thisgun 6571119db6
[KVE-2026-1806] 콘텐츠 include 경로 및 미완료주문 출력 처리 보강 ...
콘텐츠 상단/하단 파일 경로를 저장 전에 먼저 정규화한 뒤 확장자와 위치를
검증하도록 순서를 조정한다. 정규화 과정에서 확장자가 사라져 검증을
우회하던 경로를 차단한다. 실행 직전 bbs/content.php 에서도 승인 확장자와
data 디렉터리 귀결 여부를 다시 확인하는 is_content_include_allowed() 를
적용하고, 콘텐츠 상단/하단 이미지 업로드는 이미지 파일만 허용하도록 검사한다.
미완료주문 상세의 결제방법 출력에 get_text() 인코딩을 적용하고, 임시주문
저장 시 정제한 결제수단 값을 원본에도 반영한다. 개인결제 주문 세션은
결제정보 검증을 통과한 뒤에만 설정한다.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com >
(cherry picked from commit 196255d76912531d7e13861821bd59ca15c967d1)
2026-08-24 07:44:22 +00:00
2013-11-21 13:54:41 +09:00
2022-04-08 10:31:50 +09:00
2026-08-24 07:44:22 +00:00
2021-01-04 15:39:15 +09:00
2021-01-11 12:19:37 +09:00
2021-02-26 16:59:44 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-06-23 00:36:35 +00:00
2021-01-04 15:39:15 +09:00
2023-01-12 10:43:25 +09:00
2026-06-23 00:36:35 +00:00
2026-03-30 12:01:44 +00:00
2026-06-23 00:36:35 +00:00
2026-07-23 08:03:16 +00:00
2026-07-23 08:03:16 +00:00
2026-06-23 00:36:35 +00:00
2026-06-23 00:36:35 +00:00
2021-01-04 15:39:15 +09:00
2026-03-31 01:21:11 +00:00
2023-06-19 17:36:14 +09:00
2021-01-04 15:39:15 +09:00
2026-08-24 07:44:22 +00:00
2026-06-23 00:36:35 +00:00
2021-01-04 15:39:15 +09:00
2026-06-23 00:48:42 +00:00
2023-08-16 11:44:42 +09:00
2026-07-24 07:11:51 +00:00
2026-08-24 07:44:22 +00:00
2026-07-24 07:11:51 +00:00
2026-07-24 07:11:51 +00:00
2026-08-24 07:44:22 +00:00
2026-06-23 00:36:35 +00:00
2026-08-24 07:44:22 +00:00
2021-01-04 15:39:15 +09:00
2022-07-01 09:55:11 +09:00
2023-12-18 11:29:37 +09:00
2021-01-09 17:19:31 +09:00
2021-01-09 17:19:31 +09:00
2026-02-03 06:24:34 +00:00
2026-06-23 00:36:35 +00:00
2026-02-03 06:24:34 +00:00
2026-07-13 07:20:32 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-07-13 07:20:32 +00:00
2026-06-01 10:26:44 +00:00
2021-01-04 15:39:15 +09:00
2026-06-26 10:40:28 +00:00
2021-04-05 17:01:29 +09:00
2026-03-30 12:01:44 +00:00
2026-06-26 10:40:28 +00:00
2025-08-27 17:58:06 +09:00
2021-01-25 16:17:06 +09:00
2023-06-25 03:49:10 +09:00
2026-03-31 01:21:11 +00:00
2023-06-25 03:49:10 +09:00
2026-02-03 06:24:34 +00:00
2026-02-03 06:24:34 +00:00
2021-01-04 15:39:15 +09:00
2025-09-19 17:53:50 +09:00
2025-09-19 17:53:50 +09:00
2025-08-27 17:58:06 +09:00
2026-03-30 12:01:44 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-06-23 00:36:35 +00:00
2026-03-31 01:21:11 +00:00
2023-06-25 03:49:10 +09:00
2026-02-03 06:24:34 +00:00
2021-01-11 20:00:39 +09:00
2021-01-04 15:39:15 +09:00
2026-05-26 07:30:21 +00:00
2026-05-26 03:35:29 +00:00
2026-08-24 07:44:22 +00:00
2026-08-24 07:44:22 +00:00
2026-06-23 00:36:35 +00:00
2026-07-13 07:15:09 +00:00
2026-04-16 03:46:02 +00:00
2026-07-13 07:15:09 +00:00
2026-07-13 07:15:09 +00:00
2021-01-04 15:39:15 +09:00
2026-08-24 07:44:22 +00:00
2026-08-24 07:44:22 +00:00
2021-01-04 15:39:15 +09:00
2026-05-26 07:30:21 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-07-13 07:20:32 +00:00
2025-09-16 16:34:15 +09:00
2026-06-23 00:36:35 +00:00
2026-08-24 07:44:22 +00:00
2021-01-19 14:03:51 +09:00
2022-03-07 14:29:35 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-05-29 06:25:12 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-06-23 00:36:35 +00:00
2026-02-03 06:24:34 +00:00
thisgun
6571119db6