From e6eab2d040eade59f7ed84f438d6019e2c24f14f Mon Sep 17 00:00:00 2001 From: thisgun Date: Thu, 23 Jan 2020 10:58:18 +0900 Subject: [PATCH] =?UTF-8?q?[KVE-2019-1517]=20=EA=B7=B8=EB=88=84=EB=B3=B4?= =?UTF-8?q?=EB=93=9C=205=5FCross=20Site=20Scripting(XSS)=20=EC=B7=A8?= =?UTF-8?q?=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/qa_config_update.php | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/adm/qa_config_update.php b/adm/qa_config_update.php index a269c45ee..97fd16d7e 100644 --- a/adm/qa_config_update.php +++ b/adm/qa_config_update.php @@ -12,6 +12,12 @@ $error_msg = ''; $qaconfig = get_qa_config(); +$check_keys = array('qa_title', 'qa_category', 'qa_skin', 'qa_mobile_skin', 'qa_use_email', 'qa_req_email', 'qa_use_hp', 'qa_req_hp', 'qa_use_sms', 'qa_send_number', 'qa_admin_hp', 'qa_admin_email', 'qa_subject_len', 'qa_mobile_subject_len', 'qa_page_rows', 'qa_mobile_page_rows', 'qa_image_width', 'qa_upload_size'); + +foreach($check_keys as $key){ + $$key = $_POST[$key] = isset($_POST[$key]) ? strip_tags($_POST[$key]) : ''; +} + $qa_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_head, 0, 255)); $qa_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($qa_include_tail, 0, 255)); @@ -50,8 +56,6 @@ if( $qa_include_tail && ! is_include_path_check($qa_include_tail, 1) ){ $error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.'; } -$_POST['qa_title'] = strip_tags($_POST['qa_title']); - $sql = " update {$g5['qa_config_table']} set qa_title = '{$_POST['qa_title']}', qa_category = '{$_POST['qa_category']}',