XSS 취약점(16-059) 수정

gnuboard · Feb 11, 2016 · 20af5d3 · 20af5d3
1 parent 24aa7cf
commit 20af5d3
Show file tree

Hide file tree

Showing 5 changed files with 6 additions and 4 deletions.
diff --git a/bbs/formmail.php b/bbs/formmail.php
@@ -28,6 +28,12 @@
 $g5['title'] = '메일 쓰기';
 include_once(G5_PATH.'/head.sub.php');
 
+$email = get_email_address(base64_decode($email));
+if(!$email)
+    alert_close('이메일이 올바르지 않습니다.');
+
+$email = base64_encode($email);
+
 if (!$name)
     $name = base64_decode($email);
 else

diff --git a/mobile/skin/member/basic/formmail.skin.php b/mobile/skin/member/basic/formmail.skin.php
@@ -11,7 +11,6 @@
     <form name="fformmail" action="./formmail_send.php" onsubmit="return fformmail_submit(this);" method="post" enctype="multipart/form-data" style="margin:0px;">
     <input type="hidden" name="to" value="<?php echo $email ?>">
     <input type="hidden" name="attach" value="2">
-    <input type="hidden" name="token" value="<?php echo $token ?>">
     <?php if ($is_member) { // 회원이면 ?>
     <input type="hidden" name="fnick" value="<?php echo get_text($member['mb_nick']); ?>">
     <input type="hidden" name="fmail" value="<?php echo $member['mb_email'] ?>">

diff --git a/skin/member/basic/formmail.skin.php b/skin/member/basic/formmail.skin.php
@@ -12,7 +12,6 @@
     <form name="fformmail" action="./formmail_send.php" onsubmit="return fformmail_submit(this);" method="post" enctype="multipart/form-data" style="margin:0px;">
     <input type="hidden" name="to" value="<?php echo $email ?>">
     <input type="hidden" name="attach" value="2">
-    <input type="hidden" name="token" value="<?php echo $token ?>">
     <?php if ($is_member) { // 회원이면  ?>
     <input type="hidden" name="fnick" value="<?php echo get_text($member['mb_nick']); ?>">
     <input type="hidden" name="fmail" value="<?php echo $member['mb_email'] ?>">

diff --git a/theme/basic/mobile/skin/member/basic/formmail.skin.php b/theme/basic/mobile/skin/member/basic/formmail.skin.php
@@ -11,7 +11,6 @@
     <form name="fformmail" action="./formmail_send.php" onsubmit="return fformmail_submit(this);" method="post" enctype="multipart/form-data" style="margin:0px;">
     <input type="hidden" name="to" value="<?php echo $email ?>">
     <input type="hidden" name="attach" value="2">
-    <input type="hidden" name="token" value="<?php echo $token ?>">
     <?php if ($is_member) { // 회원이면 ?>
     <input type="hidden" name="fnick" value="<?php echo get_text($member['mb_nick']); ?>">
     <input type="hidden" name="fmail" value="<?php echo $member['mb_email'] ?>">

diff --git a/theme/basic/skin/member/basic/formmail.skin.php b/theme/basic/skin/member/basic/formmail.skin.php
@@ -12,7 +12,6 @@
     <form name="fformmail" action="./formmail_send.php" onsubmit="return fformmail_submit(this);" method="post" enctype="multipart/form-data" style="margin:0px;">
     <input type="hidden" name="to" value="<?php echo $email ?>">
     <input type="hidden" name="attach" value="2">
-    <input type="hidden" name="token" value="<?php echo $token ?>">
     <?php if ($is_member) { // 회원이면  ?>
     <input type="hidden" name="fnick" value="<?php echo get_text($member['mb_nick']) ?>">
     <input type="hidden" name="fmail" value="<?php echo $member['mb_email'] ?>">