+			<url>https://repo1.maven.org/maven2/</url>

+			<url>https://maven.egovframe.go.kr/maven/</url>

+package egovframework.com.cmm;

+

+import java.util.Enumeration;

+import java.util.regex.Pattern;

+

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+

+import org.springframework.web.servlet.ModelAndView;

+import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

+

+import egovframework.com.cmm.util.EgovXSSUtil;

+

+

+public class InterceptorHandler extends HandlerInterceptorAdapter{

+

+	private static final Pattern SQL_PATTERN = Pattern.compile(

+        "(?i)(select|insert|delete|update|create|drop|alter|where|substr|substring|group by|union|xp_cmdshell|and|or|having|from|unio|case|when|if|--|;|/\\*|\\*/|\\bor\\b|\\band\\b)"

+    );

+	 

+	@Override

+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

+		

+    	/**

+    	 * URL 호출 전 넘어오는 파라미터 체크

+    	 * request로 넘어오는 모든 파라미터 데이터를 검사하여 XSS 문자가 포함되어 있으면 메인화면으로 튕김

+    	 * */

+    	boolean returnSts1 = true;

+    	Enumeration e = request.getParameterNames();

+		while ( e.hasMoreElements() ){

+			String name = (String) e.nextElement();

+			

+			{ //XSS 보안조치

+				if(name.toLowerCase().contains("cmplntreqcn")

+						|| name.toLowerCase().contains("autcn")

+						|| name.toLowerCase().contains("file_0")

+						|| name.toLowerCase().contains("file_1")

+						|| name.toLowerCase().contains("seccn")

+						|| name.toLowerCase().contains("nttcn")

+				) {	

+					String[] values = request.getParameterValues(name);

+					for (String value : values) {

+						

+						boolean returnSts = EgovXSSUtil.cleanXSS(value);

+						if(!returnSts) {//XSS 문자 체크 결과 false일 경우 메인화면으로 이동

+							returnSts1 = returnSts;

+							System.out.println("+++++++++++++++++++++++++++XSS 필터 처리 Filter::: ");

+							System.out.println("name="+ name + ", value="+ value);

+							System.out.println("+++++++++++++++++++++++++++XSS 필터 처리 Filter End::: ");

+							response.sendRedirect(request.getContextPath() + "/");

+						}

+					}

+				}

+			}

+

+			{ //SQL Injection 보안조치

+				if(name.toLowerCase().contains("searchsortcnd")

+						|| name.toLowerCase().contains("searchsortord")

+				) {	

+					

+					//파라미터 중에 URL 주소를 넘겨주는 부분이 있어서 해당 부분에것 select~, update~, delete~ 로 시작하는 주소경로가 있어서 제외처리를 하였음

+					String[] values = request.getParameterValues(name);

+					

+					for (String value : values) {

+						 if (value != null && SQL_PATTERN.matcher(value.toLowerCase()).find()) {

+							System.out.println("+++++++++++++++++++++++++++XSS Html 필터 처리 Filter Start::: ");

+							System.out.println("name="+ name + ", value="+ value);

+							System.out.println("+++++++++++++++++++++++++++XSS Html 필터 처리 Filter End::: ");

+							response.sendRedirect(request.getContextPath() + "/");

+			            }

+					}

+				}

+			}

+		}

+		

+		if(!returnSts1) {//XSS 포함문자가 있는경우 메인화면으로 이동시킨다.

+			response.sendRedirect(request.getContextPath() + "/");

+			return true;

+		}

+    	

+        return true;

+    }

+    

+	/*

+	 * view 화면으로 데이터가 넘어가기 이전에 실행

+	 * modelAndView 값을 체크할 수 있음

+	 * */

+    @Override

+    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {

+        super.postHandle(request, response, handler, modelAndView);

+    }

+    

+    /*

+     * 

+     * view에서 모든 처리를 완료한 후에 실행

+     * */

+    @Override

+    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {

+        super.afterCompletion(request, response, handler, ex);

+    }

+}

+	public static boolean cleanXSS(String str) {

+		

+		String str_low= str.toLowerCase();

+		boolean returnSts = true;

+		if(

+		str_low.contains("javascript")

+		||str_low.contains("eval")

+		||str_low.contains("title")

+		||str_low.contains("onload")

+		||str_low.contains("onmousewheel")

+		||str_low.contains("onactive")

+		||str_low.contains("expression")

+		||str_low.contains("charset")

+		||str_low.contains("ondataavailable")

+		||str_low.contains("oncut")

+		||str_low.contains("applet")

+		||str_low.contains("document")

+		||str_low.contains("onafteripudate")

+		||str_low.contains("onclick")

+		||str_low.contains("meta")

+		||str_low.contains("string")

+		||str_low.contains("onmousedown")

+		||str_low.contains("onchange")

+		||str_low.contains("xml")

+		||str_low.contains("create")

+		||str_low.contains("onbeforeactivate")

+		||str_low.contains("onbeforecut")

+		||str_low.contains("blink")

+		||str_low.contains("append")

+		||str_low.contains("onbeforecopy")

+		||str_low.contains("ondbclick")

+		||str_low.contains("link")

+		||str_low.contains("binding")

+		||str_low.contains("onbeforedeactivate")

+		||str_low.contains("ondeactivate")

+		||str_low.contains("style")

+		||str_low.contains("alert")

+		||str_low.contains("prompt")

+		||str_low.contains("comfire")

+		||str_low.contains("ondrag")

+		||str_low.contains("script")

+		||str_low.contains("msgbox")

+		||str_low.contains("cnbeforeprint")

+		||str_low.contains("embed")

+		||str_low.contains("refresh")

+		||str_low.contains("cnbeforepaste")

+		||str_low.contains("object")

+		||str_low.contains("void")

+		||str_low.contains("iframe")

+		||str_low.contains("cookie")

+		||str_low.contains("ondatasetchaged")

+		||str_low.contains("ondragend")

+		||str_low.contains("ondragenter")

+		||str_low.contains("ondragleave")

+		||str_low.contains("onbeforeeditfocus")

+		||str_low.contains("onbeforeuload") 

+		||str_low.contains("ondragover")

+		||str_low.contains("onerror")

+		)

+		{

+			returnSts = false;

+		}

+		return returnSts;

+	}

+	

+package egovframework.com.cmm.util;

+

+public class FileExtCheckUtil {

+	

+	public static boolean fileExtCheck(String fileExt) {

+		final String[] PERMISSION_FILE_EXT_ARR = {"ZIP", "GIF", "JPEG", "JPG", "PNG", "BMP", "PDF", "HWP", "XLSX", "DOCX", "PPTX"};

+		boolean isPermissionFileExt = false;

+		fileExt = fileExt.toUpperCase();

+		for( int i = 0; i < PERMISSION_FILE_EXT_ARR.length; i++ ) {

+			System.out.println(fileExt + "  :  "+PERMISSION_FILE_EXT_ARR[i]);

+			if( PERMISSION_FILE_EXT_ARR[i].equals(fileExt) ) {

+				isPermissionFileExt = true;

+				break;

+			}

+		}

+		return isPermissionFileExt;

+	}

+}

+import egovframework.com.cmm.util.FileExtCheckUtil;

+import egovframework.com.cmm.util.RedirectUrlMaker;

+						String extension = tempFile.orignlFileNm.substring(tempFile.orignlFileNm.lastIndexOf(".")+1);

+						 

+						if(!FileExtCheckUtil.fileExtCheck(extension)) {

+			        	    	modelAndView.addObject("result", "extension");

+			        	    	return modelAndView;

+						 }

+						 

+		List<String> authorities = EgovUserDetailsHelper.getAuthorities();

+		boolean  adminYN = false;

+		for (String authority : authorities) {

+			if (authority.equals("ROLE_ADMIN")) {

+				 adminYN = true;

+			}

+		}

+		

+

+		if(!adminYN) {

+			if(!sessionLogin.getUniqId().equals(uniqId)) {

+				return "redirect:/";

+			}

+		}

+

+<security:http pattern="/direct/**" security="none"/>

+<?xml version="1.0" encoding="UTF-8"?>

+<beans:beans xmlns="http://www.springframework.org/schema/mvc"

+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

+    xmlns:beans="http://www.springframework.org/schema/beans"

+    xmlns:context="http://www.springframework.org/schema/context"

+    xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd

+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd

+        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

+    

+	<interceptors>

+	    <interceptor>

+	        <mapping path="/uss/**"/>

+	        <mapping path="/cop/**"/>

+	        <beans:bean class="egovframework.com.cmm.InterceptorHandler"/>

+	    </interceptor>

+	</interceptors>

+</beans:beans>(No newline at end of file)

+function fnPeristalsis() {

+    document.peristalsisForm.action = "<c:url value='/let/itsm/sync/syncOrgchtRefresh.do'/>";

+    document.peristalsisForm.submit();

+}

+

+<%--

+  Class Name : EgovLoginUsr.jsp

+  Description : 로그인화면

+  Modification Information

+ 

+      수정일         수정자                   수정내용

+    -------    --------    ---------------------------

+     2009.03.10    박지욱             최초 생성

+     2011.08.31   JJY       경량환경 버전 생성

+ 

+    author   : 공통서비스 개발팀  박지욱

+    since    : 2009.03.10

+--%>

+<%@ page language="java" contentType="text/html; charset=utf-8" pageEncoding="utf-8"%>

+<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>

+<%@ taglib prefix="ui" uri="http://egovframework.gov/ctl/ui"%>

+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>

+<%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>

+<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>

+<!DOCTYPE html>

+<html lang="ko">

+<head>

+<meta http-equiv="Content-Language" content="ko" >

+<meta http-equiv="X-UA-Compatible" content="IE=edge" />

+<script src="<c:url value='/js/jquery-1.12.4.min.js' />"></script>

+<title>로그인</title>

+<!-- <link href="/css/post.css?ver=1" rel="stylesheet" > -->

+<script type="text/javascript">

+$( document ).ready(function(){

+

+	alert("세션이 만료 되었습니다. 재로그인해주세요");

+	 window.close(); 

+});

+</script>

+</head>

+<body>

+</body>

+</html>(No newline at end of file)

+                }else if(returnData.result == 'extension'){

+                	alert("첨부파일 확장자 확인 부탁드립니다.");

+                }else if(returnData.result == 'extension'){

+                	alert("첨부파일 확장자 확인 부탁드립니다.");