From 4049c6c164cc664ffcc4d9c3eac0894bca9ae058 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Fri, 3 Jul 2026 09:25:15 +0000
Subject: [PATCH] =?UTF-8?q?[KVE-1524]=20=EC=A3=BC=EB=AC=B8=20=EC=83=81?=
 =?UTF-8?q?=ED=83=9C=EB=B3=80=EA=B2=BD=20=EA=B4=80=EB=A6=AC=EC=9E=90=20?=
 =?UTF-8?q?=EC=97=94=EB=93=9C=ED=8F=AC=EC=9D=B8=ED=8A=B8=EC=97=90=20?=
 =?UTF-8?q?=EB=A9=94=EB=89=B4=20=EA=B6=8C=ED=95=9C=20=EA=B2=80=EC=A6=9D=20?=
 =?UTF-8?q?=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/shop_admin/orderformupdate.php | 2 ++
 adm/shop_admin/orderlistdelete.php | 2 ++
 adm/shop_admin/orderlistupdate.php | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/adm/shop_admin/orderformupdate.php b/adm/shop_admin/orderformupdate.php
index 9c1a637d0..e57d6ff37 100644
--- a/adm/shop_admin/orderformupdate.php
+++ b/adm/shop_admin/orderformupdate.php
@@ -2,6 +2,8 @@
 $sub_menu = '400400';
 include_once('./_common.php');
 
+auth_check_menu($auth, $sub_menu, "w");
+
 check_admin_token();
 
 $od_shop_memo = isset($_POST['od_shop_memo']) ? addslashes(strip_tags(stripslashes($_POST['od_shop_memo']))) : '';
diff --git a/adm/shop_admin/orderlistdelete.php b/adm/shop_admin/orderlistdelete.php
index 3a0f9e62f..81009f757 100644
--- a/adm/shop_admin/orderlistdelete.php
+++ b/adm/shop_admin/orderlistdelete.php
@@ -4,6 +4,8 @@ include_once('./_common.php');
 
 //print_r2($_POST); exit;
 
+auth_check_menu($auth, $sub_menu, "d");
+
 check_admin_token();
 
 $count_post_chk = (isset($_POST['chk']) && is_array($_POST['chk'])) ? count($_POST['chk']) : 0;
diff --git a/adm/shop_admin/orderlistupdate.php b/adm/shop_admin/orderlistupdate.php
index 20929a3b1..c7b6c89b4 100644
--- a/adm/shop_admin/orderlistupdate.php
+++ b/adm/shop_admin/orderlistupdate.php
@@ -4,6 +4,8 @@ include_once('./_common.php');
 include_once('./admin.shop.lib.php');
 include_once(G5_LIB_PATH.'/mailer.lib.php');
 
+auth_check_menu($auth, $sub_menu, "w");
+
 check_admin_token();
 
 define("_ORDERMAIL_", true);