From 858579aa08cc6a6d9539f364077691a4ff3cc432 Mon Sep 17 00:00:00 2001
From: Arcturus <github@drk.st>
Date: Sat, 5 Oct 2024 05:49:06 +0900
Subject: [PATCH] patch secure:
 https://github.com/gnuboard/gnuboard5/commit/fe03163cce08287d0ea5a2eab95d506180a2aee2

---
 AvocadoEdition_Light/bbs/search.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AvocadoEdition_Light/bbs/search.php b/AvocadoEdition_Light/bbs/search.php
index 4ff0056..76cf2bf 100644
--- a/AvocadoEdition_Light/bbs/search.php
+++ b/AvocadoEdition_Light/bbs/search.php
@@ -27,7 +27,7 @@ if ($stx) {
   $sql = " select gr_id, bo_table, bo_read_level from {$g5['board_table']} where bo_use_search = 1 and bo_list_level <= '{$member['mb_level']}' ";
   if ($gr_id)
     $sql .= " and gr_id = '{$gr_id}' ";
-  $onetable = isset($onetable) ? $onetable : "";
+  $onetable = isset($onetable) ? preg_replace('/[^a-z0-9_]/i', '', $onetable) : '';
   if ($onetable) // 하나의 게시판만 검색한다면
     $sql .= " and bo_table = '{$onetable}' ";
   $sql .= " order by bo_order, gr_id, bo_table ";