XSS 취약점(16-1007) 수정

adm/shop_admin/wishlist.php

@@ -10,8 +10,15 @@ include_once(G5_PLUGIN_PATH.'/jquery-ui/datepicker.php');
 
 if (!$to_date) $to_date = date("Ymd", time());
 
+$doc = strip_tags($doc);
+$sort1 = strip_tags($sort1);
+$sel_ca_id = get_search_string($sel_ca_id);
+
+if( preg_match("/[^0-9]/", $fr_date) ) $fr_date = '';
+if( preg_match("/[^0-9]/", $to_date) ) $to_date = '';
+
 if ($sort1 == "") $sort1 = "it_id_cnt";
-if ($sort2 == "") $sort2 = "desc";
+if ($sort2 == "" || $sort2 != "asc") $sort2 = "desc";
 
 $sql  = " select a.it_id,
                  b.it_name,