thisgun and Claude Opus 4.7 f4f8c57a74
[security] 관리자 영역 권한 검증 누락 및 CSRF 토큰 누락 수정 ...
- adm/qa_config_update.php / adm/contentformupdate.php :
qa_include_head/tail, co_include_head/tail 가 super 가드 없이 변경 가능해
하위 관리자가 임의 PHP 경로를 include 시킬 수 있던 LFI 위험을
board_form_update.php 와 동일한 패턴(super 외에는 기존 값 유지)으로 차단.
- adm/member_form_update.php / adm/member_list_update.php :
신규 회원 생성·일괄 수정 시 부여하려는 mb_level 상한 검증이 없어
하위 관리자가 자기보다 높은 등급을 부여할 수 있던 권한 상승을 차단.
- adm/shop_admin/categorylistupdate.php /
adm/shop_admin/itemformupdate.php :
is_include_path_check 호출에서 두 번째 인자(is_input=1) 누락으로
rar/php/zip wrapper 등 경로 wrapper 차단이 동작하지 않던 부분을
is_include_path_check($file, 1) 로 강화.
- adm/shop_admin/orderdeliveryupdate.php /
adm/shop_admin/orderpartcancelupdate.php /
adm/sendmail_test.php :
상태 변경 동작에 check_admin_token() 누락으로 발생하던 CSRF 위험을
토큰 검증 추가로 차단. sendmail_test 폼에는 hidden token 필드 추가.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-26 03:35:29 +00:00
2013-11-21 13:54:41 +09:00
2022-04-08 10:31:50 +09:00
2025-09-17 10:44:40 +09:00
2021-01-04 15:39:15 +09:00
2021-01-11 12:19:37 +09:00
2021-02-26 16:59:44 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-10 12:42:14 +09:00
2021-01-04 15:39:15 +09:00
2023-01-12 10:43:25 +09:00
2023-06-25 03:49:10 +09:00
2026-03-30 12:01:44 +00:00
2026-05-26 03:35:29 +00:00
2026-04-16 02:29:32 +00:00
2025-11-14 07:30:47 +00:00
2025-04-15 10:11:31 +09:00
2022-05-24 08:48:51 +00:00
2021-01-04 15:39:15 +09:00
2026-03-31 01:21:11 +00:00
2023-06-19 17:36:14 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-26 10:05:36 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2023-08-16 11:44:42 +09:00
2021-01-04 15:39:15 +09:00
2026-03-30 11:50:30 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2022-07-01 09:55:11 +09:00
2023-12-18 11:29:37 +09:00
2021-01-09 17:19:31 +09:00
2021-01-09 17:19:31 +09:00
2026-02-03 06:24:34 +00:00
2024-02-14 19:09:20 +09:00
2026-02-03 06:24:34 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2022-04-20 06:20:24 +00:00
2026-02-03 06:24:34 +00:00
2021-01-04 15:39:15 +09:00
2026-05-26 03:35:29 +00:00
2021-04-05 17:01:29 +09:00
2026-03-30 12:01:44 +00:00
2022-05-24 08:48:51 +00:00
2025-08-27 17:58:06 +09:00
2021-01-25 16:17:06 +09:00
2023-06-25 03:49:10 +09:00
2026-03-31 01:21:11 +00:00
2023-06-25 03:49:10 +09:00
2026-02-03 06:24:34 +00:00
2026-02-03 06:24:34 +00:00
2021-01-04 15:39:15 +09:00
2025-09-19 17:53:50 +09:00
2025-09-19 17:53:50 +09:00
2025-08-27 17:58:06 +09:00
2026-03-30 12:01:44 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2023-06-25 03:49:10 +09:00
2026-03-31 01:21:11 +00:00
2023-06-25 03:49:10 +09:00
2026-02-03 06:24:34 +00:00
2021-01-11 20:00:39 +09:00
2021-01-04 15:39:15 +09:00
2022-05-27 10:20:36 +09:00
2026-05-26 03:35:29 +00:00
2026-04-06 12:19:11 +09:00
2025-09-22 10:39:44 +09:00
2025-09-19 17:53:50 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 03:46:02 +00:00
2021-01-04 15:39:15 +09:00
2025-09-19 17:53:50 +09:00
2021-01-04 15:39:15 +09:00
2021-05-11 11:22:07 +09:00
2026-05-26 03:35:29 +00:00
2021-01-04 15:39:15 +09:00
2024-10-25 16:25:54 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2025-09-16 16:34:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-19 14:03:51 +09:00
2022-03-07 14:29:35 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-02-03 06:24:34 +00:00
