firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

[KVE-2020-0797] 영카트 SQL 인젝션 취약점 추가 수정

Browse Source
This commit is contained in:
thisgun
2020-11-24 12:24:37 +09:00
parent bfcf64a1b1
commit d16537c2f1
6 changed files with 23 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
mobile/shop/search.php
View File

@ -130,6 +130,13 @@ while($row = sql_fetch_array($result)){
$search_skin = G5_MSHOP_SKIN_PATH.'/search.skin.php';
$list_file = G5_MSHOP_SKIN_PATH.'/'.$default['de_mobile_search_list_skin'];
if (file_exists($list_file) && is_include_path_check($list_file)) {
define('G5_SHOP_CSS_URL', G5_MSHOP_SKIN_URL);
$list = new item_list($list_file, $default['de_mobile_search_list_mod'], $default['de_mobile_search_list_row'], $default['de_mobile_search_img_width'], $default['de_mobile_search_img_height']);
$list->set_query(" select * $sql_common $sql_where {$order_by} limit $from_record, $items ");
}
if(!file_exists($search_skin)) {
echo str_replace(G5_PATH.'/', '', $search_skin).' 스킨 파일이 존재하지 않습니다.';
} else {

6
mobile/skin/shop/basic/search.skin.php
View File

@ -69,11 +69,7 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
<div>
<?php
// 리스트 유형별로 출력
define('G5_SHOP_CSS_URL', G5_MSHOP_SKIN_URL);
$list_file = G5_MSHOP_SKIN_PATH.'/'.$default['de_mobile_search_list_skin'];
if (file_exists($list_file)) {
$list = new item_list($list_file, $default['de_mobile_search_list_mod'], $default['de_mobile_search_list_row'], $default['de_mobile_search_img_width'], $default['de_mobile_search_img_height']);
$list->set_query(" select * $sql_common $sql_where {$order_by} limit $from_record, $items ");
if (isset($list) && is_object($list) && method_exists($list, 'run')) {
$list->set_is_page(true);
$list->set_mobile(true);
$list->set_view('it_img', true);

7
shop/search.php
View File

@ -138,6 +138,13 @@ while($row = sql_fetch_array($result)){
$q = get_text($q);
$search_skin = G5_SHOP_SKIN_PATH.'/search.skin.php';
$list_file = G5_SHOP_SKIN_PATH.'/'.$default['de_search_list_skin'];
if (file_exists($list_file) && is_include_path_check($list_file)) {
define('G5_SHOP_CSS_URL', G5_SHOP_SKIN_URL);
$list = new item_list($list_file, $default['de_search_list_mod'], $default['de_search_list_row'], $default['de_search_img_width'], $default['de_search_img_height']);
$list->set_query(" select * $sql_common $sql_where {$order_by} limit $from_record, $items ");
}
if(!file_exists($search_skin)) {
echo str_replace(G5_PATH.'/', '', $search_skin).' 스킨 파일이 존재하지 않습니다.';
} else {

13
skin/shop/basic/search.skin.php
View File

@ -42,11 +42,10 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
<div id="ssch_cate">
<ul>
<?php
$sql = " select b.ca_id, b.ca_name, count(*) as cnt $sql_common $sql_where group by b.ca_id order by b.ca_id ";
$result = sql_query($sql);
$total_cnt = 0;
$total_cnt = 0;
echo '<li><a href="#" onclick="set_ca_id(\'\'); return false;">전체분류 <span>('.$total_cnt.')</span></a></li>'.PHP_EOL;
for ($i=0; $row=sql_fetch_array($result); $i++) {
foreach((array) $categorys as $row){
if( empty($row) ) continue;
echo "<li><a href=\"#\" onclick=\"set_ca_id('{$row['ca_id']}'); return false;\">{$row['ca_name']} (".$row['cnt'].")</a></li>\n";
$total_cnt += $row['cnt'];
}
@ -69,11 +68,7 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
<div>
<?php
// 리스트 유형별로 출력
$list_file = G5_SHOP_SKIN_PATH.'/'.$default['de_search_list_skin'];
if (file_exists($list_file)) {
define('G5_SHOP_CSS_URL', G5_SHOP_SKIN_URL);
$list = new item_list($list_file, $default['de_search_list_mod'], $default['de_search_list_row'], $default['de_search_img_width'], $default['de_search_img_height']);
$list->set_query(" select * $sql_common $sql_where {$order_by} limit $from_record, $items ");
if (isset($list) && is_object($list) && method_exists($list, 'run')) {
$list->set_is_page(true);
$list->set_view('it_img', true);
$list->set_view('it_name', true);

6
theme/basic/mobile/skin/shop/basic/search.skin.php
View File

@ -69,11 +69,7 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
<div>
<?php
// 리스트 유형별로 출력
define('G5_SHOP_CSS_URL', G5_MSHOP_SKIN_URL);
$list_file = G5_MSHOP_SKIN_PATH.'/'.$default['de_mobile_search_list_skin'];
if (file_exists($list_file)) {
$list = new item_list($list_file, $default['de_mobile_search_list_mod'], $default['de_mobile_search_list_row'], $default['de_mobile_search_img_width'], $default['de_mobile_search_img_height']);
$list->set_query(" select * $sql_common $sql_where {$order_by} limit $from_record, $items ");
if (isset($list) && is_object($list) && method_exists($list, 'run')) {
$list->set_is_page(true);
$list->set_mobile(true);
$list->set_view('it_img', true);

11
theme/basic/skin/shop/basic/search.skin.php
View File

@ -42,11 +42,10 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
<div id="ssch_cate">
<ul>
<?php
$sql = " select b.ca_id, b.ca_name, count(*) as cnt $sql_common $sql_where group by b.ca_id order by b.ca_id ";
$result = sql_query($sql);
$total_cnt = 0;
echo '<li><a href="#" onclick="set_ca_id(\'\'); return false;">전체분류 <span>('.$total_cnt.')</span></a></li>'.PHP_EOL;
for ($i=0; $row=sql_fetch_array($result); $i++) {
foreach((array) $categorys as $row){
if( empty($row) ) continue;
echo "<li><a href=\"#\" onclick=\"set_ca_id('{$row['ca_id']}'); return false;\">{$row['ca_name']} (".$row['cnt'].")</a></li>\n";
$total_cnt += $row['cnt'];
}
@ -69,11 +68,7 @@ if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
<div>
<?php
// 리스트 유형별로 출력
$list_file = G5_SHOP_SKIN_PATH.'/'.$default['de_search_list_skin'];
if (file_exists($list_file)) {
define('G5_SHOP_CSS_URL', G5_SHOP_SKIN_URL);
$list = new item_list($list_file, $default['de_search_list_mod'], $default['de_search_list_row'], $default['de_search_img_width'], $default['de_search_img_height']);
$list->set_query(" select * $sql_common $sql_where {$order_by} limit $from_record, $items ");
if (isset($list) && is_object($list) && method_exists($list, 'run')) {
$list->set_is_page(true);
$list->set_view('it_img', true);
$list->set_view('it_name', true);