YounChan Lee blrun
blrun
/ apply_vote.php
Created
December 12, 2013 23:36
제로보드 4.1pl8 에서 투표수 카운팅 하는 파일의 보안문제 해결...(기존에 GET 파라미터에 의해 투표수가 조작되는 문제가 있었음)
기존의 /bbs/apply_vote.php 를 아래와 같이 수정해 주면 됨.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <? | |
| /*************************************************************************** | |
| * 공통파일 include | |
| **************************************************************************/ | |
| include "_head.php"; | |
| // 사용권한 체크 | |
| if($setup[grant_view]<$member[level]&&!$is_admin) Error("사용권한이 없습니다","login.php?id=$id&page=$page&page_num=$page_num&category=$category&sn=$sn&ss=$ss&sc=$sc&sm=$sm&keyword=$keyword&no=$no&file=zboard.php"); | |
| // 보안향상 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <? | |
| // 신택스하이라이트 처리 시작 | |
| $codePattern = "#(\[[a-z]+\_code\:[0-9]+\{[^}]*?\}\]|\[\/[a-z]+\_code\])#si"; | |
| $temp = preg_split($codePattern,$memo,-1,PREG_SPLIT_DELIM_CAPTURE); | |
| for($i=0;$i<count($temp);$i++) { | |
| for($j=0;$j<count($code);$j++) { | |
| $pattern1 = "#\[".$code[$j]."\_code\:([0-9]+)\{([^}]*?)\}\]#i"; | |
| $pattern2 = "#\[\/".$code[$j]."\_code\]#i"; | |
| if(preg_match($pattern1,$temp[$i])) { |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // 제로보드4 f2plus_gallery_3_0 WYSIWYG 에디터 모드 전환 관련 수정 소스... | |
| var pattern = /(\[\w+\_code\:\d+\{[^}]*?\}\]|\[\/\w+\_code\])/gi; | |
| var pattern = /(\[\w+\_code\:\d+\{[^}]*?\}\]|\[\/\w+\_code\])/gi; | |
| var pattern2 = /\[\/\w+\_code\]/gi; | |
| var matchArray, e_use_html; | |
| var iePattern = /<br[^>]*?><(P|DIV|\/PRE|HR|LI|OL|O:P|UL|TABLE|TBODY|TR|TD|TH|CENTER|H1|H2|H3|H4)([^>]*?)>/gi; | |
| var ffPattern = /<br[^>]*?><(TBODY|TR|TD)([^>]*?)>/gi; | |
| function htmlspecialchars_encode(str){ | |
| str = str.replace(/&/gi,'&amp;'); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| var pattern = /(\[\w+\_code\:\d+\{[^}]*?\}\]|\[\/\w+\_code\])/gi; | |
| var pattern2 = /\[\/\w+\_code\]/gi; | |
| var matchArray, e_use_html; | |
| var iePattern = /<br[^>]*?><(P|DIV|\/PRE|HR|LI|OL|O:P|UL|TABLE|TBODY|TR|TD|TH|CENTER|H1|H2|H3|H4|FORM|SCRIPT|\/SCRIPT)([^>]*?)>/gi; | |
| var iePattern2 = /<(HR|SCRIPT|\/SCRIPT)([^>]*?)>\s*?<br[^>]*?>/gi; | |
| var iePattern3 = / (?:\r\n|\r|\n)/g; | |
| var ffPattern = /<br[^>]*?><(TBODY|TR|TD)([^>]*?)>/gi; | |
| function htmlspecialchars_encode(str){ | |
| str = str.replace(/&/g,'&amp;'); |