diff --git a/adm/admin.menu500.shop_2of2.php b/adm/admin.menu500.shop_2of2.php index 7e4dd3071..ac4f6a2f4 100644 --- a/adm/admin.menu500.shop_2of2.php +++ b/adm/admin.menu500.shop_2of2.php @@ -11,7 +11,6 @@ $menu['menu500'] = array ( array('500310', '이벤트일괄처리', G5_ADMIN_URL.'/shop_admin/itemeventlist.php', 'scf_event_mng'), array('500500', '배너관리', G5_ADMIN_URL.'/shop_admin/bannerlist.php', 'scf_banner', 1), array('500140', '보관함현황', G5_ADMIN_URL.'/shop_admin/wishlist.php', 'sst_wish'), - array('500200', 'SMS 문자전송', G5_ADMIN_URL.'/shop_admin/smssend.php', 'sst_sms'), - array('500210', '가격비교사이트', G5_ADMIN_URL.'/shop_admin/price.php', 'sst_compare', 1) + array('500200', '가격비교사이트', G5_ADMIN_URL.'/shop_admin/price.php', 'sst_compare', 1) ); ?> \ No newline at end of file diff --git a/adm/config_form.php b/adm/config_form.php index b53870be1..5f9ff4d5b 100644 --- a/adm/config_form.php +++ b/adm/config_form.php @@ -134,6 +134,11 @@ if(!isset($config['cf_sms_use'])) { ADD `cf_icode_server_port` varchar(255) NOT NULL DEFAULT '' AFTER `cf_icode_server_ip` ", true); } +if(!isset($config['cf_mobile_page_rows'])) { + sql_query(" ALTER TABLE `{$g5['config_table']}` + ADD `cf_mobile_page_rows` int(11) NOT NULL DEFAULT '0' AFTER `cf_page_rows` ", true); +} + if(!isset($config['cf_faq_skin'])) { sql_query(" ALTER TABLE `{$g5['config_table']}` ADD `cf_faq_skin` varchar(255) NOT NULL DEFAULT '' AFTER `cf_connect_skin`, @@ -268,10 +273,15 @@ if ($config['cf_icode_id'] && $config['cf_icode_pw']) { - + 분 + + + + 라인 + @@ -279,10 +289,10 @@ if ($config['cf_icode_id'] && $config['cf_icode_pw']) { 라인 - + - - 라인 + + 라인 diff --git a/adm/config_form_update.php b/adm/config_form_update.php index 75dbbeb58..58fbfec9e 100644 --- a/adm/config_form_update.php +++ b/adm/config_form_update.php @@ -101,6 +101,7 @@ $sql = " update {$g5['config_table']} cf_movie_extension = '{$_POST['cf_movie_extension']}', cf_formmail_is_member = '{$_POST['cf_formmail_is_member']}', cf_page_rows = '{$_POST['cf_page_rows']}', + cf_mobile_page_rows = '{$_POST['cf_mobile_page_rows']}', cf_stipulation = '{$_POST['cf_stipulation']}', cf_privacy = '{$_POST['cf_privacy']}', cf_open_modify = '{$_POST['cf_open_modify']}', diff --git a/adm/shop_admin/smssend.php b/adm/shop_admin/smssend.php deleted file mode 100644 index c2c9de1ea..000000000 --- a/adm/shop_admin/smssend.php +++ /dev/null @@ -1,263 +0,0 @@ - - - -
-

SMS 문자전송 내용 입력

- -
- -
- - - - - - - - - - - - - - - - - - - - - - - - -
내용 입력
- - -
- - -
총 수신인 0명
-
- - -
0 / 80 바이트
-
예약발송 - - - - 년 - - 월 - - 일 - - 시 - - 분 -
-
- -
-

예약발송 기능을 이용하시면, 예약된 시간에 맞춰 SMS 문자를 일괄발송할 수 있습니다.

-
- -
- -
- -
- -
- 문자내용을 입력해 주세요 -

이 이미지는 이해를 돕기 위한 이미지이므로,
실제 발송 시 화면과 다를 수 있습니다.

-
-
- - - - - - -
-

SMS 문자전송 서비스를 사용할 수 없습니다.

-
-

- SMS 를 사용하지 않고 있기 때문에, 문자 전송을 할 수 없습니다.
- SMS 사용 설정은 쇼핑몰관리 > 쇼핑몰설정 > SMS설정 에서 하실 수 있습니다. -

-
-
- - - - - diff --git a/adm/shop_admin/smssendicode.php b/adm/shop_admin/smssendicode.php deleted file mode 100644 index f847b155e..000000000 --- a/adm/shop_admin/smssendicode.php +++ /dev/null @@ -1,68 +0,0 @@ -SMS_con($config['cf_icode_server_ip'], $config['cf_icode_id'], $config['cf_icode_pw'], $config['cf_icode_server_port']); - -$recv = explode("\n", conv_unescape_nl($receive_number)); - -$tran_callback = preg_replace("/[^0-9]/", "", $send_number); -$sms_id = $config['cf_icode_id']; -$tran_msg = iconv("utf-8", "euc-kr", stripslashes($sms_contents)); -$tran_date = ""; -if ($reserved_flag) // 예약전송 -{ - $tran_date = $reserved_year . - substr("0".$reserved_month, -2) . - substr("0".$reserved_day, -2). - substr("0".$reserved_hour, -2). - substr("0".$reserved_minute, -2); -} -for($i=0; $iAdd($tran_phone, $tran_callback, $sms_id, $tran_msg, $tran_date); -} -$result = $SMS->Send(); -if ($result) -{ - //echo "SMS 서버에 접속했습니다.
"; - $success = $fail = 0; - foreach($SMS->Result as $result) - { - list($phone,$code)=explode(":",$result); - if ($code=="Error") - { - //echo $phone.'로 발송하는데 에러가 발생했습니다.
'; - $msg .= $phone."로 발송하는데 에러가 발생했습니다.\\n"; - $fail++; - } - else - { - //echo $phone."로 전송했습니다. (메시지번호:".$code.")
"; - $success++; - } - } - //echo $success."건을 전송했으며 ".$fail."건을 보내지 못했습니다.\\n"; - $SMS->Init(); // 보관하고 있던 결과값을 지웁니다. -} -else -{ - //echo "에러: SMS 서버와 통신이 불안정합니다.
"; - $msg .= "에러: SMS 서버와 통신이 불안정합니다.\\n"; -} - -if (!$msg) - $msg = "정상적으로 전송하였습니다."; - -alert($msg, './smssend.php'); -?> diff --git a/adm/shop_admin/smssendresult.php b/adm/shop_admin/smssendresult.php deleted file mode 100644 index e8c6616f3..000000000 --- a/adm/shop_admin/smssendresult.php +++ /dev/null @@ -1,24 +0,0 @@ -'; -if ($return_value == 1) { - echo 'alert("정상적으로 전송하였습니다.");'; -} else { - echo 'alert("오류발생 : '.$error_msg .'('.$error_code.')");'; -} -echo ''; - -goto_url('./smssend.php'); -?> diff --git a/bbs/faq.php b/bbs/faq.php index 35906477d..d3fe9406e 100644 --- a/bbs/faq.php +++ b/bbs/faq.php @@ -73,7 +73,7 @@ if(is_file($skin_file)) { if ($page < 1) { $page = 1; } // 페이지가 없으면 첫 페이지 (1 페이지) - $page_rows = G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages']; + $page_rows = G5_IS_MOBILE ? $config['cf_mobile_page_rows'] : $config['cf_page_rows']; $sql = " select count(*) as cnt from {$g5['faq_table']} diff --git a/common.php b/common.php index abd7fc1d5..823f4f00c 100644 --- a/common.php +++ b/common.php @@ -80,10 +80,10 @@ if (file_exists($dbconfig_file)) { } // sql_escape_string 적용 - $_POST = array_map_deep('sql_escape_string', $_POST); - $_GET = array_map_deep('sql_escape_string', $_GET); - $_COOKIE = array_map_deep('sql_escape_string', $_COOKIE); - $_REQUEST = array_map_deep('sql_escape_string', $_REQUEST); + $_POST = array_map_deep(G5_ESCAPE_FUNCTION, $_POST); + $_GET = array_map_deep(G5_ESCAPE_FUNCTION, $_GET); + $_COOKIE = array_map_deep(G5_ESCAPE_FUNCTION, $_COOKIE); + $_REQUEST = array_map_deep(G5_ESCAPE_FUNCTION, $_REQUEST); //============================================================================== // PHP 4.1.0 부터 지원됨 diff --git a/install/gnuboard5.sql b/install/gnuboard5.sql index 8a79450fa..c2f159ef8 100644 --- a/install/gnuboard5.sql +++ b/install/gnuboard5.sql @@ -269,6 +269,7 @@ CREATE TABLE IF NOT EXISTS `g5_config` ( `cf_movie_extension` varchar(255) NOT NULL DEFAULT '', `cf_formmail_is_member` tinyint(4) NOT NULL DEFAULT '0', `cf_page_rows` int(11) NOT NULL DEFAULT '0', + `cf_mobile_page_rows` int(11) NOT NULL DEFAULT '0', `cf_visit` varchar(255) NOT NULL DEFAULT '', `cf_max_po_id` int(11) NOT NULL DEFAULT '0', `cf_stipulation` text NOT NULL, diff --git a/install/install_db.php b/install/install_db.php index 294931c07..e88493be4 100644 --- a/install/install_db.php +++ b/install/install_db.php @@ -170,6 +170,7 @@ if($g5_install || !$result) { cf_movie_extension = 'asx|asf|wmv|wma|mpg|mpeg|mov|avi|mp3', cf_formmail_is_member = '1', cf_page_rows = '15', + cf_page_rows = '15', cf_cert_limit = '2', cf_stipulation = '해당 홈페이지에 맞는 회원가입약관을 입력합니다.', cf_privacy = '해당 홈페이지에 맞는 개인정보처리방침을 입력합니다.' diff --git a/lib/common.lib.php b/lib/common.lib.php index 87839e139..240c0866a 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -1451,8 +1451,14 @@ function sql_select_db($db, $connect) // mysql_query 와 mysql_error 를 한꺼번에 처리 function sql_query($sql, $error=G5_DISPLAY_SQL_ERROR) { + // Blind SQL Injection 취약점 해결 + $sql = trim($sql); + // union의 사용을 허락하지 않습니다. + $sql = preg_replace("#^select.*from.*union.*#i", "select 1", $sql); + // `information_schema` DB로의 접근을 허락하지 않습니다. + $sql = preg_replace("#^select.*from.*where.*`?information_schema`?.*#i", "select 1", $sql); if ($error) - $result = @mysql_query($sql) or die("

$sql

" . mysql_errno() . " : " . mysql_error() . "

error file : {$_SERVER['PHP_SELF']}"); + $result = @mysql_query($sql) or die("

$sql

" . mysql_errno() . " : " . mysql_error() . "

error file : $_SERVER[PHP_SELF]"); else $result = @mysql_query($sql); return $result; diff --git a/mobile/skin/board/basic/write.skin.php b/mobile/skin/board/basic/write.skin.php index b15f921b7..bcce85f58 100644 --- a/mobile/skin/board/basic/write.skin.php +++ b/mobile/skin/board/basic/write.skin.php @@ -135,7 +135,7 @@ add_stylesheet('', 0 - + diff --git a/mobile/skin/board/gallery/write.skin.php b/mobile/skin/board/gallery/write.skin.php index 129674527..86456b310 100644 --- a/mobile/skin/board/gallery/write.skin.php +++ b/mobile/skin/board/gallery/write.skin.php @@ -134,7 +134,7 @@ add_stylesheet('', 0 - + diff --git a/skin/board/basic/write.skin.php b/skin/board/basic/write.skin.php index d1f4556ac..837133208 100644 --- a/skin/board/basic/write.skin.php +++ b/skin/board/basic/write.skin.php @@ -151,7 +151,7 @@ add_stylesheet('', 0 - + diff --git a/skin/board/gallery/write.skin.php b/skin/board/gallery/write.skin.php index d1f4556ac..837133208 100644 --- a/skin/board/gallery/write.skin.php +++ b/skin/board/gallery/write.skin.php @@ -151,7 +151,7 @@ add_stylesheet('', 0 - +