check_url_host fix and editor font update

- now can parse `@import` in editorfont add - fix url host check
2024-09-30 03:03:44 +09:00 · 2024-09-30 03:03:44 +09:00 · db14446cb2
commit db14446cb2
parent c2487c0d43
9 changed files with 130 additions and 84 deletions
--- a/AvocadoEdition_Light/_extra_font.php
+++ b/AvocadoEdition_Light/_extra_font.php
@ -12,11 +12,15 @@ while ($row = sql_fetch_array($font_result)) {
  $font_weight = $row['font_weight'];
  $font_style = $row['font_style'];

-  echo "@font-face {\n";
-  echo "  font-family: '{$font_family}';\n";
-  echo "  src: {$font_url};\n";
-  echo "  font-weight: {$font_weight};\n";
-  echo "  font-style: {$font_style};\n";
-  echo "}\n\n";
+  if (strpos($font_url, '@import') !== false) {
+    echo "{$font_url}\n\n";
+  } else {
+    echo "@font-face {\n";
+    echo "  font-family: '{$font_family}';\n";
+    echo "  src: {$font_url};\n";
+    echo "  font-weight: {$font_weight};\n";
+    echo "  font-style: {$font_style};\n";
+    echo "}\n\n";
+  }
 }
 echo "</style>";
--- a/AvocadoEdition_Light/addons/sample/sample.addon.php
+++ b/AvocadoEdition_Light/addons/sample/sample.addon.php
@ -1,3 +1,3 @@
 <?php
-if (!defined("__ADVDIR__"))
+if (!defined("_GNUBOARD_"))
  exit();
--- a/AvocadoEdition_Light/adm/design_form.php
+++ b/AvocadoEdition_Light/adm/design_form.php
@ -139,6 +139,7 @@ $editor_list = [];
              <a href="https://fonts.google.com/" target="_blank">구글 폰트</a>
            </th>
            <td colspan="2">
+              <?php echo help('사이트 폰트 관리는 HTML 에디터 폰트 설정에서도 가능합니다.') ?>
              <?php echo help('사이트에서 사용할 폰트 스타일을 정의해주세요. ex) @font-face {....} or @import url(...);') ?>
              <textarea name="cf_add_fonts"><?= $config['cf_add_fonts'] ?></textarea>
            </td>
--- a/AvocadoEdition_Light/adm/editor_font.php
+++ b/AvocadoEdition_Light/adm/editor_font.php
@ -18,6 +18,12 @@ if (!sql_fetch_array(sql_query("DESC {$g5['font_table']}"))) {
              PRIMARY KEY (font_id)
          ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb3";
  sql_query($sql, false);
+
+  sql_query("INSERT INTO `avo_editor_fonts` 
+              (`font_name`, `font_family`, `font_url`, `font_weight`, `font_style`) 
+              VALUES ('에스코어드림', 'S-CoreDream-3Light', 'url(\'https://cdn.jsdelivr.net/gh/projectnoonnu/noonfonts_six@1.2/S-CoreDream-3Light.woff\') format(\'woff\')', 'normal', 'normal');");
+  sql_query("INSERT INTO `avo_editor_fonts` (`font_name`, `font_family`, `font_url`, `font_weight`, `font_style`) 
+              VALUES ('평창평화체', 'PyeongChangPeace-Light', 'url(\'https://cdn.jsdelivr.net/gh/projectnoonnu/noonfonts_2206-02@1.0/PyeongChangPeace-Light.woff2\') format(\'woff2\')', '300', 'normal');");
 }

 // 목록 출력
@ -28,6 +34,20 @@ $g5['title'] = "에디터 폰트 관리";

 include_once __DIR__ . '/admin.head.php';
 ?>
+<style>
+  th a {
+    display: inline-block;
+    vertical-align: middle;
+    padding: 3px 10px;
+    background: #ecc6c6;
+    color: #fff;
+    margin: 5px 0 0;
+  }
+
+  th a+a {
+    margin-top: 3px;
+  }
+</style>
 <section>
  <h2>폰트 등록</h2>
  <form name="ffontform" method="post" action="./editor_font_update.php" onsubmit="return ffontform_submit(this);">
@ -48,16 +68,24 @@ include_once __DIR__ . '/admin.head.php';
                size="50"></td>
          </tr>
          <tr>
-            <th scope="row"><label for="font_css">@font-face CSS<strong class="sound_only">필수</strong></label></th>
+            <th scope="row"><label for="font_css">@font-face CSS 또는 @import URL<strong class="sound_only">필수</strong>
+                <a href="https://noonnu.cc/index" target="_blank">눈누 폰트</a>
+                <a href="https://fonts.google.com/" target="_blank">구글 폰트</a>
+              </label></th>
            <td>
-              <span class="frm_info">@font-face CSS를 그대로 붙여넣으세요.</span>
+              <span class="frm_info">@font-face CSS를 그대로 붙여넣거나, Google Fonts의 @import URL을 입력하세요.</span>
+              <span class="frm_info"><strong>구글 폰트의 경우 여러 폰트가 한번에 선택되지 않도록 주의해 주시기 바랍니다.</strong></span>
              <textarea name="font_css" id="font_css" rows="8" required class="required frm_input" style="width:100%;"
                placeholder="@font-face {
  font-family: 'FontName';
  src: url('https://example.com/font.woff2') format('woff2');
  font-weight: normal;
  font-style: normal;
-}"></textarea>
+}
+
+또는
+
+@import url('https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap');"></textarea>
            </td>
          </tr>
        </tbody>
@ -122,7 +150,7 @@ include_once __DIR__ . '/admin.head.php';
 <script>
  function ffontform_submit(f) {
    if (f.font_css.value.trim() === "") {
-      alert("@font-face CSS를 입력해주세요.");
+      alert("@font-face CSS 또는 @import URL을 입력해주세요.");
      f.font_css.focus();
      return false;
    }
--- a/AvocadoEdition_Light/adm/editor_font_update.php
+++ b/AvocadoEdition_Light/adm/editor_font_update.php
@ -8,7 +8,7 @@ if ($is_admin != 'super') {
 $w = isset($_POST['w']) ? $_POST['w'] : (isset($_GET['w']) ? $_GET['w'] : '');

 if ($w == 'd') {
-  $font_id = isset($_POST['font_id']) ? intval($_POST['font_id']) : isset($_GET['font_id']) ? intval($_GET['font_id']) : 0;
+  $font_id = isset($_POST['font_id']) ? intval($_POST['font_id']) : (isset($_GET['font_id']) ? intval($_GET['font_id']) : 0);
  if (!$font_id) {
    alert('올바른 요청이 아닙니다.');
  }
@ -19,31 +19,54 @@ if ($w == '') {
  $font_name = isset($_POST['font_name']) ? clean_xss_tags(trim($_POST['font_name'])) : '';

  if (empty($font_css) || empty($font_name)) {
-    alert('@font-face CSS와 폰트 이름은 필수 입력 항목입니다.');
+    alert('@font-face CSS 또는 @import URL과 폰트 이름은 필수 입력 항목입니다.');
  }
-  
-  preg_match("/font-family:\s*['\"](.*?)['\"]/i", $font_css, $family_matches);
-  preg_match("/src:\s*(.*?);/i", $font_css, $src_matches);
-  preg_match("/font-weight:\s*(.*?);/i", $font_css, $weight_matches);
-  preg_match("/font-style:\s*(.*?);/i", $font_css, $style_matches);

-  $font_family = isset($family_matches[1]) ? clean_xss_tags(trim($family_matches[1])) : '';
-  $font_url = isset($src_matches[1]) ? addslashes(trim($src_matches[1])) : '';
-  $font_weight = isset($weight_matches[1]) ? clean_xss_tags(trim($weight_matches[1])) : 'normal';
-  $font_style = isset($style_matches[1]) ? clean_xss_tags(trim($style_matches[1])) : 'normal';
+  if (strpos($font_css, '@import') !== false) {
+    if (!preg_match('/@import\s+url\([\'"](.+?)[\'"]\)\s*;/', $font_css, $import_matches)) {
+      alert('@import URL을 추출할 수 없습니다.');
+    }
+    
+    $import_url = $import_matches[1];
+    $font_url = '@import url(\'' . $import_url . '\');';
+    
+    $google_css = @file_get_contents($import_url);
+    
+    if ($google_css === false) {
+      alert('Google Fonts에서 CSS를 가져올 수 없습니다.');
+    }
+    
+    if (!preg_match("/font-family:\s*'(.*?)'/i", $google_css, $family_matches)) {
+      alert('Google Fonts CSS에서 font-family를 추출할 수 없습니다.');
+    }
+    
+    $font_url = addslashes($font_url);
+    $font_family = clean_xss_tags(trim($family_matches[1]));
+    $font_weight = 'normal';
+    $font_style = 'normal';
+  } else {
+    // handle @font-face CSS
+    preg_match("/font-family:\s*['\"](.*?)['\"]/i", $font_css, $family_matches);
+    preg_match("/src:\s*(.*?);/i", $font_css, $src_matches);
+    preg_match("/font-weight:\s*(.*?);/i", $font_css, $weight_matches);
+    preg_match("/font-style:\s*(.*?);/i", $font_css, $style_matches);
+
+    $font_family = isset($family_matches[1]) ? clean_xss_tags(trim($family_matches[1])) : '';
+    $font_url = isset($src_matches[1]) ? addslashes(trim($src_matches[1])) : '';
+    $font_weight = isset($weight_matches[1]) ? clean_xss_tags(trim($weight_matches[1])) : 'normal';
+    $font_style = isset($style_matches[1]) ? clean_xss_tags(trim($style_matches[1])) : 'normal';
+  }

  if (empty($font_family) || empty($font_url)) {
    alert('CSS에서 font-family와 src를 추출할 수 없습니다.');
  }
-  
-  $sql = "INSERT INTO {$g5['font_table']} SET font_name = '{$font_name}',
-                font_family = '{$font_family}',
-                font_url = '{$font_url}',
-                font_weight = '{$font_weight}',
-                font_style = '{$font_style}'";
-  sql_query($sql);

-  $sql_error = sql_error_info();
+  $sql = "INSERT INTO {$g5['font_table']} SET font_name = '{$font_name}',
+            font_family = '{$font_family}',
+            font_url = '{$font_url}',
+            font_weight = '{$font_weight}',
+            font_style = '{$font_style}'";
+  sql_query($sql);

  $msg = '폰트가 추가되었습니다.';

@ -58,4 +81,4 @@ if ($msg) {
  alert($msg);
 }

-goto_url('./editor_font.php');
+goto_url(clean_relative_paths('./editor_font.php'));
--- a/AvocadoEdition_Light/adm/site_config_form.php
+++ b/AvocadoEdition_Light/adm/site_config_form.php
@ -274,14 +274,6 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
              <input type="text" name="cf_site_descript" value="<?php echo $config['cf_site_descript'] ?>" size="50" />
            </td>
          </tr>
-          <tr>
-            <th>접속설정</th>
-            <td colspan="3">
-              <?php echo help('로그인이 제대로 안된다거나 화면이 안나오다 나올때 설정하세요') ?>
-              <input type="checkbox" name="cf_use_http" value="1" id="cf_use_http" <?php echo $config['cf_use_http'] ? 'checked' : ''; ?>>
-              <label for="cf_use_http">http://로 고정하기</label>
-            </td>
-          </tr>
          <tr>
            <th>파비콘</th>
            <td colspan="3">
@ -334,6 +326,14 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
                style="height:100px;"><?php echo $config['cf_intercept_ip'] ?></textarea>
            </td>
          </tr>
+          <tr>
+            <th>접속설정</th>
+            <td colspan="3">
+              <?php echo help('로그인이 제대로 안된다거나 화면이 안나오다 나올때 설정하세요') ?>
+              <input type="checkbox" name="cf_use_http" value="1" id="cf_use_http" <?php echo $config['cf_use_http'] ? 'checked' : ''; ?>>
+              <label for="cf_use_http">http://로 고정하기</label>
+            </td>
+          </tr>
        </tbody>
      </table>
    </div>
@ -420,4 +420,3 @@ if ($config['cf_sms_use'] && $config['cf_icode_id'] && $config['cf_icode_pw']) {
 </script>
 <?php
 include_once "./admin.tail.php";
-?>
--- a/AvocadoEdition_Light/common.php
+++ b/AvocadoEdition_Light/common.php
@ -368,13 +368,11 @@ if (file_exists($dbconfig_file)) {
 } else {
  ?><!doctype html>
  <html lang="ko">
-
  <head>
    <meta charset="utf-8">
    <title>오류! <?php echo G5_VERSION ?> 설치하기</title>
    <link rel="stylesheet" href="install/install.css">
  </head>
-
  <body>
    <div id="ins_bar">
      <span id="bar_img">AVOCADO EDITION</span>
@ -396,8 +394,7 @@ if (file_exists($dbconfig_file)) {
      <p>GPL! OPEN SOURCE GNUBOARD</p>
    </div>
  </body>
-
-  </html><?php
+</html><?php
  exit;
 }

@ -411,49 +408,41 @@ if (strstr($url, 'adm')) {
 if (!defined('G5_IS_ADMIN')) {
  $cssconfig_file = G5_DATA_PATH . '/css/_design.config.css';
  if (!file_exists($cssconfig_file)) {
-    ?>
-
-    <!doctype html>
-    <html lang="ko">
-
-    <head>
-      <meta charset="utf-8">
-      <title>오류! <?php echo G5_VERSION ?> 설치하기</title>
-      <link rel="stylesheet" href="<?= G5_URL ?>/install/install.css">
-    </head>
-
-    <body>
-      <div id="ins_bar">
-        <span id="bar_img">AVOCADO EDITION</span>
-        <span id="bar_txt">Message</span>
+    ?><!doctype html>
+  <html lang="ko">
+  <head>
+    <meta charset="utf-8">
+    <title>오류! <?php echo G5_VERSION ?> 설치하기</title>
+    <link rel="stylesheet" href="<?= G5_URL ?>/install/install.css">
+  </head>
+  <body>
+    <div id="ins_bar">
+      <span id="bar_img">AVOCADO EDITION</span>
+      <span id="bar_txt">Message</span>
+    </div>
+    <h1>아보카도 에디션 설정을 완료해주십시오.</h1>
+    <br />
+    <div class="ins_inner">
+      <p>아보카도 에디션 라이트 설치가 완료 되었습니다.</p>
+      <p>하지만, 아보카도 에디션의 디자인 설정이 완료되지 않았습니다.</p>
+      <p>사이트 관리 화면에서 디자인 설정을 완료하여 주시길 바랍니다. (최소 1번 이상 저장 필요)</p>
+      <div class="inner_btn">
+        <a href="<?php echo G5_URL; ?>/adm/"><?php echo G5_VERSION ?> 관리자 바로가기</a>
      </div>
-      <h1>아보카도 에디션 설정을 완료해주십시오.</h1>
-      <br />
-      <div class="ins_inner">
-        <p>아보카도 에디션 라이트 설치가 완료 되었습니다.</p>
-        <p>하지만, 아보카도 에디션의 디자인 설정이 완료되지 않았습니다.</p>
-        <p>사이트 관리 화면에서 디자인 설정을 완료하여 주시길 바랍니다. (최소 1번 이상 저장 필요)</p>
-
-        <div class="inner_btn">
-          <a href="<?php echo G5_URL; ?>/adm/"><?php echo G5_VERSION ?> 관리자 바로가기</a>
-        </div>
-      </div>
-      <div id="ins_ft">
-        <strong>AVOCADO EDITION : AMBER</strong>
-        <p>GPL! OPEN SOURCE GNUBOARD</p>
-      </div>
-
-    </body>
-
-    </html>
-    <?php exit;
+    </div>
+    <div id="ins_ft">
+      <strong>AVOCADO EDITION : AMBER</strong>
+      <p>GPL! OPEN SOURCE GNUBOARD</p>
+    </div>
+  </body>
+</html><?php exit;
  }
 }

 //==============================================================================
 // SESSION 설정
 //------------------------------------------------------------------------------
-@ini_set("session.use_trans_sid", 0);    // PHPSESSID를 자동으로 넘기지 않음
+@ini_set("session.use_trans_sid", 0); // PHPSESSID를 자동으로 넘기지 않음
@ini_set("url_rewriter.tags", ""); // 링크에 PHPSESSID가 따라다니는것을 무력화함 (해뜰녘님께서 알려주셨습니다.)

 session_save_path(G5_SESSION_PATH);
--- a/AvocadoEdition_Light/config.php
+++ b/AvocadoEdition_Light/config.php
@ -112,7 +112,6 @@ define('G5_SYNDI_PATH', G5_PLUGIN_PATH . '/' . G5_SYNDI_DIR);
 define('G5_PHPMAILER_PATH', G5_PLUGIN_PATH . '/' . G5_PHPMAILER_DIR);
 //==============================================================================

-
 //==============================================================================
 // 사용기기 설정
 // pc 설정 시 모바일 기기에서도 PC화면 보여짐
--- a/AvocadoEdition_Light/lib/common.lib.php
+++ b/AvocadoEdition_Light/lib/common.lib.php
@ -3294,17 +3294,20 @@ function check_url_host($url, $msg = '', $return_url = G5_URL, $is_redirect = fa
    return;
  }

-  if (preg_match('#\\\0#', $url)) {
+  if (preg_match('#\\\0#', $url) || preg_match('/^\/{1,}\\\/', $url)) {
    alert('url 에 올바르지 않은 값이 포함되어 있습니다.');
  }

  // remove consecutive slashes
  $patterns = ['/\/{2,}/', '/\\@/'];
-  $replacements = ['/', ''];
+  $replacements = ['//', ''];
+  
  while (($replace_url = preg_replace($patterns, $replacements, urldecode($url))) != $url) {
    $url = $replace_url;
  }

+  $msg = $url . "<br>" . (G5_DOMAIN ?: G5_HTTPS_DOMAIN ?: $_SERVER['HTTP_HOST']);
+
  $p = @parse_url(trim($url));
  // ref: https://github.com/gnuboard/gnuboard5/issues/261
  $host = preg_replace('/:[0-9]+$/', '', G5_DOMAIN ?: G5_HTTPS_DOMAIN ?: $_SERVER['HTTP_HOST']);
@ -3349,7 +3352,7 @@ function check_url_host($url, $msg = '', $return_url = G5_URL, $is_redirect = fa
  if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host']) || $is_host_check) {
    if (run_replace('check_same_url_host', ($p['host'] != $host) || $is_host_check, $p, $host, $is_host_check, $return_url, $is_redirect)) {
      echo "<script>
-  alert('url에 타 도메인을 지정할 수 없습니다.');
+  alert('{$msg}');
  document.location.href = '{$return_url}';
 </script>
 <noscript>