From 3c55c4d60d6dcb5ead47d283dd06fe57aac7e73e Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Thu, 29 Aug 2019 14:44:47 +0900
Subject: [PATCH] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C=20Stored?=
 =?UTF-8?q?=20XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90(KVE-2019-1198)=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/qa_config_update.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/adm/qa_config_update.php b/adm/qa_config_update.php
index 1072b765f..a269c45ee 100644
--- a/adm/qa_config_update.php
+++ b/adm/qa_config_update.php
@@ -50,6 +50,8 @@ if( $qa_include_tail && ! is_include_path_check($qa_include_tail, 1) ){
     $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
 }
 
+$_POST['qa_title'] = strip_tags($_POST['qa_title']);
+
 $sql = " update {$g5['qa_config_table']}
             set qa_title                = '{$_POST['qa_title']}',
                 qa_category             = '{$_POST['qa_category']}',