From afd8b35423e06de6aa3a93365a2f9a5b6980c1f2 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 2 Jun 2026 08:22:03 +0000
Subject: [PATCH] =?UTF-8?q?SMS=20=ED=9A=8C=EC=9B=90=EC=A0=95=EB=B3=B4=20?=
 =?UTF-8?q?=EC=97=85=EB=8D=B0=EC=9D=B4=ED=8A=B8=20=ED=86=A0=ED=81=B0=20?=
 =?UTF-8?q?=EB=B0=A9=EC=8B=9D=20=EB=B6=88=EC=9D=BC=EC=B9=98=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

member_update.php 가 get_token()(HMAC) 으로 발급한 토큰을
member_update_run.php 가 check_admin_token()(세션) 으로 검증해
항상 불일치 → 오류 HTML 반환으로 AJAX JSON 파싱이 실패하던 문제 수정.

sms_admin 의 다른 _run 들과 동일하게 검증측(check_admin_token)은
유지하고, 실행 시 ajax.token.php 로 세션 토큰을 발급받아 본 요청에
사용하도록 변경. check_admin_token 의 1회용 소거 특성상 재실행에도
견고함.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 adm/sms_admin/member_update.php | 44 ++++++++++++++++++++++-----------
 1 file changed, 30 insertions(+), 14 deletions(-)

diff --git a/adm/sms_admin/member_update.php b/adm/sms_admin/member_update.php
index 6b6b5caa7..baae01d76 100644
--- a/adm/sms_admin/member_update.php
+++ b/adm/sms_admin/member_update.php
@@ -4,8 +4,6 @@ include_once("./_common.php");
 
 auth_check_menu($auth, $sub_menu, "r");
 
-$token = get_token();
-
 $g5['title'] = "회원정보 업데이트";
 
 include_once(G5_ADMIN_PATH.'/admin.head.php');
@@ -39,21 +37,39 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
     $( "#mb_update_form" ).submit(function( e ) {
         e.preventDefault();
         $("#res_msg").html('업데이트 중입니다. 잠시만 기다려 주십시오...');
-        var params = { mtype : 'json', token : '<?php echo $token; ?>' };
+        var action = $(this).attr("action");
         $.ajax({
-            url: $(this).attr("action"),
-            cache:false,
-            timeout : 30000,
-            dataType:"json",
-            data:params,
-            success: function(data) {
-                if(data.error){
-                    alert( data.error );
+            url: '<?php echo G5_ADMIN_URL; ?>/ajax.token.php',
+            type: 'POST',
+            dataType: 'json',
+            data: { admin_csrf_token_key: '<?php echo admin_csrf_token_key(1); ?>' },
+            success: function(tokenData) {
+                if(tokenData.error){
+                    alert(tokenData.error);
                     $("#res_msg").html("");
-                } else {
-                    $("#datetime").html( data.datetime );
-                    $("#res_msg").html( data.res_msg );
+                    return;
                 }
+                $.ajax({
+                    url: action,
+                    type: 'POST',
+                    cache:false,
+                    timeout : 30000,
+                    dataType:"json",
+                    data: { mtype : 'json', token : tokenData.token },
+                    success: function(data) {
+                        if(data.error){
+                            alert( data.error );
+                            $("#res_msg").html("");
+                        } else {
+                            $("#datetime").html( data.datetime );
+                            $("#res_msg").html( data.res_msg );
+                        }
+                    },
+                    error: function (xhr, ajaxOptions, thrownError) {
+                        alert(xhr.status);
+                        alert(thrownError);
+                    }
+                });
             },
             error: function (xhr, ajaxOptions, thrownError) {
                 alert(xhr.status);