firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

1:1문의 이메일 입력 XSS 취약점 재수정

Browse Source
This commit is contained in:
chicpro
2014-06-11 15:12:57 +09:00
parent 2adccca817
commit 9a16993762
3 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bbs/qaview.php
View File

@ -30,7 +30,7 @@ if(is_file($skin_file)) {
$view['content'] = conv_content($view['qa_content'], $view['qa_html']); $view['content'] = conv_content($view['qa_content'], $view['qa_html']);
$view['name'] = get_text($view['qa_name']); $view['name'] = get_text($view['qa_name']);
$view['datetime'] = $view['qa_datetime']; $view['datetime'] = $view['qa_datetime'];
$view['email'] = get_text(strip_tags2($view['qa_email'])); $view['email'] = get_text(get_email_address($view['qa_email']));
$view['hp'] = $view['qa_hp']; $view['hp'] = $view['qa_hp'];
if (trim($stx)) if (trim($stx))

2
bbs/qawrite_update.php
View File

@ -16,7 +16,7 @@ $msg = array();
// e-mail 체크 // e-mail 체크
if(isset($_POST['qa_email']) && $qa_email) { if(isset($_POST['qa_email']) && $qa_email) {
$qa_email = strip_tags2(trim($_POST['qa_email'])); $qa_email = get_email_address(trim($_POST['qa_email']));
if($qaconfig['qa_req_email'] && !$qa_email) if($qaconfig['qa_req_email'] && !$qa_email)
$msg[] = '이메일을 입력하세요.'; $msg[] = '이메일을 입력하세요.';

9
lib/common.lib.php
View File

@ -2711,12 +2711,11 @@ function member_delete($mb_id)
sql_query($sql); sql_query($sql);
} }
// strip_tags 변형 // 이메일 주소 추출
function strip_tags2($str) function get_email_address($email)
{ {
if(!$str) preg_match("/[0-9a-z._-]+@[a-z0-9._-]{4,}/i", $email, $matches);
return '';
return strip_tags(preg_replace("#<script[^<]*</script[^>]*>#i", "", $str)); return $matches[0];
} }
?> ?>