TABLE
- class="frm_input " maxlength="20">
+ class="frm_input " maxlength="20">
영문자, 숫자, _ 만 가능 (공백없이 20자 이내)
@@ -1439,5 +1492,4 @@ function fboardform_submit(f)
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/board_form_update.php b/adm/board_form_update.php
index 79a882870..557a1a2a6 100644
--- a/adm/board_form_update.php
+++ b/adm/board_form_update.php
@@ -5,25 +5,27 @@ include_once('./_common.php');
if ($w == 'u')
check_demo();
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
check_admin_token();
$gr_id = isset($_POST['gr_id']) ? preg_replace('/[^a-z0-9_]/i', '', $_POST['gr_id']) : '';
$bo_admin = isset($_POST['bo_admin']) ? preg_replace('/[^a-z0-9_\, \|\#]/i', '', $_POST['bo_admin']) : '';
+$bo_subject = isset($_POST['bo_subject']) ? strip_tags(clean_xss_attributes($_POST['bo_subject'])) : '';
+$bo_mobile_subject = isset($_POST['bo_mobile_subject']) ? strip_tags(clean_xss_attributes($_POST['bo_mobile_subject'])) : '';
if (!$gr_id) { alert('그룹 ID는 반드시 선택하세요.'); }
if (!$bo_table) { alert('게시판 TABLE명은 반드시 입력하세요.'); }
if (!preg_match("/^([A-Za-z0-9_]{1,20})$/", $bo_table)) { alert('게시판 TABLE명은 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (20자 이내)'); }
-if (!$_POST['bo_subject']) { alert('게시판 제목을 입력하세요.'); }
+if (!$bo_subject) { alert('게시판 제목을 입력하세요.'); }
// 게시판명이 금지된 단어로 되어 있으면
if ( $w == '' && in_array($bo_table, get_bo_table_banned_word()) ){
alert('입력한 게시판 TABLE명을 사용할수 없습니다. 다른 이름으로 입력해 주세요.');
}
-$bo_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($bo_include_head, 0, 255));
-$bo_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($bo_include_tail, 0, 255));
+$bo_include_head = isset($_POST['bo_include_head']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['bo_include_head'], 0, 255)) : '';
+$bo_include_tail = isset($_POST['bo_include_tail']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['bo_include_tail'], 0, 255)) : '';
// 관리자가 자동등록방지를 사용해야 할 경우
if ($board && ($board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
@@ -40,7 +42,6 @@ if ($file = $bo_include_head) {
if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) || ! preg_match('/^.*\.(php|htm|html)$/i', $file) ) {
alert('상단 파일 경로의 확장자는 php, htm, html 만 허용합니다.');
}
- $_POST['bo_include_head'] = $file;
}
if ($file = $bo_include_tail) {
@@ -49,7 +50,6 @@ if ($file = $bo_include_tail) {
if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) || ! preg_match('/^.*\.(php|htm|html)$/i', $file) ) {
alert('하단 파일 경로의 확장자는 php, htm, html 만 허용합니다.');
}
- $_POST['bo_include_tail'] = $file;
}
if(!is_include_path_check($bo_include_head, 1)) {
@@ -73,10 +73,11 @@ $board_path = G5_DATA_PATH.'/file/'.$bo_table;
// 디렉토리에 있는 파일의 목록을 보이지 않게 한다.
$file = $board_path . '/index.php';
-$f = @fopen($file, 'w');
-@fwrite($f, '');
-@fclose($f);
-@chmod($file, G5_FILE_PERMISSION);
+if( $f = @fopen($file, 'w') ){
+ @fwrite($f, '');
+ @fclose($f);
+ @chmod($file, G5_FILE_PERMISSION);
+}
// 분류에 & 나 = 는 사용이 불가하므로 2바이트로 바꾼다.
$src_char = array('&', '=');
@@ -85,108 +86,178 @@ $bo_category_list = isset($_POST['bo_category_list']) ? str_replace($src_char, $
//https://github.com/gnuboard/gnuboard5/commit/f5f4925d4eb28ba1af728e1065fc2bdd9ce1da58 에 따른 조치
$str_bo_category_list = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $bo_category_list);
-$_POST['bo_subject'] = strip_tags(clean_xss_attributes($_POST['bo_subject']));
-$_POST['bo_mobile_subject'] = strip_tags(clean_xss_attributes($_POST['bo_mobile_subject']));
+$bo_use_category = isset($_POST['bo_use_category']) ? (int) $_POST['bo_use_category'] : 0;
+$bo_use_sideview = isset($_POST['bo_use_sideview']) ? (int) $_POST['bo_use_sideview'] : 0;
+$bo_use_dhtml_editor = isset($_POST['bo_use_dhtml_editor']) ? (int) $_POST['bo_use_dhtml_editor'] : 0;
+$bo_use_good = isset($_POST['bo_use_good']) ? (int) $_POST['bo_use_good'] : 0;
+$bo_use_nogood = isset($_POST['bo_use_nogood']) ? (int) $_POST['bo_use_nogood'] : 0;
+$bo_use_name = isset($_POST['bo_use_name']) ? (int) $_POST['bo_use_name'] : 0;
+$bo_use_signature = isset($_POST['bo_use_signature']) ? (int) $_POST['bo_use_signature'] : 0;
+$bo_use_ip_view = isset($_POST['bo_use_ip_view']) ? (int) $_POST['bo_use_ip_view'] : 0;
+$bo_use_list_view = isset($_POST['bo_use_list_view']) ? (int) $_POST['bo_use_list_view'] : 0;
+$bo_use_list_file = isset($_POST['bo_use_list_file']) ? (int) $_POST['bo_use_list_file'] : 0;
+$bo_use_list_content = isset($_POST['bo_use_list_content']) ? (int) $_POST['bo_use_list_content'] : 0;
+$bo_use_email = isset($_POST['bo_use_email']) ? (int) $_POST['bo_use_email'] : 0;
+$bo_use_sns = isset($_POST['bo_use_sns']) ? (int) $_POST['bo_use_sns'] : 0;
+$bo_use_captcha = isset($_POST['bo_use_captcha']) ? (int) $_POST['bo_use_captcha'] : 0;
+$bo_table_width = isset($_POST['bo_table_width']) ? (int) $_POST['bo_table_width'] : 0;
+$bo_subject_len = isset($_POST['bo_subject_len']) ? (int) $_POST['bo_subject_len'] : 0;
+$bo_mobile_subject_len = isset($_POST['bo_mobile_subject_len']) ? (int) $_POST['bo_mobile_subject_len'] : 0;
+$bo_page_rows = isset($_POST['bo_page_rows']) ? (int) $_POST['bo_page_rows'] : 0;
+$bo_mobile_page_rows = isset($_POST['bo_mobile_page_rows']) ? (int) $_POST['bo_mobile_page_rows'] : 0;
+$bo_use_rss_view = isset($_POST['bo_use_rss_view']) ? (int) $_POST['bo_use_rss_view'] : 0;
+$bo_use_secret = isset($_POST['bo_use_secret']) ? (int) $_POST['bo_use_secret'] : 0;
+$bo_use_file_content = isset($_POST['bo_use_file_content']) ? (int) $_POST['bo_use_file_content'] : 0;
+$bo_new = isset($_POST['bo_new']) ? (int) $_POST['bo_new'] : 0;
+$bo_hot = isset($_POST['bo_hot']) ? (int) $_POST['bo_hot'] : 0;
+$bo_image_width = isset($_POST['bo_image_width']) ? (int) $_POST['bo_image_width'] : 0;
+$bo_use_search = isset($_POST['bo_use_search']) ? (int) $_POST['bo_use_search'] : 0;
+$bo_use_cert = isset($_POST['bo_use_cert']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['bo_use_cert']) : '';
+$bo_device = isset($_POST['bo_device']) ? clean_xss_tags($_POST['bo_device'], 1, 1) : '';
+$bo_list_level = isset($_POST['bo_list_level']) ? (int) $_POST['bo_list_level'] : 0;
+$bo_read_level = isset($_POST['bo_read_level']) ? (int) $_POST['bo_read_level'] : 0;
+$bo_write_level = isset($_POST['bo_write_level']) ? (int) $_POST['bo_write_level'] : 0;
+$bo_reply_level = isset($_POST['bo_reply_level']) ? (int) $_POST['bo_reply_level'] : 0;
+$bo_comment_level = isset($_POST['bo_comment_level']) ? (int) $_POST['bo_comment_level'] : 0;
+$bo_html_level = isset($_POST['bo_html_level']) ? (int) $_POST['bo_html_level'] : 0;
+$bo_link_level = isset($_POST['bo_link_level']) ? (int) $_POST['bo_link_level'] : 0;
+$bo_count_modify = isset($_POST['bo_count_modify']) ? (int) $_POST['bo_count_modify'] : 0;
+$bo_count_delete = isset($_POST['bo_count_delete']) ? (int) $_POST['bo_count_delete'] : 0;
+$bo_upload_level = isset($_POST['bo_upload_level']) ? (int) $_POST['bo_upload_level'] : 0;
+$bo_download_level = isset($_POST['bo_download_level']) ? (int) $_POST['bo_download_level'] : 0;
+$bo_read_point = isset($_POST['bo_read_point']) ? (int) $_POST['bo_read_point'] : 0;
+$bo_write_point = isset($_POST['bo_write_point']) ? (int) $_POST['bo_write_point'] : 0;
+$bo_comment_point = isset($_POST['bo_comment_point']) ? (int) $_POST['bo_comment_point'] : 0;
+$bo_download_point = isset($_POST['bo_download_point']) ? (int) $_POST['bo_download_point'] : 0;
+$bo_select_editor = isset($_POST['bo_select_editor']) ? clean_xss_tags($_POST['bo_select_editor'], 1, 1) : '';
+$bo_skin = isset($_POST['bo_skin']) ? clean_xss_tags($_POST['bo_skin'], 1, 1) : '';
+$bo_mobile_skin = isset($_POST['bo_mobile_skin']) ? clean_xss_tags($_POST['bo_mobile_skin'], 1, 1) : '';
+$bo_content_head = isset($_POST['bo_content_head']) ? $_POST['bo_content_head'] : '';
+$bo_content_tail = isset($_POST['bo_content_tail']) ? $_POST['bo_content_tail'] : '';
+$bo_mobile_content_head = isset($_POST['bo_mobile_content_head']) ? $_POST['bo_mobile_content_head'] : '';
+$bo_mobile_content_tail = isset($_POST['bo_mobile_content_tail']) ? $_POST['bo_mobile_content_tail'] : '';
+$bo_insert_content = isset($_POST['bo_insert_content']) ? $_POST['bo_insert_content'] : '';
+$bo_gallery_cols = isset($_POST['bo_gallery_cols']) ? (int) $_POST['bo_gallery_cols'] : 0;
+$bo_gallery_width = isset($_POST['bo_gallery_width']) ? (int) $_POST['bo_gallery_width'] : 0;
+$bo_gallery_height = isset($_POST['bo_gallery_height']) ? (int) $_POST['bo_gallery_height'] : 0;
+$bo_mobile_gallery_width = isset($_POST['bo_mobile_gallery_width']) ? (int) $_POST['bo_mobile_gallery_width'] : 0;
+$bo_mobile_gallery_height = isset($_POST['bo_mobile_gallery_height']) ? (int) $_POST['bo_mobile_gallery_height'] : 0;
+$bo_upload_count = isset($_POST['bo_upload_count']) ? (int) $_POST['bo_upload_count'] : 0;
+$bo_upload_size = isset($_POST['bo_upload_size']) ? (int) $_POST['bo_upload_size'] : 0;
+$bo_reply_order = isset($_POST['bo_reply_order']) ? (int) $_POST['bo_reply_order'] : 0;
+$bo_order = isset($_POST['bo_order']) ? (int) $_POST['bo_order'] : 0;
+$bo_write_min = isset($_POST['bo_write_min']) ? (int) $_POST['bo_write_min'] : 0;
+$bo_write_max = isset($_POST['bo_write_max']) ? (int) $_POST['bo_write_max'] : 0;
+$bo_comment_min = isset($_POST['bo_comment_min']) ? (int) $_POST['bo_comment_min'] : 0;
+$bo_comment_max = isset($_POST['bo_comment_max']) ? (int) $_POST['bo_comment_max'] : 0;
+$bo_sort_field = isset($_POST['bo_sort_field']) ? clean_xss_tags($_POST['bo_sort_field'], 1, 1) : '';
+
+$etcs = array();
+
+for($i=1;$i<=10;$i++){
+ $etcs['bo_'.$i.'_subj'] = ${'bo_'.$i.'_subj'} = isset($_POST['bo_'.$i.'_subj']) ? $_POST['bo_'.$i.'_subj'] : '';
+ $etcs['bo_'.$i] = ${'bo_'.$i} = isset($_POST['bo_'.$i]) ? $_POST['bo_'.$i] : '';
+}
$sql_common = " gr_id = '{$gr_id}',
- bo_subject = '{$_POST['bo_subject']}',
- bo_mobile_subject = '{$_POST['bo_mobile_subject']}',
- bo_device = '{$_POST['bo_device']}',
+ bo_subject = '{$bo_subject}',
+ bo_mobile_subject = '{$bo_mobile_subject}',
+ bo_device = '{$bo_device}',
bo_admin = '{$bo_admin}',
- bo_list_level = '{$_POST['bo_list_level']}',
- bo_read_level = '{$_POST['bo_read_level']}',
- bo_write_level = '{$_POST['bo_write_level']}',
- bo_reply_level = '{$_POST['bo_reply_level']}',
- bo_comment_level = '{$_POST['bo_comment_level']}',
- bo_html_level = '{$_POST['bo_html_level']}',
- bo_link_level = '{$_POST['bo_link_level']}',
- bo_count_modify = '{$_POST['bo_count_modify']}',
- bo_count_delete = '{$_POST['bo_count_delete']}',
- bo_upload_level = '{$_POST['bo_upload_level']}',
- bo_download_level = '{$_POST['bo_download_level']}',
- bo_read_point = '{$_POST['bo_read_point']}',
- bo_write_point = '{$_POST['bo_write_point']}',
- bo_comment_point = '{$_POST['bo_comment_point']}',
- bo_download_point = '{$_POST['bo_download_point']}',
- bo_use_category = '{$_POST['bo_use_category']}',
+ bo_list_level = '{$bo_list_level}',
+ bo_read_level = '{$bo_read_level}',
+ bo_write_level = '{$bo_write_level}',
+ bo_reply_level = '{$bo_reply_level}',
+ bo_comment_level = '{$bo_comment_level}',
+ bo_html_level = '{$bo_html_level}',
+ bo_link_level = '{$bo_link_level}',
+ bo_count_modify = '{$bo_count_modify}',
+ bo_count_delete = '{$bo_count_delete}',
+ bo_upload_level = '{$bo_upload_level}',
+ bo_download_level = '{$bo_download_level}',
+ bo_read_point = '{$bo_read_point}',
+ bo_write_point = '{$bo_write_point}',
+ bo_comment_point = '{$bo_comment_point}',
+ bo_download_point = '{$bo_download_point}',
+ bo_use_category = '{$bo_use_category}',
bo_category_list = '{$str_bo_category_list}',
- bo_use_sideview = '{$_POST['bo_use_sideview']}',
- bo_use_file_content = '{$_POST['bo_use_file_content']}',
- bo_use_secret = '{$_POST['bo_use_secret']}',
- bo_use_dhtml_editor = '{$_POST['bo_use_dhtml_editor']}',
- bo_select_editor = '{$_POST['bo_select_editor']}',
- bo_use_rss_view = '{$_POST['bo_use_rss_view']}',
- bo_use_good = '{$_POST['bo_use_good']}',
- bo_use_nogood = '{$_POST['bo_use_nogood']}',
- bo_use_name = '{$_POST['bo_use_name']}',
- bo_use_signature = '{$_POST['bo_use_signature']}',
- bo_use_ip_view = '{$_POST['bo_use_ip_view']}',
- bo_use_list_view = '{$_POST['bo_use_list_view']}',
- bo_use_list_file = '{$_POST['bo_use_list_file']}',
- bo_use_list_content = '{$_POST['bo_use_list_content']}',
- bo_use_email = '{$_POST['bo_use_email']}',
- bo_use_cert = '{$_POST['bo_use_cert']}',
- bo_use_sns = '{$_POST['bo_use_sns']}',
- bo_use_captcha = '{$_POST['bo_use_captcha']}',
- bo_table_width = '{$_POST['bo_table_width']}',
- bo_subject_len = '{$_POST['bo_subject_len']}',
- bo_mobile_subject_len = '{$_POST['bo_mobile_subject_len']}',
- bo_page_rows = '{$_POST['bo_page_rows']}',
- bo_mobile_page_rows = '{$_POST['bo_mobile_page_rows']}',
- bo_new = '{$_POST['bo_new']}',
- bo_hot = '{$_POST['bo_hot']}',
- bo_image_width = '{$_POST['bo_image_width']}',
- bo_skin = '{$_POST['bo_skin']}',
- bo_mobile_skin = '{$_POST['bo_mobile_skin']}',
+ bo_use_sideview = '{$bo_use_sideview}',
+ bo_use_file_content = '{$bo_use_file_content}',
+ bo_use_secret = '{$bo_use_secret}',
+ bo_use_dhtml_editor = '{$bo_use_dhtml_editor}',
+ bo_select_editor = '{$bo_select_editor}',
+ bo_use_rss_view = '{$bo_use_rss_view}',
+ bo_use_good = '{$bo_use_good}',
+ bo_use_nogood = '{$bo_use_nogood}',
+ bo_use_name = '{$bo_use_name}',
+ bo_use_signature = '{$bo_use_signature}',
+ bo_use_ip_view = '{$bo_use_ip_view}',
+ bo_use_list_view = '{$bo_use_list_view}',
+ bo_use_list_file = '{$bo_use_list_file}',
+ bo_use_list_content = '{$bo_use_list_content}',
+ bo_use_email = '{$bo_use_email}',
+ bo_use_cert = '{$bo_use_cert}',
+ bo_use_sns = '{$bo_use_sns}',
+ bo_use_captcha = '{$bo_use_captcha}',
+ bo_table_width = '{$bo_table_width}',
+ bo_subject_len = '{$bo_subject_len}',
+ bo_mobile_subject_len = '{$bo_mobile_subject_len}',
+ bo_page_rows = '{$bo_page_rows}',
+ bo_mobile_page_rows = '{$bo_mobile_page_rows}',
+ bo_new = '{$bo_new}',
+ bo_hot = '{$bo_hot}',
+ bo_image_width = '{$bo_image_width}',
+ bo_skin = '{$bo_skin}',
+ bo_mobile_skin = '{$bo_mobile_skin}',
";
// 최고 관리자인 경우에만 수정가능
if ($is_admin === 'super'){
$sql_common .= " bo_include_head = '".$bo_include_head."',
bo_include_tail = '".$bo_include_tail."',
- bo_content_head = '{$_POST['bo_content_head']}',
- bo_content_tail = '{$_POST['bo_content_tail']}',
- bo_mobile_content_head = '{$_POST['bo_mobile_content_head']}',
- bo_mobile_content_tail = '{$_POST['bo_mobile_content_tail']}',
+ bo_content_head = '{$bo_content_head}',
+ bo_content_tail = '{$bo_content_tail}',
+ bo_mobile_content_head = '{$bo_mobile_content_head}',
+ bo_mobile_content_tail = '{$bo_mobile_content_tail}',
";
}
-$sql_common .= " bo_insert_content = '{$_POST['bo_insert_content']}',
- bo_gallery_cols = '{$_POST['bo_gallery_cols']}',
- bo_gallery_width = '{$_POST['bo_gallery_width']}',
- bo_gallery_height = '{$_POST['bo_gallery_height']}',
- bo_mobile_gallery_width = '{$_POST['bo_mobile_gallery_width']}',
- bo_mobile_gallery_height= '{$_POST['bo_mobile_gallery_height']}',
- bo_upload_count = '{$_POST['bo_upload_count']}',
- bo_upload_size = '{$_POST['bo_upload_size']}',
- bo_reply_order = '{$_POST['bo_reply_order']}',
- bo_use_search = '{$_POST['bo_use_search']}',
- bo_order = '{$_POST['bo_order']}',
- bo_write_min = '{$_POST['bo_write_min']}',
- bo_write_max = '{$_POST['bo_write_max']}',
- bo_comment_min = '{$_POST['bo_comment_min']}',
- bo_comment_max = '{$_POST['bo_comment_max']}',
- bo_sort_field = '{$_POST['bo_sort_field']}',
- bo_1_subj = '{$_POST['bo_1_subj']}',
- bo_2_subj = '{$_POST['bo_2_subj']}',
- bo_3_subj = '{$_POST['bo_3_subj']}',
- bo_4_subj = '{$_POST['bo_4_subj']}',
- bo_5_subj = '{$_POST['bo_5_subj']}',
- bo_6_subj = '{$_POST['bo_6_subj']}',
- bo_7_subj = '{$_POST['bo_7_subj']}',
- bo_8_subj = '{$_POST['bo_8_subj']}',
- bo_9_subj = '{$_POST['bo_9_subj']}',
- bo_10_subj = '{$_POST['bo_10_subj']}',
- bo_1 = '{$_POST['bo_1']}',
- bo_2 = '{$_POST['bo_2']}',
- bo_3 = '{$_POST['bo_3']}',
- bo_4 = '{$_POST['bo_4']}',
- bo_5 = '{$_POST['bo_5']}',
- bo_6 = '{$_POST['bo_6']}',
- bo_7 = '{$_POST['bo_7']}',
- bo_8 = '{$_POST['bo_8']}',
- bo_9 = '{$_POST['bo_9']}',
- bo_10 = '{$_POST['bo_10']}' ";
+$sql_common .= " bo_insert_content = '{$bo_insert_content}',
+ bo_gallery_cols = '{$bo_gallery_cols}',
+ bo_gallery_width = '{$bo_gallery_width}',
+ bo_gallery_height = '{$bo_gallery_height}',
+ bo_mobile_gallery_width = '{$bo_mobile_gallery_width}',
+ bo_mobile_gallery_height= '{$bo_mobile_gallery_height}',
+ bo_upload_count = '{$bo_upload_count}',
+ bo_upload_size = '{$bo_upload_size}',
+ bo_reply_order = '{$bo_reply_order}',
+ bo_use_search = '{$bo_use_search}',
+ bo_order = '{$bo_order}',
+ bo_write_min = '{$bo_write_min}',
+ bo_write_max = '{$bo_write_max}',
+ bo_comment_min = '{$bo_comment_min}',
+ bo_comment_max = '{$bo_comment_max}',
+ bo_sort_field = '{$bo_sort_field}',
+ bo_1_subj = '{$bo_1_subj}',
+ bo_2_subj = '{$bo_2_subj}',
+ bo_3_subj = '{$bo_3_subj}',
+ bo_4_subj = '{$bo_4_subj}',
+ bo_5_subj = '{$bo_5_subj}',
+ bo_6_subj = '{$bo_6_subj}',
+ bo_7_subj = '{$bo_7_subj}',
+ bo_8_subj = '{$bo_8_subj}',
+ bo_9_subj = '{$bo_9_subj}',
+ bo_10_subj = '{$bo_10_subj}',
+ bo_1 = '{$bo_1}',
+ bo_2 = '{$bo_2}',
+ bo_3 = '{$bo_3}',
+ bo_4 = '{$bo_4}',
+ bo_5 = '{$bo_5}',
+ bo_6 = '{$bo_6}',
+ bo_7 = '{$bo_7}',
+ bo_8 = '{$bo_8}',
+ bo_9 = '{$bo_9}',
+ bo_10 = '{$bo_10}' ";
if ($w == '') {
@@ -355,8 +426,8 @@ if (is_checked('chk_grp_use_search')) $grp_fields .= " , bo_use_search
if (is_checked('chk_grp_order')) $grp_fields .= " , bo_order = '{$bo_order}' ";
for ($i=1; $i<=10; $i++) {
if (is_checked('chk_grp_'.$i)) {
- $grp_fields .= " , bo_{$i}_subj = '".$_POST['bo_'.$i.'_subj']."' ";
- $grp_fields .= " , bo_{$i} = '".$_POST['bo_'.$i]."' ";
+ $grp_fields .= " , bo_{$i}_subj = '".$etcs['bo_'.$i.'_subj']."' ";
+ $grp_fields .= " , bo_{$i} = '".$etcs['bo_'.$i]."' ";
}
}
@@ -445,8 +516,8 @@ if (is_checked('chk_all_use_search')) $all_fields .= " , bo_use_search
if (is_checked('chk_all_order')) $all_fields .= " , bo_order = '{$bo_order}' ";
for ($i=1; $i<=10; $i++) {
if (is_checked('chk_all_'.$i)) {
- $all_fields .= " , bo_{$i}_subj = '".$_POST['bo_'.$i.'_subj']."' ";
- $all_fields .= " , bo_{$i} = '".$_POST['bo_'.$i]."' ";
+ $all_fields .= " , bo_{$i}_subj = '".$etcs['bo_'.$i.'_subj']."' ";
+ $all_fields .= " , bo_{$i} = '".$etcs['bo_'.$i]."' ";
}
}
@@ -461,5 +532,4 @@ if(function_exists('get_admin_captcha_by'))
run_event('admin_board_form_update', $bo_table, $w);
-goto_url("./board_form.php?w=u&bo_table={$bo_table}&{$qstr}");
-?>
+goto_url("./board_form.php?w=u&bo_table={$bo_table}&{$qstr}");
\ No newline at end of file
diff --git a/adm/board_list.php b/adm/board_list.php
index d4ed4282e..3d6babfa9 100644
--- a/adm/board_list.php
+++ b/adm/board_list.php
@@ -2,7 +2,7 @@
$sub_menu = "300100";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$sql_common = " from {$g5['board_table']} a ";
$sql_search = " where (1) ";
@@ -63,9 +63,9 @@ $colspan = 15;
검색대상
- >TABLE
- >제목
- >그룹ID
+ >TABLE
+ >제목
+ >그룹ID
검색어 필수
@@ -81,7 +81,7 @@ $colspan = 15;
-
+
@@ -235,5 +235,4 @@ $(function(){
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/board_list_update.php b/adm/board_list_update.php
index 552f60d99..9952804fd 100644
--- a/adm/board_list_update.php
+++ b/adm/board_list_update.php
@@ -4,28 +4,42 @@ include_once('./_common.php');
check_demo();
-if (!count($_POST['chk'])) {
- alert($_POST['act_button']." 하실 항목을 하나 이상 체크하세요.");
+$post_count_chk = (isset($_POST['chk']) && is_array($_POST['chk'])) ? count($_POST['chk']) : 0;
+$chk = (isset($_POST['chk']) && is_array($_POST['chk'])) ? $_POST['chk'] : array();
+$act_button = isset($_POST['act_button']) ? strip_tags($_POST['act_button']) : '';
+$board_table = (isset($_POST['board_table']) && is_array($_POST['board_table'])) ? $_POST['board_table'] : array();
+
+if (! $post_count_chk) {
+ alert($act_button." 하실 항목을 하나 이상 체크하세요.");
}
check_admin_token();
-$act_button = isset($_POST['act_button']) ? strip_tags($_POST['act_button']) : '';
-$chk = (isset($_POST['chk']) && is_array($_POST['chk'])) ? $_POST['chk'] : array();
-$board_table = (isset($_POST['board_table']) && is_array($_POST['board_table'])) ? $_POST['board_table'] : array();
+if ($act_button === "선택수정") {
-if ($_POST['act_button'] == "선택수정") {
+ auth_check_menu($auth, $sub_menu, 'w');
- auth_check($auth[$sub_menu], 'w');
-
- for ($i=0; $i
+goto_url('./board_list.php?'.$qstr);
\ No newline at end of file
diff --git a/adm/board_thumbnail_delete.php b/adm/board_thumbnail_delete.php
index 720cad4f9..93024ca44 100644
--- a/adm/board_thumbnail_delete.php
+++ b/adm/board_thumbnail_delete.php
@@ -2,7 +2,7 @@
$sub_menu = '300100';
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
if(!$board['bo_table'])
alert('존재하지 않는 게시판입니다.');
@@ -48,5 +48,4 @@ if(is_dir($dir)) {
\ No newline at end of file
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/boardgroup_form.php b/adm/boardgroup_form.php
index c9e8338bd..e240e1fc6 100644
--- a/adm/boardgroup_form.php
+++ b/adm/boardgroup_form.php
@@ -2,17 +2,24 @@
$sub_menu = "300200";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
if ($is_admin != 'super' && $w == '') alert('최고관리자만 접근 가능합니다.');
$html_title = '게시판그룹';
$gr_id_attr = '';
$sound_only = '';
+
+if( ! isset($group['gr_id']) ){
+ $group['gr_id'] = '';
+ $group['gr_subject'] = '';
+ $group['gr_device'] = '';
+}
+
if ($w == '') {
$gr_id_attr = 'required';
$sound_only = ' 필수 ';
- $gr = array('gr_use_access' => 0);
+ $gr = array('gr_use_access' => 0, 'gr_admin'=>'');
$html_title .= ' 생성';
} else if ($w == 'u') {
$gr_id_attr = 'readonly';
@@ -115,9 +122,9 @@ include_once('./admin.head.php');
여분필드
@@ -148,5 +155,4 @@ function fboardgroup_check(f)
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/boardgroup_form_update.php b/adm/boardgroup_form_update.php
index 35d8843c1..937198184 100644
--- a/adm/boardgroup_form_update.php
+++ b/adm/boardgroup_form_update.php
@@ -5,42 +5,63 @@ include_once('./_common.php');
if ($w == 'u')
check_demo();
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
if ($is_admin != 'super' && $w == '') alert('최고관리자만 접근 가능합니다.');
check_admin_token();
-if (!preg_match("/^([A-Za-z0-9_]{1,10})$/", $_POST['gr_id']))
+$gr_id = isset($_POST['gr_id']) ? $_POST['gr_id'] : '';
+
+if (!preg_match("/^([A-Za-z0-9_]{1,10})$/", $gr_id))
alert('그룹 ID는 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (10자 이내)');
if (!$gr_subject) alert('그룹 제목을 입력하세요.');
-$gr_subject = isset($_POST['gr_subject']) ? strip_tags(clean_xss_attributes($_POST['gr_subject'])) : '';
+$posts = array();
-$sql_common = " gr_subject = '{$gr_subject}',
- gr_device = '{$_POST['gr_device']}',
- gr_admin = '{$_POST['gr_admin']}',
- gr_1_subj = '{$_POST['gr_1_subj']}',
- gr_2_subj = '{$_POST['gr_2_subj']}',
- gr_3_subj = '{$_POST['gr_3_subj']}',
- gr_4_subj = '{$_POST['gr_4_subj']}',
- gr_5_subj = '{$_POST['gr_5_subj']}',
- gr_6_subj = '{$_POST['gr_6_subj']}',
- gr_7_subj = '{$_POST['gr_7_subj']}',
- gr_8_subj = '{$_POST['gr_8_subj']}',
- gr_9_subj = '{$_POST['gr_9_subj']}',
- gr_10_subj = '{$_POST['gr_10_subj']}',
- gr_1 = '{$_POST['gr_1']}',
- gr_2 = '{$_POST['gr_2']}',
- gr_3 = '{$_POST['gr_3']}',
- gr_4 = '{$_POST['gr_4']}',
- gr_5 = '{$_POST['gr_5']}',
- gr_6 = '{$_POST['gr_6']}',
- gr_7 = '{$_POST['gr_7']}',
- gr_8 = '{$_POST['gr_8']}',
- gr_9 = '{$_POST['gr_9']}',
- gr_10 = '{$_POST['gr_10']}' ";
+$check_keys = array(
+'gr_subject'=>'',
+'gr_device'=>'',
+'gr_admin'=>'',
+);
+
+for($i=1;$i<=10;$i++){
+ $check_keys['gr_'.$i.'_subj'] = isset($_POST['gr_'.$i.'_subj']) ? $_POST['gr_'.$i.'_subj'] : '';
+ $check_keys['gr_'.$i] = isset($_POST['gr_'.$i]) ? $_POST['gr_'.$i] : '';
+}
+
+foreach( $check_keys as $key=>$value ){
+ if( $key === 'gr_subject' ){
+ $posts[$key] = isset($_POST[$key]) ? strip_tags(clean_xss_attributes($_POST[$key])) : '';
+ } else {
+ $posts[$key] = isset($_POST[$key]) ? $_POST[$key] : '';
+ }
+}
+
+$sql_common = " gr_subject = '{$posts['gr_subject']}',
+ gr_device = '{$posts['gr_device']}',
+ gr_admin = '{$posts['gr_admin']}',
+ gr_1_subj = '{$posts['gr_1_subj']}',
+ gr_2_subj = '{$posts['gr_2_subj']}',
+ gr_3_subj = '{$posts['gr_3_subj']}',
+ gr_4_subj = '{$posts['gr_4_subj']}',
+ gr_5_subj = '{$posts['gr_5_subj']}',
+ gr_6_subj = '{$posts['gr_6_subj']}',
+ gr_7_subj = '{$posts['gr_7_subj']}',
+ gr_8_subj = '{$posts['gr_8_subj']}',
+ gr_9_subj = '{$posts['gr_9_subj']}',
+ gr_10_subj = '{$posts['gr_10_subj']}',
+ gr_1 = '{$posts['gr_1']}',
+ gr_2 = '{$posts['gr_2']}',
+ gr_3 = '{$posts['gr_3']}',
+ gr_4 = '{$posts['gr_4']}',
+ gr_5 = '{$posts['gr_5']}',
+ gr_6 = '{$posts['gr_6']}',
+ gr_7 = '{$posts['gr_7']}',
+ gr_8 = '{$posts['gr_8']}',
+ gr_9 = '{$posts['gr_9']}',
+ gr_10 = '{$posts['gr_10']}' ";
if (isset($_POST['gr_use_access']))
$sql_common .= ", gr_use_access = '{$_POST['gr_use_access']}' ";
else
@@ -48,13 +69,13 @@ else
if ($w == '') {
- $sql = " select count(*) as cnt from {$g5['group_table']} where gr_id = '{$_POST['gr_id']}' ";
+ $sql = " select count(*) as cnt from {$g5['group_table']} where gr_id = '{$gr_id}' ";
$row = sql_fetch($sql);
if ($row['cnt'])
alert('이미 존재하는 그룹 ID 입니다.');
$sql = " insert into {$g5['group_table']}
- set gr_id = '{$_POST['gr_id']}',
+ set gr_id = '{$gr_id}',
{$sql_common} ";
sql_query($sql);
@@ -62,7 +83,7 @@ if ($w == '') {
$sql = " update {$g5['group_table']}
set {$sql_common}
- where gr_id = '{$_POST['gr_id']}' ";
+ where gr_id = '{$gr_id}' ";
sql_query($sql);
} else {
@@ -71,5 +92,4 @@ if ($w == '') {
run_event('admin_boardgroup_form_update', $gr_id, $w);
-goto_url('./boardgroup_form.php?w=u&gr_id='.$gr_id.'&'.$qstr);
-?>
+goto_url('./boardgroup_form.php?w=u&gr_id='.$gr_id.'&'.$qstr);
\ No newline at end of file
diff --git a/adm/boardgroup_list.php b/adm/boardgroup_list.php
index 08cd18382..793d5a28b 100644
--- a/adm/boardgroup_list.php
+++ b/adm/boardgroup_list.php
@@ -2,7 +2,7 @@
$sub_menu = "300200";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
if (!isset($group['gr_device'])) {
// 게시판 그룹 사용 필드 추가
@@ -10,7 +10,7 @@ if (!isset($group['gr_device'])) {
// pc : pc 전용 사용
// mobile : mobile 전용 사용
// none : 사용 안함
- sql_query(" ALTER TABLE `{$g5['board_group_table']}` ADD `gr_device` ENUM( 'both', 'pc', 'mobile' ) NOT NULL DEFAULT 'both' AFTER `gr_subject` ", false);
+ sql_query(" ALTER TABLE `{$g5['group_table']}` ADD `gr_device` ENUM( 'both', 'pc', 'mobile' ) NOT NULL DEFAULT 'both' AFTER `gr_subject` ", false);
}
$sql_common = " from {$g5['group_table']} ";
@@ -66,9 +66,9 @@ $colspan = 10;
@@ -861,7 +862,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
코리아크레딧뷰로 KCB 회원사ID
서비스에 가입되어 있지 않다면, KCB와 계약체결 후 회원사ID를 발급 받으실 수 있습니다. 이용하시려는 서비스에 대한 계약을 아이핀, 휴대폰 본인확인 각각 체결해주셔야 합니다. 아이핀 본인확인 테스트의 경우에는 KCB 회원사ID가 필요 없으나, 휴대폰 본인확인 테스트의 경우 KCB 에서 따로 발급 받으셔야 합니다.') ?>
- KCB 아이핀 서비스 신청페이지
+ KCB 아이핀 서비스 신청페이지
KCB 휴대폰 본인확인 서비스 신청페이지
@@ -870,7 +871,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
서비스에 가입되어 있지 않다면, 본인확인 서비스 신청페이지에서 서비스 신청 후 사이트코드를 발급 받으실 수 있습니다.') ?>
SM
- NHN KCP 휴대폰 본인확인 서비스 신청페이지
+ NHN KCP 휴대폰 본인확인 서비스 신청페이지
@@ -878,21 +879,21 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
서비스에 가입되어 있지 않다면, 본인확인 서비스 신청페이지에서 서비스 신청 후 상점아이디를 발급 받으실 수 있습니다.LG유플러스 휴대폰본인확인은 ActiveX 설치가 필요하므로 Internet Explorer 에서만 사용할 수 있습니다. ') ?>
si_
- LG유플러스 본인확인 서비스 신청페이지
+ LG유플러스 본인확인 서비스 신청페이지
LG유플러스 MERT KEY
계약정보 -> 상점정보관리에서 확인하실 수 있습니다.') ?>
-
+
본인확인 이용제한
회수제한은 실서비스에서 아이핀과 휴대폰 본인확인 인증에 개별 적용됩니다. 0 으로 설정하시면 회수제한이 적용되지 않습니다.'); ?>
- 회
+ 회
@@ -1129,7 +1130,7 @@ include_once('_rewrite_config_form.php');
페이코 로그인을 사용합니다
@@ -1137,73 +1138,73 @@ include_once('_rewrite_config_form.php');
네이버 Client ID
- 앱 등록하기
+ 앱 등록하기
네이버 Client Secret
-
+
페이스북 앱 ID
- 앱 등록하기
+ 앱 등록하기
페이스북 앱 Secret
-
+
트위터 컨슈머 Key
- 앱 등록하기
+ 앱 등록하기
트위터 컨슈머 Secret
-
+
구글 Client ID
- 앱 등록하기
+ 앱 등록하기
구글 Client Secret
-
+
구글 짧은주소 API Key
- API Key 등록하기
+ API Key 등록하기
카카오 REST API 키
- 앱 등록하기
+ 앱 등록하기
카카오 Client Secret
-
+
카카오 JavaScript 키
-
+
페이코 Client ID
- 앱 등록하기
+ 앱 등록하기
페이코 Secret
-
+
@@ -1275,20 +1276,20 @@ include_once('_rewrite_config_form.php');
아이코드 회원아이디 (구버전)
-
+
아이코드 비밀번호 (구버전)
-
+
요금제 (구버전)
-
+
충전 잔액 (구버전)
원.
- 충전하기
+ 충전하기
@@ -1316,7 +1317,7 @@ include_once('_rewrite_config_form.php');
아이코드 토큰키 (JSON버전)
SMS 전송유형을 LMS로 설정시 90바이트 이내는 SMS, 90 ~ 2000 바이트는 LMS 그 이상은 절삭 되어 LMS로 발송됩니다."); ?>
-
+
토큰키관리 메뉴에서 생성한 토큰키를 입력합니다."); ?>
서버아이피 :
@@ -1434,6 +1435,26 @@ $(function(){
function fconfigform_submit(f)
{
+ var current_user_ip = "";
+ var cf_intercept_ip_val = f.cf_intercept_ip.value;
+
+ if( cf_intercept_ip_val && current_user_ip ){
+ var cf_intercept_ips = cf_intercept_ip_val.split("\n");
+
+ for(var i=0; i < cf_intercept_ips.length; i++){
+ if ( cf_intercept_ips[i].trim() ) {
+ cf_intercept_ips[i] = cf_intercept_ips[i].replace(".", "\.");
+ cf_intercept_ips[i] = cf_intercept_ips[i].replace("+", "[0-9\.]+");
+
+ var re = new RegExp(cf_intercept_ips[i]);
+ if ( re.test(current_user_ip) ){
+ alert("현재 접속 IP : "+ current_user_ip +" 가 차단될수 있기 때문에, 다른 IP를 입력해 주세요.");
+ return false;
+ }
+ }
+ }
+ }
+
f.action = "./config_form_update.php";
return true;
}
@@ -1509,5 +1530,4 @@ if($config['cf_cert_use']) {
}
}
-include_once ('./admin.tail.php');
-?>
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/config_form_update.php b/adm/config_form_update.php
index 250fc9082..cd31cb1e0 100644
--- a/adm/config_form_update.php
+++ b/adm/config_form_update.php
@@ -4,43 +4,184 @@ include_once('./_common.php');
check_demo();
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
if ($is_admin != 'super')
alert('최고관리자만 접근 가능합니다.');
+$cf_title = isset($_POST['cf_title']) ? strip_tags(clean_xss_attributes($_POST['cf_title'])) : '';
+$cf_admin = isset($_POST['cf_admin']) ? clean_xss_tags($_POST['cf_admin'], 1, 1) : '';
+$posts = array();
+
$mb = get_member($cf_admin);
-if (!$mb['mb_id'])
+
+if (! (isset($mb['mb_id']) && $mb['mb_id']))
alert('최고관리자 회원아이디가 존재하지 않습니다.');
check_admin_token();
+$cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',', $_POST['cf_social_servicelist']) : '';
+
+$check_keys = array('cf_lg_mid', 'cf_lg_mert_key', 'cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret');
+
+foreach( $check_keys as $key ){
+ if ( isset($_POST[$key]) && $_POST[$key] ){
+ $posts[$key] = $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
+ }
+}
+
+$posts['cf_icode_server_port'] = $_POST['cf_icode_server_port'] = isset($_POST['cf_icode_server_port']) ? preg_replace('/[^0-9]/', '', $_POST['cf_icode_server_port']) : '7295';
+
+if(isset($_POST['cf_intercept_ip']) && $_POST['cf_intercept_ip']){
+
+ $pattern = explode("\n", trim($_POST['cf_intercept_ip']));
+ for ($i=0; $i 'int',
+'cf_use_homepage' => 'int',
+'cf_req_homepage' => 'int',
+'cf_use_tel' => 'int',
+'cf_req_tel' => 'int',
+'cf_use_hp' => 'int',
+'cf_req_hp' => 'int',
+'cf_use_addr' => 'int',
+'cf_req_addr' => 'int',
+'cf_use_signature' => 'int',
+'cf_req_signature' => 'int',
+'cf_use_profile' => 'int',
+'cf_req_profile' => 'int',
+'cf_register_level' => 'int',
+'cf_register_point' => 'int',
+'cf_icon_level' => 'int',
+'cf_use_recommend' => 'int',
+'cf_leave_day' => 'int',
+'cf_search_part' => 'int',
+'cf_email_use' => 'int',
+'cf_email_wr_super_admin' => 'int',
+'cf_email_wr_group_admin' => 'int',
+'cf_email_wr_board_admin' => 'int',
+'cf_email_wr_write' => 'int',
+'cf_email_wr_comment_all' => 'int',
+'cf_email_mb_super_admin' => 'int',
+'cf_email_mb_member' => 'int',
+'cf_email_po_super_admin' => 'int',
+'cf_prohibit_id' => 'text',
+'cf_prohibit_email' => 'text',
+'cf_new_del' => 'int',
+'cf_memo_del' => 'int',
+'cf_visit_del' => 'int',
+'cf_popular_del' => 'int',
+'cf_use_member_icon' => 'int',
+'cf_member_icon_size' => 'int',
+'cf_member_icon_width' => 'int',
+'cf_member_icon_height' => 'int',
+'cf_member_img_size' => 'int',
+'cf_member_img_width' => 'int',
+'cf_member_img_height' => 'int',
+'cf_login_minutes' => 'int',
+'cf_formmail_is_member' => 'int',
+'cf_page_rows' => 'int',
+'cf_mobile_page_rows' => 'int',
+'cf_social_login_use' => 'int',
+'cf_cert_req' => 'int',
+'cf_cert_use' => 'int',
+'cf_cert_ipin' => 'char',
+'cf_cert_hp' => 'char',
+'cf_admin_email' => 'char',
+'cf_admin_email_name' => 'char',
+'cf_add_script' => 'text',
+'cf_use_point' => 'int',
+'cf_point_term' => 'int',
+'cf_use_copy_log' => 'int',
+'cf_login_point' => 'int',
+'cf_cut_name' => 'int',
+'cf_nick_modify' => 'int',
+'cf_new_skin' => 'char',
+'cf_new_rows' => 'int',
+'cf_search_skin' => 'char',
+'cf_connect_skin' => 'char',
+'cf_faq_skin' => 'char',
+'cf_read_point' => 'int',
+'cf_write_point' => 'int',
+'cf_comment_point' => 'int',
+'cf_download_point' => 'int',
+'cf_write_pages' => 'int',
+'cf_mobile_pages' => 'int',
+'cf_link_target' => 'char',
+'cf_delay_sec' => 'int',
+'cf_filter' => 'text',
+'cf_possible_ip' => 'text',
+'cf_analytics' => 'text',
+'cf_add_meta' => 'text',
+'cf_member_skin' => 'char',
+'cf_image_extension' => 'char',
+'cf_flash_extension' => 'char',
+'cf_movie_extension' => 'char',
+'cf_visit' => 'char',
+'cf_stipulation' => 'text',
+'cf_privacy' => 'text',
+'cf_open_modify' => 'int',
+'cf_memo_send_point' => 'int',
+'cf_mobile_new_skin' => 'char',
+'cf_mobile_search_skin' => 'char',
+'cf_mobile_connect_skin' => 'char',
+'cf_mobile_faq_skin' => 'char',
+'cf_mobile_member_skin' => 'char',
+'cf_captcha_mp3' => 'char',
+'cf_cert_limit' => 'int',
+'cf_sms_use' => 'char',
+'cf_sms_type' => 'char',
+'cf_icode_id' => 'char',
+'cf_icode_pw' => 'char',
+'cf_icode_server_ip' => 'char',
+'cf_captcha' => 'char',
+'cf_syndi_token' => '',
+'cf_syndi_except' => ''
+);
+
+for($i=1;$i<=10;$i++){
+ $check_keys['cf_'.$i.'_subj'] = isset($_POST['cf_'.$i.'_subj']) ? $_POST['cf_'.$i.'_subj'] : '';
+ $check_keys['cf_'.$i] = isset($_POST['cf_'.$i]) ? $_POST['cf_'.$i] : '';
+}
+
+foreach( $check_keys as $k => $v ){
+ if( $v === 'int' ){
+ $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? (int) $_POST[$k] : 0;
+ } else {
+ if(in_array($k, array('cf_analytics', 'cf_add_meta', 'cf_add_script', 'cf_stipulation', 'cf_privacy'))){
+ $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? $_POST[$k] : '';
+ } else {
+ $posts[$key] = $_POST[$k] = isset($_POST[$k]) ? strip_tags(clean_xss_attributes($_POST[$k])) : '';
+ }
+ }
+}
+
// 본인확인을 사용할 경우 아이핀, 휴대폰인증 중 하나는 선택되어야 함
if($_POST['cf_cert_use'] && !$_POST['cf_cert_ipin'] && !$_POST['cf_cert_hp'])
alert('본인확인을 위해 아이핀 또는 휴대폰 본인학인 서비스를 하나이상 선택해 주십시오');
if(!$_POST['cf_cert_use']) {
- $_POST['cf_cert_ipin'] = '';
- $_POST['cf_cert_hp'] = '';
+ $posts[$key] = $_POST['cf_cert_ipin'] = '';
+ $posts[$key] = $_POST['cf_cert_hp'] = '';
}
-$cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',', $_POST['cf_social_servicelist']) : '';
-
-$_POST['cf_title'] = strip_tags(clean_xss_attributes($_POST['cf_title']));
-
-$check_keys = array('cf_lg_mid', 'cf_lg_mert_key', 'cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret');
-
-foreach( $check_keys as $key ){
- if ( isset($_POST[$key]) && $_POST[$key] ){
- $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
- }
-}
-
-$_POST['cf_icode_server_port'] = isset($_POST['cf_icode_server_port']) ? preg_replace('/[^0-9]/', '', $_POST['cf_icode_server_port']) : '7295';
-
$sql = " update {$g5['config_table']}
- set cf_title = '{$_POST['cf_title']}',
- cf_admin = '{$_POST['cf_admin']}',
+ set cf_title = '{$cf_title}',
+ cf_admin = '{$cf_admin}',
cf_admin_email = '{$_POST['cf_admin_email']}',
cf_admin_email_name = '{$_POST['cf_admin_email_name']}',
cf_add_script = '{$_POST['cf_add_script']}',
@@ -199,5 +340,4 @@ run_event('admin_config_form_update');
update_rewrite_rules();
-goto_url('./config_form.php', false);
-?>
\ No newline at end of file
+goto_url('./config_form.php', false);
\ No newline at end of file
diff --git a/adm/contentform.php b/adm/contentform.php
index 4a8eeb1c6..7aa1184f2 100644
--- a/adm/contentform.php
+++ b/adm/contentform.php
@@ -3,7 +3,9 @@ $sub_menu = '300600';
include_once('./_common.php');
include_once(G5_EDITOR_LIB);
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
+
+$co_id = isset($_REQUEST['co_id']) ? preg_replace('/[^a-z0-9_]/i', '', $_REQUEST['co_id']) : '';
// 상단, 하단 파일경로 필드 추가
if(!sql_query(" select co_include_head from {$g5['content_table']} limit 1 ", false)) {
@@ -51,6 +53,13 @@ else
{
$html_title .= ' 입력';
$co = array(
+ 'co_id' => '',
+ 'co_subject' => '',
+ 'co_content' => '',
+ 'co_mobile_content' => '',
+ 'co_include_head' => '',
+ 'co_include_tail' => '',
+ 'co_tag_filter_use' => 1,
'co_html' => 2,
'co_skin' => 'basic',
'co_mobile_skin' => 'basic'
@@ -153,6 +162,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
750)
@@ -177,6 +187,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
750)
@@ -284,5 +295,4 @@ function frmcontentform_check(f)
+include_once (G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/contentformupdate.php b/adm/contentformupdate.php
index af8c35007..0c7f75e57 100644
--- a/adm/contentformupdate.php
+++ b/adm/contentformupdate.php
@@ -6,28 +6,37 @@ if ($w == "u" || $w == "d")
check_demo();
if ($w == 'd')
- auth_check($auth[$sub_menu], "d");
+ auth_check_menu($auth, $sub_menu, "d");
else
- auth_check($auth[$sub_menu], "w");
+ auth_check_menu($auth, $sub_menu, "w");
check_admin_token();
+$co_row = array('co_id'=>'', 'co_include_head'=>'', 'co_include_tail'=>'');
+
if ($w == "" || $w == "u")
{
- if(preg_match("/[^a-z0-9_]/i", $co_id)) alert("ID 는 영문자, 숫자, _ 만 가능합니다.");
+ if(isset($_REQUEST['co_id']) && preg_match("/[^a-z0-9_]/i", $_REQUEST['co_id'])) alert("ID 는 영문자, 숫자, _ 만 가능합니다.");
$sql = " select * from {$g5['content_table']} where co_id = '$co_id' ";
$co_row = sql_fetch($sql);
}
-$co_id = preg_replace('/[^a-z0-9_]/i', '', $co_id);
-$co_subject = strip_tags(clean_xss_attributes($co_subject));
-$co_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_head, 0, 255));
-$co_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_tail, 0, 255));
+$co_id = isset($_REQUEST['co_id']) ? preg_replace('/[^a-z0-9_]/i', '', $_REQUEST['co_id']) : '';
+$co_subject = isset($_POST['co_subject']) ? strip_tags(clean_xss_attributes($_POST['co_subject'])) : '';
+$co_include_head = isset($_POST['co_include_head']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['co_include_head'], 0, 255)) : '';
+$co_include_tail = isset($_POST['co_include_tail']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['co_include_tail'], 0, 255)) : '';
$co_tag_filter_use = isset($_POST['co_tag_filter_use']) ? (int) $_POST['co_tag_filter_use'] : 1;
+$co_himg_del = (isset($_POST['co_himg_del']) && $_POST['co_himg_del']) ? 1 : 0;
+$co_timg_del = (isset($_POST['co_timg_del']) && $_POST['co_timg_del']) ? 1 : 0;
+$co_html = isset($_POST['co_html']) ? (int) $_POST['co_html'] : 0;
+$co_content = isset($_POST['co_content']) ? $_POST['co_content'] : '';
+$co_mobile_content = isset($_POST['co_mobile_content']) ? $_POST['co_mobile_content'] : '';
+$co_skin = isset($_POST['co_skin']) ? clean_xss_tags($_POST['co_skin'], 1, 1) : '';
+$co_mobile_skin = isset($_POST['co_mobile_skin']) ? clean_xss_tags($_POST['co_mobile_skin'], 1, 1) : '';
// 관리자가 자동등록방지를 사용해야 할 경우
-if (($co_row['co_include_head'] !== $co_include_head || $co_row['co_include_tail'] !== $co_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
+if ((( isset($co_row['co_include_head']) && $co_row['co_include_head'] !== $co_include_head ) || ( isset($co_row['co_include_tail']) && $co_row['co_include_tail'] !== $co_include_tail )) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
if (!chk_captcha()) {
@@ -92,7 +101,7 @@ $sql_common = " co_include_head = '$co_include_head',
if ($w == "")
{
$row = $co_row;
- if ($row['co_id'])
+ if (isset($row['co_id']) && $row['co_id'])
alert("이미 같은 ID로 등록된 내용이 있습니다.");
$sql = " insert {$g5['content_table']}
@@ -145,5 +154,4 @@ if ($w == "" || $w == "u")
else
{
goto_url("./contentlist.php");
-}
-?>
+}
\ No newline at end of file
diff --git a/adm/contentlist.php b/adm/contentlist.php
index a23437423..cf4c54660 100644
--- a/adm/contentlist.php
+++ b/adm/contentlist.php
@@ -2,7 +2,7 @@
$sub_menu = '300600';
include_once('./_common.php');
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
if( !isset($g5['content_table']) ){
die(' /data/dbconfig.php 파일에 $g5[\'content_table\'] = G5_TABLE_PREFIX.\'content\'; 를 추가해 주세요.');
@@ -94,5 +94,4 @@ $result = sql_query($sql);
+include_once (G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/dbupgrade.php b/adm/dbupgrade.php
index 23ae7916b..d5d954d1f 100644
--- a/adm/dbupgrade.php
+++ b/adm/dbupgrade.php
@@ -2,7 +2,7 @@
$sub_menu = '100410';
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$g5['title'] = 'DB 업그레이드';
include_once('./admin.head.php');
@@ -189,5 +189,4 @@ $db_upgrade_msg = $is_check ? 'DB 업그레이드가 완료되었습니다.' : '
\ No newline at end of file
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/faqform.php b/adm/faqform.php
index f5791df49..33024c77d 100644
--- a/adm/faqform.php
+++ b/adm/faqform.php
@@ -3,16 +3,18 @@ $sub_menu = '300700';
include_once('./_common.php');
include_once(G5_EDITOR_LIB);
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
-$fm_id = (int) $fm_id;
-$fa_id = isset($fa_id) ? (int) $fa_id : 0;
+$fm_id = isset($_GET['fm_id']) ? (int) $_GET['fm_id'] : 0;
+$fa_id = isset($_GET['fa_id']) ? (int) $_GET['fa_id'] : 0;
$sql = " select * from {$g5['faq_master_table']} where fm_id = '$fm_id' ";
$fm = sql_fetch($sql);
$html_title = 'FAQ '.$fm['fm_subject'];
+$fa = array('fa_id'=>0, 'fm_id'=>0, 'fa_subject'=>'', 'fa_content'=>'', 'fa_order'=>0);
+
if ($w == "u")
{
$html_title .= " 수정";
@@ -97,5 +99,4 @@ function frmfaqform_check(f)
+include_once (G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/faqformupdate.php b/adm/faqformupdate.php
index 35b8dcb30..a68984bcf 100644
--- a/adm/faqformupdate.php
+++ b/adm/faqformupdate.php
@@ -6,12 +6,18 @@ if ($w == "u" || $w == "d")
check_demo();
if ($w == 'd')
- auth_check($auth[$sub_menu], "d");
+ auth_check_menu($auth, $sub_menu, "d");
else
- auth_check($auth[$sub_menu], "w");
+ auth_check_menu($auth, $sub_menu, "w");
check_admin_token();
+$fm_id = isset($_REQUEST['fm_id']) ? (int) $_REQUEST['fm_id'] : 0;
+$fa_id = isset($_REQUEST['fa_id']) ? (int) $_REQUEST['fa_id'] : 0;
+$fa_subject = isset($_POST['fa_subject']) ? $_POST['fa_subject'] : '';
+$fa_content = isset($_POST['fa_content']) ? $_POST['fa_content'] : '';
+$fa_order = isset($_POST['fa_order']) ? (int) $_POST['fa_order'] : 0;
+
$sql_common = " fa_subject = '$fa_subject',
fa_content = '$fa_content',
fa_order = '$fa_order' ";
@@ -41,5 +47,4 @@ else if ($w == "d")
if ($w == 'd')
goto_url("./faqlist.php?fm_id=$fm_id");
else
- goto_url("./faqform.php?w=u&fm_id=$fm_id&fa_id=$fa_id");
-?>
+ goto_url("./faqform.php?w=u&fm_id=$fm_id&fa_id=$fa_id");
\ No newline at end of file
diff --git a/adm/faqlist.php b/adm/faqlist.php
index 6f4849bb0..eccd16772 100644
--- a/adm/faqlist.php
+++ b/adm/faqlist.php
@@ -2,11 +2,11 @@
$sub_menu = '300700';
include_once('./_common.php');
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = 'FAQ 상세관리';
-if ($fm_subject){
- $fm_subject = clean_xss_tags(strip_tags($fm_subject));
+if (isset($_REQUEST['fm_subject'])){
+ $fm_subject = clean_xss_tags($_REQUEST['fm_subject'], 1, 1, 255);
$g5['title'] .= ' : '.$fm_subject;
}
@@ -96,5 +96,4 @@ $result = sql_query($sql);
+include_once (G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/faqmasterform.php b/adm/faqmasterform.php
index 4ac3f6f80..5e3410615 100644
--- a/adm/faqmasterform.php
+++ b/adm/faqmasterform.php
@@ -3,11 +3,11 @@ $sub_menu = '300700';
include_once('./_common.php');
include_once(G5_EDITOR_LIB);
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
$html_title = 'FAQ';
-$fm_id = preg_replace('/[^0-9]/', '', $fm_id);
+$fm_id = isset($_GET['fm_id']) ? preg_replace('/[^0-9]/', '', $_GET['fm_id']) : 0;
if ($w == "u")
{
@@ -21,7 +21,7 @@ if ($w == "u")
else
{
$html_title .= ' 입력';
- $fm = array();
+ $fm = array('fm_order'=>'', 'fm_subject'=>'', 'fm_id'=>0, 'fm_head_html'=> '', 'fm_tail_html'=> '', 'fm_mobile_head_html' => '', 'fm_mobile_tail_html' => '');
}
$g5['title'] = $html_title.' 관리';
@@ -72,6 +72,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
750)
@@ -96,6 +97,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
750)
@@ -162,5 +164,4 @@ function frmfaqmasterform_check(f)
+include_once (G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/faqmasterformupdate.php b/adm/faqmasterformupdate.php
index 609e805b3..9c26300c7 100644
--- a/adm/faqmasterformupdate.php
+++ b/adm/faqmasterformupdate.php
@@ -5,21 +5,29 @@ include_once('./_common.php');
if ($w == "u" || $w == "d")
check_demo();
-if ($W == 'd')
- auth_check($auth[$sub_menu], "d");
+if ($w == 'd')
+ auth_check_menu($auth, $sub_menu, "d");
else
- auth_check($auth[$sub_menu], "w");
+ auth_check_menu($auth, $sub_menu, "w");
check_admin_token();
@mkdir(G5_DATA_PATH."/faq", G5_DIR_PERMISSION);
@chmod(G5_DATA_PATH."/faq", G5_DIR_PERMISSION);
+$fm_id = isset($_REQUEST['fm_id']) ? (int) $_REQUEST['fm_id'] : 0;
+$fm_himg_del = isset($_POST['fm_himg_del']) ? (int) $_POST['fm_himg_del'] : 0;
+$fm_timg_del = isset($_POST['fm_timg_del']) ? (int) $_POST['fm_timg_del'] : 0;
+$fm_subject = isset($_POST['fm_subject']) ? strip_tags(clean_xss_attributes($_POST['fm_subject'])) : '';
+$fm_head_html = isset($_POST['fm_head_html']) ? $_POST['fm_head_html'] : '';
+$fm_tail_html = isset($_POST['fm_tail_html']) ? $_POST['fm_tail_html'] : '';
+$fm_mobile_head_html = isset($_POST['fm_mobile_head_html']) ? $_POST['fm_mobile_head_html'] : '';
+$fm_mobile_tail_html = isset($_POST['fm_mobile_tail_html']) ? $_POST['fm_mobile_tail_html'] : '';
+$fm_order = isset($_POST['fm_order']) ? (int) $_POST['fm_order'] : 0;
+
if ($fm_himg_del) @unlink(G5_DATA_PATH."/faq/{$fm_id}_h");
if ($fm_timg_del) @unlink(G5_DATA_PATH."/faq/{$fm_id}_t");
-$fm_subject = strip_tags(clean_xss_attributes($fm_subject));
-
$sql_common = " set fm_subject = '$fm_subject',
fm_head_html = '$fm_head_html',
fm_tail_html = '$fm_tail_html',
@@ -72,5 +80,4 @@ if ($w == "" || $w == "u")
goto_url("./faqmasterform.php?w=u&fm_id=$fm_id");
}
else
- goto_url("./faqmasterlist.php");
-?>
+ goto_url("./faqmasterlist.php");
\ No newline at end of file
diff --git a/adm/faqmasterlist.php b/adm/faqmasterlist.php
index 50dfc11e0..d5abfbb9d 100644
--- a/adm/faqmasterlist.php
+++ b/adm/faqmasterlist.php
@@ -2,7 +2,7 @@
$sub_menu = '300700';
include_once('./_common.php');
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
//dbconfig파일에 $g5['faq_table'] , $g5['faq_master_table'] 배열변수가 있는지 체크
if( !isset($g5['faq_table']) || !isset($g5['faq_master_table']) ){
@@ -124,5 +124,4 @@ $result = sql_query($sql);
+include_once (G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/index.php b/adm/index.php
index 4a2020238..2befa9940 100644
--- a/adm/index.php
+++ b/adm/index.php
@@ -100,11 +100,6 @@ $colspan = 12;
$mb_nick = get_sideview($row['mb_id'], get_text($row['mb_nick']), $row['mb_email'], $row['mb_homepage']);
$mb_id = $row['mb_id'];
- if ($row['mb_leave_date'])
- $mb_id = $mb_id;
- else if ($row['mb_intercept_date'])
- $mb_id = $mb_id;
-
?>
@@ -138,7 +133,7 @@ $sql_common = " from {$g5['board_new_table']} a, {$g5['board_table']} b, {$g5['g
if ($gr_id)
$sql_common .= " and b.gr_id = '$gr_id' ";
-if ($view) {
+if (isset($view) && $view) {
if ($view == 'w')
$sql_common .= " and a.wr_id = a.wr_parent ";
else if ($view == 'c')
@@ -314,5 +309,4 @@ $colspan = 7;
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/mail_delete.php b/adm/mail_delete.php
index a190802eb..7d2999cfa 100644
--- a/adm/mail_delete.php
+++ b/adm/mail_delete.php
@@ -4,21 +4,20 @@ include_once('./_common.php');
check_demo();
-auth_check($auth[$sub_menu], 'd');
+auth_check_menu($auth, $sub_menu, 'd');
check_admin_token();
-$count = count($_POST['chk']);
+$post_count_chk = (isset($_POST['chk']) && is_array($_POST['chk'])) ? count($_POST['chk']) : 0;
-if(!$count)
+if(! $post_count_chk)
alert('삭제할 메일목록을 1개이상 선택해 주세요.');
-for($i=0; $i<$count; $i++) {
- $ma_id = $_POST['chk'][$i];
+for($i=0; $i<$post_count_chk; $i++) {
+ $ma_id = isset($_POST['chk'][$i]) ? (int) $_POST['chk'][$i] : 0;
$sql = " delete from {$g5['mail_table']} where ma_id = '$ma_id' ";
sql_query($sql);
}
-goto_url('./mail_list.php');
-?>
\ No newline at end of file
+goto_url('./mail_list.php');
\ No newline at end of file
diff --git a/adm/mail_form.php b/adm/mail_form.php
index 6ee6fb95b..a7671fb3b 100644
--- a/adm/mail_form.php
+++ b/adm/mail_form.php
@@ -3,15 +3,16 @@ $sub_menu = "200300";
include_once('./_common.php');
include_once(G5_EDITOR_LIB);
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$html_title = '회원메일';
+$ma_id = isset($_GET['ma_id']) ? (int) $_GET['ma_id'] : 0;
+$ma = array('ma_id'=>0, 'ma_subject'=>'', 'ma_content'=>'');
+
if ($w == 'u') {
$html_title .= '수정';
$readonly = ' readonly';
-
- $ma_id = (int) $ma_id;
$sql = " select * from {$g5['mail_table']} where ma_id = '{$ma_id}' ";
$ma = sql_fetch($sql);
@@ -82,5 +83,4 @@ document.fmailform.ma_subject.focus();
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/mail_list.php b/adm/mail_list.php
index 587a8ddb0..9e2368ff4 100644
--- a/adm/mail_list.php
+++ b/adm/mail_list.php
@@ -2,7 +2,7 @@
$sub_menu = '200300';
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$sql_common = " from {$g5['mail_table']} ";
@@ -101,5 +101,4 @@ $(function() {
\ No newline at end of file
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/mail_preview.php b/adm/mail_preview.php
index 16abd479d..a13020e5c 100644
--- a/adm/mail_preview.php
+++ b/adm/mail_preview.php
@@ -3,7 +3,9 @@ $sub_menu = "200300";
include_once('./_common.php');
include_once(G5_LIB_PATH.'/mailer.lib.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$ma_id = isset($_REQUEST['ma_id']) ? (int) $_REQUEST['ma_id'] : 0;
$se = sql_fetch("select ma_subject, ma_content from {$g5['mail_table']} where ma_id = '{$ma_id}' ");
diff --git a/adm/mail_select_form.php b/adm/mail_select_form.php
index a8115297d..076e3a60f 100644
--- a/adm/mail_select_form.php
+++ b/adm/mail_select_form.php
@@ -5,7 +5,9 @@ include_once('./_common.php');
if (!$config['cf_email_use'])
alert('환경설정에서 \'메일발송 사용\'에 체크하셔야 메일을 발송할 수 있습니다.');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$ma_id = isset($_GET['ma_id']) ? (int) $_GET['ma_id'] : 0;
$sql = " select * from {$g5['mail_table']} where ma_id = '$ma_id' ";
$ma = sql_fetch($sql);
@@ -26,8 +28,8 @@ $last_option = explode('||', $ma['ma_last_option']);
for ($i=0; $i
@@ -55,15 +61,15 @@ include_once('./admin.head.php');
> 전체
> 구간
- 에서
- 까지
+ 에서
+ 까지
E-mail
-
+
@@ -118,5 +124,4 @@ include_once('./admin.head.php');
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/mail_select_list.php b/adm/mail_select_list.php
index b78b55375..e08032e79 100644
--- a/adm/mail_select_list.php
+++ b/adm/mail_select_list.php
@@ -2,7 +2,7 @@
$sub_menu = "200300";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$ma_last_option = "";
@@ -117,5 +117,4 @@ include_once('./admin.head.php');
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/mail_select_update.php b/adm/mail_select_update.php
index 219e58573..4a7ba5be8 100644
--- a/adm/mail_select_update.php
+++ b/adm/mail_select_update.php
@@ -2,7 +2,7 @@
$sub_menu = "200300";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
$html_title = '회원메일 발송';
@@ -26,14 +26,12 @@ echo "";
-
-
+
\ No newline at end of file
diff --git a/adm/mail_test.php b/adm/mail_test.php
index bc321f545..3731a3f2a 100644
--- a/adm/mail_test.php
+++ b/adm/mail_test.php
@@ -7,7 +7,7 @@ if (!$config['cf_email_use'])
include_once(G5_LIB_PATH.'/mailer.lib.php');
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
check_demo();
@@ -17,6 +17,7 @@ $name = get_text($member['mb_name']);
$nick = $member['mb_nick'];
$mb_id = $member['mb_id'];
$email = $member['mb_email'];
+$ma_id = isset($_REQUEST['ma_id']) ? (int) $_REQUEST['ma_id'] : 0;
$sql = "select ma_subject, ma_content from {$g5['mail_table']} where ma_id = '{$ma_id}' ";
$ma = sql_fetch($sql);
@@ -35,5 +36,4 @@ $content = $content . '더 이상 정보 수신을 원치 않으시면 [
+alert($member['mb_nick'].'('.$member['mb_email'].')님께 테스트 메일을 발송하였습니다. 확인하여 주십시오.');
\ No newline at end of file
diff --git a/adm/mail_update.php b/adm/mail_update.php
index 04d04ac92..844aa4435 100644
--- a/adm/mail_update.php
+++ b/adm/mail_update.php
@@ -5,18 +5,19 @@ include_once('./_common.php');
if ($w == 'u' || $w == 'd')
check_demo();
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
check_admin_token();
$ma_id = isset($_POST['ma_id']) ? (int) $_POST['ma_id'] : 0;
$ma_subject = isset($_POST['ma_subject']) ? strip_tags(clean_xss_attributes($_POST['ma_subject'])) : '';
+$ma_content = isset($_POST['ma_content']) ? $_POST['ma_content'] : '';
if ($w == '')
{
$sql = " insert {$g5['mail_table']}
set ma_subject = '{$ma_subject}',
- ma_content = '{$_POST['ma_content']}',
+ ma_content = '{$ma_content}',
ma_time = '".G5_TIME_YMDHIS."',
ma_ip = '{$_SERVER['REMOTE_ADDR']}' ";
sql_query($sql);
@@ -25,7 +26,7 @@ else if ($w == 'u')
{
$sql = " update {$g5['mail_table']}
set ma_subject = '{$ma_subject}',
- ma_content = '{$_POST['ma_content']}',
+ ma_content = '{$ma_content}',
ma_time = '".G5_TIME_YMDHIS."',
ma_ip = '{$_SERVER['REMOTE_ADDR']}'
where ma_id = '{$ma_id}' ";
@@ -37,5 +38,4 @@ else if ($w == 'd')
sql_query($sql);
}
-goto_url('./mail_list.php');
-?>
+goto_url('./mail_list.php');
\ No newline at end of file
diff --git a/adm/member_delete.php b/adm/member_delete.php
index e536f6c57..6f675f347 100644
--- a/adm/member_delete.php
+++ b/adm/member_delete.php
@@ -4,11 +4,11 @@ include_once("./_common.php");
check_demo();
-auth_check($auth[$sub_menu], "d");
+auth_check_menu($auth, $sub_menu, "d");
-$mb = get_member($_POST['mb_id']);
+$mb = isset($_POST['mb_id']) ? get_member($_POST['mb_id']) : array();
-if (!$mb['mb_id'])
+if (! (isset($mb['mb_id']) && $mb['mb_id']))
alert("회원자료가 존재하지 않습니다.");
else if ($member['mb_id'] == $mb['mb_id'])
alert("로그인 중인 관리자는 삭제 할 수 없습니다.");
@@ -25,5 +25,4 @@ member_delete($mb['mb_id']);
if ($url)
goto_url("{$url}?$qstr&w=u&mb_id=$mb_id");
else
- goto_url("./member_list.php?$qstr");
-?>
+ goto_url("./member_list.php?$qstr");
\ No newline at end of file
diff --git a/adm/member_form.php b/adm/member_form.php
index 2b95e6581..470fccced 100644
--- a/adm/member_form.php
+++ b/adm/member_form.php
@@ -2,7 +2,46 @@
$sub_menu = "200100";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
+
+$mb = array(
+'mb_certify' => null,
+'mb_adult' => null,
+'mb_sms' => null,
+'mb_intercept_date' => null,
+'mb_id' => null,
+'mb_name' => null,
+'mb_nick' => null,
+'mb_point' => null,
+'mb_email' => null,
+'mb_homepage' => null,
+'mb_hp' => null,
+'mb_tel' => null,
+'mb_zip1' => null,
+'mb_zip2' => null,
+'mb_addr1' => null,
+'mb_addr2' => null,
+'mb_addr3' => null,
+'mb_addr_jibeon' => null,
+'mb_signature' => null,
+'mb_profile' => null,
+'mb_memo' => null,
+'mb_leave_date' => null,
+'mb_1' => null,
+'mb_2' => null,
+'mb_3' => null,
+'mb_4' => null,
+'mb_5' => null,
+'mb_6' => null,
+'mb_7' => null,
+'mb_8' => null,
+'mb_9' => null,
+'mb_10' => null,
+);
+
+$sound_only = '';
+$required_mb_id_class = '';
+$required_mb_password = '';
if ($w == '')
{
@@ -26,7 +65,6 @@ else if ($w == 'u')
alert('자신보다 권한이 높거나 같은 회원은 수정할 수 없습니다.');
$required_mb_id = 'readonly';
- $required_mb_password = '';
$html_title = '수정';
$mb['mb_name'] = get_text($mb['mb_name']);
@@ -243,7 +281,8 @@ add_javascript(G5_POSTCODE_JS, 0); //다음 주소 js
$icon_file = G5_DATA_PATH.'/member/'.$mb_dir.'/'.get_mb_icon_name($mb['mb_id']).'.gif';
if (file_exists($icon_file)) {
$icon_url = str_replace(G5_DATA_PATH, G5_DATA_URL, $icon_file);
- echo ' ';
+ $icon_filemtile = (defined('G5_USE_MEMBER_IMAGE_FILETIME') && G5_USE_MEMBER_IMAGE_FILETIME) ? '?'.filemtime($icon_file) : '';
+ echo ' ';
echo ' 삭제';
}
?>
@@ -258,8 +297,7 @@ add_javascript(G5_POSTCODE_JS, 0); //다음 주소 js
$mb_dir = substr($mb['mb_id'],0,2);
$icon_file = G5_DATA_PATH.'/member_image/'.$mb_dir.'/'.get_mb_icon_name($mb['mb_id']).'.gif';
if (file_exists($icon_file)) {
- $icon_url = str_replace(G5_DATA_PATH, G5_DATA_URL, $icon_file);
- echo ' ';
+ echo get_member_profile_img($mb['mb_id']);
echo ' 삭제';
}
?>
@@ -481,5 +519,4 @@ function fmember_submit(f)
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/member_form_update.php b/adm/member_form_update.php
index a0c87eb9d..163fbcb74 100644
--- a/adm/member_form_update.php
+++ b/adm/member_form_update.php
@@ -7,11 +7,14 @@ include_once(G5_LIB_PATH.'/thumbnail.lib.php');
if ($w == 'u')
check_demo();
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
check_admin_token();
-$mb_id = trim($_POST['mb_id']);
+$mb_id = isset($_POST['mb_id']) ? trim($_POST['mb_id']) : '';
+$mb_certify_case = isset($_POST['mb_certify_case']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_certify_case']) : '';
+$mb_certify = isset($_POST['mb_certify']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_certify']) : '';
+$mb_zip = isset($_POST['mb_zip']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_zip']) : '';
// 휴대폰번호 체크
$mb_hp = hyphen_hp_number($_POST['mb_hp']);
@@ -22,72 +25,101 @@ if($mb_hp) {
}
// 인증정보처리
-if($_POST['mb_certify_case'] && $_POST['mb_certify']) {
- $mb_certify = $_POST['mb_certify_case'];
- $mb_adult = $_POST['mb_adult'];
+if($mb_certify_case && $mb_certify) {
+ $mb_certify = isset($_POST['mb_certify_case']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_certify_case']) : '';
+ $mb_adult = isset($_POST['mb_adult']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_adult']) : '';
} else {
$mb_certify = '';
$mb_adult = 0;
}
-$mb_zip1 = substr($_POST['mb_zip'], 0, 3);
-$mb_zip2 = substr($_POST['mb_zip'], 3);
+$mb_zip1 = substr($mb_zip, 0, 3);
+$mb_zip2 = substr($mb_zip, 3);
$mb_email = isset($_POST['mb_email']) ? get_email_address(trim($_POST['mb_email'])) : '';
$mb_nick = isset($_POST['mb_nick']) ? trim(strip_tags($_POST['mb_nick'])) : '';
if ($msg = valid_mb_nick($mb_nick)) alert($msg, "", true, true);
-$sql_common = " mb_name = '{$_POST['mb_name']}',
+$posts = array();
+$check_keys = array(
+'mb_name',
+'mb_homepage',
+'mb_tel',
+'mb_addr1',
+'mb_addr2',
+'mb_addr3',
+'mb_addr_jibeon',
+'mb_signature',
+'mb_leave_date',
+'mb_intercept_date',
+'mb_mailling',
+'mb_sms',
+'mb_open',
+'mb_profile',
+'mb_level'
+);
+
+for($i=1;$i<=10;$i++){
+ $check_keys[] = 'mb_'.$i;
+}
+
+foreach( $check_keys as $key ){
+ $posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
+}
+
+$mb_memo = isset($_POST['mb_memo']) ? $_POST['mb_memo'] : '';
+
+$sql_common = " mb_name = '{$posts['mb_name']}',
mb_nick = '{$mb_nick}',
mb_email = '{$mb_email}',
- mb_homepage = '{$_POST['mb_homepage']}',
- mb_tel = '{$_POST['mb_tel']}',
+ mb_homepage = '{$posts['mb_homepage']}',
+ mb_tel = '{$posts['mb_tel']}',
mb_hp = '{$mb_hp}',
mb_certify = '{$mb_certify}',
mb_adult = '{$mb_adult}',
mb_zip1 = '$mb_zip1',
mb_zip2 = '$mb_zip2',
- mb_addr1 = '{$_POST['mb_addr1']}',
- mb_addr2 = '{$_POST['mb_addr2']}',
- mb_addr3 = '{$_POST['mb_addr3']}',
- mb_addr_jibeon = '{$_POST['mb_addr_jibeon']}',
- mb_signature = '{$_POST['mb_signature']}',
- mb_leave_date = '{$_POST['mb_leave_date']}',
- mb_intercept_date='{$_POST['mb_intercept_date']}',
- mb_memo = '{$_POST['mb_memo']}',
- mb_mailling = '{$_POST['mb_mailling']}',
- mb_sms = '{$_POST['mb_sms']}',
- mb_open = '{$_POST['mb_open']}',
- mb_profile = '{$_POST['mb_profile']}',
- mb_level = '{$_POST['mb_level']}',
- mb_1 = '{$_POST['mb_1']}',
- mb_2 = '{$_POST['mb_2']}',
- mb_3 = '{$_POST['mb_3']}',
- mb_4 = '{$_POST['mb_4']}',
- mb_5 = '{$_POST['mb_5']}',
- mb_6 = '{$_POST['mb_6']}',
- mb_7 = '{$_POST['mb_7']}',
- mb_8 = '{$_POST['mb_8']}',
- mb_9 = '{$_POST['mb_9']}',
- mb_10 = '{$_POST['mb_10']}' ";
+ mb_addr1 = '{$posts['mb_addr1']}',
+ mb_addr2 = '{$posts['mb_addr2']}',
+ mb_addr3 = '{$posts['mb_addr3']}',
+ mb_addr_jibeon = '{$posts['mb_addr_jibeon']}',
+ mb_signature = '{$posts['mb_signature']}',
+ mb_leave_date = '{$posts['mb_leave_date']}',
+ mb_intercept_date='{$posts['mb_intercept_date']}',
+ mb_memo = '{$mb_memo}',
+ mb_mailling = '{$posts['mb_mailling']}',
+ mb_sms = '{$posts['mb_sms']}',
+ mb_open = '{$posts['mb_open']}',
+ mb_profile = '{$posts['mb_profile']}',
+ mb_level = '{$posts['mb_level']}',
+ mb_1 = '{$posts['mb_1']}',
+ mb_2 = '{$posts['mb_2']}',
+ mb_3 = '{$posts['mb_3']}',
+ mb_4 = '{$posts['mb_4']}',
+ mb_5 = '{$posts['mb_5']}',
+ mb_6 = '{$posts['mb_6']}',
+ mb_7 = '{$posts['mb_7']}',
+ mb_8 = '{$posts['mb_8']}',
+ mb_9 = '{$posts['mb_9']}',
+ mb_10 = '{$posts['mb_10']}' ";
if ($w == '')
{
$mb = get_member($mb_id);
- if ($mb['mb_id'])
+ if (isset($mb['mb_id']) && $mb['mb_id'])
alert('이미 존재하는 회원아이디입니다.\\nID : '.$mb['mb_id'].'\\n이름 : '.$mb['mb_name'].'\\n닉네임 : '.$mb['mb_nick'].'\\n메일 : '.$mb['mb_email']);
// 닉네임중복체크
$sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_nick = '{$mb_nick}' ";
$row = sql_fetch($sql);
- if ($row['mb_id'])
+ if (isset($row['mb_id']) && $row['mb_id'])
alert('이미 존재하는 닉네임입니다.\\nID : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
// 이메일중복체크
$sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_email = '{$mb_email}' ";
$row = sql_fetch($sql);
- if ($row['mb_id'])
+ if (isset($row['mb_id']) && $row['mb_id'])
alert('이미 존재하는 이메일입니다.\\nID : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
sql_query(" insert into {$g5['member_table']} set mb_id = '{$mb_id}', mb_password = '".get_encrypt_string($mb_password)."', mb_datetime = '".G5_TIME_YMDHIS."', mb_ip = '{$_SERVER['REMOTE_ADDR']}', mb_email_certify = '".G5_TIME_YMDHIS."', {$sql_common} ");
@@ -95,7 +127,7 @@ if ($w == '')
else if ($w == 'u')
{
$mb = get_member($mb_id);
- if (!$mb['mb_id'])
+ if (! (isset($mb['mb_id']) && $mb['mb_id']))
alert('존재하지 않는 회원자료입니다.');
if ($is_admin != 'super' && $mb['mb_level'] >= $member['mb_level'])
@@ -105,19 +137,19 @@ else if ($w == 'u')
alert('최고관리자의 비밀번호를 수정할수 없습니다.');
}
- if ($_POST['mb_id'] == $member['mb_id'] && $_POST['mb_level'] != $mb['mb_level'])
+ if ($mb_id === $member['mb_id'] && $_POST['mb_level'] != $mb['mb_level'])
alert($mb['mb_id'].' : 로그인 중인 관리자 레벨은 수정 할 수 없습니다.');
// 닉네임중복체크
$sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_nick = '{$mb_nick}' and mb_id <> '$mb_id' ";
$row = sql_fetch($sql);
- if ($row['mb_id'])
+ if (isset($row['mb_id']) && $row['mb_id'])
alert('이미 존재하는 닉네임입니다.\\nID : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
// 이메일중복체크
$sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_email = '{$mb_email}' and mb_id <> '$mb_id' ";
$row = sql_fetch($sql);
- if ($row['mb_id'])
+ if (isset($row['mb_id']) && $row['mb_id'])
alert('이미 존재하는 이메일입니다.\\nID : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
if ($mb_password)
@@ -125,7 +157,7 @@ else if ($w == 'u')
else
$sql_password = "";
- if ($passive_certify)
+ if (isset($passive_certify) && $passive_certify)
$sql_certify = " , mb_email_certify = '".G5_TIME_YMDHIS."' ";
else
$sql_certify = "";
@@ -146,7 +178,7 @@ if( $w == '' || $w == 'u' ){
$mb_icon_img = get_mb_icon_name($mb_id).'.gif';
// 회원 아이콘 삭제
- if ($del_mb_icon)
+ if (isset($del_mb_icon) && $del_mb_icon)
@unlink(G5_DATA_PATH.'/member/'.$mb_dir.'/'.$mb_icon_img);
$image_regex = "/(\.(gif|jpe?g|png))$/i";
@@ -196,7 +228,7 @@ if( $w == '' || $w == 'u' ){
$mb_img_dir .= substr($mb_id,0,2);
// 회원 이미지 삭제
- if ($del_mb_img)
+ if (isset($del_mb_img) && $del_mb_img)
@unlink($mb_img_dir.'/'.$mb_icon_img);
// 아이콘 업로드
@@ -238,5 +270,4 @@ if( $w == '' || $w == 'u' ){
run_event('admin_member_form_update', $w, $mb_id);
-goto_url('./member_form.php?'.$qstr.'&w=u&mb_id='.$mb_id, false);
-?>
\ No newline at end of file
+goto_url('./member_form.php?'.$qstr.'&w=u&mb_id='.$mb_id, false);
\ No newline at end of file
diff --git a/adm/member_list.php b/adm/member_list.php
index e8bcf4611..248b62be8 100644
--- a/adm/member_list.php
+++ b/adm/member_list.php
@@ -2,7 +2,7 @@
$sub_menu = "200100";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$sql_common = " from {$g5['member_table']} ";
@@ -78,17 +78,17 @@ $colspan = 16;
검색대상
- >회원아이디
- >닉네임
- >이름
- >권한
- >E-MAIL
- >전화번호
- >휴대폰번호
- >포인트
- >가입일시
- >IP
- >추천인
+ >회원아이디
+ >닉네임
+ >이름
+ >권한
+ >E-MAIL
+ >전화번호
+ >휴대폰번호
+ >포인트
+ >가입일시
+ >IP
+ >추천인
검색어 필수
@@ -330,5 +330,4 @@ function fmemberlist_submit(f)
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/member_list_delete.php b/adm/member_list_delete.php
index f416a6011..eeab528f7 100644
--- a/adm/member_list_delete.php
+++ b/adm/member_list_delete.php
@@ -4,7 +4,7 @@ include_once("./_common.php");
check_demo();
-auth_check($auth[$sub_menu], "d");
+auth_check_menu($auth, $sub_menu, "d");
check_admin_token();
@@ -33,5 +33,4 @@ for ($i=0; $i alert('$msg'); ";
-goto_url("./member_list.php?$qstr");
-?>
+goto_url("./member_list.php?$qstr");
\ No newline at end of file
diff --git a/adm/member_list_update.php b/adm/member_list_update.php
index 7e250d4af..82a2db6c3 100644
--- a/adm/member_list_update.php
+++ b/adm/member_list_update.php
@@ -4,46 +4,54 @@ include_once('./_common.php');
check_demo();
-if (!count($_POST['chk'])) {
+if (! (isset($_POST['chk']) && is_array($_POST['chk']))) {
alert($_POST['act_button']." 하실 항목을 하나 이상 체크하세요.");
}
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
check_admin_token();
$mb_datas = array();
+$msg = '';
if ($_POST['act_button'] == "선택수정") {
for ($i=0; $i= $member['mb_level']) {
$msg .= $mb['mb_id'].' : 자신보다 권한이 높거나 같은 회원은 수정할 수 없습니다.\\n';
} else if ($member['mb_id'] == $mb['mb_id']) {
$msg .= $mb['mb_id'].' : 로그인 중인 관리자는 수정 할 수 없습니다.\\n';
} else {
- if($_POST['mb_certify'][$k])
- $mb_adult = (int) $_POST['mb_adult'][$k];
+ if($post_mb_certify)
+ $mb_adult = isset($_POST['mb_adult'][$k]) ? (int) $_POST['mb_adult'][$k] : 0;
else
$mb_adult = 0;
$sql = " update {$g5['member_table']}
- set mb_level = '".sql_real_escape_string($_POST['mb_level'][$k])."',
- mb_intercept_date = '".sql_real_escape_string($_POST['mb_intercept_date'][$k])."',
- mb_mailling = '".sql_real_escape_string($_POST['mb_mailling'][$k])."',
- mb_sms = '".sql_real_escape_string($_POST['mb_sms'][$k])."',
- mb_open = '".sql_real_escape_string($_POST['mb_open'][$k])."',
- mb_certify = '".sql_real_escape_string($_POST['mb_certify'][$k])."',
+ set mb_level = '".$post_mb_level."',
+ mb_intercept_date = '".sql_real_escape_string($post_mb_intercept_date)."',
+ mb_mailling = '".$post_mb_mailling."',
+ mb_sms = '".$post_mb_sms."',
+ mb_open = '".$post_mb_open."',
+ mb_certify = '".sql_real_escape_string($post_mb_certify)."',
mb_adult = '{$mb_adult}'
- where mb_id = '".sql_real_escape_string($_POST['mb_id'][$k])."' ";
+ where mb_id = '".sql_real_escape_string($mb['mb_id'])."' ";
sql_query($sql);
}
}
@@ -53,7 +61,7 @@ if ($_POST['act_button'] == "선택수정") {
for ($i=0; $i
+goto_url('./member_list.php?'.$qstr);
\ No newline at end of file
diff --git a/adm/menu_form.php b/adm/menu_form.php
index bb421af1c..4c8c43473 100644
--- a/adm/menu_form.php
+++ b/adm/menu_form.php
@@ -8,7 +8,8 @@ if ($is_admin != 'super')
$g5['title'] = '메뉴 추가';
include_once(G5_PATH.'/head.sub.php');
-$code = isset($code) ? preg_replace('/[^0-9a-zA-Z]/', '', strip_tags($code)) : '';
+$new = isset($_GET['new']) ? clean_xss_tags($_GET['new'], 1, 1) : '';
+$code = isset($_GET['code']) ? preg_replace('/[^0-9a-zA-Z]/', '', $_GET['code']) : '';
// 코드
if($new == 'new' || !$code) {
@@ -174,10 +175,10 @@ function add_menu_list(name, link, code)
else
$menu_last = $menulist.find("tr.menu_list:last");
- if($menu_last.size() > 0) {
+ if($menu_last.length > 0) {
$menu_last.after(list);
} else {
- if($menulist.find("#empty_menu_list").size() > 0)
+ if($menulist.find("#empty_menu_list").length > 0)
$menulist.find("#empty_menu_list").remove();
$menulist.find("table tbody").append(list);
@@ -193,5 +194,4 @@ function add_menu_list(name, link, code)
\ No newline at end of file
+include_once(G5_PATH.'/tail.sub.php');
\ No newline at end of file
diff --git a/adm/menu_form_search.php b/adm/menu_form_search.php
index 497ee3ee1..bb26e26f4 100644
--- a/adm/menu_form_search.php
+++ b/adm/menu_form_search.php
@@ -4,6 +4,8 @@ include_once('./_common.php');
if ($is_admin != 'super')
die('최고관리자만 접근 가능합니다.');
+$type = isset($_REQUEST['type']) ? preg_replace('/[^0-9a-z_]/i', '', $_REQUEST['type']) : '';
+
switch($type) {
case 'group':
$sql = " select gr_id as id, gr_subject as subject
@@ -24,9 +26,7 @@ switch($type) {
$sql = '';
break;
}
-?>
-추가
창닫기
-
\ No newline at end of file
+
@@ -143,14 +144,14 @@ $(function() {
return false;
var $tr = $(this).closest("tr");
- if($tr.find("td.sub_menu_class").size() > 0) {
+ if($tr.find("td.sub_menu_class").length > 0) {
$tr.remove();
} else {
var code = $(this).closest("tr").find("input[name='code[]']").val().substr(0, 2);
$("tr.menu_group_"+code).remove();
}
- if($("#menulist tr.menu_list").size() < 1) {
+ if($("#menulist tr.menu_list").length < 1) {
var list = "\n";
$("#menulist table tbody").append(list);
} else {
@@ -215,5 +216,4 @@ function fmenulist_submit(f)
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/menu_list_update.php b/adm/menu_list_update.php
index 528a5a42b..f62ab4714 100644
--- a/adm/menu_list_update.php
+++ b/adm/menu_list_update.php
@@ -21,7 +21,11 @@ for ($i=0; $i<$count; $i++)
{
$_POST = array_map_deep('trim', $_POST);
- $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags(clean_xss_attributes($_POST['me_link'][$i], 1)) : '';
+ if(preg_match('/^javascript/i', preg_replace('/[ ]{1,}|[\t]/', '', $_POST['me_link'][$i]))){
+ $_POST['me_link'][$i] = G5_URL;
+ }
+
+ $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags(clean_xss_attributes(preg_replace('/[ ]{2,}|[\t]/', '', $_POST['me_link'][$i]), 1)) : '';
$code = is_array($_POST['code']) ? strip_tags($_POST['code'][$i]) : '';
$me_name = is_array($_POST['me_name']) ? strip_tags($_POST['me_name'][$i]) : '';
@@ -70,5 +74,4 @@ for ($i=0; $i<$count; $i++)
run_event('admin_menu_list_update');
-goto_url('./menu_list.php');
-?>
+goto_url('./menu_list.php');
\ No newline at end of file
diff --git a/adm/newwinform.php b/adm/newwinform.php
index 371aea64a..7dc842c5d 100644
--- a/adm/newwinform.php
+++ b/adm/newwinform.php
@@ -3,9 +3,15 @@ $sub_menu = '100310';
include_once('./_common.php');
include_once(G5_EDITOR_LIB);
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
-$nw_id = preg_replace('/[^0-9]/', '', $nw_id);
+$nw_id = isset($_REQUEST['nw_id']) ? preg_replace('/[^0-9]/', '', $_REQUEST['nw_id']) : 0;
+$nw = array(
+'nw_begin_time'=>'',
+'nw_end_time'=>'',
+'nw_subject'=>'',
+'nw_content'=>'',
+);
$html_title = "팝업레이어";
if ($w == "u")
@@ -13,7 +19,7 @@ if ($w == "u")
$html_title .= " 수정";
$sql = " select * from {$g5['new_win_table']} where nw_id = '$nw_id' ";
$nw = sql_fetch($sql);
- if (!$nw['nw_id']) alert("등록된 자료가 없습니다.");
+ if (! (isset($nw['nw_id']) && $nw['nw_id'])) alert("등록된 자료가 없습니다.");
}
else
{
@@ -146,5 +152,4 @@ function frmnewwin_check(f)
+include_once (G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/newwinformupdate.php b/adm/newwinformupdate.php
index f03701166..7fb507512 100644
--- a/adm/newwinformupdate.php
+++ b/adm/newwinformupdate.php
@@ -2,29 +2,55 @@
$sub_menu = '100310';
include_once('./_common.php');
+$nw_id = isset($_REQUEST['nw_id']) ? preg_replace('/[^0-9]/', '', $_REQUEST['nw_id']) : 0;
+
if ($w == "u" || $w == "d")
check_demo();
if ($w == 'd')
- auth_check($auth[$sub_menu], "d");
+ auth_check_menu($auth, $sub_menu, "d");
else
- auth_check($auth[$sub_menu], "w");
+ auth_check_menu($auth, $sub_menu, "w");
check_admin_token();
$nw_subject = isset($_POST['nw_subject']) ? strip_tags(clean_xss_attributes($_POST['nw_subject'])) : '';
+$posts = array();
-$sql_common = " nw_device = '{$_POST['nw_device']}',
- nw_begin_time = '{$_POST['nw_begin_time']}',
- nw_end_time = '{$_POST['nw_end_time']}',
- nw_disable_hours = '{$_POST['nw_disable_hours']}',
- nw_left = '{$_POST['nw_left']}',
- nw_top = '{$_POST['nw_top']}',
- nw_height = '{$_POST['nw_height']}',
- nw_width = '{$_POST['nw_width']}',
+$check_keys = array(
+'nw_device'=>'str',
+'nw_begin_time'=>'str',
+'nw_end_time'=>'str',
+'nw_disable_hours'=>'int',
+'nw_left'=>'int',
+'nw_top'=>'int',
+'nw_height'=>'int',
+'nw_width'=>'int',
+'nw_content'=>'text',
+'nw_content_html'=>'text',
+);
+
+foreach($check_keys as $key=>$val){
+ if($val === 'int'){
+ $posts[$key] = isset($_POST[$key]) ? (int) $_POST[$key] : 0;
+ } else if ($val === 'str') {
+ $posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : 0;
+ } else {
+ $posts[$key] = isset($_POST[$key]) ? trim($_POST[$key]) : 0;
+ }
+}
+
+$sql_common = " nw_device = '{$posts['nw_device']}',
+ nw_begin_time = '{$posts['nw_begin_time']}',
+ nw_end_time = '{$posts['nw_end_time']}',
+ nw_disable_hours = '{$posts['nw_disable_hours']}',
+ nw_left = '{$posts['nw_left']}',
+ nw_top = '{$posts['nw_top']}',
+ nw_height = '{$posts['nw_height']}',
+ nw_width = '{$posts['nw_width']}',
nw_subject = '{$nw_subject}',
- nw_content = '{$_POST['nw_content']}',
- nw_content_html = '{$_POST['nw_content_html']}' ";
+ nw_content = '{$posts['nw_content']}',
+ nw_content_html = '{$posts['nw_content_html']}' ";
if($w == "")
{
@@ -51,5 +77,4 @@ if ($w == "d")
else
{
goto_url("./newwinform.php?w=u&nw_id=$nw_id");
-}
-?>
+}
\ No newline at end of file
diff --git a/adm/newwinlist.php b/adm/newwinlist.php
index 093892050..ba44e063e 100644
--- a/adm/newwinlist.php
+++ b/adm/newwinlist.php
@@ -2,7 +2,7 @@
$sub_menu = '100310';
include_once('./_common.php');
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
if( !isset($g5['new_win_table']) ){
die('
/data/dbconfig.php 파일에
$g5[\'new_win_table\'] = G5_TABLE_PREFIX.\'new_win\'; 를 추가해 주세요.');
@@ -114,5 +114,4 @@ $result = sql_query($sql);
+include_once (G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/phpinfo.php b/adm/phpinfo.php
index a7f01a149..6bb61c4be 100644
--- a/adm/phpinfo.php
+++ b/adm/phpinfo.php
@@ -4,7 +4,6 @@ include_once('./_common.php');
check_demo();
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
-phpinfo();
-?>
\ No newline at end of file
+phpinfo();
\ No newline at end of file
diff --git a/adm/point_list.php b/adm/point_list.php
index 7e25aec50..a8c348ad4 100644
--- a/adm/point_list.php
+++ b/adm/point_list.php
@@ -2,7 +2,7 @@
$sub_menu = "200200";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$sql_common = " from {$g5['point_table']} ";
@@ -84,8 +84,8 @@ else
검색대상
- >회원아이디
- >내용
+ >회원아이디
+ >내용
검색어 필수
@@ -190,7 +190,7 @@ else
-
+
@@ -248,5 +248,4 @@ function fpointlist_submit(f)
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/point_list_delete.php b/adm/point_list_delete.php
index fb064b3bf..6926ad8cd 100644
--- a/adm/point_list_delete.php
+++ b/adm/point_list_delete.php
@@ -4,11 +4,11 @@ include_once('./_common.php');
check_demo();
-auth_check($auth[$sub_menu], 'd');
+auth_check_menu($auth, $sub_menu, 'd');
check_admin_token();
-$count = count($_POST['chk']);
+$count = (isset($_POST['chk']) && is_array($_POST['chk'])) ? count($_POST['chk']) : 0;
if(!$count)
alert($_POST['act_button'].' 하실 항목을 하나 이상 체크하세요.');
@@ -57,5 +57,4 @@ for ($i=0; $i<$count; $i++)
sql_query($sql);
}
-goto_url('./point_list.php?'.$qstr);
-?>
\ No newline at end of file
+goto_url('./point_list.php?'.$qstr);
\ No newline at end of file
diff --git a/adm/point_update.php b/adm/point_update.php
index ac1a70411..b560538dd 100644
--- a/adm/point_update.php
+++ b/adm/point_update.php
@@ -2,14 +2,14 @@
$sub_menu = "200200";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
check_admin_token();
-$mb_id = strip_tags(clean_xss_attributes($_POST['mb_id']));
-$po_point = strip_tags(clean_xss_attributes($_POST['po_point']));
-$po_content = strip_tags(clean_xss_attributes($_POST['po_content']));
-$expire = preg_replace('/[^0-9]/', '', $_POST['po_expire_term']);
+$mb_id = isset($_POST['mb_id']) ? strip_tags(clean_xss_attributes($_POST['mb_id'])) : '';
+$po_point = isset($_POST['po_point']) ? strip_tags(clean_xss_attributes($_POST['po_point'])) : 0;
+$po_content = isset($_POST['po_content']) ? strip_tags(clean_xss_attributes($_POST['po_content'])) : '';
+$expire = isset($_POST['po_expire_term']) ? preg_replace('/[^0-9]/', '', $_POST['po_expire_term']) : '';
$mb = get_member($mb_id);
@@ -21,5 +21,4 @@ if (($po_point < 0) && ($po_point * (-1) > $mb['mb_point']))
insert_point($mb_id, $po_point, $po_content, '@passive', $mb_id, $member['mb_id'].'-'.uniqid(''), $expire);
-goto_url('./point_list.php?'.$qstr);
-?>
+goto_url('./point_list.php?'.$qstr);
\ No newline at end of file
diff --git a/adm/poll_delete.php b/adm/poll_delete.php
index 3cae4f3cf..5827ca065 100644
--- a/adm/poll_delete.php
+++ b/adm/poll_delete.php
@@ -4,17 +4,17 @@ include_once('./_common.php');
check_demo();
-auth_check($auth[$sub_menu], 'd');
+auth_check_menu($auth, $sub_menu, 'd');
check_admin_token();
-$count = count($_POST['chk']);
+$count = (isset($_POST['chk']) && is_array($_POST['chk'])) ? count($_POST['chk']) : 0;
if(!$count)
alert('삭제할 투표목록을 1개이상 선택해 주세요.');
for($i=0; $i<$count; $i++) {
- $po_id = $_POST['chk'][$i];
+ $po_id = isset($_POST['chk'][$i]) ? (int) $_POST['chk'][$i] : 0;
$sql = " delete from {$g5['poll_table']} where po_id = '$po_id' ";
sql_query($sql);
@@ -23,5 +23,4 @@ for($i=0; $i<$count; $i++) {
sql_query($sql);
}
-goto_url('./poll_list.php?'.$qstr);
-?>
\ No newline at end of file
+goto_url('./poll_list.php?'.$qstr);
\ No newline at end of file
diff --git a/adm/poll_form.php b/adm/poll_form.php
index 3de75ddbe..f04ac7e2c 100644
--- a/adm/poll_form.php
+++ b/adm/poll_form.php
@@ -2,9 +2,15 @@
$sub_menu = "200900";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
$po_id = isset($po_id) ? (int) $po_id : 0;
+$po = array(
+'po_subject'=>'',
+'po_etc'=>'',
+'po_level'=>'',
+'po_point'=>'',
+);
$html_title = '투표';
if ($w == '')
@@ -48,7 +54,8 @@ include_once('./admin.head.php');
$sound_only = '필수 ';
}
- $po_poll = get_text($po['po_poll'.$i]);
+ $po_poll = isset($po['po_poll'.$i]) ? get_text($po['po_poll'.$i]) : '';
+ $po_cnt = isset($po['po_cnt'.$i]) ? get_text($po['po_cnt'.$i]) : 0;
?>
@@ -56,7 +63,7 @@ include_once('./admin.head.php');
class="frm_input " maxlength="125">
항목 투표수
-
+
@@ -111,5 +118,4 @@ include_once('./admin.head.php');
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/poll_form_update.php b/adm/poll_form_update.php
index f5972aa8a..2c4e7c6c2 100644
--- a/adm/poll_form_update.php
+++ b/adm/poll_form_update.php
@@ -6,7 +6,7 @@ $w = $_POST['w'];
if ($w == 'u' || $w == 'd')
check_demo();
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
check_admin_token();
@@ -99,5 +99,4 @@ sql_query(" update {$g5['config_table']} set cf_max_po_id = '{$row['max_po_id']}
if ($w == 'd')
goto_url('./poll_list.php?'.$qstr);
else
- goto_url('./poll_form.php?w=u&po_id='.$po_id.'&'.$qstr);
-?>
+ goto_url('./poll_form.php?w=u&po_id='.$po_id.'&'.$qstr);
\ No newline at end of file
diff --git a/adm/poll_list.php b/adm/poll_list.php
index 9b2123d8e..8b719c314 100644
--- a/adm/poll_list.php
+++ b/adm/poll_list.php
@@ -2,7 +2,7 @@
$sub_menu = "200900";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$sql_common = " from {$g5['poll_table']} ";
@@ -59,7 +59,7 @@ $colspan = 7;
검색대상
- >제목
+ >제목
검색어 필수
@@ -154,5 +154,4 @@ $(function() {
\ No newline at end of file
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/popular_list.php b/adm/popular_list.php
index 80f200be2..d55c975d7 100644
--- a/adm/popular_list.php
+++ b/adm/popular_list.php
@@ -2,7 +2,7 @@
$sub_menu = "300300";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
// 체크된 자료 삭제
if (isset($_POST['chk']) && is_array($_POST['chk'])) {
@@ -79,8 +79,8 @@ var list_delete_php = 'popular_list.php';
검색대상
- >검색어
- >등록일
+ >검색어
+ >등록일
검색어 필수
@@ -94,7 +94,7 @@ var list_delete_php = 'popular_list.php';
-
+
@@ -167,5 +167,4 @@ $(function() {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/popular_rank.php b/adm/popular_rank.php
index b39127a59..53552d627 100644
--- a/adm/popular_rank.php
+++ b/adm/popular_rank.php
@@ -2,7 +2,10 @@
$sub_menu = "300400";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? $_REQUEST['fr_date'] : '';
+$to_date = isset($_REQUEST['to_date']) ? $_REQUEST['to_date'] : '';
if (empty($fr_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $fr_date) ) $fr_date = G5_TIME_YMD;
if (empty($to_date) || ! preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])$/", $to_date) ) $to_date = G5_TIME_YMD;
@@ -64,7 +67,7 @@ $(function(){
-
+
@@ -105,8 +108,5 @@ $(function(){
-
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/qa_config.php b/adm/qa_config.php
index c06a0a059..13664223b 100644
--- a/adm/qa_config.php
+++ b/adm/qa_config.php
@@ -3,7 +3,7 @@ $sub_menu = "300500";
include_once('./_common.php');
include_once(G5_EDITOR_LIB);
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$g5['title'] = '1:1문의 설정';
include_once ('./admin.head.php');
@@ -396,5 +396,4 @@ function fqaconfigform_submit(f)
\ No newline at end of file
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/qa_config_update.php b/adm/qa_config_update.php
index 829c78adb..1f4f7d82c 100644
--- a/adm/qa_config_update.php
+++ b/adm/qa_config_update.php
@@ -4,7 +4,7 @@ include_once('./_common.php');
check_demo();
-auth_check($auth[$sub_menu], 'w');
+auth_check_menu($auth, $sub_menu, 'w');
check_admin_token();
@@ -61,9 +61,17 @@ if( function_exists('filter_input_include_path') ){
$qa_include_tail = filter_input_include_path($qa_include_tail);
}
+// 분류에 & 나 = 는 사용이 불가하므로 2바이트로 바꾼다.
+$src_char = array('&', '=');
+$dst_char = array('&', '〓');
+$qa_category = str_replace($src_char, $dst_char, $_POST['qa_category']);
+
+//https://github.com/gnuboard/gnuboard5/commit/f5f4925d4eb28ba1af728e1065fc2bdd9ce1da58 에 따른 조치
+$qa_category = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\/\^\*]/", "", $qa_category);
+
$sql = " update {$g5['qa_config_table']}
set qa_title = '{$_POST['qa_title']}',
- qa_category = '{$_POST['qa_category']}',
+ qa_category = '{$qa_category}',
qa_skin = '{$_POST['qa_skin']}',
qa_mobile_skin = '{$_POST['qa_mobile_skin']}',
qa_use_email = '{$_POST['qa_use_email']}',
@@ -107,5 +115,4 @@ if($error_msg){
alert($error_msg, './qa_config.php');
} else {
goto_url('./qa_config.php');
-}
-?>
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/adm/safe_check.php b/adm/safe_check.php
index 71f28f5c5..0143ddf55 100644
--- a/adm/safe_check.php
+++ b/adm/safe_check.php
@@ -13,5 +13,4 @@ function social_log_file_delete($second=0){
unlink($social_log_file);
}
}
-}
-?>
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/adm/sendmail_test.php b/adm/sendmail_test.php
index c0a88e600..bb7801d11 100644
--- a/adm/sendmail_test.php
+++ b/adm/sendmail_test.php
@@ -2,7 +2,7 @@
$sub_menu = '100300';
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
if (!$config['cf_email_use'])
alert('환경설정에서 \'메일발송 사용\'에 체크하셔야 메일을 발송할 수 있습니다.');
@@ -72,5 +72,4 @@ if (isset($_POST['email'])) {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/service.php b/adm/service.php
index c677beaff..f38583766 100644
--- a/adm/service.php
+++ b/adm/service.php
@@ -2,7 +2,7 @@
$sub_menu = '100400';
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$g5['title'] = '부가서비스';
include_once('./admin.head.php');
@@ -45,5 +45,4 @@ include_once('./admin.head.php');
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/session_file_delete.php b/adm/session_file_delete.php
index 0b88f8dc2..bfbbb08f3 100644
--- a/adm/session_file_delete.php
+++ b/adm/session_file_delete.php
@@ -57,5 +57,4 @@ include_once("./admin.head.php");
?>
+include_once("./admin.tail.php");
\ No newline at end of file
diff --git a/adm/sms_admin/_common.php b/adm/sms_admin/_common.php
index 3c53259a8..e295daf97 100644
--- a/adm/sms_admin/_common.php
+++ b/adm/sms_admin/_common.php
@@ -19,5 +19,4 @@ if( isset($token) ){
$token = @htmlspecialchars(strip_tags($token), ENT_QUOTES);
}
-add_stylesheet(' ', 0);
-?>
\ No newline at end of file
+add_stylesheet(' ', 0);
\ No newline at end of file
diff --git a/adm/sms_admin/ajax.hp_chk.php b/adm/sms_admin/ajax.hp_chk.php
index b1c303565..4634817b3 100644
--- a/adm/sms_admin/ajax.hp_chk.php
+++ b/adm/sms_admin/ajax.hp_chk.php
@@ -10,12 +10,14 @@ if( !function_exists('json_encode') ) {
}
}
-ajax_auth_check($auth[$sub_menu], "r");
+ajax_auth_check_menu($auth, $sub_menu, "r");
$err = '';
$arr_ajax_msg = array();
$exist_hplist = array();
+$bk_hp = isset($_REQUEST['bk_hp']) ? clean_xss_tags($_REQUEST['bk_hp'], 1, 1) : '';
+
if( !$bk_hp )
$err = '휴대폰번호를 입력해 주십시오.';
@@ -46,6 +48,4 @@ if(!$row['cnt'] && $w == 'u') {
$arr_ajax_msg['error'] = $err;
$arr_ajax_msg['exist'] = $exist_hplist;
-die( json_encode($arr_ajax_msg) );
-
-?>
\ No newline at end of file
+die( json_encode($arr_ajax_msg) );
\ No newline at end of file
diff --git a/adm/sms_admin/ajax.sms_write_form.php b/adm/sms_admin/ajax.sms_write_form.php
index 82a02b22a..8514179e4 100644
--- a/adm/sms_admin/ajax.sms_write_form.php
+++ b/adm/sms_admin/ajax.sms_write_form.php
@@ -10,7 +10,9 @@ if( !function_exists('json_encode') ) {
}
}
-ajax_auth_check($auth[$sub_menu], "r");
+ajax_auth_check_menu($auth, $sub_menu, "r");
+
+$fg_no = isset($_REQUEST['fg_no']) ? preg_replace('/[^0-9]/i', '', $_REQUEST['fg_no']) : '';
$page_size = 6;
@@ -82,5 +84,4 @@ $arr_ajax_msg = array(
'total_page'=>$total_page
);
-die( json_encode($arr_ajax_msg) );
-?>
\ No newline at end of file
+die( json_encode($arr_ajax_msg) );
\ No newline at end of file
diff --git a/adm/sms_admin/ajax.sms_write_group.php b/adm/sms_admin/ajax.sms_write_group.php
index 702357183..5b10312e3 100644
--- a/adm/sms_admin/ajax.sms_write_group.php
+++ b/adm/sms_admin/ajax.sms_write_group.php
@@ -4,7 +4,7 @@ include_once("./_common.php");
$colspan = 3;
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$no_group = sql_fetch("select * from {$g5['sms5_book_group_table']} where bg_no=1");
diff --git a/adm/sms_admin/ajax.sms_write_level.php b/adm/sms_admin/ajax.sms_write_level.php
index d17fcd54b..b36cf1d18 100644
--- a/adm/sms_admin/ajax.sms_write_level.php
+++ b/adm/sms_admin/ajax.sms_write_level.php
@@ -10,7 +10,7 @@ if( !function_exists('json_encode') ) {
}
}
-ajax_auth_check($auth[$sub_menu], "r");
+ajax_auth_check_menu($auth, $sub_menu, "r");
$lev = array();
@@ -26,6 +26,7 @@ while ($row = sql_fetch_array($qry))
$lev[$row['mb_level']] = $row['cnt'];
}
$str_json = array();
+$line = 0;
$tmp_str = '';
$tmp_str .= '
@@ -53,5 +54,4 @@ $tmp_str .= '
';
$str_json['html'] = $tmp_str;
-echo json_encode($str_json);
-?>
\ No newline at end of file
+echo json_encode($str_json);
\ No newline at end of file
diff --git a/adm/sms_admin/ajax.sms_write_person.php b/adm/sms_admin/ajax.sms_write_person.php
index c37b70058..26a90c3b7 100644
--- a/adm/sms_admin/ajax.sms_write_person.php
+++ b/adm/sms_admin/ajax.sms_write_person.php
@@ -5,7 +5,11 @@ include_once("./_common.php");
$page_size = 10;
$colspan = 5;
-auth_check($auth[$sub_menu], "r");
+$bg_no = isset($_REQUEST['bg_no']) ? (int) $_REQUEST['bg_no'] : 0;
+$ap = isset($_REQUEST['ap']) ? (int) $_REQUEST['ap'] : 0;
+$no_hp = isset($_REQUEST['no_hp']) ? clean_xss_tags($_REQUEST['no_hp'], 1, 1) : '';
+
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = "휴대폰번호 관리";
diff --git a/adm/sms_admin/config.php b/adm/sms_admin/config.php
index a8e89543e..dc2d28467 100644
--- a/adm/sms_admin/config.php
+++ b/adm/sms_admin/config.php
@@ -2,7 +2,7 @@
$sub_menu = "900100";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = "SMS 기본설정";
@@ -25,7 +25,7 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw'])
if (!$config['cf_icode_id'])
$config['cf_icode_id'] = 'sir_';
-if (!$sms5['cf_skin'])
+if (! (isset($sms5['cf_skin']) && $sms5['cf_skin']))
$sms5['cf_skin'] = 'basic';
include_once(G5_ADMIN_PATH.'/admin.head.php');
@@ -117,7 +117,7 @@ if ($config['cf_sms_use'] == 'icode') { // 아이코드 사용
회신번호 필수
예) 010-123-4567"); ?>
-
+
@@ -144,5 +144,4 @@ if ($config['cf_sms_use'] == 'icode') { // 아이코드 사용
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/config_update.php b/adm/sms_admin/config_update.php
index 236d56e74..da708f998 100644
--- a/adm/sms_admin/config_update.php
+++ b/adm/sms_admin/config_update.php
@@ -2,7 +2,7 @@
$sub_menu = "900100";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
check_demo();
@@ -10,6 +10,15 @@ check_admin_token();
$g5['title'] = "SMS 기본설정";
+$cf_phone = isset($_REQUEST['cf_phone']) ? clean_xss_tags($_REQUEST['cf_phone'], 1, 1) : '';
+$cf_sms_use = isset($_REQUEST['cf_sms_use']) ? clean_xss_tags($_REQUEST['cf_sms_use'], 1, 1) : '';
+$cf_sms_type = isset($_REQUEST['cf_sms_type']) ? clean_xss_tags($_REQUEST['cf_sms_type'], 1, 1) : '';
+$cf_icode_id = isset($_REQUEST['cf_icode_id']) ? clean_xss_tags($_REQUEST['cf_icode_id'], 1, 1) : '';
+$cf_icode_pw = isset($_REQUEST['cf_icode_pw']) ? clean_xss_tags($_REQUEST['cf_icode_pw'], 1, 1) : '';
+$cf_icode_server_ip = isset($_REQUEST['cf_icode_server_ip']) ? clean_xss_tags($_REQUEST['cf_icode_server_ip'], 1, 1) : '';
+$cf_icode_server_port = isset($_REQUEST['cf_icode_server_port']) ? clean_xss_tags($_REQUEST['cf_icode_server_port'], 1, 1) : '';
+$cf_icode_token_key = isset($_REQUEST['cf_icode_token_key']) ? clean_xss_tags($_REQUEST['cf_icode_token_key'], 1, 1) : '';
+
// 회신번호 체크
if(!check_vaild_callback($cf_phone))
alert('회신번호가 올바르지 않습니다.');
@@ -42,5 +51,4 @@ $sql = " update {$g5['config_table']}
cf_icode_token_key = '$cf_icode_token_key'";
sql_query($sql);
-goto_url("./config.php");
-?>
\ No newline at end of file
+goto_url("./config.php");
\ No newline at end of file
diff --git a/adm/sms_admin/css/sms5.css b/adm/sms_admin/css/sms5.css
index 03187e7ea..31a4096f9 100644
--- a/adm/sms_admin/css/sms5.css
+++ b/adm/sms_admin/css/sms5.css
@@ -126,7 +126,7 @@
/* 휴대폰번호 파일 */
#sms5_fileup_frm {margin:0 0 10px;padding:0 0;border-bottom:1px solid #e9e9e9}
-#sms5_fileup_frm div {padding:5px 0;;border-bottom:1px solid #f4f4f4}
+#sms5_fileup_frm div {padding:5px 0;border-bottom:1px solid #f4f4f4}
#sms5_fileup_frm div.sch_last {margin:0;border:0}
#sms5_fileup_frm strong {display:inline-block;width:80px}
#sms5_fileup_frm strong.sch_long {width:160px}
diff --git a/adm/sms_admin/emoticon_move.php b/adm/sms_admin/emoticon_move.php
index 4e04cf496..7c1db6eb3 100644
--- a/adm/sms_admin/emoticon_move.php
+++ b/adm/sms_admin/emoticon_move.php
@@ -6,7 +6,7 @@ if ($sw != 'move'){
alert('sw 값이 제대로 넘어오지 않았습니다.');
}
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = '이모티콘그룹 이동';
include_once(G5_PATH.'/head.sub.php');
@@ -111,5 +111,4 @@ function fboardmoveall_submit(f)
+include_once(G5_PATH.'/tail.sub.php');
\ No newline at end of file
diff --git a/adm/sms_admin/emoticon_move_update.php b/adm/sms_admin/emoticon_move_update.php
index 8fe03b539..08fe2848e 100644
--- a/adm/sms_admin/emoticon_move_update.php
+++ b/adm/sms_admin/emoticon_move_update.php
@@ -1,12 +1,15 @@
- "$msg"
+
-돌아가기
-
-HEREDOC;
-?>
\ No newline at end of file
+돌아가기
+
\ No newline at end of file
diff --git a/adm/sms_admin/form_group.php b/adm/sms_admin/form_group.php
index d91d061ac..3acb5788f 100644
--- a/adm/sms_admin/form_group.php
+++ b/adm/sms_admin/form_group.php
@@ -4,7 +4,7 @@ include_once("./_common.php");
$colspan = 5;
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = "이모티콘 그룹";
@@ -67,8 +67,8 @@ function grouplist_submit(f)
-
-
+
+
-
+
@@ -136,7 +136,7 @@ function grouplist_submit(f)
그룹명
-
+
>
회원
@@ -173,5 +173,4 @@ function grouplist_submit(f)
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/form_group_move.php b/adm/sms_admin/form_group_move.php
index 27faa14d1..5b430a830 100644
--- a/adm/sms_admin/form_group_move.php
+++ b/adm/sms_admin/form_group_move.php
@@ -3,7 +3,10 @@
$sub_menu = "900500";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
+
+$fg_no = isset($_REQUEST['fg_no']) ? (int) $_REQUEST['fg_no'] : 0;
+$move_no = isset($_REQUEST['move_no']) ? (int) $_REQUEST['move_no'] : 0;
if ($fg_no)
{
@@ -26,5 +29,4 @@ $group = sql_fetch("select * from {$g5['sms5_form_group_table']} where fg_no = '
sql_query("update {$g5['sms5_form_table']} set fg_no = '$move_no', fg_member = '{$group['fg_member']}' where fg_no = '$fg_no'");
-goto_url('./form_group.php');
-?>
\ No newline at end of file
+goto_url('./form_group.php');
\ No newline at end of file
diff --git a/adm/sms_admin/form_group_update.php b/adm/sms_admin/form_group_update.php
index d5257dcea..824d6f2e4 100644
--- a/adm/sms_admin/form_group_update.php
+++ b/adm/sms_admin/form_group_update.php
@@ -2,16 +2,18 @@
$sub_menu = "900500";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
+
+$post_cnk = (isset($_POST['chk']) && is_array($_POST['chk'])) ? $_POST['chk'] : array();
if ($w == 'u') // 업데이트
{
- for ($i=0; $i
\ No newline at end of file
+goto_url('./form_group.php');
\ No newline at end of file
diff --git a/adm/sms_admin/form_list.php b/adm/sms_admin/form_list.php
index dca08fb51..9fb66bb4a 100644
--- a/adm/sms_admin/form_list.php
+++ b/adm/sms_admin/form_list.php
@@ -5,7 +5,7 @@ include_once("./_common.php");
$page_size = 12;
$colspan = 2;
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$token = get_token();
@@ -13,7 +13,7 @@ $g5['title'] = "이모티콘 관리";
if ($page < 1) $page = 1;
-$fg_no = isset($fg_no) ? (int) $fg_no : '';
+$fg_no = isset($_REQUEST['fg_no']) ? (int) $_REQUEST['fg_no'] : 0;
if (is_numeric($fg_no))
$sql_group = " and fg_no='$fg_no' ";
@@ -34,7 +34,7 @@ if ($st == 'all') {
}
$total_res = sql_fetch("select count(*) as cnt from {$g5['sms5_form_table']} where 1 $sql_group $sql_search");
-$total_count = $total_res['cnt'];
+$total_count = isset($total_res['cnt']) ? $total_res['cnt'] : 0;
$total_page = (int)($total_count/$page_size) + ($total_count%$page_size==0 ? 0 : 1);
$page_start = $page_size * ( $page - 1 );
@@ -46,7 +46,7 @@ $qry = sql_query("select * from {$g5['sms5_form_group_table']} order by fg_name"
while ($res = sql_fetch_array($qry)) array_push($group, $res);
$res = sql_fetch("select count(*) as cnt from {$g5['sms5_form_table']} where fg_no=0");
-$no_count = $res['cnt'];
+$no_count = isset($res['cnt']) ? $res['cnt'] : 0;
include_once(G5_ADMIN_PATH.'/admin.head.php');
?>
@@ -146,6 +146,7 @@ function multi_update(sel)
+
@@ -234,8 +235,7 @@ function select_copy(sw, f) {
}
-
-
\ No newline at end of file
+echo get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['cf_write_pages'], $page, $total_page, $_SERVER['SCRIPT_NAME']."?fg_no=$fg_no&st=$st&sv=$sv&page=");
+
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/form_multi_update.php b/adm/sms_admin/form_multi_update.php
index f321a1577..ae8b50129 100644
--- a/adm/sms_admin/form_multi_update.php
+++ b/adm/sms_admin/form_multi_update.php
@@ -2,19 +2,23 @@
$sub_menu = "900600";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
check_admin_token();
+$post_fo_no = (isset($_POST['fo_no']) && is_array($_POST['fo_no'])) ? $_POST['fo_no'] : array();
+$atype = isset($_POST['atype']) ? clean_xss_tags($_POST['atype'], 1, 1) : '';
+$fg_no = isset($_POST['fg_no']) ? (int) $_POST['fg_no'] : 0;
+
if($atype == "del"){
- $count = count($_POST['fo_no']);
+ $count = count($post_fo_no);
if(!$count)
alert('선택삭제 하실 항목을 하나이상 선택해 주세요.');
for ($i=0; $i<$count; $i++)
{
// 실제 번호를 넘김
- $fo_no = (int) $_POST['fo_no'][$i];
+ $fo_no = (int) $post_fo_no[$i];
if (!trim($fo_no)) continue;
$res = sql_fetch("select * from {$g5['sms5_form_table']} where fo_no='$fo_no'");
@@ -24,4 +28,4 @@ if($atype == "del"){
sql_query("update {$g5['sms5_form_group_table']} set fg_count = fg_count - 1 where fg_no='{$res['fg_no']}'");
}
}
-goto_url('./form_list.php');
\ No newline at end of file
+goto_url('./form_list.php?fg_no='.$fg_no);
\ No newline at end of file
diff --git a/adm/sms_admin/form_update.php b/adm/sms_admin/form_update.php
index 1eb78101a..c086cb059 100644
--- a/adm/sms_admin/form_update.php
+++ b/adm/sms_admin/form_update.php
@@ -2,10 +2,12 @@
$sub_menu = "900600";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
-$fo_name = isset($fo_name) ? strip_tags(clean_xss_attributes($fo_name)) : '';
-$fo_content = isset($fo_content) ? strip_tags(clean_xss_attributes($fo_content)) : '';
+$fo_name = isset($_REQUEST['fo_name']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_name'])) : '';
+$fo_content = isset($_REQUEST['fo_content']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_content'])) : '';
+$fo_receipt = isset($_REQUEST['fo_receipt']) ? clean_xss_tags($_REQUEST['fo_receipt'], 1, 1) : '';
+$get_fg_no = '';
$g5['title'] = "이모티콘 업데이트";
@@ -77,5 +79,4 @@ else // 등록
}
$go_url = './form_list.php?page='.$page.'&fg_no='.$get_fg_no;
-goto_url($go_url);
-?>
\ No newline at end of file
+goto_url($go_url);
\ No newline at end of file
diff --git a/adm/sms_admin/form_write.php b/adm/sms_admin/form_write.php
index b8e4913f7..a28671f38 100644
--- a/adm/sms_admin/form_write.php
+++ b/adm/sms_admin/form_write.php
@@ -2,11 +2,19 @@
$sub_menu = "900600";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
$g5['title'] = "이모티콘 ";
-$fg_no = isset($fg_no) ? (int) $fg_no : '';
+$fo_no = isset($_REQUEST['fo_no']) ? (int) $_REQUEST['fo_no'] : 0;
+$fg_no = isset($_REQUEST['fg_no']) ? (int) $_REQUEST['fg_no'] : '';
+
+$write = array(
+'fg_no'=>null,
+'fo_no'=>null,
+'fo_name'=>'',
+'fo_content'=>''
+);
if ($w == 'u' && is_numeric($fo_no)) {
$write = sql_fetch("select * from {$g5['sms5_form_table']} where fo_no='$fo_no'");
@@ -14,6 +22,7 @@ if ($w == 'u' && is_numeric($fo_no)) {
}
else {
$write['fg_no'] = $fg_no;
+ $write['fo_no'] = $fo_no;
$g5['title'] .= '추가';
}
@@ -23,7 +32,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
-
+
@@ -231,5 +240,4 @@ $(function(){
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/history_list.php b/adm/sms_admin/history_list.php
index d3edc13e9..467cc33db 100644
--- a/adm/sms_admin/history_list.php
+++ b/adm/sms_admin/history_list.php
@@ -5,7 +5,7 @@ include_once("./_common.php");
$page_size = 20;
$colspan = 11;
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = "문자전송 내역";
@@ -23,7 +23,7 @@ $total_page = (int)($total_count/$page_size) + ($total_count%$page_size==0 ? 0 :
$page_start = $page_size * ( $page - 1 );
$vnum = $total_count - (($page-1) * $page_size);
-
+$line = 0;
include_once(G5_ADMIN_PATH.'/admin.head.php');
?>
@@ -68,7 +68,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
while($res = sql_fetch_array($qry)) {
$bg = 'bg'.($line++%2);
$tmp_wr_memo = @unserialize($res['wr_memo']);
- $dupli_count = $tmp_wr_memo['total'] ? $tmp_wr_memo['total'] : 0;
+ $dupli_count = (isset($tmp_wr_memo['total']) && $tmp_wr_memo['total']) ? (int) $tmp_wr_memo['total'] : 0;
?>
@@ -94,5 +94,4 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/history_num.php b/adm/sms_admin/history_num.php
index 043fdd3f0..6fe344a35 100644
--- a/adm/sms_admin/history_num.php
+++ b/adm/sms_admin/history_num.php
@@ -5,12 +5,14 @@ include_once('./_common.php');
$page_size = 20;
$colspan = 10;
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = "문자전송 내역 (번호별)";
if ($page < 1) $page = 1;
+$line = 0;
+
if( isset($st) && !in_array($st, array('hs_name', 'hs_hp', 'bk_no')) ){
$st = '';
}
@@ -107,5 +109,4 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/history_send.php b/adm/sms_admin/history_send.php
index 9b4f29600..12d51f0be 100644
--- a/adm/sms_admin/history_send.php
+++ b/adm/sms_admin/history_send.php
@@ -2,7 +2,9 @@
$sub_menu = "900400";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
+
+$wr_no = isset($_REQUEST['wr_no']) ? (int) $_REQUEST['wr_no'] : 0;
$g5['title'] = "문자전송중";
@@ -229,5 +231,4 @@ if($config['cf_sms_type'] == 'LMS') {
location.href = 'history_view.php?wr_no=&wr_renum=';
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/history_view.php b/adm/sms_admin/history_view.php
index 4ea64a885..1cf76df57 100644
--- a/adm/sms_admin/history_view.php
+++ b/adm/sms_admin/history_view.php
@@ -6,8 +6,12 @@ $spage_size = 20;
$colspan = 10;
$re_text = '';
-$st = isset($st) ? strip_tags($st) : '';
-$ssv = isset($ssv) ? strip_tags($ssv) : '';
+$st = isset($_REQUEST['st']) ? clean_xss_tags($_REQUEST['st'], 1, 1) : '';
+$ssv = isset($_REQUEST['ssv']) ? clean_xss_tags($_REQUEST['ssv'], 1, 1) : '';
+$wr_no = isset($_REQUEST['wr_no']) ? (int) $_REQUEST['wr_no'] : 0;
+$wr_renum = isset($_REQUEST['wr_renum']) ? (int) $_REQUEST['wr_renum'] : 0;
+$spage = isset($_REQUEST['spage']) ? (int) $_REQUEST['spage'] : 0;
+$line = 0;
if( $st && !in_array($st, array('hs_name', 'hs_hp', 'bk_no')) ){
$st = '';
@@ -17,7 +21,7 @@ if( $sst && !in_array($sst, array('mb_id', 'bk_no', 'hs_name', 'hs_hp', 'hs_date
$sst = '';
}
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = "문자전송 상세내역";
@@ -261,5 +265,4 @@ function all_send()
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/install.php b/adm/sms_admin/install.php
index 025ecda8e..c5405c3d2 100644
--- a/adm/sms_admin/install.php
+++ b/adm/sms_admin/install.php
@@ -2,11 +2,11 @@
$sub_menu = "900000";
include_once("./_common.php");
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$g5['title'] = "SMS5 솔루션 설치";
-$setup = $_POST['setup'];
+$setup = (isset($_POST['setup']) && $_POST['setup']) ? 1 : 0;
include_once(G5_ADMIN_PATH.'/admin.head.php');
?>
@@ -83,5 +83,4 @@ flush(); usleep(50000);
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/member_update.php b/adm/sms_admin/member_update.php
index cf90a404e..0008c794f 100644
--- a/adm/sms_admin/member_update.php
+++ b/adm/sms_admin/member_update.php
@@ -2,7 +2,7 @@
$sub_menu = "900200";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = "회원정보 업데이트";
@@ -19,7 +19,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
- 마지막 업데이트 일시 :
+ 마지막 업데이트 일시 :
@@ -64,5 +64,4 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/member_update_run.php b/adm/sms_admin/member_update_run.php
index 94efc229c..aeea60f48 100644
--- a/adm/sms_admin/member_update_run.php
+++ b/adm/sms_admin/member_update_run.php
@@ -3,6 +3,8 @@ $sub_menu = "900200";
include_once("./_common.php");
@include_once(G5_PLUGIN_PATH."/sms5/JSON.php");
+$mtype = isset($_REQUEST['mtype']) ? clean_xss_tags($_REQUEST['mtype'], 1, 1) : '';
+
if(empty($config['cf_sms_use'])){
if( $mtype == "json" ){
die("{\"error\":\"환경 설정의 SMS 사용에서 아이코드를 사용설정해 주셔야 실행할수 있습니다.\"}");
@@ -19,9 +21,9 @@ if( !function_exists('json_encode') ) {
}
if( $mtype == "json" ){
- ajax_auth_check($auth[$sub_menu], "w");
+ ajax_auth_check_menu($auth, $sub_menu, "w");
} else {
- auth_check($auth[$sub_menu], "w");
+ auth_check_menu($auth, $sub_menu, "w");
}
$count = 0;
@@ -126,5 +128,4 @@ if( $mtype == "json" ){
die( json_encode($json_msg) );
} else {
die( $msg );
-}
-?>
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/adm/sms_admin/num_book.php b/adm/sms_admin/num_book.php
index d6a658567..4e89db11f 100644
--- a/adm/sms_admin/num_book.php
+++ b/adm/sms_admin/num_book.php
@@ -5,7 +5,7 @@ include_once("./_common.php");
$page_size = 20;
$colspan = 9;
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$token = get_token();
@@ -13,8 +13,8 @@ $g5['title'] = "휴대폰번호 관리";
if ($page < 1) $page = 1;
-$bg_no = isset($bg_no) ? preg_replace('/[^0-9]/i', '', $bg_no) : '';
-$st = isset($st) ? preg_replace('/[^a-z0-9]/i', '', $st) : '';
+$bg_no = isset($_REQUEST['bg_no']) ? preg_replace('/[^0-9]/i', '', $_REQUEST['bg_no']) : '';
+$st = isset($_REQUEST['st']) ? preg_replace('/[^a-z0-9]/i', '', $_REQUEST['st']) : '';
$sql_korean = $sql_group = $sql_search = $sql_no_hp = '';
@@ -33,6 +33,9 @@ if ($st == 'all') {
$sql_search = '';
}
+$ap = isset($_GET['ap']) ? (int) $_GET['ap'] : 0;
+$no_hp = isset($_GET['no_hp']) ? preg_replace('/[^0-9a-z_]/i', '', $_GET['no_hp']) : 0;
+
if ($ap > 0)
$sql_korean = korean_index('bk_name', $ap-1);
else {
@@ -104,7 +107,7 @@ function no_hp_click(val)
-
업데이트
+
업데이트
건수 명
회원 명
비회원 명
@@ -262,5 +265,4 @@ function select_copy(sw, f) {
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/num_book_file.php b/adm/sms_admin/num_book_file.php
index ed4f6f35b..abaa1912a 100644
--- a/adm/sms_admin/num_book_file.php
+++ b/adm/sms_admin/num_book_file.php
@@ -2,7 +2,7 @@
$sub_menu = "900900";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = "휴대폰번호 파일";
@@ -154,5 +154,4 @@ function download()
}
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/num_book_file_download.php b/adm/sms_admin/num_book_file_download.php
index 65c1bdaa1..55d8e6f0d 100644
--- a/adm/sms_admin/num_book_file_download.php
+++ b/adm/sms_admin/num_book_file_download.php
@@ -2,7 +2,10 @@
$sub_menu = "900900";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "r");
+$bg_no = isset($_REQUEST['bg_no']) ? clean_xss_tags($_REQUEST['bg_no'], 1, 1) : '';
+$no_hp = isset($_REQUEST['no_hp']) ? clean_xss_tags($_REQUEST['no_hp'], 1, 1) : '';
+
+auth_check_menu($auth, $sub_menu, "r");
if ($bg_no != 'all' && $bg_no < 1)
alert_just('다운로드 할 휴대폰번호 그룹을 선택해주세요.');
@@ -18,50 +21,49 @@ if (!$total['cnt']) alert_just('데이터가 없습니다.');
$qry = sql_query("select * from {$g5['sms5_book_table']} where 1 $sql_bg $sql_hp order by bk_name");
-/*================================================================================
-php_writeexcel http://www.bettina-attack.de/jonny/view.php/projects/php_writeexcel/
-=================================================================================*/
+if(! function_exists('column_char')) {
+ function column_char($i) {
+ return chr( 65 + $i );
+ }
+}
-include_once(G5_LIB_PATH.'/Excel/php_writeexcel/class.writeexcel_workbook.inc.php');
-include_once(G5_LIB_PATH.'/Excel/php_writeexcel/class.writeexcel_worksheet.inc.php');
+include_once(G5_LIB_PATH.'/PHPExcel.php');
+$excel = new PHPExcel();
-$fname = tempnam(G5_DATA_PATH, "tmp.xls");
-$workbook = new writeexcel_workbook($fname);
-$worksheet = $workbook->addworksheet();
-
-$num2_format =& $workbook->addformat(array(num_format => '\0#'));
-
-// Put Excel data
-$data = array('이름', '전화번호');
-$data = array_map('iconv_euckr', $data);
+$headers = array('이름', '전화번호');
+$widths = array(18, 25);
+$header_bgcolor = 'FFABCDEF';
+$last_char = column_char(count($headers) - 1);
+$rows = array();
$col = 0;
-foreach($data as $cell) {
- $worksheet->write(0, $col++, $cell);
-}
for($i=1; $res=sql_fetch_array($qry); $i++)
{
- $res = array_map('iconv_euckr', $res);
+ //$res = array_map('iconv_euckr', $res);
$hp = get_hp($res['bk_hp'], $hyphen);
if ($no_hp && $res['bk_hp'] != '' && !$hp) continue;
- $worksheet->write($i, 0, $res['bk_name']);
- $worksheet->write($i, 1, $hp, $num2_format);
+ $rows[] = array($res['bk_name'], ' '.$hp);
}
-$workbook->close();
+$data = array_merge(array($headers), $rows);
+
+$excel->setActiveSheetIndex(0)->getStyle( "A1:${last_char}1" )->getFill()->setFillType(PHPExcel_Style_Fill::FILL_SOLID)->getStartColor()->setARGB($header_bgcolor);
+$excel->setActiveSheetIndex(0)->getStyle( "A:$last_char" )->getAlignment()->setVertical(PHPExcel_Style_Alignment::VERTICAL_CENTER)->setWrapText(true);
+foreach($widths as $i => $w) $excel->setActiveSheetIndex(0)->getColumnDimension( column_char($i) )->setWidth($w);
+$excel->getActiveSheet()->fromArray($data,NULL,'A1');
$filename = "휴대폰번호목록-".date("ymd", time()).".xls";
if( is_ie() ) $filename = utf2euc($filename);
-header("Content-Type: application/x-msexcel; name=".$filename);
-header("Content-Disposition: inline; filename=".$filename);
-$fh=fopen($fname, "rb");
-fpassthru($fh);
-unlink($fname);
+header("Content-Type: application/octet-stream");
+header("Content-Disposition: attachment; filename=".$filename);
+header("Cache-Control: max-age=0");
-exit;
-?>
\ No newline at end of file
+$writer = PHPExcel_IOFactory::createWriter($excel, 'Excel5');
+$writer->save('php://output');
+
+exit;
\ No newline at end of file
diff --git a/adm/sms_admin/num_book_file_upload.php b/adm/sms_admin/num_book_file_upload.php
index c1fa4cdda..0c07d9ea9 100644
--- a/adm/sms_admin/num_book_file_upload.php
+++ b/adm/sms_admin/num_book_file_upload.php
@@ -2,14 +2,17 @@
$sub_menu = "900900";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
+
+$upload_bg_no = isset($_REQUEST['upload_bg_no']) ? clean_xss_tags($_REQUEST['upload_bg_no'], 1, 1) : '';
+$confirm = isset($_REQUEST['confirm']) ? clean_xss_tags($_REQUEST['confirm'], 1, 1) : '';
if (!$upload_bg_no)
alert_after('그룹을 선택해주세요.');
$bg_no = $upload_bg_no;
-if (!$_FILES['csv']['size'])
+if (! (isset($_FILES['csv']['size']) && $_FILES['csv']['size']))
alert_after('파일을 선택해주세요.');
$file = $_FILES['csv']['tmp_name'];
@@ -18,6 +21,12 @@ $filename = $_FILES['csv']['name'];
$pos = strrpos($filename, '.');
$ext = strtolower(substr($filename, $pos, strlen($filename)));
+if(! function_exists('column_char')) {
+ function column_char($i) {
+ return chr( 65 + $i );
+ }
+}
+
switch ($ext) {
case '.csv' :
$data = file($file);
@@ -36,16 +45,17 @@ switch ($ext) {
}
break;
case '.xls' :
- include_once(G5_LIB_PATH.'/Excel/reader.php');
- $data = new Spreadsheet_Excel_Reader();
+ case '.xlsx' :
+ include_once(G5_LIB_PATH.'/PHPExcel/IOFactory.php');
+ $objPHPExcel = PHPExcel_IOFactory::load($file);
+ $sheet = $objPHPExcel->getSheet(0);
+
+ $num_rows = $sheet->getHighestRow();
+ $highestColumn = $sheet->getHighestColumn();
- // Set output Encoding.
- $data->setOutputEncoding('UTF-8');
- $data->read($file);
- $num_rows = $data->sheets[0]['numRows'];
break;
default :
- alert_after('xls파일과 csv파일만 허용합니다.');
+ alert_after('xls파일 xlsx파일과 csv파일만 허용합니다.');
}
$counter = 0;
@@ -54,6 +64,8 @@ $failure = 0;
$inner_overlap = 0;
$overlap = 0;
$arr_hp = array();
+$dupl_hp = array();
+$regi_hp = array();
$encode = array('ASCII','UTF-8','EUC-KR');
for ($i = 1; $i <= $num_rows; $i++) {
@@ -71,18 +83,25 @@ for ($i = 1; $i <= $num_rows; $i++) {
$hp = addslashes($csv[$i][1]);
break;
case '.xls' :
- $name = addslashes($data->sheets[0]['cells'][$i][$j++]);
- $str_encode = @mb_detect_encoding($name, $encode);
- if( $str_encode == "EUC-KR" ){
- $name = iconv_utf8( $name );
+ case '.xlsx' :
+ $rowData = $sheet->rangeToArray('A' . $i . ':' . $highestColumn . $i,
+ NULL,
+ TRUE,
+ FALSE);
+ $name = isset($rowData[0][0]) ? addslashes($rowData[0][0]) : '';
+ if( $name ){
+ $str_encode = @mb_detect_encoding($name, $encode);
+ if( $str_encode == "EUC-KR" ){
+ $name = iconv_utf8( $name );
+ }
}
- $hp = addslashes(get_hp($data->sheets[0]['cells'][$i][$j++]));
+ $hp = isset($rowData[0][1]) ? addslashes(get_hp($rowData[0][1])) : '';
break;
}
+
if (!(strlen($name)&&$hp))
{
$failure++;
-
} else {
if (in_array($hp, $arr_hp))
{
@@ -92,15 +111,17 @@ for ($i = 1; $i <= $num_rows; $i++) {
array_push($arr_hp, $hp);
$res = sql_fetch("select * from {$g5['sms5_book_table']} where bk_hp='$hp'");
- if ($res)
+
+ if (isset($res['bk_hp']) && $res['bk_hp'])
{
+ array_push($dupl_hp, $hp);
$overlap++;
- }
- else if (!$confirm && $hp)
- {
+ } else if (!$confirm && $hp) {
sql_query("insert into {$g5['sms5_book_table']} set bg_no='$bg_no', bk_name='".addslashes($name)."', bk_hp='$hp', bk_receipt=1, bk_datetime='".G5_TIME_YMDHIS."'");
sql_query("update {$g5['sms5_book_group_table']} set bg_count = bg_count + 1, bg_nomember = bg_nomember + 1, bg_receipt = bg_receipt + 1 where bg_no='$bg_no'");
$success++;
+ } else {
+ array_push($regi_hp, $hp);
}
}
}
@@ -127,7 +148,7 @@ html += \"
중복번호 ".number_format($overlap)." 건등록가능 ".number_format($result)." 건\";";
+ echo "html += \"
등록가능 ".number_format($result)." 건
\";";
echo "html += \"등록하기 \";";
}
else
@@ -143,16 +164,27 @@ parent.document.getElementById('uploading').style.display = 'none';
parent.document.getElementById('register').style.display = 'none';
info.style.display = 'block';
-info.innerHTML = html;
+info.innerHTML = html;";
-parent.document.getElementById('overlap').innerHTML = '중복번호 목록 ';";
+if( $dupl_hp ) {
+ echo "parent.document.getElementById('overlap').innerHTML = '
중복번호 목록 ';";
-for ($i=0; $i';\n";
+ for ($i=0; $i';\n";
+ }
+ echo "parent.document.getElementById('overlap').innerHTML += '
';\n";
}
-echo "parent.document.getElementById('overlap').innerHTML += '';\n";
-echo "";
+if( $regi_hp ) {
+ echo "parent.document.getElementById('regi_hps').innerHTML = '등록가능 목록 ';";
+
+ for ($i=0; $i';\n";
+ }
+ echo "parent.document.getElementById('regi_hps').innerHTML += '
';\n";
+}
+
+echo "";
function alert_after($str) {
echo "";
alert_just($str);
-}
-?>
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/adm/sms_admin/num_book_move.php b/adm/sms_admin/num_book_move.php
index f69248d89..e59013fb1 100644
--- a/adm/sms_admin/num_book_move.php
+++ b/adm/sms_admin/num_book_move.php
@@ -11,12 +11,12 @@ if ($sw == 'move'){
alert('sw 값이 제대로 넘어오지 않았습니다.');
}
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = '번호그룹 ' . $act;
include_once(G5_PATH.'/head.sub.php');
-$bk_no_list = implode(',', $_POST['bk_no']);
+$bk_no_list = isset($_POST['bk_no']) ? implode(',', $_POST['bk_no']) : '';
$sql = " select * from {$g5['sms5_book_group_table']} order by bg_no ";
$result = sql_query($sql);
@@ -124,5 +124,4 @@ function fboardmoveall_submit(f)
+include_once(G5_PATH.'/tail.sub.php');
\ No newline at end of file
diff --git a/adm/sms_admin/num_book_multi_update.php b/adm/sms_admin/num_book_multi_update.php
index 5919a7f61..e1f579e76 100644
--- a/adm/sms_admin/num_book_multi_update.php
+++ b/adm/sms_admin/num_book_multi_update.php
@@ -2,13 +2,15 @@
$sub_menu = "900800";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
$g5['title'] = "전화번호부";
-for ($i=0; $i
\ No newline at end of file
+goto_url('./num_book.php'.$str_query);
\ No newline at end of file
diff --git a/adm/sms_admin/num_book_update.php b/adm/sms_admin/num_book_update.php
index 079c5eae1..6358e2017 100644
--- a/adm/sms_admin/num_book_update.php
+++ b/adm/sms_admin/num_book_update.php
@@ -2,7 +2,7 @@
$sub_menu = "900800";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
$g5['title'] = "휴대폰번호 업데이트";
@@ -10,10 +10,11 @@ $g5['sms5_demo'] = 0;
$is_hp_exist = false;
-$bk_hp = get_hp($bk_hp);
+$bk_hp = isset($_REQUEST['bk_hp']) ? get_hp($_REQUEST['bk_hp']) : '';
-$bk_memo = strip_tags($bk_memo);
-$bk_name = strip_tags($bk_name);
+$bk_memo = isset($_REQUEST['bk_memo']) ? strip_tags($_REQUEST['bk_memo']) : '';
+$bk_name = isset($_REQUEST['bk_name']) ? strip_tags($_REQUEST['bk_name']) : '';
+$bg_no = isset($_REQUEST['bg_no']) ? (int) $_REQUEST['bg_no'] : 0;
if ($w=='u') // 업데이트
{
@@ -54,7 +55,7 @@ if ($w=='u') // 업데이트
// 휴대폰번호 중복체크
$sql = " select mb_id from {$g5['member_table']} where mb_id <> '{$res['mb_id']}' and mb_hp = '{$bk_hp}' ";
$mb_hp_exist = sql_fetch($sql);
- if ($mb_hp_exist['mb_id']) { //중복된 회원 휴대폰번호가 있다면
+ if (isset($mb_hp_exist['mb_id']) && $mb_hp_exist['mb_id']) { //중복된 회원 휴대폰번호가 있다면
$is_hp_exist = true;
} else {
sql_query("update {$g5['member_table']} set mb_name='".addslashes($bk_name)."', mb_hp='$bk_hp', mb_sms='$bk_receipt' where mb_id='{$res['mb_id']}'", false);
@@ -136,5 +137,4 @@ else // 등록
}
$go_url = './num_book.php?page='.$page.'&bg_no='.$get_bg_no.'&ap='.$ap;
-goto_url($go_url);
-?>
\ No newline at end of file
+goto_url($go_url);
\ No newline at end of file
diff --git a/adm/sms_admin/num_book_write.php b/adm/sms_admin/num_book_write.php
index 665673472..7890ee90f 100644
--- a/adm/sms_admin/num_book_write.php
+++ b/adm/sms_admin/num_book_write.php
@@ -3,8 +3,11 @@ $sub_menu = "900800";
include_once("./_common.php");
$colspan = 4;
+$bk_no = isset($_REQUEST['bk_no']) ? (int) $_REQUEST['bk_no'] : 0;
+$bg_no = isset($_REQUEST['bg_no']) ? (int) $_REQUEST['bg_no'] : 0;
+$ap = isset($_REQUEST['ap']) ? clean_xss_tags($_REQUEST['ap'], 1, 1) : '';
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = "휴대폰번호 ";
@@ -184,12 +187,12 @@ function book_submit(){
var $check_msg = $("#hp_check_el");
if( !list_text ){ // 중복 휴대폰 번호가 없다면 submit
- if($check_msg.size()> 0)
+ if($check_msg.length > 0)
$check_msg.remove();
is_submit = true;
} else {
- if($check_msg.size() < 1)
+ if($check_msg.length < 1)
$("input#bk_hp").after("");
$("#hp_check_el").find("ul").html( list_text );
@@ -210,5 +213,4 @@ function book_submit(){
}
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/num_group.php b/adm/sms_admin/num_group.php
index 2da088f9c..880774b2e 100644
--- a/adm/sms_admin/num_group.php
+++ b/adm/sms_admin/num_group.php
@@ -2,7 +2,7 @@
$sub_menu = "900700";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
$g5['title'] = "휴대폰번호 그룹";
@@ -77,8 +77,8 @@ function num_group_submit(f)
건수 건
-
-
+
+
그룹추가 필수
@@ -185,5 +185,4 @@ function num_group_submit(f)
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/num_group_move.php b/adm/sms_admin/num_group_move.php
index 733585c16..689fdcd37 100644
--- a/adm/sms_admin/num_group_move.php
+++ b/adm/sms_admin/num_group_move.php
@@ -3,12 +3,18 @@
$sub_menu = "900700";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+$bk_no = isset($_REQUEST['bk_no']) ? (int) $_REQUEST['bk_no'] : 0;
+$bg_no = isset($_REQUEST['bg_no']) ? (int) $_REQUEST['bg_no'] : 0;
+$move_no = isset($_REQUEST['move_no']) ? (int) $_REQUEST['move_no'] : 0;
+
+auth_check_menu($auth, $sub_menu, "w");
$res = sql_fetch("select * from {$g5['sms5_book_group_table']} where bg_no='$bg_no'");
-sql_query("update {$g5['sms5_book_group_table']} set bg_count = bg_count + {$res['bg_count']}, bg_member = bg_member + {$res['bg_member']}, bg_nomember = bg_nomember + {$res['bg_nomember']}, bg_receipt = bg_receipt + {$res['bg_receipt']}, bg_reject = bg_reject + {$res['bg_reject']} where bg_no='$move_no'");
-sql_query("update {$g5['sms5_book_group_table']} set bg_count = 0, bg_member = 0, bg_nomember = 0, bg_receipt = 0, bg_reject = 0 where bg_no='$bg_no'");
-sql_query("update {$g5['sms5_book_table']} set bg_no='$move_no' where bg_no='$bg_no'");
-goto_url('./num_group.php');
-?>
\ No newline at end of file
+if( $res ) {
+ sql_query("update {$g5['sms5_book_group_table']} set bg_count = bg_count + {$res['bg_count']}, bg_member = bg_member + {$res['bg_member']}, bg_nomember = bg_nomember + {$res['bg_nomember']}, bg_receipt = bg_receipt + {$res['bg_receipt']}, bg_reject = bg_reject + {$res['bg_reject']} where bg_no='$move_no'");
+ sql_query("update {$g5['sms5_book_group_table']} set bg_count = 0, bg_member = 0, bg_nomember = 0, bg_receipt = 0, bg_reject = 0 where bg_no='$bg_no'");
+ sql_query("update {$g5['sms5_book_table']} set bg_no='$move_no' where bg_no='$bg_no'");
+}
+
+goto_url('./num_group.php');
\ No newline at end of file
diff --git a/adm/sms_admin/num_group_update.php b/adm/sms_admin/num_group_update.php
index dffeab6ee..abd3407b0 100644
--- a/adm/sms_admin/num_group_update.php
+++ b/adm/sms_admin/num_group_update.php
@@ -2,16 +2,18 @@
$sub_menu = "900700";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+$post_chk = (isset($_POST['chk']) && is_array($_POST['chk'])) ? $_POST['chk'] : array();
+
+auth_check_menu($auth, $sub_menu, "w");
if ($w == 'u') // 업데이트
{
- for ($i=0; $i
\ No newline at end of file
+goto_url('./num_group.php');
\ No newline at end of file
diff --git a/adm/sms_admin/number_move_update.php b/adm/sms_admin/number_move_update.php
index 76ad32fcb..f1925645f 100644
--- a/adm/sms_admin/number_move_update.php
+++ b/adm/sms_admin/number_move_update.php
@@ -1,12 +1,14 @@
돌아가기
-HEREDOC;
-?>
\ No newline at end of file
+HEREDOC;
\ No newline at end of file
diff --git a/adm/sms_admin/sms_write.php b/adm/sms_admin/sms_write.php
index 77754a97c..c09090e2a 100644
--- a/adm/sms_admin/sms_write.php
+++ b/adm/sms_admin/sms_write.php
@@ -2,7 +2,11 @@
$sub_menu = "900300";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "r");
+auth_check_menu($auth, $sub_menu, "r");
+
+$wr_no = isset($_REQUEST['wr_no']) ? (int) $_REQUEST['wr_no'] : 0;
+$bk_no = isset($_REQUEST['bk_no']) ? (int) $_REQUEST['bk_no'] : 0;
+$fo_no = isset($_REQUEST['fo_no']) ? (int) $_REQUEST['fo_no'] : 0;
$g5['title'] = "문자 보내기";
@@ -10,7 +14,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
?>
- 회원정보 최근 업데이트 :
+ 회원정보 최근 업데이트 :
회신 필수
-
+
@@ -831,5 +835,4 @@ var sms_obj={
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/sms_admin/sms_write_form.php b/adm/sms_admin/sms_write_form.php
index 103535b5e..f9421d9f4 100644
--- a/adm/sms_admin/sms_write_form.php
+++ b/adm/sms_admin/sms_write_form.php
@@ -6,9 +6,9 @@ $qry = sql_query("select * from {$g5['sms5_form_group_table']} order by fg_name"
while ($res = sql_fetch_array($qry)) array_push($group, $res);
$res = sql_fetch("select count(*) as cnt from `{$g5['sms5_form_table']}` where fg_no=0");
-$no_count = $res['cnt'];
+$no_count = isset($res['cnt']) ? $res['cnt'] : 0;
-$fg_no = isset($fg_no) ? (int) $fg_no : '';
+$fg_no = isset($_REQUEST['fg_no']) ? (int) $_REQUEST['fg_no'] : 0;
?>
diff --git a/adm/sms_admin/sms_write_overlap_check.php b/adm/sms_admin/sms_write_overlap_check.php
index 100ed6ba3..8dc7f7722 100644
--- a/adm/sms_admin/sms_write_overlap_check.php
+++ b/adm/sms_admin/sms_write_overlap_check.php
@@ -2,12 +2,14 @@
$sub_menu = "900300";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
$list = $hps = array();
$overlap = 0;
+$send_list = isset($_REQUEST['send_list']) ? clean_xss_tags($_REQUEST['send_list'], 1, 1) : '';
+
if( !$send_list ){
die("넘어온 데이터 값이 없습니다.");
}
@@ -65,5 +67,4 @@ while ($row = array_shift($send_list))
if ($overlap)
die("중복되는 휴대폰번호가 $overlap 건 있습니다. ");
else
- die("중복되는 휴대폰번호가 없습니다. ");
-?>
\ No newline at end of file
+ die("중복되는 휴대폰번호가 없습니다. ");
\ No newline at end of file
diff --git a/adm/sms_admin/sms_write_send.php b/adm/sms_admin/sms_write_send.php
index e88bdae46..9cd072f08 100644
--- a/adm/sms_admin/sms_write_send.php
+++ b/adm/sms_admin/sms_write_send.php
@@ -2,7 +2,7 @@
$sub_menu = "900300";
include_once("./_common.php");
-auth_check($auth[$sub_menu], "w");
+auth_check_menu($auth, $sub_menu, "w");
check_admin_token();
@@ -24,8 +24,15 @@ if ( ! (($config['cf_icode_id'] && $config['cf_icode_pw']) || $config['cf_icode_
alert('아이코드 설정값이 존재하지 않습니다.');
}
-$wr_reply = preg_replace('#[^0-9\-]#', '', trim($wr_reply));
-$wr_message = clean_xss_tags(trim($wr_message));
+$wr_reply = isset($_REQUEST['wr_reply']) ? preg_replace('#[^0-9\-]#', '', trim($_REQUEST['wr_reply'])) : '';
+$wr_message = isset($_REQUEST['wr_message']) ? clean_xss_tags(trim($_REQUEST['wr_message'])) : '';
+$send_list = isset($_REQUEST['send_list']) ? clean_xss_tags(trim($_REQUEST['send_list']), 1, 1) : '';
+
+$wr_by = isset($_REQUEST['wr_by']) ? clean_xss_tags(trim($_REQUEST['wr_by']), 1, 1) : '';
+$wr_bm = isset($_REQUEST['wr_bm']) ? clean_xss_tags(trim($_REQUEST['wr_bm']), 1, 1) : '';
+$wr_bd = isset($_REQUEST['wr_bd']) ? clean_xss_tags(trim($_REQUEST['wr_bd']), 1, 1) : '';
+$wr_bh = isset($_REQUEST['wr_bh']) ? clean_xss_tags(trim($_REQUEST['wr_bh']), 1, 1) : '';
+$wr_bi = isset($_REQUEST['wr_bi']) ? clean_xss_tags(trim($_REQUEST['wr_bi']), 1, 1) : '';
if (!$wr_reply)
win_close_alert('회신 번호를 숫자, - 로 입력해주세요.');
@@ -359,5 +366,4 @@ function win_close_alert($msg) {
location.href = 'history_view.php?wr_no=';
\ No newline at end of file
+include_once(G5_ADMIN_PATH.'/admin.tail.php');
\ No newline at end of file
diff --git a/adm/theme.php b/adm/theme.php
index 32eb294eb..ceeea78c5 100644
--- a/adm/theme.php
+++ b/adm/theme.php
@@ -75,5 +75,4 @@ include_once('./admin.head.php');
\ No newline at end of file
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/theme_config_load.php b/adm/theme_config_load.php
index a19a2a293..24c807bed 100644
--- a/adm/theme_config_load.php
+++ b/adm/theme_config_load.php
@@ -6,7 +6,7 @@ include_once(G5_LIB_PATH.'/json.lib.php');
$data = array();
$data['error'] = '';
-$data['error'] = auth_check($auth[$sub_menu], 'w', true);
+$data['error'] = auth_check_menu($auth, $sub_menu, 'w', true);
if($data['error'])
die(json_encode($data));
@@ -74,5 +74,4 @@ if($type == 'board') {
$data['error'] = '적용할 기본환경 회원스킨 설정이 없습니다.';
}
-die(json_encode($data));
-?>
\ No newline at end of file
+die(json_encode($data));
\ No newline at end of file
diff --git a/adm/theme_preview.php b/adm/theme_preview.php
index 559db4e63..e281009fa 100644
--- a/adm/theme_preview.php
+++ b/adm/theme_preview.php
@@ -11,7 +11,7 @@ if(!$theme || !in_array($theme, $theme_dir))
$info = get_theme_info($theme);
$arr_mode = array('index', 'list', 'view');
-$mode = substr(strip_tags($_GET['mode']), 0, 20);
+$mode = isset($_GET['mode']) ? substr(strip_tags($_GET['mode']), 0, 20) : '';
if(!in_array($mode, $arr_mode))
$mode = 'index';
@@ -114,5 +114,4 @@ require_once(G5_PATH.'/head.sub.php');
\ No newline at end of file
+require_once(G5_PATH.'/tail.sub.php');
\ No newline at end of file
diff --git a/adm/theme_update.php b/adm/theme_update.php
index 4749fb893..8804a9f9d 100644
--- a/adm/theme_update.php
+++ b/adm/theme_update.php
@@ -7,10 +7,13 @@ if ($is_admin != 'super')
admin_referer_check();
-$theme = trim($_POST['theme']);
+$theme = isset($_POST['theme']) ? trim($_POST['theme']) : '';
+$post_type = isset($_POST['type']) ? clean_xss_tags($_POST['type'], 1, 1) : '';
+$post_set_default_skin = isset($_POST['set_default_skin']) ? clean_xss_tags($_POST['set_default_skin'], 1, 1) : '';
+
$theme_dir = get_theme_dir();
-if($_POST['type'] == 'reset') {
+if($post_type == 'reset') {
$sql = " update {$g5['config_table']} set cf_theme = '' ";
sql_query($sql);
die('');
@@ -24,7 +27,7 @@ $sql = " update {$g5['config_table']} set cf_theme = '$theme' ";
sql_query($sql);
// 테마 설정 스킨 적용
-if($_POST['set_default_skin'] == 1) {
+if($post_set_default_skin == 1) {
$keys = 'set_default_skin, cf_member_skin, cf_mobile_member_skin, cf_new_skin, cf_mobile_new_skin, cf_search_skin, cf_mobile_search_skin, cf_connect_skin, cf_mobile_connect_skin, cf_faq_skin, cf_mobile_faq_skin, qa_skin, qa_mobile_skin';
$tconfig = get_theme_config_value($theme, $keys);
@@ -68,7 +71,6 @@ if($_POST['set_default_skin'] == 1) {
}
}
-run_event('adm_theme_update', $theme, $_POST['set_default_skin']);
+run_event('adm_theme_update', $theme, $post_set_default_skin);
-die('');
-?>
\ No newline at end of file
+die('');
\ No newline at end of file
diff --git a/adm/thumbnail_file_delete.php b/adm/thumbnail_file_delete.php
index 47f40c918..edbb7a610 100644
--- a/adm/thumbnail_file_delete.php
+++ b/adm/thumbnail_file_delete.php
@@ -68,5 +68,4 @@ echo '썸네일 '.$cnt.'건의
?>
\ No newline at end of file
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/view.php b/adm/view.php
index 777bd326e..937318e16 100644
--- a/adm/view.php
+++ b/adm/view.php
@@ -2,6 +2,7 @@
include_once('./_common.php');
$call = isset($_REQUEST['call']) ? strtolower(preg_replace('/[^a-z0-9_]/i', '', $_REQUEST['call'])) : '';
+$token = isset($_REQUEST['token']) ? clean_xss_tags($_REQUEST['token'], 1, 1) : '';
if( ! $call ){
return;
@@ -10,7 +11,7 @@ if( ! $call ){
if( ! $is_admin ){
$sql = " select count(*) as cnt from {$g5['auth_table']} where mb_id = '{$member['mb_id']}' ";
$row = sql_fetch($sql);
- if ( ! $row['cnt']) {
+ if (! (isset($row['cnt']) && $row['cnt'])) {
return;
}
}
@@ -24,5 +25,4 @@ include_once ('./admin.head.php');
run_event('admin_get_page_'.$call, $arr_query, $token);
-include_once ('./admin.tail.php');
-?>
\ No newline at end of file
+include_once ('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_browser.php b/adm/visit_browser.php
index 15cc0c297..6b2737e5c 100644
--- a/adm/visit_browser.php
+++ b/adm/visit_browser.php
@@ -2,7 +2,10 @@
$sub_menu = "200800";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['fr_date']) : G5_TIME_YMD;
+$to_date = isset($_REQUEST['to_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['to_date']) : G5_TIME_YMD;
$g5['title'] = '브라우저별 접속자집계';
include_once('./visit.sub.php');
@@ -11,6 +14,8 @@ $colspan = 5;
$max = 0;
$sum_count = 0;
+$arr = array();
+
$sql = " select * from {$g5['visit_table']}
where vi_date between '{$fr_date}' and '{$to_date}' ";
$result = sql_query($sql);
@@ -19,7 +24,11 @@ while ($row=sql_fetch_array($result)) {
if(!$s)
$s = get_brow($row['vi_agent']);
- $arr[$s]++;
+ if( isset($arr[$s]) ){
+ $arr[$s]++;
+ } else {
+ $arr[$s] = 1;
+ }
if ($arr[$s] > $max) $max = $arr[$s];
@@ -93,5 +102,4 @@ while ($row=sql_fetch_array($result)) {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_date.php b/adm/visit_date.php
index 967f4e8e9..3b552cda5 100644
--- a/adm/visit_date.php
+++ b/adm/visit_date.php
@@ -2,7 +2,10 @@
$sub_menu = "200800";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['fr_date']) : G5_TIME_YMD;
+$to_date = isset($_REQUEST['to_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['to_date']) : G5_TIME_YMD;
$g5['title'] = '일별 접속자집계';
include_once('./visit.sub.php');
@@ -11,6 +14,8 @@ $colspan = 4;
$max = 0;
$sum_count = 0;
+$arr = array();
+
$sql = " select vs_date, vs_count as cnt
from {$g5['visit_sum_table']}
where vs_date between '{$fr_date}' and '{$to_date}'
@@ -82,5 +87,4 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_delete.php b/adm/visit_delete.php
index 99fe62e49..16390c3ee 100644
--- a/adm/visit_delete.php
+++ b/adm/visit_delete.php
@@ -2,7 +2,7 @@
$sub_menu = "200820";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$g5['title'] = '접속자로그삭제';
include_once('./admin.head.php');
@@ -91,5 +91,4 @@ function form_submit(f)
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_delete_update.php b/adm/visit_delete_update.php
index 716eec63f..d19006981 100644
--- a/adm/visit_delete_update.php
+++ b/adm/visit_delete_update.php
@@ -4,7 +4,7 @@ include_once('./_common.php');
check_demo();
-auth_check($auth[$sub_menu], 'd');
+auth_check_menu($auth, $sub_menu, 'd');
if ($is_admin != 'super')
alert('최고관리자만 접근 가능합니다.');
@@ -56,5 +56,4 @@ $sql = " select count(*) as cnt from {$g5['visit_table']} ";
$row = sql_fetch($sql);
$total_count2 = $row['cnt'];
-alert('총 '.number_format($total_count).'건 중 '.number_format($total_count - $total_count2).'건 삭제 완료', './visit_delete.php');
-?>
\ No newline at end of file
+alert('총 '.number_format($total_count).'건 중 '.number_format($total_count - $total_count2).'건 삭제 완료', './visit_delete.php');
\ No newline at end of file
diff --git a/adm/visit_device.php b/adm/visit_device.php
index df2362bcd..2fed093dc 100644
--- a/adm/visit_device.php
+++ b/adm/visit_device.php
@@ -2,7 +2,10 @@
$sub_menu = "200800";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['fr_date']) : G5_TIME_YMD;
+$to_date = isset($_REQUEST['to_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['to_date']) : G5_TIME_YMD;
$g5['title'] = '기기별 접속자집계';
include_once('./visit.sub.php');
@@ -11,6 +14,8 @@ $colspan = 5;
$max = 0;
$sum_count = 0;
+$arr = array();
+
$sql = " select * from {$g5['visit_table']}
where vi_date between '$fr_date' and '$to_date' ";
$result = sql_query($sql);
@@ -19,7 +24,11 @@ while ($row=sql_fetch_array($result)) {
if(!$s)
$s = '기타';
- $arr[$s]++;
+ if( isset($arr[$s]) ){
+ $arr[$s]++;
+ } else {
+ $arr[$s] = 1;
+ }
if ($arr[$s] > $max) $max = $arr[$s];
@@ -97,5 +106,4 @@ while ($row=sql_fetch_array($result)) {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_domain.php b/adm/visit_domain.php
index 348a87c63..81e9b6801 100644
--- a/adm/visit_domain.php
+++ b/adm/visit_domain.php
@@ -2,7 +2,10 @@
$sub_menu = "200800";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['fr_date']) : G5_TIME_YMD;
+$to_date = isset($_REQUEST['to_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['to_date']) : G5_TIME_YMD;
$g5['title'] = '도메인별 접속자집계';
include_once('./visit.sub.php');
@@ -11,15 +14,22 @@ $colspan = 5;
$max = 0;
$sum_count = 0;
+$arr = array();
+
$sql = " select * from {$g5['visit_table']}
where vi_date between '{$fr_date}' and '{$to_date}' ";
$result = sql_query($sql);
while ($row=sql_fetch_array($result)) {
$str = $row['vi_referer'];
preg_match("/^http[s]*:\/\/([\.\-\_0-9a-zA-Z]*)\//", $str, $match);
- $s = $match[1];
+ $s = isset($match[1]) ? $match[1] : 0;
$s = preg_replace("/^(www\.|search\.|dirsearch\.|dir\.search\.|dir\.|kr\.search\.|myhome\.)(.*)/", "\\2", $s);
- $arr[$s]++;
+
+ if( isset($arr[$s]) ){
+ $arr[$s]++;
+ } else {
+ $arr[$s] = 1;
+ }
if ($arr[$s] > $max) $max = $arr[$s];
@@ -100,5 +110,4 @@ while ($row=sql_fetch_array($result)) {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_hour.php b/adm/visit_hour.php
index ba4f13479..e13392221 100644
--- a/adm/visit_hour.php
+++ b/adm/visit_hour.php
@@ -2,7 +2,10 @@
$sub_menu = "200800";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['fr_date']) : G5_TIME_YMD;
+$to_date = isset($_REQUEST['to_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['to_date']) : G5_TIME_YMD;
$g5['title'] = '시간별 접속자집계';
include_once('./visit.sub.php');
@@ -11,6 +14,8 @@ $colspan = 4;
$max = 0;
$sum_count = 0;
+$arr = array();
+
$sql = " select SUBSTRING(vi_time,1,2) as vi_hour, count(vi_id) as cnt
from {$g5['visit_table']}
where vi_date between '{$fr_date}' and '{$to_date}'
@@ -50,7 +55,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
if ($i) {
for ($i=0; $i<24; $i++) {
$hour = sprintf("%02d", $i);
- $count = (int)$arr[$hour];
+ $count = isset($arr[$hour]) ? (int) $arr[$hour] : 0;
$rate = ($count / $sum_count * 100);
$s_rate = number_format($rate, 1);
@@ -78,5 +83,4 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_list.php b/adm/visit_list.php
index 46744e99f..54a313edf 100644
--- a/adm/visit_list.php
+++ b/adm/visit_list.php
@@ -2,7 +2,10 @@
$sub_menu = "200800";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['fr_date']) : G5_TIME_YMD;
+$to_date = isset($_REQUEST['to_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['to_date']) : G5_TIME_YMD;
$g5['title'] = '접속자집계';
include_once('./visit.sub.php');
@@ -114,5 +117,4 @@ $qstr .= "&page=";
$pagelist = get_paging($config['cf_write_pages'], $page, $total_page, "{$_SERVER['SCRIPT_NAME']}?$qstr");
echo $pagelist;
-include_once('./admin.tail.php');
-?>
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_month.php b/adm/visit_month.php
index 5524f74c0..390419f1c 100644
--- a/adm/visit_month.php
+++ b/adm/visit_month.php
@@ -2,7 +2,10 @@
$sub_menu = "200800";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['fr_date']) : G5_TIME_YMD;
+$to_date = isset($_REQUEST['to_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['to_date']) : G5_TIME_YMD;
$g5['title'] = '월별 접속자집계';
include_once('./visit.sub.php');
@@ -11,6 +14,8 @@ $colspan = 4;
$max = 0;
$sum_count = 0;
+$arr = array();
+
$sql = " select SUBSTRING(vs_date,1,7) as vs_month, SUM(vs_count) as cnt
from {$g5['visit_sum_table']}
where vs_date between '{$fr_date}' and '{$to_date}'
@@ -86,5 +91,4 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_os.php b/adm/visit_os.php
index 183604ab5..17fb7ed13 100644
--- a/adm/visit_os.php
+++ b/adm/visit_os.php
@@ -2,7 +2,10 @@
$sub_menu = "200800";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['fr_date']) : G5_TIME_YMD;
+$to_date = isset($_REQUEST['to_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['to_date']) : G5_TIME_YMD;
$g5['title'] = 'OS별 접속자집계';
include_once('./visit.sub.php');
@@ -11,6 +14,8 @@ $colspan = 5;
$max = 0;
$sum_count = 0;
+$arr = array();
+
$sql = " select * from {$g5['visit_table']}
where vi_date between '$fr_date' and '$to_date' ";
$result = sql_query($sql);
@@ -19,7 +24,11 @@ while ($row=sql_fetch_array($result)) {
if(!$s)
$s = get_os($row['vi_agent']);
- $arr[$s]++;
+ if( isset($arr[$s]) ){
+ $arr[$s]++;
+ } else {
+ $arr[$s] = 1;
+ }
if ($arr[$s] > $max) $max = $arr[$s];
@@ -97,5 +106,4 @@ while ($row=sql_fetch_array($result)) {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_search.php b/adm/visit_search.php
index 524f2026f..21b803d4e 100644
--- a/adm/visit_search.php
+++ b/adm/visit_search.php
@@ -3,7 +3,7 @@ $sub_menu = '200810';
include_once('./_common.php');
include_once(G5_PATH.'/lib/visit.lib.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$g5['title'] = '접속자검색';
include_once('./admin.head.php');
@@ -122,6 +122,7 @@ if(isset($sfl) && $sfl && !in_array($sfl, array('vi_ip','vi_date','vi_time','vi_
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_week.php b/adm/visit_week.php
index 5ebccac2d..036e20844 100644
--- a/adm/visit_week.php
+++ b/adm/visit_week.php
@@ -2,7 +2,10 @@
$sub_menu = "200800";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['fr_date']) : G5_TIME_YMD;
+$to_date = isset($_REQUEST['to_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['to_date']) : G5_TIME_YMD;
$g5['title'] = '요일별 접속자집계';
include_once('./visit.sub.php');
@@ -11,6 +14,8 @@ $colspan = 4;
$weekday = array ('월', '화', '수', '목', '금', '토', '일');
$sum_count = 0;
+$arr = array();
+
$sql = " select WEEKDAY(vs_date) as weekday_date, SUM(vs_count) as cnt
from {$g5['visit_sum_table']}
where vs_date between '{$fr_date}' and '{$to_date}'
@@ -47,7 +52,7 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
$k = 0;
if ($i) {
for ($i=0; $i<7; $i++) {
- $count = (int)$arr[$i];
+ $count = isset($arr[$i]) ? (int) $arr[$i] : 0;
$rate = ($count / $sum_count * 100);
$s_rate = number_format($rate, 1);
@@ -77,5 +82,4 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/visit_year.php b/adm/visit_year.php
index 1d42e1512..226fe962c 100644
--- a/adm/visit_year.php
+++ b/adm/visit_year.php
@@ -2,7 +2,10 @@
$sub_menu = "200800";
include_once('./_common.php');
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
+
+$fr_date = isset($_REQUEST['fr_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['fr_date']) : G5_TIME_YMD;
+$to_date = isset($_REQUEST['to_date']) ? preg_replace('/[^0-9 :\-]/i', '', $_REQUEST['to_date']) : G5_TIME_YMD;
$g5['title'] = '연도별 접속자집계';
include_once('./visit.sub.php');
@@ -11,6 +14,8 @@ $colspan = 4;
$max = 0;
$sum_count = 0;
+$arr = array();
+
$sql = " select SUBSTRING(vs_date,1,4) as vs_year, SUM(vs_count) as cnt
from {$g5['visit_sum_table']}
where vs_date between '{$fr_date}' and '{$to_date}'
@@ -82,5 +87,4 @@ for ($i=0; $row=sql_fetch_array($result); $i++) {
+include_once('./admin.tail.php');
\ No newline at end of file
diff --git a/adm/write_count.php b/adm/write_count.php
index c37271627..fe6f12732 100644
--- a/adm/write_count.php
+++ b/adm/write_count.php
@@ -4,11 +4,14 @@ include_once('./_common.php');
check_demo();
-auth_check($auth[$sub_menu], 'r');
+auth_check_menu($auth, $sub_menu, 'r');
$g5['title'] = '글,댓글 현황';
include_once ('./admin.head.php');
+$graph = isset($_GET['graph']) ? clean_xss_tags($_GET['graph'], 1, 1) : '';
+$period = isset($_GET['period']) ? clean_xss_tags($_GET['period'], 1, 1) : '';
+
// http://www.jqplot.com/
add_stylesheet(' ', 1);
add_javascript('', 1);
@@ -75,6 +78,8 @@ $sql_bo_table = '';
if ($bo_table)
$sql_bo_table = "and bo_table = '$bo_table'";
+$line1 = $line2 = array();
+
switch ($day) {
case '시간' :
$sql = " select substr(bn_datetime,6,8) as hours, sum(if(wr_id=wr_parent,1,0)) as wcount, sum(if(wr_id=wr_parent,0,1)) as ccount from {$g5['board_new_table']} where substr(bn_datetime,1,10) between '$from' and '$to' {$sql_bo_table} group by hours order by bn_datetime ";
@@ -175,8 +180,8 @@ if (empty($line1) || empty($line2)) {
- "$msg"
+
-돌아가기
-
-HEREDOC;
-?>
+돌아가기
+
\ No newline at end of file
diff --git a/bbs/new.php b/bbs/new.php
index 708d2ffac..e439b9fe2 100644
--- a/bbs/new.php
+++ b/bbs/new.php
@@ -112,5 +112,4 @@ $write_pages = get_paging(G5_IS_MOBILE ? $config['cf_mobile_pages'] : $config['c
include_once($new_skin_path.'/new.skin.php');
-include_once('./_tail.php');
-?>
\ No newline at end of file
+include_once('./_tail.php');
\ No newline at end of file
diff --git a/bbs/new_delete.php b/bbs/new_delete.php
index 035653915..0cf1d425c 100644
--- a/bbs/new_delete.php
+++ b/bbs/new_delete.php
@@ -6,17 +6,20 @@ include_once('./_common.php');
if ($is_admin != 'super')
alert("최고관리자만 접근이 가능합니다.");
-$board = array();
+$board = array('bo_table'=>'');
$save_bo_table = array();
$save_wr_id = array();
+$count_chk_bn_id = (isset($_POST['chk_bn_id']) && is_array($_POST['chk_bn_id'])) ? count($_POST['chk_bn_id']) : 0;
-for($i=0;$i$value) {
run_event('bbs_new_delete', $chk_bn_id, $save_bo_table, $save_wr_id);
-goto_url("new.php?sfl=$sfl&stx=$stx&page=$page");
-?>
\ No newline at end of file
+goto_url("new.php?sfl=$sfl&stx=$stx&page=$page");
\ No newline at end of file
diff --git a/bbs/newwin.inc.php b/bbs/newwin.inc.php
index e3f8aed55..d9043f606 100644
--- a/bbs/newwin.inc.php
+++ b/bbs/newwin.inc.php
@@ -16,7 +16,7 @@ $result = sql_query($sql, false);
for ($i=0; $nw=sql_fetch_array($result); $i++)
{
// 이미 체크 되었다면 Continue
- if ($_COOKIE["hd_pops_{$nw['nw_id']}"])
+ if (isset($_COOKIE["hd_pops_{$nw['nw_id']}"]) && $_COOKIE["hd_pops_{$nw['nw_id']}"])
continue;
?>
diff --git a/bbs/password.php b/bbs/password.php
index 54209e9d3..31e807881 100644
--- a/bbs/password.php
+++ b/bbs/password.php
@@ -3,9 +3,7 @@ include_once('./_common.php');
$g5['title'] = '비밀번호 입력';
-if( isset($comment_id) ){
- $comment_id = (int) $comment_id;
-}
+$comment_id = isset($_REQUEST['comment_id']) ? preg_replace('/[^0-9]/', '', $_REQUEST['comment_id']) : 0;
switch ($w) {
case 'u' :
@@ -64,5 +62,4 @@ include_once($member_skin_path.'/password.skin.php');
//if ($board['bo_content_tail']) { echo html_purifier(stripslashes($board['bo_content_tail'])); }
//if ($board['bo_include_tail'] && is_include_path_check($board['bo_content_tail'])) { @include ($board['bo_include_tail']); }
-include_once(G5_PATH.'/tail.sub.php');
-?>
+include_once(G5_PATH.'/tail.sub.php');
\ No newline at end of file
diff --git a/bbs/password_check.php b/bbs/password_check.php
index 9eab6e5fe..cde4c408c 100644
--- a/bbs/password_check.php
+++ b/bbs/password_check.php
@@ -47,5 +47,4 @@ if ($w == 's') {
} else
alert('w 값이 제대로 넘어오지 않았습니다.');
-goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?'.$qstr));
-?>
+goto_url(short_url_clean(G5_HTTP_BBS_URL.'/board.php?'.$qstr));
\ No newline at end of file
diff --git a/bbs/password_lost.php b/bbs/password_lost.php
index 1e70ecf8d..c8f93f352 100644
--- a/bbs/password_lost.php
+++ b/bbs/password_lost.php
@@ -12,5 +12,4 @@ include_once(G5_PATH.'/head.sub.php');
$action_url = G5_HTTPS_BBS_URL."/password_lost2.php";
include_once($member_skin_path.'/password_lost.skin.php');
-include_once(G5_PATH.'/tail.sub.php');
-?>
\ No newline at end of file
+include_once(G5_PATH.'/tail.sub.php');
\ No newline at end of file
diff --git a/bbs/password_lost2.php b/bbs/password_lost2.php
index 96f57c7f9..9f8ec56da 100644
--- a/bbs/password_lost2.php
+++ b/bbs/password_lost2.php
@@ -73,5 +73,4 @@ mailer($config['cf_admin_email_name'], $config['cf_admin_email'], $mb['mb_email'
run_event('password_lost2_after', $mb, $mb_nonce, $mb_lost_certify);
-alert_close($email.' 메일로 회원아이디와 비밀번호를 인증할 수 있는 메일이 발송 되었습니다.\\n\\n메일을 확인하여 주십시오.');
-?>
+alert_close($email.' 메일로 회원아이디와 비밀번호를 인증할 수 있는 메일이 발송 되었습니다.\\n\\n메일을 확인하여 주십시오.');
\ No newline at end of file
diff --git a/bbs/password_lost_certify.php b/bbs/password_lost_certify.php
index b71cfc5d7..92aed20c2 100644
--- a/bbs/password_lost_certify.php
+++ b/bbs/password_lost_certify.php
@@ -8,8 +8,8 @@ run_event('password_lost_certify_before');
// 오류시 공히 Error 라고 처리하는 것은 회원정보가 있는지? 비밀번호가 틀린지? 를 알아보려는 해킹에 대비한것
-$mb_no = preg_replace('#[^0-9]#', '', trim($_GET['mb_no']));
-$mb_nonce = trim($_GET['mb_nonce']);
+$mb_no = isset($_GET['mb_no']) ? preg_replace('#[^0-9]#', '', trim($_GET['mb_no'])) : 0;
+$mb_nonce = isset($_GET['mb_nonce']) ? trim($_GET['mb_nonce']) : '';
// 회원아이디가 아닌 회원고유번호로 회원정보를 구한다.
$sql = " select mb_id, mb_lost_certify from {$g5['member_table']} where mb_no = '$mb_no' ";
@@ -31,5 +31,4 @@ if ($mb_nonce === substr($mb['mb_lost_certify'], 0, 32)) {
}
else {
die("Error");
-}
-?>
+}
\ No newline at end of file
diff --git a/bbs/point.php b/bbs/point.php
index e37fe67bc..e8e614fad 100644
--- a/bbs/point.php
+++ b/bbs/point.php
@@ -21,7 +21,17 @@ $total_page = ceil($total_count / $rows); // 전체 페이지 계산
if ($page < 1) { $page = 1; } // 페이지가 없으면 첫 페이지 (1 페이지)
$from_record = ($page - 1) * $rows; // 시작 열을 구함
+$sql = " select *
+ {$sql_common}
+ {$sql_order}
+ limit {$from_record}, {$rows} ";
+
+$result = sql_query($sql);
+
+for ($i=0; $row=sql_fetch_array($result); $i++) {
+ $list[] = $row;
+}
+
include_once($member_skin_path.'/point.skin.php');
-include_once(G5_PATH.'/tail.sub.php');
-?>
\ No newline at end of file
+include_once(G5_PATH.'/tail.sub.php');
\ No newline at end of file
diff --git a/bbs/poll_etc_update.php b/bbs/poll_etc_update.php
index 14bf55553..772826872 100644
--- a/bbs/poll_etc_update.php
+++ b/bbs/poll_etc_update.php
@@ -4,9 +4,9 @@ include_once(G5_LIB_PATH.'/mailer.lib.php');
if ($w == '')
{
- $po_id = $_POST['po_id'];
- $pc_name = $_POST['pc_name'];
- $pc_idea = $_POST['pc_idea'];
+ $po_id = isset($_POST['po_id']) ? (int) $_POST['po_id'] : '';
+ $pc_name = isset($_POST['pc_name']) ? clean_xss_tags($_POST['pc_name'], 1, 1) : '';
+ $pc_idea = isset($_POST['pc_idea']) ? clean_xss_tags($_POST['pc_idea'], 1, 1) : '';
$po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '{$po_id}' ");
if (!$po['po_id'])
@@ -55,5 +55,4 @@ else if ($w == 'd')
}
}
-goto_url('./poll_result.php?po_id='.$po_id.'&skin_dir='.$skin_dir);
-?>
+goto_url('./poll_result.php?po_id='.$po_id.'&skin_dir='.$skin_dir);
\ No newline at end of file
diff --git a/bbs/poll_result.php b/bbs/poll_result.php
index 939758de6..01e43773f 100644
--- a/bbs/poll_result.php
+++ b/bbs/poll_result.php
@@ -2,6 +2,8 @@
include_once('./_common.php');
include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
+$po_id = isset($_REQUEST['po_id']) ? (int) $_REQUEST['po_id'] : '';
+
$po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '{$po_id}' ");
if (!$po['po_id'])
alert('설문조사 정보가 없습니다.');
@@ -15,9 +17,11 @@ $po_subject = $po['po_subject'];
$max = 1;
$total_po_cnt = 0;
-for ($i=1; $i<=9; $i++) {
+$poll_max_count = 9;
+
+for ($i=1; $i<=$poll_max_count; $i++) {
$poll = $po['po_poll'.$i];
- if ($poll == '') break;
+ if (! $poll) break;
$count = $po['po_cnt'.$i];
$total_po_cnt += $count;
@@ -29,12 +33,14 @@ $nf_total_po_cnt = number_format($total_po_cnt);
$list = array();
-for ($i=1; $i<=9; $i++) {
+for ($i=1; $i<=$poll_max_count; $i++) {
$poll = $po['po_poll'.$i];
- if ($poll == '') { break; }
+ if (! $poll) { break; }
$list[$i]['content'] = $poll;
$list[$i]['cnt'] = $po['po_cnt'.$i];
+ $list[$i]['rate'] = 0;
+
if ($total_po_cnt > 0)
$list[$i]['rate'] = ($list[$i]['cnt'] / $total_po_cnt) * 100;
@@ -111,5 +117,4 @@ include_once(G5_PATH.'/head.sub.php');
if (!file_exists($poll_skin_path.'/poll_result.skin.php')) die('skin error');
include_once ($poll_skin_path.'/poll_result.skin.php');
-include_once(G5_PATH.'/tail.sub.php');
-?>
+include_once(G5_PATH.'/tail.sub.php');
\ No newline at end of file
diff --git a/bbs/poll_update.php b/bbs/poll_update.php
index 292e3ae7b..cca29431b 100644
--- a/bbs/poll_update.php
+++ b/bbs/poll_update.php
@@ -1,14 +1,16 @@
+goto_url($result_url);
\ No newline at end of file
diff --git a/bbs/profile.php b/bbs/profile.php
index d10ba16b8..b0f967dfa 100644
--- a/bbs/profile.php
+++ b/bbs/profile.php
@@ -32,5 +32,4 @@ $mb_profile = $mb['mb_profile'] ? conv_content($mb['mb_profile'],0) : '소개
include_once($member_skin_path.'/profile.skin.php');
-include_once(G5_PATH.'/tail.sub.php');
-?>
+include_once(G5_PATH.'/tail.sub.php');
\ No newline at end of file
diff --git a/bbs/qadelete.php b/bbs/qadelete.php
index 09e7b82cc..af92640eb 100644
--- a/bbs/qadelete.php
+++ b/bbs/qadelete.php
@@ -4,18 +4,21 @@ include_once('./_common.php');
if($is_guest)
alert('회원이시라면 로그인 후 이용해 주십시오.', G5_URL);
+$token = isset($_REQUEST['token']) ? clean_xss_tags($_REQUEST['token'], 1, 1) : '';
+$qa_id = isset($_REQUEST['qa_id']) ? (int) $_REQUEST['qa_id'] : 0;
+
$delete_token = get_session('ss_qa_delete_token');
set_session('ss_qa_delete_token', '');
-//관리자가 아닌경우에는 토큰을 검사합니다.
-if (!$is_admin && !($token && $delete_token == $token))
+//모든 회원의 토큰을 검사합니다.
+if (!($token && $delete_token === $token))
alert('토큰 에러로 삭제 불가합니다.');
$tmp_array = array();
if ($qa_id) // 건별삭제
$tmp_array[0] = $qa_id;
else // 일괄삭제
- $tmp_array = $_POST['chk_qa_id'];
+ $tmp_array = (isset($_POST['chk_qa_id']) && is_array($_POST['chk_qa_id'])) ? $_POST['chk_qa_id'] : array();
$count = count($tmp_array);
if(!$count)
@@ -42,7 +45,7 @@ for($i=0; $i<$count; $i++) {
// 첨부파일 삭제
for($k=1; $k<=2; $k++) {
- @unlink(G5_DATA_PATH.'/qa/'.$row['qa_file'.$k]);
+ @unlink(G5_DATA_PATH.'/qa/'.clean_relative_paths($row['qa_file'.$k]));
// 썸네일삭제
if(preg_match("/\.({$config['cf_image_extension']})$/i", $row['qa_file'.$k])) {
delete_qa_thumbnail($row['qa_file'.$k]);
@@ -57,7 +60,7 @@ for($i=0; $i<$count; $i++) {
$row2 = sql_fetch(" select qa_content, qa_file1, qa_file2 from {$g5['qa_content_table']} where qa_parent = '$qa_id' ");
// 첨부파일 삭제
for($k=1; $k<=2; $k++) {
- @unlink(G5_DATA_PATH.'/qa/'.$row2['qa_file'.$k]);
+ @unlink(G5_DATA_PATH.'/qa/'.clean_relative_paths($row2['qa_file'.$k]));
// 썸네일삭제
if(preg_match("/\.({$config['cf_image_extension']})$/i", $row2['qa_file'.$k])) {
delete_qa_thumbnail($row2['qa_file'.$k]);
@@ -79,5 +82,4 @@ for($i=0; $i<$count; $i++) {
sql_query(" delete from {$g5['qa_content_table']} where qa_id = '$qa_id' ");
}
-goto_url(G5_BBS_URL.'/qalist.php'.preg_replace('/^&/', '?', $qstr));
-?>
\ No newline at end of file
+goto_url(G5_BBS_URL.'/qalist.php'.preg_replace('/^&/', '?', $qstr));
\ No newline at end of file
diff --git a/bbs/qadownload.php b/bbs/qadownload.php
index b6f163ed7..93cf8e210 100644
--- a/bbs/qadownload.php
+++ b/bbs/qadownload.php
@@ -4,7 +4,7 @@ include_once('./_common.php');
// clean the output buffer
ob_end_clean();
-$no = (int)$no;
+$no = isset($_REQUEST['no']) ? (int) $_REQUEST['no'] : 0;
// 쿠키에 저장된 ID값과 넘어온 ID값을 비교하여 같지 않을 경우 오류 발생
// 다른곳에서 링크 거는것을 방지하기 위한 코드
@@ -71,5 +71,4 @@ while(!feof($fp)) {
usleep(1000);
}
fclose ($fp);
-flush();
-?>
+flush();
\ No newline at end of file
diff --git a/bbs/qahead.php b/bbs/qahead.php
index 976f4d524..256cd0058 100644
--- a/bbs/qahead.php
+++ b/bbs/qahead.php
@@ -14,5 +14,4 @@ if (G5_IS_MOBILE) {
else
include ('./_head.php');
echo conv_content($qaconfig['qa_content_head'], 1);
-}
-?>
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/bbs/qalist.php b/bbs/qalist.php
index 4d404c610..08fd0b175 100644
--- a/bbs/qalist.php
+++ b/bbs/qalist.php
@@ -6,12 +6,20 @@ if($is_guest)
$qaconfig = get_qa_config();
+$token = '';
+if( $is_admin ){
+ $token = _token();
+ set_session('ss_qa_delete_token', $token);
+}
+
$g5['title'] = $qaconfig['qa_title'];
include_once('./qahead.php');
$skin_file = $qa_skin_path.'/list.skin.php';
+$is_auth = $is_admin ? true : false;
$category_option = '';
+
if ($qaconfig['qa_category']) {
$category_href = G5_BBS_URL.'/qalist.php';
@@ -120,5 +128,4 @@ if(is_file($skin_file)) {
echo ''.str_replace(G5_PATH.'/', '', $skin_file).'이 존재하지 않습니다.
';
}
-include_once('./qatail.php');
-?>
\ No newline at end of file
+include_once('./qatail.php');
\ No newline at end of file
diff --git a/bbs/qatail.php b/bbs/qatail.php
index 8b22bcf66..1fb3cf646 100644
--- a/bbs/qatail.php
+++ b/bbs/qatail.php
@@ -11,5 +11,4 @@ if (G5_IS_MOBILE) {
@include ($qaconfig['qa_include_tail']);
else
include ('./_tail.php');
-}
-?>
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/bbs/qaview.php b/bbs/qaview.php
index 1bdbd48f3..59543188f 100644
--- a/bbs/qaview.php
+++ b/bbs/qaview.php
@@ -2,10 +2,16 @@
include_once('./_common.php');
include_once(G5_EDITOR_LIB);
+$qa_id = isset($_REQUEST['qa_id']) ? (int) $_REQUEST['qa_id'] : 0;
+
if($is_guest)
alert('회원이시라면 로그인 후 이용해 보십시오.', './login.php?url='.urlencode(G5_BBS_URL.'/qaview.php?qa_id='.$qa_id));
$qaconfig = get_qa_config();
+$content = '';
+
+$token = _token();
+set_session('ss_qa_delete_token', $token);
$g5['title'] = $qaconfig['qa_title'];
include_once('./qahead.php');
@@ -20,7 +26,7 @@ if(is_file($skin_file)) {
$view = sql_fetch($sql);
- if(!$view['qa_id'])
+ if(!(isset($view['qa_id']) && $view['qa_id']))
alert('게시글이 존재하지 않습니다.\\n삭제되었거나 자신의 글이 아닌 경우입니다.');
$subject_len = G5_IS_MOBILE ? $qaconfig['qa_mobile_subject_len'] : $qaconfig['qa_subject_len'];
@@ -107,9 +113,9 @@ if(is_file($skin_file)) {
$update_href = G5_BBS_URL.'/qawrite.php?w=u&qa_id='.$view['qa_id'].$qstr;
}
*/
+
if(($view['qa_type'] && $is_admin) || (!$view['qa_type'] && $view['qa_status'] == 0)) {
$update_href = G5_BBS_URL.'/qawrite.php?w=u&qa_id='.$view['qa_id'].$qstr;
- set_session('ss_qa_delete_token', $token = uniqid(time()));
$delete_href = G5_BBS_URL.'/qadelete.php?qa_id='.$view['qa_id'].'&token='.$token.$qstr;
}
@@ -126,7 +132,7 @@ if(is_file($skin_file)) {
if($is_admin) {
$answer_update_href = G5_BBS_URL.'/qawrite.php?w=u&qa_id='.$answer['qa_id'].$qstr;
- $answer_delete_href = G5_BBS_URL.'/qadelete.php?qa_id='.$answer['qa_id'].$qstr;
+ $answer_delete_href = G5_BBS_URL.'/qadelete.php?qa_id='.$answer['qa_id'].'&token='.$token.$qstr;
}
}
@@ -168,10 +174,19 @@ if(is_file($skin_file)) {
}
}
+ $html_value = '';
+ $html_checked = '';
+ if (isset($view['qa_html']) && $view['qa_html']) {
+ $html_checked = 'checked';
+ $html_value = $view['qa_html'];
+
+ if($view['qa_html'] == 1 && !$is_dhtml_editor)
+ $html_value = 2;
+ }
+
include_once($skin_file);
} else {
echo ''.str_replace(G5_PATH.'/', '', $skin_file).'이 존재하지 않습니다.
';
}
-include_once('./qatail.php');
-?>
\ No newline at end of file
+include_once('./qatail.php');
\ No newline at end of file
diff --git a/bbs/qawrite.php b/bbs/qawrite.php
index 484f271b5..fb041e0ad 100644
--- a/bbs/qawrite.php
+++ b/bbs/qawrite.php
@@ -6,10 +6,15 @@ if($w != '' && $w != 'u' && $w != 'r') {
alert('올바른 방법으로 이용해 주십시오.');
}
+$qa_id = isset($_REQUEST['qa_id']) ? (int) $_REQUEST['qa_id'] : 0;
+$write = array('qa_email_recv'=>'', 'qa_subject'=>'', 'qa_category'=>'');
+
if($is_guest)
alert('회원이시라면 로그인 후 이용해 보십시오.', './login.php?url='.urlencode(G5_BBS_URL.'/qalist.php'));
$qaconfig = get_qa_config();
+$token = _token();
+set_session('ss_qa_write_token', $token);
$g5['title'] = $qaconfig['qa_title'];
include_once('./qahead.php');
@@ -90,7 +95,7 @@ if(is_file($skin_file)) {
$upload_max_filesize = number_format($qaconfig['qa_upload_size']) . ' 바이트';
$html_value = '';
- if ($write['qa_html']) {
+ if (isset($write['qa_html']) && $write['qa_html']) {
$html_checked = 'checked';
$html_value = $write['qa_html'];
@@ -137,5 +142,4 @@ if(is_file($skin_file)) {
echo ''.str_replace(G5_PATH.'/', '', $skin_file).'이 존재하지 않습니다.
';
}
-include_once('./qatail.php');
-?>
\ No newline at end of file
+include_once('./qatail.php');
\ No newline at end of file
diff --git a/bbs/qawrite_update.php b/bbs/qawrite_update.php
index 02ebd1cef..ab0b9b3a7 100644
--- a/bbs/qawrite_update.php
+++ b/bbs/qawrite_update.php
@@ -12,9 +12,18 @@ if($is_guest)
$msg = array();
+$write_token = get_session('ss_qa_write_token');
+set_session('ss_qa_write_token', '');
+
+$token = isset($_POST['token']) ? clean_xss_tags($_POST['token'], 1, 1) : '';
+
+//모든 회원의 토큰을 검사합니다.
+if (!($token && $write_token === $token))
+ alert('올바른 방법으로 이용해 주십시오.');
+
// 1:1문의 설정값
$qaconfig = get_qa_config();
-$qa_id = isset($qa_id) ? (int) $qa_id : 0;
+$qa_id = isset($_POST['qa_id']) ? (int) $_POST['qa_id'] : 0;
if(trim($qaconfig['qa_category'])) {
if($w != 'a') {
@@ -57,8 +66,7 @@ if (!empty($msg)) {
alert($msg);
}
-if($qa_hp)
- $qa_hp = preg_replace('/[^0-9\-]/', '', strip_tags($qa_hp));
+$qa_hp = isset($_POST['qa_hp']) ? preg_replace('/[^0-9\-]/', '', $_POST['qa_hp']) : '';
// 090710
if (substr_count($qa_content, '') > 50) {
@@ -72,6 +80,13 @@ if (empty($_POST)) {
alert("파일 또는 글내용의 크기가 서버에서 설정한 값을 넘어 오류가 발생하였습니다.\\npost_max_size=".ini_get('post_max_size')." , upload_max_filesize=".$upload_max_filesize."\\n게시판관리자 또는 서버관리자에게 문의 바랍니다.");
}
+$qa_type = 0;
+$qa_parent = 0;
+$qa_related = 0;
+$qa_email_recv = (isset($_POST['qa_email_recv']) && $_POST['qa_email_recv']) ? 1 : 0;
+$qa_sms_recv = (isset($_POST['qa_sms_recv']) && $_POST['qa_sms_recv']) ? 1 : 0;
+$qa_status = 0;
+
for ($i=1; $i<=5; $i++) {
$var = "qa_$i";
$$var = "";
@@ -115,7 +130,7 @@ if($w == 'u' || $w == 'a' || $w == 'r') {
// 파일개수 체크
$file_count = 0;
-$upload_count = count($_FILES['bf_file']['name']);
+$upload_count = isset($_FILES['bf_file']['name']) ? count($_FILES['bf_file']['name']) : 0;
for ($i=1; $i<=$upload_count; $i++) {
if($_FILES['bf_file']['name'][$i] && is_uploaded_file($_FILES['bf_file']['tmp_name'][$i]))
@@ -134,7 +149,7 @@ $chars_array = array_merge(range(0,9), range('a','z'), range('A','Z'));
// 가변 파일 업로드
$file_upload_msg = '';
$upload = array();
-for ($i=1; $i<=count($_FILES['bf_file']['name']); $i++) {
+for ($i=1; $i<=$upload_count; $i++) {
$upload[$i]['file'] = '';
$upload[$i]['source'] = '';
$upload[$i]['del_check'] = false;
@@ -142,7 +157,7 @@ for ($i=1; $i<=count($_FILES['bf_file']['name']); $i++) {
// 삭제에 체크가 되어있다면 파일을 삭제합니다.
if (isset($_POST['bf_file_del'][$i]) && $_POST['bf_file_del'][$i]) {
$upload[$i]['del_check'] = true;
- @unlink(G5_DATA_PATH.'/qa/'.$write['qa_file'.$i]);
+ @unlink(G5_DATA_PATH.'/qa/'.clean_relative_paths($write['qa_file'.$i]));
// 썸네일삭제
if(preg_match("/\.({$config['cf_image_extension']})$/i", $write['qa_file'.$i])) {
delete_qa_thumbnail($write['qa_file'.$i]);
@@ -189,7 +204,7 @@ for ($i=1; $i<=count($_FILES['bf_file']['name']); $i++) {
if ($w == 'u') {
// 존재하는 파일이 있다면 삭제합니다.
- @unlink(G5_DATA_PATH.'/qa/'.$write['qa_file'.$i]);
+ @unlink(G5_DATA_PATH.'/qa/'.clean_relative_paths($write['qa_file'.$i]));
// 이미지파일이면 썸네일삭제
if(preg_match("/\.({$config['cf_image_extension']})$/i", $write['qa_file'.$i])) {
delete_qa_thumbnail($row['qa_file'.$i]);
@@ -229,11 +244,16 @@ if($w == '' || $w == 'a' || $w == 'r') {
$qa_num = $write['qa_num'];
$qa_parent = $write['qa_id'];
$qa_related = $write['qa_related'];
- $qa_category = $write['qa_category'];
+ $qa_category = addslashes($write['qa_category']);
$qa_type = 1;
$qa_status = 1;
}
+ $insert_qa_file1 = isset($upload[1]['file']) ? $upload[1]['file'] : '';
+ $insert_qa_source1 = isset($upload[1]['source']) ? $upload[1]['source'] : '';
+ $insert_qa_file2 = isset($upload[2]['file']) ? $upload[2]['file'] : '';
+ $insert_qa_source2 = isset($upload[2]['source']) ? $upload[2]['source'] : '';
+
$sql = " insert into {$g5['qa_content_table']}
set qa_num = '$qa_num',
mb_id = '{$member['mb_id']}',
@@ -250,10 +270,10 @@ if($w == '' || $w == 'a' || $w == 'r') {
qa_subject = '$qa_subject',
qa_content = '$qa_content',
qa_status = '$qa_status',
- qa_file1 = '{$upload[1]['file']}',
- qa_source1 = '{$upload[1]['source']}',
- qa_file2 = '{$upload[2]['file']}',
- qa_source2 = '{$upload[2]['source']}',
+ qa_file1 = '{$insert_qa_file1}',
+ qa_source1 = '{$insert_qa_source1}',
+ qa_file2 = '{$insert_qa_file2}',
+ qa_source2 = '{$insert_qa_source2}',
qa_ip = '{$_SERVER['REMOTE_ADDR']}',
qa_datetime = '".G5_TIME_YMDHIS."',
qa_1 = '$qa_1',
@@ -450,5 +470,4 @@ else
if ($file_upload_msg)
alert($file_upload_msg, $result_url);
else
- goto_url($result_url);
-?>
\ No newline at end of file
+ goto_url($result_url);
\ No newline at end of file
diff --git a/bbs/register.php b/bbs/register.php
index e6fbb31a3..b417534c6 100644
--- a/bbs/register.php
+++ b/bbs/register.php
@@ -15,5 +15,4 @@ include_once('./_head.php');
$register_action_url = G5_BBS_URL.'/register_form.php';
include_once($member_skin_path.'/register.skin.php');
-include_once('./_tail.php');
-?>
+include_once('./_tail.php');
\ No newline at end of file
diff --git a/bbs/register_email.php b/bbs/register_email.php
index 2d83f2c72..54ab2f6f7 100644
--- a/bbs/register_email.php
+++ b/bbs/register_email.php
@@ -5,14 +5,19 @@ include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
$g5['title'] = '메일인증 메일주소 변경';
include_once('./_head.php');
-$mb_id = substr(clean_xss_tags($_GET['mb_id']), 0, 20);
-$sql = " select mb_email, mb_datetime, mb_ip, mb_email_certify from {$g5['member_table']} where mb_id = '{$mb_id}' ";
+$mb_id = isset($_GET['mb_id']) ? substr(clean_xss_tags($_GET['mb_id']), 0, 20) : '';
+$sql = " select mb_email, mb_datetime, mb_ip, mb_email_certify, mb_id from {$g5['member_table']} where mb_id = '{$mb_id}' ";
$mb = sql_fetch($sql);
+
+if(! (isset($mb['mb_id']) && $mb['mb_id'])){
+ alert("해당 회원이 존재하지 않습니다.", G5_URL);
+}
+
if (substr($mb['mb_email_certify'],0,1)!=0) {
alert("이미 메일인증 하신 회원입니다.", G5_URL);
}
-$ckey = trim($_GET['ckey']);
+$ckey = isset($_GET['ckey']) ? trim($_GET['ckey']) : '';
$key = md5($mb['mb_ip'].$mb['mb_datetime']);
if(!$ckey || $ckey != $key)
@@ -54,5 +59,4 @@ function fregister_email_submit(f)
}
+include_once('./_tail.php');
\ No newline at end of file
diff --git a/bbs/register_email_update.php b/bbs/register_email_update.php
index ec6a5672d..0dda117d9 100644
--- a/bbs/register_email_update.php
+++ b/bbs/register_email_update.php
@@ -3,8 +3,8 @@ include_once('./_common.php');
include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
include_once(G5_LIB_PATH.'/mailer.lib.php');
-$mb_id = substr(clean_xss_tags($_POST['mb_id']), 0, 20);
-$mb_email = get_email_address(trim($_POST['mb_email']));
+$mb_id = isset($_POST['mb_id']) ? substr(clean_xss_tags($_POST['mb_id']), 0, 20) : '';
+$mb_email = isset($_POST['mb_email']) ? get_email_address(trim($_POST['mb_email'])) : '';
if(!$mb_id || !$mb_email)
alert('올바른 방법으로 이용해 주십시오.', G5_URL);
@@ -47,5 +47,4 @@ mailer($config['cf_admin_email_name'], $config['cf_admin_email'], $mb_email, $su
$sql = " update {$g5['member_table']} set mb_email = '$mb_email' where mb_id = '$mb_id' ";
sql_query($sql);
-alert("인증메일을 {$mb_email} 메일로 다시 보내 드렸습니다.\\n\\n잠시후 {$mb_email} 메일을 확인하여 주십시오.", G5_URL);
-?>
\ No newline at end of file
+alert("인증메일을 {$mb_email} 메일로 다시 보내 드렸습니다.\\n\\n잠시후 {$mb_email} 메일을 확인하여 주십시오.", G5_URL);
\ No newline at end of file
diff --git a/bbs/register_form.php b/bbs/register_form.php
index d72804dd2..c79046575 100644
--- a/bbs/register_form.php
+++ b/bbs/register_form.php
@@ -14,7 +14,7 @@ set_session("ss_cert_type", "");
$is_social_login_modify = false;
-if( $provider && function_exists('social_nonce_is_valid') ){ //모바일로 소셜 연결을 했다면
+if( isset($_REQUEST['provider']) && $_REQUEST['provider'] && function_exists('social_nonce_is_valid') ){ //모바일로 소셜 연결을 했다면
if( social_nonce_is_valid(get_session("social_link_token"), $provider) ){ //토큰값이 유효한지 체크
$w = 'u'; //회원 수정으로 처리
$_POST['mb_id'] = $member['mb_id'];
@@ -87,7 +87,7 @@ if ($w == "") {
if (isset($_POST['mb_password'])) {
// 수정된 정보를 업데이트후 되돌아 온것이라면 비밀번호가 암호화 된채로 넘어온것임
- if ($_POST['is_update']) {
+ if (isset($_POST['is_update']) && $_POST['is_update']) {
$tmp_password = $_POST['mb_password'];
$pass_check = ($member['mb_password'] === $tmp_password);
} else {
@@ -131,19 +131,21 @@ include_once('./_head.php');
// 회원아이콘 경로
$mb_icon_path = G5_DATA_PATH.'/member/'.substr($member['mb_id'],0,2).'/'.get_mb_icon_name($member['mb_id']).'.gif';
-$mb_icon_url = G5_DATA_URL.'/member/'.substr($member['mb_id'],0,2).'/'.get_mb_icon_name($member['mb_id']).'.gif';
+$mb_icon_filemtile = (defined('G5_USE_MEMBER_IMAGE_FILETIME') && G5_USE_MEMBER_IMAGE_FILETIME && file_exists($mb_icon_path)) ? '?'.filemtime($mb_icon_path) : '';
+$mb_icon_url = G5_DATA_URL.'/member/'.substr($member['mb_id'],0,2).'/'.get_mb_icon_name($member['mb_id']).'.gif'.$mb_icon_filemtile;
// 회원이미지 경로
$mb_img_path = G5_DATA_PATH.'/member_image/'.substr($member['mb_id'],0,2).'/'.get_mb_icon_name($member['mb_id']).'.gif';
-$mb_img_url = G5_DATA_URL.'/member_image/'.substr($member['mb_id'],0,2).'/'.get_mb_icon_name($member['mb_id']).'.gif';
+$mb_img_filemtile = (defined('G5_USE_MEMBER_IMAGE_FILETIME') && G5_USE_MEMBER_IMAGE_FILETIME && file_exists($mb_img_path)) ? '?'.filemtime($mb_img_path) : '';
+$mb_img_url = G5_DATA_URL.'/member_image/'.substr($member['mb_id'],0,2).'/'.get_mb_icon_name($member['mb_id']).'.gif'.$mb_img_filemtile;
$register_action_url = G5_HTTPS_BBS_URL.'/register_form_update.php';
$req_nick = !isset($member['mb_nick_date']) || (isset($member['mb_nick_date']) && $member['mb_nick_date'] <= date("Y-m-d", G5_SERVER_TIME - ($config['cf_nick_modify'] * 86400)));
$required = ($w=='') ? 'required' : '';
$readonly = ($w=='u') ? 'readonly' : '';
-$agree = preg_replace('#[^0-9]#', '', $agree);
-$agree2 = preg_replace('#[^0-9]#', '', $agree2);
+$agree = isset($_REQUEST['agree']) ? preg_replace('#[^0-9]#', '', $_REQUEST['agree']) : '';
+$agree2 = isset($_REQUEST['agree2']) ? preg_replace('#[^0-9]#', '', $_REQUEST['agree2']) : '';
// add_javascript('js 구문', 출력순서); 숫자가 작을 수록 먼저 출력됨
if ($config['cf_use_addr'])
@@ -153,5 +155,4 @@ include_once($member_skin_path.'/register_form.skin.php');
run_event('register_form_after', $w, $agree, $agree2);
-include_once('./_tail.php');
-?>
\ No newline at end of file
+include_once('./_tail.php');
\ No newline at end of file
diff --git a/bbs/register_form_update.php b/bbs/register_form_update.php
index c68a33687..9cafded03 100644
--- a/bbs/register_form_update.php
+++ b/bbs/register_form_update.php
@@ -24,18 +24,18 @@ if (!chk_captcha()) {
if($w == 'u')
$mb_id = isset($_SESSION['ss_mb_id']) ? trim($_SESSION['ss_mb_id']) : '';
else if($w == '')
- $mb_id = trim($_POST['mb_id']);
+ $mb_id = isset($_POST['mb_id']) ? trim($_POST['mb_id']) : '';
else
alert('잘못된 접근입니다', G5_URL);
if(!$mb_id)
alert('회원아이디 값이 없습니다. 올바른 방법으로 이용해 주십시오.');
-$mb_password = trim($_POST['mb_password']);
-$mb_password_re = trim($_POST['mb_password_re']);
-$mb_name = trim($_POST['mb_name']);
-$mb_nick = trim($_POST['mb_nick']);
-$mb_email = trim($_POST['mb_email']);
+$mb_password = isset($_POST['mb_password']) ? trim($_POST['mb_password']) : '';
+$mb_password_re = isset($_POST['mb_password_re']) ? trim($_POST['mb_password_re']) : '';
+$mb_name = isset($_POST['mb_name']) ? trim($_POST['mb_name']) : '';
+$mb_nick = isset($_POST['mb_nick']) ? trim($_POST['mb_nick']) : '';
+$mb_email = isset($_POST['mb_email']) ? trim($_POST['mb_email']) : '';
$mb_sex = isset($_POST['mb_sex']) ? trim($_POST['mb_sex']) : "";
$mb_birth = isset($_POST['mb_birth']) ? trim($_POST['mb_birth']) : "";
$mb_homepage = isset($_POST['mb_homepage']) ? trim($_POST['mb_homepage']) : "";
@@ -127,7 +127,8 @@ if ($w == '' || $w == 'u') {
// 본인확인 체크
if($config['cf_cert_use'] && $config['cf_cert_req']) {
- if(trim($_POST['cert_no']) != $_SESSION['ss_cert_no'] || !$_SESSION['ss_cert_no'])
+ $post_cert_no = isset($_POST['cert_no']) ? trim($_POST['cert_no']) : '';
+ if($post_cert_no !== get_session('ss_cert_no') || ! get_session('ss_cert_no'))
alert("회원가입을 위해서는 본인확인을 해주셔야 합니다.");
}
@@ -161,9 +162,9 @@ if ($w == '' || $w == 'u') {
// 본인확인
//---------------------------------------------------------------
$mb_hp = hyphen_hp_number($mb_hp);
-if($config['cf_cert_use'] && $_SESSION['ss_cert_type'] && $_SESSION['ss_cert_dupinfo']) {
+if($config['cf_cert_use'] && get_session('ss_cert_type') && get_session('ss_cert_dupinfo')) {
// 중복체크
- $sql = " select mb_id from {$g5['member_table']} where mb_id <> '{$member['mb_id']}' and mb_dupinfo = '{$_SESSION['ss_cert_dupinfo']}' ";
+ $sql = " select mb_id from {$g5['member_table']} where mb_id <> '{$member['mb_id']}' and mb_dupinfo = '".get_session('ss_cert_dupinfo')."' ";
$row = sql_fetch($sql);
if ($row['mb_id']) {
alert("입력하신 본인확인 정보로 가입된 내역이 존재합니다.\\n회원아이디 : ".$row['mb_id']);
@@ -171,17 +172,17 @@ if($config['cf_cert_use'] && $_SESSION['ss_cert_type'] && $_SESSION['ss_cert_dup
}
$sql_certify = '';
-$md5_cert_no = $_SESSION['ss_cert_no'];
-$cert_type = $_SESSION['ss_cert_type'];
+$md5_cert_no = get_session('ss_cert_no');
+$cert_type = get_session('ss_cert_type');
if ($config['cf_cert_use'] && $cert_type && $md5_cert_no) {
// 해시값이 같은 경우에만 본인확인 값을 저장한다.
- if ($_SESSION['ss_cert_hash'] == md5($mb_name.$cert_type.$_SESSION['ss_cert_birth'].$md5_cert_no)) {
+ if (get_session('ss_cert_hash') == md5($mb_name.$cert_type.get_session('ss_cert_birth').$md5_cert_no)) {
$sql_certify .= " , mb_hp = '{$mb_hp}' ";
$sql_certify .= " , mb_certify = '{$cert_type}' ";
- $sql_certify .= " , mb_adult = '{$_SESSION['ss_cert_adult']}' ";
- $sql_certify .= " , mb_birth = '{$_SESSION['ss_cert_birth']}' ";
- $sql_certify .= " , mb_sex = '{$_SESSION['ss_cert_sex']}' ";
- $sql_certify .= " , mb_dupinfo = '{$_SESSION['ss_cert_dupinfo']}' ";
+ $sql_certify .= " , mb_adult = '".get_session('ss_cert_adult')."' ";
+ $sql_certify .= " , mb_birth = '".get_session('ss_cert_birth')."' ";
+ $sql_certify .= " , mb_sex = '".get_session('ss_cert_sex')."' ";
+ $sql_certify .= " , mb_dupinfo = '".get_session('ss_cert_dupinfo')."' ";
if($w == 'u')
$sql_certify .= " , mb_name = '{$mb_name}' ";
} else {
@@ -304,7 +305,7 @@ if ($w == '') {
set_session('ss_mb_reg', $mb_id);
} else if ($w == 'u') {
- if (!trim($_SESSION['ss_mb_id']))
+ if (!trim(get_session('ss_mb_id')))
alert('로그인 되어 있지 않습니다.');
if (trim($_POST['mb_id']) != $mb_id)
@@ -508,11 +509,11 @@ if ($config['cf_use_email_certify'] && $old_email != $mb_email) {
// 사용자 코드 실행
@include_once ($member_skin_path.'/register_form_update.tail.skin.php');
-unset($_SESSION['ss_cert_type']);
-unset($_SESSION['ss_cert_no']);
-unset($_SESSION['ss_cert_hash']);
-unset($_SESSION['ss_cert_birth']);
-unset($_SESSION['ss_cert_adult']);
+if(isset($_SESSION['ss_cert_type'])) unset($_SESSION['ss_cert_type']);
+if(isset($_SESSION['ss_cert_no'])) unset($_SESSION['ss_cert_no']);
+if(isset($_SESSION['ss_cert_hash'])) unset($_SESSION['ss_cert_hash']);
+if(isset($_SESSION['ss_cert_birth'])) unset($_SESSION['ss_cert_birth']);
+if(isset($_SESSION['ss_cert_adult'])) unset($_SESSION['ss_cert_adult']);
if ($msg)
echo '';
@@ -549,5 +550,4 @@ if ($w == '') {