firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

[KVE-2019-1581,1585,1586,1590,2020-0012]그누보드XSS취약점 수정

Browse Source
This commit is contained in:
thisgun
2020-02-12 11:33:53 +09:00
parent 30e0b93ecf
commit 992d3d93f4
7 changed files with 14 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
adm/sms_admin/num_group_update.php
View File

@ -11,7 +11,7 @@ if ($w == 'u') // 업데이트
// 실제 번호를 넘김
$k = $_POST['chk'][$i];
$bg_no = (int) $_POST['bg_no'][$k];
$bg_name = strip_tags($_POST['bg_name'][$k]);
$bg_name = strip_tags(clean_xss_attributes($_POST['bg_name'][$k]));
if (!is_numeric($bg_no))
alert('그룹 고유번호가 없습니다.');
@ -23,11 +23,11 @@ if ($w == 'u') // 업데이트
if (!strlen(trim($bg_name)))
alert('그룹명을 입력해주세요');
$res = sql_fetch("select bg_name from {$g5['sms5_book_group_table']} where bg_no<>'$bg_no' and bg_name='$bg_name'");
$res = sql_fetch("select bg_name from {$g5['sms5_book_group_table']} where bg_no<>'$bg_no' and bg_name='".sql_real_escape_string($bg_name)."'");
if ($res)
alert('같은 그룹명이 존재합니다.');
sql_query("update {$g5['sms5_book_group_table']} set bg_name='".addslashes($bg_name)."' where bg_no='$bg_no'");
sql_query("update {$g5['sms5_book_group_table']} set bg_name='".sql_real_escape_string($bg_name)."' where bg_no='$bg_no'");
}
}
else if ($w == 'de') // 그룹삭제
@ -63,7 +63,7 @@ else if ($w == 'em') // 비우기
}
else // 등록
{
$bg_name = strip_tags($bg_name);
$bg_name = strip_tags(clean_xss_attributes($bg_name));
if (!strlen(trim($bg_name)))
alert('그룹명을 입력해주세요');
@ -72,7 +72,7 @@ else // 등록
if ($res)
alert('같은 그룹명이 존재합니다.');
sql_query("insert into {$g5['sms5_book_group_table']} set bg_name='".addslashes($bg_name)."'");
sql_query("insert into {$g5['sms5_book_group_table']} set bg_name='$bg_name'");
}
goto_url('./num_group.php');