그누보드 영카트 다중 취약점(17-1029, 17-1047) 수정

2018-03-13 16:11:52 +09:00
parent d7b5c9a4bd
commit 06ad4e534a
12 changed files with 50 additions and 31 deletions
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@ -3346,6 +3346,11 @@ function is_include_path_check($path='', $is_input='')
 {
    if( $path ){
        if ($is_input){
+
+            if( strpos($path, 'php://') !== false || strpos($path, 'zlib://') !== false || strpos($path, 'bzip2://') !== false || strpos($path, 'zip://') !== false ){
+                return false;
+            }
+
            try {
                // whether $path is unix or not
                $unipath = strlen($path)==0 || $path{0}!='/';