Reflected XSS, 원격코드 취약점 수정(17-0155, 0156, 0157)

2017-03-28 10:18:02 +09:00
parent 1f7103c33c
commit 33ad378400
4 changed files with 10 additions and 2 deletions
--- a/shop/list.php
+++ b/shop/list.php
@ -90,7 +90,7 @@ var itemlist_ca_id = "<?php echo $ca_id; ?>";
    $error = '<p class="sct_noitem">등록된 상품이 없습니다.</p>';

    // 리스트 스킨
-    $skin_file = $skin_dir.'/'.$ca['ca_skin'];
+    $skin_file = is_include_path_check($skin_dir.'/'.$ca['ca_skin']) ? $skin_dir.'/'.$ca['ca_skin'] : $skin_dir.'/list.10.skin.php';

    if (file_exists($skin_file)) {