firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

[KVE-2019-1582,1590,1594]영카트XSS취약점 수정

Browse Source
This commit is contained in:
thisgun
2020-02-12 12:17:36 +09:00
parent e40105045a
commit 7b220eaeb9
4 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
adm/shop_admin/couponform.php
View File

@ -52,7 +52,7 @@ include_once(G5_PLUGIN_PATH.'/jquery-ui/datepicker.php');
<tr>
<th scope="row"><label for="cp_subject">쿠폰이름</label></th>
<td>
<input type="text" name="cp_subject" value="<?php echo stripslashes($cp['cp_subject']); ?>" id="cp_subject" required class="required frm_input" size="50">
<input type="text" name="cp_subject" value="<?php echo get_sanitize_input($cp['cp_subject']); ?>" id="cp_subject" required class="required frm_input" size="50">
</td>
</tr>
<tr>

2
adm/shop_admin/couponformupdate.php
View File

@ -24,7 +24,7 @@ $check_sanitize_keys = array(
);
foreach( $check_sanitize_keys as $key ){
$$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags($_POST[$key]) : '';
$$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
}
if(!$_POST['cp_subject'])

2
adm/shop_admin/couponzoneformupdate.php
View File

@ -28,7 +28,7 @@ $check_sanitize_keys = array(
);
foreach( $check_sanitize_keys as $key ){
$$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags($_POST[$key]) : '';
$$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
}
if(!$_POST['cz_subject'])

2
adm/shop_admin/itemlistupdate.php
View File

@ -26,7 +26,7 @@ if ($_POST['act_button'] == "선택수정") {
$p_ca_id = is_array($_POST['ca_id']) ? strip_tags($_POST['ca_id'][$k]) : '';
$p_ca_id2 = is_array($_POST['ca_id2']) ? strip_tags($_POST['ca_id2'][$k]) : '';
$p_ca_id3 = is_array($_POST['ca_id3']) ? strip_tags($_POST['ca_id3'][$k]) : '';
$p_it_name = is_array($_POST['it_name']) ? strip_tags($_POST['it_name'][$k]) : '';
$p_it_name = is_array($_POST['it_name']) ? strip_tags(clean_xss_attributes($_POST['it_name'][$k])) : '';
$p_it_cust_price = is_array($_POST['it_cust_price']) ? strip_tags($_POST['it_cust_price'][$k]) : '';
$p_it_price = is_array($_POST['it_price']) ? strip_tags($_POST['it_price'][$k]) : '';
$p_it_stock_qty = is_array($_POST['it_stock_qty']) ? strip_tags($_POST['it_stock_qty'][$k]) : '';