From 0afffdcf98d6de08a94b042ca97a41d0b54a1434 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=90=B4=E6=98=8A=E5=A4=A9?= <442384644@qq.com>
Date: Tue, 29 Nov 2022 15:02:47 +0800
Subject: [PATCH] =?UTF-8?q?=E3=80=90=E7=A8=8B=E5=BA=8F=E7=9B=AE=E5=BD=95?=
 =?UTF-8?q?=E3=80=91=E4=BC=98=E5=8C=96=E7=94=9F=E6=88=90=E5=9B=BE=E7=89=87?=
 =?UTF-8?q?=E6=B5=81=E7=A8=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crmeb/app/services/order/StoreOrderComputedServices.php | 4 ++--
 crmeb/crmeb/utils/DownloadImage.php                     | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/crmeb/app/services/order/StoreOrderComputedServices.php b/crmeb/app/services/order/StoreOrderComputedServices.php
index 156e2cd82..5acc07300 100644
--- a/crmeb/app/services/order/StoreOrderComputedServices.php
+++ b/crmeb/app/services/order/StoreOrderComputedServices.php
@@ -201,11 +201,11 @@ class StoreOrderComputedServices extends BaseServices
             if (!$flag) {
                 throw new ApiException(410243);
             }
-            $payPrice = (float)bcsub((string)$payPrice, (string)$couponInfo['coupon_price'], 2);
             if ($isCreate) {
                 $res1 = $couponServices->useCoupon($couponId);
             }
-            $couponPrice = $couponInfo['coupon_price'];
+            $couponPrice = $couponInfo['coupon_price'] > $price ? $price : $couponInfo['coupon_price'];
+            $payPrice = (float)bcsub((string)$payPrice, (string)$couponPrice, 2);
         } else {
             $couponPrice = 0;
         }
diff --git a/crmeb/crmeb/utils/DownloadImage.php b/crmeb/crmeb/utils/DownloadImage.php
index cd6ebf101..3c3aef13b 100644
--- a/crmeb/crmeb/utils/DownloadImage.php
+++ b/crmeb/crmeb/utils/DownloadImage.php
@@ -74,8 +74,14 @@ class DownloadImage
         if (!$name) {
             //TODO 获取要下载的文件名称
             $downloadImageInfo = $this->getImageExtname($url);
+            $ext = $downloadImageInfo['ext_name'];
             $name = $downloadImageInfo['file_name'];
             if (!$name) throw new AdminException(400725);
+        } else {
+            $ext = $this->getImageExtname($name)['ext_name'];
+        }
+        if (in_array($ext, ['php', 'js', 'html'])) {
+            throw new AdminException(400558);
         }
         if (strstr($url, 'http://') === false && strstr($url, 'https://') === false) {
             $url = 'http:' . $url;