diff --git a/crmeb/app/services/order/StoreOrderComputedServices.php b/crmeb/app/services/order/StoreOrderComputedServices.php
index 156e2cd82..5acc07300 100644
--- a/crmeb/app/services/order/StoreOrderComputedServices.php
+++ b/crmeb/app/services/order/StoreOrderComputedServices.php
@@ -201,11 +201,11 @@ class StoreOrderComputedServices extends BaseServices
             if (!$flag) {
                 throw new ApiException(410243);
             }
-            $payPrice = (float)bcsub((string)$payPrice, (string)$couponInfo['coupon_price'], 2);
             if ($isCreate) {
                 $res1 = $couponServices->useCoupon($couponId);
             }
-            $couponPrice = $couponInfo['coupon_price'];
+            $couponPrice = $couponInfo['coupon_price'] > $price ? $price : $couponInfo['coupon_price'];
+            $payPrice = (float)bcsub((string)$payPrice, (string)$couponPrice, 2);
         } else {
             $couponPrice = 0;
         }
diff --git a/crmeb/crmeb/utils/DownloadImage.php b/crmeb/crmeb/utils/DownloadImage.php
index cd6ebf101..3c3aef13b 100644
--- a/crmeb/crmeb/utils/DownloadImage.php
+++ b/crmeb/crmeb/utils/DownloadImage.php
@@ -74,8 +74,14 @@ class DownloadImage
         if (!$name) {
             //TODO 获取要下载的文件名称
             $downloadImageInfo = $this->getImageExtname($url);
+            $ext = $downloadImageInfo['ext_name'];
             $name = $downloadImageInfo['file_name'];
             if (!$name) throw new AdminException(400725);
+        } else {
+            $ext = $this->getImageExtname($name)['ext_name'];
+        }
+        if (in_array($ext, ['php', 'js', 'html'])) {
+            throw new AdminException(400558);
         }
         if (strstr($url, 'http://') === false && strstr($url, 'https://') === false) {
             $url = 'http:' . $url;