firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

그누보드 open redirect 취약점 수정

Browse Source
This commit is contained in:
thisgun
2024-07-03 12:50:12 +09:00
parent 14ffe72574
commit c6b58bb16b
3 changed files with 1 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
bbs/login.php
View File

@ -8,7 +8,6 @@ if( function_exists('social_check_login_before') ){
$g5['title'] = '로그인'; $g5['title'] = '로그인';
include_once('./_head.sub.php'); include_once('./_head.sub.php');
$url = isset($_GET['url']) ? strip_tags($_GET['url']) : '';
$od_id = isset($_POST['od_id']) ? safe_replace_regex($_POST['od_id'], 'od_id') : ''; $od_id = isset($_POST['od_id']) ? safe_replace_regex($_POST['od_id'], 'od_id') : '';
// url 체크 // url 체크

2
bbs/member_confirm.php
View File

@ -4,8 +4,6 @@ include_once('./_common.php');
if ($is_guest) if ($is_guest)
alert('로그인 한 회원만 접근하실 수 있습니다.', G5_BBS_URL.'/login.php'); alert('로그인 한 회원만 접근하실 수 있습니다.', G5_BBS_URL.'/login.php');
$url = isset($_GET['url']) ? clean_xss_tags($_GET['url']) : '';
while (1) { while (1) {
$tmp = preg_replace('/&#[^;]+;/', '', $url); $tmp = preg_replace('/&#[^;]+;/', '', $url);
if ($tmp == $url) break; if ($tmp == $url) break;

2
common.php
View File

@ -505,7 +505,7 @@ if (isset($_REQUEST['bo_table']) && ! is_array($_REQUEST['bo_table'])) {
// URL ENCODING // URL ENCODING
if (isset($_REQUEST['url'])) { if (isset($_REQUEST['url'])) {
$url = strip_tags(trim($_REQUEST['url'])); $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\x80-\\xff]|i', '', trim($_REQUEST['url']));
$urlencode = urlencode($url); $urlencode = urlencode($url);
} else { } else {
$url = ''; $url = '';