thisgun and Claude Opus 4.8 76d83c2bae
게시판 정렬 필드 화이트리스트 검증 추가 ...
게시판 설정의 bo_sort_field 가 허용 목록 검증 없이 저장·사용되어
목록 조회 ORDER BY 절에 임의 표현식이 들어갈 수 있던 문제 수정.
정렬값은 따옴표로 감싸지 않아 escape 로 막히지 않으므로,
게시판 관리 권한 계정이 저장한 값이 비로그인 목록 조회에서
실행될 수 있었음.
get_board_sort_fields() 의 허용 목록(관리자 드롭다운과 동일)으로
저장(adm/board_form_update.php)과 사용(bbs/list.php) 양쪽을 검증.
허용 목록 외 값은 기본 정렬로 무력화하여 이미 저장된 값도 차단.
function_exists 가드로 부분 패치 환경 대비.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 07:20:58 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2024-06-04 17:38:33 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2022-06-13 14:28:35 +09:00
2026-04-16 02:26:59 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:54:05 +00:00
2026-04-16 02:54:05 +00:00
2026-04-16 02:54:05 +00:00
2022-06-13 14:28:35 +09:00
2026-06-01 10:26:44 +00:00
2026-06-01 10:26:44 +00:00
2023-01-02 17:58:22 +09:00
2026-06-01 10:26:44 +00:00
2023-01-02 17:58:22 +09:00
2022-06-13 14:28:45 +09:00
2026-06-01 10:26:44 +00:00
2023-01-09 15:33:03 +09:00
2021-01-04 15:39:15 +09:00
2025-07-31 17:12:43 +09:00
2021-01-04 15:39:15 +09:00
2025-03-31 15:36:32 +09:00
2021-04-02 11:40:50 +09:00
2022-09-27 17:15:46 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 03:35:29 +00:00
2023-03-23 11:10:28 +09:00
2026-04-16 03:18:19 +00:00
2026-06-01 10:26:44 +00:00
2026-04-16 01:07:17 +00:00
2021-01-04 15:39:15 +09:00
2025-05-14 11:59:40 +09:00
2026-06-05 07:20:58 +00:00
2026-04-16 02:21:23 +00:00
2024-07-03 12:50:12 +09:00
2026-04-16 01:31:19 +00:00
2026-05-29 09:16:29 +00:00
2021-10-07 06:08:38 +00:00
2024-07-03 12:50:12 +09:00
2022-11-22 19:36:35 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 03:23:00 +00:00
2026-04-16 03:35:29 +00:00
2021-01-04 15:39:15 +09:00
2022-03-11 11:01:15 +09:00
2026-05-26 03:32:18 +00:00
2021-05-10 11:37:20 +09:00
2026-04-16 02:26:59 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 03:39:12 +00:00
2021-01-04 15:39:15 +09:00
2021-09-30 16:07:55 +09:00
2022-04-18 16:51:53 +09:00
2022-06-15 16:11:06 +09:00
2025-04-15 11:20:44 +09:00
2021-01-13 11:48:34 +09:00
2013-09-13 11:03:33 +09:00
2026-04-16 03:23:00 +00:00
2026-04-16 03:38:41 +00:00
2026-06-01 10:26:44 +00:00
2021-01-04 15:39:15 +09:00
2023-08-11 19:41:25 +09:00
2021-01-04 15:39:15 +09:00
2023-01-02 17:58:22 +09:00
2026-04-16 02:26:59 +00:00
2023-01-02 17:58:22 +09:00
2023-01-03 14:53:08 +09:00
2026-06-01 10:26:44 +00:00
2026-04-16 02:26:59 +00:00
2026-04-16 03:46:02 +00:00
2026-04-16 03:35:29 +00:00
2013-09-13 14:32:06 +09:00
2014-01-20 10:09:14 +09:00
2014-02-06 13:38:07 +09:00
2026-06-01 10:26:44 +00:00
2026-04-16 03:46:02 +00:00
2025-04-15 11:20:44 +09:00
2021-01-04 15:39:15 +09:00
2026-05-29 01:33:45 +00:00
2021-01-04 15:39:15 +09:00
2026-06-01 10:26:44 +00:00
2021-01-04 15:39:15 +09:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:29:32 +00:00
2021-01-04 15:39:15 +09:00
2026-04-16 02:29:32 +00:00
2021-06-22 16:07:02 +09:00
2026-04-16 02:29:32 +00:00
2026-05-26 09:34:18 +00:00
2025-05-15 15:30:40 +09:00
2026-04-16 03:35:29 +00:00
2021-01-04 15:39:15 +09:00
2022-06-13 14:28:35 +09:00
2014-03-18 17:17:11 +09:00
2026-06-01 10:26:44 +00:00
2026-01-27 05:50:34 +00:00
