diff --git a/adm/admin.lib.php b/adm/admin.lib.php index edbf96fb5..6a2fc5f2b 100644 --- a/adm/admin.lib.php +++ b/adm/admin.lib.php @@ -554,9 +554,18 @@ function admin_check_xss_params($params) if (is_array($value)) { admin_check_xss_params($value); - } else if ((preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/(onload|onerror)=.*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || (preg_match('/(onload|onerror|focus)=.*/ius', $value) && preg_match('/(eval|expression|exec|prompt)(\s*)\((.*)\)/ius', $value))) { + } else if ( + (preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/on[a-z]+=*/ius', $value))) || preg_match('/^(?=.*token\()(?=.*xmlhttprequest\()(?=.*send\().*$/im', $value) || + (preg_match('/(on[a-z]+|focus)=.*/ius', $value) && preg_match('/(eval|atob|fetch|expression|exec|prompt)(\s*)\((.*)\)/ius', $value))) { alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.', G5_URL); die(); + } else if (preg_match('/atob\s*\(\s*[\'"]?([a-zA-Z0-9+\/=]+)[\'"]?\s*\)/ius', $value, $matches)) { + $decoded = base64_decode($matches[1], true); + if ($decoded && preg_match('/(eval|fetch|script|alert|settimeout|setinterval)/ius', $decoded)) { + // error_log("Base64 XSS 시도 감지: key=$key, decoded=$decoded, IP=" . $_SERVER['REMOTE_ADDR']); + alert('Base64로 인코딩된 위험한 스크립트가 발견되었습니다.', G5_URL); + die(); + } } } diff --git a/adm/config_form.php b/adm/config_form.php index c63189411..986112e79 100644 --- a/adm/config_form.php +++ b/adm/config_form.php @@ -1557,7 +1557,17 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) { - + + +
@@ -1629,10 +1639,61 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) { }); }); + // 각 요소의 초기값 저장 + var initialValues = { + cf_admin: $('#cf_admin').val(), + cf_analytics: $('#cf_analytics').val(), + cf_add_meta: $('#cf_add_meta').val(), + cf_add_script: $('#cf_add_script').val() + }; + + function check_config_captcha_open() { + var isChanged = false; + + // 현재 값이 있는 경우에만 변경 여부 체크 + if ($('#cf_admin').val()) { + isChanged = isChanged || $('#cf_admin').val() !== initialValues.cf_admin; + } + if ($('#cf_analytics').val()) { + isChanged = isChanged || $('#cf_analytics').val() !== initialValues.cf_analytics; + } + if ($('#cf_add_meta').val()) { + isChanged = isChanged || $('#cf_add_meta').val() !== initialValues.cf_add_meta; + } + if ($('#cf_add_script').val()) { + isChanged = isChanged || $('#cf_add_script').val() !== initialValues.cf_add_script; + } + + var $wrap = $("#config_captcha_wrap"), + tooptipid = "mp_captcha_tooltip", + $p_text = $("

", {id:tooptipid, style:"font-size:0.95em;letter-spacing:-0.1em"}).html("중요정보를 수정할 경우 캡챠를 입력해야 합니다."), + $children = $wrap.children(':first'), + is_invisible_recaptcha = $("#captcha").hasClass("invisible_recaptcha"); + + if(isChanged){ + $wrap.show(); + if(! is_invisible_recaptcha) { + $wrap.css("margin-top","1em"); + if(! $("#"+tooptipid).length){ $children.after($p_text) } + } + } else { + $wrap.hide(); + if($("#"+tooptipid).length && ! is_invisible_recaptcha){ $children.next("#"+tooptipid).remove(); } + } + + return isChanged; + } + function fconfigform_submit(f) { var current_user_ip = ""; var cf_intercept_ip_val = f.cf_intercept_ip.value; - + + if (check_config_captcha_open()){ + jQuery("html, body").scrollTop(jQuery("#config_captcha_wrap").offset().top); + + + } + if (cf_intercept_ip_val && current_user_ip) { var cf_intercept_ips = cf_intercept_ip_val.split("\n"); @@ -1653,6 +1714,22 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) { f.action = "./config_form_update.php"; return true; } + + jQuery(function($){ + $("#captcha_key").prop('required', false).removeAttr("required").removeClass("required"); + + // 최고관리자 변경시 + $(document).on('change', '#cf_admin', check_config_captcha_open); + + // 방문자분석 스크립트 변경시 + $(document).on('input', '#cf_analytics', check_config_captcha_open); + + // 추가 메타태그 변경시 + $(document).on('input', '#cf_add_meta', check_config_captcha_open); + + // 추가 script, css 변경시 + $(document).on('input', '#cf_add_script', check_config_captcha_open); + });

- - - - - - - + + + + + + +
diff --git a/adm/shop_admin/itemsellrank.php b/adm/shop_admin/itemsellrank.php index d9522381d..b1e387d58 100644 --- a/adm/shop_admin/itemsellrank.php +++ b/adm/shop_admin/itemsellrank.php @@ -68,10 +68,10 @@ $listall = '전체목 - - - - + + + + - - - + + + + - - - + + + + - + + - - - + + + + - - - - + + + + + - + +