firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

그누보드 Reflected XSS 취약점 (891, 906, 908, 910) 수정

Browse Source
This commit is contained in:
thisgun
2017-12-11 17:52:20 +09:00
parent 8755c8ece7
commit 7f9664af0a
4 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
adm/sms_admin/num_group_update.php
View File

@ -10,8 +10,8 @@ if ($w == 'u') // 업데이트
{
// 실제 번호를 넘김
$k = $_POST['chk'][$i];
$bg_no = $_POST['bg_no'][$k];
$bg_name = $_POST['bg_name'][$k];
$bg_no = (int) $_POST['bg_no'][$k];
$bg_name = strip_tags($_POST['bg_name'][$k]);
if (!is_numeric($bg_no))
alert('그룹 고유번호가 없습니다.');
@ -36,7 +36,7 @@ else if ($w == 'de') // 그룹삭제
{
// 실제 번호를 넘김
$k = $_POST['chk'][$i];
$bg_no = $_POST['bg_no'][$k];
$bg_no = (int) $_POST['bg_no'][$k];
if (!is_numeric($bg_no))
alert('그룹 고유번호가 없습니다.');
@ -55,7 +55,7 @@ else if ($w == 'em') // 비우기
{
// 실제 번호를 넘김
$k = $_POST['chk'][$i];
$bg_no = $_POST['bg_no'][$k];
$bg_no = (int) $_POST['bg_no'][$k];
sql_query("update {$g5['sms5_book_group_table']} set bg_count = 0, bg_member = 0, bg_nomember = 0, bg_receipt = 0, bg_reject = 0 where bg_no='$bg_no'");
sql_query("delete from {$g5['sms5_book_table']} where bg_no='$bg_no'");
@ -63,6 +63,8 @@ else if ($w == 'em') // 비우기
}
else // 등록
{
$bg_name = strip_tags($bg_name);
if (!strlen(trim($bg_name)))
alert('그룹명을 입력해주세요');