firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

LFI to RCE 취약점 수정

Browse Source
This commit is contained in:
thisgun
2017-02-06 20:00:18 +09:00
parent ce03af265e
commit ed957cf6b3
7 changed files with 51 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
adm/contentformupdate.php
View File

@ -18,6 +18,18 @@ check_admin_token();
if ($co_himg_del) @unlink(G5_DATA_PATH."/content/{$co_id}_h");
if ($co_timg_del) @unlink(G5_DATA_PATH."/content/{$co_id}_t");
$error_msg = '';
if( $co_include_head && ! is_include_path_check($co_include_head) ){
$co_include_head = '';
$error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 상단 파일 경로에 포함시킬수 없습니다.';
}
if( $co_include_tail && ! is_include_path_check($co_include_tail) ){
$co_include_tail = '';
$error_msg = '/data/file/ 또는 /data/editor/ 포함된 문자를 하단 파일 경로에 포함시킬수 없습니다.';
}
$sql_common = " co_include_head = '$co_include_head',
co_include_tail = '$co_include_tail',
co_html = '$co_html',
@ -74,7 +86,11 @@ if ($w == "" || $w == "u")
@chmod($dest_path, G5_FILE_PERMISSION);
}
goto_url("./contentform.php?w=u&co_id=$co_id");
if( $error_msg ){
alert($error_msg, "./contentform.php?w=u&co_id=$co_id");
} else {
goto_url("./contentform.php?w=u&co_id=$co_id");
}
}
else
{