thisgun 6571119db6
[KVE-2026-1806] 콘텐츠 include 경로 및 미완료주문 출력 처리 보강 ...
콘텐츠 상단/하단 파일 경로를 저장 전에 먼저 정규화한 뒤 확장자와 위치를
검증하도록 순서를 조정한다. 정규화 과정에서 확장자가 사라져 검증을
우회하던 경로를 차단한다. 실행 직전 bbs/content.php 에서도 승인 확장자와
data 디렉터리 귀결 여부를 다시 확인하는 is_content_include_allowed() 를
적용하고, 콘텐츠 상단/하단 이미지 업로드는 이미지 파일만 허용하도록 검사한다.
미완료주문 상세의 결제방법 출력에 get_text() 인코딩을 적용하고, 임시주문
저장 시 정제한 결제수단 값을 원본에도 반영한다. 개인결제 주문 세션은
결제정보 검증을 통과한 뒤에만 설정한다.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com >
(cherry picked from commit 196255d76912531d7e13861821bd59ca15c967d1)
2026-08-24 07:44:22 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2024-06-04 17:38:33 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2022-06-13 14:28:35 +09:00
2026-04-16 02:26:59 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:54:05 +00:00
2026-04-16 02:54:05 +00:00
2026-04-16 02:54:05 +00:00
2022-06-13 14:28:35 +09:00
2026-06-01 10:26:44 +00:00
2026-06-01 10:26:44 +00:00
2023-01-02 17:58:22 +09:00
2026-06-01 10:26:44 +00:00
2023-01-02 17:58:22 +09:00
2022-06-13 14:28:45 +09:00
2026-06-01 10:26:44 +00:00
2026-08-24 07:44:22 +00:00
2026-08-24 07:44:22 +00:00
2025-07-31 17:12:43 +09:00
2021-01-04 15:39:15 +09:00
2025-03-31 15:36:32 +09:00
2021-04-02 11:40:50 +09:00
2022-09-27 17:15:46 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 03:35:29 +00:00
2023-03-23 11:10:28 +09:00
2026-04-16 03:18:19 +00:00
2026-06-01 10:26:44 +00:00
2026-04-16 01:07:17 +00:00
2021-01-04 15:39:15 +09:00
2025-05-14 11:59:40 +09:00
2026-06-05 07:20:58 +00:00
2026-04-16 02:21:23 +00:00
2024-07-03 12:50:12 +09:00
2026-04-16 01:31:19 +00:00
2026-05-29 09:16:29 +00:00
2021-10-07 06:08:38 +00:00
2024-07-03 12:50:12 +09:00
2022-11-22 19:36:35 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 03:23:00 +00:00
2026-04-16 03:35:29 +00:00
2021-01-04 15:39:15 +09:00
2022-03-11 11:01:15 +09:00
2026-05-26 03:32:18 +00:00
2021-05-10 11:37:20 +09:00
2026-04-16 02:26:59 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 03:39:12 +00:00
2021-01-04 15:39:15 +09:00
2021-09-30 16:07:55 +09:00
2022-04-18 16:51:53 +09:00
2022-06-15 16:11:06 +09:00
2025-04-15 11:20:44 +09:00
2021-01-13 11:48:34 +09:00
2013-09-13 11:03:33 +09:00
2026-08-24 07:44:22 +00:00
2026-04-16 03:38:41 +00:00
2026-06-01 10:26:44 +00:00
2021-01-04 15:39:15 +09:00
2023-08-11 19:41:25 +09:00
2026-08-24 07:44:22 +00:00
2023-01-02 17:58:22 +09:00
2026-08-24 07:44:22 +00:00
2023-01-02 17:58:22 +09:00
2026-08-24 07:44:22 +00:00
2026-08-24 07:44:22 +00:00
2026-04-16 02:26:59 +00:00
2026-04-16 03:46:02 +00:00
2026-04-16 03:35:29 +00:00
2013-09-13 14:32:06 +09:00
2014-01-20 10:09:14 +09:00
2014-02-06 13:38:07 +09:00
2026-08-24 07:44:22 +00:00
2026-06-16 03:26:42 +00:00
2025-04-15 11:20:44 +09:00
2021-01-04 15:39:15 +09:00
2026-05-29 01:33:45 +00:00
2021-01-04 15:39:15 +09:00
2026-06-01 10:26:44 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:29:32 +00:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:29:32 +00:00
2021-06-22 16:07:02 +09:00
2026-04-16 02:29:32 +00:00
2026-05-26 09:34:18 +00:00
2025-05-15 15:30:40 +09:00
2026-04-16 03:35:29 +00:00
2021-01-04 15:39:15 +09:00
2022-06-13 14:28:35 +09:00
2014-03-18 17:17:11 +09:00
2026-06-01 10:26:44 +00:00
2026-01-27 05:50:34 +00:00
thisgun
6571119db6