firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

KVE-2018-1772, 1808, 1817 취약점 수정

Browse Source
This commit is contained in:
thisgun
2018-12-12 16:58:22 +09:00
parent 013b67a63b
commit e620f6aafa
13 changed files with 29 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mobile/shop/item.php
View File

@ -2,7 +2,7 @@
include_once('./_common.php');
include_once(G5_LIB_PATH.'/iteminfo.lib.php');
$it_id = trim($_GET['it_id']);
$it_id = get_search_string(trim($_GET['it_id']));
// 분류사용, 상품사용하는 상품의 정보를 얻음
$sql = " select a.*,

4
mobile/shop/iteminfo.php
View File

@ -1,8 +1,8 @@
<?php
include_once('./_common.php');
$it_id = $_GET['it_id'];
$info = $_GET['info'];
$it_id = get_search_string(trim($_GET['it_id']));
$info = preg_replace('/[^0-9a-z]/i', '', $_GET['info']);
// 분류사용, 상품사용하는 상품의 정보를 얻음
$sql = " select a.*,

6
mobile/shop/itemqaform.php
View File

@ -6,9 +6,9 @@ if (!$is_member) {
alert_close("상품문의는 회원만 작성 가능합니다.");
}
$w = trim($_REQUEST['w']);
$it_id = trim($_REQUEST['it_id']);
$iq_id = trim($_REQUEST['iq_id']);
$w = preg_replace('/[^0-9a-z]/i', '', trim($_REQUEST['w']));
$it_id = get_search_string(trim($_REQUEST['it_id']));
$iq_id = preg_replace('/[^0-9]/', '', trim($_REQUEST['iq_id']));
// 상품정보체크
$sql = " select it_id from {$g5['g5_shop_item_table']} where it_id = '$it_id' ";

6
mobile/shop/itemuseform.php
View File

@ -6,9 +6,9 @@ if (!$is_member) {
alert_close("사용후기는 회원만 작성 가능합니다.");
}
$w = trim($_REQUEST['w']);
$it_id = trim($_REQUEST['it_id']);
$is_id = trim($_REQUEST['is_id']);
$w = preg_replace('/[^0-9a-z]/i', '', trim($_REQUEST['w']));
$it_id = get_search_string(trim($_REQUEST['it_id']));
$is_id = preg_replace('/[^0-9]/', '', trim($_REQUEST['is_id']));
// 상품정보체크
$sql = " select it_id from {$g5['g5_shop_item_table']} where it_id = '$it_id' ";

4
mobile/shop/largeimage.php
View File

@ -1,8 +1,8 @@
<?php
include_once('./_common.php');
$it_id = $_GET['it_id'];
$no = $_GET['no'];
$it_id = get_search_string(trim($_GET['it_id']));
$no = preg_replace('/[^0-9a-z]/i', '', $_GET['no']);
$sql = " select it_id, it_name, it_img1, it_img2, it_img3, it_img4, it_img5, it_img6, it_img7, it_img8, it_img9, it_img10
from {$g5['g5_shop_item_table']} where it_id='$it_id' ";