본문으로 건너뛰기

엑셀·CSV 다운로드 및 쿠폰 발급 보안 강화

PHP 8 · GODO26
변경 파일 수: 2개
변경 파일 목록
총 2개
변경 파일 코드
추가삭제
Component/Coupon/CouponAdmin.php+7-1
변경 전CouponAdmin.php
$fileHandler->write(\App::getUserBasePath() . '/config/CliSaveCoupon', json_encode($tempMemberData));
$aTempData = array('arrData' => $arrData, 'searchQuery' => 'T');
$sData = json_encode($aTempData);
exec("/usr/local/php/bin/php " . \App::getUserBasePath() . "/route.php job --name='CliSaveCoupon' --extravalue='" . $sData . "'" . " > /dev/null 2>/dev/null &");
 
 
 
 
 
 
return 'C';
exit;
}
 
변경 후CouponAdmin.php
$fileHandler->write(\App::getUserBasePath() . '/config/CliSaveCoupon', json_encode($tempMemberData));
$aTempData = array('arrData' => $arrData, 'searchQuery' => 'T');
$sData = json_encode($aTempData);
$script = sprintf(
'/usr/local/php/bin/php %s job --name=%s --extravalue=%s > /dev/null 2>/dev/null &',
escapeshellarg(\App::getUserBasePath() . '/route.php'),
escapeshellarg('CliSaveCoupon'),
escapeshellarg($sData)
);
exec($script);
return 'C';
exit;
}
 
Component/Excel/ExcelRequest.php+14-7
변경 전ExcelRequest.php
}
 
if ($arrData['passwordFl'] == 'y') {
// 특정문자 치환
$replace = ['$', '"', '`'];
foreach ($replace as $key => $val) {
$arrData['password'] = str_replace($val, '\\' . $val, $arrData['password']);
}
$this->fileConfig['password'] = gd_isset($arrData['password']);
} else {
$this->fileConfig['password'] = "";
$fileName = pathinfo($tmpFilePath)['filename'];
 
$zipFilePath = UserFilePath::data('excel', $this->fileConfig['menu'], $fileName . ".zip")->getRealPath();
exec('cd ' . pathinfo($tmpFilePath)['dirname'] . ' && zip -P ' . $this->fileConfig['password'] . ' -r "' . $zipFilePath . '" "' . $fileName . '.xls"');
 
 
 
 
 
 
$this->fileConfig['fileName'][] = $fileName . ".zip";
FileHandler::delete($tmpFilePath);
}
$tmpFilePath = UserFilePath::data('excel', $this->fileConfig['menu'], '_tmp', $fileName . ".xls")->getRealPath();
FileHandler::write($tmpFilePath, $inputData, 0707);
$zipFilePath = UserFilePath::data('excel', $this->fileConfig['menu'], $fileName . ".zip")->getRealPath();
exec('cd ' . pathinfo($tmpFilePath)['dirname'] . ' && zip -P ' . $this->fileConfig['password'] . ' -r "' . $zipFilePath . '" "' . $fileName . '.xls"');
 
 
 
 
 
 
$this->fileConfig['fileName'][] = $fileName . '.zip';
FileHandler::delete($tmpFilePath);
} else {
 
변경 후ExcelRequest.php
}
 
if ($arrData['passwordFl'] == 'y') {
 
 
 
 
 
$this->fileConfig['password'] = gd_isset($arrData['password']);
} else {
$this->fileConfig['password'] = "";
$fileName = pathinfo($tmpFilePath)['filename'];
 
$zipFilePath = UserFilePath::data('excel', $this->fileConfig['menu'], $fileName . ".zip")->getRealPath();
exec(sprintf(
'cd %s && zip -P %s -r %s %s',
escapeshellarg(pathinfo($tmpFilePath)['dirname']),
escapeshellarg($this->fileConfig['password']),
escapeshellarg($zipFilePath),
escapeshellarg($fileName . '.xls')
));
$this->fileConfig['fileName'][] = $fileName . ".zip";
FileHandler::delete($tmpFilePath);
}
$tmpFilePath = UserFilePath::data('excel', $this->fileConfig['menu'], '_tmp', $fileName . ".xls")->getRealPath();
FileHandler::write($tmpFilePath, $inputData, 0707);
$zipFilePath = UserFilePath::data('excel', $this->fileConfig['menu'], $fileName . ".zip")->getRealPath();
exec(sprintf(
'cd %s && zip -P %s -r %s %s',
escapeshellarg(pathinfo($tmpFilePath)['dirname']),
escapeshellarg($this->fileConfig['password']),
escapeshellarg($zipFilePath),
escapeshellarg($fileName . '.xls')
));
$this->fileConfig['fileName'][] = $fileName . '.zip';
FileHandler::delete($tmpFilePath);
} else {