firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

sms5 sql injection 취약점 수정

Browse Source
This commit is contained in:
chicpro
2015-04-07 09:50:14 +09:00
parent e28acc8495
commit 588a1a7c9d
3 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
adm/sms_admin/history_send.php
View File

@ -67,7 +67,7 @@ if ($result)
if ($result) //SMS 서버에 접속했습니다.
{
sql_query("insert into {$g5['sms5_write_table']} set wr_no='$wr_no', wr_renum='$new_wr_renum', wr_reply='{$write['wr_reply']}', wr_message='{$write['wr_message']}', wr_total='$wr_total', wr_datetime='".G5_TIME_YMDHIS."'");
sql_query("insert into {$g5['sms5_write_table']} set wr_no='$wr_no', wr_renum='$new_wr_renum', wr_reply='".addslashes($write['wr_reply'])."', wr_message='".addslashes($write['wr_message'])."', wr_total='$wr_total', wr_datetime='".G5_TIME_YMDHIS."'");
$wr_success = 0;
$wr_failure = 0;

9
adm/sms_admin/sms_write_send.php
View File

@ -6,10 +6,13 @@ auth_check($auth[$sub_menu], "w");
$g5['title'] = "문자전송중";
if (!trim($wr_reply))
win_close_alert('회신 번호를 입력해주세요.');
$wr_reply = preg_replace('#[^0-9\-]#', '', trim($wr_reply));
$wr_message = clean_xss_tags(trim($wr_message));
if (!trim($wr_message))
if (!$wr_reply)
win_close_alert('회신 번호를 숫자, - 로 입력해주세요.');
if (!$wr_message)
win_close_alert('메세지를 입력해주세요.');
if (!trim($send_list))

7
plugin/sms5/write_update.php
View File

@ -15,10 +15,13 @@ if (!$is_member)
if ($member['mb_level'] < $sms5['cf_level'])
alert("회원 {$sms5['cf_level']}레벨 이상만 문자전송이 가능합니다.");
if (!trim($mh_reply))
$mh_reply = preg_replace('#[^0-9\-]#', '', trim($mh_reply));
$mh_message = clean_xss_tags(trim($mh_message));
if (!$mh_reply)
alert('보내는 번호를 입력해주세요.');
if (!trim($mh_message))
if (!$mh_message)
alert('메세지를 입력해주세요.');
if ($is_admin != 'super')