{"action":"opened","number":1461,"pull_request":{"url":"https://api.github.com/repos/xpressengine/xe-core/pulls/1461","id":34784782,"html_url":"https://github.com/xpressengine/xe-core/pull/1461","diff_url":"https://github.com/xpressengine/xe-core/pull/1461.diff","patch_url":"https://github.com/xpressengine/xe-core/pull/1461.patch","issue_url":"https://api.github.com/repos/xpressengine/xe-core/issues/1461","number":1461,"state":"open","locked":false,"title":"회원가입 및 정보수정시 필터링 강화","user":{"login":"kijin","id":164058,"avatar_url":"https://avatars.githubusercontent.com/u/164058?v=3","gravatar_id":"","url":"https://api.github.com/users/kijin","html_url":"https://github.com/kijin","followers_url":"https://api.github.com/users/kijin/followers","following_url":"https://api.github.com/users/kijin/following{/other_user}","gists_url":"https://api.github.com/users/kijin/gists{/gist_id}","starred_url":"https://api.github.com/users/kijin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kijin/subscriptions","organizations_url":"https://api.github.com/users/kijin/orgs","repos_url":"https://api.github.com/users/kijin/repos","events_url":"https://api.github.com/users/kijin/events{/privacy}","received_events_url":"https://api.github.com/users/kijin/received_events","type":"User","site_admin":false},"body":"회원가입(`insertMember`) 및 정보수정(`updateMember`)시 아이디, 이름, 닉네임 등의 필터링에 일관성이 없어서 태그를 입력하거나 고의로 닉네임 중복을 일으킬 수 있는 문제가 있습니다.\r\n\r\n1. DB에 저장할 때는 태그를 필터링하지만, 중복 여부를 체크할 때는 필터링하기 전의 변수값을 비교합니다. 그래서 `<`, `>`, `&` 등의 특수문자를 잘 활용하면 중복체크를 우회할 수 있습니다.\r\n\r\n2. 아이디와 닉네임에는 공백이 허용되지 않지만, 유니코드의 다양한 공백 문자 및 컨트롤 문자들을 모두 필터링하지 못하므로 공백을 사용한 닉네임 중복이 가능합니다. (며칠 전 공홈에서 이런 일이 있었죠.)\r\n\r\n3. 회원정보 수정시에는 금지된 ID 및 중복 ID 체크가 이루어지지 않습니다. ID는 변경할 수 없다고 가정하는 모양인데, 이걸 우회하는 것도 어렵지 않더군요. 관리자가 직접 회원정보를 수정하다가 실수로 중복을 일으키는 경우도 있겠고요.\r\n\r\n4. 모든 변수에 완벽하게 `htmlspecialchars()` 적용이 되지 않아서 일부 회원정보를 이용한 태그 삽입이 가능합니다. 엄격한 길이 제한 때문에 당장 XSS 취약점으로 이어지지는 않으나, 회원들이 멋대로 자기 닉네임을 **진하게** 표시하는 등 귀찮은 일이 생길 수 있습니다.\r\n\r\n이 PR에서는 위와 같은 문제들을 해결하고, 앞으로의 유지관리 편의를 위해 관련 루틴들의 코딩 스타일을 XE 코딩규칙에 맞게 다소 손보았습니다. `if`문이 어디서 끝나는지 한 눈에 알기 어려운 곳이 꽤 많더라고요.","created_at":"2015-05-06T02:27:14Z","updated_at":"2015-05-06T02:27:14Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/xpressengine/xe-core/pulls/1461/commits","review_comments_url":"https://api.github.com/repos/xpressengine/xe-core/pulls/1461/comments","review_comment_url":"https://api.github.com/repos/xpressengine/xe-core/pulls/comments{/number}","comments_url":"https://api.github.com/repos/xpressengine/xe-core/issues/1461/comments","statuses_url":"https://api.github.com/repos/xpressengine/xe-core/statuses/115cf95ac725871b560f2695411f979d04b6ddba","head":{"label":"kijin:fix/nickname-filter","ref":"fix/nickname-filter","sha":"115cf95ac725871b560f2695411f979d04b6ddba","user":{"login":"kijin","id":164058,"avatar_url":"https://avatars.githubusercontent.com/u/164058?v=3","gravatar_id":"","url":"https://api.github.com/users/kijin","html_url":"https://github.com/kijin","followers_url":"https://api.github.com/users/kijin/followers","following_url":"https://api.github.com/users/kijin/following{/other_user}","gists_url":"https://api.github.com/users/kijin/gists{/gist_id}","starred_url":"https://api.github.com/users/kijin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kijin/subscriptions","organizations_url":"https://api.github.com/users/kijin/orgs","repos_url":"https://api.github.com/users/kijin/repos","events_url":"https://api.github.com/users/kijin/events{/privacy}","received_events_url":"https://api.github.com/users/kijin/received_events","type":"User","site_admin":false},"repo":{"id":22745446,"name":"xe-core","full_name":"kijin/xe-core","owner":{"login":"kijin","id":164058,"avatar_url":"https://avatars.githubusercontent.com/u/164058?v=3","gravatar_id":"","url":"https://api.github.com/users/kijin","html_url":"https://github.com/kijin","followers_url":"https://api.github.com/users/kijin/followers","following_url":"https://api.github.com/users/kijin/following{/other_user}","gists_url":"https://api.github.com/users/kijin/gists{/gist_id}","starred_url":"https://api.github.com/users/kijin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kijin/subscriptions","organizations_url":"https://api.github.com/users/kijin/orgs","repos_url":"https://api.github.com/users/kijin/repos","events_url":"https://api.github.com/users/kijin/events{/privacy}","received_events_url":"https://api.github.com/users/kijin/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/kijin/xe-core","description":"PHP Open Source CMS","fork":true,"url":"https://api.github.com/repos/kijin/xe-core","forks_url":"https://api.github.com/repos/kijin/xe-core/forks","keys_url":"https://api.github.com/repos/kijin/xe-core/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kijin/xe-core/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kijin/xe-core/teams","hooks_url":"https://api.github.com/repos/kijin/xe-core/hooks","issue_events_url":"https://api.github.com/repos/kijin/xe-core/issues/events{/number}","events_url":"https://api.github.com/repos/kijin/xe-core/events","assignees_url":"https://api.github.com/repos/kijin/xe-core/assignees{/user}","branches_url":"https://api.github.com/repos/kijin/xe-core/branches{/branch}","tags_url":"https://api.github.com/repos/kijin/xe-core/tags","blobs_url":"https://api.github.com/repos/kijin/xe-core/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kijin/xe-core/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kijin/xe-core/git/refs{/sha}","trees_url":"https://api.github.com/repos/kijin/xe-core/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kijin/xe-core/statuses/{sha}","languages_url":"https://api.github.com/repos/kijin/xe-core/languages","stargazers_url":"https://api.github.com/repos/kijin/xe-core/stargazers","contributors_url":"https://api.github.com/repos/kijin/xe-core/contributors","subscribers_url":"https://api.github.com/repos/kijin/xe-core/subscribers","subscription_url":"https://api.github.com/repos/kijin/xe-core/subscription","commits_url":"https://api.github.com/repos/kijin/xe-core/commits{/sha}","git_commits_url":"https://api.github.com/repos/kijin/xe-core/git/commits{/sha}","comments_url":"https://api.github.com/repos/kijin/xe-core/comments{/number}","issue_comment_url":"https://api.github.com/repos/kijin/xe-core/issues/comments{/number}","contents_url":"https://api.github.com/repos/kijin/xe-core/contents/{+path}","compare_url":"https://api.github.com/repos/kijin/xe-core/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kijin/xe-core/merges","archive_url":"https://api.github.com/repos/kijin/xe-core/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kijin/xe-core/downloads","issues_url":"https://api.github.com/repos/kijin/xe-core/issues{/number}","pulls_url":"https://api.github.com/repos/kijin/xe-core/pulls{/number}","milestones_url":"https://api.github.com/repos/kijin/xe-core/milestones{/number}","notifications_url":"https://api.github.com/repos/kijin/xe-core/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kijin/xe-core/labels{/name}","releases_url":"https://api.github.com/repos/kijin/xe-core/releases{/id}","created_at":"2014-08-08T03:59:00Z","updated_at":"2015-04-18T05:20:02Z","pushed_at":"2015-05-06T02:14:57Z","git_url":"git://github.com/kijin/xe-core.git","ssh_url":"git@github.com:kijin/xe-core.git","clone_url":"https://github.com/kijin/xe-core.git","svn_url":"https://github.com/kijin/xe-core","homepage":"http://www.xpressengine.com","size":79546,"stargazers_count":0,"watchers_count":0,"language":"PHP","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"develop"}},"base":{"label":"xpressengine:develop","ref":"develop","sha":"900bfca57011c74510887ae2633da0cb1e89974f","user":{"login":"xpressengine","id":1429259,"avatar_url":"https://avatars.githubusercontent.com/u/1429259?v=3","gravatar_id":"","url":"https://api.github.com/users/xpressengine","html_url":"https://github.com/xpressengine","followers_url":"https://api.github.com/users/xpressengine/followers","following_url":"https://api.github.com/users/xpressengine/following{/other_user}","gists_url":"https://api.github.com/users/xpressengine/gists{/gist_id}","starred_url":"https://api.github.com/users/xpressengine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xpressengine/subscriptions","organizations_url":"https://api.github.com/users/xpressengine/orgs","repos_url":"https://api.github.com/users/xpressengine/repos","events_url":"https://api.github.com/users/xpressengine/events{/privacy}","received_events_url":"https://api.github.com/users/xpressengine/received_events","type":"Organization","site_admin":false},"repo":{"id":7953576,"name":"xe-core","full_name":"xpressengine/xe-core","owner":{"login":"xpressengine","id":1429259,"avatar_url":"https://avatars.githubusercontent.com/u/1429259?v=3","gravatar_id":"","url":"https://api.github.com/users/xpressengine","html_url":"https://github.com/xpressengine","followers_url":"https://api.github.com/users/xpressengine/followers","following_url":"https://api.github.com/users/xpressengine/following{/other_user}","gists_url":"https://api.github.com/users/xpressengine/gists{/gist_id}","starred_url":"https://api.github.com/users/xpressengine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xpressengine/subscriptions","organizations_url":"https://api.github.com/users/xpressengine/orgs","repos_url":"https://api.github.com/users/xpressengine/repos","events_url":"https://api.github.com/users/xpressengine/events{/privacy}","received_events_url":"https://api.github.com/users/xpressengine/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/xpressengine/xe-core","description":"PHP Open Source CMS","fork":false,"url":"https://api.github.com/repos/xpressengine/xe-core","forks_url":"https://api.github.com/repos/xpressengine/xe-core/forks","keys_url":"https://api.github.com/repos/xpressengine/xe-core/keys{/key_id}","collaborators_url":"https://api.github.com/repos/xpressengine/xe-core/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/xpressengine/xe-core/teams","hooks_url":"https://api.github.com/repos/xpressengine/xe-core/hooks","issue_events_url":"https://api.github.com/repos/xpressengine/xe-core/issues/events{/number}","events_url":"https://api.github.com/repos/xpressengine/xe-core/events","assignees_url":"https://api.github.com/repos/xpressengine/xe-core/assignees{/user}","branches_url":"https://api.github.com/repos/xpressengine/xe-core/branches{/branch}","tags_url":"https://api.github.com/repos/xpressengine/xe-core/tags","blobs_url":"https://api.github.com/repos/xpressengine/xe-core/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/xpressengine/xe-core/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/xpressengine/xe-core/git/refs{/sha}","trees_url":"https://api.github.com/repos/xpressengine/xe-core/git/trees{/sha}","statuses_url":"https://api.github.com/repos/xpressengine/xe-core/statuses/{sha}","languages_url":"https://api.github.com/repos/xpressengine/xe-core/languages","stargazers_url":"https://api.github.com/repos/xpressengine/xe-core/stargazers","contributors_url":"https://api.github.com/repos/xpressengine/xe-core/contributors","subscribers_url":"https://api.github.com/repos/xpressengine/xe-core/subscribers","subscription_url":"https://api.github.com/repos/xpressengine/xe-core/subscription","commits_url":"https://api.github.com/repos/xpressengine/xe-core/commits{/sha}","git_commits_url":"https://api.github.com/repos/xpressengine/xe-core/git/commits{/sha}","comments_url":"https://api.github.com/repos/xpressengine/xe-core/comments{/number}","issue_comment_url":"https://api.github.com/repos/xpressengine/xe-core/issues/comments{/number}","contents_url":"https://api.github.com/repos/xpressengine/xe-core/contents/{+path}","compare_url":"https://api.github.com/repos/xpressengine/xe-core/compare/{base}...{head}","merges_url":"https://api.github.com/repos/xpressengine/xe-core/merges","archive_url":"https://api.github.com/repos/xpressengine/xe-core/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/xpressengine/xe-core/downloads","issues_url":"https://api.github.com/repos/xpressengine/xe-core/issues{/number}","pulls_url":"https://api.github.com/repos/xpressengine/xe-core/pulls{/number}","milestones_url":"https://api.github.com/repos/xpressengine/xe-core/milestones{/number}","notifications_url":"https://api.github.com/repos/xpressengine/xe-core/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/xpressengine/xe-core/labels{/name}","releases_url":"https://api.github.com/repos/xpressengine/xe-core/releases{/id}","created_at":"2013-02-01T07:16:05Z","updated_at":"2015-05-05T13:56:41Z","pushed_at":"2015-05-05T14:01:27Z","git_url":"git://github.com/xpressengine/xe-core.git","ssh_url":"git@github.com:xpressengine/xe-core.git","clone_url":"https://github.com/xpressengine/xe-core.git","svn_url":"https://github.com/xpressengine/xe-core","homepage":"http://www.xpressengine.com","size":103839,"stargazers_count":182,"watchers_count":182,"language":"PHP","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":177,"mirror_url":null,"open_issues_count":275,"forks":177,"open_issues":275,"watchers":182,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/xpressengine/xe-core/pulls/1461"},"html":{"href":"https://github.com/xpressengine/xe-core/pull/1461"},"issue":{"href":"https://api.github.com/repos/xpressengine/xe-core/issues/1461"},"comments":{"href":"https://api.github.com/repos/xpressengine/xe-core/issues/1461/comments"},"review_comments":{"href":"https://api.github.com/repos/xpressengine/xe-core/pulls/1461/comments"},"review_comment":{"href":"https://api.github.com/repos/xpressengine/xe-core/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/xpressengine/xe-core/pulls/1461/commits"},"statuses":{"href":"https://api.github.com/repos/xpressengine/xe-core/statuses/115cf95ac725871b560f2695411f979d04b6ddba"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"commits":7,"additions":76,"deletions":29,"changed_files":1}}