diff --git a/lib/common.lib.php b/lib/common.lib.php index 3ecde78c9..4b2423f2c 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -3489,8 +3489,10 @@ function is_include_path_check($path='', $is_input='') { if( $path ){ if ($is_input){ + // 장태진 @jtjisgod 추가 + // 보안 목적 : rar wrapper 차단 - if( stripos($path, 'php:') !== false || stripos($path, 'zlib:') !== false || stripos($path, 'bzip2:') !== false || stripos($path, 'zip:') !== false || stripos($path, 'data:') !== false || stripos($path, 'phar:') !== false ){ + if( stripos($path, 'rar:') !== false || stripos($path, 'php:') !== false || stripos($path, 'zlib:') !== false || stripos($path, 'bzip2:') !== false || stripos($path, 'zip:') !== false || stripos($path, 'data:') !== false || stripos($path, 'phar:') !== false ){ return false; }