firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

LFI to RCE 취약점 수정

Browse Source
This commit is contained in:
thisgun
2017-02-06 20:00:18 +09:00
parent ce03af265e
commit ed957cf6b3
7 changed files with 51 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
adm/contentformupdate.php
View File

@ -18,6 +18,18 @@ check_admin_token();
if ($co_himg_del) @unlink(G5_DATA_PATH."/content/{$co_id}_h");
if ($co_timg_del) @unlink(G5_DATA_PATH."/content/{$co_id}_t");
$error_msg = '';
if( $co_include_head && ! is_include_path_check($co_include_head) ){
$co_include_head = '';
$error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.';
}
if( $co_include_tail && ! is_include_path_check($co_include_tail) ){
$co_include_tail = '';
$error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
}
$sql_common = " co_include_head = '$co_include_head',
co_include_tail = '$co_include_tail',
co_html = '$co_html',
@ -74,7 +86,11 @@ if ($w == "" || $w == "u")
@chmod($dest_path, G5_FILE_PERMISSION);
}
goto_url("./contentform.php?w=u&co_id=$co_id");
if( $error_msg ){
alert($error_msg, "./contentform.php?w=u&co_id=$co_id");
} else {
goto_url("./contentform.php?w=u&co_id=$co_id");
}
}
else
{

22
adm/qa_config_update.php
View File

@ -8,6 +8,18 @@ auth_check($auth[$sub_menu], 'w');
check_admin_token();
$error_msg = '';
if( $qa_include_head && ! is_include_path_check($qa_include_head) ){
$qa_include_head = '';
$error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.';
}
if( $qa_include_tail && ! is_include_path_check($qa_include_tail) ){
$qa_include_tail = '';
$error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
}
$sql = " update {$g5['qa_config_table']}
set qa_title = '{$_POST['qa_title']}',
qa_category = '{$_POST['qa_category']}',
@ -29,8 +41,8 @@ $sql = " update {$g5['qa_config_table']}
qa_image_width = '{$_POST['qa_image_width']}',
qa_upload_size = '{$_POST['qa_upload_size']}',
qa_insert_content = '{$_POST['qa_insert_content']}',
qa_include_head = '{$_POST['qa_include_head']}',
qa_include_tail = '{$_POST['qa_include_tail']}',
qa_include_head = '{$qa_include_head}',
qa_include_tail = '{$qa_include_tail}',
qa_content_head = '{$_POST['qa_content_head']}',
qa_content_tail = '{$_POST['qa_content_tail']}',
qa_mobile_content_head = '{$_POST['qa_mobile_content_head']}',
@ -47,5 +59,9 @@ $sql = " update {$g5['qa_config_table']}
qa_5 = '{$_POST['qa_5']}' ";
sql_query($sql);
goto_url('./qa_config.php');
if($error_msg){
alert($error_msg, './qa_config.php');
} else {
goto_url('./qa_config.php');
}
?>