From c665cc05574f48c9af6300736d1865ae5afb4529 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 19 Mar 2018 10:24:24 +0900
Subject: [PATCH] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C=20?=
 =?UTF-8?q?=EA=B4=80=EB=A6=AC=EC=9E=90=20=ED=8E=98=EC=9D=B4=EC=A7=80=20SQL?=
 =?UTF-8?q?=20Injection=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/auth_list_delete.php | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/adm/auth_list_delete.php b/adm/auth_list_delete.php
index 46acecce6..0327c1889 100644
--- a/adm/auth_list_delete.php
+++ b/adm/auth_list_delete.php
@@ -9,17 +9,24 @@ if ($is_admin != 'super')
 
 check_admin_token();
 
-$count = count($_POST['chk']);
+$count = (isset($_POST['chk']) && is_array($_POST['chk'])) ? count($_POST['chk']) : 0;
 
 if (!$count)
     alert($_POST['act_button']." 하실 항목을 하나 이상 체크하세요.");
 
+if ( (isset($_POST['mb_id']) && ! is_array($_POST['mb_id'])) || (isset($_POST['au_menu']) && ! is_array($_POST['au_menu'])) ){
+    alert("잘못된 요청입니다.");
+}
+
 for ($i=0; $i<$count; $i++)
 {
     // 실제 번호를 넘김
     $k = $chk[$i];
+    
+    $mb_id = preg_replace('/[^a-zA-Z0-9_]/', '', $_POST['mb_id'][$k]);
+    $au_menu = preg_replace('/[^a-zA-Z0-9_]/', '', $_POST['au_menu'][$k]);
 
-    $sql = " delete from {$g5['auth_table']} where mb_id = '{$_POST['mb_id'][$k]}' and au_menu = '{$_POST['au_menu'][$k]}' ";
+    $sql = " delete from {$g5['auth_table']} where mb_id = '".$mb_id."' and au_menu = '".$au_menu."' ";
     sql_query($sql);
 }