Index: /branches/version-2_5-dev/data/class/util/SC_Utils.php
===================================================================
--- /branches/version-2_5-dev/data/class/util/SC_Utils.php	(revision 19912)
+++ /branches/version-2_5-dev/data/class/util/SC_Utils.php	(revision 19947)
@@ -2230,4 +2230,21 @@
         return true;
     }
+
+    /**
+     * 指定されたURLのドメインが一致するかを返す
+     *
+     * 戻り値：一致(true) 不一致(false)
+     *
+     * @param string $url
+     * @return boolean
+     */
+    function sfIsInternalDomain($url) {
+        $netURL = new Net_URL(HTTP_URL);
+        $host = $netURL->host;
+        if (!$host) return false;
+        $host = preg_quote($host, "#");
+        if (!preg_match("#^(http|https)://{$host}#i", $url)) return false;
+        return true;
+    }
 }
 ?>
Index: /branches/version-2_5-dev/data/class/pages/products/LC_Page_Products_Detail.php
===================================================================
--- /branches/version-2_5-dev/data/class/pages/products/LC_Page_Products_Detail.php	(revision 19944)
+++ /branches/version-2_5-dev/data/class/pages/products/LC_Page_Products_Detail.php	(revision 19947)
@@ -198,5 +198,7 @@
 
                     // カート「戻るボタン」用に保持
-                    $_SESSION['cart_referer_url'] = $_SERVER['HTTP_REFERER'];
+                    if (SC_Utils_Ex::sfIsInternalDomain($_SERVER['HTTP_REFERER'])) {
+                        $_SESSION['cart_referer_url'] = $_SERVER['HTTP_REFERER'];
+                    }
 
                     if (!empty($_POST['gmo_oneclick'])) {
Index: /branches/version-2_5-dev/data/class/pages/products/LC_Page_Products_List.php
===================================================================
--- /branches/version-2_5-dev/data/class/pages/products/LC_Page_Products_List.php	(revision 19944)
+++ /branches/version-2_5-dev/data/class/pages/products/LC_Page_Products_List.php	(revision 19947)
@@ -168,5 +168,7 @@
 
                 // カート「戻るボタン」用に保持
-                $_SESSION['cart_referer_url'] = $_SERVER['HTTP_REFERER'];
+                if (SC_Utils_Ex::sfIsInternalDomain($_SERVER['HTTP_REFERER'])) {
+                    $_SESSION['cart_referer_url'] = $_SERVER['HTTP_REFERER'];
+                }
 
                 SC_Response_Ex::sendRedirect(CART_URLPATH);
Index: /branches/version-2_5-dev/data/class/pages/cart/LC_Page_Cart.php
===================================================================
--- /branches/version-2_5-dev/data/class/pages/cart/LC_Page_Cart.php	(revision 19944)
+++ /branches/version-2_5-dev/data/class/pages/cart/LC_Page_Cart.php	(revision 19947)
@@ -196,5 +196,5 @@
             } else {
                 if (preg_match("/entry/", $_SERVER['HTTP_REFERER'])) {
-                    $_SESSION['cart_prev_url'] = URL_PATH . 'entry/kiyaku.php';
+                    $_SESSION['cart_prev_url'] = HTTPS_URL . 'entry/kiyaku.php';
                 } else {
                     $_SESSION['cart_prev_url'] = $_SERVER['HTTP_REFERER'];
@@ -202,5 +202,10 @@
             }
         }
-        $this->tpl_prev_url = $_SESSION['cart_prev_url'];
+        // 妥当性チェック
+        if (!SC_Utils_Ex::sfIsInternalDomain($_SESSION['cart_prev_url'])) {
+            $_SESSION['cart_prev_url'] = '';
+        }
+
+        $this->tpl_prev_url = (isset($_SESSION['cart_prev_url'])) ? $_SESSION['cart_prev_url'] : '';
     }
 
Index: /branches/version-2_5-dev/data/Smarty/templates/sphone/cart/index.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/sphone/cart/index.tpl	(revision 19945)
+++ /branches/version-2_5-dev/data/Smarty/templates/sphone/cart/index.tpl	(revision 19947)
@@ -167,5 +167,5 @@
                 <p>
                     <!--{if $tpl_prev_url != ""}-->
-                     <a href="<!--{$tpl_prev_url}-->" class="spbtn spbtn-medeum">
+                     <a href="<!--{$tpl_prev_url|escape}-->" class="spbtn spbtn-medeum">
                                     買い物を続ける</a>&nbsp;&nbsp;
                     <!--{/if}-->
Index: /branches/version-2_5-dev/data/Smarty/templates/default/cart/index.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/default/cart/index.tpl	(revision 19945)
+++ /branches/version-2_5-dev/data/Smarty/templates/default/cart/index.tpl	(revision 19947)
@@ -166,5 +166,5 @@
                 <p>
                     <!--{if $tpl_prev_url != ""}-->
-                        <a href="<!--{$tpl_prev_url}-->" onmouseover="chgImg('<!--{$TPL_DIR}-->img/button/btn_back_on.gif','back');" onmouseout="chgImg('<!--{$TPL_DIR}-->img/button/btn_back.gif','back');">
+                        <a href="<!--{$tpl_prev_url|escape}-->" onmouseover="chgImg('<!--{$TPL_DIR}-->img/button/btn_back_on.gif','back');" onmouseout="chgImg('<!--{$TPL_DIR}-->img/button/btn_back.gif','back');">
                             <img src="<!--{$TPL_DIR}-->img/button/btn_back.gif" width="150" height="30" alt="買い物を続ける" name="back" /></a>&nbsp;&nbsp;
                     <!--{/if}-->
Index: /branches/version-2_5-dev/data/Smarty/templates/mobile/cart/index.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/mobile/cart/index.tpl	(revision 19945)
+++ /branches/version-2_5-dev/data/Smarty/templates/mobile/cart/index.tpl	(revision 19947)
@@ -97,5 +97,5 @@
 
 <!--{if $tpl_prev_url != ""}-->
-    <a href="<!--{$tpl_prev_url}-->">[emoji:69]お買物を続ける</a>
+    <a href="<!--{$tpl_prev_url|escape}-->">[emoji:69]お買物を続ける</a>
 <!--{/if}-->
 <!--{/foreach}-->