From 9356fdfaa86c7eb9a97ac89b6a5bc45197907e3d Mon Sep 17 00:00:00 2001 From: chicpro Date: Mon, 13 Jul 2015 17:20:00 +0900 Subject: [PATCH 1/3] =?UTF-8?q?=ED=8C=9D=EC=97=85=EB=A0=88=EC=9D=B4?= =?UTF-8?q?=EC=96=B4=20=EC=A4=91=EB=B3=B5=20=EC=BF=BC=EB=A6=AC=20=EC=88=98?= =?UTF-8?q?=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/newwin.inc.php | 7 ++----- mobile/newwin.inc.php | 7 ++----- 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/bbs/newwin.inc.php b/bbs/newwin.inc.php index 3c3c8c127..e3f8aed55 100644 --- a/bbs/newwin.inc.php +++ b/bbs/newwin.inc.php @@ -13,14 +13,11 @@ $result = sql_query($sql, false);

팝업레이어 알림

diff --git a/mobile/newwin.inc.php b/mobile/newwin.inc.php index 14ad49127..bfd3eadfc 100644 --- a/mobile/newwin.inc.php +++ b/mobile/newwin.inc.php @@ -13,14 +13,11 @@ $result = sql_query($sql, false);

팝업레이어 알림

From 164944dd0c69b3a06edd093a9d67616189156b5a Mon Sep 17 00:00:00 2001 From: chicpro Date: Tue, 14 Jul 2015 12:10:44 +0900 Subject: [PATCH 2/3] =?UTF-8?q?XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/alert.php | 3 ++- bbs/confirm.php | 4 ++++ bbs/move.php | 2 +- bbs/new.php | 2 ++ bbs/register_form.php | 3 +++ bbs/search.php | 2 +- lib/common.lib.php | 7 ++++++- skin/new/basic/new.skin.php | 1 - 8 files changed, 19 insertions(+), 5 deletions(-) diff --git a/bbs/alert.php b/bbs/alert.php index d64b6f2fd..6b1ab26a7 100644 --- a/bbs/alert.php +++ b/bbs/alert.php @@ -30,7 +30,8 @@ include_once(G5_PATH.'/head.sub.php'); $msg2 = str_replace("\\n", "
", $msg); -if (!$url) $url = $_SERVER['HTTP_REFERER']; +$url = clean_xss_tags($url); +if (!$url) $url = clean_xss_tags($_SERVER['HTTP_REFERER']); // url 체크 check_url_host($url); diff --git a/bbs/confirm.php b/bbs/confirm.php index 76e9c7652..fcf94e0e9 100644 --- a/bbs/confirm.php +++ b/bbs/confirm.php @@ -2,6 +2,10 @@ include_once('./_common.php'); include_once(G5_PATH.'/head.sub.php'); +$url1 = clean_xss_tags($url1); +$url2 = clean_xss_tags($url2); +$url3 = clean_xss_tags($url3); + // url 체크 check_url_host($url1); check_url_host($url2); diff --git a/bbs/move.php b/bbs/move.php index e3a7d86f2..a4631addf 100644 --- a/bbs/move.php +++ b/bbs/move.php @@ -55,7 +55,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) - +
diff --git a/bbs/new.php b/bbs/new.php index bbf9ccf96..9e008e861 100644 --- a/bbs/new.php +++ b/bbs/new.php @@ -17,6 +17,8 @@ if ($view == "w") $sql_common .= " and a.wr_id = a.wr_parent "; else if ($view == "c") $sql_common .= " and a.wr_id <> a.wr_parent "; +else + $view = ''; $mb_id = isset($_GET['mb_id']) ? ($_GET['mb_id']) : ''; $mb_id = substr(preg_replace('#[^a-z0-9_]#i', '', $mb_id), 0, 20); diff --git a/bbs/register_form.php b/bbs/register_form.php index cb6fd2517..e6583e111 100644 --- a/bbs/register_form.php +++ b/bbs/register_form.php @@ -30,6 +30,9 @@ if ($w == "") { alert('개인정보처리방침안내의 내용에 동의하셔야 회원가입 하실 수 있습니다.', G5_BBS_URL.'/register.php'); } + $agree = preg_replace('#[^0-9]#', '', $_POST['agree']); + $agree2 = preg_replace('#[^0-9]#', '', $_POST['agree2']); + $member['mb_birth'] = ''; $member['mb_sex'] = ''; $member['mb_name'] = ''; diff --git a/bbs/search.php b/bbs/search.php index 4f4df3f19..0f3fe803b 100644 --- a/bbs/search.php +++ b/bbs/search.php @@ -17,7 +17,7 @@ if ($stx) { $stx = preg_replace('/\//', '\/', trim($stx)); $sop = strtolower($sop); if (!$sop || !($sop == 'and' || $sop == 'or')) $sop = 'and'; // 연산자 and , or - $srows = isset($_GET['srows']) ? preg_replace('#[^0-9]#', '', $_GET['srows']) : 10; + $srows = isset($_GET['srows']) ? (int)preg_replace('#[^0-9]#', '', $_GET['srows']) : 10; if (!$srows) $srows = 10; // 한페이지에 출력하는 검색 행수 $g5_search['tables'] = Array(); diff --git a/lib/common.lib.php b/lib/common.lib.php index d8f4bc557..c7f842586 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -192,7 +192,7 @@ function confirm($msg, $url1='', $url2='', $url3='') alert($msg); } - if (!$url3) $url3 = $_SERVER['HTTP_REFERER']; + if (!$url3) $url3 = clean_xss_tags($_SERVER['HTTP_REFERER']); $msg = str_replace("\\n", "
", $msg); @@ -2723,6 +2723,11 @@ function clean_xss_tags($str) { $str = preg_replace('#]*+>#i', '', $str); + $search = array('"', "'"); + $replace = array('"', '''); + + $str = str_replace($search, $replace, $str); + return $str; } diff --git a/skin/new/basic/new.skin.php b/skin/new/basic/new.skin.php index 085eec0e6..2558d8118 100644 --- a/skin/new/basic/new.skin.php +++ b/skin/new/basic/new.skin.php @@ -45,7 +45,6 @@ add_stylesheet('', 0); - From b2bfe117438e875bd24d523a1a19e11802cdfcb8 Mon Sep 17 00:00:00 2001 From: chicpro Date: Tue, 14 Jul 2015 13:58:19 +0900 Subject: [PATCH 3/3] =?UTF-8?q?XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/register_form.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bbs/register_form.php b/bbs/register_form.php index e6583e111..4729c7692 100644 --- a/bbs/register_form.php +++ b/bbs/register_form.php @@ -30,9 +30,6 @@ if ($w == "") { alert('개인정보처리방침안내의 내용에 동의하셔야 회원가입 하실 수 있습니다.', G5_BBS_URL.'/register.php'); } - $agree = preg_replace('#[^0-9]#', '', $_POST['agree']); - $agree2 = preg_replace('#[^0-9]#', '', $_POST['agree2']); - $member['mb_birth'] = ''; $member['mb_sex'] = ''; $member['mb_name'] = ''; @@ -118,6 +115,9 @@ $req_nick = !isset($member['mb_nick_date']) || (isset($member['mb_nick_date']) & $required = ($w=='') ? 'required' : ''; $readonly = ($w=='u') ? 'readonly' : ''; +$agree = preg_replace('#[^0-9]#', '', $agree); +$agree2 = preg_replace('#[^0-9]#', '', $agree2); + // add_javascript('js 구문', 출력순서); 숫자가 작을 수록 먼저 출력됨 if ($config['cf_use_addr']) add_javascript(G5_POSTCODE_JS, 0); //다음 주소 js