From 81671abd01a2522e7a489d73740b6c72a4d3929b Mon Sep 17 00:00:00 2001
From: chicpro <chicpro@sir.co.kr>
Date: Fri, 29 Apr 2016 14:20:59 +0900
Subject: [PATCH] =?UTF-8?q?=EC=9D=B4=EB=A9=94=EC=9D=BC=EC=9D=B8=EC=A6=9D?=
 =?UTF-8?q?=20=ED=94=84=EB=A1=9C=EC=84=B8=EC=8A=A4=20=EA=B0=9C=EC=84=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/member_form.php           |  5 +++++
 bbs/email_certify.php         | 15 ++++++++++++---
 bbs/register_email_update.php | 10 +++++++---
 bbs/register_form_update.php  |  9 ++++++---
 4 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/adm/member_form.php b/adm/member_form.php
index 980369314..14825a339 100644
--- a/adm/member_form.php
+++ b/adm/member_form.php
@@ -126,6 +126,11 @@ if(!isset($mb['mb_dupinfo'])) {
     sql_query(" ALTER TABLE {$g5['member_table']} ADD `mb_dupinfo` varchar(255) NOT NULL DEFAULT '' AFTER `mb_adult` ", false);
 }
 
+// 이메일인증 체크 필드추가
+if(!isset($mb['mb_email_certify2'])) {
+    sql_query(" ALTER TABLE {$g5['member_table']} ADD `mb_email_certify2` varchar(255) NOT NULL DEFAULT '' AFTER `mb_email_certify` ", false);
+}
+
 if ($mb['mb_intercept_date']) $g5['title'] = "차단된 ";
 else $g5['title'] .= "";
 $g5['title'] .= '회원 '.$html_title;
diff --git a/bbs/email_certify.php b/bbs/email_certify.php
index ae50f7356..80b4bf0b8 100644
--- a/bbs/email_certify.php
+++ b/bbs/email_certify.php
@@ -1,20 +1,29 @@
 <?php
 include_once('./_common.php');
 
-$sql = " select mb_id, mb_email, mb_datetime from {$g5['member_table']} where mb_id = '{$mb_id}' ";
+$mb_id  = trim($_GET['mb_id']);
+$mb_md5 = trim($_GET['mb_md5']);
+
+$sql = " select mb_id, mb_email_certify2 from {$g5['member_table']} where mb_id = '{$mb_id}' ";
 $row = sql_fetch($sql);
 if (!$row['mb_id'])
     alert('존재하는 회원이 아닙니다.', G5_URL);
 
+// 인증 링크는 한번만 처리가 되게 한다.
+sql_query(" update {$g5['member_table']} set mb_email_certify2 = '' where mb_id = '$mb_id' ");
+
 if ($mb_md5)
 {
-    $tmp_md5 = md5($row['mb_id'].$row['mb_email'].$row['mb_datetime']);
-    if ($mb_md5 == $tmp_md5)
+    if ($mb_md5 == $row['mb_email_certify2'])
     {
         sql_query(" update {$g5['member_table']} set mb_email_certify = '".G5_TIME_YMDHIS."' where mb_id = '{$mb_id}' ");
 
         alert("메일인증 처리를 완료 하였습니다.\\n\\n지금부터 {$mb_id} 아이디로 로그인 가능합니다.", G5_URL);
     }
+    else
+    {
+        alert('메일인증 요청 정보가 올바르지 않습니다.', G5_URL);
+    }
 }
 
 alert('제대로 된 값이 넘어오지 않았습니다.', G5_URL);
diff --git a/bbs/register_email_update.php b/bbs/register_email_update.php
index 12287c668..ec6a5672d 100644
--- a/bbs/register_email_update.php
+++ b/bbs/register_email_update.php
@@ -9,7 +9,7 @@ $mb_email = get_email_address(trim($_POST['mb_email']));
 if(!$mb_id || !$mb_email)
     alert('올바른 방법으로 이용해 주십시오.', G5_URL);
 
-$sql = " select mb_name, mb_password, mb_email, mb_datetime from {$g5['member_table']} where mb_id = '{$mb_id}' and substring(mb_email_certify, 1, 1) = '0' ";
+$sql = " select mb_name from {$g5['member_table']} where mb_id = '{$mb_id}' and substring(mb_email_certify, 1, 1) = '0' ";
 $mb = sql_fetch($sql);
 if (!$mb) {
     alert("이미 메일인증 하신 회원입니다.", G5_URL);
@@ -29,8 +29,12 @@ if ($row['cnt']) {
 $subject = '['.$config['cf_title'].'] 인증확인 메일입니다.';
 
 $mb_name = $mb['mb_name'];
-$mb_datetime = $mb['mb_datetime'] ? $mb['mb_datetime'] : G5_TIME_YMDHIS;
-$mb_md5 = md5($mb_id.$mb_email.$mb_datetime);
+
+// 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용
+$mb_md5 = md5(pack('V*', rand(), rand(), rand(), rand()));
+
+sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' ");
+
 $certify_href = G5_BBS_URL.'/email_certify.php?mb_id='.$mb_id.'&amp;mb_md5='.$mb_md5;
 
 ob_start();
diff --git a/bbs/register_form_update.php b/bbs/register_form_update.php
index ef1392ca6..e272f3f5e 100644
--- a/bbs/register_form_update.php
+++ b/bbs/register_form_update.php
@@ -396,8 +396,11 @@ if (isset($_FILES['mb_icon']) && is_uploaded_file($_FILES['mb_icon']['tmp_name']
 if ($config['cf_use_email_certify'] && $old_email != $mb_email) {
     $subject = '['.$config['cf_title'].'] 인증확인 메일입니다.';
 
-    $mb_datetime = $member['mb_datetime'] ? $member['mb_datetime'] : G5_TIME_YMDHIS;
-    $mb_md5 = md5($mb_id.$mb_email.$mb_datetime);
+    // 어떠한 회원정보도 포함되지 않은 일회용 난수를 생성하여 인증에 사용
+    $mb_md5 = md5(pack('V*', rand(), rand(), rand(), rand()));
+
+    sql_query(" update {$g5['member_table']} set mb_email_certify2 = '$mb_md5' where mb_id = '$mb_id' ");
+
     $certify_href = G5_BBS_URL.'/email_certify.php?mb_id='.$mb_id.'&amp;mb_md5='.$mb_md5;
 
     ob_start();
@@ -405,7 +408,7 @@ if ($config['cf_use_email_certify'] && $old_email != $mb_email) {
     $content = ob_get_contents();
     ob_end_clean();
 
-    mailer($config['cf_title'], $config['cf_admin_email'], $mb_email, $subject, $content, 1);
+    mailer($config['cf_admin_email_name'], $config['cf_admin_email'], $mb_email, $subject, $content, 1);
 }