From ebad7240cc09f77ec2d68592c657fec02f7b7dbf Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 10 Oct 2017 11:26:11 +0900
Subject: [PATCH] =?UTF-8?q?=EA=B7=B8=EB=88=84=EB=B3=B4=EB=93=9C=20RCE=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95=20adm1nkyj(?=
 =?UTF-8?q?=EA=B9=80=EC=9A=A9=EC=A7=84,=20http://adm1nkyj.kr)=20=EB=8B=98?=
 =?UTF-8?q?=20=EC=A0=9C=EB=B3=B4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 g4_import.php     | 5 +++++
 g4_import_run.php | 9 ++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/g4_import.php b/g4_import.php
index 85e763858..3e4f67ac2 100644
--- a/g4_import.php
+++ b/g4_import.php
@@ -125,6 +125,7 @@ if($is_admin != 'super')
             <p>프로그램을 실행하시려면 그누보드4의 config.php 파일 경로를 입력하신 후 확인을 클릭해 주십시오.</p>
 
             <form name="fimport" method="post" action="./g4_import_run.php" onsubmit="return fimport_submit(this);">
+            <input type="hidden" name="token" value="" >
             <div id="g4_import_frm">
                 <label for="file_path">config.php 파일 경로</label>
                 <input type="text" name="file_path" id="file_path" required class="frm_input required">
@@ -142,6 +143,10 @@ if($is_admin != 'super')
         <script>
         function fimport_submit(f)
         {
+            var token = get_write_token('g4_import');
+            
+            f.token.value = token;
+
             return confirm('그누보드4의 DB 데이터를 이전하시겠습니까?');
         }
         </script>
diff --git a/g4_import_run.php b/g4_import_run.php
index 28c949931..f34569b93 100644
--- a/g4_import_run.php
+++ b/g4_import_run.php
@@ -17,6 +17,13 @@ echo '<link rel="stylesheet" href="'.G5_URL.'/g4_import.css">';
 if(empty($_POST))
     alert('올바른 방법으로 이용해 주십시오.', G5_URL);
 
+if (!preg_match("/^http['s']?:\/\/".$_SERVER['HTTP_HOST']."/", $_SERVER['HTTP_REFERER'])){
+    alert("제대로 된 접근이 아닌것 같습니다.", G5_URL);
+}
+
+// 토큰체크
+check_write_token('g4_import');
+
 if(get_session('tables_copied') == 'done')
     alert('DB 데이터 변환을 이미 실행하였습니다. 중복 실행시 오류가 발생할 수 있습니다.', G5_URL);
 
@@ -165,7 +172,7 @@ document.onkeydown = noRefresh ;
         flush();
 
         // g4의 confing.php
-        require($g4_config_file);
+        require('./'.$g4_config_file);
 
         if(preg_replace('/[^a-z]/', '', strtolower($g4['charset'])) == 'euckr')
             $is_euckr = true;