thisgun 79f915988b
[security]개인결제 hash 검증을 strict 비교(===)로 강화 ...
shop/personalpayformupdate.php와 lib/shop.lib.php의 ss_personalpay_hash
검증이 loose 비교(==/!=)를 사용하여 PHP type juggling 잠재적 우회 가능성이
있었음. md5 결과 중 "0e..." 형식 hash는 PHP의 loose 비교에서 0e 지수
표기법으로 해석되어 다른 "0e..." 해시와 동등 판정될 수 있음
(소위 magic hash collision 패턴).
실제 익스플로잇 가능성은 낮지만 (md5 출력은 32자 hex 문자열이고 PHP의
문자열 vs 문자열 비교에서는 0e... 패턴이 적용되지 않는 경우가 많음),
defense in depth 차원에서 strict 비교로 변경.
mobile/shop/personalpayformupdate.php는 이미 strict 비교를 사용 중이라
core 두 곳만 동일한 패턴으로 정렬.
- shop/personalpayformupdate.php:35: != / != → !== / !==
- lib/shop.lib.php:2333: == → ===
2026-04-16 02:46:49 +00:00
2018-03-30 18:12:51 +09:00
2026-04-16 02:43:22 +00:00
2026-03-30 11:50:30 +00:00
2025-07-31 20:21:22 +09:00
2026-04-16 02:43:22 +00:00
2021-01-04 15:39:15 +09:00
2025-11-14 07:30:47 +00:00
2026-04-16 02:43:22 +00:00
2022-01-19 06:16:31 +00:00
2026-04-16 02:43:22 +00:00
2022-03-22 12:52:36 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2022-06-13 14:28:35 +09:00
2022-06-13 14:28:35 +09:00
2021-01-04 15:39:15 +09:00
2023-01-20 11:17:20 +09:00
2021-01-04 15:39:15 +09:00
2026-03-25 09:18:48 +00:00
2023-04-17 12:16:12 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:02:26 +00:00
2019-12-02 10:29:31 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2024-02-14 19:09:20 +09:00
2021-02-26 17:11:57 +09:00
2023-12-18 17:26:30 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:02:26 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2025-09-19 17:53:50 +09:00
2025-09-19 17:53:50 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:02:26 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-03-31 01:21:11 +00:00
2023-07-04 18:37:23 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:02:26 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:26:59 +00:00
2026-04-16 02:15:29 +00:00
2026-04-16 02:15:29 +00:00
2026-04-16 02:15:29 +00:00
2026-04-16 02:15:29 +00:00
2026-04-16 02:15:29 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2024-04-03 10:42:04 +09:00
2025-09-16 16:34:15 +09:00
2026-04-16 02:46:49 +00:00
2026-04-16 02:15:29 +00:00
2026-04-16 02:26:59 +00:00
2025-09-19 17:53:50 +09:00
2025-06-05 16:11:20 +09:00
2021-01-04 15:39:15 +09:00
2025-09-19 17:53:50 +09:00
2021-01-04 15:39:15 +09:00
2025-09-19 17:53:50 +09:00
2021-01-04 15:39:15 +09:00
2025-11-14 07:30:47 +00:00
2025-09-19 17:53:50 +09:00
2024-04-03 10:42:04 +09:00
2026-04-06 06:26:20 +00:00
2025-09-16 16:34:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:43:22 +00:00
2021-01-04 15:39:15 +09:00
2021-03-16 11:01:52 +09:00
thisgun
79f915988b