url));
+            }
+            $attr = array('for' => "{$this->name}:$ns.$directive");
+
+            // crop directive name if it's too long
+            if (!$this->compress || (strlen($directive) < $this->compress)) {
+                $directive_disp = $directive;
+            } else {
+                $directive_disp = substr($directive, 0, $this->compress - 2) . '...';
+                $attr['title'] = $directive;
+            }
+
+            $ret .= $this->element(
+                'label',
+                $directive_disp,
+                // component printers must create an element with this id
+                $attr
+            );
+            if ($this->docURL) {
+                $ret .= $this->end('a');
+            }
+            $ret .= $this->end('th');
+
+            $ret .= $this->start('td');
+            $def = $this->config->def->info["$ns.$directive"];
+            if (is_int($def)) {
+                $allow_null = $def < 0;
+                $type = abs($def);
+            } else {
+                $type = $def->type;
+                $allow_null = isset($def->allow_null);
+            }
+            if (!isset($this->fields[$type])) {
+                $type = 0;
+            } // default
+            $type_obj = $this->fields[$type];
+            if ($allow_null) {
+                $type_obj = new HTMLPurifier_Printer_ConfigForm_NullDecorator($type_obj);
+            }
+            $ret .= $type_obj->render($ns, $directive, $value, $this->name, array($this->genConfig, $this->config));
+            $ret .= $this->end('td');
+            $ret .= $this->end('tr');
+        }
+        $ret .= $this->end('tbody');
+        return $ret;
+    }
+
+}
+
+/**
+ * Printer decorator for directives that accept null
+ */
+class HTMLPurifier_Printer_ConfigForm_NullDecorator extends HTMLPurifier_Printer
+{
+    /**
+     * Printer being decorated
+     * @type HTMLPurifier_Printer
+     */
+    protected $obj;
+
+    /**
+     * @param HTMLPurifier_Printer $obj Printer to decorate
+     */
+    public function __construct($obj)
+    {
+        parent::__construct();
+        $this->obj = $obj;
+    }
+
+    /**
+     * @param string $ns
+     * @param string $directive
+     * @param string $value
+     * @param string $name
+     * @param HTMLPurifier_Config|array $config
+     * @return string
+     */
+    public function render($ns, $directive, $value, $name, $config)
+    {
+        if (is_array($config) && isset($config[0])) {
+            $gen_config = $config[0];
+            $config = $config[1];
+        } else {
+            $gen_config = $config;
+        }
+        $this->prepareGenerator($gen_config);
+
+        $ret = '';
+        $ret .= $this->start('label', array('for' => "$name:Null_$ns.$directive"));
+        $ret .= $this->element('span', "$ns.$directive:", array('class' => 'verbose'));
+        $ret .= $this->text(' Null/Disabled');
+        $ret .= $this->end('label');
+        $attr = array(
+            'type' => 'checkbox',
+            'value' => '1',
+            'class' => 'null-toggle',
+            'name' => "$name" . "[Null_$ns.$directive]",
+            'id' => "$name:Null_$ns.$directive",
+            'onclick' => "toggleWriteability('$name:$ns.$directive',checked)" // INLINE JAVASCRIPT!!!!
+        );
+        if ($this->obj instanceof HTMLPurifier_Printer_ConfigForm_bool) {
+            // modify inline javascript slightly
+            $attr['onclick'] =
+                "toggleWriteability('$name:Yes_$ns.$directive',checked);" .
+                "toggleWriteability('$name:No_$ns.$directive',checked)";
+        }
+        if ($value === null) {
+            $attr['checked'] = 'checked';
+        }
+        $ret .= $this->elementEmpty('input', $attr);
+        $ret .= $this->text(' or ');
+        $ret .= $this->elementEmpty('br');
+        $ret .= $this->obj->render($ns, $directive, $value, $name, array($gen_config, $config));
+        return $ret;
+    }
+}
+
+/**
+ * Swiss-army knife configuration form field printer
+ */
+class HTMLPurifier_Printer_ConfigForm_default extends HTMLPurifier_Printer
+{
+    /**
+     * @type int
+     */
+    public $cols = 18;
+
+    /**
+     * @type int
+     */
+    public $rows = 5;
+
+    /**
+     * @param string $ns
+     * @param string $directive
+     * @param string $value
+     * @param string $name
+     * @param HTMLPurifier_Config|array $config
+     * @return string
+     */
+    public function render($ns, $directive, $value, $name, $config)
+    {
+        if (is_array($config) && isset($config[0])) {
+            $gen_config = $config[0];
+            $config = $config[1];
+        } else {
+            $gen_config = $config;
+        }
+        $this->prepareGenerator($gen_config);
+        // this should probably be split up a little
+        $ret = '';
+        $def = $config->def->info["$ns.$directive"];
+        if (is_int($def)) {
+            $type = abs($def);
+        } else {
+            $type = $def->type;
+        }
+        if (is_array($value)) {
+            switch ($type) {
+                case HTMLPurifier_VarParser::LOOKUP:
+                    $array = $value;
+                    $value = array();
+                    foreach ($array as $val => $b) {
+                        $value[] = $val;
+                    }
+                    //TODO does this need a break?
+                case HTMLPurifier_VarParser::ALIST:
+                    $value = implode(PHP_EOL, $value);
+                    break;
+                case HTMLPurifier_VarParser::HASH:
+                    $nvalue = '';
+                    foreach ($value as $i => $v) {
+                        if (is_array($v)) {
+                            // HACK
+                            $v = implode(";", $v);
+                        }
+                        $nvalue .= "$i:$v" . PHP_EOL;
+                    }
+                    $value = $nvalue;
+                    break;
+                default:
+                    $value = '';
+            }
+        }
+        if ($type === HTMLPurifier_VarParser::C_MIXED) {
+            return 'Not supported';
+            $value = serialize($value);
+        }
+        $attr = array(
+            'name' => "$name" . "[$ns.$directive]",
+            'id' => "$name:$ns.$directive"
+        );
+        if ($value === null) {
+            $attr['disabled'] = 'disabled';
+        }
+        if (isset($def->allowed)) {
+            $ret .= $this->start('select', $attr);
+            foreach ($def->allowed as $val => $b) {
+                $attr = array();
+                if ($value == $val) {
+                    $attr['selected'] = 'selected';
+                }
+                $ret .= $this->element('option', $val, $attr);
+            }
+            $ret .= $this->end('select');
+        } elseif ($type === HTMLPurifier_VarParser::TEXT ||
+                $type === HTMLPurifier_VarParser::ITEXT ||
+                $type === HTMLPurifier_VarParser::ALIST ||
+                $type === HTMLPurifier_VarParser::HASH ||
+                $type === HTMLPurifier_VarParser::LOOKUP) {
+            $attr['cols'] = $this->cols;
+            $attr['rows'] = $this->rows;
+            $ret .= $this->start('textarea', $attr);
+            $ret .= $this->text($value);
+            $ret .= $this->end('textarea');
+        } else {
+            $attr['value'] = $value;
+            $attr['type'] = 'text';
+            $ret .= $this->elementEmpty('input', $attr);
+        }
+        return $ret;
+    }
+}
+
+/**
+ * Bool form field printer
+ */
+class HTMLPurifier_Printer_ConfigForm_bool extends HTMLPurifier_Printer
+{
+    /**
+     * @param string $ns
+     * @param string $directive
+     * @param string $value
+     * @param string $name
+     * @param HTMLPurifier_Config|array $config
+     * @return string
+     */
+    public function render($ns, $directive, $value, $name, $config)
+    {
+        if (is_array($config) && isset($config[0])) {
+            $gen_config = $config[0];
+            $config = $config[1];
+        } else {
+            $gen_config = $config;
+        }
+        $this->prepareGenerator($gen_config);
+        $ret = '';
+        $ret .= $this->start('div', array('id' => "$name:$ns.$directive"));
+
+        $ret .= $this->start('label', array('for' => "$name:Yes_$ns.$directive"));
+        $ret .= $this->element('span', "$ns.$directive:", array('class' => 'verbose'));
+        $ret .= $this->text(' Yes');
+        $ret .= $this->end('label');
+
+        $attr = array(
+            'type' => 'radio',
+            'name' => "$name" . "[$ns.$directive]",
+            'id' => "$name:Yes_$ns.$directive",
+            'value' => '1'
+        );
+        if ($value === true) {
+            $attr['checked'] = 'checked';
+        }
+        if ($value === null) {
+            $attr['disabled'] = 'disabled';
+        }
+        $ret .= $this->elementEmpty('input', $attr);
+
+        $ret .= $this->start('label', array('for' => "$name:No_$ns.$directive"));
+        $ret .= $this->element('span', "$ns.$directive:", array('class' => 'verbose'));
+        $ret .= $this->text(' No');
+        $ret .= $this->end('label');
+
+        $attr = array(
+            'type' => 'radio',
+            'name' => "$name" . "[$ns.$directive]",
+            'id' => "$name:No_$ns.$directive",
+            'value' => '0'
+        );
+        if ($value === false) {
+            $attr['checked'] = 'checked';
+        }
+        if ($value === null) {
+            $attr['disabled'] = 'disabled';
+        }
+        $ret .= $this->elementEmpty('input', $attr);
+
+        $ret .= $this->end('div');
+
+        return $ret;
+    }
+}
+
+// vim: et sw=4 sts=4
@@ -1,324 +1,324 @@
-<?php
-
-class HTMLPurifier_Printer_HTMLDefinition extends HTMLPurifier_Printer
-{
-
-    /**
-     * @type HTMLPurifier_HTMLDefinition, for easy access
-     */
-    protected $def;
-
-    /**
-     * @param HTMLPurifier_Config $config
-     * @return string
-     */
-    public function render($config)
-    {
-        $ret = '';
-        $this->config =& $config;
-
-        $this->def = $config->getHTMLDefinition();
-
-        $ret .= $this->start('div', array('class' => 'HTMLPurifier_Printer'));
-
-        $ret .= $this->renderDoctype();
-        $ret .= $this->renderEnvironment();
-        $ret .= $this->renderContentSets();
-        $ret .= $this->renderInfo();
-
-        $ret .= $this->end('div');
-
-        return $ret;
-    }
-
-    /**
-     * Renders the Doctype table
-     * @return string
-     */
-    protected function renderDoctype()
-    {
-        $doctype = $this->def->doctype;
-        $ret = '';
-        $ret .= $this->start('table');
-        $ret .= $this->element('caption', 'Doctype');
-        $ret .= $this->row('Name', $doctype->name);
-        $ret .= $this->row('XML', $doctype->xml ? 'Yes' : 'No');
-        $ret .= $this->row('Default Modules', implode(', ', $doctype->modules));
-        $ret .= $this->row('Default Tidy Modules', implode(', ', $doctype->tidyModules));
-        $ret .= $this->end('table');
-        return $ret;
-    }
-
-
-    /**
-     * Renders environment table, which is miscellaneous info
-     * @return string
-     */
-    protected function renderEnvironment()
-    {
-        $def = $this->def;
-
-        $ret = '';
-
-        $ret .= $this->start('table');
-        $ret .= $this->element('caption', 'Environment');
-
-        $ret .= $this->row('Parent of fragment', $def->info_parent);
-        $ret .= $this->renderChildren($def->info_parent_def->child);
-        $ret .= $this->row('Block wrap name', $def->info_block_wrapper);
-
-        $ret .= $this->start('tr');
-        $ret .= $this->element('th', 'Global attributes');
-        $ret .= $this->element('td', $this->listifyAttr($def->info_global_attr), null, 0);
-        $ret .= $this->end('tr');
-
-        $ret .= $this->start('tr');
-        $ret .= $this->element('th', 'Tag transforms');
-        $list = array();
-        foreach ($def->info_tag_transform as $old => $new) {
-            $new = $this->getClass($new, 'TagTransform_');
-            $list[] = "<$old> with $new";
-        }
-        $ret .= $this->element('td', $this->listify($list));
-        $ret .= $this->end('tr');
-
-        $ret .= $this->start('tr');
-        $ret .= $this->element('th', 'Pre-AttrTransform');
-        $ret .= $this->element('td', $this->listifyObjectList($def->info_attr_transform_pre));
-        $ret .= $this->end('tr');
-
-        $ret .= $this->start('tr');
-        $ret .= $this->element('th', 'Post-AttrTransform');
-        $ret .= $this->element('td', $this->listifyObjectList($def->info_attr_transform_post));
-        $ret .= $this->end('tr');
-
-        $ret .= $this->end('table');
-        return $ret;
-    }
-
-    /**
-     * Renders the Content Sets table
-     * @return string
-     */
-    protected function renderContentSets()
-    {
-        $ret = '';
-        $ret .= $this->start('table');
-        $ret .= $this->element('caption', 'Content Sets');
-        foreach ($this->def->info_content_sets as $name => $lookup) {
-            $ret .= $this->heavyHeader($name);
-            $ret .= $this->start('tr');
-            $ret .= $this->element('td', $this->listifyTagLookup($lookup));
-            $ret .= $this->end('tr');
-        }
-        $ret .= $this->end('table');
-        return $ret;
-    }
-
-    /**
-     * Renders the Elements ($info) table
-     * @return string
-     */
-    protected function renderInfo()
-    {
-        $ret = '';
-        $ret .= $this->start('table');
-        $ret .= $this->element('caption', 'Elements ($info)');
-        ksort($this->def->info);
-        $ret .= $this->heavyHeader('Allowed tags', 2);
-        $ret .= $this->start('tr');
-        $ret .= $this->element('td', $this->listifyTagLookup($this->def->info), array('colspan' => 2));
-        $ret .= $this->end('tr');
-        foreach ($this->def->info as $name => $def) {
-            $ret .= $this->start('tr');
-            $ret .= $this->element('th', "<$name>", array('class' => 'heavy', 'colspan' => 2));
-            $ret .= $this->end('tr');
-            $ret .= $this->start('tr');
-            $ret .= $this->element('th', 'Inline content');
-            $ret .= $this->element('td', $def->descendants_are_inline ? 'Yes' : 'No');
-            $ret .= $this->end('tr');
-            if (!empty($def->excludes)) {
-                $ret .= $this->start('tr');
-                $ret .= $this->element('th', 'Excludes');
-                $ret .= $this->element('td', $this->listifyTagLookup($def->excludes));
-                $ret .= $this->end('tr');
-            }
-            if (!empty($def->attr_transform_pre)) {
-                $ret .= $this->start('tr');
-                $ret .= $this->element('th', 'Pre-AttrTransform');
-                $ret .= $this->element('td', $this->listifyObjectList($def->attr_transform_pre));
-                $ret .= $this->end('tr');
-            }
-            if (!empty($def->attr_transform_post)) {
-                $ret .= $this->start('tr');
-                $ret .= $this->element('th', 'Post-AttrTransform');
-                $ret .= $this->element('td', $this->listifyObjectList($def->attr_transform_post));
-                $ret .= $this->end('tr');
-            }
-            if (!empty($def->auto_close)) {
-                $ret .= $this->start('tr');
-                $ret .= $this->element('th', 'Auto closed by');
-                $ret .= $this->element('td', $this->listifyTagLookup($def->auto_close));
-                $ret .= $this->end('tr');
-            }
-            $ret .= $this->start('tr');
-            $ret .= $this->element('th', 'Allowed attributes');
-            $ret .= $this->element('td', $this->listifyAttr($def->attr), array(), 0);
-            $ret .= $this->end('tr');
-
-            if (!empty($def->required_attr)) {
-                $ret .= $this->row('Required attributes', $this->listify($def->required_attr));
-            }
-
-            $ret .= $this->renderChildren($def->child);
-        }
-        $ret .= $this->end('table');
-        return $ret;
-    }
-
-    /**
-     * Renders a row describing the allowed children of an element
-     * @param HTMLPurifier_ChildDef $def HTMLPurifier_ChildDef of pertinent element
-     * @return string
-     */
-    protected function renderChildren($def)
-    {
-        $context = new HTMLPurifier_Context();
-        $ret = '';
-        $ret .= $this->start('tr');
-        $elements = array();
-        $attr = array();
-        if (isset($def->elements)) {
-            if ($def->type == 'strictblockquote') {
-                $def->validateChildren(array(), $this->config, $context);
-            }
-            $elements = $def->elements;
-        }
-        if ($def->type == 'chameleon') {
-            $attr['rowspan'] = 2;
-        } elseif ($def->type == 'empty') {
-            $elements = array();
-        } elseif ($def->type == 'table') {
-            $elements = array_flip(
-                array(
-                    'col',
-                    'caption',
-                    'colgroup',
-                    'thead',
-                    'tfoot',
-                    'tbody',
-                    'tr'
-                )
-            );
-        }
-        $ret .= $this->element('th', 'Allowed children', $attr);
-
-        if ($def->type == 'chameleon') {
-
-            $ret .= $this->element(
-                'td',
-                '<em>Block</em>: ' .
-                $this->escape($this->listifyTagLookup($def->block->elements)),
-                null,
-                0
-            );
-            $ret .= $this->end('tr');
-            $ret .= $this->start('tr');
-            $ret .= $this->element(
-                'td',
-                '<em>Inline</em>: ' .
-                $this->escape($this->listifyTagLookup($def->inline->elements)),
-                null,
-                0
-            );
-
-        } elseif ($def->type == 'custom') {
-
-            $ret .= $this->element(
-                'td',
-                '<em>' . ucfirst($def->type) . '</em>: ' .
-                $def->dtd_regex
-            );
-
-        } else {
-            $ret .= $this->element(
-                'td',
-                '<em>' . ucfirst($def->type) . '</em>: ' .
-                $this->escape($this->listifyTagLookup($elements)),
-                null,
-                0
-            );
-        }
-        $ret .= $this->end('tr');
-        return $ret;
-    }
-
-    /**
-     * Listifies a tag lookup table.
-     * @param array $array Tag lookup array in form of array('tagname' => true)
-     * @return string
-     */
-    protected function listifyTagLookup($array)
-    {
-        ksort($array);
-        $list = array();
-        foreach ($array as $name => $discard) {
-            if ($name !== '#PCDATA' && !isset($this->def->info[$name])) {
-                continue;
-            }
-            $list[] = $name;
-        }
-        return $this->listify($list);
-    }
-
-    /**
-     * Listifies a list of objects by retrieving class names and internal state
-     * @param array $array List of objects
-     * @return string
-     * @todo Also add information about internal state
-     */
-    protected function listifyObjectList($array)
-    {
-        ksort($array);
-        $list = array();
-        foreach ($array as $obj) {
-            $list[] = $this->getClass($obj, 'AttrTransform_');
-        }
-        return $this->listify($list);
-    }
-
-    /**
-     * Listifies a hash of attributes to AttrDef classes
-     * @param array $array Array hash in form of array('attrname' => HTMLPurifier_AttrDef)
-     * @return string
-     */
-    protected function listifyAttr($array)
-    {
-        ksort($array);
-        $list = array();
-        foreach ($array as $name => $obj) {
-            if ($obj === false) {
-                continue;
-            }
-            $list[] = "$name&nbsp;=&nbsp;<i>" . $this->getClass($obj, 'AttrDef_') . '</i>';
-        }
-        return $this->listify($list);
-    }
-
-    /**
-     * Creates a heavy header row
-     * @param string $text
-     * @param int $num
-     * @return string
-     */
-    protected function heavyHeader($text, $num = 1)
-    {
-        $ret = '';
-        $ret .= $this->start('tr');
-        $ret .= $this->element('th', $text, array('colspan' => $num, 'class' => 'heavy'));
-        $ret .= $this->end('tr');
-        return $ret;
-    }
-}
-
-// vim: et sw=4 sts=4
+<?php
+
+class HTMLPurifier_Printer_HTMLDefinition extends HTMLPurifier_Printer
+{
+
+    /**
+     * @type HTMLPurifier_HTMLDefinition, for easy access
+     */
+    protected $def;
+
+    /**
+     * @param HTMLPurifier_Config $config
+     * @return string
+     */
+    public function render($config)
+    {
+        $ret = '';
+        $this->config =& $config;
+
+        $this->def = $config->getHTMLDefinition();
+
+        $ret .= $this->start('div', array('class' => 'HTMLPurifier_Printer'));
+
+        $ret .= $this->renderDoctype();
+        $ret .= $this->renderEnvironment();
+        $ret .= $this->renderContentSets();
+        $ret .= $this->renderInfo();
+
+        $ret .= $this->end('div');
+
+        return $ret;
+    }
+
+    /**
+     * Renders the Doctype table
+     * @return string
+     */
+    protected function renderDoctype()
+    {
+        $doctype = $this->def->doctype;
+        $ret = '';
+        $ret .= $this->start('table');
+        $ret .= $this->element('caption', 'Doctype');
+        $ret .= $this->row('Name', $doctype->name);
+        $ret .= $this->row('XML', $doctype->xml ? 'Yes' : 'No');
+        $ret .= $this->row('Default Modules', implode(', ', $doctype->modules));
+        $ret .= $this->row('Default Tidy Modules', implode(', ', $doctype->tidyModules));
+        $ret .= $this->end('table');
+        return $ret;
+    }
+
+
+    /**
+     * Renders environment table, which is miscellaneous info
+     * @return string
+     */
+    protected function renderEnvironment()
+    {
+        $def = $this->def;
+
+        $ret = '';
+
+        $ret .= $this->start('table');
+        $ret .= $this->element('caption', 'Environment');
+
+        $ret .= $this->row('Parent of fragment', $def->info_parent);
+        $ret .= $this->renderChildren($def->info_parent_def->child);
+        $ret .= $this->row('Block wrap name', $def->info_block_wrapper);
+
+        $ret .= $this->start('tr');
+        $ret .= $this->element('th', 'Global attributes');
+        $ret .= $this->element('td', $this->listifyAttr($def->info_global_attr), null, 0);
+        $ret .= $this->end('tr');
+
+        $ret .= $this->start('tr');
+        $ret .= $this->element('th', 'Tag transforms');
+        $list = array();
+        foreach ($def->info_tag_transform as $old => $new) {
+            $new = $this->getClass($new, 'TagTransform_');
+            $list[] = "<$old> with $new";
+        }
+        $ret .= $this->element('td', $this->listify($list));
+        $ret .= $this->end('tr');
+
+        $ret .= $this->start('tr');
+        $ret .= $this->element('th', 'Pre-AttrTransform');
+        $ret .= $this->element('td', $this->listifyObjectList($def->info_attr_transform_pre));
+        $ret .= $this->end('tr');
+
+        $ret .= $this->start('tr');
+        $ret .= $this->element('th', 'Post-AttrTransform');
+        $ret .= $this->element('td', $this->listifyObjectList($def->info_attr_transform_post));
+        $ret .= $this->end('tr');
+
+        $ret .= $this->end('table');
+        return $ret;
+    }
+
+    /**
+     * Renders the Content Sets table
+     * @return string
+     */
+    protected function renderContentSets()
+    {
+        $ret = '';
+        $ret .= $this->start('table');
+        $ret .= $this->element('caption', 'Content Sets');
+        foreach ($this->def->info_content_sets as $name => $lookup) {
+            $ret .= $this->heavyHeader($name);
+            $ret .= $this->start('tr');
+            $ret .= $this->element('td', $this->listifyTagLookup($lookup));
+            $ret .= $this->end('tr');
+        }
+        $ret .= $this->end('table');
+        return $ret;
+    }
+
+    /**
+     * Renders the Elements ($info) table
+     * @return string
+     */
+    protected function renderInfo()
+    {
+        $ret = '';
+        $ret .= $this->start('table');
+        $ret .= $this->element('caption', 'Elements ($info)');
+        ksort($this->def->info);
+        $ret .= $this->heavyHeader('Allowed tags', 2);
+        $ret .= $this->start('tr');
+        $ret .= $this->element('td', $this->listifyTagLookup($this->def->info), array('colspan' => 2));
+        $ret .= $this->end('tr');
+        foreach ($this->def->info as $name => $def) {
+            $ret .= $this->start('tr');
+            $ret .= $this->element('th', "<$name>", array('class' => 'heavy', 'colspan' => 2));
+            $ret .= $this->end('tr');
+            $ret .= $this->start('tr');
+            $ret .= $this->element('th', 'Inline content');
+            $ret .= $this->element('td', $def->descendants_are_inline ? 'Yes' : 'No');
+            $ret .= $this->end('tr');
+            if (!empty($def->excludes)) {
+                $ret .= $this->start('tr');
+                $ret .= $this->element('th', 'Excludes');
+                $ret .= $this->element('td', $this->listifyTagLookup($def->excludes));
+                $ret .= $this->end('tr');
+            }
+            if (!empty($def->attr_transform_pre)) {
+                $ret .= $this->start('tr');
+                $ret .= $this->element('th', 'Pre-AttrTransform');
+                $ret .= $this->element('td', $this->listifyObjectList($def->attr_transform_pre));
+                $ret .= $this->end('tr');
+            }
+            if (!empty($def->attr_transform_post)) {
+                $ret .= $this->start('tr');
+                $ret .= $this->element('th', 'Post-AttrTransform');
+                $ret .= $this->element('td', $this->listifyObjectList($def->attr_transform_post));
+                $ret .= $this->end('tr');
+            }
+            if (!empty($def->auto_close)) {
+                $ret .= $this->start('tr');
+                $ret .= $this->element('th', 'Auto closed by');
+                $ret .= $this->element('td', $this->listifyTagLookup($def->auto_close));
+                $ret .= $this->end('tr');
+            }
+            $ret .= $this->start('tr');
+            $ret .= $this->element('th', 'Allowed attributes');
+            $ret .= $this->element('td', $this->listifyAttr($def->attr), array(), 0);
+            $ret .= $this->end('tr');
+
+            if (!empty($def->required_attr)) {
+                $ret .= $this->row('Required attributes', $this->listify($def->required_attr));
+            }
+
+            $ret .= $this->renderChildren($def->child);
+        }
+        $ret .= $this->end('table');
+        return $ret;
+    }
+
+    /**
+     * Renders a row describing the allowed children of an element
+     * @param HTMLPurifier_ChildDef $def HTMLPurifier_ChildDef of pertinent element
+     * @return string
+     */
+    protected function renderChildren($def)
+    {
+        $context = new HTMLPurifier_Context();
+        $ret = '';
+        $ret .= $this->start('tr');
+        $elements = array();
+        $attr = array();
+        if (isset($def->elements)) {
+            if ($def->type == 'strictblockquote') {
+                $def->validateChildren(array(), $this->config, $context);
+            }
+            $elements = $def->elements;
+        }
+        if ($def->type == 'chameleon') {
+            $attr['rowspan'] = 2;
+        } elseif ($def->type == 'empty') {
+            $elements = array();
+        } elseif ($def->type == 'table') {
+            $elements = array_flip(
+                array(
+                    'col',
+                    'caption',
+                    'colgroup',
+                    'thead',
+                    'tfoot',
+                    'tbody',
+                    'tr'
+                )
+            );
+        }
+        $ret .= $this->element('th', 'Allowed children', $attr);
+
+        if ($def->type == 'chameleon') {
+
+            $ret .= $this->element(
+                'td',
+                '<em>Block</em>: ' .
+                $this->escape($this->listifyTagLookup($def->block->elements)),
+                null,
+                0
+            );
+            $ret .= $this->end('tr');
+            $ret .= $this->start('tr');
+            $ret .= $this->element(
+                'td',
+                '<em>Inline</em>: ' .
+                $this->escape($this->listifyTagLookup($def->inline->elements)),
+                null,
+                0
+            );
+
+        } elseif ($def->type == 'custom') {
+
+            $ret .= $this->element(
+                'td',
+                '<em>' . ucfirst($def->type) . '</em>: ' .
+                $def->dtd_regex
+            );
+
+        } else {
+            $ret .= $this->element(
+                'td',
+                '<em>' . ucfirst($def->type) . '</em>: ' .
+                $this->escape($this->listifyTagLookup($elements)),
+                null,
+                0
+            );
+        }
+        $ret .= $this->end('tr');
+        return $ret;
+    }
+
+    /**
+     * Listifies a tag lookup table.
+     * @param array $array Tag lookup array in form of array('tagname' => true)
+     * @return string
+     */
+    protected function listifyTagLookup($array)
+    {
+        ksort($array);
+        $list = array();
+        foreach ($array as $name => $discard) {
+            if ($name !== '#PCDATA' && !isset($this->def->info[$name])) {
+                continue;
+            }
+            $list[] = $name;
+        }
+        return $this->listify($list);
+    }
+
+    /**
+     * Listifies a list of objects by retrieving class names and internal state
+     * @param array $array List of objects
+     * @return string
+     * @todo Also add information about internal state
+     */
+    protected function listifyObjectList($array)
+    {
+        ksort($array);
+        $list = array();
+        foreach ($array as $obj) {
+            $list[] = $this->getClass($obj, 'AttrTransform_');
+        }
+        return $this->listify($list);
+    }
+
+    /**
+     * Listifies a hash of attributes to AttrDef classes
+     * @param array $array Array hash in form of array('attrname' => HTMLPurifier_AttrDef)
+     * @return string
+     */
+    protected function listifyAttr($array)
+    {
+        ksort($array);
+        $list = array();
+        foreach ($array as $name => $obj) {
+            if ($obj === false) {
+                continue;
+            }
+            $list[] = "$name&nbsp;=&nbsp;<i>" . $this->getClass($obj, 'AttrDef_') . '</i>';
+        }
+        return $this->listify($list);
+    }
+
+    /**
+     * Creates a heavy header row
+     * @param string $text
+     * @param int $num
+     * @return string
+     */
+    protected function heavyHeader($text, $num = 1)
+    {
+        $ret = '';
+        $ret .= $this->start('tr');
+        $ret .= $this->element('th', $text, array('colspan' => $num, 'class' => 'heavy'));
+        $ret .= $this->end('tr');
+        return $ret;
+    }
+}
+
+// vim: et sw=4 sts=4
@@ -68,6 +68,11 @@ for($i=0; $i<count($key); $i++)
        $enc_cert_data = f_get_parm_str ( $valParam );
    }

+    if ( $nmParam == "enc_cert_data2" )
+    {
+        $enc_cert_data2 = f_get_parm_str ( $valParam );
+    }
+    
    if ( $nmParam == "dn_hash" )
    {
        $dn_hash = f_get_parm_str ( $valParam );
@@ -97,17 +102,25 @@ if( $cert_enc_use == "Y" )
        // KCP 가 리턴해 드리는 dn_hash 와 사이트 코드, 주문번호 , 인증번호를 검증하여
        // 해당 데이터의 위변조를 방지합니다
         $veri_str = $site_cd.$ordr_idxx.$cert_no; // 사이트 코드 + 주문번호 + 인증거래번호
-
-        if ( $ct_cert->check_valid_hash ( $home_dir , $dn_hash , $veri_str ) != "1" )
+        
+        $enc_cert_real_data = $enc_cert_data2;
+        $bin_path = 'bin';
+        
+        if ((int)$config['cf_cert_use'] === 2 && !$config['cf_cert_kcp_enckey']) {
+            $bin_path = 'bin_old';
+            $enc_cert_real_data = $enc_cert_data;
+        }
+        
+        if ( $ct_cert->check_valid_hash ( $home_dir , $kcp_enc_key, $dn_hash , $veri_str ) != "1" )
        {
            if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
                // 검증 실패시 처리 영역
                if(PHP_INT_MAX == 2147483647) // 32-bit
-                    $bin_exe = '/bin/ct_cli';
+                    $bin_exe = '/'.$bin_path.'/ct_cli';
                else
-                    $bin_exe = '/bin/ct_cli_x64';
+                    $bin_exe = '/'.$bin_path.'/ct_cli_x64';
            } else {
-                $bin_exe = '/bin/ct_cli_exe.exe';
+                $bin_exe = '/'.$bin_path.'/ct_cli_exe.exe';
            }

            echo "dn_hash 변조 위험있음 (".G5_KCPCERT_PATH.$bin_exe." 파일에 실행권한이 있는지 확인하세요.)";
@@ -116,13 +129,13 @@ if( $cert_enc_use == "Y" )
        }

        // 가맹점 DB 처리 페이지 영역
-
+        
        // 인증데이터 복호화 함수
        // 해당 함수는 암호화된 enc_cert_data 를
        // site_cd 와 cert_no 를 가지고 복화화 하는 함수 입니다.
        // 정상적으로 복호화 된경우에만 인증데이터를 가져올수 있습니다.
        $opt = "1" ; // 복호화 인코딩 옵션 ( UTF - 8 사용시 "1" )
-        $ct_cert->decrypt_enc_cert( $home_dir , $site_cd , $cert_no , $enc_cert_data , $opt );
+        $ct_cert->decrypt_enc_cert( $home_dir , $kcp_enc_key,  $site_cd , $cert_no , $enc_cert_real_data , $opt );

        $comm_id        = $ct_cert->mf_get_key_value("comm_id"    );                // 이동통신사 코드
        $phone_no       = $ct_cert->mf_get_key_value("phone_no"   );                // 전화번호
@@ -14,12 +14,15 @@ $web_siteid = '';
 if ($config['cf_cert_use'] == 2) { // 실서비스
    $site_cd = 'SM'.$config['cf_cert_kcp_cd'];
    $cert_url = 'https://cert.kcp.co.kr/kcp_cert/cert_view.jsp';
+    $kcp_enc_key = $config['cf_cert_kcp_enckey'];
 } else if ($config['cf_cert_use'] == 1) { // 테스트사용
    $site_cd = 'S6186';
    $cert_url = 'https://testcert.kcp.co.kr/kcp_cert/cert_view.jsp';
+    $kcp_enc_key = 'E66DCEB95BFBD45DF9DFAEEBCB092B5DC2EB3BF0';
 } else { // 사용안함
    $site_cd = '';
    $cert_url = '';
+    $kcp_enc_key = '';
 }

 if(!$site_cd)
@@ -27,6 +27,8 @@ if(!$ordr_idxx)
 $ct_cert = new C_CT_CLI;
 $ct_cert->mf_clear();

+$sbParam = '';
+
 $year          = "00";
 $month         = "00";
 $day           = "00";
@@ -47,7 +49,7 @@ $hash_data = $site_cd   .
             $sex_code  .
             $local_code;

-$up_hash = $ct_cert->make_hash_data( $home_dir, $hash_data );
+$up_hash = $ct_cert->make_hash_data( $home_dir, $kcp_enc_key, $hash_data );

 $ct_cert->mf_clear();
 ?>
@@ -101,10 +103,19 @@ $ct_cert->mf_clear();
 <!-- up_hash 검증 을 위한 필드 -->
 <input type="hidden" name="veri_up_hash" value=""/>

+<!-- web_siteid 을 위한 필드 -->
+<input type="hidden" name="web_siteid_hashYN" value=""/>
+
 <!-- 가맹점 사용 필드 (인증완료시 리턴)-->
 <input type="hidden" name="param_opt_1"  value="opt1"/>
 <input type="hidden" name="param_opt_2"  value="opt2"/>
 <input type="hidden" name="param_opt_3"  value="opt3"/>
+
+<?php if ($config['cf_cert_kcp_enckey']) { ?>
+<!-- 리턴 암호화 고도화 -->
+<input type="hidden" name="cert_enc_use_ext" value="Y"/>
+<input type='hidden' name='kcp_cert_lib_ver' value="<?php echo $ct_cert->get_kcp_lib_ver( $home_dir ); ?>"/>
+<?php } ?>
 </form>

 <script>
@@ -12,6 +12,7 @@ $enc_data      = "";
 $req_tx        = "";

 $enc_cert_data = "";
+$enc_cert_data2 = "";
 $cert_info     = "";

 $tran_cd       = "";
@@ -67,6 +68,11 @@ for($i=0; $i<count($key); $i++)
    {
        $enc_cert_data = f_get_parm_str ( $valParam );
    }
+    
+    if ( $nmParam == "enc_cert_data2" )
+    {
+        $enc_cert_data2 = f_get_parm_str ( $valParam );
+    }

    if ( $nmParam == "dn_hash" )
    {
@@ -98,16 +104,24 @@ if( $cert_enc_use == "Y" )
        // 해당 데이터의 위변조를 방지합니다
         $veri_str = $site_cd.$ordr_idxx.$cert_no; // 사이트 코드 + 주문번호 + 인증거래번호

-        if ( $ct_cert->check_valid_hash ( $home_dir , $dn_hash , $veri_str ) != "1" )
+        $enc_cert_real_data = $enc_cert_data2;
+        $bin_path = 'bin';
+        
+        if ((int)$config['cf_cert_use'] === 2 && !$config['cf_cert_kcp_enckey']) {
+            $bin_path = 'bin_old';
+            $enc_cert_real_data = $enc_cert_data;
+        }
+        
+        if ( $ct_cert->check_valid_hash ( $home_dir , $kcp_enc_key, $dn_hash , $veri_str ) != "1" )
        {
            if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
                // 검증 실패시 처리 영역
                if(PHP_INT_MAX == 2147483647) // 32-bit
-                    $bin_exe = '/bin/ct_cli';
+                    $bin_exe = '/'.$bin_path.'/ct_cli';
                else
-                    $bin_exe = '/bin/ct_cli_x64';
+                    $bin_exe = '/'.$bin_path.'/ct_cli_x64';
            } else {
-                $bin_exe = '/bin/ct_cli_exe.exe';
+                $bin_exe = '/'.$bin_path.'/ct_cli_exe.exe';
            }

            echo "dn_hash 변조 위험있음 (".G5_KCPCERT_PATH.$bin_exe." 파일에 실행권한이 있는지 확인하세요.)";
@@ -116,13 +130,13 @@ if( $cert_enc_use == "Y" )
        }

        // 가맹점 DB 처리 페이지 영역
-
+            
        // 인증데이터 복호화 함수
        // 해당 함수는 암호화된 enc_cert_data 를
        // site_cd 와 cert_no 를 가지고 복화화 하는 함수 입니다.
        // 정상적으로 복호화 된경우에만 인증데이터를 가져올수 있습니다.
        $opt = "1" ; // 복호화 인코딩 옵션 ( UTF - 8 사용시 "1" )
-        $ct_cert->decrypt_enc_cert( $home_dir , $site_cd , $cert_no , $enc_cert_data , $opt );
+        $ct_cert->decrypt_enc_cert( $home_dir , $kcp_enc_key, $site_cd , $cert_no , $enc_cert_real_data , $opt );

        $comm_id        = $ct_cert->mf_get_key_value("comm_id"    );                // 이동통신사 코드
        $phone_no       = $ct_cert->mf_get_key_value("phone_no"   );                // 전화번호
@@ -18,22 +18,39 @@ class   C_CT_CLI
    {
        $this->m_dec_data="";
    }
-
+    
+    function get_bin_dirname()
+    {
+        global $config;
+        
+        $bin_path = ((int)$config['cf_cert_use'] === 2 && !$config['cf_cert_kcp_enckey']) ? 'bin_old' : 'bin';
+        
+        return $bin_path;
+    }
    // hash 처리 영역
-    function make_hash_data( $home_dir , $str )
+    function make_hash_data( $home_dir , $key , $str )
    {
        if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
            if(PHP_INT_MAX == 2147483647) // 32-bit
-                $bin_exe = $home_dir . '/bin/ct_cli';
+                $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli';
            else
-                $bin_exe = $home_dir . '/bin/ct_cli_x64';
+                $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli_x64';
        } else {
-            $bin_exe = $home_dir . '/bin/ct_cli_exe.exe';
+            $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli_exe.exe';
+        }
+        
+        if ($key) {
+            $hash_data = $this -> mf_exec( $bin_exe ,
+                                           "lf_CT_CLI__make_hash_data",
+                                           $key,
+                                           $str
+                                         );
+        } else {
+            $hash_data = $this -> mf_exec( $bin_exe ,
+                                           "lf_CT_CLI__make_hash_data",
+                                           $str
+                                         );
        }
-        $hash_data = $this -> mf_exec( $bin_exe ,
-                                       "lf_CT_CLI__make_hash_data",
-                                       $str
-                                     );

        if ( $hash_data == "" ) { $hash_data = "HS01"; }

@@ -41,21 +58,31 @@ class   C_CT_CLI
    }

    // dn_hash 체크 함수
-    function check_valid_hash ($home_dir , $hash_data , $str )
+    function check_valid_hash ($home_dir , $key , $hash_data , $str )
    {
        if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
            if(PHP_INT_MAX == 2147483647) // 32-bit
-                $bin_exe = $home_dir . '/bin/ct_cli';
+                $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli';
            else
-                $bin_exe = $home_dir . '/bin/ct_cli_x64';
+                $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli_x64';
        } else {
-            $bin_exe = $home_dir . '/bin/ct_cli_exe.exe';
+            $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli_exe.exe';
+        }
+        
+        if ($key) {
+            $ret_val = $this -> mf_exec( $bin_exe ,
+                                         "lf_CT_CLI__check_valid_hash" ,
+                                         $key,
+                                         $hash_data ,
+                                         $str
+                                        );
+        } else {
+            $ret_val = $this -> mf_exec( $bin_exe ,
+                                         "lf_CT_CLI__check_valid_hash" ,
+                                         $hash_data ,
+                                         $str
+                                        );
        }
-        $ret_val = $this -> mf_exec( $bin_exe ,
-                                     "lf_CT_CLI__check_valid_hash" ,
-                                     $hash_data ,
-                                     $str
-                                    );

        if ( $ret_val == "" ) { $ret_val = "HS02"; }

@@ -63,31 +90,52 @@ class   C_CT_CLI
    }

    // 암호화 인증데이터 복호화
-    function decrypt_enc_cert ( $home_dir, $site_cd , $cert_no , $enc_cert_data , $opt)
+    function decrypt_enc_cert ( $home_dir, $key , $site_cd , $cert_no , $enc_cert_data , $opt)
    {
        if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
            if(PHP_INT_MAX == 2147483647) // 32-bit
-                $bin_exe = $home_dir . '/bin/ct_cli';
+                $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli';
            else
-                $bin_exe = $home_dir . '/bin/ct_cli_x64';
-
-            $dec_data = $this -> mf_exec( $bin_exe ,
-                                         "lf_CT_CLI__decrypt_enc_cert" ,
-                                          $site_cd ,
-                                          $cert_no ,
-                                          $enc_cert_data ,
-                                          $opt
-                                        );
+                $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli_x64';
+            
+            if ($key) {
+                $dec_data = $this -> mf_exec( $bin_exe ,
+                                             "lf_CT_CLI__decrypt_enc_cert" ,
+                                              $key,
+                                              $site_cd ,
+                                              $cert_no ,
+                                              $enc_cert_data ,
+                                              $opt
+                                            );
+            } else {
+                $dec_data = $this -> mf_exec( $bin_exe ,
+                                             "lf_CT_CLI__decrypt_enc_cert" ,
+                                              $site_cd ,
+                                              $cert_no ,
+                                              $enc_cert_data ,
+                                              $opt
+                                            );
+            }

        } else {
-            $bin_exe = $home_dir . '/bin/ct_cli_exe.exe';
-
-            $dec_data = $this -> mf_exec( $bin_exe ,
-                                         "lf_CT_CLI__decrypt_enc_cert" ,
-                                          $site_cd ,
-                                          $cert_no ,
-                                          $enc_cert_data
-                                        );
+            $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli_exe.exe';
+            
+            if ($key) {
+                $dec_data = $this -> mf_exec( $bin_exe ,
+                                             "lf_CT_CLI__decrypt_enc_cert" ,
+                                              $key,
+                                              $site_cd ,
+                                              $cert_no ,
+                                              $enc_cert_data
+                                            );
+            } else {
+                $dec_data = $this -> mf_exec( $bin_exe ,
+                                             "lf_CT_CLI__decrypt_enc_cert" ,
+                                              $site_cd ,
+                                              $cert_no ,
+                                              $enc_cert_data
+                                            );
+            }
        }

        if ( $dec_data == "" ) { $dec_data = "HS03"; }
@@ -96,6 +144,26 @@ class   C_CT_CLI
        parse_str( str_replace( chr( 31 ), "&", $dec_data ), $this->m_dec_data );
    }

+    function get_kcp_lib_ver( $home_dir )
+    {
+        if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
+            if(PHP_INT_MAX == 2147483647) // 32-bit
+                $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli';
+            else
+                $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli_x64';
+        } else {
+            $bin_exe = $home_dir . '/'.$this->get_bin_dirname().'/ct_cli_exe.exe';
+        }
+        
+        $ver_data = $this -> mf_exec( $bin_exe , 
+                                       "lf_CT_CLI__get_kcp_lib_ver"
+                                     );
+
+        if ( $ver_data == "" ) { $ver_data = "HS04"; }
+        
+        return $ver_data;
+    }
+    
    // 인증데이터 get data
    function mf_get_key_value( $name )
    {
@@ -82,17 +82,10 @@ if( !isset($g5['g5_shop_post_log_table']) || !$g5['g5_shop_post_log_table'] ){
 // 옵션 ID 특수문자 필터링 패턴
 define('G5_OPTION_ID_FILTER', '/[\'\"\\\'\\\"]/');

-if(isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') {
-    // 토스페이먼츠 현금영수증 실결제 URL 상수
-    define('SHOP_TOSSPAYMENTS_CASHRECEIPT_REAL_JS', 'https://pgweb.tosspayments.com/WEB_SERVER/js/receipt_link.js');
-    // 토스페이먼츠 현금영수증 테스트 URL 상수
-    define('SHOP_TOSSPAYMENTS_CASHRECEIPT_TEST_JS', 'https://pgweb.tosspayments.com:7085/WEB_SERVER/js/receipt_link.js');
-} else {
-    // 토스페이먼츠 현금영수증 실결제 URL 상수
-    define('SHOP_TOSSPAYMENTS_CASHRECEIPT_REAL_JS', 'http://pgweb.tosspayments.com/WEB_SERVER/js/receipt_link.js');
-    // 토스페이먼츠 현금영수증 테스트 URL 상수
-    define('SHOP_TOSSPAYMENTS_CASHRECEIPT_TEST_JS', 'http://pgweb.tosspayments.com:7085/WEB_SERVER/js/receipt_link.js');
-}
+// 토스페이먼츠 현금영수증 실결제 URL 상수
+define('SHOP_TOSSPAYMENTS_CASHRECEIPT_REAL_JS', 'https://pgweb.tosspayments.com/WEB_SERVER/js/receipt_link.js');
+// 토스페이먼츠 현금영수증 테스트 URL 상수
+define('SHOP_TOSSPAYMENTS_CASHRECEIPT_TEST_JS', 'https://pgweb.tosspayments.com:7085/WEB_SERVER/js/receipt_link.js');

 // 네이버페이를 신용카드 결제창에서 지원하고 있으므로 네이버에 직접신청하는 결제 기능을 미사용(false:기본설정) 합니다. (kagla,211019)
 // 네이버에서 직접신청 결제를 사용(true)하시는 경우 모든 문제를 직접 해결해 주셔야 합니다.
@@ -148,7 +148,12 @@ else // 장바구니에 담기
    $post_io_ids = (isset($_POST['io_id']) && is_array($_POST['io_id'])) ? $_POST['io_id'] : array();
    $post_io_types = (isset($_POST['io_type']) && is_array($_POST['io_type'])) ? $_POST['io_type'] : array();
    $post_ct_qtys = (isset($_POST['ct_qty']) && is_array($_POST['ct_qty'])) ? $_POST['ct_qty'] : array();
-
+    
+    if ($count && $sw_direct) {
+        // 바로구매에 있던 장바구니 자료를 지운다.
+        sql_query(" delete from {$g5['g5_shop_cart_table']} where od_id = '$tmp_cart_id' and ct_direct = 1 ", false);
+    }
+    
    for($i=0; $i<$count; $i++) {
        // 보관함의 상품을 담을 때 체크되지 않은 상품 건너뜀
        if($act == 'multi' && ! (isset($post_chk_it_id[$i]) && $post_chk_it_id[$i]))
@@ -180,10 +185,6 @@ else // 장바구니에 담기
        if(!$it['it_id'])
            alert('상품정보가 존재하지 않습니다.');

-        // 바로구매에 있던 장바구니 자료를 지운다.
-        if($i == 0 && $sw_direct)
-            sql_query(" delete from {$g5['g5_shop_cart_table']} where od_id = '$tmp_cart_id' and ct_direct = 1 ", false);
-
        // 최소, 최대 수량 체크
        if($it['it_buy_min_qty'] || $it['it_buy_max_qty']) {
            $sum_qty = 0;
@@ -81,7 +81,7 @@ if ($xpay->TX()) {
        $app_time        = $xpay->Response('LGD_PAYDATE',0);
        $bank_name = $bankname = $xpay->Response('LGD_FINANCENAME',0);
        $depositor       = $xpay->Response('LGD_PAYER',0);
-        $account         = $xpay->Response('LGD_FINANCENAME',0).' '.$xpay->Response('LGD_ACCOUNTNUM',0).' '.$xpay->Response('LGD_SAOWNER',0);
+        $account         = $xpay->Response('LGD_ACCOUNTNUM',0).' '.$xpay->Response('LGD_SAOWNER',0);
        $commid          = $xpay->Response('LGD_FINANCENAME',0);
        $mobile_no       = $xpay->Response('LGD_TELNO',0);
        $app_no = $od_app_no = $xpay->Response('LGD_FINANCEAUTHNUM',0);
@@ -2,7 +2,7 @@
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가

 define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.6.6');
+define('G5_GNUBOARD_VER', '5.6.12');
 // 그누보드5.4.5.5 버전과 영카트5.4.5.5.1 버전을 합쳐서 그누보드5.4.6 버전에서 시작함 (kagla-210617)
 // G5_YOUNGCART_VER 이 상수를 사용하는 곳이 있으므로 주석 처리 해제함
 // 그누보드5.4.6 이상 버전 부터는 영카트를 그누보드에 포함하여 배포하므로 영카트5의 버전은 의미가 없습니다.
Author	SHA1	Message	Date
thisgun	ada8f28aae	버전 5.6.12 수정	2025-04-15 16:33:05 +09:00
thisgun	11afc52b84	접근차단 ip 코드의 위치 다시 재수정	2025-04-15 16:31:27 +09:00
thisgun	d9c3f0e66c	Merge branch 'master' of github.com:gnuboard/gnuboard5	2025-04-15 12:06:31 +09:00
thisgun	49da5c33df	버전 5.6.11 수정	2025-04-15 11:56:53 +09:00
thisgun	29250f264a	첩근차단 ip코드의 위치 수정	2025-04-15 11:44:40 +09:00
thisgun	df00641290	php warning 메시지 코드 수정	2025-04-15 11:20:44 +09:00
thisgun	a05a1403f5	Merge branch 'master' of github.com:gnuboard/g5-update	2025-04-15 10:52:11 +09:00
총	c5817594d0	[KVE-2025-0234] 관리자 XSS 취약점 수정	2025-04-15 10:11:31 +09:00
kagla	68a9e45337	Revert "경로 수정 및 불필요한 파일 삭제: CSS 파일 경로를 절대 경로로 변경하고, 사용되지 않는 install.css 및 이미지 파일을 삭제함. 또한, 여러 파일에서 include 경로를 수정하여 일관성을 유지함." This reverts commit `b8da0f0890`.	2025-04-11 13:06:43 +09:00
kagla	b8da0f0890	경로 수정 및 불필요한 파일 삭제: CSS 파일 경로를 절대 경로로 변경하고, 사용되지 않는 install.css 및 이미지 파일을 삭제함. 또한, 여러 파일에서 include 경로를 수정하여 일관성을 유지함.	2025-04-11 12:56:45 +09:00
thisgun	62ff45b31f	php warning 메시지 코드 수정	2025-03-31 15:36:32 +09:00
thisgun	918ad48675	이미지 태그에 loading=lazy 가 있을경우 viewimagereisze 함수에서 width 속성을 추가하지 않도록 수정#355	2025-03-14 16:40:26 +09:00
thisgun	e5128bf02e	cheditor5 에 지도아이콘 제거	2025-02-20 12:52:39 +09:00
thisgun	0a0d6e7228	버전 5.6.10 수정	2025-02-04 11:17:21 +09:00
thisgun	69180914f8	쇼핑몰 가상계좌 정보(toss)에 은행이름이 하나 더 붙은 문제 수정	2025-02-04 11:01:41 +09:00
thisgun	5552fda906	사이드뷰에서 잘못된 닉네임 또는 이름이 출력되는 오류 수정	2025-02-04 10:49:01 +09:00
thisgun	13759821fe	메일 함수 예외 로그 추가 #354	2025-02-03 17:56:42 +09:00
thisgun	2e7843da56	php warning 메시지 코드 수정	2025-02-03 11:36:01 +09:00
thisgun	33ee904f60	버전 5.6.9 수정	2025-01-21 16:26:06 +09:00
thisgun	3e8bedb1e9	토스페이먼츠 (구)상점관리자 서비스 종료 관련 수정 #353	2025-01-21 16:24:42 +09:00
thisgun	4f3ad37bf4	쇼핑몰 택배업체 url 추가 및 수정	2025-01-15 16:07:02 +09:00
thisgun	af92ea064e	버전 5.6.8 수정	2024-11-26 17:36:29 +09:00
thisgun	dab5abb89a	NHN_KCP 휴대폰 본인인증 인증키 입력없이 사용할수 있도록 적용	2024-11-26 17:33:04 +09:00
thisgun	8893b112fa	일부 특수문자가 mysql charset 이 uft8 인 경우 기록이 안되는 현상 수정	2024-11-21 11:58:55 +09:00
thisgun	d65fa99e3c	CloudFlare 환경과 적용에 대한 코드 다시 재수정	2024-11-04 16:13:43 +09:00
thisgun	29381da2ce	버전 5.6.7 수정	2024-10-31 16:19:11 +09:00
thisgun	d96f47f93d	NHN_KCP 휴대폰 본인인증 설정 가맹점 인증키 추가	2024-10-31 12:17:26 +09:00
thisgun	830994b637	소셜로그인 테이블 PK 수정	2024-10-28 10:55:14 +09:00
thisgun	0d586e2101	htmlpurifier 4.15.0 버전으로 수정	2024-10-25 17:52:55 +09:00
thisgun	5e6549a22c	영카트 관리자페이지 주문내역출력 페이지 코드 수정	2024-10-25 16:25:54 +09:00
thisgun	ab204cfa59	CloudFlare 환경과 적용에 대한 코드 수정 #349	2024-10-25 11:46:50 +09:00
thisgun	3ca77a38fb	위시리스트에서 주문하기시 상품이 잘못 장바구니 담기되는 오류 수정	2024-10-23 15:23:47 +09:00
thisgun	67051c74a8	latest 함수 PHP 8 optional parameter issue 수정	2024-10-22 17:48:08 +09:00