diff --git a/AvocadoEdition_Light/adm/admin.lib.php b/AvocadoEdition_Light/adm/admin.lib.php index 0fc36b8..9de1f58 100644 --- a/AvocadoEdition_Light/adm/admin.lib.php +++ b/AvocadoEdition_Light/adm/admin.lib.php @@ -432,7 +432,7 @@ function admin_check_xss_params($params) if (is_array($value)) { admin_check_xss_params($value); - } else if (preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/[onload|onerror]=.*/ius', $value))) { + } else if (preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/(onload|onerror)=.*/ius', $value))) { alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.'); die(); }