From 3b3f83461a01dfc6d18ed87832cfe19742fe06cf Mon Sep 17 00:00:00 2001 From: taekyoungc Date: Wed, 24 Jun 2026 18:01:18 +0900 Subject: [PATCH] =?UTF-8?q?feat(security):=20=EB=B9=84=EB=B0=80=EB=B2=88?= =?UTF-8?q?=ED=98=B8=20=EC=A0=95=EC=B1=85=20=EA=B0=95=ED=99=94=20=E2=80=94?= =?UTF-8?q?=208=EC=9E=90+=EC=98=81=EB=AC=B8=C2=B7=EC=88=AB=EC=9E=90=C2=B7?= =?UTF-8?q?=ED=8A=B9=EC=88=98=203=EC=A2=85=20+=20=EC=95=88=EB=82=B4?= =?UTF-8?q?=EB=AC=B8=EA=B5=AC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 회원가입·비밀번호 변경·관리자 회원 등록/수정에 정책 적용 - 정규식 규칙을 배열 형식으로 적용(파이프 파싱 깨짐 → is_unique 등 검증 무력화 버그 수정) - 비밀번호 입력란에 형식 안내문구 추가 Co-Authored-By: Claude Opus 4.8 --- app/Controllers/Admin/PasswordChange.php | 7 ++++--- app/Controllers/Admin/User.php | 8 ++++---- app/Controllers/Auth.php | 7 ++++--- app/Views/admin/password_change/index.php | 1 + app/Views/admin/user/create.php | 1 + app/Views/admin/user/edit.php | 1 + app/Views/auth/register.php | 1 + 7 files changed, 16 insertions(+), 10 deletions(-) diff --git a/app/Controllers/Admin/PasswordChange.php b/app/Controllers/Admin/PasswordChange.php index fee33aa..8b55218 100644 --- a/app/Controllers/Admin/PasswordChange.php +++ b/app/Controllers/Admin/PasswordChange.php @@ -19,14 +19,15 @@ class PasswordChange extends BaseController helper('admin'); $rules = [ 'current_password' => 'required', - 'new_password' => 'required|min_length[4]|max_length[255]', + 'new_password' => ['required', 'min_length[8]', 'max_length[255]', 'regex_match[/^(?=.*[A-Za-z])(?=.*\d)(?=.*[\W_]).+$/]'], 'new_password_confirm' => 'required|matches[new_password]', ]; $messages = [ 'current_password' => ['required' => '현재 비밀번호를 입력해 주세요.'], 'new_password' => [ - 'required' => '새 비밀번호를 입력해 주세요.', - 'min_length' => '비밀번호는 4자 이상이어야 합니다.', + 'required' => '새 비밀번호를 입력해 주세요.', + 'min_length' => '비밀번호는 8자 이상이어야 합니다.', + 'regex_match' => '비밀번호는 영문·숫자·특수문자를 모두 포함해야 합니다.', ], 'new_password_confirm' => [ 'required' => '비밀번호 확인을 입력해 주세요.', diff --git a/app/Controllers/Admin/User.php b/app/Controllers/Admin/User.php index 3e5e450..cb9a502 100644 --- a/app/Controllers/Admin/User.php +++ b/app/Controllers/Admin/User.php @@ -83,13 +83,13 @@ class User extends BaseController { $rules = [ 'mb_id' => 'required|min_length[2]|max_length[50]|is_unique[member.mb_id]', - 'mb_passwd' => 'required|min_length[4]|max_length[255]', + 'mb_passwd' => ['required', 'min_length[8]', 'max_length[255]', 'regex_match[/^(?=.*[A-Za-z])(?=.*\d)(?=.*[\W_]).+$/]'], 'mb_name' => 'required|max_length[50]', 'mb_email' => 'permit_empty|valid_email|max_length[100]', 'mb_phone' => 'permit_empty|max_length[20]', 'mb_level' => 'required', ]; - if (! $this->validate($rules)) { + if (! $this->validate($rules, ['mb_passwd' => ['min_length' => '비밀번호는 8자 이상이어야 합니다.', 'regex_match' => '비밀번호는 영문·숫자·특수문자를 모두 포함해야 합니다.']])) { return redirect()->back()->withInput()->with('errors', $this->validator->getErrors()); } $allowedLevels = array_keys($this->getAssignableLevels()); @@ -154,9 +154,9 @@ class User extends BaseController ]; $passwd = $this->request->getPost('mb_passwd'); if ($passwd !== '') { - $rules['mb_passwd'] = 'min_length[4]|max_length[255]'; + $rules['mb_passwd'] = ['min_length[8]', 'max_length[255]', 'regex_match[/^(?=.*[A-Za-z])(?=.*\d)(?=.*[\W_]).+$/]']; } - if (! $this->validate($rules)) { + if (! $this->validate($rules, ['mb_passwd' => ['min_length' => '비밀번호는 8자 이상이어야 합니다.', 'regex_match' => '비밀번호는 영문·숫자·특수문자를 모두 포함해야 합니다.']])) { return redirect()->back()->withInput()->with('errors', $this->validator->getErrors()); } $allowedLevels = array_keys($this->getAssignableLevels()); diff --git a/app/Controllers/Auth.php b/app/Controllers/Auth.php index 6d24ba1..d34aa3e 100644 --- a/app/Controllers/Auth.php +++ b/app/Controllers/Auth.php @@ -357,7 +357,7 @@ class Auth extends BaseController { $rules = [ 'mb_id' => 'required|min_length[4]|max_length[50]|is_unique[member.mb_id]', - 'mb_passwd' => 'required|min_length[4]|max_length[255]', + 'mb_passwd' => ['required', 'min_length[8]', 'max_length[255]', 'regex_match[/^(?=.*[A-Za-z])(?=.*\d)(?=.*[\W_]).+$/]'], 'mb_passwd_confirm' => 'required|matches[mb_passwd]', 'mb_name' => 'required|max_length[100]', 'mb_email' => 'permit_empty|valid_email|max_length[100]', @@ -374,9 +374,10 @@ class Auth extends BaseController 'is_unique' => '이미 사용 중인 아이디입니다.', ], 'mb_passwd' => [ - 'required' => '비밀번호를 입력해 주세요.', - 'min_length' => '비밀번호는 4자 이상이어야 합니다.', + 'required' => '비밀번호를 입력해 주세요.', + 'min_length' => '비밀번호는 8자 이상이어야 합니다.', 'max_length' => '비밀번호는 255자 이하여야 합니다.', + 'regex_match' => '비밀번호는 영문·숫자·특수문자를 모두 포함해야 합니다.', ], 'mb_passwd_confirm' => [ 'required' => '비밀번호 확인을 입력해 주세요.', diff --git a/app/Views/admin/password_change/index.php b/app/Views/admin/password_change/index.php index 9966717..654d34f 100644 --- a/app/Views/admin/password_change/index.php +++ b/app/Views/admin/password_change/index.php @@ -13,6 +13,7 @@
+

8자 이상, 영문·숫자·특수문자를 모두 포함해야 합니다.

diff --git a/app/Views/admin/user/create.php b/app/Views/admin/user/create.php index 50e4447..d0db6e1 100644 --- a/app/Views/admin/user/create.php +++ b/app/Views/admin/user/create.php @@ -11,6 +11,7 @@
+

8자 이상, 영문·숫자·특수문자를 모두 포함해야 합니다.

diff --git a/app/Views/admin/user/edit.php b/app/Views/admin/user/edit.php index 1b7df0b..fbb46bd 100644 --- a/app/Views/admin/user/edit.php +++ b/app/Views/admin/user/edit.php @@ -24,6 +24,7 @@ $editLoginLocked = $editLockUntil !== null && $editLockUntil !== '' && strtotime
+

변경 시 8자 이상, 영문·숫자·특수문자를 모두 포함해야 합니다.

diff --git a/app/Views/auth/register.php b/app/Views/auth/register.php index 7c6ca94..6f993c6 100644 --- a/app/Views/auth/register.php +++ b/app/Views/auth/register.php @@ -13,6 +13,7 @@
+

8자 이상, 영문·숫자·특수문자를 모두 포함해야 합니다.