From bf925a9672dde21b7b753f616c87bd18e9428bfe Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 28 Jan 2019 11:10:35 +0900
Subject: [PATCH] =?UTF-8?q?KVE-2019-0058=20=EB=8B=A4=EC=A4=91=20=EC=B7=A8?=
 =?UTF-8?q?=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/shop_admin/categorylistupdate.php | 59 ++++++++++++++++++---------
 1 file changed, 40 insertions(+), 19 deletions(-)

diff --git a/adm/shop_admin/categorylistupdate.php b/adm/shop_admin/categorylistupdate.php
index 3cb8149ad..52b746961 100644
--- a/adm/shop_admin/categorylistupdate.php
+++ b/adm/shop_admin/categorylistupdate.php
@@ -12,33 +12,54 @@ for ($i=0; $i<count($_POST['ca_id']); $i++)
 {
     if ($_POST['ca_mb_id'][$i])
     {
-        $sql = " select mb_id from {$g5['member_table']} where mb_id = '{$_POST['ca_mb_id'][$i]}' ";
+        $sql = " select mb_id from {$g5['member_table']} where mb_id = '".sql_real_escape_string($_POST['ca_mb_id'][$i])."' ";
         $row = sql_fetch($sql);
         if (!$row['mb_id'])
             alert("\'{$_POST['ca_mb_id'][$i]}\' 은(는) 존재하는 회원아이디가 아닙니다.", "./categorylist.php?$qstr");
     }
     
-    if( !empty($_POST['ca_skin'][$i]) && ! is_include_path_check($_POST['ca_skin'][$i]) ){
-        alert('오류 : 데이터폴더가 포함된 path 를 포함할수 없습니다.');
+    $check_files =  array();
+    
+    if( !empty($_POST['ca_skin'][$i]) ){
+        $check_files[] = $_POST['ca_skin'][$i];
+    }
+
+    if( !empty($_POST['ca_mobile_skin'][$i]) ){
+        $check_files[] = $_POST['ca_mobile_skin'][$i];
+    }
+
+    foreach( $check_files as $file ){
+        if( empty($file) ) continue;
+
+        if( ! is_include_path_check($file) ){
+            alert('오류 : 데이터폴더가 포함된 path 또는 잘못된 path 를 포함할수 없습니다.');
+        }
+
+        $file_ext = pathinfo($file, PATHINFO_EXTENSION);
+
+        if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) || ! preg_match('/^.*\.(php|htm|html)$/i', $file) ) {
+            alert('스킨 파일 경로의 확장자는 php, htm, html 만 허용합니다.');
+        }
     }
 
     $sql = " update {$g5['g5_shop_category_table']}
-                set ca_name             = '{$_POST['ca_name'][$i]}',
-                    ca_mb_id            = '{$_POST['ca_mb_id'][$i]}',
-                    ca_use              = '{$_POST['ca_use'][$i]}',
-                    ca_list_mod         = '{$_POST['ca_list_mod'][$i]}',
-                    ca_cert_use         = '{$_POST['ca_cert_use'][$i]}',
-                    ca_adult_use        = '{$_POST['ca_adult_use'][$i]}',
-                    ca_skin             = '{$_POST['ca_skin'][$i]}',
-                    ca_mobile_skin      = '{$_POST['ca_mobile_skin'][$i]}',
-                    ca_skin_dir         = '{$_POST['ca_skin_dir'][$i]}',
-                    ca_mobile_skin_dir  = '{$_POST['ca_mobile_skin_dir'][$i]}',
-                    ca_img_width        = '{$_POST['ca_img_width'][$i]}',
-                    ca_img_height       = '{$_POST['ca_img_height'][$i]}',
-                    ca_list_row         = '{$_POST['ca_list_row'][$i]}',
-                    ca_mobile_list_mod  = '{$_POST['ca_mobile_list_mod'][$i]}',
-                    ca_mobile_list_row  = '{$_POST['ca_mobile_list_row'][$i]}'
-              where ca_id = '{$_POST['ca_id'][$i]}' ";
+                set ca_name             = '".sql_real_escape_string($_POST['ca_name'][$i])."',
+                    ca_mb_id            = '".sql_real_escape_string($_POST['ca_mb_id'][$i])."',
+                    ca_use              = '".sql_real_escape_string($_POST['ca_use'][$i])."',
+                    ca_list_mod         = '".sql_real_escape_string($_POST['ca_list_mod'][$i])."',
+                    ca_cert_use         = '".sql_real_escape_string($_POST['ca_cert_use'][$i])."',
+                    ca_adult_use        = '".sql_real_escape_string($_POST['ca_adult_use'][$i])."',
+                    ca_skin             = '".sql_real_escape_string($_POST['ca_skin'][$i])."',
+                    ca_mobile_skin      = '".sql_real_escape_string($_POST['ca_mobile_skin'][$i])."',
+                    ca_skin_dir         = '".sql_real_escape_string($_POST['ca_skin_dir'][$i])."',
+                    ca_mobile_skin_dir  = '".sql_real_escape_string($_POST['ca_mobile_skin_dir'][$i])."',
+                    ca_img_width        = '".sql_real_escape_string($_POST['ca_img_width'][$i])."',
+                    ca_img_height       = '".sql_real_escape_string($_POST['ca_img_height'][$i])."',
+                    ca_list_row         = '".sql_real_escape_string($_POST['ca_list_row'][$i])."',
+                    ca_mobile_list_mod  = '".sql_real_escape_string($_POST['ca_mobile_list_mod'][$i])."',
+                    ca_mobile_list_row  = '".sql_real_escape_string($_POST['ca_mobile_list_row'][$i])."'
+              where ca_id = '".sql_real_escape_string($_POST['ca_id'][$i])."' ";
+
     sql_query($sql);
 
 }