From 605933c5168036d1cf7c1b734eb03d9a09597d7a Mon Sep 17 00:00:00 2001 From: kagla Date: Thu, 18 Jun 2015 15:49:04 +0900 Subject: [PATCH 1/7] =?UTF-8?q?lo=5Furl=20=EC=9D=98=20XSS=20=EC=B7=A8?= =?UTF-8?q?=EC=95=BD=EC=A0=90=20=ED=95=B4=EA=B2=B0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/current_connect.php | 1 + 1 file changed, 1 insertion(+) diff --git a/bbs/current_connect.php b/bbs/current_connect.php index 686522564..5ad0e2a4e 100644 --- a/bbs/current_connect.php +++ b/bbs/current_connect.php @@ -12,6 +12,7 @@ $sql = " select a.mb_id, b.mb_nick, b.mb_name, b.mb_email, b.mb_homepage, b.mb_o order by a.lo_datetime desc "; $result = sql_query($sql); for ($i=0; $row=sql_fetch_array($result); $i++) { + $row['lo_url'] = get_text($row['lo_url']); $list[$i] = $row; if ($row['mb_id']) { From 4d9e6be3944ec352a936fa703a6418291ca0f5ba Mon Sep 17 00:00:00 2001 From: chicpro Date: Thu, 18 Jun 2015 17:33:21 +0900 Subject: [PATCH 2/7] =?UTF-8?q?XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/current_connect.php | 1 + head.sub.php | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/bbs/current_connect.php b/bbs/current_connect.php index 686522564..5ad0e2a4e 100644 --- a/bbs/current_connect.php +++ b/bbs/current_connect.php @@ -12,6 +12,7 @@ $sql = " select a.mb_id, b.mb_nick, b.mb_name, b.mb_email, b.mb_homepage, b.mb_o order by a.lo_datetime desc "; $result = sql_query($sql); for ($i=0; $row=sql_fetch_array($result); $i++) { + $row['lo_url'] = get_text($row['lo_url']); $list[$i] = $row; if ($row['mb_id']) { diff --git a/head.sub.php b/head.sub.php index bcfb4b9c2..96a8d8d27 100644 --- a/head.sub.php +++ b/head.sub.php @@ -23,8 +23,8 @@ else { // 게시판 제목에 ' 포함되면 오류 발생 $g5['lo_location'] = addslashes($g5['title']); if (!$g5['lo_location']) - $g5['lo_location'] = addslashes($_SERVER['REQUEST_URI']); -$g5['lo_url'] = addslashes($_SERVER['REQUEST_URI']); + $g5['lo_location'] = addslashes(clean_xss_tags($_SERVER['REQUEST_URI'])); +$g5['lo_url'] = addslashes(clean_xss_tags($_SERVER['REQUEST_URI'])); if (strstr($g5['lo_url'], '/'.G5_ADMIN_DIR.'/') || $is_admin == 'super') $g5['lo_url'] = ''; /* From 1b8069eec8f84551653a616a661b29a650bad029 Mon Sep 17 00:00:00 2001 From: chicpro Date: Thu, 18 Jun 2015 17:45:00 +0900 Subject: [PATCH 3/7] =?UTF-8?q?cf=5Finclude=5Fhead=20=EC=84=A4=EC=A0=95=20?= =?UTF-8?q?=EC=A0=81=EC=9A=A9=20=EC=BD=94=EB=93=9C=20=EC=9C=84=EC=B9=98=20?= =?UTF-8?q?=EB=B3=80=EA=B2=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- head.php | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/head.php b/head.php index c27416c4e..cccc0f2db 100644 --- a/head.php +++ b/head.php @@ -1,6 +1,12 @@ Date: Fri, 19 Jun 2015 09:48:28 +0900 Subject: [PATCH 4/7] =?UTF-8?q?xss=20=EA=B4=80=EB=A0=A8=20=ED=83=9C?= =?UTF-8?q?=EA=B7=B8=20=EC=A0=9C=EA=B1=B0=20=ED=95=A8=EC=88=98=20=EC=B6=94?= =?UTF-8?q?=EA=B0=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/member_confirm.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bbs/member_confirm.php b/bbs/member_confirm.php index e3f1e9ab6..9f214f289 100644 --- a/bbs/member_confirm.php +++ b/bbs/member_confirm.php @@ -14,7 +14,7 @@ else $g5['title'] = '회원 비밀번호 확인'; include_once('./_head.sub.php'); -$url = $_GET['url']; +$url = clean_xss_tags($_GET['url']); // url 체크 check_url_host($url); From cbe9c53262257ca6af297f296d8fed39e914e167 Mon Sep 17 00:00:00 2001 From: chicpro Date: Mon, 22 Jun 2015 17:27:16 +0900 Subject: [PATCH 5/7] =?UTF-8?q?=EB=B2=84=EC=A0=84=EB=B3=80=EA=B2=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- config.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config.php b/config.php index 613073dbb..ca8744855 100644 --- a/config.php +++ b/config.php @@ -5,7 +5,7 @@ ********************/ define('G5_VERSION', '그누보드5'); -define('G5_GNUBOARD_VER', '5.0.36'); +define('G5_GNUBOARD_VER', '5.0.37'); // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음 define('_GNUBOARD_', true); From b4b24aadfd62768e55e82c6a3fb35c95d4b47c65 Mon Sep 17 00:00:00 2001 From: chicpro Date: Tue, 23 Jun 2015 11:01:07 +0900 Subject: [PATCH 6/7] =?UTF-8?q?PHP=5FSELF=20=EB=A5=BC=20=EC=9D=B4=EC=9A=A9?= =?UTF-8?q?=ED=95=9C=20XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98?= =?UTF-8?q?=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lib/common.lib.php | 36 +++++++++++++++++++++++++++++++++++- mobile/tail.php | 26 ++------------------------ tail.php | 26 ++------------------------ 3 files changed, 39 insertions(+), 49 deletions(-) diff --git a/lib/common.lib.php b/lib/common.lib.php index 5ee99b547..526d36f4f 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -2881,7 +2881,7 @@ function clean_query_string($query, $amp=true) $q = array(); foreach($out as $key=>$val) { - $key = trim($key); + $key = strip_tags(trim($key)); $val = trim($val); switch($key) { @@ -2953,4 +2953,38 @@ function clean_query_string($query, $amp=true) return $str; } + +function get_device_change_url() +{ + $p = parse_url(G5_URL); + $href = $p['scheme'].'://'.$p['host']; + if(isset($p['port']) && $p['port']) + $href .= ':'.$p['port']; + $href .= $_SERVER['SCRIPT_NAME']; + + $q = array(); + $device = 'device='.(G5_IS_MOBILE ? 'pc' : 'mobile'); + + if($_SERVER['QUERY_STRING']) { + foreach($_GET as $key=>$val) { + if($key == 'device') + continue; + + $key = strip_tags($key); + $val = strip_tags($val); + + if($key && $val) + $q[$key] = $val; + } + } + + if(!empty($q)) { + $query = http_build_query($q, '', '&'); + $href .= '?'.$query.'&'.$device; + } else { + $href .= '?'.$device; + } + + return $href; +} ?> \ No newline at end of file diff --git a/mobile/tail.php b/mobile/tail.php index ceecca3fd..44d88ff22 100644 --- a/mobile/tail.php +++ b/mobile/tail.php @@ -25,30 +25,8 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가 $val) { - if($key == 'device') - continue; - - $href .= $sep.$key.'='.$val; - $sep = '&'; - $seq++; - } - } - if($seq) - $href .= '&device=pc'; - else - $href .= '?device=pc'; -?> -PC 버전으로 보기 +if(G5_DEVICE_BUTTON_DISPLAY && G5_IS_MOBILE) { ?> +PC 버전으로 보기 $val) { - if($key == 'device') - continue; - - $href .= $sep.$key.'='.strip_tags($val); - $sep = '&'; - $seq++; - } - } - if($seq) - $href .= '&device=mobile'; - else - $href .= '?device=mobile'; -?> -모바일 버전으로 보기 +if(G5_DEVICE_BUTTON_DISPLAY && !G5_IS_MOBILE) { ?> +모바일 버전으로 보기 Date: Wed, 24 Jun 2015 17:02:29 +0900 Subject: [PATCH 7/7] =?UTF-8?q?PHP=5FSELF=20=EB=A5=BC=20SCRIPT=5FNAME=20?= =?UTF-8?q?=EC=9C=BC=EB=A1=9C=20=EB=B3=80=EA=B2=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/admin.lib.php | 1 - adm/auth_list.php | 4 +- adm/board_list.php | 4 +- adm/boardgroup_list.php | 4 +- adm/boardgroupmember_list.php | 2 +- adm/contentlist.php | 4 +- adm/faqmasterlist.php | 4 +- adm/index.php | 2 +- adm/member_list.php | 2 +- adm/point_list.php | 4 +- adm/poll_list.php | 4 +- adm/popular_list.php | 6 +- adm/popular_rank.php | 4 +- adm/sms_admin/_common.php | 2 +- adm/sms_admin/ajax.sms_write_person.php | 2 +- adm/sms_admin/form_list.php | 6 +- adm/sms_admin/history_list.php | 4 +- adm/sms_admin/history_member.php | 4 +- adm/sms_admin/history_num.php | 4 +- adm/sms_admin/history_view.php | 4 +- adm/sms_admin/install.php | 2 +- adm/sms_admin/num_book.php | 6 +- adm/sms_admin/sms_write_form.php | 2 +- adm/visit_list.php | 2 +- adm/visit_search.php | 8 +-- bbs/search.php | 4 +- bbs/write.php | 10 +-- lib/common.lib.php | 6 +- lib/mailer.lib.php | 96 ++++++++++++------------- mobile/skin/faq/basic/list.skin.php | 2 +- mobile/skin/member/basic/point.skin.php | 2 +- skin/faq/basic/list.skin.php | 2 +- skin/member/basic/point.skin.php | 2 +- 33 files changed, 107 insertions(+), 108 deletions(-) diff --git a/adm/admin.lib.php b/adm/admin.lib.php index 53410238e..38a1183f4 100644 --- a/adm/admin.lib.php +++ b/adm/admin.lib.php @@ -191,7 +191,6 @@ function order_select($fld, $sel='') // 접근 권한 검사 if (!$member['mb_id']) { - //alert('로그인 하십시오.', '$g5['bbs_path']/login.php?url=' . urlencode('$_SERVER['PHP_SELF']?w=$w&mb_id=$mb_id')); alert('로그인 하십시오.', G5_BBS_URL.'/login.php?url=' . urlencode(G5_ADMIN_URL)); } else if ($is_admin != 'super') diff --git a/adm/auth_list.php b/adm/auth_list.php index fc11f400e..3dfad19f5 100644 --- a/adm/auth_list.php +++ b/adm/auth_list.php @@ -45,7 +45,7 @@ $sql = " select * limit {$from_record}, {$rows} "; $result = sql_query($sql); -$listall = '전체목록'; +$listall = '전체목록'; $g5['title'] = "관리권한설정"; include_once('./admin.head.php'); @@ -158,7 +158,7 @@ else diff --git a/adm/board_list.php b/adm/board_list.php index 1c51da1d2..ade37535c 100644 --- a/adm/board_list.php +++ b/adm/board_list.php @@ -46,7 +46,7 @@ $from_record = ($page - 1) * $rows; // 시작 열을 구함 $sql = " select * {$sql_common} {$sql_search} {$sql_order} limit {$from_record}, {$rows} "; $result = sql_query($sql); -$listall = '전체목록'; +$listall = '전체목록'; $g5['title'] = '게시판관리'; include_once('./admin.head.php'); @@ -208,7 +208,7 @@ $colspan = 15; - + - + -
class="local_sch01 local_sch" method="get"> + class="local_sch01 local_sch" method="get"> @@ -91,7 +91,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php'); - + - + @@ -100,7 +100,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php'); - + - + @@ -244,7 +244,7 @@ function all_send() - + - +
거부 명 -
+ + diff --git a/adm/visit_list.php b/adm/visit_list.php index f4934488a..afc950164 100644 --- a/adm/visit_list.php +++ b/adm/visit_list.php @@ -102,7 +102,7 @@ if (isset($domain)) $qstr .= "&domain=$domain"; $qstr .= "&page="; -$pagelist = get_paging($config['cf_write_pages'], $page, $total_page, "{$_SERVER['PHP_SELF']}?$qstr"); +$pagelist = get_paging($config['cf_write_pages'], $page, $total_page, "{$_SERVER['SCRIPT_NAME']}?$qstr"); echo $pagelist; include_once('./admin.tail.php'); diff --git a/adm/visit_search.php b/adm/visit_search.php index fb52d05f2..23f1af471 100644 --- a/adm/visit_search.php +++ b/adm/visit_search.php @@ -10,7 +10,7 @@ include_once('./admin.head.php'); include_once(G5_PLUGIN_PATH.'/jquery-ui/datepicker.php'); $colspan = 5; -$listall = '처음'; //페이지 처음으로 (초기화용도) +$listall = '처음'; //페이지 처음으로 (초기화용도) ?>
@@ -98,11 +98,11 @@ $listall = '처음'; //페이지 처음 $bg = 'bg'.($i%2); ?> - + - + 자료가 없습니다.'; ?> @@ -111,7 +111,7 @@ $listall = '처음'; //페이지 처음
'.$row2['bo_subject'].''.$row['cnt'].''; + $str_board_list .= '
  • '.$row2['bo_subject'].''.$row['cnt'].'
    • '; } } @@ -217,7 +217,7 @@ if ($stx) { $from_record = 0; } - $write_pages = get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $page, $total_page, $_SERVER['PHP_SELF'].'?'.$search_query.'&gr_id='.$gr_id.'&srows='.$srows.'&onetable='.$onetable.'&page='); + $write_pages = get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $page, $total_page, $_SERVER['SCRIPT_NAME'].'?'.$search_query.'&gr_id='.$gr_id.'&srows='.$srows.'&onetable='.$onetable.'&page='); } $group_select = '