Index: /branches/rel/html/install/user_data/templates/detail.tpl
===================================================================
--- /branches/rel/html/install/user_data/templates/detail.tpl	(revision 13457)
+++ /branches/rel/html/install/user_data/templates/detail.tpl	(revision 15035)
@@ -378,9 +378,10 @@
 									<td align="center" valign="middle"><a href="<!--{$smarty.const.DETAIL_P_HTML}--><!--{$arrRecommend[cnt].product_id}-->">
 									<!--{if $arrRecommend[cnt].main_list_image != ""}-->
-										<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrRecommend[cnt].main_list_image`"}-->
+										<!--{assign var=image_path value="`$arrRecommend[cnt].main_list_image`"}-->
 									<!--{else}-->
 										<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
 									<!--{/if}-->
-									<img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$image_path|sfRmDupSlash}-->&width=65&height=65" alt="<!--{$arrRecommend[cnt].name|escape}-->"></a></td>
+									<img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$image_path|sfRmDupSlash}-->&width=65&height=65" alt="<!--{$arrRecommend[cnt].name|escape}-->"></a>
+									</td>
 									<td align="right">
 									<table width="145" border="0" cellspacing="0" cellpadding="0" summary=" ">
@@ -419,5 +420,5 @@
 									<td align="center" valign="middle"><a href="<!--{$smarty.const.DETAIL_P_HTML}--><!--{$arrRecommend[$nextCnt].product_id}-->">
 									<!--{if $arrRecommend[$nextCnt].main_list_image != ""}-->
-										<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrRecommend[$nextCnt].main_list_image`"}-->
+										<!--{assign var=image_path value="`$arrRecommend[$nextCnt].main_list_image`"}-->
 									<!--{else}-->
 										<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: /branches/rel/html/install/user_data/templates/default1/include/bloc/best5.tpl
===================================================================
--- /branches/rel/html/install/user_data/templates/default1/include/bloc/best5.tpl	(revision 12157)
+++ /branches/rel/html/install/user_data/templates/default1/include/bloc/best5.tpl	(revision 15035)
@@ -15,5 +15,5 @@
 		<td>
 		
-		<!--{if $arrBestProducts[cnt].main_list_image != ""}--><!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrBestProducts[cnt].main_list_image`"}--><!--{else}--><!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}--><!--{/if}-->
+		<!--{if $arrBestProducts[cnt].main_list_image != ""}--><!--{assign var=image_path value="`$arrBestProducts[cnt].main_list_image`"}--><!--{else}--><!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}--><!--{/if}-->
 		
 		<table width="190" border="0" cellspacing="0" cellpadding="0" summary=" ">
@@ -48,5 +48,5 @@
 		<!--{assign var=cnt2 value=`$smarty.section.cnt.iteration*$smarty.section.cnt.step-1` }-->
 		<!--{if $arrBestProducts[$cnt2]|count > 0}-->
-			<!--{if $arrBestProducts[$cnt2].main_list_image != ""}--><!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrBestProducts[$cnt2].main_list_image`"}--><!--{else}--><!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}--><!--{/if}-->
+			<!--{if $arrBestProducts[$cnt2].main_list_image != ""}--><!--{assign var=image_path value="`$arrBestProducts[$cnt2].main_list_image`"}--><!--{else}--><!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}--><!--{/if}-->
 			<table width="190" border="0" cellspacing="0" cellpadding="0" summary=" ">
 				<tr valign="top">
Index: /branches/rel/html/install/user_data/templates/default1/templates/detail.tpl
===================================================================
--- /branches/rel/html/install/user_data/templates/default1/templates/detail.tpl	(revision 13457)
+++ /branches/rel/html/install/user_data/templates/default1/templates/detail.tpl	(revision 15035)
@@ -341,5 +341,5 @@
 									<td align="center" valign="middle"><a href="<!--{$smarty.const.DETAIL_P_HTML}--><!--{$arrRecommend[cnt].product_id}-->">
 									<!--{if $arrRecommend[cnt].main_list_image != ""}-->
-										<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrRecommend[cnt].main_list_image`"}-->
+										<!--{assign var=image_path value="`$arrRecommend[cnt].main_list_image`"}-->
 									<!--{else}-->
 										<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
@@ -382,5 +382,5 @@
 									<td align="center" valign="middle"><a href="<!--{$smarty.const.DETAIL_P_HTML}--><!--{$arrRecommend[$nextCnt].product_id}-->">
 									<!--{if $arrRecommend[$nextCnt].main_list_image != ""}-->
-										<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrRecommend[$nextCnt].main_list_image`"}-->
+										<!--{assign var=image_path value="`$arrRecommend[$nextCnt].main_list_image`"}-->
 									<!--{else}-->
 										<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: /branches/rel/html/install/user_data/include/bloc/best5.tpl
===================================================================
--- /branches/rel/html/install/user_data/include/bloc/best5.tpl	(revision 12157)
+++ /branches/rel/html/install/user_data/include/bloc/best5.tpl	(revision 15035)
@@ -15,5 +15,5 @@
 		<td>
 		
-		<!--{if $arrBestProducts[cnt].main_list_image != ""}--><!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrBestProducts[cnt].main_list_image`"}--><!--{else}--><!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}--><!--{/if}-->
+		<!--{if $arrBestProducts[cnt].main_list_image != ""}--><!--{assign var=image_path value="`$arrBestProducts[cnt].main_list_image`"}--><!--{else}--><!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}--><!--{/if}-->
 		
 		<table width="190" border="0" cellspacing="0" cellpadding="0" summary=" ">
@@ -48,5 +48,5 @@
 		<!--{assign var=cnt2 value=`$smarty.section.cnt.iteration*$smarty.section.cnt.step-1` }-->
 		<!--{if $arrBestProducts[$cnt2]|count > 0}-->
-			<!--{if $arrBestProducts[$cnt2].main_list_image != ""}--><!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrBestProducts[$cnt2].main_list_image`"}--><!--{else}--><!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}--><!--{/if}-->
+			<!--{if $arrBestProducts[$cnt2].main_list_image != ""}--><!--{assign var=image_path value="`$arrBestProducts[$cnt2].main_list_image`"}--><!--{else}--><!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}--><!--{/if}-->
 			<table width="190" border="0" cellspacing="0" cellpadding="0" summary=" ">
 				<tr valign="top">
Index: /branches/rel/html/resize_image.php
===================================================================
--- /branches/rel/html/resize_image.php	(revision 13448)
+++ /branches/rel/html/resize_image.php	(revision 15035)
@@ -5,13 +5,37 @@
 
 require_once($include_dir . HTML2DATA_DIR. "lib/gdthumb.php");
-require_once($include_dir . HTML2DATA_DIR. "conf/conf.php");	
+require_once($include_dir . HTML2DATA_DIR. "conf/conf.php");
 
 $objThumb = new gdthumb();
 
-$file = $_GET["image"];
+$file = NO_IMAGE_DIR;
+
+// NO_IMAGE_DIR°Ê³°¤Î¥Õ¥¡¥¤¥ëÌ¾¤¬ÅÏ¤µ¤ì¤¿¾ì¹ç¡¢¥Õ¥¡¥¤¥ëÌ¾¤Î¥Á¥§¥Ã¥¯¤ò¹Ô¤¦
+if ( isset($_GET['image']) && $_GET['image'] !== NO_IMAGE_DIR) {
+    
+    //ÉÔÀµ¤Ê¥Õ¥¡¥¤¥ëÌ¾¤¬ÅÏ¤µ¤ì¤¿¾ì¹ç¤Ï½ªÎ»¤µ¤»¤ë
+    if ( lfCheckFileName() !== true ) {
+        exit();
+    }
+    
+    $file = IMAGE_SAVE_DIR . $_GET['image'];
+}
+
 if(file_exists($file)){
-	$objThumb->Main($file, $_GET["width"], $_GET["height"], "", true);
+    $objThumb->Main($file, $_GET["width"], $_GET["height"], "", true);
 }else{
-	$objThumb->Main(NO_IMAGE_DIR, $_GET["width"], $_GET["height"], "", true);
+    $objThumb->Main(NO_IMAGE_DIR, $_GET["width"], $_GET["height"], "", true);
+}
+
+// ¥Õ¥¡¥¤¥ëÌ¾¤Î·Á¼°¤ò¥Á¥§¥Ã¥¯
+function lfCheckFileName() {
+    //$pattern = '|^[0-9]+_[0-9a-z]+\.[a-z]{3}$|';
+    $pattern = '|\.\./|';
+    $file    = trim($_GET["image"]);
+    if ( preg_match_all($pattern, $file, $matches) ) {
+        return false;
+    } else {
+        return true;
+    }
 }
 
Index: /branches/rel/data/Smarty/templates/shopping/confirm.tpl
===================================================================
--- /branches/rel/data/Smarty/templates/shopping/confirm.tpl	(revision 12157)
+++ /branches/rel/data/Smarty/templates/shopping/confirm.tpl	(revision 15035)
@@ -46,5 +46,5 @@
 						<td align="center">
 							<a href="<!--{$smarty.server.PHP_SELF|escape}-->" onclick="win01('../products/detail_image.php?product_id=<!--{$arrProductsClass[cnt].product_id}-->&image=main_image','detail_image','<!--{$arrProductsClass[cnt].tpl_image_width}-->','<!--{$arrProductsClass[cnt].tpl_image_height}-->'); return false;" target="_blank">
-								<img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$smarty.const.IMAGE_SAVE_DIR}-->/<!--{$arrProductsClass[cnt].main_list_image}-->&width=65&height=65" alt="<!--{$arrProductsClass[cnt].name|escape}-->">
+								<img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$arrProductsClass[cnt].main_list_image}-->&width=65&height=65" alt="<!--{$arrProductsClass[cnt].name|escape}-->">
 							</a>
 						</td>
Index: /branches/rel/data/Smarty/templates/admin/design/template.tpl
===================================================================
--- /branches/rel/data/Smarty/templates/admin/design/template.tpl	(revision 12157)
+++ /branches/rel/data/Smarty/templates/admin/design/template.tpl	(revision 15035)
@@ -79,5 +79,5 @@
 										<td bgcolor="#ffffff" align="center"><!--{$arrTemplate[template]}-->
 											<span class="fs12">¡Ú<!--{$code}-->¡Û</span><br/>
-											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$smarty.const.HTML_PATH}--><!--{$image}-->&width=160&height=200" name="<!--{$key}-->" alt="<!--{$code}-->"></label><br>
+											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.URL_DIR}--><!--{$image}-->" width="160" height="200" name="<!--{$key}-->" alt="<!--{$code}-->"></label><br>
 											<span class="fs10n"><label for="radio<!--{$key}-->"><input type="radio" name="check_template" value="<!--{$code}-->" id="radio<!--{$key}-->" onClick="ChangeImage('<!--{$smarty.const.URL_DIR}--><!--{$image}-->');" <!--{if $arrTemplate.check[$code] != ""}-->checked<!--{/if}-->>ÁªÂò</label></span>
 										</td>
@@ -89,5 +89,5 @@
 										<td bgcolor="#ffffff" align="center"><!--{$arrTemplate[template]}-->
 											<span class="fs12">¡Ú<!--{$code}-->¡Û</span><br/>
-											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$smarty.const.HTML_PATH}--><!--{$image}-->&width=160&height=200" name="<!--{$key}-->" alt="<!--{$code}-->"></label><br>
+											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.URL_DIR}--><!--{$image}-->" width="160" height="200" name="<!--{$key}-->" alt="<!--{$code}-->></label><br>
 											<span class="fs10n"><label for="radio<!--{$key}-->"><input type="radio" name="check_template" value="<!--{$code}-->" id="radio<!--{$key}-->" onClick="ChangeImage('<!--{$smarty.const.URL_DIR}--><!--{$image}-->');" <!--{if $arrTemplate.check[$code] != ""}-->checked<!--{/if}-->>ÁªÂò</label></span>
 										</td>
@@ -100,5 +100,5 @@
 										<td bgcolor="#ffffff" align="center"><!--{$arrTemplate[template]}-->
 											<span class="fs12">¡Ú<!--{$code}-->¡Û</span><br/>
-											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$smarty.const.HTML_PATH}--><!--{$image}-->&width=160&height=200" name="<!--{$key}-->" alt="<!--{$code}-->"></label><br>
+											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.URL_DIR}--><!--{$image}-->" width="160" height="200" name="<!--{$key}-->" alt="<!--{$code}-->></label><br>
 											<span class="fs10n"><label for="radio<!--{$key}-->"><input type="radio" name="check_template" value="<!--{$code}-->" id="radio<!--{$key}-->" onClick="ChangeImage('<!--{$smarty.const.URL_DIR}--><!--{$image}-->');" <!--{if $arrTemplate.check[$code] != ""}-->checked<!--{/if}-->>ÁªÂò</label></span>
 										</td>
Index: /branches/rel/data/Smarty/templates/admin/contents/campaign_create_tag.tpl
===================================================================
--- /branches/rel/data/Smarty/templates/admin/contents/campaign_create_tag.tpl	(revision 12157)
+++ /branches/rel/data/Smarty/templates/admin/contents/campaign_create_tag.tpl	(revision 15035)
@@ -109,5 +109,5 @@
 			<td width="90" align="center">
 			<!--{if $arrProducts[cnt].main_list_image != ""}-->
-				<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrProducts[cnt].main_list_image`"}-->
+				<!--{assign var=image_path value="`$arrProducts[cnt].main_list_image`"}-->
 			<!--{else}-->
 				<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: /branches/rel/data/Smarty/templates/admin/contents/recomend_search.tpl
===================================================================
--- /branches/rel/data/Smarty/templates/admin/contents/recomend_search.tpl	(revision 12157)
+++ /branches/rel/data/Smarty/templates/admin/contents/recomend_search.tpl	(revision 15035)
@@ -99,5 +99,5 @@
 			<td width="90" align="center">
 			<!--{if $arrProducts[cnt].main_list_image != ""}-->
-				<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrProducts[cnt].main_list_image`"}-->
+				<!--{assign var=image_path value="`$arrProducts[cnt].main_list_image`"}-->
 			<!--{else}-->
 				<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: /branches/rel/data/Smarty/templates/admin/products/product_rank.tpl
===================================================================
--- /branches/rel/data/Smarty/templates/admin/products/product_rank.tpl	(revision 12157)
+++ /branches/rel/data/Smarty/templates/admin/products/product_rank.tpl	(revision 15035)
@@ -124,5 +124,5 @@
 												<!--{* ¾¦ÉÊ²èÁü *}-->
 												<!--{if $arrProductsList[cnt].main_list_image != ""}-->
-													<!--{assign var=image_path value=`$smarty.const.IMAGE_SAVE_DIR`/`$arrProductsList[cnt].main_list_image`}-->
+													<!--{assign var=image_path value=`$arrProductsList[cnt].main_list_image`}-->
 												<!--{else}-->
 													<!--{assign var=image_path value=$smarty.const.NO_IMAGE_URL}-->
Index: /branches/rel/data/Smarty/templates/admin/products/confirm.tpl
===================================================================
--- /branches/rel/data/Smarty/templates/admin/products/confirm.tpl	(revision 12157)
+++ /branches/rel/data/Smarty/templates/admin/products/confirm.tpl	(revision 15035)
@@ -234,5 +234,5 @@
 									<td bgcolor="#f2f1ec" width="160" class="fs12n">´ØÏ¢¾¦ÉÊ(<!--{$smarty.section.cnt.iteration}-->)<br>
 									<!--{if $arrRecommend[$recommend_no].main_list_image != ""}-->
-										<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrRecommend[$recommend_no].main_list_image`"}-->
+										<!--{assign var=image_path value="`$arrRecommend[$recommend_no].main_list_image`"}-->
 									<!--{else}-->
 										<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: /branches/rel/data/Smarty/templates/admin/products/index.tpl
===================================================================
--- /branches/rel/data/Smarty/templates/admin/products/index.tpl	(revision 12157)
+++ /branches/rel/data/Smarty/templates/admin/products/index.tpl	(revision 15035)
@@ -295,5 +295,5 @@
 							<td rowspan="2" align="center">
 							<!--{if $arrProducts[cnt].main_list_image != ""}-->
-								<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrProducts[cnt].main_list_image`"}-->
+								<!--{assign var=image_path value="`$arrProducts[cnt].main_list_image`"}-->
 							<!--{else}-->
 								<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: /branches/rel/data/Smarty/templates/admin/products/product_select.tpl
===================================================================
--- /branches/rel/data/Smarty/templates/admin/products/product_select.tpl	(revision 12157)
+++ /branches/rel/data/Smarty/templates/admin/products/product_select.tpl	(revision 15035)
@@ -100,5 +100,5 @@
 			<td width="90" align="center">
 			<!--{if $arrProducts[cnt].main_list_image != ""}-->
-				<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrProducts[cnt].main_list_image`"}-->
+				<!--{assign var=image_path value="`$arrProducts[cnt].main_list_image`"}-->
 			<!--{else}-->
 				<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: /branches/rel/data/Smarty/templates/admin/products/product.tpl
===================================================================
--- /branches/rel/data/Smarty/templates/admin/products/product.tpl	(revision 12157)
+++ /branches/rel/data/Smarty/templates/admin/products/product.tpl	(revision 15035)
@@ -354,5 +354,5 @@
 										<td bgcolor="#f2f1ec" width="160" class="fs12n">´ØÏ¢¾¦ÉÊ(<!--{$smarty.section.cnt.iteration}-->)<br>
 										<!--{if $arrRecommend[$recommend_no].main_list_image != ""}-->
-											<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrRecommend[$recommend_no].main_list_image`"}-->
+											<!--{assign var=image_path value="`$arrRecommend[$recommend_no].main_list_image`"}-->
 										<!--{else}-->
 											<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: /branches/rel/data/Smarty/templates/cart/index.tpl
===================================================================
--- /branches/rel/data/Smarty/templates/cart/index.tpl	(revision 12157)
+++ /branches/rel/data/Smarty/templates/cart/index.tpl	(revision 15035)
@@ -79,5 +79,5 @@
 							<td align="center"><a href="<!--{$smarty.server.PHP_SELF|escape}-->" onclick="fnChangeAction('<!--{$smarty.server.PHP_SELF|escape}-->'); fnModeSubmit('delete', 'cart_no', '<!--{$arrProductsClass[cnt].cart_no}-->'); return false;">ºï½ü</a></td>
 							<td ><a href="<!--{$smarty.server.PHP_SELF|escape}-->" onclick="win01('../products/detail_image.php?product_id=<!--{$arrProductsClass[cnt].product_id}-->&image=main_image','detail_image','<!--{$arrProductsClass[cnt].tpl_image_width}-->','<!--{$arrProductsClass[cnt].tpl_image_height}-->'); return false;" target="_blank">
-								<img src="<!--{$smarty.const.URL_DIR}-->resize_image.php?image=<!--{$smarty.const.IMAGE_SAVE_DIR}-->/<!--{$arrProductsClass[cnt].main_list_image}-->&width=65&height=65" alt="<!--{$arrProductsClass[cnt].name|escape}-->">
+								<img src="<!--{$smarty.const.URL_DIR}-->resize_image.php?image=<!--{$arrProductsClass[cnt].main_list_image}-->&width=65&height=65" alt="<!--{$arrProductsClass[cnt].name|escape}-->">
 							</a></td>
 							<td ><!--{* ¾¦ÉÊÌ¾ *}--><strong><!--{$arrProductsClass[cnt].name|escape}--></storng><br />
