firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

Merge branch 'g5'

Browse Source
This commit is contained in:
chicpro
2014-07-31 15:58:07 +09:00
parent 342f645d94 4d115fd895
commit c273d49adb
8 changed files with 23 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
adm/index.php
View File

@ -176,7 +176,7 @@ $colspan = 5;
$comment_link = "";
$row2 = sql_fetch(" select * from $tmp_write_table where wr_id = '{$row['wr_id']}' ");
$name = get_sideview($row2['mb_id'], cut_str($row2['wr_name'], $config['cf_cut_name']), $row2['wr_email'], $row2['wr_homepage']);
$name = get_sideview($row2['mb_id'], get_text(cut_str($row2['wr_name'], $config['cf_cut_name'])), $row2['wr_email'], $row2['wr_homepage']);
// 당일인 경우 시간으로 표시함
$datetime = substr($row2['wr_datetime'],0,10);
$datetime2 = $row2['wr_datetime'];
@ -193,7 +193,7 @@ $colspan = 5;
$row2 = sql_fetch(" select * from {$tmp_write_table} where wr_id = '{$row['wr_parent']}' ");
$row3 = sql_fetch(" select mb_id, wr_name, wr_email, wr_homepage, wr_datetime from {$tmp_write_table} where wr_id = '{$row['wr_id']}' ");
$name = get_sideview($row3['mb_id'], cut_str($row3['wr_name'], $config['cf_cut_name']), $row3['wr_email'], $row3['wr_homepage']);
$name = get_sideview($row3['mb_id'], get_text(cut_str($row3['wr_name'], $config['cf_cut_name'])), $row3['wr_email'], $row3['wr_homepage']);
// 당일인 경우 시간으로 표시함
$datetime = substr($row3['wr_datetime'],0,10);
$datetime2 = $row3['wr_datetime'];

1
bbs/poll_update.php
View File

@ -8,6 +8,7 @@ if (!$po['po_id'])
if ($member['mb_level'] < $po['po_level'])
alert_close('권한 '.$po['po_level'].' 이상 회원만 투표에 참여하실 수 있습니다.');
$gb_poll = preg_replace('/[^0-9]/', '', $gb_poll);
if(!$gb_poll)
alert_close('항목을 선택하세요.');

4
bbs/qawrite_update.php
View File

@ -28,6 +28,7 @@ if(isset($_POST['qa_email']) && $qa_email) {
$qa_subject = '';
if (isset($_POST['qa_subject'])) {
$qa_subject = substr(trim($_POST['qa_subject']),0,255);
$qa_subject = preg_replace("#[\\\]+$#", "", $qa_subject);
}
if ($qa_subject == '') {
$msg[] = '<strong>제목</strong>을 입력하세요.';
@ -36,6 +37,7 @@ if ($qa_subject == '') {
$qa_content = '';
if (isset($_POST['qa_content'])) {
$qa_content = substr(trim($_POST['qa_content']),0,65536);
$qa_content = preg_replace("#[\\\]+$#", "", $qa_content);
}
if ($qa_content == '') {
$msg[] = '<strong>내용</strong>을 입력하세요.';
@ -132,7 +134,7 @@ for ($i=1; $i<=count($_FILES['bf_file']['name']); $i++) {
$tmp_file = $_FILES['bf_file']['tmp_name'][$i];
$filesize = $_FILES['bf_file']['size'][$i];
$filename = $_FILES['bf_file']['name'][$i];
$filename = preg_replace('/(<|>|=)/', '', $filename);
$filename = get_safe_filename($filename);
// 서버에 설정된 값보다 큰파일을 업로드 한다면
if ($filename) {

2
bbs/register_form_update.php
View File

@ -56,6 +56,8 @@ $mb_10 = isset($_POST['mb_10']) ? trim($_POST['mb_10'])
if ($w == '' || $w == 'u') {
if ($msg = empty_mb_id($mb_id)) alert($msg, "", true, true); // alert($msg, $url, $error, $post);
if ($msg = valid_mb_id($mb_id)) alert($msg, "", true, true);
if ($msg = count_mb_id($mb_id)) alert($msg, "", true, true);
if ($w == '' && !$mb_password)
alert('비밀번호가 넘어오지 않았습니다.');

2
bbs/write.php
View File

@ -319,7 +319,7 @@ if ($w == '') {
}
$name = get_text(cut_str($write['wr_name'],20));
$email = $write['wr_email'];
$email = get_email_address($write['wr_email']);
$homepage = get_text($write['wr_homepage']);
for ($i=1; $i<=G5_LINK_COUNT; $i++) {

5
bbs/write_update.php
View File

@ -19,6 +19,7 @@ if ($wr_subject == '') {
$wr_content = '';
if (isset($_POST['wr_content'])) {
$wr_content = substr(trim($_POST['wr_content']),0,65536);
$wr_content = preg_replace("#[\\\]+$#", "", $wr_content);
}
if ($wr_content == '') {
$msg[] = '<strong>내용</strong>을 입력하세요.';
@ -211,7 +212,7 @@ for ($i=0; $i<count($_FILES['bf_file']['name']); $i++) {
$tmp_file = $_FILES['bf_file']['tmp_name'][$i];
$filesize = $_FILES['bf_file']['size'][$i];
$filename = $_FILES['bf_file']['name'][$i];
$filename = preg_replace('/(<|>|=)/', '', $filename);
$filename = get_safe_filename($filename);
// 서버에 설정된 값보다 큰파일을 업로드 한다면
if ($filename) {
@ -297,6 +298,7 @@ if ($w == '' || $w == 'r') {
if (!$wr_name)
alert('이름은 필히 입력하셔야 합니다.');
$wr_password = sql_password($wr_password);
$wr_email = get_email_address(trim($_POST['wr_email']));
}
if ($w == 'r') {
@ -417,6 +419,7 @@ if ($w == '' || $w == 'r') {
$mb_id = "";
// 비회원의 경우 이름이 누락되는 경우가 있음
//if (!trim($wr_name)) alert("이름은 필히 입력하셔야 합니다.");
$wr_email = get_email_address(trim($_POST['wr_email']));
}
$sql_password = $wr_password ? " , wr_password = '".sql_password($wr_password)."' " : "";

2
common.php
View File

@ -381,7 +381,7 @@ if ($_SESSION['ss_mb_id']) { // 로그인중이라면
$tmp_mb_id = substr(preg_replace("/[^a-zA-Z0-9_]*/", "", $tmp_mb_id), 0, 20);
// 최고관리자는 자동로그인 금지
if ($tmp_mb_id != $config['cf_admin']) {
if (strtolower($tmp_mb_id) != strtolower($config['cf_admin'])) {
$sql = " select mb_password, mb_intercept_date, mb_leave_date, mb_email_certify from {$g5['member_table']} where mb_id = '{$tmp_mb_id}' ";
$row = sql_fetch($sql);
$key = md5($_SERVER['SERVER_ADDR'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $row['mb_password']);

9
lib/common.lib.php
View File

@ -2703,4 +2703,13 @@ function get_email_address($email)
return $matches[0];
}
// 파일명에서 특수문자 제거
function get_safe_filename($name)
{
$pattern = '/["\'<>=#&!%\\\\(\)\*\+\?]/';
$name = preg_replace($pattern, '', $name);
return $name;
}
?>