git-svn-id: http://xe-core.googlecode.com/svn/trunk@1121 201d5d3c-b55e-5fd7-737f-ddc643e51545

modules/member/member.controller.php

@@ -455,10 +455,12 @@
          **/
         function procMemberAdminInsertConfig() {
             // 기본 정보를 받음
-            $args = Context::gets('enable_join','redirect_url','agreement','image_name','image_mark', 'image_name_max_width', 'image_name_max_height','image_mark_max_width','image_mark_max_height');
+            $args = Context::gets('enable_join','redirect_url','content','image_name','image_mark', 'image_name_max_width', 'image_name_max_height','image_mark_max_width','image_mark_max_height');
             if($args->enable_join!='Y') $args->enable_join = 'N';
             if($args->image_name!='Y') $args->image_name = 'N';
             if($args->image_mark!='Y') $args->image_mark = 'N';
+            $args->agreement = $args->content;
+            unset($args->content);
 
             // module Controller 객체 생성하여 입력
             $oModuleController = &getController('module');

modules/member/member.view.php

@@ -401,6 +401,11 @@
             $skin_list = $oModuleModel->getSkins($this->module_path);
             Context::set('skin_list', $skin_list);
 
+            // 에디터를 받음
+            $oEditorModel = &getModel('editor');
+            $editor = $oEditorModel->getEditor(0, false, true);
+            Context::set('editor', $editor);
+
             // 템플릿 파일 지정
             $this->setTemplateFile('member_config');
         }

modules/member/skins/default/member_info.html

@@ -11,11 +11,11 @@
 </tr>
 <tr>
     <th>{$lang->user_name}</th>
-    <td>{$member_info->user_name}</td>
+    <td>{htmlspecialchars($member_info->user_name)}</td>
 </tr>
 <tr>
     <th>{$lang->nick_name}</th>
-    <td>{$member_info->nick_name}</td>
+    <td>{htmlspecialchars($member_info->nick_name)}</td>
 </tr>
 <!--@if($member_info->image_name->src)-->
 <tr>
@@ -31,11 +31,11 @@
 <!--@end-->
 <tr>
     <th>{$lang->homepage}</th>
-    <td><!--@if($member_info->homepage)--><a href="#" onclick="winopen('{$member_info->homepage}'); return false;">{$member_info->homepage}</a><!--@end--></td>
+    <td><!--@if($member_info->homepage)--><a href="#" onclick="winopen('{htmlspecialchars($member_info->homepage)}'); return false;">{htmlspecialchars($member_info->homepage)}</a><!--@end--></td>
 </tr>
 <tr>
     <th>{$lang->blog}</th>
-    <td><!--@if($member_info->blog)--><a href="#" onclick="winopen('{$member_info->blog}'); return false;">{$member_info->blog}</a><!--@end--></td>
+    <td><!--@if($member_info->blog)--><a href="#" onclick="winopen('{htmlspecialchars($member_info->blog)}'); return false;">{htmlspecialchars($member_info->blog)}</a><!--@end--></td>
 </tr>
 <tr>
     <th>{$lang->birthday}</th>
@@ -58,18 +58,18 @@
 <!--@if($extend_form_list)-->
 <!--@foreach($extend_form_list as $key => $val)-->
 <tr>
-    <th>{$val->column_title}</th>
+    <th>{htmlspecialchars($val->column_title)}</th>
     <td>
         <!--@if($val->column_type=='tel')-->
-            {$val->value[0]} - {$val->value[1]} - {$val->value[2]}
+            {htmlspecialchars($val->value[0])} - {htmlspecialchars($val->value[1])} - {htmlspecialchars($val->value[2])}
         <!--@elseif($val->column_type=='kr_zip')-->
-            {$val->value[0]} {$val->value[1]}
+            {$val->value[0]} {htmlspecialchars($val->value[1])}
         <!--@elseif($val->column_type=='checkbox')-->
-            {implode(",",$val->value)}
+            {htmlspecialchars(implode(",",$val->value))}
         <!--@elseif($val->column_type=='date')-->
             {zdate($val->value, "Y-m-d")}
         <!--@else-->
-            {$val->value}
+            {htmlspecialchars($val->value)}
         <!--@end-->
     </td>
 </tr>

modules/member/skins/default/modify_info.html

@@ -26,19 +26,19 @@
     <tr>
         <th>{$lang->user_id}</th>
         <td>
-            {$member_info->user_id}
+            {htmlspecialchars($member_info->user_id)}
         </td>
     </tr>
     <tr>
         <th>{$lang->user_name}</th>
         <td>
-            {$member_info->user_name}
+            {htmlspecialchars($member_info->user_name)}
         </td>
     </tr>
     <tr>
         <th rowspan="2">{$lang->nick_name}</th>
         <td>
-            <input type="text" name="nick_name" value="{$member_info->nick_name}" />
+            <input type="text" name="nick_name" value="{htmlspecialchars($member_info->nick_name)}" />
         </td>
     </tr>
     <tr>
@@ -47,7 +47,7 @@
     <tr>
         <th>{$lang->email_address}</th>
         <td>
-            <input type="text" name="email_address" value="{$member_info->email_address}" />
+            <input type="text" name="email_address" value="{htmlspecialchars($member_info->email_address)}" />
         </td>
     </tr>
     <!--@if($member_config->image_name == 'Y')-->
@@ -81,7 +81,7 @@
     <tr>
         <th rowspan="2">{$lang->homepage}</th>
         <td>
-            <input type="text" name="homepage" value="{$member_info->homepage}" />
+            <input type="text" name="homepage" value="{htmlspecialchars($member_info->homepage)}" />
         </td>
     </tr>
     <tr>
@@ -90,7 +90,7 @@
     <tr>
         <th rowspan="2">{$lang->blog}</th>
         <td>
-            <input type="text" name="blog" value="{$member_info->blog}" />
+            <input type="text" name="blog" value="{htmlspecialchars($member_info->blog)}" />
         </td>
     </tr>
     <tr>
@@ -146,30 +146,30 @@
             <!--@if($val->required=='Y')-->
             *
             <!--@end-->
-            {$val->column_title}
+            {htmlspecialchars($val->column_title)}
         </th>
         <td>
             <!-- 일반 text -->
             <!--@if($val->column_type == 'text')--> 
-                <input type="text" name="{$val->column_name}" value="{$val->value}" />
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value)}" />
 
             <!-- 홈페이지 주소 -->
             <!--@elseif($val->column_type == 'homepage')-->
-                <input type="text" name="{$val->column_name}" value="{$val->value}" />
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value)}" />
 
             <!-- Email 주소 -->
             <!--@elseif($val->column_type == 'email_address')-->
-                <input type="text" name="{$val->column_name}" value="{$val->value}" />
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value)}" />
 
             <!-- 전화번호 -->
             <!--@elseif($val->column_type == 'tel')-->
-                <input type="text" name="{$val->column_name}" value="{$val->value[0]}" size="4" />-
-                <input type="text" name="{$val->column_name}" value="{$val->value[1]}" size="4" />-
-                <input type="text" name="{$val->column_name}" value="{$val->value[2]}" size="4" />
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value[0])}" size="4" />-
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value[1])}" size="4" />-
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value[2])}" size="4" />
 
             <!-- textarea -->
             <!--@elseif($val->column_type == 'textarea')-->
-                <textarea name="{$val->column_name}">{$val->value}</textarea>
+                <textarea name="{$val->column_name}">{htmlspecialchars($val->value)}</textarea>
 
             <!-- 다중 선택 -->
             <!--@elseif($val->column_type == 'checkbox')-->
@@ -206,12 +206,12 @@
                 </div>
 
                 <div>
-                    <input type="text" name="{$val->column_name}" value="{$val->value[1]}" />
+                    <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value[1])}" />
                 </div>
 
             <!-- 일본 주소 검색 -->
             <!--@elseif($val->column_type == 'jp_zip')-->
-                <input type="text" name="{$val->column_name}" value="{$val->value}" />
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value)}" />
 
             <!-- 날자 입력 -->
             <!--@elseif($val->column_type == 'date')-->

modules/member/tpl/insert_join_form.html

@@ -59,14 +59,14 @@
     </tr>
     <tr>
         <th rowspan="2">{$lang->column_name}</th>
-        <td><input type="text" name="column_name" value="{$join_form->column_name}" /></td>
+        <td><input type="text" name="column_name" value="{htmlspecialchars($join_form->column_name)}" /></td>
     </tr>
     <tr>
         <td>{$lang->about_column_name}</td>
     </tr>
     <tr>
         <th rowspan="2">{$lang->column_title}</th>
-        <td><input type="text" name="column_title" value="{$join_form->column_title}" /></td>
+        <td><input type="text" name="column_title" value="{htmlspecialchars($join_form->column_title)}" /></td>
     </tr>
     <tr>
         <td>{$lang->about_column_title}</td>
@@ -87,7 +87,7 @@
     </tr>
     <tr>
         <th rowspan="2">{$lang->description}</th>
-        <td><textarea name="description">{$join_form->description}</textarea></td>
+        <td><textarea name="description">{htmlspecialchars($join_form->description)}</textarea></td>
     </tr>
     <tr>
         <td>{$lang->about_form_description}</td>

modules/member/tpl/insert_member.html

@@ -14,7 +14,7 @@
     <input type="hidden" name="member_srl" value="{$member_srl}" />
     <input type="hidden" name="content" value="{htmlspecialchars($member_info->signature)}" />
     <!--@if($member_info->member_srl)-->
-    <input type="hidden" name="user_id" value="{$member_info->user_id}" />
+    <input type="hidden" name="user_id" value="{htmlspecialchars($member_info->user_id)}" />
     <!--@end-->
 
     <div>
@@ -25,7 +25,7 @@
         <th rowspan="2">{$lang->user_id}</th>
         <td>
             <!--@if($member_info->member_srl)-->
-            {$member_info->user_id}
+            {htmlspecialchars($member_info->user_id)}
             <!--@else-->
             <input type="text" name="user_id" value="" />
             <!--@end-->
@@ -43,7 +43,7 @@
     <tr>
         <th rowspan="2">{$lang->user_name}</th>
         <td>
-            <input type="text" name="user_name" value="{$member_info->user_name}" />
+            <input type="text" name="user_name" value="{htmlspecialchars($member_info->user_name)}" />
         </td>
     </tr>
     <tr>
@@ -52,7 +52,7 @@
     <tr>
         <th rowspan="2">{$lang->nick_name}</th>
         <td>
-            <input type="text" name="nick_name" value="{$member_info->nick_name}" />
+            <input type="text" name="nick_name" value="{htmlspecialchars($member_info->nick_name)}" />
         </td>
     </tr>
     <tr>
@@ -61,13 +61,13 @@
     <tr>
         <th>{$lang->email_address}</th>
         <td>
-            <input type="text" name="email_address" value="{$member_info->email_address}" />
+            <input type="text" name="email_address" value="{htmlspecialchars($member_info->email_address)}" />
         </td>
     </tr>
     <tr>
         <th rowspan="2">{$lang->homepage}</th>
         <td>
-            <input type="text" name="homepage" value="{$member_info->homepage}" />
+            <input type="text" name="homepage" value="{htmlspecialchars($member_info->homepage)}" />
         </td>
     </tr>
     <tr>
@@ -76,7 +76,7 @@
     <tr>
         <th rowspan="2">{$lang->blog}</th>
         <td>
-            <input type="text" name="blog" value="{$member_info->blog}" />
+            <input type="text" name="blog" value="{htmlspecialchars($member_info->blog)}" />
         </td>
     </tr>
     <tr>
@@ -172,31 +172,31 @@
         <td>
             <!-- 일반 text -->
             <!--@if($val->column_type == 'text')--> 
-                <input type="text" name="{$val->column_name}" value="{$val->value}" />
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value)}" />
 
             <!-- 홈페이지 주소 -->
             <!--@elseif($val->column_type == 'homepage')-->
-                <input type="text" name="{$val->column_name}" value="{$val->value}" />
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value)}" />
 
             <!-- Email 주소 -->
             <!--@elseif($val->column_type == 'email_address')-->
-                <input type="text" name="{$val->column_name}" value="{$val->value}" />
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value)}" />
 
             <!-- 전화번호 -->
             <!--@elseif($val->column_type == 'tel')-->
-                <input type="text" name="{$val->column_name}" value="{$val->value[0]}" size="4" />-
-                <input type="text" name="{$val->column_name}" value="{$val->value[1]}" size="4" />-
-                <input type="text" name="{$val->column_name}" value="{$val->value[2]}" size="4" />
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value[0])}" size="4" />-
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value[1])}" size="4" />-
+                <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value[2])}" size="4" />
 
             <!-- textarea -->
             <!--@elseif($val->column_type == 'textarea')-->
-                <textarea name="{$val->column_name}">{$val->value}</textarea>
+                <textarea name="{$val->column_name}">{htmlspecialchars($val->value)}</textarea>
 
             <!-- 다중 선택 -->
             <!--@elseif($val->column_type == 'checkbox')-->
                 <!--@if($val->default_value)-->
                     <!--@foreach($val->default_value as $v)-->
-                        <input type="checkbox" name="{$val->column_name}" value="{$v}" <!--@if(is_array($val->value)&&in_array($v, $val->value))-->checked="true"<!--@end-->/>    {$v}
+                        <input type="checkbox" name="{$val->column_name}" value="{htmlspecialchars($v)}" <!--@if(is_array($val->value)&&in_array($v, $val->value))-->checked="true"<!--@end-->/>    {$v}
                     <!--@end-->
                 <!--@end-->
 
@@ -213,7 +213,7 @@
             <!-- 한국 주소 검색 -->
             <!--@elseif($val->column_type == 'kr_zip')-->
                 <div id="zone_address_1_{$val->column_name}" style="display:<!--@if($val->value[0])-->inline<!--@else-->none<!--@end-->;">
-                    <input type="text" name="{$val->column_name}" value="{$val->value[0]}" />
+                    <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value[0])}" />
                     <input type="button" value="{$lang->cmd_cancel}" onclick="doHideKrZipList('{$val->column_name}'); return false;" />
                 </div>
                 <div id="zone_address_list_{$val->column_name}" style="display:none">
@@ -227,7 +227,7 @@
                 </div>
 
                 <div>
-                    <input type="text" name="{$val->column_name}" value="{$val->value[1]}" />
+                    <input type="text" name="{$val->column_name}" value="{htmlspecialchars($val->value[1])}" />
                 </div>
 
             <!-- 일본 주소 검색 -->
@@ -236,7 +236,7 @@
 
             <!-- 날자 입력 -->
             <!--@elseif($val->column_type == 'date')-->
-                <input type="hidden" name="{$val->column_name}" id="date_{$val->column_name}" value="{$val->value}" />
+                <input type="hidden" name="{$val->column_name}" id="date_{$val->column_name}" value="{htmlspecialchars($val->value)}" />
                 <span id="str_{$val->column_name}">{zdate($val->value,"Y-m-d")}</span>
                 [<a href="#" onclick="open_calendar('{$val->column_name}','{$val->value}');return false;">{$lang->cmd_open_calendar}</a>]
 
@@ -245,7 +245,7 @@
         </td>
     </tr>
     <tr>
-        <td>{$val->description}</td>
+        <td>{htmlspecialchars($val->description)}</td>
     </tr>
         <!--@end-->
     <!--@end-->

modules/member/tpl/join_form_list.html

@@ -23,7 +23,7 @@
     </tr>
     <!--@foreach($form_list as $no => $val)-->
     <tr>
-        <td>{$val->column_title}</td>
+        <td>{htmlspecialchars($val->column_title)}</td>
         <td>{$val->column_name}</td>
         <td>{$lang->column_type_list[$val->column_type]}</td>
         <td>{$val->is_active}</td>

modules/member/tpl/member_config.html

@@ -2,6 +2,7 @@
 <!--%import("filter/insert_config.xml")-->
 
 <form action="./" method="get" onsubmit="return procFilter(this, insert_config)">
+    <input type="hidden" name="content" value="{htmlspecialchars($config->agreement)}" />
     <table border="1">
     <tr>
         <th>{$lang->skin}</th>
@@ -51,7 +52,7 @@
     </tr>
     <tr>
         <th rowspan="2">{$lang->agreement}</th>
-        <td><textarea name="agreement">{$config->agreement}</textarea></td>
+        <td>{$editor}</td>
     </tr>
     <tr>
         <td>{$lang->about_agreement}</td>

modules/member/tpl/member_info.html

@@ -10,15 +10,15 @@
 <table>
 <tr>
     <th>{$lang->user_id}</th>
-    <td>{$member_info->user_id}</td>
+    <td>{htmlspecialchars($member_info->user_id)}</td>
 </tr>
 <tr>
     <th>{$lang->user_name}</th>
-    <td>{$member_info->user_name}</td>
+    <td>{htmlspecialchars($member_info->user_name)}</td>
 </tr>
 <tr>
     <th>{$lang->nick_name}</th>
-    <td>{$member_info->nick_name}</td>
+    <td>{htmlspecialchars($member_info->nick_name)}</td>
 </tr>
 <tr>
     <th>{$lang->image_name}</th>
@@ -62,15 +62,15 @@
 </tr>
 <tr>
     <th>{$lang->email_address}</th>
-    <td>{$member_info->email_address}</td>
+    <td>{htmlspecialchars($member_info->email_address)}</td>
 </tr>
 <tr>
     <th>{$lang->homepage}</th>
-    <td><!--@if($member_info->homepage)--><a href="#" onclick="winopen('{$member_info->homepage}'); return false;">{$member_info->homepage}</a><!--@end--></td>
+    <td><!--@if($member_info->homepage)--><a href="#" onclick="winopen('{$member_info->homepage}'); return false;">{htmlspecialchars($member_info->homepage)}</a><!--@end--></td>
 </tr>
 <tr>
     <th>{$lang->blog}</th>
-    <td><!--@if($member_info->blog)--><a href="#" onclick="winopen('{$member_info->blog}'); return false;">{$member_info->blog}</a><!--@end--></td>
+    <td><!--@if($member_info->blog)--><a href="#" onclick="winopen('{$member_info->blog}'); return false;">{htmlspecialchars($member_info->blog)}</a><!--@end--></td>
 </tr>
 <tr>
     <th>{$lang->birthday}</th>
@@ -107,18 +107,18 @@
 <!--@if($extend_form_list)-->
 <!--@foreach($extend_form_list as $key => $val)-->
 <tr>
-    <th>{$val->column_title}</th>
+    <th>{htmlspecialchars($val->column_title)}</th>
     <td>
         <!--@if($val->column_type=='tel')-->
-            {$val->value[0]} - {$val->value[1]} - {$val->value[2]}
+            {htmlspecialchars($val->value[0])} - {htmlspecialchars($val->value[1])} - {htmlspecialchars($val->value[2])}
         <!--@elseif($val->column_type=='kr_zip')-->
-            {$val->value[0]} {$val->value[1]}
+            {htmlspecialchars($val->value[0])} {htmlspecialchars($val->value[1])}
         <!--@elseif($val->column_type=='checkbox')-->
-            {implode(",",$val->value)}
+            {htmlspecialchars(implode(",",$val->value))}
         <!--@elseif($val->column_type=='date')-->
             {zdate($val->value, "Y-m-d")}
         <!--@else-->
-            {$val->value}
+            {htmlspecialchars($val->value)}
         <!--@end-->
     </td>
 </tr>
@@ -126,7 +126,7 @@
 <!--@end-->
 <tr>
     <th>{$lang->description}</th>
-    <td>{$member_info->description}</td>
+    <td>{htmlspecialchars($member_info->description)}</td>
 </tr>
 <tr>
     <td colspan="2">

modules/member/tpl/member_list.html

@@ -24,9 +24,9 @@
     <!--@foreach($member_list as $no => $val)-->
     <tr>
         <td>{$val->member_srl}</td>
-        <td><a href="{getUrl('act','dispMemberAdminInfo','member_srl',$val->member_srl)}">{$val->user_id}</a></td>
-        <td>{$val->user_name}</td>
-        <td><div class="member_{$val->member_srl}">{$val->nick_name}</div></td>
+        <td><a href="{getUrl('act','dispMemberAdminInfo','member_srl',$val->member_srl)}">{htmlspecialchars($val->user_id)}</a></td>
+        <td>{htmlspecialchars($val->user_name)}</td>
+        <td><div class="member_{$val->member_srl}">{htmlspecialchars($val->nick_name)}</div></td>
         <td>{$val->allow_mailing}</td>
         <td>{$val->denied}</td>
         <td>{zdate($val->regdate,"Y-m-d")}</td>