thisgun 96df43480b
게시판·1:1문의·쇼핑몰분류 상단/하단 파일 경로 처리 보강 ...
콘텐츠와 동일하게, 게시판(bo_include)·1:1문의(qa_include)·쇼핑몰 분류
(ca_include)의 상단/하단 파일 경로도 저장 전에 먼저 정규화한 뒤 확장자와
위치를 검증하도록 순서를 조정한다. 정규화 과정에서 확장자가 사라져 검증을
우회하던 경로를 차단하고, data 디렉터리로 귀결되는 경로를 거부한다.
실행 직전 board_head/board_tail, qahead/qatail, shop 목록·상품 페이지에서도
승인 확장자와 data 디렉터리 여부를 다시 확인하는 is_content_include_allowed()
를 적용한다. 이미 저장된 경로도 실행 시 재확인된다.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com >
(cherry picked from commit 0c6bca704725ebea2a584d4c06366282e9bc36d6)
2026-08-24 07:44:22 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2024-06-04 17:38:33 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2022-06-13 14:28:35 +09:00
2026-04-16 02:26:59 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:54:05 +00:00
2026-04-16 02:54:05 +00:00
2026-04-16 02:54:05 +00:00
2022-06-13 14:28:35 +09:00
2026-06-01 10:26:44 +00:00
2026-06-01 10:26:44 +00:00
2026-08-24 07:44:22 +00:00
2026-06-01 10:26:44 +00:00
2026-08-24 07:44:22 +00:00
2022-06-13 14:28:45 +09:00
2026-06-01 10:26:44 +00:00
2026-08-24 07:44:22 +00:00
2026-08-24 07:44:22 +00:00
2025-07-31 17:12:43 +09:00
2021-01-04 15:39:15 +09:00
2025-03-31 15:36:32 +09:00
2021-04-02 11:40:50 +09:00
2022-09-27 17:15:46 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 03:35:29 +00:00
2023-03-23 11:10:28 +09:00
2026-04-16 03:18:19 +00:00
2026-06-01 10:26:44 +00:00
2026-04-16 01:07:17 +00:00
2021-01-04 15:39:15 +09:00
2025-05-14 11:59:40 +09:00
2026-06-05 07:20:58 +00:00
2026-04-16 02:21:23 +00:00
2024-07-03 12:50:12 +09:00
2026-04-16 01:31:19 +00:00
2026-05-29 09:16:29 +00:00
2021-10-07 06:08:38 +00:00
2024-07-03 12:50:12 +09:00
2022-11-22 19:36:35 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 03:23:00 +00:00
2026-04-16 03:35:29 +00:00
2021-01-04 15:39:15 +09:00
2022-03-11 11:01:15 +09:00
2026-05-26 03:32:18 +00:00
2021-05-10 11:37:20 +09:00
2026-04-16 02:26:59 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 03:39:12 +00:00
2021-01-04 15:39:15 +09:00
2021-09-30 16:07:55 +09:00
2022-04-18 16:51:53 +09:00
2022-06-15 16:11:06 +09:00
2025-04-15 11:20:44 +09:00
2021-01-13 11:48:34 +09:00
2013-09-13 11:03:33 +09:00
2026-08-24 07:44:22 +00:00
2026-04-16 03:38:41 +00:00
2026-06-01 10:26:44 +00:00
2021-01-04 15:39:15 +09:00
2023-08-11 19:41:25 +09:00
2026-08-24 07:44:22 +00:00
2026-08-24 07:44:22 +00:00
2026-08-24 07:44:22 +00:00
2026-08-24 07:44:22 +00:00
2026-08-24 07:44:22 +00:00
2026-08-24 07:44:22 +00:00
2026-04-16 02:26:59 +00:00
2026-04-16 03:46:02 +00:00
2026-04-16 03:35:29 +00:00
2013-09-13 14:32:06 +09:00
2014-01-20 10:09:14 +09:00
2014-02-06 13:38:07 +09:00
2026-08-24 07:44:22 +00:00
2026-06-16 03:26:42 +00:00
2025-04-15 11:20:44 +09:00
2021-01-04 15:39:15 +09:00
2026-05-29 01:33:45 +00:00
2021-01-04 15:39:15 +09:00
2026-06-01 10:26:44 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:29:32 +00:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:29:32 +00:00
2021-06-22 16:07:02 +09:00
2026-04-16 02:29:32 +00:00
2026-05-26 09:34:18 +00:00
2025-05-15 15:30:40 +09:00
2026-04-16 03:35:29 +00:00
2021-01-04 15:39:15 +09:00
2022-06-13 14:28:35 +09:00
2014-03-18 17:17:11 +09:00
2026-06-01 10:26:44 +00:00
2026-01-27 05:50:34 +00:00
thisgun
96df43480b