firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

충돌 수정

Browse Source
This commit is contained in:
thisgun
2018-03-19 14:25:32 +09:00
parent 91a3ca9f8a af6d060fa0
commit bb176f0a46
52 changed files with 332 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
adm/admin.lib.php
View File

@ -355,6 +355,17 @@ function get_admin_token()
return $token;
}
//input value 에서 xss 공격 filter 역할을 함 ( 반드시 input value='' 타입에만 사용할것 )
function get_sanitize_input($s, $is_html=false){
if(!$is_html){
$s = strip_tags($s);
}
$s = htmlspecialchars($s, ENT_QUOTES, 'utf-8');
return $s;
}
// POST로 넘어온 토큰과 세션에 저장된 토큰 비교
function check_admin_token()

11
adm/auth_list_delete.php
View File

@ -9,17 +9,24 @@ if ($is_admin != 'super')
check_admin_token();
$count = count($_POST['chk']);
$count = (isset($_POST['chk']) && is_array($_POST['chk'])) ? count($_POST['chk']) : 0;
if (!$count)
alert($_POST['act_button']." 하실 항목을 하나 이상 체크하세요.");
if ( (isset($_POST['mb_id']) && ! is_array($_POST['mb_id'])) || (isset($_POST['au_menu']) && ! is_array($_POST['au_menu'])) ){
alert("잘못된 요청입니다.");
}
for ($i=0; $i<$count; $i++)
{
// 실제 번호를 넘김
$k = $chk[$i];
$mb_id = preg_replace('/[^a-zA-Z0-9_]/', '', $_POST['mb_id'][$k]);
$au_menu = preg_replace('/[^a-zA-Z0-9_]/', '', $_POST['au_menu'][$k]);
$sql = " delete from {$g5['auth_table']} where mb_id = '{$_POST['mb_id'][$k]}' and au_menu = '{$_POST['au_menu'][$k]}' ";
$sql = " delete from {$g5['auth_table']} where mb_id = '".$mb_id."' and au_menu = '".$au_menu."' ";
sql_query($sql);
}

4
adm/board_form.php
View File

@ -233,7 +233,7 @@ $frm_submit .= '</div>';
<tr>
<th scope="row"><label for="bo_category_list">분류</label></th>
<td>
<?php echo help('분류와 분류 사이는 | 로 구분하세요. (예: 질문|답변) 첫자로 #은 입력하지 마세요. (예: #질문|#답변 [X])') ?>
<?php echo help('분류와 분류 사이는 | 로 구분하세요. (예: 질문|답변) 첫자로 #은 입력하지 마세요. (예: #질문|#답변 [X])'."\n".'분류명에 일부 특수문자 ()/ 는 사용할수 없습니다.'); ?>
<input type="text" name="bo_category_list" value="<?php echo get_text($board['bo_category_list']) ?>" id="bo_category_list" class="frm_input" size="70">
<input type="checkbox" name="bo_use_category" value="1" id="bo_use_category" <?php echo $board['bo_use_category']?'checked':''; ?>>
<label for="bo_use_category">사용</label>
@ -815,6 +815,7 @@ $frm_submit .= '</div>';
<label for="chk_all_mobile_skin">전체적용</label>
</td>
</tr>
<?php if ($is_admin === 'super'){ // 슈퍼관리자인 경우에만 수정 가능 ?>
<tr>
<th scope="row"><label for="bo_include_head">상단 파일 경로</label></th>
<td>
@ -887,6 +888,7 @@ $frm_submit .= '</div>';
<label for="chk_all_mobile_content_tail">전체적용</label>
</td>
</tr>
<?php } //end if $is_admin === 'super' ?>
<tr>
<th scope="row"><label for="bo_insert_content">글쓰기 기본 내용</label></th>
<td>

65
adm/board_form_update.php
View File

@ -18,29 +18,29 @@ $_POST['bo_include_head'] = preg_replace("#[\\\]+$#", "", substr($_POST['bo_incl
$_POST['bo_include_tail'] = preg_replace("#[\\\]+$#", "", substr($_POST['bo_include_tail'], 0, 255));
if ($file = $_POST['bo_include_head']) {
$purl = parse_url($file);
$file = $purl['path'];
if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
$file_ext = pathinfo($file, PATHINFO_EXTENSION);
if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) ) {
alert('상단 파일 경로의 확장자는 php, html 만 허용합니다.');
}
$_POST['bo_include_head'] = $file;
}
if ($file = $_POST['bo_include_tail']) {
$purl = parse_url($file);
$file = $purl['path'];
if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
$file_ext = pathinfo($file, PATHINFO_EXTENSION);
if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) ) {
alert('하단 파일 경로의 확장자는 php, html 만 허용합니다.');
}
$_POST['bo_include_tail'] = $file;
}
if(!is_include_path_check($_POST['bo_include_head'], 1)) {
alert('/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.');
alert('상단 파일 경로에 포함시킬수 없는 문자열이 있습니다.');
}
if(!is_include_path_check($_POST['bo_include_tail'], 1)) {
alert('/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.');
alert('하단 파일 경로에 포함시킬수 없는 문자열이 있습니다.');
}
$board_path = G5_DATA_PATH.'/file/'.$bo_table;
@ -60,6 +60,8 @@ $f = @fopen($file, 'w');
$src_char = array('&', '=');
$dst_char = array('＆', '〓');
$bo_category_list = str_replace($src_char, $dst_char, $bo_category_list);
//https://github.com/gnuboard/gnuboard5/commit/f5f4925d4eb28ba1af728e1065fc2bdd9ce1da58 에 따른 조치
$str_bo_category_list = isset($_POST['bo_category_list']) ? preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $_POST['bo_category_list']) : '';
$sql_common = " gr_id = '{$_POST['gr_id']}',
bo_subject = '{$_POST['bo_subject']}',
@ -82,7 +84,7 @@ $sql_common = " gr_id = '{$_POST['gr_id']}',
bo_comment_point = '{$_POST['bo_comment_point']}',
bo_download_point = '{$_POST['bo_download_point']}',
bo_use_category = '{$_POST['bo_use_category']}',
bo_category_list = '{$_POST['bo_category_list']}',
bo_category_list = '{$str_bo_category_list}',
bo_use_sideview = '{$_POST['bo_use_sideview']}',
bo_use_file_content = '{$_POST['bo_use_file_content']}',
bo_use_secret = '{$_POST['bo_use_secret']}',
@ -109,13 +111,20 @@ $sql_common = " gr_id = '{$_POST['gr_id']}',
bo_image_width = '{$_POST['bo_image_width']}',
bo_skin = '{$_POST['bo_skin']}',
bo_mobile_skin = '{$_POST['bo_mobile_skin']}',
bo_include_head = '{$_POST['bo_include_head']}',
";
// 최고 관리자인 경우에만 수정가능
if ($is_admin === 'super'){
$sql_common .= " bo_include_head = '{$_POST['bo_include_head']}',
bo_include_tail = '{$_POST['bo_include_tail']}',
bo_content_head = '{$_POST['bo_content_head']}',
bo_content_tail = '{$_POST['bo_content_tail']}',
bo_mobile_content_head = '{$_POST['bo_mobile_content_head']}',
bo_mobile_content_tail = '{$_POST['bo_mobile_content_tail']}',
bo_insert_content = '{$_POST['bo_insert_content']}',
";
}
$sql_common .= " bo_insert_content = '{$_POST['bo_insert_content']}',
bo_gallery_cols = '{$_POST['bo_gallery_cols']}',
bo_gallery_width = '{$_POST['bo_gallery_width']}',
bo_gallery_height = '{$_POST['bo_gallery_height']}',
@ -299,12 +308,17 @@ if (is_checked('chk_grp_comment_min')) $grp_fields .= " , bo_comment_mi
if (is_checked('chk_grp_comment_max')) $grp_fields .= " , bo_comment_max = '{$bo_comment_max}' ";
if (is_checked('chk_grp_upload_count')) $grp_fields .= " , bo_upload_count = '{$bo_upload_count}' ";
if (is_checked('chk_grp_upload_size')) $grp_fields .= " , bo_upload_size = '{$bo_upload_size}' ";
if (is_checked('chk_grp_include_head')) $grp_fields .= " , bo_include_head = '{$bo_include_head}' ";
if (is_checked('chk_grp_include_tail')) $grp_fields .= " , bo_include_tail = '{$bo_include_tail}' ";
if (is_checked('chk_grp_content_head')) $grp_fields .= " , bo_content_head = '{$bo_content_head}' ";
if (is_checked('chk_grp_content_tail')) $grp_fields .= " , bo_content_tail = '{$bo_content_tail}' ";
if (is_checked('chk_grp_mobile_content_head')) $grp_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' ";
if (is_checked('chk_grp_mobile_content_tail')) $grp_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' ";
//최고관리자만 수정가능
if ($is_admin === 'super'){
if (is_checked('chk_grp_include_head')) $grp_fields .= " , bo_include_head = '{$bo_include_head}' ";
if (is_checked('chk_grp_include_tail')) $grp_fields .= " , bo_include_tail = '{$bo_include_tail}' ";
if (is_checked('chk_grp_content_head')) $grp_fields .= " , bo_content_head = '{$bo_content_head}' ";
if (is_checked('chk_grp_content_tail')) $grp_fields .= " , bo_content_tail = '{$bo_content_tail}' ";
if (is_checked('chk_grp_mobile_content_head')) $grp_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' ";
if (is_checked('chk_grp_mobile_content_tail')) $grp_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' ";
}
if (is_checked('chk_grp_insert_content')) $grp_fields .= " , bo_insert_content = '{$bo_insert_content}' ";
if (is_checked('chk_grp_use_search')) $grp_fields .= " , bo_use_search = '{$bo_use_search}' ";
if (is_checked('chk_grp_order')) $grp_fields .= " , bo_order = '{$bo_order}' ";
@ -382,12 +396,17 @@ if (is_checked('chk_all_comment_min')) $all_fields .= " , bo_comment_mi
if (is_checked('chk_all_comment_max')) $all_fields .= " , bo_comment_max = '{$bo_comment_max}' ";
if (is_checked('chk_all_upload_count')) $all_fields .= " , bo_upload_count = '{$bo_upload_count}' ";
if (is_checked('chk_all_upload_size')) $all_fields .= " , bo_upload_size = '{$bo_upload_size}' ";
if (is_checked('chk_all_include_head')) $all_fields .= " , bo_include_head = '{$bo_include_head}' ";
if (is_checked('chk_all_include_tail')) $all_fields .= " , bo_include_tail = '{$bo_include_tail}' ";
if (is_checked('chk_all_content_head')) $all_fields .= " , bo_content_head = '{$bo_content_head}' ";
if (is_checked('chk_all_content_tail')) $all_fields .= " , bo_content_tail = '{$bo_content_tail}' ";
if (is_checked('chk_all_mobile_content_head')) $all_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' ";
if (is_checked('chk_all_mobile_content_tail')) $all_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' ";
//최고관리자만 수정가능
if ($is_admin === 'super'){
if (is_checked('chk_all_include_head')) $all_fields .= " , bo_include_head = '{$bo_include_head}' ";
if (is_checked('chk_all_include_tail')) $all_fields .= " , bo_include_tail = '{$bo_include_tail}' ";
if (is_checked('chk_all_content_head')) $all_fields .= " , bo_content_head = '{$bo_content_head}' ";
if (is_checked('chk_all_content_tail')) $all_fields .= " , bo_content_tail = '{$bo_content_tail}' ";
if (is_checked('chk_all_mobile_content_head')) $all_fields .= " , bo_mobile_content_head = '{$bo_mobile_content_head}' ";
if (is_checked('chk_all_mobile_content_tail')) $all_fields .= " , bo_mobile_content_tail = '{$bo_mobile_content_tail}' ";
}
if (is_checked('chk_all_insert_content')) $all_fields .= " , bo_insert_content = '{$bo_insert_content}' ";
if (is_checked('chk_all_use_search')) $all_fields .= " , bo_use_search = '{$bo_use_search}' ";
if (is_checked('chk_all_order')) $all_fields .= " , bo_order = '{$bo_order}' ";

33
adm/board_list_update.php
View File

@ -8,6 +8,8 @@ if (!count($_POST['chk'])) {
alert($_POST['act_button']." 하실 항목을 하나 이상 체크하세요.");
}
check_admin_token();
if ($_POST['act_button'] == "선택수정") {
auth_check($auth[$sub_menu], 'w');
@ -19,7 +21,7 @@ if ($_POST['act_button'] == "선택수정") {
if ($is_admin != 'super') {
$sql = " select count(*) as cnt from {$g5['board_table']} a, {$g5['group_table']} b
where a.gr_id = '{$_POST['gr_id'][$k]}'
where a.gr_id = '".sql_real_escape_string($_POST['gr_id'][$k])."'
and a.gr_id = b.gr_id
and b.gr_admin = '{$member['mb_id']}' ";
$row = sql_fetch($sql);
@ -28,19 +30,20 @@ if ($_POST['act_button'] == "선택수정") {
}
$sql = " update {$g5['board_table']}
set gr_id = '{$_POST['gr_id'][$k]}',
bo_subject = '{$_POST['bo_subject'][$k]}',
bo_device = '{$_POST['bo_device'][$k]}',
bo_skin = '{$_POST['bo_skin'][$k]}',
bo_mobile_skin = '{$_POST['bo_mobile_skin'][$k]}',
bo_read_point = '{$_POST['bo_read_point'][$k]}',
bo_write_point = '{$_POST['bo_write_point'][$k]}',
bo_comment_point = '{$_POST['bo_comment_point'][$k]}',
bo_download_point = '{$_POST['bo_download_point'][$k]}',
bo_use_search = '{$_POST['bo_use_search'][$k]}',
bo_use_sns = '{$_POST['bo_use_sns'][$k]}',
bo_order = '{$_POST['bo_order'][$k]}'
where bo_table = '{$_POST['board_table'][$k]}' ";
set gr_id = '".sql_real_escape_string($_POST['gr_id'][$k])."',
bo_subject = '".sql_real_escape_string($_POST['bo_subject'][$k])."',
bo_device = '".sql_real_escape_string($_POST['bo_device'][$k])."',
bo_skin = '".sql_real_escape_string($_POST['bo_skin'][$k])."',
bo_mobile_skin = '".sql_real_escape_string($_POST['bo_mobile_skin'][$k])."',
bo_read_point = '".sql_real_escape_string($_POST['bo_read_point'][$k])."',
bo_write_point = '".sql_real_escape_string($_POST['bo_write_point'][$k])."',
bo_comment_point = '".sql_real_escape_string($_POST['bo_comment_point'][$k])."',
bo_download_point = '".sql_real_escape_string($_POST['bo_download_point'][$k])."',
bo_use_search = '".sql_real_escape_string($_POST['bo_use_search'][$k])."',
bo_use_sns = '".sql_real_escape_string($_POST['bo_use_sns'][$k])."',
bo_order = '".sql_real_escape_string($_POST['bo_order'][$k])."'
where bo_table = '".sql_real_escape_string($_POST['board_table'][$k])."' ";
sql_query($sql);
}
@ -51,8 +54,6 @@ if ($_POST['act_button'] == "선택수정") {
auth_check($auth[$sub_menu], 'd');
check_admin_token();
// _BOARD_DELETE_ 상수를 선언해야 board_delete.inc.php 가 정상 작동함
define('_BOARD_DELETE_', true);

2
adm/faqformupdate.php
View File

@ -5,7 +5,7 @@ include_once('./_common.php');
if ($w == "u" || $w == "d")
check_demo();
if ($W == 'd')
if ($w == 'd')
auth_check($auth[$sub_menu], "d");
else
auth_check($auth[$sub_menu], "w");

34
adm/poll_form_update.php
View File

@ -10,6 +10,40 @@ auth_check($auth[$sub_menu], 'w');
check_admin_token();
$check_keys = array(
'po_subject',
'po_poll1',
'po_poll2',
'po_poll3',
'po_poll4',
'po_poll5',
'po_poll6',
'po_poll7',
'po_poll8',
'po_poll9',
'po_cnt1',
'po_cnt2',
'po_cnt3',
'po_cnt4',
'po_cnt5',
'po_cnt6',
'po_cnt7',
'po_cnt8',
'po_cnt9',
'po_etc',
'po_level',
'po_point',
'po_id'
);
foreach( $_POST as $key=>$value ){
if( empty($value) ) continue;
if( in_array($key, $check_keys) ) {
$_POST[$key] = strip_tags($value);
}
}
if ($w == '')
{
$sql = " insert {$g5['poll_table']}

12
adm/qa_config_update.php
View File

@ -11,17 +11,17 @@ check_admin_token();
$error_msg = '';
if( $qa_include_head ){
$purl = parse_url($qa_include_head);
$file = $purl['path'];
if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
$file_ext = pathinfo($qa_include_head, PATHINFO_EXTENSION);
if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) ) {
alert('상단 파일 경로의 확장자는 php, html 만 허용합니다.');
}
}
if( $qa_include_tail ){
$purl = parse_url($qa_include_tail);
$file = $purl['path'];
if (!preg_match("/\.(php|htm['l']?)$/i", $file)) {
$file_ext = pathinfo($qa_include_tail, PATHINFO_EXTENSION);
if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) ) {
alert('하단 파일 경로의 확장자는 php, html 만 허용합니다.');
}
}

5
adm/sms_admin/emoticon_move.php
View File

@ -11,7 +11,8 @@ auth_check($auth[$sub_menu], "r");
$g5['title'] = '이모티콘그룹 이동';
include_once(G5_PATH.'/head.sub.php');
$fo_no_list = implode(',', $_POST['fo_no']);
$list = array(); //배열 변수 초기화
$fo_no_list = isset($_POST['fo_no']) ? implode(',', $_POST['fo_no']) : '';
$sql = " select * from {$g5['sms5_form_group_table']} order by fg_no ";
$result = sql_query($sql);
@ -27,7 +28,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
<form name="fboardmoveall" method="post" action="./emoticon_move_update.php" onsubmit="return fboardmoveall_submit(this);">
<input type="hidden" name="sw" value="<?php echo $sw ?>">
<input type="hidden" name="fo_no_list" value="<?php echo $fo_no_list ?>">
<input type="hidden" name="url" value="<?php echo $_SERVER['HTTP_REFERER'] ?>">
<input type="hidden" name="url" value="<?php echo clean_xss_tags(strip_tags($_SERVER['HTTP_REFERER'])); ?>">
<div class="tbl_head01 tbl_wrap">
<table>

15
adm/sms_admin/history_view.php
View File

@ -5,6 +5,9 @@ include_once("./_common.php");
$spage_size = 20;
$colspan = 10;
$st = isset($st) ? strip_tags($st) : '';
$ssv = isset($ssv) ? strip_tags($ssv) : '';
auth_check($auth[$sub_menu], "r");
$g5['title'] = "문자전송 상세내역";
@ -64,18 +67,18 @@ function all_send()
</script>
<form name="search_form" method="get" action="<?php echo $_SERVER['SCRIPT_NAME']?>" class="local_sch01 local_sch">
<input type="hidden" name="wr_no" value="<?php echo $wr_no?>">
<input type="hidden" name="wr_renum" value="<?php echo $wr_renum?>">
<input type="hidden" name="page" value="<?php echo $page?>">
<input type="hidden" name="st" value="<?php echo $st?>">
<input type="hidden" name="sv" value="<?php echo $sv?>">
<input type="hidden" name="wr_no" value="<?php echo get_sanitize_input($wr_no); ?>">
<input type="hidden" name="wr_renum" value="<?php echo get_sanitize_input($wr_renum); ?>">
<input type="hidden" name="page" value="<?php echo get_sanitize_input($page); ?>">
<input type="hidden" name="st" value="<?php echo get_sanitize_input($st); ?>">
<input type="hidden" name="sv" value="<?php echo get_sanitize_input($sv); ?>">
<label for="sst" class="sound_only">검색대상</label>
<select name="sst" id="sst">
<option value="hs_name" <?php echo get_selected('hs_name', $sst); ?>>이름</option>
<option value="hs_hp" <?php echo get_selected('hs_hp', $sst); ?>>휴대폰번호</option>
</select>
<label for="ssv" class="sound_only">검색어<strong class="sound_only"> 필수</strong></label>
<input type="text" name="ssv" value="<?php echo $ssv?>" id="ssv" class="frm_input">
<input type="text" name="ssv" value="<?php echo get_sanitize_input($ssv); ?>" id="ssv" class="frm_input">
<input type="submit" value="검색" class="btn_submit">
</form>

2
adm/sms_admin/num_book_move.php
View File

@ -33,7 +33,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++)
<input type="hidden" name="sw" value="<?php echo $sw ?>">
<input type="hidden" name="bk_no_list" value="<?php echo $bk_no_list ?>">
<input type="hidden" name="act" value="<?php echo $act ?>">
<input type="hidden" name="url" value="<?php echo $_SERVER['HTTP_REFERER'] ?>">
<input type="hidden" name="url" value="<?php echo clean_xss_tags(strip_tags($_SERVER['HTTP_REFERER'])); ?>">
<div class="tbl_head01 tbl_wrap">
<table>