From d419f430a9ff49e5ce72b0e655c8d216b004901a Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 23 Jun 2026 01:04:45 +0000
Subject: [PATCH] =?UTF-8?q?[KVE-20206-1176]XSS=20=EC=B7=A8=EC=95=BD?=
 =?UTF-8?q?=EC=A0=90=20-=20=EA=B2=B0=EC=A0=9C=20=EC=A0=84=20=EC=A3=BC?=
 =?UTF-8?q?=EB=AC=B8=20=EC=9E=84=EC=8B=9C=EB=8D=B0=EC=9D=B4=ED=84=B0=20?=
 =?UTF-8?q?=EC=A0=80=EC=9E=A5=20=EC=9A=94=EC=B2=AD=20=EC=B6=9C=EC=B2=98=20?=
 =?UTF-8?q?=EA=B2=80=EC=A6=9D=20=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- shop/ajax.orderdatasave.php에 check_request_origin() 적용하여
  외부 사이트발 자동 요청에 의한 임시 주문 데이터 교체 차단

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 shop/ajax.orderdatasave.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/shop/ajax.orderdatasave.php b/shop/ajax.orderdatasave.php
index ece05e3b6..11f6f0517 100644
--- a/shop/ajax.orderdatasave.php
+++ b/shop/ajax.orderdatasave.php
@@ -1,6 +1,9 @@
 <?php
 include_once('./_common.php');
 
+// 요청 출처 검증
+if (function_exists('check_request_origin')) check_request_origin(G5_SHOP_URL);
+
 if(empty($_POST))
     die('정보가 넘어오지 않았습니다.');