From 78a6943ed888523f10172db9e4e9f0fe9412ec85 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 26 Mar 2018 09:15:10 +0900
Subject: [PATCH] =?UTF-8?q?=ED=83=80=EB=8F=84=EB=A9=94=EC=9D=B8=20?=
 =?UTF-8?q?=EB=A6=AC=EB=8B=A4=EC=9D=B4=EB=A0=89=ED=8A=B8=20=EC=B2=B4?=
 =?UTF-8?q?=ED=81=AC=20=EC=98=A4=EB=A5=98=20=EC=BD=94=EB=93=9C=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 bbs/login_check.php    | 2 +-
 bbs/member_confirm.php | 2 +-
 lib/common.lib.php     | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/bbs/login_check.php b/bbs/login_check.php
index a66ed1c444..fadee0bbc3 100644
--- a/bbs/login_check.php
+++ b/bbs/login_check.php
@@ -67,7 +67,7 @@
 
 if ($url) {
     // url 체크
-    check_url_host($url);
+    check_url_host($url, '', G5_URL, true);
 
     $link = urldecode($url);
     // 2003-06-14 추가 (다른 변수들을 넘겨주기 위함)
diff --git a/bbs/member_confirm.php b/bbs/member_confirm.php
index e5abe169e8..d3631e2676 100644
--- a/bbs/member_confirm.php
+++ b/bbs/member_confirm.php
@@ -17,7 +17,7 @@
 $url = clean_xss_tags($_GET['url']);
 
 // url 체크
-check_url_host($url);
+check_url_host($url, '', G5_URL, true);
 
 $url = get_text($url);
 
diff --git a/lib/common.lib.php b/lib/common.lib.php
index 03473b27ae..8bf11615f9 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -3008,7 +3008,7 @@ function check_password($pass, $hash)
 }
 
 // 동일한 host url 인지
-function check_url_host($url, $msg='', $return_url=G5_URL)
+function check_url_host($url, $msg='', $return_url=G5_URL, $is_redirect=false)
 {
     if(!$msg)
         $msg = 'url에 타 도메인을 지정할 수 없습니다.';
@@ -3018,7 +3018,7 @@ function check_url_host($url, $msg='', $return_url=G5_URL)
     $is_host_check = false;
     
     // url을 urlencode 를 2번이상하면 parse_url 에서 scheme와 host 값을 가져올수 없는 취약점이 존재함
-    if ( !isset($p['host']) && urldecode($url) != $url ){
+    if ( $is_redirect && !isset($p['host']) && urldecode($url) != $url ){
         $i = 0;
         while($i <= 3){
             $url = urldecode($url);
@@ -3040,7 +3040,7 @@ function check_url_host($url, $msg='', $return_url=G5_URL)
 
     //php 5.6.29 이하 버전에서는 parse_url 버그가 존재함
     //php 7.0.1 ~ 7.0.5 버전에서는 parse_url 버그가 존재함
-    if ( (isset($p['host']) && $p['host']) ) {
+    if ( $is_redirect && (isset($p['host']) && $p['host']) ) {
         $bool_ch = false;
         foreach( array('user','host') as $key) {
             if ( isset( $p[ $key ] ) && strpbrk( $p[ $key ], ':/?#@' ) ) {