firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

[KVE-2022-0992] 취약점 다시 재수정

Browse Source
This commit is contained in:
thisgun
2022-09-27 17:15:46 +09:00
parent 8074bce274
commit 2f9fb355e3
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bbs/download.php
View File

@ -24,7 +24,7 @@ if (!$file['bf_file'])
$nonce = isset($_REQUEST['nonce']) ? preg_replace('/[^0-9a-z\|]/i', '', $_REQUEST['nonce']) : '';
if (function_exists('download_file_nonce_is_valid')){
if (function_exists('download_file_nonce_is_valid') && !defined('G5_DOWNLOAD_NONCE_CHECK')){
if(! download_file_nonce_is_valid($nonce, $bo_table, $wr_id)){
alert('토큰 유효시간이 지났거나 토큰이 유효하지 않습니다.\\n브라우저를 새로고침 후 다시 시도해 주세요.', G5_URL);
}

8
lib/common.lib.php
View File

@ -604,7 +604,7 @@ function check_html_link_nofollow($type=''){
// Open : HTML Purifier is open-source and highly customizable
function html_purifier($html)
{
global $is_admin;
global $is_admin, $write;
$f = file(G5_PLUGIN_PATH.'/htmlpurifier/safeiframe.txt');
$domains = array();
@ -616,9 +616,9 @@ function html_purifier($html)
array_push($domains, $domain);
}
}
// 관리자인 경우에만 내 도메인을 추가
if ($is_admin) array_push($domains, $_SERVER['HTTP_HOST'].'/');
$safeiframe = implode('|', $domains);
// 글쓴이가 관리자인 경우에만 현재 사이트 도메인을 허용
if (isset($write['mb_id']) && $write['mb_id'] && is_admin($write['mb_id'])) array_push($domains, $_SERVER['HTTP_HOST'].'/');
$safeiframe = implode('|', run_replace('html_purifier_safeiframes', $domains, $html));
include_once(G5_PLUGIN_PATH.'/htmlpurifier/HTMLPurifier.standalone.php');
include_once(G5_PLUGIN_PATH.'/htmlpurifier/extend.video.php');