From 5338723ce2bd6019d77ab8e37409424d67de4ccb Mon Sep 17 00:00:00 2001
From: KNKIM <knkim@digitalship.co.kr>
Date: Thu, 9 Dec 2021 11:51:09 +0900
Subject: [PATCH] =?UTF-8?q?Q&A=20=EC=A0=9C=EB=AA=A9=20=ED=8A=B9=EC=88=98?=
 =?UTF-8?q?=EB=AC=B8=EC=9E=90=EC=B2=98=EB=A6=AC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../com/cmm/filter/HTMLTagFilterRequestWrapper.java            | 3 +++
 src/main/java/nlib/bbs/service/ArticleVO.java                  | 3 +++
 src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp         | 2 +-
 src/main/webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp              | 2 +-
 src/main/webapp/WEB-INF/jsp/nlib/bbs/selectQnaArticle.jsp      | 2 +-
 src/main/webapp/WEB-INF/web.xml                                | 3 +--
 6 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java b/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java
index 6bde4167..23ab172c 100644
--- a/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java
+++ b/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java
@@ -108,6 +108,8 @@ public class HTMLTagFilterRequestWrapper extends HttpServletRequestWrapper {
     }
     
 	private String getSafeParamData(String value) {
+		
+		/*
 		StringBuffer strBuff = new StringBuffer();
 
 		for (int i = 0; i < value.length(); i++) {
@@ -143,6 +145,7 @@ public class HTMLTagFilterRequestWrapper extends HttpServletRequestWrapper {
 		}
 		
 		value = strBuff.toString();
+		*/
 		
 		// SQL INJECTION 취약점 보완 
 		value = value.replaceAll("\\s+[o|O][r|R]\\s+", " o-r ");
diff --git a/src/main/java/nlib/bbs/service/ArticleVO.java b/src/main/java/nlib/bbs/service/ArticleVO.java
index 6e919161..cd8b8cb3 100644
--- a/src/main/java/nlib/bbs/service/ArticleVO.java
+++ b/src/main/java/nlib/bbs/service/ArticleVO.java
@@ -100,6 +100,9 @@ public class ArticleVO extends PagingVO {
 	public String getTitle() {
 		return title;
 	}
+	public String getUnescapeTitle() {
+		return StringEscapeUtils.unescapeHtml(title);
+	}
 	public void setTitle(String title) {
 		this.title = StringUtil.getSafeParamData(title);
 	}
diff --git a/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp b/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp
index 20ef1738..af59fb59 100644
--- a/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp
+++ b/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp
@@ -314,7 +314,7 @@ function fn_downloadFile(attachFileId, fileSn) {
                                             <li class="wt-title fl">
                                                 <div class="w-tit">제목</div>
                                                 <div class="w-form">
-                                                    <input type="text" name="title" id="title" title="제목" value="${searchArticle.title}" size="100" maxlength="200" class="grid-1" placeholder="제목을 입력하세요." required />
+                                                    <input type="text" name="title" id="title" title="제목" value="${searchArticle.unescapeTitle}" size="100" maxlength="200" class="grid-1" placeholder="제목을 입력하세요." required />
                                                 </div>
                                             </li>
                                             <li class="wt-secret fl check">
diff --git a/src/main/webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp b/src/main/webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp
index 25e70d75..9bfb557e 100644
--- a/src/main/webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp
+++ b/src/main/webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp
@@ -152,7 +152,7 @@
                  var li = $('<tr class="tableTrData" />');
                  li.append($('<td />').attr('class', 't-num').html(obj.rno));   
                  li.append($('<td />').attr('class', 't-tit').html("<a href=\"javascript:void(0)\" onclick=\"fn_viewDetail('" + obj.articleId + "','" + obj.secretYn + "','" + obj.myQnaYn + "')\">" +
-                         obj.title + 
+                         obj.unescapeTitle + 
                          (obj.secretYn == "Y" ? '<img src="/images/icon/icon-password.png" alt="자물쇠 아이콘">&nbsp;' : '') +
                          "</a>"));
                  li.append($('<td />').attr('class', 't-writer').html(obj.regNmSec));
diff --git a/src/main/webapp/WEB-INF/jsp/nlib/bbs/selectQnaArticle.jsp b/src/main/webapp/WEB-INF/jsp/nlib/bbs/selectQnaArticle.jsp
index 1da28fa3..ad5203cb 100644
--- a/src/main/webapp/WEB-INF/jsp/nlib/bbs/selectQnaArticle.jsp
+++ b/src/main/webapp/WEB-INF/jsp/nlib/bbs/selectQnaArticle.jsp
@@ -115,7 +115,7 @@ function fn_downloadFile(attachFileId, fileSn) {
                                     <span class="type">
                                     <c:if test='${article.answerYn == "Y"}'><span>답변완료</span></c:if>
                                     </span>
-                                    ${article.title}
+                                    ${article.unescapeTitle}
                                     <span>
                                     <c:if test='${article.secretYn == "Y"}'>
                                     <img src="/images/icon/icon-secret.png" alt="자물쇠 아이콘">
diff --git a/src/main/webapp/WEB-INF/web.xml b/src/main/webapp/WEB-INF/web.xml
index a8a3760b..44335315 100644
--- a/src/main/webapp/WEB-INF/web.xml
+++ b/src/main/webapp/WEB-INF/web.xml
@@ -19,11 +19,10 @@
 		<filter-name>encodingFilter</filter-name>
 		<url-pattern>*.do</url-pattern>
 	</filter-mapping>
-    
 	<filter>
 		<filter-name>HTMLTagFilter</filter-name>
 		<filter-class>egovframework.com.cmm.filter.HTMLTagFilter</filter-class>
-		<!-- <filter-class>egovframework.rte.ptl.mvc.filter.HTMLTagFilter</filter-class> -->
+        <!-- <filter-class>egovframework.rte.ptl.mvc.filter.HTMLTagFilter</filter-class> --> 
 	</filter>
 	<filter-mapping>
 		<filter-name>HTMLTagFilter</filter-name>