From 02baf1589f3133a2a488fbd5538678e344c69e94 Mon Sep 17 00:00:00 2001
From: kkigomi <kkigomi@duck.com>
Date: Tue, 18 Jun 2024 09:45:34 +0900
Subject: [PATCH] =?UTF-8?q?fix:=20get=5Fmember=20=ED=95=A8=EC=88=98?=
 =?UTF-8?q?=EC=97=90=EC=84=9C=20hook=EC=97=90=20=EC=9E=98=EB=AA=BB?=
 =?UTF-8?q?=EB=90=9C=20=EC=95=84=EC=9D=B4=EB=94=94=EA=B0=80=20=EC=A0=84?=
 =?UTF-8?q?=EB=8B=AC=EB=90=A0=20=EC=88=98=20=EC=9E=88=EB=8A=94=20=EB=AC=B8?=
 =?UTF-8?q?=EC=A0=9C=20=EA=B3=A0=EC=B9=A8=20(#328)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: get_member 함수에서 hook에 잘못된 아이디가 전달될 수 있는 문제 고침

trim()이 mysql 쿼리에서만 처리되어 hook에 잘못된 회원아이디가 전달될 수 있는 문제.

* 잘못된 파라미터 타입 수정
---
 lib/common.lib.php | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/lib/common.lib.php b/lib/common.lib.php
index 236e90349..053486975 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -849,23 +849,33 @@ function get_group($gr_id, $is_cache=false)
 }
 
 
-// 회원 정보를 얻는다.
-function get_member($mb_id, $fields='*', $is_cache=false)
+/**
+ * 회원 정보를 얻는다
+ * 
+ * @param string $mb_id
+ * @param string $fields
+ * @param bool $is_cache
+ * 
+ * @return array
+ */
+function get_member($mb_id, $fields = '*', $is_cache = false)
 {
     global $g5;
-    
-    if (preg_match("/[^0-9a-z_]+/i", $mb_id))
+
+    $mb_id = trim($mb_id);
+    if (preg_match("/[^0-9a-z_]+/i", $mb_id)) {
         return array();
+    }
 
     static $cache = array();
 
     $key = md5($fields);
 
-    if( $is_cache && isset($cache[$mb_id]) && isset($cache[$mb_id][$key]) ){
+    if ($is_cache && isset($cache[$mb_id]) && isset($cache[$mb_id][$key])) {
         return $cache[$mb_id][$key];
     }
 
-    $sql = " select $fields from {$g5['member_table']} where mb_id = TRIM('$mb_id') ";
+    $sql = " SELECT {$fields} from {$g5['member_table']} where mb_id = '{$mb_id}' ";
 
     $cache[$mb_id][$key] = run_replace('get_member', sql_fetch($sql), $mb_id, $fields, $is_cache);