웹취약점 마무리 , 상세검색 서지정보 내보내기 title focus

src/main/java/nlib/sch/web/NlibSearchController.java

@@ -90,17 +90,35 @@ public class NlibSearchController extends NlibCommonController {
 	 * @param req
 	 * @return
 	 */
-	@RequestMapping(value = "/search/searchList.do")
+	@RequestMapping(value = {"/search/searchList.do", "/search/searchListCondition.do"} )
 	public String searchList(
 			HttpServletRequest req
 			, Authentication authentication
 			, ModelMap model
 			, @ModelAttribute("searchVO") NlibSearchVO searchVO
   			, HttpServletRequest request
-			, HttpServletResponse res) throws Exception {
+			, HttpServletResponse res
+			, String csrfToken) throws Exception {
 		HttpSession session = request.getSession();
 		String councilCd = (String)session.getAttribute("councilCd");
 		
+		boolean fromMenu = request.getServletPath().contains("/search/searchList.do");
+		
+		if(fromMenu) {
+			String sfield = searchVO.getSfield();
+			String query = searchVO.getQuery();
+			searchVO = new NlibSearchVO();
+			searchVO.setSfield(sfield);
+			searchVO.setQuery(query);
+		}
+		
+		if(!fromMenu && !isValidCsrfToken(request, csrfToken))
+		{
+			model.addAttribute("msg", "잘못된 접근입니다.");
+			model.addAttribute("url","/");
+			return "nlib/cmm/alert";
+		}
+		
 		//검색엔진파라미터로 문화원코드
 		searchVO.setMngOrgCd(councilCd);
 		
@@ -207,6 +225,10 @@ public class NlibSearchController extends NlibCommonController {
 	  		}
 	  		secondClassList.get(i).put("cnt", Integer.toString(count));	  		
 	  	}
+	  	// CSRF 토큰 생성 (2021.12.02 KKN 추가)
+ 		String token = generateCsrfToken(request);
+ 		model.addAttribute("csrfToken", token);
+	 		
 		// 반환 정보 
 	  	model.addAttribute("pageSizeCodes", pageSizeCodes);
 	  	//주제분야
@@ -355,8 +377,6 @@ public class NlibSearchController extends NlibCommonController {
 		// CSRF 토큰 생성 (2021.12.02 KKN 추가)
 		String token = generateCsrfToken(request);
 		model.addAttribute("csrfToken", token);
-		log.debug("searchItemDetail > token=" + token);
-		log.debug("searchItemDetail > session token=" + session.getAttribute(SESSION_CSRF_TOKEN_NAME));
 		
 		model.addAttribute("imageType",imageType);
 		model.addAttribute("imagePath",imagePath);
@@ -453,7 +473,9 @@ public class NlibSearchController extends NlibCommonController {
   		model.addAttribute("firstClassList", codeService.listCodes(Constant.CODE_ID_MASTER_TYPE_DIV_CD));
   	    model.addAttribute("secondClassList", codeService.listCodes(Constant.CODE_ID_DTLS_TYPE_DIV_CD));
   	    
-    	
+  	    // CSRF 토큰 생성 (2021.12.02 KKN 추가)
+  	    String token = generateCsrfToken(request);
+ 		model.addAttribute("csrfToken", token);
         return "nlib/search/getDetailedSearchFormPopup";
 	}
 	

src/main/webapp/WEB-INF/jsp/nlib/collection/searchList.jsp

@@ -220,7 +220,7 @@ function fn_search_article(pageIndex) {
        <input type="hidden" name="collection" id="collection" value="<c:out value='${searchVO.collection}'/>" /> 
         <input type="hidden" id="pageIndex" name="pageIndex" title="페이지번호" value="<c:out value='${searchVO.pageIndex }' />"/> 
         <input type="hidden" id="masterId" name="masterId" value="" /> 
-        
+        <input type="hidden" id="csrfToken" name="csrfToken" value="<c:out value='${csrfToken}'/>" /> 
         <input type="hidden" id="filter_creatYyyy" name="filter_creatYyyy" value="<c:out value='${searchVO.filter_creatYyyy}'/>" />
         
         <input type="hidden"  id="filter_class" name="filter_class" value="<c:out value='${searchVO.filter_class}'/>" />

src/main/webapp/WEB-INF/jsp/nlib/search/getDetailedSearchFormPopup.jsp

@@ -33,6 +33,7 @@
 <c:set var="pageTitle">상세 검색</c:set>
 <script>
 $(document).ready(function() {
+	$("#detailTitle").attr("tabindex", -1).focus();
     // $('.pop-advanced-search').fadeIn();
     // $('html,body').addClass('no-scroll');
 	// 상세검색 팝업 - 문화원정보 선택영역 초기작업 메서드 분리
@@ -370,16 +371,17 @@ function detailSearchSetting(){
 </script>
 
         <div class="pop-wrap">
-            <div class="Title">
+            <div class="Title" title="상세 검색" >
-                <span>상세 검색</span>
+                <span id="detailTitle">상세 검색</span>
                 <span>검색어와, 검색조건들을 통해서 더 정확한 정보를 찾아보세요.</span>
                 <span><a href="javascript:;" class="btn-close-pop" onclick="gfn_closeLayerPopup();"><img src="/images/btn/btn-pop-close.png" alt="닫기"></a></span>
             </div>
-            <form action="/search/searchList.do" method="POST" id="d_referencelistForm" name="d_referencelistForm" class="mCustomScrollbar" data-mcs-theme="dark-2">
+            <form action="/search/searchListCondition.do" method="POST" id="d_referencelistForm" name="d_referencelistForm" class="mCustomScrollbar" data-mcs-theme="dark-2">
                 <input type="hidden" id="d_filter_class" name="filter_class">
                 <input type="hidden" id="d_filter_category" name="filter_category">
                 <input type="hidden" id="d_filter_mylist" name="filter_mylist">
                 <input type="hidden" id="d_filter_creatYyyy" name="filter_creatYyyy" value="">
+                <input type="hidden" id="csrfToken" name="csrfToken" value="${csrfToken}">
                 <div class="scroll-wrap">
                     <fieldset>
                         <legend>상세검색 입력폼</legend>

src/main/webapp/js/nlib.js

@@ -175,7 +175,7 @@ function gfn_showRis(risId){
 	var html="";
 	html+='<div class="pop-serge">';
 	html+='<div class="row Title">';                                                                                          
-	html+='    <h3>서지정보 내보내기<span>(Export)</span></h3>';                                                                      
+	html+='    <h3 id="risTitle">서지정보 내보내기<span>(Export)</span></h3>';                                                                      
 	html+='</div>';                                                                                                           
 	html+='<div class="inner">';                                                                                              
 	html+='    <div class="row Text">';                                                                                       
@@ -209,10 +209,10 @@ function gfn_showRis(risId){
 	html+='</div>';
 	
 	$("#export-data").append(html);
-	gfn_focus("risExport");
+	gfn_focus("risTitle");
 }
 function gfn_focus(obj){
-	$("#"+obj).focus();
+	$("#"+obj).attr("tabindex", -1).focus();
 }
 function gfn_downloadRis(risId){
 	

src/main/webapp/js/search/reference.js

@@ -415,7 +415,7 @@ function fnLabel_reference_detail(){
     }
 }
 function fnFilterSch(){
-	document.referencelistForm.action="/search/searchList.do";
+	document.referencelistForm.action="/search/searchListCondition.do";
     document.referencelistForm.submit();
 }
 

src/main/webapp/js/search/util.js

@@ -44,11 +44,6 @@ util = (function( w, $ ) {
 		}
 		return url.replace( w.location.protocol + '//' + w.location.host, '' );
 	}
-	function downloadFile(form, atchFileId, fileSn) {
-		var varForm = document.forms[form];
-		varForm.action = '/cmm/downloadFile.do?atchFileId='+ atchFileId +'&fileSn='+ fileSn;
-		varForm.submit();
-	}
 	function updateFile(obj) {
 		$(obj).parent().parent().find("input").eq(0).val('U');
 	}
@@ -195,25 +190,6 @@ util = (function( w, $ ) {
 	function isWindowSmall() {
 		return $(window).width() <= 768;
 	}
-	function risDownloadFile(aId, mId, formName) {
-		if (typeof(formName) == 'undefined') formName = 'risDownloadForm' // [include_cmm_popup.jsp] 파일에 선언
-	
-		var varForm = document.forms[formName];
-		if (typeof(varForm.aId) != 'undefined') {
-			varForm.action = '/cmm/risDownloadFile.do';
-			varForm.aId.value = aId;
-			varForm.mId.value = mId;
-		} else {
-			varForm.action = '/cmm/risDownloadFile.do?aId='+aId+'&mId'+mId;
-		}
-				
-		if ( $.cookie('KCCF_E_POP') == 'Y' ){
-			varForm.submit();
-		}else{
-			$('#export-data').show();
-		}
-	
-	}
 	function assetImgUrl(filePath, amsAssetsPath, amsThumbnailPath) {
 		var linkUrl = amsAssetsPath + amsThumbnailPath;
 		var stringVal = util.isNull(filePath);