From 670ed19c398b1e91d47f54f06487e0970fb94e68 Mon Sep 17 00:00:00 2001
From: aozhiwei <aozhiwei@kingsome.cn>
Date: Sat, 29 Jan 2022 14:28:26 +0800
Subject: [PATCH] 1

---
 third_party/phpcommon                        |  2 +-
 webapp/controller/MarketController.class.php | 15 ++++++++++++++-
 webapp/models/BuyRecord.php                  |  4 ++--
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/third_party/phpcommon b/third_party/phpcommon
index 195376f8..9f17c495 160000
--- a/third_party/phpcommon
+++ b/third_party/phpcommon
@@ -1 +1 @@
-Subproject commit 195376f820d8882e8fe10c14f219cebcfd908dcf
+Subproject commit 9f17c495ec483929d1f6e206e016b20f37dd6686
diff --git a/webapp/controller/MarketController.class.php b/webapp/controller/MarketController.class.php
index 504113b6..d70418ed 100644
--- a/webapp/controller/MarketController.class.php
+++ b/webapp/controller/MarketController.class.php
@@ -172,6 +172,15 @@ class MarketController extends BaseController {
             myself()->_rspErr(500, 'not white list user');
             return;
         }
+        $itemMeta = mt\Item::get($itemId);
+        if (!$itemMeta ||
+            empty($itemMeta['nft_image_id']) ||
+            $itemMeta['nft_image_id'] <= 0 ||
+            $itemMeta['nft_image_id'] > 999
+        ) {
+            myself()->_rspErr(500, 'server internal error');
+            return;
+        }
         $currencyMeta = mt\Currency::get($goodsMeta['currency_id']);
         if (!$currencyMeta || $currencyMeta['address'] != $paymentTokenAddress) {
             myself()->_rspErr(500, 'currency error');
@@ -198,7 +207,11 @@ class MarketController extends BaseController {
             return;
             }*/
 
-        $orderId = BuyRecord::genOrderId($gameId, $funcId, myself()->_getNowTime(), $buyerAddress);
+        $orderId = BuyRecord::genOrderId($gameId,
+                                         $funcId,
+                                         myself()->_getNowTime(),
+                                         $itemMeta['nft_image_id'],
+                                         $buyerAddress);
         $tokenId = $orderId;
         SqlHelper::insert(
             myself()->_getMarketMysql(),
diff --git a/webapp/models/BuyRecord.php b/webapp/models/BuyRecord.php
index 539d09d0..817f84e8 100644
--- a/webapp/models/BuyRecord.php
+++ b/webapp/models/BuyRecord.php
@@ -10,7 +10,7 @@ use phpcommon\SqlHelper;
 
 class BuyRecord extends BaseModel {
 
-    public static function genOrderId($gameId, $funcId, $time, $buyerAddress)
+    public static function genOrderId($gameId, $funcId, $time, $imgIdx, $buyerAddress)
     {
         SqlHelper::insert
             (myself()->_getMarketMysql(),
@@ -29,7 +29,7 @@ class BuyRecord extends BaseModel {
                 'errmsg' => 'server internal error'
             )));
         }
-        $orderId = phpcommon\genOrderId($gameId, $funcId, $time, $lastIdx);
+        $orderId = phpcommon\genOrderId($gameId, $funcId, $time, $lastIdx, $imgIdx);
         if (!phpcommon\isValidOrderId($orderId)) {
             die(json_encode(array(
                 'errcode' => 500,