strstr()은 일치하는 부분 문자열 전체를 반환하므로 존재 여부만 체크할 때는 메모리 할당이 낭비됨. strpos()는 위치(int) 또는 false만 반환하여 메모리 할당 없이 더 빠르게 동일 동작 수행. 적용 파일 (19개, 약 25곳): - lib/common.lib.php: wr_option html1/html2/secret 검사 3곳 - lib/shop.lib.php: de_taxsave_types 검사 2곳 - lib/latest.lib.php: wr_option secret 검사 1곳 - lib/thumbnail.lib.php: wr_option secret 검사 1곳 - lib/URI/uri.class.php: URI 확장자 검사 1곳 - bbs/view.php: subject/wr_option/content 검사 4곳 - bbs/view_comment.php: wr_option secret 검사 1곳 - bbs/search.php: wr_option/sfl 검사 3곳 - bbs/rss.php: wr_option html 검사 1곳 - bbs/write_update.php: html1/html2 검사 2곳 - bbs/move_update.php: wr_option html 검사 1곳 - adm/admin.lib.php: auth 권한 검사 1곳 - adm/admin.head.php: 메뉴 권한 검사 1곳 - adm/session_file_delete.php: sess_ prefix 검사 1곳 - adm/point_list.php, adm/auth_list.php: sfl mb_id 검사 2곳 - adm/sms_admin/_common.php: install.php 검사 1곳 - adm/shop_admin/configform.php: de_taxsave_types 검사 3곳 - head.sub.php: admin dir 검사 1곳 규칙: strstr($a, $b) → strpos($a, $b) !== false !strstr($a, $b) → strpos($a, $b) === false 제외: - theme/, skin/, plugin/ (사용자 커스터마이징/서드파티) - strstr() 반환값을 실제로 사용하는 케이스 (예: lib/common.lib.php:4135 if( \$freg = strstr(\$ori_params, '#') ), extend/gif2mp4.extend.php)
173 lines
5.1 KiB
PHP
173 lines
5.1 KiB
PHP
<?php
|
|
if (!defined('_GNUBOARD_')) exit;
|
|
|
|
class G5_URI {
|
|
public $basename;
|
|
public $parts;
|
|
public $slashes;
|
|
|
|
public static function getInstance()
|
|
{ //싱글톤
|
|
static $instance = null;
|
|
if (null === $instance) {
|
|
$instance = new self();
|
|
}
|
|
|
|
return $instance;
|
|
}
|
|
|
|
public function parseURL() {
|
|
/* grab URL query string and script name */
|
|
$uri = $_SERVER['REQUEST_URI'];
|
|
$script = $_SERVER['SCRIPT_NAME'];
|
|
/* get extension */
|
|
$script_names = explode(".",$script);
|
|
$ext = end($script_names);
|
|
|
|
/* if extension is found in URL, eliminate it */
|
|
if(strpos($uri,".") !== false) {
|
|
$arr_uri = explode('.', $uri);
|
|
/* get last part */
|
|
$last = end($arr_uri);
|
|
|
|
if($last == $ext){
|
|
array_pop($arr_uri);
|
|
$uri = implode('.', $arr_uri);
|
|
}
|
|
}
|
|
|
|
/* pick the name without extension */
|
|
$basename = basename ($script, '.'.$ext);
|
|
/* slicing query string */
|
|
$temp = explode('/',$uri);
|
|
$key = array_search($basename,$temp);
|
|
$parts = array_slice ($temp, $key+1);
|
|
$this->basename = $basename;
|
|
$this->parts = $parts;
|
|
|
|
}
|
|
|
|
public function setRelative($relativevar) {
|
|
/* count the number of slash
|
|
to define relative path */
|
|
$numslash = count($this->parts);
|
|
$slashes="";
|
|
for($i=0;$i<$numslash;$i++){
|
|
$slashes .= "../";
|
|
}
|
|
$this->slashes = $slashes;
|
|
/* make relative path variable available for webpage */
|
|
//eval("\$GLOBALS['$relativevar'] = '$slashes';");
|
|
|
|
$links = array();
|
|
$links[$relativevar] = $slashes;
|
|
|
|
return $links;
|
|
}
|
|
|
|
public function getParts() {
|
|
/* return array of sliced query string */
|
|
return $this->parts;
|
|
}
|
|
|
|
public function setParts() {
|
|
/* pair off query string variable and query string value */
|
|
$numargs = func_num_args();
|
|
$arg_list = func_get_args();
|
|
$urlparts = $this->getParts();
|
|
$links = array();
|
|
for ($i = 0; $i < $numargs; $i++) {
|
|
/* make them available for webpage */
|
|
//eval ("\$GLOBALS['".$arg_list[$i] ."']= '$urlparts[$i]';");
|
|
$links[$arg_list[$i]] = $urlparts[$i];
|
|
}
|
|
|
|
return $links;
|
|
}
|
|
/**
|
|
* convert normal URL query string to clean URL
|
|
*/
|
|
public function makeClean($string_url) {
|
|
$url = parse_url($string_url);
|
|
$strUrl = basename($url['path'],".php");
|
|
parse_str($url['query'],$queryString);
|
|
foreach($queryString as $value){
|
|
$strUrl .= "/$value";
|
|
}
|
|
return $strUrl;
|
|
}
|
|
|
|
public function url_clean($string_url, $add_qry='') {
|
|
global $config, $g5;
|
|
|
|
$string_url = str_replace('&', '&', $string_url);
|
|
$url=parse_url($string_url);
|
|
$page_name = basename($url['path'],".php");
|
|
|
|
$array_page_names = run_replace('url_clean_page_names', array('board', 'write'));
|
|
|
|
if( strpos($string_url, G5_BBS_URL) === false || ! in_array($page_name, $array_page_names) ){ //게시판이 아니면 리턴
|
|
return $string_url;
|
|
}
|
|
|
|
$return_url = '';
|
|
parse_str($url['query'], $vars);
|
|
|
|
// 예) Array ( [scheme] => http [host] => sir.kr [path] => /bbs/board.php [query] => wr_id=1110870&bo_table=cm_free&cpage=1 [fragment] => c_1110946 )
|
|
//while(list($k,$v) = each($vars)) $page_name .= "/".$v;
|
|
|
|
if( $page_name === 'write' ){
|
|
$vars['action'] = 'write';
|
|
$allow_param_keys = array('bo_table'=>'', 'action'=>'');
|
|
} else {
|
|
$allow_param_keys = array('bo_table'=>'', 'wr_id'=>'');
|
|
}
|
|
|
|
$s = array();
|
|
|
|
foreach( $allow_param_keys as $key=>$v ){
|
|
if( !isset($vars[$key]) || empty($vars[$key]) ) continue;
|
|
$add = '';
|
|
$s[$key] = $vars[$key];
|
|
}
|
|
|
|
if( $config['cf_bbs_rewrite'] > 1 && $page_name === 'board' && (isset($s['wr_id']) && $s['wr_id']) && (isset($s['bo_table']) && $s['bo_table']) ){
|
|
$get_write = get_write( get_write_table_name($s['bo_table']), $s['wr_id'], true);
|
|
|
|
if( $get_write['wr_seo_title'] ){
|
|
unset($s['wr_id']);
|
|
$s['wr_seo_title'] = $get_write['wr_seo_title'].'/';
|
|
}
|
|
}
|
|
|
|
$fragment = isset($url['fragment']) ? '#'.$url['fragment'] : '';
|
|
|
|
$host = G5_URL;
|
|
|
|
if( isset($url['host']) ){
|
|
|
|
$array_file_paths = run_replace('url_clean_page_paths', array('/'.G5_BBS_DIR.'/board.php', '/'.G5_BBS_DIR.'/write.php'));
|
|
|
|
$str_path = isset($url['path']) ? $url['path'] : '';
|
|
$http = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ? 'https://' : 'http://';
|
|
$host = $http.$url['host'].str_replace($array_file_paths, '', $str_path);
|
|
}
|
|
|
|
$add_param = '';
|
|
|
|
if( $result = array_diff_key($vars, $allow_param_keys ) ){
|
|
$add_param = '?'.http_build_query($result,'','&');
|
|
}
|
|
|
|
if( $add_qry ){
|
|
$add_param .= $add_param ? '&'.$add_qry : '?'.$add_qry;
|
|
}
|
|
|
|
foreach($s as $value){
|
|
$return_url .= "/$value";
|
|
}
|
|
|
|
return $host.$return_url.$add_param.$fragment;
|
|
}
|
|
}
|