From 6d7ac7a6be3ba3636910a91f17ac923d6537fd3b Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 10 Jul 2018 17:20:42 +0900
Subject: [PATCH 1/7] =?UTF-8?q?=EC=B9=B4=EC=B9=B4=EC=98=A4=EB=A7=81?=
 =?UTF-8?q?=ED=81=AC=20=EB=B2=84=EC=A0=84=20=EC=86=8C=EC=8A=A4=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 js/kakaolink.js              | 22 ++++++++++++++++------
 plugin/sns/view.sns.skin.php |  2 +-
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/js/kakaolink.js b/js/kakaolink.js
index 8ac822a0b..b7c0cc83f 100644
--- a/js/kakaolink.js
+++ b/js/kakaolink.js
@@ -1,10 +1,20 @@
-function kakaolink_send(text, url)
+function kakaolink_send(text, url, image)
 {
+    if( image === undefined ){
+        image = '';
+    }
+
     // 카카오톡 링크 버튼을 생성합니다. 처음 한번만 호출하면 됩니다.
-    Kakao.Link.sendTalkLink({
-      webLink : {
-        text: String(text),
-        url: url // 앱 설정의 웹 플랫폼에 등록한 도메인의 URL이어야 합니다.
-      }
+    Kakao.Link.sendDefault({
+        objectType: 'feed',
+        content: {
+            title: String(text),
+            description: url,
+            imageUrl: image,
+            link: {
+                mobileWebUrl: url,
+                webUrl: url // 앱 설정의 웹 플랫폼에 등록한 도메인의 URL이어야 합니다.
+            }
+        }
     });
 }
\ No newline at end of file
diff --git a/plugin/sns/view.sns.skin.php b/plugin/sns/view.sns.skin.php
index a798cfd0e..dc95a3894 100644
--- a/plugin/sns/view.sns.skin.php
+++ b/plugin/sns/view.sns.skin.php
@@ -23,7 +23,7 @@ $gplus_url    = $sns_send.'&amp;sns=gplus';
 ?>
 
 <?php if(G5_IS_MOBILE && $config['cf_kakao_js_apikey']) { ?>
-<script src="https://developers.kakao.com/sdk/js/kakao.min.js"></script>
+<script src="//developers.kakao.com/sdk/js/kakao.min.js"></script>
 <script src="<?php echo G5_JS_URL; ?>/kakaolink.js"></script>
 <script>
     // 사용할 앱의 Javascript 키를 설정해 주세요.

From 3c9f4e05fb33a29523f82e5330068a3bda8aa719 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 24 Jul 2018 09:58:00 +0900
Subject: [PATCH 2/7] =?UTF-8?q?iframe=20=ED=97=88=EC=9A=A9=20=EB=8F=84?=
 =?UTF-8?q?=EB=A9=94=EC=9D=B8=20=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 plugin/htmlpurifier/safeiframe.txt | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/plugin/htmlpurifier/safeiframe.txt b/plugin/htmlpurifier/safeiframe.txt
index b87696a76..48c676d4f 100644
--- a/plugin/htmlpurifier/safeiframe.txt
+++ b/plugin/htmlpurifier/safeiframe.txt
@@ -9,4 +9,6 @@ play.afreeca.com/
 v.nate.com/
 www.microsoft.com/showcase/video.aspx/
 w.soundcloud.com/
-www.facebook.com/
\ No newline at end of file
+www.facebook.com/
+kakaotv.daum.net/
+v.afree.ca/
\ No newline at end of file

From a7a8f453013c774492db441f3bae6525b13762e9 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 30 Jul 2018 11:05:17 +0900
Subject: [PATCH 3/7] =?UTF-8?q?=EB=A7=81=ED=81=AC=20=EB=B3=B4=EA=B8=B0=20?=
 =?UTF-8?q?=EC=A0=9C=EB=8C=80=EB=A1=9C=20=EC=B6=9C=EB=A0=A5=20=EC=95=88?=
 =?UTF-8?q?=EB=90=98=EB=8A=94=20=EC=98=A4=EB=A5=98=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 mobile/skin/board/basic/view.skin.php   | 2 +-
 mobile/skin/board/gallery/view.skin.php | 2 +-
 skin/board/basic/view.skin.php          | 2 +-
 skin/board/gallery/view.skin.php        | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/mobile/skin/board/basic/view.skin.php b/mobile/skin/board/basic/view.skin.php
index 344610c3a..70c42e1ba 100644
--- a/mobile/skin/board/basic/view.skin.php
+++ b/mobile/skin/board/basic/view.skin.php
@@ -153,7 +153,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
     </section>
     <?php } ?>
 
-    <?php if(isset($view['link'][1]) && $view['link'][1]) { ?>
+    <?php if(array_filter($view['link'])) { ?>
     <!-- 관련링크 시작 { -->
     <section id="bo_v_link">
         <h2>관련링크</h2>
diff --git a/mobile/skin/board/gallery/view.skin.php b/mobile/skin/board/gallery/view.skin.php
index aa4257797..eaa7bc310 100644
--- a/mobile/skin/board/gallery/view.skin.php
+++ b/mobile/skin/board/gallery/view.skin.php
@@ -153,7 +153,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
     </section>
     <?php } ?>
 
-    <?php if(isset($view['link'][1]) && $view['link'][1]) { ?>
+    <?php if(array_filter($view['link'])) { ?>
     <!-- 관련링크 시작 { -->
     <section id="bo_v_link">
         <h2>관련링크</h2>
diff --git a/skin/board/basic/view.skin.php b/skin/board/basic/view.skin.php
index 326c4320a..bd5961218 100644
--- a/skin/board/basic/view.skin.php
+++ b/skin/board/basic/view.skin.php
@@ -135,7 +135,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
     <!-- } 첨부파일 끝 -->
     <?php } ?>
 
-    <?php if(isset($view['link'][1]) && $view['link'][1]) { ?>
+    <?php if(array_filter($view['link'])) { ?>
     <!-- 관련링크 시작 { -->
     <section id="bo_v_link">
         <h2>관련링크</h2>
diff --git a/skin/board/gallery/view.skin.php b/skin/board/gallery/view.skin.php
index 326c4320a..bd5961218 100644
--- a/skin/board/gallery/view.skin.php
+++ b/skin/board/gallery/view.skin.php
@@ -135,7 +135,7 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
     <!-- } 첨부파일 끝 -->
     <?php } ?>
 
-    <?php if(isset($view['link'][1]) && $view['link'][1]) { ?>
+    <?php if(array_filter($view['link'])) { ?>
     <!-- 관련링크 시작 { -->
     <section id="bo_v_link">
         <h2>관련링크</h2>

From c03fec73b9aeb6571271f4141788e614cc3f6e82 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Fri, 17 Aug 2018 14:45:04 +0900
Subject: [PATCH 4/7] =?UTF-8?q?KVE-2018-0441,0449,0510=20=EA=B7=B8?=
 =?UTF-8?q?=EB=88=84=EB=B3=B4=EB=93=9C=20=EC=98=81=EC=B9=B4=ED=8A=B8=20?=
 =?UTF-8?q?=EB=8B=A4=EC=A4=91=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/board_form_update.php        | 18 +++++++++---------
 adm/contentformupdate.php        |  5 ++++-
 adm/qa_config_update.php         |  5 ++++-
 adm/sms_admin/num_book_write.php | 10 ++++------
 bbs/formmail_send.php            |  7 +++----
 bbs/member_confirm.php           |  4 ++++
 lib/common.lib.php               |  6 +++---
 7 files changed, 31 insertions(+), 24 deletions(-)

diff --git a/adm/board_form_update.php b/adm/board_form_update.php
index 8b40bc8d2..912887760 100644
--- a/adm/board_form_update.php
+++ b/adm/board_form_update.php
@@ -14,11 +14,11 @@ if (!$bo_table) { alert('게시판 TABLE명은 반드시 입력하세요.'); }
 if (!preg_match("/^([A-Za-z0-9_]{1,20})$/", $bo_table)) { alert('게시판 TABLE명은 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (20자 이내)'); }
 if (!$_POST['bo_subject']) { alert('게시판 제목을 입력하세요.'); }
 
-$_POST['bo_include_head'] = preg_replace("#[\\\]+$#", "", substr($_POST['bo_include_head'], 0, 255));
-$_POST['bo_include_tail'] = preg_replace("#[\\\]+$#", "", substr($_POST['bo_include_tail'], 0, 255));
+$bo_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($bo_include_head, 0, 255));
+$bo_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($bo_include_tail, 0, 255));
 
 // 관리자가 자동등록방지를 사용해야 할 경우
-if ($board && ($board['bo_include_head'] !== $_POST['bo_include_head'] || $board['bo_include_tail'] !== $_POST['bo_include_tail']) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
+if ($board && ($board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
     include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 
     if (!chk_captcha()) {
@@ -26,7 +26,7 @@ if ($board && ($board['bo_include_head'] !== $_POST['bo_include_head'] || $board
     }
 }
 
-if ($file = $_POST['bo_include_head']) {
+if ($file = $bo_include_head) {
     $file_ext = pathinfo($file, PATHINFO_EXTENSION);
 
     if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) || ! preg_match('/^.*\.(php|htm|html)$/i', $file) ) {
@@ -35,7 +35,7 @@ if ($file = $_POST['bo_include_head']) {
     $_POST['bo_include_head'] = $file;
 }
 
-if ($file = $_POST['bo_include_tail']) {
+if ($file = $bo_include_tail) {
     $file_ext = pathinfo($file, PATHINFO_EXTENSION);
 
     if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) || ! preg_match('/^.*\.(php|htm|html)$/i', $file) ) {
@@ -44,11 +44,11 @@ if ($file = $_POST['bo_include_tail']) {
     $_POST['bo_include_tail'] = $file;
 }
 
-if(!is_include_path_check($_POST['bo_include_head'], 1)) {
+if(!is_include_path_check($bo_include_head, 1)) {
     alert('상단 파일 경로에 포함시킬수 없는 문자열이 있습니다.');
 }
 
-if(!is_include_path_check($_POST['bo_include_tail'], 1)) {
+if(!is_include_path_check($bo_include_tail, 1)) {
     alert('하단 파일 경로에 포함시킬수 없는 문자열이 있습니다.');
 }
 
@@ -125,8 +125,8 @@ $sql_common = " gr_id               = '{$_POST['gr_id']}',
 
 // 최고 관리자인 경우에만 수정가능
 if ($is_admin === 'super'){
-$sql_common .= " bo_include_head     = '{$_POST['bo_include_head']}',
-                bo_include_tail     = '{$_POST['bo_include_tail']}',
+$sql_common .= " bo_include_head     = '".$bo_include_head."',
+                bo_include_tail     = '".$bo_include_tail."',
                 bo_content_head     = '{$_POST['bo_content_head']}',
                 bo_content_tail     = '{$_POST['bo_content_tail']}',
                 bo_mobile_content_head     = '{$_POST['bo_mobile_content_head']}',
diff --git a/adm/contentformupdate.php b/adm/contentformupdate.php
index 9904425b1..d344c4707 100644
--- a/adm/contentformupdate.php
+++ b/adm/contentformupdate.php
@@ -20,8 +20,11 @@ if ($w == "" || $w == "u")
     $co_row = sql_fetch($sql);
 }
 
+$co_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_head, 0, 255));
+$co_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_tail, 0, 255));
+
 // 관리자가 자동등록방지를 사용해야 할 경우
-if (($co_row['co_include_head'] !== $_POST['co_include_head'] || $co_row['co_include_tail'] !== $_POST['co_include_tail']) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
+if (($co_row['co_include_head'] !== $co_include_head || $co_row['co_include_tail'] !== $co_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
     include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 
     if (!chk_captcha()) {
diff --git a/adm/qa_config_update.php b/adm/qa_config_update.php
index df9153e9c..1072b765f 100644
--- a/adm/qa_config_update.php
+++ b/adm/qa_config_update.php
@@ -12,8 +12,11 @@ $error_msg = '';
 
 $qaconfig = get_qa_config();
 
+$qa_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_head, 0, 255));
+$qa_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_tail, 0, 255));
+
 // 관리자가 자동등록방지를 사용해야 할 경우
-if ($board && ($qaconfig['qa_include_head'] !== $_POST['qa_include_head'] || $qaconfig['qa_include_tail'] !== $_POST['qa_include_tail']) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
+if ($board && ($qaconfig['qa_include_head'] !== $qa_include_head || $qaconfig['qa_include_tail'] !== $qa_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
     include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 
     if (!chk_captcha()) {
diff --git a/adm/sms_admin/num_book_write.php b/adm/sms_admin/num_book_write.php
index 90f5b3bd7..2e05a4b67 100644
--- a/adm/sms_admin/num_book_write.php
+++ b/adm/sms_admin/num_book_write.php
@@ -43,12 +43,12 @@ include_once(G5_ADMIN_PATH."/admin.head.php");
 ?>
 
 <form name="book_form" id="book_form" method="post" action="./num_book_update.php">
-<input type="hidden" name="w" value="<?php echo $w?>">
-<input type="hidden" name="page" value="<?php echo $page?>">
-<input type="hidden" name="ap" value="<?php echo $ap?>">
+<input type="hidden" name="w" value="<?php echo get_sanitize_input($w); ?>">
+<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
+<input type="hidden" name="ap" value="<?php echo get_sanitize_input($ap); ?>">
 <input type="hidden" name="bk_no" value="<?php echo $write['bk_no']?>">
 <input type="hidden" name="mb_id" id="mb_id" value="<?php echo $write['mb_id']?>">
-<input type="hidden" name="get_bg_no" value="<?php echo $bg_no?>">
+<input type="hidden" name="get_bg_no" value="<?php echo get_sanitize_input($bg_no); ?>">
 
 <div class="tbl_frm01 tbl_wrap">
     <table>
@@ -187,14 +187,12 @@ function book_submit(){
                     if($check_msg.size()> 0)
                         $check_msg.remove();
 
-//                    $("#exist_msg").text("<?php echo $exist_msg_2; ?>");
                     is_submit = true;
                 } else {
                     if($check_msg.size() < 1)
                         $("input#bk_hp").after("<div id=\"hp_check_el\"><h3>이 번호를 쓰는 회원 정보</h3><ul></ul></div>");
 
                     $("#hp_check_el").find("ul").html( list_text );
-//                    $("#exist_msg").html("<?php echo $exist_msg_1 ?>");
 
                     if(confirm("회원 정보에 중복 휴대폰 번호가 있습니다.수정하실 경우 회원정보에 반영되지 않습니다.\n수정하시겠습니까?"))
                         is_submit = true;
diff --git a/bbs/formmail_send.php b/bbs/formmail_send.php
index 090209479..b36feed06 100644
--- a/bbs/formmail_send.php
+++ b/bbs/formmail_send.php
@@ -12,14 +12,13 @@ if (!$is_member && $config['cf_formmail_is_member'])
 $email_enc = new str_encrypt();
 $to = $email_enc->decrypt($to);
 
-if (substr_count($to, "@") > 1)
-    alert_close('한번에 한사람에게만 메일을 발송할 수 있습니다.');
-
-
 if (!chk_captcha()) {
     alert('자동등록방지 숫자가 틀렸습니다.');
 }
 
+if (!preg_match("/([0-9a-zA-Z_-]+)@([0-9a-zA-Z_-]+)\.([0-9a-zA-Z_-]+)/", $to)){
+    alert_close('E-mail 주소가 형식에 맞지 않아서, 메일을 보낼수 없습니다.');
+}
 
 $file = array();
 for ($i=1; $i<=$attach; $i++) {
diff --git a/bbs/member_confirm.php b/bbs/member_confirm.php
index 8dfa76b28..685dec86c 100644
--- a/bbs/member_confirm.php
+++ b/bbs/member_confirm.php
@@ -24,6 +24,10 @@ $url = clean_xss_tags($_GET['url']);
 // url 체크
 check_url_host($url, '', G5_URL, true);
 
+if( preg_match('#^/{3,}#', $url) ){
+    $url = preg_replace('#^/{3,}#', '/', $url);
+}
+
 $url = get_text($url);
 
 include_once($member_skin_path.'/member_confirm.skin.php');
diff --git a/lib/common.lib.php b/lib/common.lib.php
index 084ffb16e..2da6faa4b 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -3269,7 +3269,7 @@ class str_encrypt
     function __construct($salt='')
     {
         if(!$salt)
-            $this->salt = md5(preg_replace('/[^0-9A-Za-z]/', substr(G5_MYSQL_USER, -1), G5_MYSQL_PASSWORD));
+            $this->salt = md5(preg_replace('/[^0-9A-Za-z]/', substr(G5_MYSQL_USER, -1), $_SERVER['SERVER_SOFTWARE'].$_SERVER['DOCUMENT_ROOT']));
         else
             $this->salt = $salt;
 
@@ -3438,7 +3438,7 @@ function is_include_path_check($path='', $is_input='')
     if( $path ){
         if ($is_input){
 
-            if( stripos($path, 'php://') !== false || stripos($path, 'zlib://') !== false || stripos($path, 'bzip2://') !== false || stripos($path, 'zip://') !== false || stripos($path, 'data:text/') !== false || stripos($path, 'data://') !== false ){
+            if( stripos($path, 'php:') !== false || stripos($path, 'zlib:') !== false || stripos($path, 'bzip2:') !== false || stripos($path, 'zip:') !== false || stripos($path, 'data:') !== false || stripos($path, 'phar:') !== false ){
                 return false;
             }
 
@@ -3478,7 +3478,7 @@ function is_include_path_check($path='', $is_input='')
                 return false;
             }
 
-            if( preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $path) ){
+            if( preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', str_replace('\\', '/', $path)) ){
                 return false;
             }
         }

From 9834a0962ed36a884ae5bb8171af17dbdf897457 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 13 Aug 2018 09:20:48 +0900
Subject: [PATCH 5/7] =?UTF-8?q?str=5Fencrypt=20=ED=81=B4=EB=9E=98=EC=8A=A4?=
 =?UTF-8?q?=20=EC=BD=94=EB=93=9C=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/common.lib.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/common.lib.php b/lib/common.lib.php
index 084ffb16e..111059b77 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -3288,12 +3288,12 @@ class str_encrypt
             $result .= $char;
         }
 
-        return base64_encode($result);
+        return strtr(base64_encode($result) , '+/=', '._-');
     }
 
     function decrypt($str) {
         $result = '';
-        $str    = base64_decode($str);
+        $str    = base64_decode(strtr($str, '._-', '+/='));
         $length = strlen($str);
 
         for($i=0; $i<$length; $i++) {

From a4d3de3227a02b16cb38b077eaedfd7e3debd66f Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Fri, 17 Aug 2018 12:06:41 +0900
Subject: [PATCH 6/7] =?UTF-8?q?=EC=9E=98=EB=AA=BB=EB=90=9C=20=EC=A3=BC?=
 =?UTF-8?q?=EC=84=9D=20=EC=BD=94=EB=93=9C=20=EC=82=AD=EC=A0=9C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/sms_admin/history_num.php                       | 2 +-
 common.php                                          | 1 +
 mobile/skin/board/basic/list.skin.php               | 1 -
 mobile/skin/board/gallery/list.skin.php             | 1 -
 skin/board/basic/list.skin.php                      | 1 -
 skin/board/gallery/list.skin.php                    | 1 -
 theme/basic/mobile/skin/board/basic/list.skin.php   | 1 -
 theme/basic/mobile/skin/board/gallery/list.skin.php | 1 -
 theme/basic/skin/board/basic/list.skin.php          | 1 -
 theme/basic/skin/board/gallery/list.skin.php        | 1 -
 10 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/adm/sms_admin/history_num.php b/adm/sms_admin/history_num.php
index 78af3f36e..530cfcdcd 100644
--- a/adm/sms_admin/history_num.php
+++ b/adm/sms_admin/history_num.php
@@ -27,7 +27,7 @@ $vnum = $total_count - (($page-1) * $page_size);
 include_once(G5_ADMIN_PATH.'/admin.head.php');
 ?>
 
-<form name="search_form" method="get" action="<?echo $_SERVER['SCRIPT_NAME']?>" class="local_sch01 local_sch" >
+<form name="search_form" method="get" action="<?php echo $_SERVER['SCRIPT_NAME']; ?>" class="local_sch01 local_sch" >
 <label for="st" class="sound_only">검색대상</label>
 <select name="st" id="st">
     <option value="hs_name"<?php echo get_selected('hs_name', $st); ?>>이름</option>
diff --git a/common.php b/common.php
index d0b2bf244..3aa15e069 100644
--- a/common.php
+++ b/common.php
@@ -621,6 +621,7 @@ if(!empty($extend_file) && is_array($extend_file)) {
     foreach($extend_file as $file) {
         include_once(G5_EXTEND_PATH.'/'.$file);
     }
+    unset($file);
 }
 unset($extend_file);
 
diff --git a/mobile/skin/board/basic/list.skin.php b/mobile/skin/board/basic/list.skin.php
index 421c19592..149d1f22a 100644
--- a/mobile/skin/board/basic/list.skin.php
+++ b/mobile/skin/board/basic/list.skin.php
@@ -76,7 +76,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
                         <?php if ($list[$i]['is_notice']) { ?><strong class="notice_icon"><i class="fa fa-volume-up" aria-hidden="true"></i>공지</strong><?php } ?> 
                         <?php echo $list[$i]['subject'] ?>
                         <?php
-                        // if ($list[$i]['link']['count']) { echo '['.$list[$i]['link']['count']}.']'; }
                         // if ($list[$i]['file']['count']) { echo '<'.$list[$i]['file']['count'].'>'; }
 
                         if (isset($list[$i]['icon_new'])) echo $list[$i]['icon_new'];
diff --git a/mobile/skin/board/gallery/list.skin.php b/mobile/skin/board/gallery/list.skin.php
index 05acdfe05..abaab110a 100644
--- a/mobile/skin/board/gallery/list.skin.php
+++ b/mobile/skin/board/gallery/list.skin.php
@@ -103,7 +103,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
                         <?php if ($list[$i]['comment_cnt']) { ?><span class="sound_only">댓글</span><?php echo $list[$i]['comment_cnt']; ?><span class="sound_only">개</span><?php } ?>
                     </a>
                     <?php
-                    // if ($list[$i]['link']['count']) { echo '['.$list[$i]['link']['count']}.']'; }
                     // if ($list[$i]['file']['count']) { echo '<'.$list[$i]['file']['count'].'>'; }
 
                     if (isset($list[$i]['icon_new'])) echo $list[$i]['icon_new'];
diff --git a/skin/board/basic/list.skin.php b/skin/board/basic/list.skin.php
index abde78f5d..7c9fa75d5 100644
--- a/skin/board/basic/list.skin.php
+++ b/skin/board/basic/list.skin.php
@@ -114,7 +114,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
                        
                     </a>
                     <?php
-                    // if ($list[$i]['link']['count']) { echo '['.$list[$i]['link']['count']}.']'; }
                     // if ($list[$i]['file']['count']) { echo '<'.$list[$i]['file']['count'].'>'; }
                     if (isset($list[$i]['icon_file'])) echo rtrim($list[$i]['icon_file']);
                     if (isset($list[$i]['icon_link'])) echo rtrim($list[$i]['icon_link']);
diff --git a/skin/board/gallery/list.skin.php b/skin/board/gallery/list.skin.php
index d8166d9fd..36b32bfbe 100644
--- a/skin/board/gallery/list.skin.php
+++ b/skin/board/gallery/list.skin.php
@@ -117,7 +117,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
                             <?php echo $list[$i]['subject'] ?>
                             <?php if ($list[$i]['comment_cnt']) { ?><span class="sound_only">댓글</span><span class="cnt_cmt">+ <?php echo $list[$i]['wr_comment']; ?></span><span class="sound_only">개</span><?php } ?>
                             <?php
-                            // if ($list[$i]['link']['count']) { echo '['.$list[$i]['link']['count']}.']'; }
                             // if ($list[$i]['file']['count']) { echo '<'.$list[$i]['file']['count'].'>'; }
 
                             if (isset($list[$i]['icon_new'])) echo rtrim($list[$i]['icon_new']);
diff --git a/theme/basic/mobile/skin/board/basic/list.skin.php b/theme/basic/mobile/skin/board/basic/list.skin.php
index 421c19592..149d1f22a 100644
--- a/theme/basic/mobile/skin/board/basic/list.skin.php
+++ b/theme/basic/mobile/skin/board/basic/list.skin.php
@@ -76,7 +76,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
                         <?php if ($list[$i]['is_notice']) { ?><strong class="notice_icon"><i class="fa fa-volume-up" aria-hidden="true"></i>공지</strong><?php } ?> 
                         <?php echo $list[$i]['subject'] ?>
                         <?php
-                        // if ($list[$i]['link']['count']) { echo '['.$list[$i]['link']['count']}.']'; }
                         // if ($list[$i]['file']['count']) { echo '<'.$list[$i]['file']['count'].'>'; }
 
                         if (isset($list[$i]['icon_new'])) echo $list[$i]['icon_new'];
diff --git a/theme/basic/mobile/skin/board/gallery/list.skin.php b/theme/basic/mobile/skin/board/gallery/list.skin.php
index 05f51faf3..33ad640b1 100644
--- a/theme/basic/mobile/skin/board/gallery/list.skin.php
+++ b/theme/basic/mobile/skin/board/gallery/list.skin.php
@@ -103,7 +103,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
                         <?php if ($list[$i]['comment_cnt']) { ?><span class="sound_only">댓글</span><?php echo $list[$i]['comment_cnt']; ?><span class="sound_only">개</span><?php } ?>
                     </a>
                     <?php
-                    // if ($list[$i]['link']['count']) { echo '['.$list[$i]['link']['count']}.']'; }
                     // if ($list[$i]['file']['count']) { echo '<'.$list[$i]['file']['count'].'>'; }
 
                     if (isset($list[$i]['icon_new'])) echo $list[$i]['icon_new'];
diff --git a/theme/basic/skin/board/basic/list.skin.php b/theme/basic/skin/board/basic/list.skin.php
index abde78f5d..7c9fa75d5 100644
--- a/theme/basic/skin/board/basic/list.skin.php
+++ b/theme/basic/skin/board/basic/list.skin.php
@@ -114,7 +114,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
                        
                     </a>
                     <?php
-                    // if ($list[$i]['link']['count']) { echo '['.$list[$i]['link']['count']}.']'; }
                     // if ($list[$i]['file']['count']) { echo '<'.$list[$i]['file']['count'].'>'; }
                     if (isset($list[$i]['icon_file'])) echo rtrim($list[$i]['icon_file']);
                     if (isset($list[$i]['icon_link'])) echo rtrim($list[$i]['icon_link']);
diff --git a/theme/basic/skin/board/gallery/list.skin.php b/theme/basic/skin/board/gallery/list.skin.php
index cc6b9bc8e..3795ce0c6 100644
--- a/theme/basic/skin/board/gallery/list.skin.php
+++ b/theme/basic/skin/board/gallery/list.skin.php
@@ -117,7 +117,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0
                             <?php echo $list[$i]['subject'] ?>
                             <?php if ($list[$i]['comment_cnt']) { ?><span class="sound_only">댓글</span><span class="cnt_cmt">+ <?php echo $list[$i]['wr_comment']; ?></span><span class="sound_only">개</span><?php } ?>
                             <?php
-                            // if ($list[$i]['link']['count']) { echo '['.$list[$i]['link']['count']}.']'; }
                             // if ($list[$i]['file']['count']) { echo '<'.$list[$i]['file']['count'].'>'; }
 
                             if (isset($list[$i]['icon_new'])) echo rtrim($list[$i]['icon_new']);

From b1fc952c7600b825c4b02e2789ddafdea18c8d13 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Wed, 22 Aug 2018 14:02:14 +0900
Subject: [PATCH 7/7] =?UTF-8?q?XSS=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?=
 =?UTF-8?q?=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/boardgroup_form.php           | 2 +-
 adm/boardgroup_form_update.php    | 4 +++-
 adm/boardgroup_list_update.php    | 3 ++-
 adm/contentform.php               | 8 +++++---
 adm/contentformupdate.php         | 1 +
 adm/faqmasterform.php             | 1 +
 adm/faqmasterformupdate.php       | 2 ++
 adm/newwinform.php                | 2 +-
 adm/newwinformupdate.php          | 4 +++-
 adm/point_update.php              | 6 +++---
 adm/sms_admin/num_book_update.php | 2 ++
 adm/sms_admin/num_book_write.php  | 4 ++--
 12 files changed, 26 insertions(+), 13 deletions(-)

diff --git a/adm/boardgroup_form.php b/adm/boardgroup_form.php
index df2b9b2c1..73e162d98 100644
--- a/adm/boardgroup_form.php
+++ b/adm/boardgroup_form.php
@@ -12,7 +12,7 @@ $sound_only = '';
 if ($w == '') {
     $gr_id_attr = 'required';
     $sound_only = '<strong class="sound_only"> 필수</strong>';
-    $gr['gr_use_access'] = 0;
+    $gr = array('gr_use_access' => 0);
     $html_title .= ' 생성';
 } else if ($w == 'u') {
     $gr_id_attr = 'readonly';
diff --git a/adm/boardgroup_form_update.php b/adm/boardgroup_form_update.php
index c29558fdd..7ce694a8e 100644
--- a/adm/boardgroup_form_update.php
+++ b/adm/boardgroup_form_update.php
@@ -16,7 +16,9 @@ if (!preg_match("/^([A-Za-z0-9_]{1,10})$/", $_POST['gr_id']))
 
 if (!$gr_subject) alert('그룹 제목을 입력하세요.');
 
-$sql_common = " gr_subject = '{$_POST['gr_subject']}',
+$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';
+
+$sql_common = " gr_subject = '{$gr_subject}',
                 gr_device = '{$_POST['gr_device']}',
                 gr_admin  = '{$_POST['gr_admin']}',
                 gr_1_subj = '{$_POST['gr_1_subj']}',
diff --git a/adm/boardgroup_list_update.php b/adm/boardgroup_list_update.php
index c10cd247f..fbf9e2f1a 100644
--- a/adm/boardgroup_list_update.php
+++ b/adm/boardgroup_list_update.php
@@ -19,10 +19,11 @@ for ($i=0; $i<$count; $i++)
 {
     $k     = $_POST['chk'][$i];
     $gr_id = $_POST['group_id'][$k];
+    $gr_subject = strip_tags($_POST['gr_subject'][$k]);
 
     if($_POST['act_button'] == '선택수정') {
         $sql = " update {$g5['group_table']}
-                    set gr_subject    = '{$_POST['gr_subject'][$k]}',
+                    set gr_subject    = '{$gr_subject}',
                         gr_device     = '{$_POST['gr_device'][$k]}',
                         gr_admin      = '{$_POST['gr_admin'][$k]}',
                         gr_use_access = '{$_POST['gr_use_access'][$k]}',
diff --git a/adm/contentform.php b/adm/contentform.php
index 024a17615..7ebe8bf01 100644
--- a/adm/contentform.php
+++ b/adm/contentform.php
@@ -49,9 +49,11 @@ if ($w == "u")
 else
 {
     $html_title .= ' 입력';
-    $co['co_html'] = 2;
-    $co['co_skin'] = 'basic';
-    $co['co_mobile_skin'] = 'basic';
+    $co = array(
+        'co_html' => 2,
+        'co_skin' => 'basic',
+        'co_mobile_skin' => 'basic'
+        );
 }
 
 include_once (G5_ADMIN_PATH.'/admin.head.php');
diff --git a/adm/contentformupdate.php b/adm/contentformupdate.php
index d344c4707..dff780a39 100644
--- a/adm/contentformupdate.php
+++ b/adm/contentformupdate.php
@@ -20,6 +20,7 @@ if ($w == "" || $w == "u")
     $co_row = sql_fetch($sql);
 }
 
+$co_subject = strip_tags($co_subject);
 $co_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_head, 0, 255));
 $co_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_tail, 0, 255));
 
diff --git a/adm/faqmasterform.php b/adm/faqmasterform.php
index df87fec03..d48f69e49 100644
--- a/adm/faqmasterform.php
+++ b/adm/faqmasterform.php
@@ -21,6 +21,7 @@ if ($w == "u")
 else
 {
     $html_title .= ' 입력';
+    $fm = array();
 }
 
 $g5['title'] = $html_title.' 관리';
diff --git a/adm/faqmasterformupdate.php b/adm/faqmasterformupdate.php
index fed67d644..f753683e3 100644
--- a/adm/faqmasterformupdate.php
+++ b/adm/faqmasterformupdate.php
@@ -18,6 +18,8 @@ check_admin_token();
 if ($fm_himg_del)  @unlink(G5_DATA_PATH."/faq/{$fm_id}_h");
 if ($fm_timg_del)  @unlink(G5_DATA_PATH."/faq/{$fm_id}_t");
 
+$fm_subject = strip_tags($fm_subject);
+
 $sql_common = " set fm_subject = '$fm_subject',
                     fm_head_html = '$fm_head_html',
                     fm_tail_html = '$fm_tail_html',
diff --git a/adm/newwinform.php b/adm/newwinform.php
index 1e64f41e2..10aab222d 100644
--- a/adm/newwinform.php
+++ b/adm/newwinform.php
@@ -109,7 +109,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     <tr>
         <th scope="row"><label for="nw_subject">팝업 제목<strong class="sound_only"> 필수</strong></label></th>
         <td>
-            <input type="text" name="nw_subject" value="<?php echo stripslashes($nw['nw_subject']) ?>" id="nw_subject" required class="frm_input required" size="80">
+            <input type="text" name="nw_subject" value="<?php echo get_sanitize_input($nw['nw_subject']); ?>" id="nw_subject" required class="frm_input required" size="80">
         </td>
     </tr>
     <tr>
diff --git a/adm/newwinformupdate.php b/adm/newwinformupdate.php
index 191e54a3a..1441ac820 100644
--- a/adm/newwinformupdate.php
+++ b/adm/newwinformupdate.php
@@ -12,6 +12,8 @@ else
 
 check_admin_token();
 
+$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';
+
 $sql_common = " nw_device = '{$_POST['nw_device']}',
                 nw_begin_time = '{$_POST['nw_begin_time']}',
                 nw_end_time = '{$_POST['nw_end_time']}',
@@ -20,7 +22,7 @@ $sql_common = " nw_device = '{$_POST['nw_device']}',
                 nw_top = '{$_POST['nw_top']}',
                 nw_height = '{$_POST['nw_height']}',
                 nw_width = '{$_POST['nw_width']}',
-                nw_subject = '{$_POST['nw_subject']}',
+                nw_subject = '{$nw_subject}',
                 nw_content = '{$_POST['nw_content']}',
                 nw_content_html = '{$_POST['nw_content_html']}' ";
 
diff --git a/adm/point_update.php b/adm/point_update.php
index 2240e6022..571a1dfa6 100644
--- a/adm/point_update.php
+++ b/adm/point_update.php
@@ -6,9 +6,9 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
-$mb_id = $_POST['mb_id'];
-$po_point = $_POST['po_point'];
-$po_content = $_POST['po_content'];
+$mb_id = strip_tags($_POST['mb_id']);
+$po_point = strip_tags($_POST['po_point']);
+$po_content = strip_tags($_POST['po_content']);
 $expire = preg_replace('/[^0-9]/', '', $_POST['po_expire_term']);
 
 $mb = get_member($mb_id);
diff --git a/adm/sms_admin/num_book_update.php b/adm/sms_admin/num_book_update.php
index 578c482df..0a13c641f 100644
--- a/adm/sms_admin/num_book_update.php
+++ b/adm/sms_admin/num_book_update.php
@@ -21,6 +21,8 @@ if ($w=='u') // 업데이트
     if (!strlen(trim($bk_name)))
         alert('이름을 입력해주세요');
 
+    $bk_name = strip_tags($bk_name);
+
     if ($bk_hp == '')
         alert('휴대폰번호만 입력 가능합니다.');
 /*
diff --git a/adm/sms_admin/num_book_write.php b/adm/sms_admin/num_book_write.php
index 2e05a4b67..06896f81e 100644
--- a/adm/sms_admin/num_book_write.php
+++ b/adm/sms_admin/num_book_write.php
@@ -30,7 +30,7 @@ if ($w == 'u' && is_numeric($bk_no)) {
     $g5['title'] .= '수정';
 }
 else  {
-    $write['bg_no'] = $bg_no;
+    $write = array('bg_no' => (int) $bg_no);
     $g5['title'] .= '추가';
 }
 
@@ -74,7 +74,7 @@ include_once(G5_ADMIN_PATH."/admin.head.php");
     </tr>
     <tr>
         <th scope="row"><label for="bk_name">이름<strong class="sound_only"> 필수</strong></label></th>
-        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo $write['bk_name']?>" required class="frm_input required"></td>
+        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo get_sanitize_input($write['bk_name']); ?>" required class="frm_input required"></td>
     </tr>
     <tr>
         <th scope="row"><label for="bk_hp">휴대폰번호<strong class="sound_only"> 필수</strong></label></th>