|
ÇöÀç ȨÆäÀÌÁö¸¦ ¸¸µé¸é¼ º¸°íÀִµ¥
°Ô½ÃÆÇ¿¡¼ ±ÛÀ» »èÁ¦Çϴµ¥
ÅäÅ«¿¡·¯·Î »èÁ¦°¡ ¾ÈµÈ´Ù±¸ ³ª¿À³×¿ä.
±×´©º¸µå4À̱¸¿ä
ÀÎÅͳÝÀ¸·Î ºÁºÃÁö¸¸
congif.php ÂÊÀº ÀÌ·¸°Ô
/*
// 081022 : CSRF ¿¡¼ ÅäÅ« ºñ±³´Â ÀÇ¹Ì ¾øÀ½
// ¼¼¼Ç¿¡ ÀúÀåµÈ ÅäÅ«°ú Æû°ªÀ¸·Î ³Ñ¾î¿Â ÅäÅ«À» ºñ±³ÇÏ¿© Ʋ¸®¸é ¿¡·¯
if ($_POST["token"] && get_session("ss_token") == $_POST["token"])
{
// ÀÌÀü Æû Àü¼Û ¹Ù·ÎÀü¿¡ ¸¸µé¾îÁø Äí۰¡ ¾ø´Ù¸é ¿¡·¯
//if (!get_cookie($_POST["token"])) alert_close("ÄíŰ ¿¡·¯");
// ¸ÂÀ¸¸é ¼¼¼Ç°ú Äí۸¦ Áö¿ö ´Ù½Ã ÀÔ·ÂÆûÀ» ÅëÇØ¼ µé¾î¿Àµµ·Ï ÇÑ´Ù.
set_session("ss_token", "");
set_cookie($_POST["token"], 0, 0);
}
else
{
alert_close("ÅäÅ« ¿¡·¯");
exit;
}
*/
ÀÌ·¸°Ô ÁÖ¼®À» ¸ÔÀÌ¶ó±¸ ÇÏ´õ¶ó±¸¿ä
±×·¡¼ È®ÀÎÇØºÃ´õ´Ï ±×´ë·Î ¸Ô¿©Á® ÀÖ±¸¿ä À½
¾îµð ´Ù¸¥°÷À» ¶Ç ¼öÁ¤ÇؾßÇÒ°÷ÀÌ ÀÖ³ª¿ä?
¹Ø¿¡ ¼Ò½º´Â bbs/delete.phpÀÔ´Ï´Ù.
ÇöÀç ȨÆäÀÌÁö¸¦ ¸¸µé¸é¼ º¸°íÀִµ¥
°Ô½ÃÆÇ¿¡¼ ±ÛÀ» »èÁ¦Çϴµ¥
ÅäÅ«¿¡·¯·Î »èÁ¦°¡ ¾ÈµÈ´Ù±¸ ³ª¿À³×¿ä.
±×´©º¸µå4À̱¸¿ä
ÀÎÅͳÝÀ¸·Î ºÁºÃÁö¸¸
congif.php ÂÊÀº ÀÌ·¸°Ô
/*
// 081022 : CSRF ¿¡¼ ÅäÅ« ºñ±³´Â ÀÇ¹Ì ¾øÀ½
// ¼¼¼Ç¿¡ ÀúÀåµÈ ÅäÅ«°ú Æû°ªÀ¸·Î ³Ñ¾î¿Â ÅäÅ«À» ºñ±³ÇÏ¿© Ʋ¸®¸é ¿¡·¯
if ($_POST["token"] && get_session("ss_token") == $_POST["token"])
{
// ÀÌÀü Æû Àü¼Û ¹Ù·ÎÀü¿¡ ¸¸µé¾îÁø Äí۰¡ ¾ø´Ù¸é ¿¡·¯
//if (!get_cookie($_POST["token"])) alert_close("ÄíŰ ¿¡·¯");
// ¸ÂÀ¸¸é ¼¼¼Ç°ú Äí۸¦ Áö¿ö ´Ù½Ã ÀÔ·ÂÆûÀ» ÅëÇØ¼ µé¾î¿Àµµ·Ï ÇÑ´Ù.
set_session("ss_token", "");
set_cookie($_POST["token"], 0, 0);
}
else
{
alert_close("ÅäÅ« ¿¡·¯");
exit;
}
*/
ÀÌ·¸°Ô ÁÖ¼®À» ¸ÔÀÌ¶ó±¸ ÇÏ´õ¶ó±¸¿ä
±×·¡¼ È®ÀÎÇØºÃ´õ´Ï ±×´ë·Î ¸Ô¿©Á® ÀÖ±¸¿ä À½
¾îµð ´Ù¸¥°÷À» ¶Ç ¼öÁ¤ÇؾßÇÒ°÷ÀÌ ÀÖ³ª¿ä?
¹Ø¿¡ ¼Ò½º´Â bbs/delete.phpÀÔ´Ï´Ù.
[ ¡å Áú¹®°ü·Ã Âü°í Source ]
<?
include_once("./_common.php");
if ($is_admin)
{
if (!($token && get_session("ss_delete_token") == $token))
alert("ÅäÅ« ¿¡·¯·Î »èÁ¦ ºÒ°¡ÇÕ´Ï´Ù.");
}
//$wr = sql_fetch(" select * from $write_table where wr_id = '$wr_id' ");
@include_once("$board_skin_path/delete.head.skin.php");
if ($is_admin == "super") // ÃÖ°í°ü¸®ÀÚ Åë°ú
;
else if ($is_admin == "group") { // ±×·ì°ü¸®ÀÚ
$mb = get_member($write[mb_id]);
if ($member[mb_id] != $group[gr_admin]) // ÀÚ½ÅÀÌ °ü¸®ÇÏ´Â ±×·ìÀΰ¡?
alert("ÀÚ½ÅÀÌ °ü¸®ÇÏ´Â ±×·ìÀÇ °Ô½ÃÆÇÀÌ ¾Æ´Ï¹Ç·Î »èÁ¦ÇÒ ¼ö ¾ø½À´Ï´Ù.");
else if ($member[mb_level] < $mb[mb_level]) // ÀÚ½ÅÀÇ ·¹º§ÀÌ Å©°Å³ª °°´Ù¸é Åë°ú
alert("ÀÚ½ÅÀÇ ±ÇÇѺ¸´Ù ³ôÀº ±ÇÇÑÀÇ È¸¿øÀÌ ÀÛ¼ºÇÑ ±ÛÀº »èÁ¦ÇÒ ¼ö ¾ø½À´Ï´Ù.");
} else if ($is_admin == "board") { // °Ô½ÃÆÇ°ü¸®ÀÚÀ̸é
$mb = get_member($write[mb_id]);
if ($member[mb_id] != $board[bo_admin]) // ÀÚ½ÅÀÌ °ü¸®ÇÏ´Â °Ô½ÃÆÇÀΰ¡?
alert("ÀÚ½ÅÀÌ °ü¸®ÇÏ´Â °Ô½ÃÆÇÀÌ ¾Æ´Ï¹Ç·Î »èÁ¦ÇÒ ¼ö ¾ø½À´Ï´Ù.");
else if ($member[mb_level] < $mb[mb_level]) // ÀÚ½ÅÀÇ ·¹º§ÀÌ Å©°Å³ª °°´Ù¸é Åë°ú
alert("ÀÚ½ÅÀÇ ±ÇÇѺ¸´Ù ³ôÀº ±ÇÇÑÀÇ È¸¿øÀÌ ÀÛ¼ºÇÑ ±ÛÀº »èÁ¦ÇÒ ¼ö ¾ø½À´Ï´Ù.");
} else if ($member[mb_id]) {
if ($member[mb_id] != $write[mb_id])
alert("ÀÚ½ÅÀÇ ±ÛÀÌ ¾Æ´Ï¹Ç·Î »èÁ¦ÇÒ ¼ö ¾ø½À´Ï´Ù.");
} else {
if ($write[mb_id])
alert("·Î±×ÀÎ ÈÄ »èÁ¦Çϼ¼¿ä.", "./login.php?url=".urlencode("./board.php?bo_table=$bo_table&wr_id=$wr_id"));
else if (sql_password($wr_password) != $write[wr_password])
alert("ÆÐ½º¿öµå°¡ Ʋ¸®¹Ç·Î »èÁ¦ÇÒ ¼ö ¾ø½À´Ï´Ù.");
}
$len = strlen($write[wr_reply]);
if ($len < 0) $len = 0;
$reply = substr($write[wr_reply], 0, $len);
// ¿ø±Û¸¸ ±¸ÇÑ´Ù.
$sql = " select count(*) as cnt from $write_table
where wr_reply like '$reply%'
and wr_id <> '$write[wr_id]'
and wr_num = '$write[wr_num]'
and wr_is_comment = 0 ";
$row = sql_fetch($sql);
if ($row[cnt] && !$is_admin)
alert("ÀÌ ±Û°ú °ü·ÃµÈ ´äº¯±ÛÀÌ Á¸ÀçÇϹǷΠ»èÁ¦ ÇÒ ¼ö ¾ø½À´Ï´Ù.\\n\\n¿ì¼± ´äº¯±ÛºÎÅÍ »èÁ¦ÇÏ¿© ÁֽʽÿÀ.");
// ÄÚ¸àÆ® ´Þ¸° ¿ø±ÛÀÇ »èÁ¦ ¿©ºÎ
$sql = " select count(*) as cnt from $write_table
where wr_parent = '$wr_id'
and mb_id <> '$member[mb_id]'
and wr_is_comment = 1 ";
$row = sql_fetch($sql);
if ($row[cnt] >= $board[bo_count_delete] && !$is_admin)
alert("ÀÌ ±Û°ú °ü·ÃµÈ ÄÚ¸àÆ®°¡ Á¸ÀçÇϹǷΠ»èÁ¦ ÇÒ ¼ö ¾ø½À´Ï´Ù.\\n\\nÄÚ¸àÆ®°¡ {$board[bo_count_delete]}°Ç ÀÌ»ó ´Þ¸° ¿ø±ÛÀº »èÁ¦ÇÒ ¼ö ¾ø½À´Ï´Ù.");
// »ç¿ëÀÚ ÄÚµå ½ÇÇà
@include_once("$board_skin_path/delete.skin.php");
// ³ª¶ó¿À¸§´Ô ¼öÁ¤ : ¿ø±Û°ú ÄÚ¸àÆ®¼ö°¡ Á¤»óÀûÀ¸·Î ¾÷µ¥ÀÌÆ® µÇÁö ¾Ê´Â ¿À·ù¸¦ Àâ¾Æ Áּ̽À´Ï´Ù.
//$sql = " select wr_id, mb_id, wr_comment from $write_table where wr_parent = '$write[wr_id]' order by wr_id ";
$sql = " select wr_id, mb_id, wr_is_comment from $write_table where wr_parent = '$write[wr_id]' order by wr_id ";
$result = sql_query($sql);
while ($row = sql_fetch_array($result))
{
// ¿ø±ÛÀ̶ó¸é
if (!$row[wr_is_comment])
{
// ¿ø±Û Æ÷ÀÎÆ® »èÁ¦
if (!delete_point($row[mb_id], $bo_table, $row[wr_id], '¾²±â'))
insert_point($row[mb_id], $board[bo_write_point] * (-1), "$board[bo_subject] $row[wr_id] ±Û»èÁ¦");
// ¾÷·ÎµåµÈ ÆÄÀÏÀÌ ÀÖ´Ù¸é ÆÄÀÏ»èÁ¦
$sql2 = " select * from $g4[board_file_table] where bo_table = '$bo_table' and wr_id = '$row[wr_id]' ";
$result2 = sql_query($sql2);
while ($row2 = sql_fetch_array($result2))
@unlink("$g4[path]/data/file/$bo_table/$row2[bf_file]");
// ÆÄÀÏÅ×À̺í Çà »èÁ¦
sql_query(" delete from $g4[board_file_table] where bo_table = '$bo_table' and wr_id = '$row[wr_id]' ");
$count_write++;
}
else
{
// ÄÚ¸àÆ® Æ÷ÀÎÆ® »èÁ¦
if (!delete_point($row[mb_id], $bo_table, $row[wr_id], 'ÄÚ¸àÆ®'))
insert_point($row[mb_id], $board[bo_comment_point] * (-1), "$board[bo_subject] {$write[wr_id]}-{$row[wr_id]} ÄÚ¸àÆ®»èÁ¦");
$count_comment++;
}
}
// °Ô½Ã±Û »èÁ¦
sql_query(" delete from $write_table where wr_parent = '$write[wr_id]' ");
// ÃֱٰԽù° »èÁ¦
sql_query(" delete from $g4[board_new_table] where bo_table = '$bo_table' and wr_parent = '$write[wr_id]' ");
// ½ºÅ©·¦ »èÁ¦
sql_query(" delete from $g4[scrap_table] where bo_table = '$bo_table' and wr_id = '$write[wr_id]' ");
// °øÁö»çÇ× »èÁ¦
$notice_array = explode("\n", trim($board[bo_notice]));
$bo_notice = "";
for ($k=0; $k<count($notice_array); $k++)
if ((int)$write[wr_id] != (int)$notice_array[$k])
$bo_notice .= $notice_array[$k] . "\n";
$bo_notice = trim($bo_notice);
sql_query(" update $g4[board_table] set bo_notice = '$bo_notice' where bo_table = '$bo_table' ");
// ±Û¼ýÀÚ °¨¼Ò
if ($count_write > 0 || $count_comment > 0)
sql_query(" update $g4[board_table] set bo_count_write = bo_count_write - '$count_write', bo_count_comment = bo_count_comment - '$count_comment' where bo_table = '$bo_table' ");
@include_once("$board_skin_path/delete.tail.skin.php");
goto_url("./board.php?bo_table=$bo_table&page=$page" . $qstr);
?>
|