firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

XSS 및 Blind SQL Injection 취약점 수정

Browse Source
This commit is contained in:
chicpro
2015-07-07 13:50:38 +09:00
parent 78169b372c
commit 3bbbe96319
5 changed files with 16 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
bbs/db_table.optimize.php
View File

@ -41,7 +41,9 @@ if($config['cf_memo_del'] > 0) {
// 탈퇴회원 자동 삭제
if($config['cf_leave_day'] > 0) {
$sql = " select mb_id from {$g5['member_table']} where (TO_DAYS('".G5_TIME_YMDHIS."') - TO_DAYS(mb_leave_date)) > '{$config['cf_leave_day']}' ";
$sql = " select mb_id from {$g5['member_table']}
where (TO_DAYS('".G5_TIME_YMDHIS."') - TO_DAYS(mb_leave_date)) > '{$config['cf_leave_day']}'
and mb_memo not regexp '^[0-9]{8}.*삭제함' ";
$result = sql_query($sql);
while ($row=sql_fetch_array($result))
{

8
bbs/new.php
View File

@ -18,7 +18,9 @@ if ($view == "w")
else if ($view == "c")
$sql_common .= " and a.wr_id <> a.wr_parent ";
$mb_id = isset($_GET['mb_id']) ? strip_tags($_GET['mb_id']) : "";
$mb_id = isset($_GET['mb_id']) ? ($_GET['mb_id']) : '';
$mb_id = substr(preg_replace('#[^a-z0-9_]#i', '', $mb_id), 0, 20);
if ($mb_id) {
$sql_common .= " and a.mb_id = '{$mb_id}' ";
}
@ -28,9 +30,9 @@ $sql = " select count(*) as cnt {$sql_common} ";
$row = sql_fetch($sql);
$total_count = $row['cnt'];
$rows = $config['cf_new_rows'];
$rows = G5_IS_MOBILE ? $config['cf_mobile_page_rows'] : $config['cf_new_rows'];
$total_page = ceil($total_count / $rows); // 전체 페이지 계산
if (!$page) $page = 1; // 페이지가 없으면 첫 페이지 (1 페이지)
if ($page < 1) $page = 1; // 페이지가 없으면 첫 페이지 (1 페이지)
$from_record = ($page - 1) * $rows; // 시작 열을 구함
$group_select = '<label for="gr_id" class="sound_only">그룹</label><select name="gr_id" id="gr_id"><option value="">전체그룹';

2
bbs/search.php
View File

@ -17,7 +17,7 @@ if ($stx) {
$stx = preg_replace('/\//', '\/', trim($stx));
$sop = strtolower($sop);
if (!$sop || !($sop == 'and' || $sop == 'or')) $sop = 'and'; // 연산자 and , or
$srows = isset($_GET['srows']) ? $_GET['srows'] : 10;
$srows = isset($_GET['srows']) ? preg_replace('#[^0-9]#', '', $_GET['srows']) : 10;
if (!$srows) $srows = 10; // 한페이지에 출력하는 검색 행수
$g5_search['tables'] = Array();