Stored XSS 취약점 수정 (17-557)

2017-08-14 17:23:23 +09:00
parent cd8a9078d5
commit d9789a636e
1 changed files with 4 additions and 1 deletions
--- a/bbs/qawrite.php
+++ b/bbs/qawrite.php
@ -76,7 +76,10 @@ if(is_file($skin_file)) {

        $content .= get_text($write['qa_content'], 0);
    } else {
-        $content = get_text($write['qa_content'], 0);
+        //$content = get_text($write['qa_content'], 0);
+        
+        // KISA 취약점 권고사항 Stored XSS
+        $content = get_text(html_purifier($write['qa_content']), 0);
    }

    $editor_html = editor_html('qa_content', $content, $is_dhtml_editor);