LFI to RCE 취약점 수정

2017-02-06 20:00:18 +09:00
parent ce03af265e
commit ed957cf6b3
7 changed files with 51 additions and 10 deletions
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@ -3259,4 +3259,13 @@ function check_write_token($bo_table)

    return true;
 }
+
+// include 하는 경로에 data file 경로가 포함되어 있는지 체크합니다.
+function is_include_path_check($path='')
+{
+    if( !$path || preg_match('/\/data\/(file|editor)\/[A-Za-z0-9_]{1,20}\//', $path) ){
+        return false;
+    }
+    return true;
+}
 ?>