diff --git a/adm/board_list.php b/adm/board_list.php index 57c425879..f3145f9fb 100644 --- a/adm/board_list.php +++ b/adm/board_list.php @@ -4,8 +4,6 @@ include_once('./_common.php'); auth_check($auth[$sub_menu], 'r'); -$token = get_token(); - // DHTML 에디터 사용 필드 추가 : 061021 sql_query(" ALTER TABLE `{$g4['board_table']}` ADD `bo_use_dhtml_editor` TINYINT NOT NULL AFTER `bo_use_secret` ", false); // RSS 보이기 사용 필드 추가 : 061106 @@ -19,7 +17,7 @@ if ($is_admin != "super") { $sql_search .= " and (a.gr_id = b.gr_id and b.gr_admin = '{$member['mb_id']}') "; } -if (isset($stx)) { +if ($stx) { $sql_search .= " and ( "; switch ($sfl) { case "bo_table" : @@ -155,7 +153,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) { - + diff --git a/adm/board_list_update.php b/adm/board_list_update.php index 58ba00830..64dab2d7b 100644 --- a/adm/board_list_update.php +++ b/adm/board_list_update.php @@ -6,15 +6,12 @@ check_demo(); auth_check($auth[$sub_menu], 'w'); -check_token(); +for ($i=0; $i>>>>>> 2b5c471bdb62542fc9cb8b6740a934c34e5de04b $open_checked = ''; $open_no_checked = 'checked="checked"'; } @@ -264,7 +249,7 @@ include_once('./admin.head.php');
XSS 혹은 CSRF 방지 -

관리자 권한을 탈취당하는 경우를 대비하여 패스워드를 다시 한번 확인합니다.

+

관리자 권한을 탈취 당하는 경우를 대비하여 관리자의 패스워드를 다시 한번 확인합니다.

diff --git a/adm/member_list.php b/adm/member_list.php index a6cbd89df..39d697311 100644 --- a/adm/member_list.php +++ b/adm/member_list.php @@ -9,7 +9,7 @@ $token = get_token(); $sql_common = " from {$g4['member_table']} "; $sql_search = " where (1) "; -if (isset($stx)) { +if ($stx) { $sql_search .= " and ( "; switch ($sfl) { case 'mb_point' : @@ -32,7 +32,7 @@ if (isset($stx)) { if ($is_admin != 'super') $sql_search .= " and mb_level <= '{$member['mb_level']}' "; -if (!isset($sst)) { +if (!$sst) { $sst = "mb_datetime"; $sod = "desc"; } @@ -48,7 +48,7 @@ $total_count = $row['cnt']; $rows = $config['cf_page_rows']; $total_page = ceil($total_count / $rows); // 전체 페이지 계산 -if (!isset($page)) $page = 1; // 페이지가 없으면 첫 페이지 (1 페이지) +if (!$page) $page = 1; // 페이지가 없으면 첫 페이지 (1 페이지) $from_record = ($page - 1) * $rows; // 시작 열을 구함 // 탈퇴회원수 diff --git a/adm/point_list.php b/adm/point_list.php index fe1697362..5981f8f0f 100644 --- a/adm/point_list.php +++ b/adm/point_list.php @@ -9,7 +9,7 @@ $token = get_token(); $sql_common = " from {$g4['point_table']} "; $sql_search = " where (1) "; -if (isset($stx)) { +if ($stx) { $sql_search .= " and ( "; switch ($sfl) { case 'mb_id' : @@ -84,15 +84,9 @@ function point_clear() 전체 >>>>>> 35e2a0e57216e9ff77b98266f30f5e8f87800654 $row2 = sql_fetch(" select sum(po_point) as sum_point from {$g4['point_table']} "); echo ' (전체 합계 '.number_format($row2['sum_point']).'점)'; } @@ -179,11 +173,7 @@ if ($i == 0) >>>>>> 35e2a0e57216e9ff77b98266f30f5e8f87800654 ?>
diff --git a/adm/poll_list.php b/adm/poll_list.php index e69c397dc..098002bdd 100644 --- a/adm/poll_list.php +++ b/adm/poll_list.php @@ -9,7 +9,7 @@ $token = get_token(); $sql_common = " from {$g4['poll_table']} "; $sql_search = " where (1) "; -if (isset($stx)) { +if ($stx) { $sql_search .= " and ( "; switch ($sfl) { default : @@ -44,6 +44,7 @@ $sql = " select * limit {$from_record}, {$rows} "; $result = sql_query($sql); +$listall = ''; if ($sfl || $stx) // 검색렬일 때만 처음 버튼을 보여줌 $listall = '전체목록'; @@ -115,8 +116,9 @@ if ($i==0) +$pagelist = get_paging($config['cf_write_pages'], $page, $total_page, "{$_SERVER['PHP_SELF']}?$qstr&page="); +if ($pagelist) { +?>
diff --git a/adm/visit_list.php b/adm/visit_list.php index 02c57849c..288e3d8aa 100644 --- a/adm/visit_list.php +++ b/adm/visit_list.php @@ -10,9 +10,6 @@ include_once('./visit.sub.php'); $colspan = 5; -//unset($br); // 브라우저 -//unset($os); // OS - $sql_common = " from {$g4['visit_table']} "; $sql_search = " where vi_date between '{$fr_date}' and '{$to_date}' "; if (isset($domain)) @@ -105,14 +102,10 @@ if ($i == 0) >>>>>> 2b5c471bdb62542fc9cb8b6740a934c34e5de04b if ($page) { ?>
diff --git a/common.php b/common.php index ac7bc378f..8f1f8e708 100644 --- a/common.php +++ b/common.php @@ -491,8 +491,9 @@ if (isset($bo_table)) { } } -if (isset($gr_id)) +if (!empty($_GET['gr_id'])) { $group = sql_fetch(" select * from {$g4['group_table']} where gr_id = '$gr_id' "); +} if ($is_admin != 'super') { // 접근가능 IP diff --git a/lib/common.lib.php b/lib/common.lib.php index 3551bfc7c..f4dc05874 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -1567,4 +1567,11 @@ function escape_trim($field) { return mysql_real_escape_string(htmlentities(trim($field))); } + + +// $_POST 형식에서 checkbox 엘리먼트의 checked 속성에서 checked 가 되어 넘어 왔는지를 검사 +function is_checked($field) +{ + return !empty($_POST[$field]); +} ?> \ No newline at end of file