Index: branches/beta/data/Smarty/templates/shopping/confirm.tpl
===================================================================
--- branches/beta/data/Smarty/templates/shopping/confirm.tpl	(revision 14676)
+++ branches/beta/data/Smarty/templates/shopping/confirm.tpl	(revision 15056)
@@ -46,5 +46,5 @@
 						<td align="center">
 							<a href="<!--{$smarty.server.PHP_SELF|escape}-->" onclick="win01('../products/detail_image.php?product_id=<!--{$arrProductsClass[cnt].product_id}-->&image=main_image','detail_image','<!--{$arrProductsClass[cnt].tpl_image_width}-->','<!--{$arrProductsClass[cnt].tpl_image_height}-->'); return false;" target="_blank">
-								<img src="<!--{$smarty.const.URL_DIR}-->resize_image.php?image=<!--{$smarty.const.IMAGE_SAVE_DIR}-->/<!--{$arrProductsClass[cnt].main_list_image}-->&width=65&height=65" alt="<!--{$arrProductsClass[cnt].name|escape}-->">
+								<img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$arrProductsClass[cnt].main_list_image}-->&width=65&height=65" alt="<!--{$arrProductsClass[cnt].name|escape}-->">
 							</a>
 						</td>
Index: branches/beta/data/Smarty/templates/admin/contents/campaign_create_tag.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/contents/campaign_create_tag.tpl	(revision 17)
+++ branches/beta/data/Smarty/templates/admin/contents/campaign_create_tag.tpl	(revision 15056)
@@ -109,5 +109,5 @@
 			<td width="90" align="center">
 			<!--{if $arrProducts[cnt].main_list_image != ""}-->
-				<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrProducts[cnt].main_list_image`"}-->
+				<!--{assign var=image_path value="`$arrProducts[cnt].main_list_image`"}-->
 			<!--{else}-->
 				<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: branches/beta/data/Smarty/templates/admin/contents/recomend_search.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/contents/recomend_search.tpl	(revision 17)
+++ branches/beta/data/Smarty/templates/admin/contents/recomend_search.tpl	(revision 15056)
@@ -99,5 +99,5 @@
 			<td width="90" align="center">
 			<!--{if $arrProducts[cnt].main_list_image != ""}-->
-				<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrProducts[cnt].main_list_image`"}-->
+				<!--{assign var=image_path value="`$arrProducts[cnt].main_list_image`"}-->
 			<!--{else}-->
 				<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: branches/beta/data/Smarty/templates/admin/customer/index.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/customer/index.tpl	(revision 14994)
+++ branches/beta/data/Smarty/templates/admin/customer/index.tpl	(revision 15056)
@@ -195,25 +195,25 @@
 									<!--{if $arrErr.buy_start_year || $arrErr.buy_end_year}--><span class="red12"><!--{$arrErr.buy_start_year}--><!--{$arrErr.buy_end_year}--></span><br><!--{/if}-->
 									<select name="buy_start_year" style="<!--{$arrErr.buy_start_year|sfGetErrorColor}-->">
-										<option value="" selected="selected">------</option>
+										<option value="" selected="selected">----</option>
 										<!--{html_options options=$objDate->getYear($smarty.const.RELEASE_YEAR)  selected=$arrForm.buy_start_year}-->
 									</select>Ç¯
 									<select name="buy_start_month" style="<!--{$arrErr.buy_start_year|sfGetErrorColor}-->">
-										<option value="" selected="selected">----</option>
+										<option value="" selected="selected">--</option>
 										<!--{html_options options=$arrMonth selected=$arrForm.buy_start_month}-->
 									</select>·î
 									<select name="buy_start_day" style="<!--{$arrErr.buy_start_year|sfGetErrorColor}-->">
-										<option value="" selected="selected">----</option>
+										<option value="" selected="selected">--</option>
 										<!--{html_options options=$arrDay selected=$arrForm.buy_start_day}-->
 									</select>Æü¡Á
 									<select name="buy_end_year" style="<!--{$arrErr.buy_end_year|sfGetErrorColor}-->">
-										<option value="" selected="selected">------</option>
+										<option value="" selected="selected">----</option>
 										<!--{html_options options=$objDate->getYear($smarty.const.RELEASE_YEAR)  selected=$arrForm.buy_end_year}-->
 									</select>Ç¯
 									<select name="buy_end_month" style="<!--{$arrErr.buy_end_year|sfGetErrorColor}-->">
-										<option value="" selected="selected">----</option>
+										<option value="" selected="selected">--</option>
 										<!--{html_options options=$arrMonth selected=$arrForm.buy_end_month}-->
 									</select>·î
 									<select name="buy_end_day" style="<!--{$arrErr.buy_end_year|sfGetErrorColor}-->">
-										<option value="" selected="selected">----</option>
+										<option value="" selected="selected">--</option>
 										<!--{html_options options=$arrDay selected=$arrForm.buy_end_day}-->
 									</select>Æü
Index: branches/beta/data/Smarty/templates/admin/products/product_select.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/products/product_select.tpl	(revision 17)
+++ branches/beta/data/Smarty/templates/admin/products/product_select.tpl	(revision 15056)
@@ -100,5 +100,5 @@
 			<td width="90" align="center">
 			<!--{if $arrProducts[cnt].main_list_image != ""}-->
-				<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrProducts[cnt].main_list_image`"}-->
+				<!--{assign var=image_path value="`$arrProducts[cnt].main_list_image`"}-->
 			<!--{else}-->
 				<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: branches/beta/data/Smarty/templates/admin/products/product.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/products/product.tpl	(revision 12035)
+++ branches/beta/data/Smarty/templates/admin/products/product.tpl	(revision 15056)
@@ -354,5 +354,5 @@
 										<td bgcolor="#f2f1ec" width="160" class="fs12n">´ØÏ¢¾¦ÉÊ(<!--{$smarty.section.cnt.iteration}-->)<br>
 										<!--{if $arrRecommend[$recommend_no].main_list_image != ""}-->
-											<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrRecommend[$recommend_no].main_list_image`"}-->
+											<!--{assign var=image_path value="`$arrRecommend[$recommend_no].main_list_image`"}-->
 										<!--{else}-->
 											<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: branches/beta/data/Smarty/templates/admin/products/product_rank.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/products/product_rank.tpl	(revision 17)
+++ branches/beta/data/Smarty/templates/admin/products/product_rank.tpl	(revision 15056)
@@ -124,5 +124,5 @@
 												<!--{* ¾¦ÉÊ²èÁü *}-->
 												<!--{if $arrProductsList[cnt].main_list_image != ""}-->
-													<!--{assign var=image_path value=`$smarty.const.IMAGE_SAVE_DIR`/`$arrProductsList[cnt].main_list_image`}-->
+													<!--{assign var=image_path value=`$arrProductsList[cnt].main_list_image`}-->
 												<!--{else}-->
 													<!--{assign var=image_path value=$smarty.const.NO_IMAGE_URL}-->
Index: branches/beta/data/Smarty/templates/admin/products/confirm.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/products/confirm.tpl	(revision 24)
+++ branches/beta/data/Smarty/templates/admin/products/confirm.tpl	(revision 15056)
@@ -234,5 +234,5 @@
 									<td bgcolor="#f2f1ec" width="160" class="fs12n">´ØÏ¢¾¦ÉÊ(<!--{$smarty.section.cnt.iteration}-->)<br>
 									<!--{if $arrRecommend[$recommend_no].main_list_image != ""}-->
-										<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrRecommend[$recommend_no].main_list_image`"}-->
+										<!--{assign var=image_path value="`$arrRecommend[$recommend_no].main_list_image`"}-->
 									<!--{else}-->
 										<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: branches/beta/data/Smarty/templates/admin/products/index.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/products/index.tpl	(revision 11753)
+++ branches/beta/data/Smarty/templates/admin/products/index.tpl	(revision 15056)
@@ -295,5 +295,5 @@
 							<td rowspan="2" align="center">
 							<!--{if $arrProducts[cnt].main_list_image != ""}-->
-								<!--{assign var=image_path value="`$smarty.const.IMAGE_SAVE_DIR`/`$arrProducts[cnt].main_list_image`"}-->
+								<!--{assign var=image_path value="`$arrProducts[cnt].main_list_image`"}-->
 							<!--{else}-->
 								<!--{assign var=image_path value="`$smarty.const.NO_IMAGE_DIR`"}-->
Index: branches/beta/data/Smarty/templates/admin/design/template.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/design/template.tpl	(revision 17)
+++ branches/beta/data/Smarty/templates/admin/design/template.tpl	(revision 15056)
@@ -79,5 +79,5 @@
 										<td bgcolor="#ffffff" align="center"><!--{$arrTemplate[template]}-->
 											<span class="fs12">¡Ú<!--{$code}-->¡Û</span><br/>
-											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$smarty.const.HTML_PATH}--><!--{$image}-->&width=160&height=200" name="<!--{$key}-->" alt="<!--{$code}-->"></label><br>
+											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.URL_DIR}--><!--{$image}-->" width="160" height="200" name="<!--{$key}-->" alt="<!--{$code}-->"></label><br>
 											<span class="fs10n"><label for="radio<!--{$key}-->"><input type="radio" name="check_template" value="<!--{$code}-->" id="radio<!--{$key}-->" onClick="ChangeImage('<!--{$smarty.const.URL_DIR}--><!--{$image}-->');" <!--{if $arrTemplate.check[$code] != ""}-->checked<!--{/if}-->>ÁªÂò</label></span>
 										</td>
@@ -89,5 +89,5 @@
 										<td bgcolor="#ffffff" align="center"><!--{$arrTemplate[template]}-->
 											<span class="fs12">¡Ú<!--{$code}-->¡Û</span><br/>
-											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$smarty.const.HTML_PATH}--><!--{$image}-->&width=160&height=200" name="<!--{$key}-->" alt="<!--{$code}-->"></label><br>
+											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.URL_DIR}--><!--{$image}-->" width="160" height="200" name="<!--{$key}-->" alt="<!--{$code}-->></label><br>
 											<span class="fs10n"><label for="radio<!--{$key}-->"><input type="radio" name="check_template" value="<!--{$code}-->" id="radio<!--{$key}-->" onClick="ChangeImage('<!--{$smarty.const.URL_DIR}--><!--{$image}-->');" <!--{if $arrTemplate.check[$code] != ""}-->checked<!--{/if}-->>ÁªÂò</label></span>
 										</td>
@@ -100,5 +100,5 @@
 										<td bgcolor="#ffffff" align="center"><!--{$arrTemplate[template]}-->
 											<span class="fs12">¡Ú<!--{$code}-->¡Û</span><br/>
-											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.SITE_URL}-->resize_image.php?image=<!--{$smarty.const.HTML_PATH}--><!--{$image}-->&width=160&height=200" name="<!--{$key}-->" alt="<!--{$code}-->"></label><br>
+											<label for="radio<!--{$key}-->"><img src="<!--{$smarty.const.URL_DIR}--><!--{$image}-->" width="160" height="200" name="<!--{$key}-->" alt="<!--{$code}-->></label><br>
 											<span class="fs10n"><label for="radio<!--{$key}-->"><input type="radio" name="check_template" value="<!--{$code}-->" id="radio<!--{$key}-->" onClick="ChangeImage('<!--{$smarty.const.URL_DIR}--><!--{$image}-->');" <!--{if $arrTemplate.check[$code] != ""}-->checked<!--{/if}-->>ÁªÂò</label></span>
 										</td>
Index: branches/beta/data/Smarty/templates/admin/total/index.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/total/index.tpl	(revision 12166)
+++ branches/beta/data/Smarty/templates/admin/total/index.tpl	(revision 15056)
@@ -180,5 +180,5 @@
 									<!--{/if}-->
 								</table>
-								<!--{* ¥°¥é¥ÕÉ½¼¨ *}-->		
+								<!--{* ¥°¥é¥ÕÉ½¼¨ *}-->			
 								<table width="840" border="0" cellspacing="0" cellpadding="0" summary=" ">
 									<tr>
Index: branches/beta/data/Smarty/templates/admin/system/input.tpl
===================================================================
--- branches/beta/data/Smarty/templates/admin/system/input.tpl	(revision 17)
+++ branches/beta/data/Smarty/templates/admin/system/input.tpl	(revision 15056)
@@ -42,4 +42,5 @@
 <input type="hidden" name="pageno" value="<!--{$tpl_pageno}-->">
 <input type="hidden" name="old_login_id" value="<!--{$tpl_old_login_id}-->">
+<input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->">
 	<tr valign="top">
 		<td class="mainbg">
Index: branches/beta/data/Smarty/templates/cart/index.tpl
===================================================================
--- branches/beta/data/Smarty/templates/cart/index.tpl	(revision 11980)
+++ branches/beta/data/Smarty/templates/cart/index.tpl	(revision 15056)
@@ -79,5 +79,5 @@
 							<td align="center"><a href="<!--{$smarty.server.PHP_SELF|escape}-->" onclick="fnChangeAction('<!--{$smarty.server.PHP_SELF|escape}-->'); fnModeSubmit('delete', 'cart_no', '<!--{$arrProductsClass[cnt].cart_no}-->'); return false;">ºï½ü</a></td>
 							<td ><a href="<!--{$smarty.server.PHP_SELF|escape}-->" onclick="win01('../products/detail_image.php?product_id=<!--{$arrProductsClass[cnt].product_id}-->&image=main_image','detail_image','<!--{$arrProductsClass[cnt].tpl_image_width}-->','<!--{$arrProductsClass[cnt].tpl_image_height}-->'); return false;" target="_blank">
-								<img src="<!--{$smarty.const.URL_DIR}-->resize_image.php?image=<!--{$smarty.const.IMAGE_SAVE_DIR}-->/<!--{$arrProductsClass[cnt].main_list_image}-->&width=65&height=65" alt="<!--{$arrProductsClass[cnt].name|escape}-->">
+								<img src="<!--{$smarty.const.URL_DIR}-->resize_image.php?image=<!--{$arrProductsClass[cnt].main_list_image}-->&width=65&height=65" alt="<!--{$arrProductsClass[cnt].name|escape}-->">
 							</a></td>
 							<td ><!--{* ¾¦ÉÊÌ¾ *}--><strong><!--{$arrProductsClass[cnt].name|escape}--></storng><br />
Index: branches/beta/data/class/SC_View.php
===================================================================
--- branches/beta/data/class/SC_View.php	(revision 14676)
+++ branches/beta/data/class/SC_View.php	(revision 15056)
@@ -44,5 +44,6 @@
 		$this->_smarty->register_function("sfPrintEbisTag","sfPrintEbisTag");
 		$this->_smarty->register_function("sfPrintAffTag","sfPrintAffTag");
-		$this->_smarty->default_modifiers = array('script_escape');
+        $this->_smarty->register_function("sfIsHTTPS","sfIsHTTPS");
+        $this->_smarty->default_modifiers = array('script_escape');
         
 		if(ADMIN_MODE == '1') {		
Index: branches/beta/data/class/SC_Session.php
===================================================================
--- branches/beta/data/class/SC_Session.php	(revision 17)
+++ branches/beta/data/class/SC_Session.php	(revision 15056)
@@ -13,5 +13,6 @@
 	var $sid;			// ¥»¥Ã¥·¥ç¥óID
 	var $member_id;		// ¥í¥°¥¤¥ó¥æ¡¼¥¶¤Î¼ç¥­¡¼
-
+    var $uniqid;         // ¥Ú¡¼¥¸Á«°Ü¤ÎÀµÅöÀ­¥Á¥§¥Ã¥¯¤Ë»ÈÍÑ
+    
 	/* ¥³¥ó¥¹¥È¥é¥¯¥¿ */
 	function SC_Session() {
@@ -23,7 +24,9 @@
 			$this->sid = session_id();
 			$this->cert = $_SESSION['cert'];
-			$this->login_id = $_SESSION['login_id'];
+			$this->login_id  = $_SESSION['login_id'];
 			$this->authority = $_SESSION['authority'];	// ´ÉÍý¼Ô:0, °ìÈÌ:1, ±ÜÍ÷:2
 			$this->member_id = $_SESSION['member_id'];
+            $this->uniqid    = $_SESSION['uniq_id'];
+            
 			// ¥í¥°¤Ëµ­Ï¿¤¹¤ë
 			gfPrintLog("access : user=".$this->login_id." auth=".$this->authority." sid=".$this->sid);
@@ -64,4 +67,19 @@
 	}
 	
+    /** ¥æ¥Ë¡¼¥¯ID¤Î¼èÆÀ **/ 
+    function getUniqId() {
+        // ¥æ¥Ë¡¼¥¯ID¤¬¥»¥Ã¥È¤µ¤ì¤Æ¤¤¤Ê¤¤¾ì¹ç¤Ï¥»¥Ã¥È¤¹¤ë¡£
+        if( empty($_SESSION['uniqid']) ) {
+            $this->setUniqId();
+        }
+        return $this->GetSession('uniqid');
+    }
+    
+    /** ¥æ¥Ë¡¼¥¯ID¤Î¥»¥Ã¥È **/ 
+    function setUniqId() {
+        // Í½Â¬¤µ¤ì¤Ê¤¤¤è¤¦¤Ë¥é¥ó¥À¥àÊ¸»úÎó¤òÉÕÍ¿¤¹¤ë¡£
+        $this->SetSession('uniqid', sfGetUniqRandomId());
+    }
+    
 	/* ¥»¥Ã¥·¥ç¥ó¤ÎÇË´þ */
 	function EndSession() {
@@ -87,4 +105,5 @@
 		unset($_SESSION['authority']);
 		unset($_SESSION['member_id']);
+        unset($_SESSION['uniqid']);
 		// ¥í¥°¤Ëµ­Ï¿¤¹¤ë
 		gfPrintLog("logout : user=".$this->login_id." auth=".$this->authority." sid=".$this->sid);
Index: branches/beta/data/class/SC_CheckError.php
===================================================================
--- branches/beta/data/class/SC_CheckError.php	(revision 12037)
+++ branches/beta/data/class/SC_CheckError.php	(revision 15056)
@@ -812,5 +812,25 @@
 			$this->arrErr[$value[1]] = "¢¨ " . $value[0] . "¤Ï·ÈÂÓÅÅÏÃ¤Î¤â¤Î¤Ç¤Ï¤¢¤ê¤Þ¤»¤ó¡£<br />";
 		}
-	}		
+	}
+    /**
+     * ¶Ø»ßÊ¸»úÎó¤Î¥Á¥§¥Ã¥¯
+     * value[0] = ¹àÌÜÌ¾ value[1] = È½ÄêÂÐ¾ÝÊ¸»úÎó
+     * value[2] = ÆþÎÏ¤ò¶Ø»ß¤¹¤ëÊ¸»úÎó(ÇÛÎó)
+     * 
+     * @example $objErr->doFunc(array("URL", "contents", $arrReviewDenyURL), array("PROHIBITED_STR_CHECK"));
+     */ 
+    function PROHIBITED_STR_CHECK( $value ) {
+        if( isset($this->arrErr[$value[1]]) || empty($this->arrParam[$value[1]]) ) {
+            return;
+        }
+        
+        $targetStr     = $this->arrParam[$value[1]];
+        $prohibitedStr = str_replace(array('|', '/'), array('\|', '\/'), $value[2]);
+        
+        $pattern = '/' . join('|', $prohibitedStr) . '/i';
+        if(preg_match_all($pattern, $this->arrParam[$value[1]], $matches)) {
+            $this->arrErr[$value[1]] = "¢¨ " . $value[0] . "¤ÏÆþÎÏ¤Ç¤­¤Þ¤»¤ó¡£<br />";
+        }
+    }
 }
 ?>
Index: branches/beta/data/class/SC_CartSession.php
===================================================================
--- branches/beta/data/class/SC_CartSession.php	(revision 14730)
+++ branches/beta/data/class/SC_CartSession.php	(revision 15056)
@@ -344,5 +344,4 @@
 	}
     
-
 }
 ?>
Index: branches/beta/data/conf/conf.php
===================================================================
--- branches/beta/data/conf/conf.php	(revision 14920)
+++ branches/beta/data/conf/conf.php	(revision 15056)
@@ -186,5 +186,5 @@
 define("REVIEW_REGIST_MAX", 5);
 
-/*F
+/*
  * ¥µ¥¤¥ÈÄêµÁÄê¿ô
  */
@@ -342,4 +342,5 @@
 define ("ACCESS_ERROR", 2);		// ¥¢¥¯¥»¥¹¼ºÇÔ¡Ê¥¿¥¤¥à¥¢¥¦¥ÈÅù¡Ë
 define ("AUTH_ERROR", 3);		// ¥¢¥¯¥»¥¹¸¢¸Â°ãÈ¿
+define ("INVALID_MOVE_ERRORR", 4); // ÉÔÀµ¤ÊÁ«°Ü¥¨¥é¡¼
 
 /* É½¼¨¿ôÀ©¸Â */
@@ -874,4 +875,16 @@
 );
 
+/*--------- ¢¥¾¦ÉÊ¥ì¥Ó¥å¡¼ÍÑ ---------*/
+// ¾¦ÉÊ¥ì¥Ó¥å¡¼¤ÇURL½ñ¤­¹þ¤ß¤òµö²Ä¤¹¤ë¤«ÈÝ¤«
+define ('REVIEW_ALLOW_URL', false);
+
+// ½ñ¤­¹þ¤ßÉÔ²Ä¤ÎURLÊ¸»úÎó
+$arrReviewDenyURL = array(
+    'http://',
+    'https://',
+    'ttp://',
+    'ttps://',
+);
+
 /*--------- ¢¥¥È¥é¥Ã¥¯¥Ð¥Ã¥¯ÍÑ ---------*/
 
Index: branches/beta/data/lib/slib.php
===================================================================
--- branches/beta/data/lib/slib.php	(revision 15002)
+++ branches/beta/data/lib/slib.php	(revision 15056)
@@ -341,5 +341,5 @@
 			$objPage->tpl_error="¤³¤Î¥Õ¥¡¥¤¥ë¤Ë¤Ï¥¢¥¯¥»¥¹¸¢¸Â¤¬¤¢¤ê¤Þ¤»¤ó¡£<br />¤â¤¦°ìÅÙ¤´³ÎÇ§¤Î¤¦¤¨¡¢ºÆÅÙ¥í¥°¥¤¥ó¤·¤Æ¤¯¤À¤µ¤¤¡£";
 			break;
-		case PAGE_ERROR:
+		case INVALID_MOVE_ERRORR:
 			$objPage->tpl_error="ÉÔÀµ¤Ê¥Ú¡¼¥¸°ÜÆ°¤Ç¤¹¡£<br />¤â¤¦°ìÅÙ¤´³ÎÇ§¤Î¤¦¤¨¡¢ºÆÅÙÆþÎÏ¤·¤Æ¤¯¤À¤µ¤¤¡£";
 			break;
@@ -465,5 +465,5 @@
 
 /* Ç§¾Ú¤Î²ÄÈÝÈ½Äê */
-function sfIsSuccess($objSess, $disp_error = true) { 
+function sfIsSuccess($objSess, $disp_error = true) {
 	$ret = $objSess->IsSuccess();
 	if($ret != SUCCESS) {
@@ -474,5 +474,53 @@
 		return false;
 	}
-	return true;		
+    // ¥ê¥Õ¥¡¥é¡¼¥Á¥§¥Ã¥¯(CSRF¤Î»ÃÄêÅª¤ÊÂÐºö)
+    // ¡Ö¥ê¥Õ¥¡¥éÌµ¡× ¤Î¾ì¹ç¤Ï¥¹¥ë¡¼
+    // ¡Ö¥ê¥Õ¥¡¥éÍ­¡× ¤«¤Ä ¡Ö´ÉÍý²èÌÌ¤«¤é¤ÎÁ«°Ü¤Ç¤Ê¤¤¡× ¾ì¹ç¤Ë¥¨¥é¡¼²èÌÌ¤òÉ½¼¨¤¹¤ë
+    if ( empty($_SERVER['HTTP_REFERER']) ) {
+        // ·Ù¹ðÉ½¼¨¤µ¤»¤ë¡©
+        // sfErrorHeader('>> referrer¤¬Ìµ¸ú¤Ë¤Ê¤Ã¤Æ¤¤¤Þ¤¹¡£');
+    } else {
+        $domain  = sfIsHTTPS() ? SSL_URL : SITE_URL;
+        $pattern = sprintf('|^%s.*|', $domain);
+        $referer = $_SERVER['HTTP_REFERER'];
+
+        // ´ÉÍý²èÌÌ¤«¤é°Ê³°¤ÎÁ«°Ü¤Î¾ì¹ç¤Ï¥¨¥é¡¼²èÌÌ¤òÉ½¼¨
+        if (!preg_match($pattern, $referer)) {
+            if ($disp_error) sfDispError(INVALID_MOVE_ERRORR);
+            return false;
+        }
+    }
+    return true;
+}
+
+/**
+ * HTTPS¤«¤É¤¦¤«¤òÈ½Äê
+ * 
+ * @return bool
+ */
+function sfIsHTTPS () {
+    // HTTPS»þ¤Ë¤Ï$_SERVER['HTTPS']¤Ë¤Ï¶õ¤Ç¤Ê¤¤ÃÍ¤¬Æþ¤ë
+    // $_SERVER['HTTPS'] != 'off' ¤ÏIISÍÑ
+    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') {
+        return true;
+    } else {
+        return false;
+    }
+}
+
+/**
+ *  Àµµ¬¤ÎÁ«°Ü¤¬¤µ¤ì¤Æ¤¤¤ë¤«¤òÈ½Äê
+ *  Á°²èÌÌ¤Çuniqid¤òËä¤á¹þ¤ó¤Ç¤ª¤¯É¬Í×¤¬¤¢¤ë
+ *  @param  obj  SC_Session, SC_SiteSession
+ *  @return bool
+ */
+function sfIsValidTransition($objSess) {
+    // Á°²èÌÌ¤«¤éPOST¤µ¤ì¤ëuniqid¤¬Àµ¤·¤¤¤â¤Î¤«¤É¤¦¤«¤ò¥Á¥§¥Ã¥¯
+    $uniqid = $objSess->getUniqId();
+    if ( !empty($_POST['uniqid']) && ($_POST['uniqid'] === $uniqid) ) {
+        return true;
+    } else {
+        return false;
+    }
 }
 
@@ -776,4 +824,5 @@
 // html_checkboxes¤ÎÃÍ¤ò¥Þ¡¼¥¸¤·¤Æ¡Ö-¡×¤Ç¤Ä¤Ê¤²¤ë¡£
 function sfMergeParamCheckBoxes($array) {
+    $ret = '';
 	if(is_array($array)) {
 		foreach($array as $val) {
@@ -2825,5 +2874,4 @@
 	// ¥Õ¥©¥ë¥À¤òºï½ü
 	return rmdir($dir);
-	
 }
 
Index: branches/beta/data/smarty_extends/modifier.script_escape.php
===================================================================
--- branches/beta/data/smarty_extends/modifier.script_escape.php	(revision 14676)
+++ branches/beta/data/smarty_extends/modifier.script_escape.php	(revision 15056)
@@ -8,7 +8,7 @@
 function smarty_modifier_script_escape($value) {
     
-    if (is_array($value)) {return $value;}
+    if (is_array($value)) return $value;
     
-    $pattern = "/<script.*?>|<\/script>/";
+    $pattern = "/<script.*?>|<\/script>|javascript:/";
     $convert = "#script tag escaped#";
     
