버그 리포트

(2014-08-22 16:27:39)

:::

다음과 같은 소스로 해당 문제를 해소하였습니다. 참고 바랍니다. 소스 중에서 my_**_dla 문자열은 고유한 문자열을 사용하면 됩니다.<br />
<br />
[/bbs/write_ok.php]<br />
<pre class="brush: php; html_script: true; first-line: 72" title="/bbs/write_ok.php">
// &lt,&gt를 신택스하이라이트에서 사용하기 위해 임시 치환
$memo=str_replace("&amp;lt;","my_lt_dla",$memo);
$memo=str_replace("&amp;gt;","my_gt_dla",$memo);

// 관리자이거나 HTML허용레벨이 낮을때 태그의 금지유무를 체크
if(!$is_admin&&$setup[grant_html]&lt;$member[level]) {

&nbsp;&nbsp;&nbsp;&nbsp;// 내용의 HTML 금지;;
&nbsp;&nbsp;&nbsp;&nbsp;if(!$use_html||$setup[use_html]==0) $memo=del_html($memo);

&nbsp;&nbsp;&nbsp;&nbsp;// HTML의 부분허용일때;;
&nbsp;&nbsp;&nbsp;&nbsp;if($use_html&&$setup[use_html]==1) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=str_replace("&lt;","&amp;lt;",$memo);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$tag=explode(",",$setup[avoid_tag]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for($i=0;$i&lt;count($tag);$i++) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!isblank($tag[$i])) { 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=eregi_replace("&amp;lt;".$tag[$i]." ","&lt;".$tag[$i]." ",$memo); 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=eregi_replace("&amp;lt;".$tag[$i]."&gt;","&lt;".$tag[$i]."&gt;",$memo); 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=eregi_replace("&amp;lt;/".$tag[$i],"&lt;/".$tag[$i],$memo); 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// XSS 해킹 이벤트 핸들러 제거
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$xss_pattern1 = "!(&lt;[^&gt;]*?)on(load|click|error|abort|activate|afterprint|afterupdate|beforeactivate|beforecopy|beforecut|beforedeactivate|beforeeditfocus|beforepaste|beforeprint|beforeunload|beforeupdate|blur|bounce|cellchange|change|contextmenu|controlselect|copy|cut|dataavailable|datasetchanged|datasetcomplete|dblclick|deactivate|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|errorupdate|filterchange|finish|focus|focusin|focusout|help|keydown|keypress|keyup|layoutcomplete|losecapture|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|mousewheel|move|moveend|movestart|paste|propertychange|readystatechange|reset|resize|resizeend|resizestart|rowenter|rowexit|rowsdelete|rowsinserted|scroll|select|selectionchange|selectstart|start|stop|submit|unload)([^&gt;]*?)(&gt;)!i";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$xss_pattern2 = "!on(load|click|error|abort|activate|afterprint|afterupdate|beforeactivate|beforecopy|beforecut|beforedeactivate|beforeeditfocus|beforepaste|beforeprint|beforeunload|beforeupdate|blur|bounce|cellchange|change|contextmenu|controlselect|copy|cut|dataavailable|datasetchanged|datasetcomplete|dblclick|deactivate|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|errorupdate|filterchange|finish|focus|focusin|focusout|help|keydown|keypress|keyup|layoutcomplete|losecapture|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|mousewheel|move|moveend|movestart|paste|propertychange|readystatechange|reset|resize|resizeend|resizestart|rowenter|rowexit|rowsdelete|rowsinserted|scroll|select|selectionchange|selectstart|start|stop|submit|unload)=!i";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(preg_match($xss_pattern1,$memo))
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=preg_replace($xss_pattern1,"\\1\\4",$memo);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(preg_match($xss_pattern2,$memo))
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=preg_replace($xss_pattern2,"",$memo);
&nbsp;&nbsp;&nbsp;&nbsp;}
} else {
&nbsp;&nbsp;&nbsp;&nbsp;if(!$use_html) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$memo=del_html($memo);
&nbsp;&nbsp;&nbsp;&nbsp;}
}

// 신택스하이라이트 처리 시작
$codePattern = "#(\[[a-z]+\_code\:[0-9]+\{[^}]*?\}\]|\[\/[a-z]+\_code\])#si";
$temp = preg_split($codePattern,$memo,-1,PREG_SPLIT_DELIM_CAPTURE);

for($i=0;$i&lt;count($temp);$i++) {
&nbsp;&nbsp;&nbsp;&nbsp;for($j=0;$j&lt;count($code);$j++) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$pattern1 = "#\[".$code[$j]."\_code\:([0-9]+)\{([^}]*?)\}\]#i";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$pattern2 = "#\[\/".$code[$j]."\_code\]#i";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(preg_match($pattern1,$temp[$i])) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if($code[$j]=="php")
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i]=preg_replace($pattern1,"&lt;pre class=\"brush: $code[$j]; html_script: true; first-line: \\1\" title=\"\\2\"&gt;",$temp[$i]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i]=preg_replace($pattern1,"&lt;pre class=\"brush: $code[$j]; first-line: \\1\" title=\"\\2\"&gt;",$temp[$i]);

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("&amp;amp;","&amp;amp;amp;",$temp[$i+1]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("&amp;#039;","&amp;amp;#039;",$temp[$i+1]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("&amp;quot;","&amp;amp;quot;",$temp[$i+1]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("&amp;nbsp;","&amp;amp;nbsp;",$temp[$i+1]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("my_lt_dla","&amp;amp;lt;",$temp[$i+1]); // &lt 사용!
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("my_gt_dla","&amp;amp;gt;",$temp[$i+1]); // &gt 사용!
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i+1]=str_replace("&lt;","&amp;lt;",$temp[$i+1]);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$i+=1;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;elseif(preg_match($pattern2,$temp[$i])) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$temp[$i]="&lt;/pre&gt;";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;}
}

$memo="";

for($i=0;$i&lt;count($temp);$i++) {
&nbsp;&nbsp;&nbsp;&nbsp;$memo = $memo.$temp[$i];
}
// 신택스하이라이트 처리 끝

// 임시 치환된 문자를 복원함
$memo=str_replace("my_lt_dla","&amp;lt;",$memo);
$memo=str_replace("my_gt_dla","&amp;gt;",$memo);

</pre>

[bitly]

번호	분류	제목	작성자	작성일	추천	조회
Notice	일반	(공지) 오픈소스 게시판 수정증보판을 사용할 때 기억해야 할 몇가지 특성... [2]		2018/05/01	128	944
12	일반	오픈소스 게시판 수정증보판 1.0.8.1257 배포...		2014/07/30	60	1683
11	일반	오픈소스 게시판 수정증보판 1.0.7.1700 배포...		2014/07/28	67	2183
10	일반	오픈소스 게시판 수정증보판 1.0.6.6 배포...		2014/07/26	89	2207
9	일반	오픈소스 게시판 수정증보판 1.0.5.34 배포...		2014/07/23	95	2518
8	일반	오픈소스 게시판 수정증보판 1.0.4.2 배포...		2014/07/16	77	1478
7	일반	오픈소스 게시판 수정증보판 1.0.3.3 배포...		2014/07/14	87	1748
6	일반	오픈소스 게시판 수정증보판 1.0.2.2 배포...		2014/07/05	72	1416
5	일반	오픈소스 게시판 수정증보판 1.0.1.36 배포...		2014/06/28	82	1357
	질문	혹시 SyntaxHighlighter에서 < 표현하는 방법 아시는 분 계신가요? [2]		2014/06/27	68	3406
3	일반	오픈소스 게시판 수정증보판 1.0.0.0 최초판 배포...		2014/06/26	85	2936
2	일반	오픈소스 게시판 수정증보판을 사용하고 나서 알게 된 버그를 말씀해 주세요...		2014/06/14	87	1940