From 43f626885e46330d00fda981b112c14b00b5c827 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Fri, 24 Jul 2026 01:33:23 +0000
Subject: [PATCH] =?UTF-8?q?[KVE-2026-1638]=20=EC=87=BC=ED=95=91=EB=AA=B0?=
 =?UTF-8?q?=20=EC=BF=A0=ED=8F=B0=20=EC=A4=91=EB=B3=B5=EC=A0=81=EC=9A=A9=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit 88bfddd0e83353c15c424549b594b8f36593220f)
---
 mobile/shop/orderformupdate.php | 12 ++++++++++++
 shop/orderformupdate.php        | 12 ++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/mobile/shop/orderformupdate.php b/mobile/shop/orderformupdate.php
index cab00b88d..b98e97512 100644
--- a/mobile/shop/orderformupdate.php
+++ b/mobile/shop/orderformupdate.php
@@ -145,6 +145,11 @@ if($is_member) {
     for($i=0; $i<$it_cp_cnt; $i++) {
         $cid = isset($_POST['cp_id'][$i]) ? safe_replace_regex($_POST['cp_id'][$i], 'cp_id') : '';
         $it_id = isset($_POST['it_id'][$i]) ? safe_replace_regex($_POST['it_id'][$i], 'it_id') : '';
+
+        // 한 상품에는 상품쿠폰 하나만 적용 (동일 상품 반복 전송 무시)
+        if(isset($arr_it_cp_prc[$it_id]))
+            continue;
+
         $sql = " select cp_id, cp_method, cp_target, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
                     from {$g5['g5_shop_coupon_table']}
                     where cp_id = '$cid'
@@ -822,11 +827,16 @@ $od_memo = nl2br(htmlspecialchars2(stripslashes($od_memo))) . "&nbsp;";
 $coupon_duplicate = false;
 if($is_member) {
     $it_cp_cnt = (isset($_POST['cp_id']) && is_array($_POST['cp_id'])) ? count($_POST['cp_id']) : 0;
+    $arr_it_cp_logged = array();
     for($i=0; $i<$it_cp_cnt; $i++) {
         $cid = isset($_POST['cp_id'][$i]) ? safe_replace_regex($_POST['cp_id'][$i], 'cp_id') : '';
         $cp_it_id = isset($_POST['it_id'][$i]) ? safe_replace_regex($_POST['it_id'][$i], 'it_id') : '';
         $cp_prc = isset($arr_it_cp_prc[$cp_it_id]) ? (int) $arr_it_cp_prc[$cp_it_id] : 0;
 
+        // 한 상품에는 상품쿠폰 하나만 기록 (동일 상품 반복 전송 무시)
+        if(isset($arr_it_cp_logged[$cp_it_id]))
+            continue;
+
         if(trim($cid)) {
             // 쿠폰 이중사용 방지: INSERT 직전 재확인
             if(is_used_coupon($member['mb_id'], $cid)) {
@@ -848,6 +858,8 @@ if($is_member) {
                 $coupon_duplicate = true;
                 break;
             }
+
+            $arr_it_cp_logged[$cp_it_id] = true;
         }
 
         // 쿠폰사용금액 cart에 기록
diff --git a/shop/orderformupdate.php b/shop/orderformupdate.php
index 28d89af85..1850b4ee9 100644
--- a/shop/orderformupdate.php
+++ b/shop/orderformupdate.php
@@ -120,6 +120,11 @@ if($is_member) {
     for($i=0; $i<$it_cp_cnt; $i++) {
         $cid = isset($_POST['cp_id'][$i]) ? safe_replace_regex($_POST['cp_id'][$i], 'cp_id') : '';
         $it_id = isset($_POST['it_id'][$i]) ? safe_replace_regex($_POST['it_id'][$i], 'it_id') : '';
+
+        // 한 상품에는 상품쿠폰 하나만 적용 (동일 상품 반복 전송 무시)
+        if(isset($arr_it_cp_prc[$it_id]))
+            continue;
+
         $sql = " select cp_id, cp_method, cp_target, cp_type, cp_price, cp_trunc, cp_minimum, cp_maximum
                     from {$g5['g5_shop_coupon_table']}
                     where cp_id = '$cid'
@@ -774,11 +779,16 @@ $od_memo = nl2br(htmlspecialchars2(stripslashes($od_memo))) . "&nbsp;";
 $coupon_duplicate = false;
 if($is_member) {
     $it_cp_cnt = (isset($_POST['cp_id']) && is_array($_POST['cp_id'])) ? count($_POST['cp_id']) : 0;
+    $arr_it_cp_logged = array();
     for($i=0; $i<$it_cp_cnt; $i++) {
         $cid = isset($_POST['cp_id'][$i]) ? safe_replace_regex($_POST['cp_id'][$i], 'cp_id') : '';
         $cp_it_id = isset($_POST['it_id'][$i]) ? safe_replace_regex($_POST['it_id'][$i], 'it_id') : '';
         $cp_prc = isset($arr_it_cp_prc[$cp_it_id]) ? (int) $arr_it_cp_prc[$cp_it_id] : 0;
 
+        // 한 상품에는 상품쿠폰 하나만 기록 (동일 상품 반복 전송 무시)
+        if(isset($arr_it_cp_logged[$cp_it_id]))
+            continue;
+
         if(trim($cid)) {
             // 쿠폰 이중사용 방지: INSERT 직전 재확인
             if(is_used_coupon($member['mb_id'], $cid)) {
@@ -800,6 +810,8 @@ if($is_member) {
                 $coupon_duplicate = true;
                 break;
             }
+
+            $arr_it_cp_logged[$cp_it_id] = true;
         }
 
         // 쿠폰사용금액 cart에 기록