From 7ae8f47d55a6ad2d4a56f8b3f3bd49b46e9b5153 Mon Sep 17 00:00:00 2001 From: chicpro Date: Tue, 15 Jan 2013 18:08:58 +0900 Subject: [PATCH 01/12] =?UTF-8?q?=EB=94=B0=EC=98=B4=ED=91=9C=20=EC=88=98?= =?UTF-8?q?=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/move_update.php | 140 ++++++++++++++++++++++---------------------- 1 file changed, 70 insertions(+), 70 deletions(-) diff --git a/bbs/move_update.php b/bbs/move_update.php index 6d7e5cee0..0977a299b 100644 --- a/bbs/move_update.php +++ b/bbs/move_update.php @@ -21,11 +21,11 @@ $cnt = 0; // SQL Injection 으로 인한 코드 보완 //$sql = " select distinct wr_num from {$write_table} where wr_id in (" . stripslashes($wr_id_list) . ") order by wr_id "; -$sql = " select distinct wr_num from {$write_table} where wr_id in ({$wr_id_list}) order by wr_id "; +$sql = " select distinct wr_num from $write_table where wr_id in ({$wr_id_list}) order by wr_id "; $result = sql_query($sql); while ($row = sql_fetch_array($result)) { - $wr_num = $row[wr_num]; + $wr_num = $row['wr_num']; for ($i=0; $i Date: Tue, 15 Jan 2013 18:19:23 +0900 Subject: [PATCH 02/12] =?UTF-8?q?=EB=94=B0=EC=98=B4=ED=91=9C=20=EC=97=90?= =?UTF-8?q?=EB=9F=AC=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/move_update.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bbs/move_update.php b/bbs/move_update.php index 0977a299b..37885bfd5 100644 --- a/bbs/move_update.php +++ b/bbs/move_update.php @@ -100,7 +100,7 @@ while ($row = sql_fetch_array($result)) { // 원본파일을 복사하고 퍼미션을 변경 @copy($src_dir.'/'.$row3['bf_file'], $dst_dir.'/'.$row3['bf_file']); - @chmod($dst_dir/$row3['bf_file]', 0606); + @chmod($dst_dir/$row3['bf_file'], 0606); } $sql = " insert into {$g4['board_file_table']} From 41f59fa9ae589fc22660fde7d19293f195aede31 Mon Sep 17 00:00:00 2001 From: chicpro Date: Tue, 15 Jan 2013 18:37:23 +0900 Subject: [PATCH 03/12] =?UTF-8?q?=EC=9D=B4=EB=8F=99=20=EB=B3=B5=EC=82=AC?= =?UTF-8?q?=20=EC=97=90=EB=9F=AC=20=EB=95=8C=20=EC=82=AC=EC=9A=A9=ED=95=A0?= =?UTF-8?q?=20url=20=EB=B3=80=EC=88=98=20=EC=B6=94=EA=B0=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/move.php | 1 + bbs/move_update.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/bbs/move.php b/bbs/move.php index 74a419ddb..49c951682 100644 --- a/bbs/move.php +++ b/bbs/move.php @@ -54,6 +54,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) + diff --git a/bbs/move_update.php b/bbs/move_update.php index 37885bfd5..59549d444 100644 --- a/bbs/move_update.php +++ b/bbs/move_update.php @@ -9,7 +9,7 @@ if ($sw != 'move' && $sw != 'copy') alert('sw 값이 제대로 넘어오지 않았습니다.'); if(!count($_POST['chk_bo_table'])) - alert("게시물을 ".$act."할 게시판을 한개 이상 선택해 주십시오."); + alert("게시물을 ".$act."할 게시판을 한개 이상 선택해 주십시오.", $url); // 원본 파일 디렉토리 $src_dir = $g4['path'].'/data/file/'.$bo_table; From 238941e04175f691eefbeda7afb831d791032d3a Mon Sep 17 00:00:00 2001 From: gnuboard Date: Tue, 15 Jan 2013 18:58:07 +0900 Subject: [PATCH 04/12] =?UTF-8?q?=EC=84=BC=EC=8A=A4=EB=A6=AC=EB=8D=94=20?= =?UTF-8?q?=EC=98=A4=EB=A5=98=3F=20=ED=95=B4=EA=B2=B0=EC=9D=84=20=EC=9C=84?= =?UTF-8?q?=ED=95=98=EC=97=AC=20=EC=BA=A1=EC=B1=A0=20wav=20=ED=8C=8C?= =?UTF-8?q?=EC=9D=BC=EC=97=90=20=EB=8B=A4=EC=9A=B4=EB=A1=9C=EB=93=9C=20?= =?UTF-8?q?=EC=A0=9C=EA=B3=B5,=20=EA=B7=B8=EB=9F=AC=EB=82=98=20=EA=B2=B0?= =?UTF-8?q?=EA=B3=BC=EB=8A=94=20=EC=A2=8B=EC=A7=80=20=EC=95=8A=EC=9D=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/gcaptcha/down.php | 35 +++++++++++++++++++++++++++++++++++ bbs/gcaptcha/gcaptcha.lib.php | 1 + 2 files changed, 36 insertions(+) create mode 100644 bbs/gcaptcha/down.php diff --git a/bbs/gcaptcha/down.php b/bbs/gcaptcha/down.php new file mode 100644 index 000000000..4e02ae120 --- /dev/null +++ b/bbs/gcaptcha/down.php @@ -0,0 +1,35 @@ + diff --git a/bbs/gcaptcha/gcaptcha.lib.php b/bbs/gcaptcha/gcaptcha.lib.php index 90e12a582..d24275b2b 100644 --- a/bbs/gcaptcha/gcaptcha.lib.php +++ b/bbs/gcaptcha/gcaptcha.lib.php @@ -151,6 +151,7 @@ function captcha_html($class="captcha") $html .= '스팸방지'; $html .= '스팸방지 숫자'; $html .= '숫자를 음성으로 듣기'; + $html .= '다운로드'; $html .= ''; $html .= '

스팸방지 숫자를 순서대로 입력하세요.

'; $html .= ''; From c55de7445f77959790fc61ea9bc7c4ca4a13b50e Mon Sep 17 00:00:00 2001 From: gnuboard Date: Tue, 15 Jan 2013 18:58:29 +0900 Subject: [PATCH 05/12] =?UTF-8?q?noscript=20=EB=A9=94=EC=84=B8=EC=A7=80=20?= =?UTF-8?q?=EC=B6=94=EA=B0=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/admin.tail.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/adm/admin.tail.php b/adm/admin.tail.php index fc620d6e9..e30b0949f 100644 --- a/adm/admin.tail.php +++ b/adm/admin.tail.php @@ -2,6 +2,12 @@ if (!defined("_GNUBOARD_")) exit; ?> +
From a9b15ff30b4e55baee9d93364b1e44e0b32b35e9 Mon Sep 17 00:00:00 2001 From: gnuboard Date: Tue, 15 Jan 2013 18:59:37 +0900 Subject: [PATCH 06/12] =?UTF-8?q?=20'=20=EB=A5=BC=20"=20=EB=A1=9C=20?= =?UTF-8?q?=EB=B3=80=EA=B2=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- js/wrest.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/js/wrest.js b/js/wrest.js index c909a6932..8909e2182 100644 --- a/js/wrest.js +++ b/js/wrest.js @@ -260,7 +260,7 @@ function wrestSubmit() wrestRequired(el); } - var array_css = el.className.split(' '); // class 를 공백으로 나눔 + var array_css = el.className.split(" "); // class 를 공백으로 나눔 el.style.backgroundColor = wrestFldDefaultColor; @@ -348,4 +348,4 @@ function wrestInitialized() $(document).ready(function(){ // onload wrestInitialized(); -}); \ No newline at end of file +}); From 28bb520652d0b52541edcc0d742108a5b180dada Mon Sep 17 00:00:00 2001 From: gnuboard Date: Tue, 15 Jan 2013 19:00:20 +0900 Subject: [PATCH 07/12] =?UTF-8?q?option=5Fselected=20=ED=95=A8=EC=88=98?= =?UTF-8?q?=EB=AA=85=20=EC=B6=A9=EB=8F=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lib/common.lib.php | 50 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 39 insertions(+), 11 deletions(-) diff --git a/lib/common.lib.php b/lib/common.lib.php index af32393c9..518091671 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -778,28 +778,48 @@ function get_group_select($name, $selected='', $event='') $sql .= " order by a.gr_id "; $result = sql_query($sql); - $str = ""; return $str; } +// 스킨디렉토리를 SELECT 형식으로 얻음 +function get_skin_select($skin_gubun, $id, $name, $selected='', $event='') +{ + $skins = get_skin_dir($skin_gubun); + $str = ""; + $str = ""; return $str; @@ -1598,4 +1618,12 @@ function abs_ip2long($ip='') $ip = $ip ? $ip : $_SERVER['REMOTE_ADDR']; return abs(ip2long($ip)); } + + +/* +function option_selected($field, $value) +{ + return ($field==$value) ? ' selected="selected"' : ''; +} +*/ ?> \ No newline at end of file From fa7b92f6d4721bf8fc3687a0dfbbad1f37cfaa1b Mon Sep 17 00:00:00 2001 From: gnuboard Date: Tue, 15 Jan 2013 19:00:44 +0900 Subject: [PATCH 08/12] =?UTF-8?q?=EA=B2=8C=EC=8B=9C=ED=8C=90=20=EB=B3=B5?= =?UTF-8?q?=EC=82=AC=EC=97=90=20=EC=BA=A1=EC=B1=A0=20=EB=84=A3=EA=B8=B0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/board_copy.php | 13 ++++++++----- adm/board_copy_update.php | 13 +++++++++---- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/adm/board_copy.php b/adm/board_copy.php index f251bf291..315df7bd5 100644 --- a/adm/board_copy.php +++ b/adm/board_copy.php @@ -1,5 +1,6 @@ -
+ -
할 게시판을 한개 이상 선택하여 주십시오.
@@ -23,11 +23,11 @@ include_once($g4['path'].'/head.sub.php'); - + - + @@ -41,6 +41,8 @@ include_once($g4['path'].'/head.sub.php');
기존 게시판을 새 게시판으로 복사
영문자, 숫자, _ 만 가능 (공백없이) 영문자, 숫자, _ 만 가능 (공백없이)
복사 유형
+ +
@@ -51,7 +53,8 @@ include_once($g4['path'].'/head.sub.php'); diff --git a/adm/board_copy_update.php b/adm/board_copy_update.php index 73c6c2130..e25cda384 100644 --- a/adm/board_copy_update.php +++ b/adm/board_copy_update.php @@ -1,11 +1,16 @@ Date: Tue, 15 Jan 2013 19:01:47 +0900 Subject: [PATCH 09/12] =?UTF-8?q?select=20tag=20=EC=BD=94=EB=93=9C=20?= =?UTF-8?q?=EC=B5=9C=EC=A0=81=ED=99=94?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/admin.lib.php | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/adm/admin.lib.php b/adm/admin.lib.php index fd9c2d007..ca320d736 100644 --- a/adm/admin.lib.php +++ b/adm/admin.lib.php @@ -10,7 +10,7 @@ if (!get_session('ss_admin')) { */ // 스킨경로를 얻는다 -function get_skin_dir($skin, $len="") +function get_skin_dir($skin) { global $g4; @@ -18,8 +18,7 @@ function get_skin_dir($skin, $len="") $dirname = $g4['path'].'/skin/'.$skin.'/'; $handle = opendir($dirname); - while ($file = readdir($handle)) - { + while ($file = readdir($handle)) { if($file == '.'||$file == '..') continue; if (is_dir($dirname.$file)) $result_array[] = $file; @@ -114,15 +113,16 @@ function get_member_level_select($name, $start_id=0, $end_id=10, $selected="", $ { global $g4; - $str = ''; + $str .= ' selected="selected"'; + $str .= ">{$i}\n"; } - $str .= ''; + $str .= "\n"; return $str; } From 5d8d481731e27740f278bb773c86d3a85c034544 Mon Sep 17 00:00:00 2001 From: gnuboard Date: Tue, 15 Jan 2013 19:02:25 +0900 Subject: [PATCH 10/12] =?UTF-8?q?=EC=BA=A1=EC=B1=A0=20=EC=A0=81=EC=9A=A9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbs/memo_form.php | 1 + skin/member/neo/memo_form.skin.php | 7 +------ 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/bbs/memo_form.php b/bbs/memo_form.php index 12039f116..04a5be790 100644 --- a/bbs/memo_form.php +++ b/bbs/memo_form.php @@ -1,4 +1,5 @@ -
- 자동등록방지 - - - 왼쪽의 글자를 입력하세요. -
+
From 7a574f50777599361fbcc007e781bc2536a02e55 Mon Sep 17 00:00:00 2001 From: gnuboard Date: Tue, 15 Jan 2013 19:02:38 +0900 Subject: [PATCH 11/12] =?UTF-8?q?=EA=B2=B8=EC=86=90=ED=95=9C=20=EC=9E=90?= =?UTF-8?q?=EB=B0=94=EC=8A=A4=ED=81=AC=EB=A6=BD=ED=8A=B8=20=EC=A0=81?= =?UTF-8?q?=EC=9A=A9=EC=A4=91?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/board_form.php | 39 ++++++++++++++++------------------ adm/board_form_update.php | 9 ++++++-- adm/board_list.php | 28 +++++------------------- adm/board_list_update.php | 2 +- adm/boardgroup_form_update.php | 2 +- 5 files changed, 32 insertions(+), 48 deletions(-) diff --git a/adm/board_form.php b/adm/board_form.php index 4a3959d67..51c4a7f4c 100644 --- a/adm/board_form.php +++ b/adm/board_form.php @@ -78,7 +78,7 @@ include_once ('./admin.head.php');
  • 여분필드
    • - + @@ -92,7 +92,7 @@ include_once ('./admin.head.php'); - value=""> + value="" required="required"> - - 동일그룹게시판목록 + - + @@ -295,11 +294,10 @@ include_once ('./admin.head.php'); - @@ -521,14 +519,7 @@ if (!preg_match("/([m|M])$/", $upload_max_filesize)) { - - + @@ -787,18 +778,25 @@ if (!preg_match("/([m|M])$/", $upload_max_filesize)) { XSS 혹은 CSRF 방지

    관리자 권한을 탈취당하는 경우를 대비하여 패스워드를 다시 한번 확인합니다.

    - +
    - - + 목록 + 게시판복사
    diff --git a/adm/board_form_update.php b/adm/board_form_update.php index a01b698b5..dfa7cbeca 100644 --- a/adm/board_form_update.php +++ b/adm/board_form_update.php @@ -7,10 +7,15 @@ if ($w == 'u') auth_check($auth[$sub_menu], 'w'); -if ($member['mb_password'] != sql_password($_POST['admin_password'])) { - alert('패스워드가 다릅니다.'); +if ($_POST['admin_password']) { + if ($member['mb_password'] != sql_password($_POST['admin_password'])) { + alert('관리자 패스워드가 틀립니다.'); + } +} else { + alert('관리자 패스워드를 입력하세요.'); } + if (!$_POST['gr_id']) { alert('그룹 ID는 반드시 선택하세요.'); } if (!$bo_table) { alert('게시판 TABLE명은 반드시 입력하세요.'); } if (!preg_match("/^([A-Za-z0-9_]{1,20})$/", $bo_table)) { alert('게시판 TABLE명은 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (20자 이내)'); } diff --git a/adm/board_list.php b/adm/board_list.php index 4f631fd18..cd03c08b5 100644 --- a/adm/board_list.php +++ b/adm/board_list.php @@ -70,9 +70,9 @@ var list_delete_php = 'board_list_delete.php'; @@ -113,17 +113,6 @@ var list_delete_php = 'board_list_delete.php'; 10) - $option = substr($arr[$k], 0, 18) . '…'; - - $skin_options .= ''; -} - for ($i=0; $row=sql_fetch_array($result); $i++) { $s_upd = '수정'; $s_del = ""; @@ -150,12 +139,9 @@ for ($i=0; $row=sql_fetch_array($result); $i++) { - - + - + @@ -190,10 +176,6 @@ if ($i == 0)
    - - diff --git a/adm/board_list_update.php b/adm/board_list_update.php index e8ca8cf0f..662d25fb5 100644 --- a/adm/board_list_update.php +++ b/adm/board_list_update.php @@ -5,7 +5,7 @@ include_once('./_common.php'); check_demo(); if (!count($_POST['chk'])) { - alert($_POST['btn_submit']." 하실 항목을 하나 이상 선택하세요."); + alert($_POST['btn_submit']." 하실 항목을 하나 이상 체크하세요."); } if ($_POST['btn_submit'] == "선택수정") { diff --git a/adm/boardgroup_form_update.php b/adm/boardgroup_form_update.php index 555538b14..786e7c295 100644 --- a/adm/boardgroup_form_update.php +++ b/adm/boardgroup_form_update.php @@ -9,7 +9,7 @@ auth_check($auth[$sub_menu], 'w'); if ($is_admin != 'super' && $w == '') alert('최고관리자만 접근 가능합니다.'); -if (!preg_match("/^([A-Za-z0-9_]{1,10})$/", $gr_id)) +if (!preg_match("/^([A-Za-z0-9_]{1,10})$/", $_POST['gr_id'])) alert('그룹 ID는 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (10자 이내)'); if (!$gr_subject) alert('그룹 제목을 입력하세요.'); From 8cd43a0ae87bf563cbe02a343ffa4d67189bbb2d Mon Sep 17 00:00:00 2001 From: gnuboard Date: Tue, 15 Jan 2013 20:41:00 +0900 Subject: [PATCH 12/12] =?UTF-8?q?=EA=B2=80=EC=83=89=EB=8C=80=EC=83=81=20se?= =?UTF-8?q?lect=20option=20=EC=97=90=20seleced=20=EB=84=A3=EA=B8=B0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/board_list.php | 10 +++------- lib/common.lib.php | 9 +++++---- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/adm/board_list.php b/adm/board_list.php index cd03c08b5..8427314e0 100644 --- a/adm/board_list.php +++ b/adm/board_list.php @@ -70,9 +70,9 @@ var list_delete_php = 'board_list_delete.php'; @@ -183,10 +183,6 @@ $pagelist = get_paging($config['cf_write_pages'], $page, $total_page, $_SERVER['
    -document.fsearch.sfl.value = "'.$sfl.'";'; -?>