From 9869be59702566a8a1048019f3a36ae454ecf606 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Fri, 29 May 2026 06:30:29 +0000
Subject: [PATCH] =?UTF-8?q?[security]=20=ED=86=A0=EC=8A=A4=20=EA=B2=B0?=
 =?UTF-8?q?=EC=A0=9C=EC=B0=BD=20customerName=20=EC=B6=9C=EB=A0=A5=20?=
 =?UTF-8?q?=EC=8B=9C=20get=5Ftext=20=EC=9D=B8=EC=BD=94=EB=94=A9=20?=
 =?UTF-8?q?=EC=A0=81=EC=9A=A9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

토스페이먼츠 결제 요청 폼의 customerName hidden 필드에 주문자명
($od_name)이 인코딩 없이 출력되던 것을 get_text() 적용으로 정리.
직전 주문 필드 인코딩 처리와 동일한 맥락의 마무리.

hidden value 의 엔티티는 결제 SDK 가 값을 읽을 때 브라우저가
디코딩하므로 토스로 전달되는 구매자명에는 영향 없음.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 mobile/shop/toss/orderform.1.php | 2 +-
 mobile/shop/toss/orderform.2.php | 2 +-
 shop/toss/orderform.2.php        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/mobile/shop/toss/orderform.1.php b/mobile/shop/toss/orderform.1.php
index d3b6e9017..7c7207b44 100644
--- a/mobile/shop/toss/orderform.1.php
+++ b/mobile/shop/toss/orderform.1.php
@@ -6,7 +6,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
 <input type="hidden" name="method"    value="">
 <input type="hidden" name="orderId"    value="<?php echo isset($od_id) ? $od_id : ''; ?>">
 <input type="hidden" name="orderName"    value="<?php echo isset($goods) ? $goods : ''; ?>">
-<input type="hidden" name="customerName"    value="<?php echo isset($od_name) ? $od_name : ''; ?>">
+<input type="hidden" name="customerName"    value="<?php echo isset($od_name) ? get_text($od_name) : ''; ?>">
 <input type="hidden" name="customerEmail"    value="<?php echo isset($od_email) ? $od_email : ''; ?>">
 <input type="hidden" name="customerMobilePhone"    value="<?php echo isset($od_hp) ? $od_hp : ''; ?>">
 <input type="hidden" name="cardUseEscrow"    value="false">
diff --git a/mobile/shop/toss/orderform.2.php b/mobile/shop/toss/orderform.2.php
index 6587ed56b..0d67ed25f 100644
--- a/mobile/shop/toss/orderform.2.php
+++ b/mobile/shop/toss/orderform.2.php
@@ -5,7 +5,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
 <input type="hidden" name="method"    value="">
 <input type="hidden" name="orderId"    value="<?php echo isset($od_id) ? $od_id : ''; ?>">
 <input type="hidden" name="orderName"    value="<?php echo isset($goods) ? $goods : ''; ?>">
-<input type="hidden" name="customerName"    value="<?php echo isset($od_name) ? $od_name : ''; ?>">
+<input type="hidden" name="customerName"    value="<?php echo isset($od_name) ? get_text($od_name) : ''; ?>">
 <input type="hidden" name="customerEmail"    value="<?php echo isset($od_email) ? $od_email : ''; ?>">
 <input type="hidden" name="customerMobilePhone"    value="<?php echo isset($od_hp) ? $od_hp : ''; ?>">
 <input type="hidden" name="cardUseEscrow"    value="false">
diff --git a/shop/toss/orderform.2.php b/shop/toss/orderform.2.php
index 005383e1a..79a5ca92c 100644
--- a/shop/toss/orderform.2.php
+++ b/shop/toss/orderform.2.php
@@ -5,7 +5,7 @@ if (!defined("_GNUBOARD_")) exit; // 개별 페이지 접근 불가
 <input type="hidden" name="method"    value="">
 <input type="hidden" name="orderId"    value="<?php echo isset($od_id) ? $od_id : ''; ?>">
 <input type="hidden" name="orderName"    value="<?php echo isset($goods) ? $goods : ''; ?>">
-<input type="hidden" name="customerName"    value="<?php echo isset($od_name) ? $od_name : ''; ?>">
+<input type="hidden" name="customerName"    value="<?php echo isset($od_name) ? get_text($od_name) : ''; ?>">
 <input type="hidden" name="customerEmail"    value="<?php echo isset($od_email) ? $od_email : ''; ?>">
 <input type="hidden" name="customerMobilePhone"    value="<?php echo isset($od_hp) ? $od_hp : ''; ?>">
 <input type="hidden" name="cardUseEscrow"    value="false">