From 8797c8cd968c739bb1b80e57a213929d55eee381 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Fri, 14 Jun 2019 09:34:55 +0900
Subject: [PATCH] =?UTF-8?q?KVE-2019-0991=20=EC=98=81=EC=B9=B4=ED=8A=B8Purc?=
 =?UTF-8?q?hase=20Bypass?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/shop_admin/couponformupdate.php     | 4 ++++
 adm/shop_admin/couponzoneformupdate.php | 4 ++++
 mobile/shop/orderformupdate.php         | 2 +-
 shop/orderformupdate.php                | 2 +-
 4 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/adm/shop_admin/couponformupdate.php b/adm/shop_admin/couponformupdate.php
index 96738f9bb..295dc8964 100644
--- a/adm/shop_admin/couponformupdate.php
+++ b/adm/shop_admin/couponformupdate.php
@@ -55,6 +55,10 @@ if(!$_POST['cp_price']) {
         alert('할인금액을 입력해 주십시오.');
 }
 
+if( (int) $_POST['cp_price'] < 0 ){
+    alert('할인금액 또는 할인비율은 음수를 입력할수 없습니다.');
+}
+
 if($_POST['cp_type'] && ($_POST['cp_price'] < 1 || $_POST['cp_price'] > 99))
     alert('할인비율을은 1과 99사이 값으로 입력해 주십시오.');
 
diff --git a/adm/shop_admin/couponzoneformupdate.php b/adm/shop_admin/couponzoneformupdate.php
index fbaa7cbf7..e14ecc213 100644
--- a/adm/shop_admin/couponzoneformupdate.php
+++ b/adm/shop_admin/couponzoneformupdate.php
@@ -73,6 +73,10 @@ if(!$_POST['cp_price']) {
         alert('할인금액을 입력해 주십시오.');
 }
 
+if( (int) $_POST['cp_price'] < 0 ){
+    alert('할인금액 또는 할인비율은 음수를 입력할수 없습니다.');
+}
+
 if($_POST['cp_type'] && ($_POST['cp_price'] < 1 || $_POST['cp_price'] > 99))
     alert('할인비율을은 1과 99사이 값으로 입력해 주십시오.');
 
diff --git a/mobile/shop/orderformupdate.php b/mobile/shop/orderformupdate.php
index f196b497d..8c6100eb3 100644
--- a/mobile/shop/orderformupdate.php
+++ b/mobile/shop/orderformupdate.php
@@ -78,7 +78,7 @@ if ($error != "")
 $i_price     = (int)$_POST['od_price'];
 $i_send_cost  = (int)$_POST['od_send_cost'];
 $i_send_cost2  = (int)$_POST['od_send_cost2'];
-$i_send_coupon  = (int)$_POST['od_send_coupon'];
+$i_send_coupon  = abs((int)$_POST['od_send_coupon']);
 $i_temp_point = (int)$_POST['od_temp_point'];
 
 
diff --git a/shop/orderformupdate.php b/shop/orderformupdate.php
index 84ab6155a..c97b0ea05 100644
--- a/shop/orderformupdate.php
+++ b/shop/orderformupdate.php
@@ -56,7 +56,7 @@ if ($error != "")
 $i_price     = (int)$_POST['od_price'];
 $i_send_cost  = (int)$_POST['od_send_cost'];
 $i_send_cost2  = (int)$_POST['od_send_cost2'];
-$i_send_coupon  = (int)$_POST['od_send_coupon'];
+$i_send_coupon  = abs((int)$_POST['od_send_coupon']);
 $i_temp_point = (int)$_POST['od_temp_point'];