5.0.13 버전 패치 적용

adm/config_form.php

@@ -213,14 +213,7 @@ if (!$config['cf_icode_server_ip'])   $config['cf_icode_server_ip'] = '211.172.2
 if (!$config['cf_icode_server_port']) $config['cf_icode_server_port'] = '7295';
 
 if ($config['cf_icode_id'] && $config['cf_icode_pw']) {
-    $res = get_sock('http://www.icodekorea.com/res/userinfo.php?userid='.$config['cf_icode_id'].'&userpw='.$config['cf_icode_pw']);
+    $userinfo = get_icode_userinfo($config['cf_icode_id'], $config['cf_icode_pw']);
-    $res = explode(';', $res);
-    $userinfo = array(
-        'code'      => $res[0], // 결과코드
-        'coin'      => $res[1], // 고객 잔액 (충전제만 해당)
-        'gpay'      => $res[2], // 고객의 건수 별 차감액 표시 (충전제만 해당)
-        'payment'   => $res[3]  // 요금제 표시, A:충전제, C:정액제
-    );
 }
 ?>
 

adm/sms_admin/config.php

@@ -11,14 +11,7 @@ if (!$config['cf_icode_server_port']) $config['cf_icode_server_port'] = '7295';
 
 if ($config['cf_icode_id'] && $config['cf_icode_pw'])
 {
-    $res = get_sock('http://www.icodekorea.com/res/userinfo.php?userid='.$config['cf_icode_id'].'&userpw='.$config['cf_icode_pw']);
+    $userinfo = get_icode_userinfo($config['cf_icode_id'], $config['cf_icode_pw']);
-    $res = explode(';', $res);
-    $userinfo = array(
-        'code'      => $res[0], // 결과코드
-        'coin'      => $res[1], // 고객 잔액 (충전제만 해당)
-        'gpay'      => $res[2], // 고객의 건수 별 차감액 표시 (충전제만 해당)
-        'payment'   => $res[3]  // 요금제 표시, A:충전제, C:정액제
-    );
 }
 
 if (!$config['cf_icode_id'])

adm/sms_admin/config_update.php

@@ -8,14 +8,7 @@ check_demo();
 
 $g5['title'] = "SMS 기본설정";
 
-$res = get_sock("http://www.icodekorea.com/res/userinfo.php?userid=$cf_icode_id&userpw=$cf_icode_pw");
+$userinfo = get_icode_userinfo($cf_icode_id, $cf_icode_pw);
-$res = explode(';', $res);
-$userinfo = array(
-    'code'      => $res[0], // 결과코드
-    'coin'      => $res[1], // 고객 잔액 (충전제만 해당)
-    'gpay'      => $res[2], // 고객의 건수 별 차감액 표시 (충전제만 해당)
-    'payment'   => $res[3]  // 요금제 표시, A:충전제, C:정액제
-);
 
 if ($userinfo['code'] == '202')
     alert('아이코드 아이디와 패스워드가 맞지 않습니다.');

adm/sms_admin/member_update.php

@@ -45,8 +45,13 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
             dataType:"json",
             data:params,
             success: function(data) {
-                $("#datetime").html( data.datetime );
+                if(data.error){
-                $("#res_msg").html( data.res_msg );
+                    alert( data.error );
+                    $("#res_msg").html("");
+                } else {
+                    $("#datetime").html( data.datetime );
+                    $("#res_msg").html( data.res_msg );
+                }
             },
             error: function (xhr, ajaxOptions, thrownError) {
                 alert(xhr.status);

adm/sms_admin/member_update_run.php

@@ -3,6 +3,14 @@ $sub_menu = "900200";
 include_once("./_common.php");
 @include_once(G5_PLUGIN_PATH."/sms5/JSON.php");
 
+if(empty($config['cf_sms_use'])){
+    if( $mtype == "json" ){
+        die("{\"error\":\"환경 설정의 SMS 사용에서 아이코드를 사용설정해 주셔야 실행할수 있습니다.\"}");
+    } else {
+        die("환경 설정의 SMS 사용에서 아이코드를 사용설정해 주셔야 실행할수 있습니다.");
+    }
+}
+
 if( !function_exists('json_encode') ) {
     function json_encode($data) {
         $json = new Services_JSON();

bbs/board.php

@@ -236,7 +236,7 @@ if ($member['mb_level'] >= $board['bo_list_level'] && $board['bo_use_list_view']
 
 include_once('./board_tail.php');
 
-echo "\n<!-- 사용스킨 : {$board_skin_url} -->\n";
+echo "\n<!-- 사용스킨 : ".(G5_IS_MOBEILE ? $board['bo_mobile_skin'] : $board['bo_skin'])." -->\n";
 
 include_once(G5_PATH.'/tail.sub.php');
 ?>

bbs/faq.php

@@ -27,15 +27,6 @@ if (!$fm['fm_id'])
 
 $g5['title'] = $fm['fm_subject'];
 
-if(G5_IS_MOBILE){
-    $faq_skin = $config['cf_mobile_faq_skin'];
-} else {
-    $faq_skin = $config['cf_faq_skin'];
-}
-
-if(!$faq_skin) $faq_skin = 'basic';
-$faq_skin_path = (G5_IS_MOBILE ? G5_MOBILE_PATH : G5_PATH).'/'.G5_SKIN_DIR.'/faq/'.$faq_skin;
-$faq_skin_url = (G5_IS_MOBILE ? G5_MOBILE_URL : G5_URL).'/'.G5_SKIN_DIR.'/faq/'.$faq_skin;
 $skin_file = $faq_skin_path.'/list.skin.php';
 
 include_once('./_head.php');

bbs/search.php

@@ -172,7 +172,6 @@ if ($stx) {
 
             if ($row['wr_is_comment'])
             {
-                $link .= '#c'.$row['wr_id'];
                 $sql2 = " select wr_subject, wr_option from {$tmp_write_table} where wr_id = '{$row['wr_parent']}' ";
                 $row2 = sql_fetch($sql2);
                 //$row['wr_subject'] = $row2['wr_subject'];
@@ -204,7 +203,7 @@ if ($stx) {
 
             $list[$idx][$i]['subject'] = $subject;
             $list[$idx][$i]['content'] = $content;
-            $list[$idx][$i]['name'] = get_sideview($row['mb_id'], cut_str($row['wr_name'], $config['cf_cut_name']), $row['wr_email'], $row['wr_homepage']);
+            $list[$idx][$i]['name'] = get_sideview($row['mb_id'], get_text(cut_str($row['wr_name'], $config['cf_cut_name'])), $row['wr_email'], $row['wr_homepage']);
 
             $k++;
             if ($k >= $rows)

bbs/write.php

@@ -408,7 +408,7 @@ include_once('./board_head.php');
 
 $action_url = https_url(G5_BBS_DIR)."/write_update.php";
 
-echo '<!-- skin : '.$board_skin_path.' -->';
+echo '<!-- skin : '.(G5_IS_MOBEILE ? $board['bo_mobile_skin'] : $board['bo_skin']).' -->';
 include_once ($board_skin_path.'/write.skin.php');
 
 include_once('./board_tail.php');

common.php

@@ -252,7 +252,7 @@ if (isset($_REQUEST['PHPSESSID']) && $_REQUEST['PHPSESSID'] != session_id())
 $qstr = '';
 
 if (isset($_REQUEST['sca']))  {
-    $sca = trim($_REQUEST['sca']);
+    $sca = clean_xss_tags(trim($_REQUEST['sca']));
     if ($sca)
         $qstr .= '&sca=' . urlencode($sca);
 } else {
@@ -453,9 +453,9 @@ if ($is_admin != 'super') {
             if (empty($pattern[$i]))
                 continue;
 
-            //$pat = "/({$pattern[$i]})/";
             $pattern[$i] = str_replace(".", "\.", $pattern[$i]);
-            $pat = "/^{$pattern[$i]}/";
+            $pattern[$i] = str_replace("+", "[0-9\.]+", $pattern[$i]);
+            $pat = "/^{$pattern[$i]}$/";
             $is_possible_ip = preg_match($pat, $_SERVER['REMOTE_ADDR']);
             if ($is_possible_ip)
                 break;
@@ -473,7 +473,8 @@ if ($is_admin != 'super') {
             continue;
 
         $pattern[$i] = str_replace(".", "\.", $pattern[$i]);
-        $pat = "/^{$pattern[$i]}/";
+        $pattern[$i] = str_replace("+", "[0-9\.]+", $pattern[$i]);
+        $pat = "/^{$pattern[$i]}$/";
         $is_intercept_ip = preg_match($pat, $_SERVER['REMOTE_ADDR']);
         if ($is_intercept_ip)
             die ("접근 불가합니다.");
@@ -495,6 +496,8 @@ if (G5_IS_MOBILE) {
     $search_skin_url    = G5_MOBILE_URL .'/'.G5_SKIN_DIR.'/search/'.$config['cf_mobile_search_skin'];
     $connect_skin_path  = G5_MOBILE_PATH.'/'.G5_SKIN_DIR.'/connect/'.$config['cf_mobile_connect_skin'];
     $connect_skin_url   = G5_MOBILE_URL .'/'.G5_SKIN_DIR.'/connect/'.$config['cf_mobile_connect_skin'];
+    $faq_skin_path      = G5_MOBILE_PATH .'/'.G5_SKIN_DIR.'/faq/'.$config['cf_mobile_faq_skin'];
+    $faq_skin_url       = G5_MOBILE_URL .'/'.G5_SKIN_DIR.'/faq/'.$config['cf_mobile_faq_skin'];
 } else {
     $board_skin_path    = G5_SKIN_PATH.'/board/'.$board['bo_skin'];
     $board_skin_url     = G5_SKIN_URL .'/board/'.$board['bo_skin'];
@@ -506,6 +509,8 @@ if (G5_IS_MOBILE) {
     $search_skin_url    = G5_SKIN_URL .'/search/'.$config['cf_search_skin'];
     $connect_skin_path  = G5_SKIN_PATH.'/connect/'.$config['cf_connect_skin'];
     $connect_skin_url   = G5_SKIN_URL .'/connect/'.$config['cf_connect_skin'];
+    $faq_skin_path      = G5_SKIN_PATH.'/faq/'.$config['cf_faq_skin'];
+    $faq_skin_url       = G5_SKIN_URL.'/faq/'.$config['cf_faq_skin'];
 }
 //==============================================================================
 

extend/sms5.extend.php

@@ -24,7 +24,7 @@ $g5['sms5_form_table']            = $g5['sms5_prefix'] . 'form';
 $g5['sms5_form_group_table']      = $g5['sms5_prefix'] . 'form_group';
 $g5['sms5_member_history_table']  = $g5['sms5_prefix'] . 'member_history';
 
-if ($config['cf_sms_use'] == 'icode') {
+if (!empty($config['cf_sms_use'])) {
 
     $sms5 = sql_fetch("select * from {$g5['sms5_config_table']} ", false);
     if( $sms5['cf_member'] && trim($member['mb_hp']) ) {

js/wrest.js

@@ -208,7 +208,7 @@ function wrestMinLength(fld, css)
 {
     if (!wrestTrim(fld)) return;
 
-    var str = css.split('_'); // minlength_?? <-- str[1]
+    var str = css.split('='); // minlength=?? <-- str[1]
 
     if (wrestFld == null) {
         if (fld.value.length < parseInt(str[1])) {
@@ -305,8 +305,8 @@ function wrestSubmit()
                     case "telnum"       : wrestTelNum(el); break; // 김선용 2006.3 - 전화번호 형식 검사
                     case "imgext"       : wrestImgExt(el); break;
                     default :
-                        // css 가 minlength_ 로 시작한다면 _ 뒤의 숫자는 최소길이값
+                        // css 가 minlength= 로 시작한다면 = 뒤의 숫자는 최소길이값
-                        if (/^minlength\_/.test(css)) {
+                        if (/^minlength\=/.test(css)) {
                             wrestMinLength(el, css); break;
                         } else if (/^extension\=/.test(css)) {
                             wrestExtension(el, css); break;

lib/common.lib.php

@@ -2653,6 +2653,14 @@ function get_search_string($stx)
     return $stx;
 }
 
+// XSS 관련 태그 제거
+function clean_xss_tags($str)
+{
+    $str = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $str);
+
+    return $str;
+}
+
 // unescape nl 얻기
 function conv_unescape_nl($str)
 {
@@ -2697,4 +2705,19 @@ function get_safe_filename($name)
 
     return $name;
 }
+
+// 아이코드 사용자정보
+function get_icode_userinfo($id, $pass)
+{
+    $res = get_sock('http://www.icodekorea.com/res/userinfo.php?userid='.$id.'&userpw='.$pass);
+    $res = explode(';', $res);
+    $userinfo = array(
+        'code'      => $res[0], // 결과코드
+        'coin'      => $res[1], // 고객 잔액 (충전제만 해당)
+        'gpay'      => $res[2], // 고객의 건수 별 차감액 표시 (충전제만 해당)
+        'payment'   => $res[3]  // 요금제 표시, A:충전제, C:정액제
+    );
+
+    return $userinfo;
+}
 ?>

mobile/skin/board/basic/list.skin.php

@@ -2,11 +2,9 @@
 if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
 
 // 선택옵션으로 인해 셀합치기가 가변적으로 변함
-$colspan = 5;
+$colspan = 2;
 
 if ($is_checkbox) $colspan++;
-if ($is_good) $colspan++;
-if ($is_nogood) $colspan++;
 
 // add_stylesheet('css 구문', 출력순서); 숫자가 작을 수록 먼저 출력됨
 add_stylesheet('<link rel="stylesheet" href="'.$board_skin_url.'/style.css">', 0);

mobile/skin/member/basic/register_form.skin.php

@@ -31,17 +31,17 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
             <th scope="row"><label for="reg_mb_id">아이디<strong class="sound_only">필수</strong></label></th>
             <td>
                 <span class="frm_info">영문자, 숫자, _ 만 입력 가능. 최소 3자이상 입력하세요.</span>
-                <input type="text" name="mb_id" value="<?php echo $member['mb_id'] ?>" id="reg_mb_id" class="frm_input minlength_3 <?php echo $required ?> <?php echo $readonly ?>" maxlength="20" <?php echo $required ?> <?php echo $readonly ?>>
+                <input type="text" name="mb_id" value="<?php echo $member['mb_id'] ?>" id="reg_mb_id" class="frm_input minlength=3 <?php echo $required ?> <?php echo $readonly ?>" maxlength="20" <?php echo $required ?> <?php echo $readonly ?>>
                 <span id="msg_mb_id"></span>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="reg_mb_password">비밀번호<strong class="sound_only">필수</strong></label></th>
-            <td><input type="password" name="mb_password" id="reg_mb_password" class="frm_input minlength_3 <?php echo $required ?>" maxlength="20" <?php echo $required ?>></td>
+            <td><input type="password" name="mb_password" id="reg_mb_password" class="frm_input minlength=3 <?php echo $required ?>" maxlength="20" <?php echo $required ?>></td>
         </tr>
         <tr>
             <th scope="row"><label for="reg_mb_password_re">비밀번호 확인<strong class="sound_only">필수</strong></label></th>
-            <td><input type="password" name="mb_password_re" id="reg_mb_password_re" class="frm_input minlength_3 <?php echo $required ?>" maxlength="20" <?php echo $required ?>></td>
+            <td><input type="password" name="mb_password_re" id="reg_mb_password_re" class="frm_input minlength=3 <?php echo $required ?>" maxlength="20" <?php echo $required ?>></td>
         </tr>
         </table>
     </div>

mobile/skin/search/basic/search.skin.php

@@ -106,8 +106,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',
     <?php
     $k=0;
     for ($idx=$table_index, $k=0; $idx<count($search_table) && $k<$rows; $idx++) {
-        $comment_def = "";
-        $comment_href = "";
      ?>
         <h2><a href="./board.php?bo_table=<?php echo $search_table[$idx] ?>&amp;<?php echo $search_query ?>"><?php echo $bo_subject[$idx] ?> 게시판 내 결과</a></h2>
         <ul>
@@ -115,8 +113,13 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',
         for ($i=0; $i<count($list[$idx]) && $k<$rows; $i++, $k++) {
             if ($list[$idx][$i]['wr_is_comment'])
             {
-                $comment_def = "<span class=\"cmt_def\">댓글</span>";
+                $comment_def = '<span class="cmt_def">댓글</span>';
-                $comment_href = "#c_".$list[$idx][$i]['wr_id'];
+                $comment_href = '#c_'.$list[$idx][$i]['wr_id'];
+            }
+            else
+            {
+                $comment_def = '';
+                $comment_href = '';
             }
          ?>
             <li>

plugin/sms5/write.php

@@ -68,5 +68,5 @@ if( G5_IS_MOBILE ){
     $write_skin_page = "/write.skin.php";
 }
 include_once ($sms5_skin_path.$write_skin_page);
-echo PHP_EOL.'<!-- skin : '.$sms5_skin_path.' -->'.PHP_EOL;
+echo PHP_EOL.'<!-- skin : '.$sms5['bo_skin'].' -->'.PHP_EOL;
 ?>

skin/member/basic/register_form.skin.php

@@ -34,17 +34,17 @@ add_stylesheet('<link rel="stylesheet" href="'.$member_skin_url.'/style.css">',
             <th scope="row"><label for="reg_mb_id">아이디<strong class="sound_only">필수</strong></label></th>
             <td>
                 <span class="frm_info">영문자, 숫자, _ 만 입력 가능. 최소 3자이상 입력하세요.</span>
-                <input type="text" name="mb_id" value="<?php echo $member['mb_id'] ?>" id="reg_mb_id" <?php echo $required ?> <?php echo $readonly ?> class="frm_input minlength_3 <?php echo $required ?> <?php echo $readonly ?>" maxlength="20">
+                <input type="text" name="mb_id" value="<?php echo $member['mb_id'] ?>" id="reg_mb_id" <?php echo $required ?> <?php echo $readonly ?> class="frm_input minlength=3 <?php echo $required ?> <?php echo $readonly ?>" maxlength="20">
                 <span id="msg_mb_id"></span>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="reg_mb_password">비밀번호<strong class="sound_only">필수</strong></label></th>
-            <td><input type="password" name="mb_password" id="reg_mb_password" <?php echo $required ?> class="frm_input minlength_3 <?php echo $required ?>" maxlength="20"></td>
+            <td><input type="password" name="mb_password" id="reg_mb_password" <?php echo $required ?> class="frm_input minlength=3 <?php echo $required ?>" maxlength="20"></td>
         </tr>
         <tr>
             <th scope="row"><label for="reg_mb_password_re">비밀번호 확인<strong class="sound_only">필수</strong></label></th>
-            <td><input type="password" name="mb_password_re" id="reg_mb_password_re" <?php echo $required ?> class="frm_input minlength_3 <?php echo $required ?>" maxlength="20"></td>
+            <td><input type="password" name="mb_password_re" id="reg_mb_password_re" <?php echo $required ?> class="frm_input minlength=3 <?php echo $required ?>" maxlength="20"></td>
         </tr>
         </tbody>
         </table>

skin/search/basic/search.skin.php

@@ -102,8 +102,6 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',
     <?php
     $k=0;
     for ($idx=$table_index, $k=0; $idx<count($search_table) && $k<$rows; $idx++) {
-        $comment_def = "";
-        $comment_href = "";
      ?>
         <h2><a href="./board.php?bo_table=<?php echo $search_table[$idx] ?>&amp;<?php echo $search_query ?>"><?php echo $bo_subject[$idx] ?> 게시판 내 결과</a></h2>
         <ul>
@@ -111,8 +109,13 @@ add_stylesheet('<link rel="stylesheet" href="'.$search_skin_url.'/style.css">',
         for ($i=0; $i<count($list[$idx]) && $k<$rows; $i++, $k++) {
             if ($list[$idx][$i]['wr_is_comment'])
             {
-                $comment_def = "<span class=\"cmt_def\">댓글 | </span>";
+                $comment_def = '<span class="cmt_def">댓글 | </span>';
-                $comment_href = "#c_".$list[$idx][$i]['wr_id'];
+                $comment_href = '#c_'.$list[$idx][$i]['wr_id'];
+            }
+            else
+            {
+                $comment_def = '';
+                $comment_href = '';
             }
          ?>