firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

그누보드 Reflected XSS 취약점 (891, 906, 908, 910) 수정

Browse Source
This commit is contained in:
thisgun
2017-12-11 17:52:20 +09:00
parent 8755c8ece7
commit 7f9664af0a
4 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
adm/sms_admin/form_group_update.php
View File

@ -10,9 +10,9 @@ if ($w == 'u') // 업데이트
{
// 실제 번호를 넘김
$k = $_POST['chk'][$i];
$fg_no = $_POST['fg_no'][$k];
$fg_name = $_POST['fg_name'][$k];
$fg_member = $_POST['fg_member'][$k];
$fg_no = (int) $_POST['fg_no'][$k];
$fg_name = strip_tags($_POST['fg_name'][$k]);
$fg_member = strip_tags($_POST['fg_member'][$k]);
if (!is_numeric($fg_no))
alert('그룹 고유번호가 없습니다.');
@ -38,7 +38,7 @@ else if ($w == 'de') // 그룹삭제
{
// 실제 번호를 넘김
$k = $_POST['chk'][$i];
$fg_no = $_POST['fg_no'][$k];
$fg_no = (int) $_POST['fg_no'][$k];
if (!is_numeric($fg_no))
alert('그룹 고유번호가 없습니다.');
@ -57,7 +57,7 @@ else if ($w == 'em')
{
// 실제 번호를 넘김
$k = $_POST['chk'][$i];
$fg_no = $_POST['fg_no'][$k];
$fg_no = (int) $_POST['fg_no'][$k];
if ($fg_no == 'no') $fg_no = 0;
@ -71,6 +71,8 @@ else if ($w == 'no')
{
if ($fg_no == 'no') $fg_no = 0;
$fg_no = (int) $fg_no;
if ($fg_no)
sql_query("update {$g5['sms5_form_group_table']} set fg_count = 0 where fg_no = '$fg_no'");
@ -81,6 +83,8 @@ else // 등록
if (!strlen(trim($fg_name)))
alert('그룹명을 입력해주세요');
$fg_name = strip_tags($fg_name);
$res = sql_fetch("select fg_name from {$g5['sms5_form_group_table']} where fg_name = '$fg_name'");
if ($res)
alert('같은 그룹명이 존재합니다.');