firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

버전 5.4.2.6 으로 수정

Browse Source
This commit is contained in:
thisgun
2020-06-05 12:39:55 +09:00
parent e829305489 73a72af338
commit 7379d10256
16 changed files with 212 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
adm/admin.lib.php
View File

@ -482,7 +482,7 @@ function admin_check_xss_params($params){
if( is_array($value) ){
admin_check_xss_params($value);
} else if ( (preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/[onload|onerror]=.*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || (preg_match('/[onload|onerror]=.*/ius', $value) && preg_match('/(eval|expression|exec|prompt)(\s*)\((.*)\)/ius', $value)) ){
} else if ( (preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/[onload|onerror]=.*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || (preg_match('/[onload|onerror|focus]=.*/ius', $value) && preg_match('/(eval|expression|exec|prompt)(\s*)\((.*)\)/ius', $value)) ){
alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.', G5_URL);
die();
}

20
adm/auth_list.php
View File

@ -160,7 +160,7 @@ $pagelist = get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_w
echo $pagelist;
?>
<form name="fauthlist2" id="fauthlist2" action="./auth_update.php" method="post" autocomplete="off">
<form name="fauthlist2" id="fauthlist2" action="./auth_update.php" method="post" autocomplete="off" onsubmit="return fauth_add_submit(this);">
<input type="hidden" name="sfl" value="<?php echo $sfl ?>">
<input type="hidden" name="stx" value="<?php echo $stx ?>">
<input type="hidden" name="sst" value="<?php echo $sst ?>">
@ -218,6 +218,17 @@ echo $pagelist;
<label for="d">d (삭제)</label>
</td>
</tr>
<tr>
<th scope="row">자동등록방지</th>
<td>
<?php
include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
$captcha_html = captcha_html();
$captcha_js = chk_captcha_js();
echo $captcha_html;
?>
</td>
</tr>
</tbody>
</table>
</div>
@ -230,6 +241,13 @@ echo $pagelist;
</form>
<script>
function fauth_add_submit(f){
<?php echo $captcha_js; // 캡챠 사용시 자바스크립트에서 입력된 캡챠를 검사함 ?>
return true;
}
function fauthlist_submit(f)
{
if (!is_checked("chk[]")) {

17
adm/auth_update.php
View File

@ -1,6 +1,7 @@
<?php
$sub_menu = "100200";
include_once('./_common.php');
include_once(G5_LIB_PATH.'/mailer.lib.php');
if ($is_admin != 'super')
alert('최고관리자만 접근 가능합니다.');
@ -11,6 +12,12 @@ if (!$mb['mb_id'])
check_admin_token();
include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
if (!chk_captcha()) {
alert('자동등록방지 숫자가 틀렸습니다.');
}
$sql = " insert into {$g5['auth_table']}
set mb_id = '{$_POST['mb_id']}',
au_menu = '{$_POST['au_menu']}',
@ -26,5 +33,15 @@ if (!$result) {
//sql_query(" OPTIMIZE TABLE `$g5['auth_table']` ");
// 세션을 체크하여 하루에 한번만 메일알림이 가게 합니다.
if( str_replace('-', '', G5_TIME_YMD) !== get_session('adm_auth_update') ){
$site_url = preg_replace('/^www\./', '', strtolower($_SERVER['SERVER_NAME']));
$to_email = 'gnuboard@'.$site_url;
mailer($config['cf_admin_email_name'], $to_email, $config['cf_admin_email'], '['.$config['cf_title'].'] 관리권한설정 알림', '<p><b>['.$config['cf_title'].'] 관리권한설정 변경 안내</b></p><p style="padding-top:1em">회원 아이디 '.$mb['mb_id'].' 에 관리권한이 추가 되었습니다.</p><p style="padding-top:1em">'.G5_TIME_YMDHIS.'</p><p style="padding-top:1em"><a href="'.G5_URL.'" target="_blank">'.$config['cf_title'].'</a></p>', 1);
set_session('adm_auth_update', str_replace('-', '', G5_TIME_YMD));
}
goto_url('./auth_list.php?'.$qstr);
?>

4
adm/config_form.php
View File

@ -1466,10 +1466,14 @@ if($config['cf_cert_use']) {
// kcp일 때
if($config['cf_cert_hp'] == 'kcp') {
if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
if(PHP_INT_MAX == 2147483647) // 32-bit
$exe = G5_KCPCERT_PATH . '/bin/ct_cli';
else
$exe = G5_KCPCERT_PATH . '/bin/ct_cli_x64';
} else {
$exe = G5_KCPCERT_PATH . '/bin/ct_cli_exe.exe';
}
echo module_exec_check($exe, 'ct_cli');
}

1
adm/sms_admin/history_view.php
View File

@ -4,6 +4,7 @@ include_once("./_common.php");
$spage_size = 20;
$colspan = 10;
$re_text = '';
$st = isset($st) ? strip_tags($st) : '';
$ssv = isset($ssv) ? strip_tags($ssv) : '';

4
bbs/view_image.php
View File

@ -6,6 +6,10 @@ include_once(G5_PATH.'/head.sub.php');
$filename = preg_replace('/[^A-Za-z0-9 _ .\-\/]/', '', $_GET['fn']);
if(function_exists('clean_relative_paths')){
$filename = clean_relative_paths($filename);
}
$extension = pathinfo($filename, PATHINFO_EXTENSION);
if ( ! preg_match('/(jpg|jpeg|png|gif|bmp)$/i', $extension) ){

9
bbs/write_update.php
View File

@ -436,7 +436,7 @@ if (!$group['gr_use_access'] && $board['bo_read_level'] < 2 && !$secret) {
// 파일개수 체크
$file_count = 0;
$upload_count = count($_FILES['bf_file']['name']);
$upload_count = (isset($_FILES['bf_file']['name']) && is_array($_FILES['bf_file']['name'])) ? count($_FILES['bf_file']['name']) : 0;
for ($i=0; $i<$upload_count; $i++) {
if($_FILES['bf_file']['name'][$i] && is_uploaded_file($_FILES['bf_file']['tmp_name'][$i]))
@ -461,7 +461,9 @@ $chars_array = array_merge(range(0,9), range('a','z'), range('A','Z'));
// 가변 파일 업로드
$file_upload_msg = '';
$upload = array();
for ($i=0; $i<count($_FILES['bf_file']['name']); $i++) {
if(isset($_FILES['bf_file']['name']) && is_array($_FILES['bf_file']['name'])) {
for ($i=0; $i<count($_FILES['bf_file']['name']); $i++) {
$upload[$i]['file'] = '';
$upload[$i]['source'] = '';
$upload[$i]['filesize'] = 0;
@ -570,7 +572,8 @@ for ($i=0; $i<count($_FILES['bf_file']['name']); $i++) {
$dest_file = run_replace('write_update_upload_file', $dest_file, $board, $wr_id, $w);
$upload[$i] = run_replace('write_update_upload_array', $upload[$i], $dest_file, $board, $wr_id, $w);
}
}
} // end for
} // end if
// 나중에 테이블에 저장하는 이유는 $wr_id 값을 저장해야 하기 때문입니다.
for ($i=0; $i<count($upload); $i++)

4
common.php
View File

@ -310,8 +310,8 @@ if( $config['cf_cert_use'] || (defined('G5_YOUNGCART_VER') && G5_YOUNGCART_VER)
$res = @session_start($options);
// IE 브라우저 또는 엣지브라우저 일때는 secure; SameSite=None, http 환경에서는 설정하지 않습니다.
if( preg_match('/Edge/i', $_SERVER['HTTP_USER_AGENT']) || preg_match('~MSIE|Internet Explorer~i', $_SERVER['HTTP_USER_AGENT']) || preg_match('~Trident/7.0(; Touch)?; rv:11.0~',$_SERVER['HTTP_USER_AGENT']) || ! (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ){
// IE 브라우저 또는 엣지브라우저 또는 IOS 모바일과 http환경에서는 secure; SameSite=None을 설정하지 않습니다.
if( preg_match('/Edge/i', $_SERVER['HTTP_USER_AGENT']) || preg_match('/(iPhone|iPod|iPad).*AppleWebKit.*Safari/i', $_SERVER['HTTP_USER_AGENT']) || preg_match('~MSIE|Internet Explorer~i', $_SERVER['HTTP_USER_AGENT']) || preg_match('~Trident/7.0(; Touch)?; rv:11.0~',$_SERVER['HTTP_USER_AGENT']) || ! (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ){
return $res;
}

4
config.php
View File

@ -5,8 +5,8 @@
********************/
define('G5_VERSION', '그누보드5');
define('G5_GNUBOARD_VER', '5.4.2.5');
define('G5_YOUNGCART_VER', '5.4.2.5.1');
define('G5_GNUBOARD_VER', '5.4.2.6');
define('G5_YOUNGCART_VER', '5.4.2.6');
// 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
define('_GNUBOARD_', true);

2
install/ajax.install.check.php
View File

@ -26,7 +26,7 @@ $mysql_db = safe_install_string_check($_POST['mysql_db'], 'json');
$table_prefix= safe_install_string_check(preg_replace('/[^a-zA-Z0-9_]/', '_', $_POST['table_prefix']));
$tmp_str = isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '';
$ajax_token = md5($tmp_str.$_SERVER['REMOTE_ADDR'].$_SERVER['DOCUMENT_ROOT']);
$ajax_token = md5($tmp_str.$_SERVER['REMOTE_ADDR'].dirname(dirname(__FILE__).'/'));
$bool_ajax_token = ($ajax_token == $_POST['ajax_token']) ? true : false;

2
install/install_config.php
View File

@ -19,7 +19,7 @@ if (!isset($_POST['agree']) || $_POST['agree'] != '동의함') {
}
$tmp_str = isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '';
$ajax_token = md5($tmp_str.$_SERVER['REMOTE_ADDR'].$_SERVER['DOCUMENT_ROOT']);
$ajax_token = md5($tmp_str.$_SERVER['REMOTE_ADDR'].dirname(dirname(__FILE__).'/'));
?>

3
lib/common.lib.php
View File

@ -3130,7 +3130,8 @@ function member_delete($mb_id)
}
// 회원자료는 정보만 없앤 후 아이디는 보관하여 다른 사람이 사용하지 못하도록 함 : 061025
$sql = " update {$g5['member_table']} set mb_password = '', mb_level = 1, mb_email = '', mb_homepage = '', mb_tel = '', mb_hp = '', mb_zip1 = '', mb_zip2 = '', mb_addr1 = '', mb_addr2 = '', mb_birth = '', mb_sex = '', mb_signature = '', mb_memo = '".date('Ymd', G5_SERVER_TIME)." 삭제함\n{$mb['mb_memo']}' where mb_id = '{$mb_id}' ";
$sql = " update {$g5['member_table']} set mb_password = '', mb_level = 1, mb_email = '', mb_homepage = '', mb_tel = '', mb_hp = '', mb_zip1 = '', mb_zip2 = '', mb_addr1 = '', mb_addr2 = '', mb_birth = '', mb_sex = '', mb_signature = '', mb_memo = '".date('Ymd', G5_SERVER_TIME)." 삭제함\n".sql_real_escape_string($mb['mb_memo'])."' where mb_id = '{$mb_id}' ";
sql_query($sql);
// 포인트 테이블에서 삭제

6
plugin/kcaptcha/kcaptcha_mp3.php
View File

@ -17,18 +17,18 @@ function make_mp3()
}
$ip = sprintf("%u", ip2long($_SERVER['REMOTE_ADDR']));
$mp3_file = 'data/cache/kcaptcha-'.$ip.'_'.G5_SERVER_TIME.'.mp3';
$mp3_file = 'cache/kcaptcha-'.$ip.'_'.G5_SERVER_TIME.'.mp3';
$contents = '';
foreach ($mp3s as $mp3) {
$contents .= file_get_contents($mp3);
}
file_put_contents(G5_PATH.'/'.$mp3_file, $contents);
file_put_contents(G5_DATA_PATH.'/'.$mp3_file, $contents);
// 지난 캡챠 파일 삭제
if (rand(0,99) == 0) {
foreach (glob(G5_PATH.'/data/cache/kcaptcha-*.mp3') as $file) {
foreach (glob(G5_DATA_PATH.'/cache/kcaptcha-*.mp3') as $file) {
if (filemtime($file) + 86400 < G5_SERVER_TIME) {
@unlink($file);
}

BIN
plugin/kcpcert/bin/ct_cli_exe.exe Normal file
View File

Binary file not shown.

11
plugin/kcpcert/kcpcert_result.php
View File

@ -100,11 +100,15 @@ if( $cert_enc_use == "Y" )
if ( $ct_cert->check_valid_hash ( $home_dir , $dn_hash , $veri_str ) != "1" )
{
if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
// 검증 실패시 처리 영역
if(PHP_INT_MAX == 2147483647) // 32-bit
$bin_exe = '/bin/ct_cli';
else
$bin_exe = '/bin/ct_cli_x64';
} else {
$bin_exe = '/bin/ct_cli_exe.exe';
}
echo "dn_hash 변조 위험있음 (".G5_KCPCERT_PATH.$bin_exe." 파일에 실행권한이 있는지 확인하세요.)";
exit;
@ -133,6 +137,13 @@ if( $cert_enc_use == "Y" )
$dec_res_cd = $ct_cert->mf_get_key_value("res_cd" ); // 암호화된 결과코드
$dec_mes_msg = $ct_cert->mf_get_key_value("res_msg" ); // 암호화된 결과메시지
if(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN' && function_exists('mb_detect_encoding') ){
if( mb_detect_encoding($user_name, 'EUC-KR') === 'EUC-KR' ){
$user_name = iconv_utf8($user_name);
$dec_mes_msg = iconv_utf8($dec_mes_msg);
}
}
// 정상인증인지 체크
if(!$phone_no)
alert_close("정상적인 인증이 아닙니다. 올바른 방법으로 이용해 주세요.");

23
plugin/kcpcert/lib/ct_cli_lib.php
View File

@ -22,11 +22,14 @@ class C_CT_CLI
// hash 처리 영역
function make_hash_data( $home_dir , $str )
{
if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
if(PHP_INT_MAX == 2147483647) // 32-bit
$bin_exe = $home_dir . '/bin/ct_cli';
else
$bin_exe = $home_dir . '/bin/ct_cli_x64';
} else {
$bin_exe = $home_dir . '/bin/ct_cli_exe.exe';
}
$hash_data = $this -> mf_exec( $bin_exe ,
"lf_CT_CLI__make_hash_data",
$str
@ -40,11 +43,14 @@ class C_CT_CLI
// dn_hash 체크 함수
function check_valid_hash ($home_dir , $hash_data , $str )
{
if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
if(PHP_INT_MAX == 2147483647) // 32-bit
$bin_exe = $home_dir . '/bin/ct_cli';
else
$bin_exe = $home_dir . '/bin/ct_cli_x64';
} else {
$bin_exe = $home_dir . '/bin/ct_cli_exe.exe';
}
$ret_val = $this -> mf_exec( $bin_exe ,
"lf_CT_CLI__check_valid_hash" ,
$hash_data ,
@ -59,6 +65,7 @@ class C_CT_CLI
// 암호화 인증데이터 복호화
function decrypt_enc_cert ( $home_dir, $site_cd , $cert_no , $enc_cert_data , $opt)
{
if(strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
if(PHP_INT_MAX == 2147483647) // 32-bit
$bin_exe = $home_dir . '/bin/ct_cli';
else
@ -71,6 +78,18 @@ class C_CT_CLI
$enc_cert_data ,
$opt
);
} else {
$bin_exe = $home_dir . '/bin/ct_cli_exe.exe';
$dec_data = $this -> mf_exec( $bin_exe ,
"lf_CT_CLI__decrypt_enc_cert" ,
$site_cd ,
$cert_no ,
$enc_cert_data
);
}
if ( $dec_data == "" ) { $dec_data = "HS03"; }