영카트 5.0.1 보안패치 이후 개인결제 오류와 주문서 XSS 관련 코드가 추가되었습니다.
수정 내역은 아래와 같습니다.


XSS 관련 대응 get_text 함수 처리 추가
/adm/shop_admin/orderlist.php
-        <td headers="th_odrertel" class="td_tel"><?php echo $row['od_tel']; ?></td>
-        <td headers="th_recvr" class="td_name"><a href="<?php echo $_SERVER['PHP_SELF']; ?>?sort1=<?php echo $sort1; ?>&amp;sort2=<?php echo $sort2; ?>&amp;sel_field=od_b_name&amp;search=<?php echo $row['od_b_
+        <td headers="th_odrertel" class="td_tel"><?php echo get_text($row['od_tel']); ?></td>
+        <td headers="th_recvr" class="td_name"><a href="<?php echo $_SERVER['PHP_SELF']; ?>?sort1=<?php echo $sort1; ?>&amp;sort2=<?php echo $sort2; ?>&amp;sel_field=od_b_name&amp;search=<?php echo get_text($r

/adm/shop_admin/orderprintresult.php
-        $od_memo = ($row1['od_memo']) ? stripslashes($row1['od_memo']) : '';
-        $od_shop_memo = ($row1['od_shop_memo']) ? stripslashes($row1['od_shop_memo']) : '';
+        $od_memo = ($row1['od_memo']) ? get_text(stripslashes($row1['od_memo'])) : '';
+        $od_shop_memo = ($row1['od_shop_memo']) ? get_text(stripslashes($row1['od_shop_memo'])) : '';

-        <h3>보내는 사람 : <?php echo $row1['od_name']; ?></h3>
+        <h3>보내는 사람 : <?php echo get_text($row1['od_name']); ?></h3>
 
-            <dd><?php echo $row1['od_addr']; ?></dd>
+            <dd><?php echo get_text($row1['od_addr']); ?></dd>

-            <dd><?php echo $row1['od_hp']; ?></dd>
+            <dd><?php echo get_text($row1['od_hp']); ?></dd>

-            <dd><?php echo $row1['od_tel']; ?></dd>
+            <dd><?php echo get_text($row1['od_tel']); ?></dd>

-        <h3>받는 사람 : <?php echo $row1['od_b_name']; ?></h3>
+        <h3>받는 사람 : <?php echo get_text($row1['od_b_name']); ?></h3>

-            <dd><?php echo $row1['od_b_addr']; ?></dd>
+            <dd><?php echo get_text($row1['od_b_addr']); ?></dd>

-            <dd><?php echo $row1['od_b_hp']; ?></dd>
+            <dd><?php echo get_text($row1['od_b_hp']); ?></dd>

-            <dd><?php echo $row1['od_b_tel']; ?></dd>
+            <dd><?php echo get_text($row1['od_b_tel']); ?></dd>

/mobile/shop/orderformupdate.php
 $od_pg = $default['de_pg_service'];
+$od_email = get_email_address($od_email);
 
/mobile/shop/orderinquiryview.php
-                    <td><?php echo $od['od_deposit_name']; ?></td>
+                    <td><?php echo get_text($od['od_deposit_name']); ?></td>

-                    <td><?php echo $od['od_bank_account']; ?></td>
+                    <td><?php echo get_text($od['od_bank_account']); ?></td>

-                    <td><?php echo $od['od_name']; ?></td>
+                    <td><?php echo get_text($od['od_name']); ?></td>

-                    <td><?php echo $od['od_tel']; ?></td>
+                    <td><?php echo get_text($od['od_tel']); ?></td>

-                    <td><?php echo $od['od_hp']; ?></td>
+                    <td><?php echo get_text($od['od_hp']); ?></td>

-                    <td><?php echo sprintf("(%s-%s)", $od['od_zip1'], $od['od_zip2']).' '.print_address($od['od_addr1'], $od['od_addr2'], $od['od_addr3']); ?></td>
+                    <td><?php echo get_text(sprintf("(%s-%s)", $od['od_zip1'], $od['od_zip2']).' '.print_address($od['od_addr1'], $od['od_addr2'], $od['od_addr3'])); ?></td>

-                    <td><?php echo $od['od_email']; ?></td>
+                    <td><?php echo get_text($od['od_email']); ?></td>

-                    <td><?php echo $od['od_b_name']; ?></td>
+                    <td><?php echo get_text($od['od_b_name']); ?></td>

-                    <td><?php echo $od['od_b_tel']; ?></td>
+                    <td><?php echo get_text($od['od_b_tel']); ?></td>

-                    <td><?php echo $od['od_b_hp']; ?></td>
+                    <td><?php echo get_text($od['od_b_hp']); ?></td>

-                    <td><?php echo sprintf("(%s-%s)", $od['od_b_zip1'], $od['od_b_zip2']).' '.print_address($od['od_b_addr1'], $od['od_b_addr2'], $od['od_b_addr3']); ?></td>
+                    <td><?php echo get_text(sprintf("(%s-%s)", $od['od_b_zip1'], $od['od_b_zip2']).' '.print_address($od['od_b_addr1'], $od['od_b_addr2'], $od['od_b_addr3'])); ?></td>

/mobile/shop/personalpayresult.php
-                    <td><?php echo $pp['pp_deposit_name']; ?></td>
+                    <td><?php echo get_text($pp['pp_deposit_name']); ?></td>

-                    <td><?php echo $pp['pp_bank_account']; ?></td>
+                    <td><?php echo get_text($pp['pp_bank_account']); ?></td>

/shop/orderform.php
-// LG Xpay 전자결제를 사용할 때만 실행
+// 전자결제를 사용할 때만 실행

/shop/orderformupdate.php
 $od_pg = $default['de_pg_service'];
+$od_email = get_email_address($od_email);
 
/shop/orderinquiryview.php
-                    <td><?php echo $od['od_deposit_name']; ?></td>
+                    <td><?php echo get_text($od['od_deposit_name']); ?></td>

-                    <td><?php echo $od['od_bank_account']; ?></td>
+                    <td><?php echo get_text($od['od_bank_account']); ?></td>

-                    <td><?php echo $od['od_name']; ?></td>
+                    <td><?php echo get_text($od['od_name']); ?></td>

-                    <td><?php echo $od['od_tel']; ?></td>
+                    <td><?php echo get_text($od['od_tel']); ?></td>

-                    <td><?php echo $od['od_hp']; ?></td>
+                    <td><?php echo get_text($od['od_hp']); ?></td>

-                    <td><?php echo sprintf("(%s-%s)", $od['od_zip1'], $od['od_zip2']).' '.print_address($od['od_addr1'], $od['od_addr2'], $od['od_addr3']); ?></td>
+                    <td><?php echo get_text(sprintf("(%s-%s)", $od['od_zip1'], $od['od_zip2']).' '.print_address($od['od_addr1'], $od['od_addr2'], $od['od_addr3'])); ?></td>

-                    <td><?php echo $od['od_email']; ?></td>
+                    <td><?php echo get_text($od['od_email']); ?></td>

-                    <td><?php echo $od['od_b_name']; ?></td>
+                    <td><?php echo get_text($od['od_b_name']); ?></td>

-                    <td><?php echo $od['od_b_tel']; ?></td>
+                    <td><?php echo get_text($od['od_b_tel']); ?></td>

-                    <td><?php echo $od['od_b_hp']; ?></td>
+                    <td><?php echo get_text($od['od_b_hp']); ?></td>

-                    <td><?php echo sprintf("(%s-%s)", $od['od_b_zip1'], $od['od_b_zip2']).' '.print_address($od['od_b_addr1'], $od['od_b_addr2'], $od['od_b_addr3']); ?></td>
+                    <td><?php echo get_text(sprintf("(%s-%s)", $od['od_b_zip1'], $od['od_b_zip2']).' '.print_address($od['od_b_addr1'], $od['od_b_addr2'], $od['od_b_addr3'])); ?></td>

/shop/personalpayresult.php
-                    <td><?php echo $pp['pp_deposit_name']; ?></td>
+                    <td><?php echo get_text($pp['pp_deposit_name']); ?></td>

-                    <td><?php echo $pp['pp_bank_account']; ?></td>
+                    <td><?php echo get_text($pp['pp_bank_account']); ?></td>


개인결제 kcp 결제모듈 스크립트 수정
/shop/personalpayform.php
 $g5['title'] = $pp['pp_name'].'님 개인결제';
-if($default['de_pg_service'] == 'lg') {
-    $g5['body_script'] = 'onload="isActiveXOK();"';
+
+// 전자결제를 사용할 때만 실행
+if($default['de_iche_use'] || $default['de_vbank_use'] || $default['de_hp_use'] || $default['de_card_use']) {
+    switch($default['de_pg_service']) {
+        case 'lg':
+            $g5['body_script'] = 'onload="isActiveXOK();"';
+            break;
+        default:
+            $g5['body_script'] = 'onload="CheckPayplusInstall();"';
+            break;
+    }
 }
+
 include_once('./_head.php');


LG유플러스로 명칭 변경
/adm/shop_admin/orderform.php
-                                    $pg_test = 'LG eCredit';
+                                    $pg_test = 'LG유플러스';


관리자 재입고알림 SMS 버튼 class 제거
/adm/shop_admin/itemstocksms.php
-    <input type="submit" name="act_button" value="선택삭제" class="btn_submit" onclick="document.pressed=this.value">
+    <input type="submit" name="act_button" value="선택삭제" onclick="document.pressed=this.value">