그누보드 글 수정 XSS 취약점 수정 ( 17-454 )

gnuboard · Jul 3, 2017 · df20a23 · df20a23
1 parent 2892919
commit df20a23
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/bbs/write.php b/bbs/write.php
@@ -401,6 +401,11 @@
 if ($config['cf_editor'] && $is_dhtml_editor_use && $board['bo_use_dhtml_editor'] && $member['mb_level'] >= $board['bo_html_level']) {
     $is_dhtml_editor = true;
 
+    if ( $w == 'u' && (! $is_member || ! $is_admin || $write['mb_id'] !== $member['mb_id']) ){
+        // kisa 취약점 제보 xss 필터 적용
+        $content = get_text(html_purifier($write['wr_content']), 0);
+    }
+
     if(is_file(G5_EDITOR_PATH.'/'.$config['cf_editor'].'/autosave.editor.js'))
         $editor_content_js = '<script src="'.G5_EDITOR_URL.'/'.$config['cf_editor'].'/autosave.editor.js"></script>'.PHP_EOL;
 }