버그 리포트

(2014-08-22 16:27:39)

:::

다음과 같은 소스로 해당 문제를 해소하였습니다. 참고 바랍니다. 소스 중에서 my_**_dla 문자열은 고유한 문자열을 사용하면 됩니다.<br />
<br />
[/bbs/write_ok.php]<br />
<pre class="brush: php; html_script: true; first-line: 72" title="/bbs/write_ok.php">
// &lt,&gt를 신택스하이라이트에서 사용하기 위해 임시 치환
$memo=str_replace("&amp;lt;","my_lt_dla",$memo);
$memo=str_replace("&amp;gt;","my_gt_dla",$memo);

// 관리자이거나 HTML허용레벨이 낮을때 태그의 금지유무를 체크
if(!$is_admin&&$setup[grant_html]&lt;$member[level]) {

&nbsp;&nbsp;&nbsp;&nbsp;// 내용의 HTML 금지;;
&nbsp;&nbsp;&nbsp;&nbsp;if(!$use_html||$setup[use_html]==0) $memo=del_html($memo);

&nbsp;&nbsp;&nbsp;&nbsp;// HTML의 부분허용일때;;
&nbsp;&nbsp;&nbsp;&nbsp;if($use_html&&$setup[use_html]==1) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=str_replace("&lt;","&amp;lt;",$memo);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$tag=explode(",",$setup[avoid_tag]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for($i=0;$i&lt;count($tag);$i++) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!isblank($tag[$i])) { 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=eregi_replace("&amp;lt;".$tag[$i]." ","&lt;".$tag[$i]." ",$memo); 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=eregi_replace("&amp;lt;".$tag[$i]."&gt;","&lt;".$tag[$i]."&gt;",$memo); 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=eregi_replace("&amp;lt;/".$tag[$i],"&lt;/".$tag[$i],$memo); 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// XSS 해킹 이벤트 핸들러 제거
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$xss_pattern1 = "!(&lt;[^&gt;]*?)on(load|click|error|abort|activate|afterprint|afterupdate|beforeactivate|beforecopy|beforecut|beforedeactivate|beforeeditfocus|beforepaste|beforeprint|beforeunload|beforeupdate|blur|bounce|cellchange|change|contextmenu|controlselect|copy|cut|dataavailable|datasetchanged|datasetcomplete|dblclick|deactivate|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|errorupdate|filterchange|finish|focus|focusin|focusout|help|keydown|keypress|keyup|layoutcomplete|losecapture|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|mousewheel|move|moveend|movestart|paste|propertychange|readystatechange|reset|resize|resizeend|resizestart|rowenter|rowexit|rowsdelete|rowsinserted|scroll|select|selectionchange|selectstart|start|stop|submit|unload)([^&gt;]*?)(&gt;)!i";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$xss_pattern2 = "!on(load|click|error|abort|activate|afterprint|afterupdate|beforeactivate|beforecopy|beforecut|beforedeactivate|beforeeditfocus|beforepaste|beforeprint|beforeunload|beforeupdate|blur|bounce|cellchange|change|contextmenu|controlselect|copy|cut|dataavailable|datasetchanged|datasetcomplete|dblclick|deactivate|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|errorupdate|filterchange|finish|focus|focusin|focusout|help|keydown|keypress|keyup|layoutcomplete|losecapture|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|mousewheel|move|moveend|movestart|paste|propertychange|readystatechange|reset|resize|resizeend|resizestart|rowenter|rowexit|rowsdelete|rowsinserted|scroll|select|selectionchange|selectstart|start|stop|submit|unload)=!i";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(preg_match($xss_pattern1,$memo))
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=preg_replace($xss_pattern1,"\\1\\4",$memo);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(preg_match($xss_pattern2,$memo))
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=preg_replace($xss_pattern2,"",$memo);
&nbsp;&nbsp;&nbsp;&nbsp;}
} else {
&nbsp;&nbsp;&nbsp;&nbsp;if(!$use_html) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=del_html($memo);
&nbsp;&nbsp;&nbsp;&nbsp;}
}

// 신택스하이라이트 처리 시작
$codePattern = "#(\[[a-z]+\_code\:[0-9]+\{[^}]*?\}\]|\[\/[a-z]+\_code\])#si";
$temp = preg_split($codePattern,$memo,-1,PREG_SPLIT_DELIM_CAPTURE);

for($i=0;$i&lt;count($temp);$i++) {
&nbsp;&nbsp;&nbsp;&nbsp;for($j=0;$j&lt;count($code);$j++) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$pattern1 = "#\[".$code[$j]."\_code\:([0-9]+)\{([^}]*?)\}\]#i";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$pattern2 = "#\[\/".$code[$j]."\_code\]#i";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(preg_match($pattern1,$temp[$i])) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if($code[$j]=="php")
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i]=preg_replace($pattern1,"&lt;pre class=\"brush: $code[$j]; html_script: true; first-line: \\1\" title=\"\\2\"&gt;",$temp[$i]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i]=preg_replace($pattern1,"&lt;pre class=\"brush: $code[$j]; first-line: \\1\" title=\"\\2\"&gt;",$temp[$i]);

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("&amp;amp;","&amp;amp;amp;",$temp[$i+1]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("&amp;#039;","&amp;amp;#039;",$temp[$i+1]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("&amp;quot;","&amp;amp;quot;",$temp[$i+1]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("&amp;nbsp;","&amp;amp;nbsp;",$temp[$i+1]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("my_lt_dla","&amp;amp;lt;",$temp[$i+1]); // &lt 사용!
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("my_gt_dla","&amp;amp;gt;",$temp[$i+1]); // &gt 사용!
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("&lt;","&amp;lt;",$temp[$i+1]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$i+=1;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;elseif(preg_match($pattern2,$temp[$i])) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i]="&lt;/pre&gt;";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;}
}

$memo="";

for($i=0;$i&lt;count($temp);$i++) {
&nbsp;&nbsp;&nbsp;&nbsp;$memo = $memo.$temp[$i];
}
// 신택스하이라이트 처리 끝

// 임시 치환된 문자를 복원함
$memo=str_replace("my_lt_dla","&amp;lt;",$memo);
$memo=str_replace("my_gt_dla","&amp;gt;",$memo);

</pre>

[bitly]

번호	분류	제목	작성자	작성일	추천	조회
Notice	일반	(공지) 오픈소스 게시판 수정증보판을 사용할 때 기억해야 할 몇가지 특성... [2]		2018/05/01	181	1023
87	질문	그래서 링크 버그는요? [1]	gg	2016/05/28	38	743
86	질문	object 태그 버그 [1]	gg	2016/05/29	44	663
85	질문	태그 내 열고 닫는 따옴표 처리 [1]	gg	2016/05/29	26	703
84	질문	xmp 태그 공격 [5]	gg	2016/05/29	69	826
83	질문	jwplayer 라이센스 위반 [2]	gg	2016/05/29	24	1150
82	질문	리눅스 크롬에서 레이아웃 깨짐 [1]	gg	2016/06/25	39	715
81	질문	햄버거 사주세요 [5]	gg<shit>	2016/05/31	51	754
80	질문	htmlpurifier 라이센스 위반	gg<sigh>	2016/06/11	30	601
79	질문	bit.ly 해독기 [1]	gg<xmp>	2016/05/29	23	582
78	질문	shift+tab 오작동 [6]	gg<xmp>	2016/06/10	53	773
77	질문	Firefox 57 다운로드 버그 [2]	glwalk	2017/11/19	42	565
76	일반	오픈소스 게시판 수정증보판을 사용하고 나서 알게 된 버그를 말씀해 주세요...		2014/06/14	104	1962
75	일반	오픈소스 게시판 수정증보판 1.0.0.0 최초판 배포...		2014/06/26	101	2963
	질문	혹시 SyntaxHighlighter에서 < 표현하는 방법 아시는 분 계신가요? [2]		2014/06/27	82	3430
73	일반	오픈소스 게시판 수정증보판 1.0.1.36 배포...		2014/06/28	95	1378
72	일반	오픈소스 게시판 수정증보판 1.0.2.2 배포...		2014/07/05	87	1440
71	일반	오픈소스 게시판 수정증보판 1.0.3.3 배포...		2014/07/14	101	1771
70	일반	오픈소스 게시판 수정증보판 1.0.4.2 배포...		2014/07/16	91	1498
69	일반	오픈소스 게시판 수정증보판 1.0.5.34 배포...		2014/07/23	110	2541
68	일반	오픈소스 게시판 수정증보판 1.0.6.6 배포...		2014/07/26	105	2229
67	일반	오픈소스 게시판 수정증보판 1.0.7.1700 배포...		2014/07/28	83	2208
66	일반	오픈소스 게시판 수정증보판 1.0.8.1257 배포...		2014/07/30	75	1703
65	일반	오픈소스 게시판 수정증보판 1.0.9.225 배포...		2014/08/02	78	1522
64	일반	오픈소스 게시판 수정증보판 1.1.0.15314 버전 배포...		2014/08/21	81	1955
63	일반	오픈소스 게시판 수정증보판 1.1.1.2252 버전 배포... [1]		2014/09/05	99	1794