From c5845c4758506f28727f011d4a4b7135ec851408 Mon Sep 17 00:00:00 2001 From: bnu Date: Thu, 2 Jan 2014 19:51:15 +0900 Subject: [PATCH 1/7] =?UTF-8?q?SECISSUE=20=20tag=EC=9D=98=20XSS=20?= =?UTF-8?q?=EB=AC=B8=EC=A0=9C=20=ED=95=B4=EA=B2=B0.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- classes/security/EmbedFilter.class.php | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/classes/security/EmbedFilter.class.php b/classes/security/EmbedFilter.class.php index 0b5d5dd4f..15f6e1ae8 100644 --- a/classes/security/EmbedFilter.class.php +++ b/classes/security/EmbedFilter.class.php @@ -347,14 +347,14 @@ class EmbedFilter } } - if(!$isWhiteDomain && !$isWhiteMimetype && $ext) + if($isWhiteDomain && $isWhiteMimetype && $ext) { $isWhiteExt = $this->isWhiteExt($ext); } - if(!$isWhiteDomain && !$isWhiteMimetype && !$isWhiteExt) + if(!$isWhiteDomain || !$isWhiteMimetype || !$isWhiteExt) { - $content = str_replace($objectTag, htmlspecialchars($objectTag), $content); + $content = str_replace($objectTag, htmlspecialchars($objectTag, ENT_COMPAT, 'UTF-8', false), $content); } } } @@ -400,14 +400,14 @@ class EmbedFilter } } - if(!$isWhiteDomain && !$isWhiteMimetype && $ext) + if($isWhiteDomain && $isWhiteMimetype && $ext) { $isWhiteExt = $this->isWhiteExt($ext); } - if(!$isWhiteDomain && !$isWhiteMimetype && !$isWhiteExt) + if(!$isWhiteDomain || !$isWhiteMimetype || !$isWhiteExt) { - $content = str_replace($embedTag, htmlspecialchars($embedTag), $content); + $content = str_replace($embedTag, htmlspecialchars($embedTag, ENT_COMPAT, 'UTF-8', false), $content); } } } @@ -450,7 +450,7 @@ class EmbedFilter if(!$isWhiteDomain) { - $content = str_replace($iframeTag, htmlspecialchars($iframeTag), $content); + $content = str_replace($iframeTag, htmlspecialchars($iframeTag, ENT_COMPAT, 'UTF-8', false), $content); } } } @@ -483,14 +483,14 @@ class EmbedFilter $ext = strtolower(substr(strrchr($parser->iNodeAttributes['value'], "."), 1)); $isWhiteDomain = $this->isWhiteDomain($parser->iNodeAttributes['value']); - if(!$isWhiteDomain && $ext) + if($isWhiteDomain && $ext) { $isWhiteExt = $this->isWhiteExt($ext); } - if(!$isWhiteDomain && !$isWhiteExt) + if(!$isWhiteDomain || !$isWhiteExt) { - $content = str_replace($paramTag, htmlspecialchars($paramTag), $content); + $content = str_replace($paramTag, htmlspecialchars($paramTag, ENT_COMPAT, 'UTF-8', false), $content); } } } @@ -568,7 +568,7 @@ class EmbedFilter if($m[1] == 'param') { - if(strpos(strtolower($m[0]), 'allowscriptaccess')) + if(stripos($m[0], 'allowscriptaccess')) { $m[0] = ' Date: Fri, 3 Jan 2014 11:10:00 +0900 Subject: [PATCH 2/7] NOISSUE Minify --- common/js/x.min.js | 14 ++++---- common/js/xe.js | 5 +++ common/js/xe.min.js | 78 ++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 89 insertions(+), 8 deletions(-) diff --git a/common/js/x.min.js b/common/js/x.min.js index fbdfac0f1..dd98a2157 100644 --- a/common/js/x.min.js +++ b/common/js/x.min.js @@ -10,8 +10,8 @@ function xResizeEvent(){xDeprecate("xResizeEvent");window.xREL&&setTimeout("xRes function xAppendChild(a,b){xDeprecate("xAppendChild");return a.appendChild?a.appendChild(b):null} function xClientHeight(){xDeprecate("xClientHeight");var a=0;xOp6Dn?a=window.innerHeight:"CSS1Compat"==document.compatMode&&!window.opera&&document.documentElement&&document.documentElement.clientHeight?a=document.documentElement.clientHeight:document.body&&document.body.clientHeight?a=document.body.clientHeight:xDef(window.innerWidth,window.innerHeight,document.width)&&(a=window.innerHeight,document.width>window.innerWidth&&(a-=16));return a} function xClientWidth(){xDeprecate("xClientWidth");var a=0;xOp6Dn?a=window.innerWidth:"CSS1Compat"==document.compatMode&&!window.opera&&document.documentElement&&document.documentElement.clientWidth?a=document.documentElement.clientWidth:document.body&&document.body.clientWidth?a=document.body.clientWidth:xDef(window.innerWidth,window.innerHeight,document.height)&&(a=window.innerWidth,document.height>window.innerHeight&&(a-=16));return a} -function xCreateElement(a){xDeprecate("xCreateElement");return document.createElement?document.createElement(a):null}function xDef(){xDeprecate("xDef");for(var a=0;ab?a:b}function xGetBodyHeight(){xDeprecate("xGetBodyHeight");var a=xClientHeight(),b=window.document.body.scrollHeight;return a>b?a:b} @@ -24,15 +24,15 @@ function xHeight(a,b){xDeprecate("xHeight");if(!(a=xGetElementById(a)))return 0; a.style.height)&&(a.style.height=b+"px",d=a.offsetHeight-b)}b-=d+e+f+h;if(isNaN(b)||0>b)return null;a.style.height=b+"px"}b=a.offsetHeight}else d&&xDef(a.style.pixelHeight)&&(0<=b&&(a.style.pixelHeight=b),b=a.style.pixelHeight);return b}function xHex(a,b,d){xDeprecate("xHex");var e="";a=Math.ceil(a);d&&(e=d);a=a.toString(16);for(d=0;db?0:Math.round(b):-1;var d=xDef(a.style);if(a==document||"html"==a.tagName.toLowerCase()||"body"==a.tagName.toLowerCase())b=xClientWidth();else if(d&&xDef(a.offsetWidth)&&xStr(a.style.width)){if(0<=b){var e=d=0,f=0,h=0;if("CSS1Compat"==document.compatMode){var g=xGetComputedStyle,d=g(a,"padding-left",1);null!==d?(e=g(a,"padding-right",1),f=g(a,"border-left-width",1),h=g(a,"border-right-width",1)):xDef(a.offsetWidth, a.style.width)&&(a.style.width=b+"px",d=a.offsetWidth-b)}b-=d+e+f+h;if(isNaN(b)||0>b)return null;a.style.width=b+"px"}b=a.offsetWidth}else d&&xDef(a.style.pixelWidth)&&(0<=b&&(a.style.pixelWidth=b),b=a.style.pixelWidth);return b}function xZIndex(a,b){xDeprecate("xZIndex");if(!(a=xGetElementById(a)))return 0;a.style&&xDef(a.style.zIndex)&&(xNum(b)&&(a.style.zIndex=b),b=parseInt(a.style.zIndex));return b} function xStopPropagation(a){xDeprecate("xStopPropagation");a&&a.stopPropagation?a.stopPropagation():window.event&&(window.event.cancelBubble=!0)}; diff --git a/common/js/xe.js b/common/js/xe.js index cb3ad6567..f582248bf 100644 --- a/common/js/xe.js +++ b/common/js/xe.js @@ -420,6 +420,11 @@ if(jQuery) jQuery.noConflict(); /* jQuery(document).ready() */ jQuery(function($) { + // Anchor: focus move to target + $('a[href^="#"]').click(function(){ + $($(this).attr('href')).attr('tabindex','0').focus(); + }); + /* select - option의 disabled=disabled 속성을 IE에서도 체크하기 위한 함수 */ if($.browser.msie) { $('select').each(function(i, sels) { diff --git a/common/js/xe.min.js b/common/js/xe.min.js index 315d4dcfc..cefb57893 100644 --- a/common/js/xe.min.js +++ b/common/js/xe.min.js @@ -1 +1,77 @@ -(function(g){var c,a,d;var e=[];c={getName:function(){return"Core"},createApp:function(j,h){var i=b();g.extend(i.prototype,a,h);i.prototype.getName=function(){return j};return i},createPlugin:function(j,h){var i=b();g.extend(i.prototype,d,h);i.prototype.getName=function(){return j};return i},getApps:function(){return g.makeArray(e)},getApp:function(h){h=(h||"").toLowerCase();if(typeof e[h]!="undefined"){return e[h]}else{return null}},registerApp:function(h){var i=h.getName().toLowerCase();e.push(h);if(!g.isArray(e[i])){e[i]=[]}e[i].push(h);h.parent=this;if(g.isFunction(h.activate)){h.activate()}},unregisterApp:function(i){var j=i.getName().toLowerCase();var h=g.inArray(i,e);if(h>=0){e=e.splice(h,1)}if(g.isArray(e[j])){h=g.inArray(i,e[j]);if(h>=0){e[j]=e[j].splice(h,1)}}if(g.isFunction(i.deactivate)){i.deactivate()}},broadcast:function(i,h){this._broadcast(this,i,h)},_broadcast:function(j,l,k){for(var h=0;h=0){return false}this._plugins.push(j);if(!g.isArray(this._plugins[i])){this._plugins[i]=[]}this._plugins[i].push(j);g.each(j._binded_fn,function(l,k){h.registerHandler(l,k)});j.oApp=this;if(g.isFunction(j.activate)){j.activate()}return true},registerHandler:function(h,i){var j=this._messages;h=h.toUpperCase();if(!g.isArray(j[h])){j[h]=[]}j[h].push(i)},cast:function(i,h){return this._cast(this,i,h||[])},broadcast:function(h,j,i){if(this.parent&&this.parent._broadcast){this.parent._broadcast(h,j,i)}},_cast:function(k,h,j){var l,m;var q=this._messages;h=h.toUpperCase();if(q["BEFORE_"+h]||this["API_BEFORE_"+h]){var n=this._cast(k,"BEFORE_"+h,j);if(!n){return}}var p=[],o="API_"+h;if(g.isArray(q[h])){for(l=0;l"+q+" "}}}this.loaded_popup_menus[s]=o}if(o){var g=b("#popup_menu_area").html("
    "+o+"
");var h={top:j.page_y,left:j.page_x};if(g.outerHeight()+h.top>b(window).height()+b(window).scrollTop()){h.top=b(window).height()-g.outerHeight()+b(window).scrollTop()}if(g.outerWidth()+h.left>b(window).width()+b(window).scrollLeft()){h.left=b(window).width()-g.outerWidth()+b(window).scrollLeft()}g.css({top:h.top,left:h.left}).show().focus()}}}})(jQuery);jQuery(function(c){if(c.browser.msie){c("select").each(function(h,d){var g=false;var k=new Array();for(var e=0;e-1)?k[h]:e}}if(!g){return}d.oldonchange=d.onchange;d.onchange=function(){if(this.options[this.selectedIndex].disabled){this.selectedIndex=k[h]}else{if(this.oldonchange){this.oldonchange()}}};if(d.selectedIndex>=0&&d.options[d.selectedIndex].disabled){d.onchange()}})}var a=c(".xe_content .fold_button");if(a.size()){var b=c("div.fold_container",a);c("button.more",a).click(function(){c(this).hide().next("button").show().parent().next(b).show()});c("button.less",a).click(function(){c(this).hide().prev("button").show().parent().next(b).hide()})}jQuery('input[type="submit"],button[type="submit"]').click(function(e){var d=jQuery(e.currentTarget);setTimeout(function(){return function(){d.attr("disabled","disabled")}}(),0);setTimeout(function(){return function(){d.removeAttr("disabled")}}(),3000)})});(function(){function a(d,c){return(d.replace(/#.*$/,"")===c.replace(/#.*$/,""))}var b=Array.isArray||function(c){return Object.prototype.toString.call(c)=="[object Array]"};String.prototype.getQuery=function(e){var i=a(this,window.location.href)?current_url:this;var c=i.indexOf("?");if(c==-1){return null}var h=i.substr(c+1,this.length),d={};h.replace(/([^=]+)=([^&]*)(&|$)/g,function(){d[arguments[1]]=arguments[2]});var g=d[e];if(typeof(g)=="undefined"){g=""}return g};String.prototype.setQuery=function(q,e){var k=a(this,window.location.href)?current_url:this;var p=k.indexOf("?");var g=k.replace(/#$/,"");var l,s,r;if(typeof(e)=="undefined"){e=""}if(p!=-1){var j=g.substr(p+1,k.length),m={},u=[];g=k.substr(0,p);j.replace(/([^=]+)=([^&]*)(&|$)/g,function(i,c,v){m[c]=v});m[q]=e;for(var d in m){if(!m.hasOwnProperty(d)){continue}if(!(r=String(m[d]).trim())){continue}u.push(d+"="+decodeURI(r))}j=u.join("&");g=g+(j?"?"+j:"")}else{if(String(e).trim()){g=g+"?"+q+"="+e}}s=/^https:\/\/([^:\/]+)(:\d+|)/i;if(s.test(g)){var t="http://"+RegExp.$1;if(window.http_port&&http_port!=80){t+=":"+http_port}g=g.replace(s,t)}var o=!!window.enforce_ssl;if(!o&&b(window.ssl_actions)&&(l=g.getQuery("act"))){for(var h=0,n=ssl_actions.length;h-1&&!a.getQuery("vid")){a=a.setQuery("vid",xeVid)}try{if(g!="_blank"&&winopen_list[g]){winopen_list[g].close();winopen_list[g]=null}}catch(d){}if(typeof(g)=="undefined"){g="_blank"}if(typeof(b)=="undefined"){b=""}var c=window.open(a,g,b);c.focus();if(g!="_blank"){winopen_list[g]=c}}function popopen(a,b){if(typeof(b)=="undefined"){b="_blank"}if(typeof(xeVid)!="undefined"&&a.indexOf(request_uri)>-1&&!a.getQuery("vid")){a=a.setQuery("vid",xeVid)}winopen(a,b,"width=800,height=600,scrollbars=yes,resizable=yes,toolbars=no")}function sendMailTo(a){location.href="mailto:"+a}function move_url(a,b){if(!a){return false}if(typeof(b)=="undefined"){b="N"}if(b=="N"){b=false}else{b=true}if(/^\./.test(a)){a=request_uri+a}if(b){winopen(a)}else{location.href=a}return false}function displayMultimedia(e,d,a,b){var c=_displayMultimedia(e,d,a,b);if(c){document.writeln(c)}}function _displayMultimedia(a,c,j,l){if(a.indexOf("files")==0){a=request_uri+a}var e={wmode:"transparent",allowScriptAccess:"sameDomain",quality:"high",flashvars:"",autostart:false};var d=jQuery.extend(e,l||{});var k=(d.autostart&&d.autostart!="false")?"true":"false";delete (d.autostart);var g="";var h="";var i="";if(/\.(gif|jpg|jpeg|bmp|png)$/i.test(a)){i=''}else{if(/\.flv$/i.test(a)||/\.mov$/i.test(a)||/\.moov$/i.test(a)||/\.m4v$/i.test(a)){i=''}else{if(/\.swf/i.test(a)){g="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000";if(typeof(enforce_ssl)!="undefined"&&enforce_ssl){h="https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,28,0"}else{h="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,28,0"}i='';i+='';for(var b in d){if(d[b]!="undefined"&&d[b]!=""){i+=''}}i+=''}else{if(jQuery.browser.mozilla||jQuery.browser.opera){k=(d.autostart&&d.autostart!="false")?"1":"0"}i='.popup"),a,d,c,e,i;i=b.css({overflow:"scroll"}).offset();a=b.width(10).height(10000).get(0).scrollWidth+i.left*2;d=b.height(10).width(10000).get(0).scrollHeight+i.top*2;if(a<800){a=800+i.left*2}c=j.width();e=j.height();if(a!=c){window.resizeBy(a-c,0)}if(d!=e){window.resizeBy(0,d-e)}b.width(a-i.left*2).css({overflow:"",height:""})}function doCallModuleAction(a,c,b){var d={target_srl:b,cur_mid:current_mid,mid:current_mid};exec_xml(a,c,d,completeCallModuleAction)}function completeCallModuleAction(a,b){if(a.message!="success"){alert(a.message)}location.reload()}function completeMessage(a){alert(a.message);location.reload()}function doChangeLangType(a){if(typeof(a)=="string"){setLangType(a)}else{var b=a.options[a.selectedIndex].value;setLangType(b)}location.href=location.href.setQuery("l","")}function setLangType(b){var a=new Date();a.setTime(a.getTime()+(7000*24*3600000));setCookie("lang_type",b,a,"/")}function doDocumentPreview(e){var a=e;while(a.nodeName!="FORM"){a=a.parentNode}if(a.nodeName!="FORM"){return}var b=a.getAttribute("editor_sequence");var c=editorGetContent(b);var d=window.open("","previewDocument","toolbars=no,width=700px;height=800px,scrollbars=yes,resizable=yes");var g=jQuery("#previewDocument");if(!g.length){jQuery('
').appendTo(document.body);g=jQuery("#previewDocument")[0]}else{g=g[0]}if(g){g.content.value=c;g.submit()}}function doDocumentSave(g){var b=g.form.getAttribute("editor_sequence");var i=editorRelKeys[b]["content"].value;if(typeof(b)!="undefined"&&b&&typeof(editorRelKeys)!="undefined"&&typeof(editorGetContent)=="function"){var c=editorGetContent(b);editorRelKeys[b]["content"].value=c}var h={},e=["error","message","document_srl"],a=g.form.elements,d=jQuery(g.form).serializeArray();jQuery.each(d,function(j,k){var l=jQuery.trim(k.value);if(!l){return true}if(/\[\]$/.test(k.name)){k.name=k.name.replace(/\[\]$/,"")}if(h[k.name]){h[k.name]+="|@|"+l}else{h[k.name]=k.value}});exec_xml("document","procDocumentTempSave",h,completeDocumentSave,e,h,g.form);editorRelKeys[b]["content"].value=i;return false}function completeDocumentSave(a){jQuery("input[name=document_srl]").eq(0).val(a.document_srl);alert(a.message)}var objForSavedDoc=null;function doDocumentLoad(a){objForSavedDoc=a.form;popopen(request_uri.setQuery("module","document").setQuery("act","dispTempSavedList"))}function doDocumentSelect(a){if(!opener||!opener.objForSavedDoc){window.close();return}opener.location.href=opener.current_url.setQuery("document_srl",a).setQuery("act","dispBoardWrite");window.close()}function viewSkinInfo(a,b){popopen("./?module=module&act=dispModuleSkinInfo&selected_module="+a+"&skin="+b,"SkinInfo")}var addedDocument=new Array();function doAddDocumentCart(b){var a=b.value;addedDocument[addedDocument.length]=a;setTimeout(function(){callAddDocumentCart(addedDocument.length)},100)}function callAddDocumentCart(a){if(addedDocument.length<1||a!=addedDocument.length){return}var b=new Array();b.srls=addedDocument.join(",");exec_xml("document","procDocumentAddCart",b,null);addedDocument=new Array()}function transRGB2Hex(d){if(!d){return d}if(d.indexOf("#")>-1){return d.replace(/^#/,"")}if(d.toLowerCase().indexOf("rgb")<0){return d}d=d.replace(/^rgb\(/i,"").replace(/\)$/,"");value_list=d.split(",");var c="";for(var b=0;b>2;h=((l&3)<<4)|(j>>4);e=((j&15)<<2)|(g>>6);d=g&63;if(isNaN(j)){e=d=64}else{if(isNaN(g)){d=64}}a=a+this._keyStr.charAt(k)+this._keyStr.charAt(h)+this._keyStr.charAt(e)+this._keyStr.charAt(d)}return a},decode:function(c){var a="";var l,j,g;var k,h,e,d;var b=0;c=c.replace(/[^A-Za-z0-9\+\/\=]/g,"");while(b>4);j=((h&15)<<4)|(e>>2);g=((e&3)<<6)|d;a=a+String.fromCharCode(l);if(e!=64){a=a+String.fromCharCode(j)}if(d!=64){a=a+String.fromCharCode(g)}}a=Base64._utf8_decode(a);return a},_utf8_encode:function(b){b=b.replace(/\r\n/g,"\n");var a="";for(var e=0;e127)&&(d<2048)){a+=String.fromCharCode((d>>6)|192);a+=String.fromCharCode((d&63)|128)}else{a+=String.fromCharCode((d>>12)|224);a+=String.fromCharCode(((d>>6)&63)|128);a+=String.fromCharCode((d&63)|128)}}}return a},_utf8_decode:function(a){var b="";var d=0;var e=c1=c2=0;while(d191)&&(e<224)){c2=a.charCodeAt(d+1);b+=String.fromCharCode(((e&31)<<6)|(c2&63));d+=2}else{c2=a.charCodeAt(d+1);c3=a.charCodeAt(d+2);b+=String.fromCharCode(((e&15)<<12)|((c2&63)<<6)|(c3&63));d+=3}}}return b}};if(typeof(resizeImageContents)=="undefined"){function resizeImageContents(){}}if(typeof(activateOptionDisabled)=="undefined"){function activateOptionDisabled(){}}objectExtend=jQuery.extend;function toggleDisplay(a){jQuery("#"+a).toggle()}function svc_folder_open(a){jQuery("#_folder_open_"+a).hide();jQuery("#_folder_close_"+a).show();jQuery("#_folder_"+a).show()}function svc_folder_close(a){jQuery("#_folder_open_"+a).show();jQuery("#_folder_close_"+a).hide();jQuery("#_folder_"+a).hide()}function open_calendar(c,d,b){if(typeof(d)=="undefined"){d=""}var a="./common/tpl/calendar.php?";if(c){a+="fo_id="+c}if(d){a+="&day_str="+d}if(b){a+="&callback_func="+b}popopen(a,"Calendar")}var loaded_popup_menus=XE.loaded_popup_menus;function createPopupMenu(){}function chkPopupMenu(){}function displayPopupMenu(a,b,c){XE.displayPopupMenu(a,b,c)}function GetObjLeft(a){return jQuery(a).offset().left}function GetObjTop(a){return jQuery(a).offset().top}function replaceOuterHTML(b,a){jQuery(b).replaceWith(a)}function getOuterHTML(a){return jQuery(a).html().trim()}function setCookie(b,c,a,e){var d=b+"="+escape(c)+((!a)?"":("; expires="+a.toGMTString()))+"; path="+((!e)?"/":e);document.cookie=d}function getCookie(b){var a=document.cookie.match(new RegExp(b+"=(.*?)(?:;|$)"));if(a){return unescape(a[1])}}function is_def(a){return(typeof(a)!="undefined")}function ucfirst(a){return a.charAt(0).toUpperCase()+a.slice(1)}function get_by_id(a){return document.getElementById(a)}jQuery(function(a){a(document).click(function(d){var e=a("#popup_menu_area");if(!e.length){e=a('