본문으로 건너뛰기

게시판 및 상품 안내 보안 강화

PHP 8 · GODO26
변경 파일 수: 3개
변경 파일 목록
3
변경 파일 코드
추가삭제
Component/Agreement/BuyerInform.php+6-3
변경 전BuyerInform.php
$tableName = $this->mall->getTableName(DB_BUYER_INFORM, $mallSno);
 
$arrField = "*,s.companyNm as scmNm";
 
 
if ($mallSno > DEFAULT_MALL_NUMBER) {
$strSQL = "SELECT " . $arrField . " FROM " . $tableName . " INNER JOIN " . DB_SCM_MANAGE . " as s ON s.scmNo = " . $tableName . ".scmNo WHERE informCd='" . $informCd . "' AND mallSno='" . $mallSno . "' LIMIT 1";
 
} else {
$strSQL = "SELECT " . $arrField . " FROM " . $tableName . " INNER JOIN " . DB_SCM_MANAGE . " as s ON s.scmNo = " . $tableName . ".scmNo WHERE informCd='" . $informCd . "' LIMIT 1";
}
$data = $this->db->fetch($strSQL);
 
if (Session::get('manager.isProvider')) {
if($data['scmDisplayFl'] =='n' && $data['scmNo'] != Session::get('manager.scmNo')) {
 
변경 후BuyerInform.php
$tableName = $this->mall->getTableName(DB_BUYER_INFORM, $mallSno);
 
$arrField = "*,s.companyNm as scmNm";
$arrBind = [];
$this->db->bind_param_push($arrBind, 's', $informCd);
if ($mallSno > DEFAULT_MALL_NUMBER) {
$this->db->bind_param_push($arrBind, 'i', $mallSno);
$strSQL = "SELECT " . $arrField . " FROM " . $tableName . " INNER JOIN " . DB_SCM_MANAGE . " as s ON s.scmNo = " . $tableName . ".scmNo WHERE informCd = ? AND mallSno = ? LIMIT 1";
} else {
$strSQL = "SELECT " . $arrField . " FROM " . $tableName . " INNER JOIN " . DB_SCM_MANAGE . " as s ON s.scmNo = " . $tableName . ".scmNo WHERE informCd = ? LIMIT 1";
}
$data = $this->db->query_fetch($strSQL, $arrBind, false);
 
if (Session::get('manager.isProvider')) {
if($data['scmDisplayFl'] =='n' && $data['scmNo'] != Session::get('manager.scmNo')) {
 
Component/Board/ArticleAdmin.php+4-2
변경 전ArticleAdmin.php
return '네이버페이 구매자';
}
if ($data[$refManagerSno] < 0) { //비회원일때
$query = "SELECT scmNo,managerNickNm,dispImage,managerId,managerNm,isDelete FROM " . DB_MANAGER . " WHERE sno = " . abs($data[$refManagerSno]);
$managerData = $this->db->query_fetch($query, null, false);
 
 
$addInfo = '';
if ($managerData['isDelete'] == 'y') {
$addInfo = '<br><span class="text-red">(' . Manager::DELETE_DISPLAY . ')</span>'; //TODO:운영자표기
 
변경 후ArticleAdmin.php
return '네이버페이 구매자';
}
if ($data[$refManagerSno] < 0) { //비회원일때
$arrBind = [];
$this->db->bind_param_push($arrBind, 'i', abs($data[$refManagerSno]));
$query = "SELECT scmNo,managerNickNm,dispImage,managerId,managerNm,isDelete FROM " . DB_MANAGER . " WHERE sno = ?";
$managerData = $this->db->query_fetch($query, $arrBind, false);
$addInfo = '';
if ($managerData['isDelete'] == 'y') {
$addInfo = '<br><span class="text-red">(' . Manager::DELETE_DISPLAY . ')</span>'; //TODO:운영자표기
 
Component/Board/Board.php+2-2
변경 전Board.php
if($this->req['mode'] == 'write') {
$groupNo = Session::get('groupNo_' . $this->cfg['bdId']);
if (gd_isset($groupNo)) {
$sql = 'SELECT regDt FROM ' . DB_BD_ . $this->req['bdId'] . ' WHERE groupNo = ? AND groupThread = \'\'';
$res = $this->db->query_fetch($sql, ['i', $groupNo]);
if (empty($res[0]['regDt']) === false && $res[0]['regDt'] < date('Y-m-d H:i:s', strtotime('-30 seconds'))) {
$groupNo = BoardUtil::createGroupNo($this->cfg['bdId']);
$groupNo = BoardUtil::createGroupNo($this->cfg['bdId']);
Session::set('groupNo_' . $this->cfg['bdId'], $groupNo);
}
$query = "SELECT count(*) as cnt FROM " . DB_BD_ . $this->req['bdId'] . " WHERE groupNo <= ? AND groupThread = '' AND regDt >= (now()-INTERVAL 30 SECOND) AND writerIp = ? AND subject = ? AND memNo = ? ";
$arrBind = [];
$this->db->bind_param_push($arrBind, 's', $groupNo);
$this->db->bind_param_push($arrBind, 's', \Request::getRemoteAddress());
 
변경 후Board.php
if($this->req['mode'] == 'write') {
$groupNo = Session::get('groupNo_' . $this->cfg['bdId']);
if (gd_isset($groupNo)) {
$sql = 'SELECT regDt FROM ' . DB_BD_ . $this->cfg['bdId'] . ' WHERE groupNo = ? AND groupThread = \'\'';
$res = $this->db->query_fetch($sql, ['i', $groupNo]);
if (empty($res[0]['regDt']) === false && $res[0]['regDt'] < date('Y-m-d H:i:s', strtotime('-30 seconds'))) {
$groupNo = BoardUtil::createGroupNo($this->cfg['bdId']);
$groupNo = BoardUtil::createGroupNo($this->cfg['bdId']);
Session::set('groupNo_' . $this->cfg['bdId'], $groupNo);
}
$query = "SELECT count(*) as cnt FROM " . DB_BD_ . $this->cfg['bdId'] . " WHERE groupNo <= ? AND groupThread = '' AND regDt >= (now()-INTERVAL 30 SECOND) AND writerIp = ? AND subject = ? AND memNo = ? ";
$arrBind = [];
$this->db->bind_param_push($arrBind, 's', $groupNo);
$this->db->bind_param_push($arrBind, 's', \Request::getRemoteAddress());