XSS 및 Blind SQL Injection 취약점 수정

2015-07-07 13:50:38 +09:00
parent 78169b372c
commit 3bbbe96319
5 changed files with 16 additions and 7 deletions
--- a/bbs/search.php
+++ b/bbs/search.php
@ -17,7 +17,7 @@ if ($stx) {
    $stx = preg_replace('/\//', '\/', trim($stx));
    $sop = strtolower($sop);
    if (!$sop || !($sop == 'and' || $sop == 'or')) $sop = 'and'; // 연산자 and , or
-    $srows = isset($_GET['srows']) ? $_GET['srows'] : 10;
+    $srows = isset($_GET['srows']) ? preg_replace('#[^0-9]#', '', $_GET['srows']) : 10;
    if (!$srows) $srows = 10; // 한페이지에 출력하는 검색 행수

    $g5_search['tables'] = Array();