first

application/api/controller/HuiPay.php

@@ -259,8 +259,7 @@ class HuiPay extends Api
 
     /**
      * 支付回调
-     */
-    /**
+     *
      * @param Request $request
      * @return string
      * @throws \think\db\exception\DataNotFoundException
@@ -280,6 +279,13 @@ class HuiPay extends Api
             'resp_data' => $resp_data,
         ]);
 
+        // 校验签名
+        $huiPay = new PayUtil();
+        if (!$huiPay->checkSign($params['sign'],$resp_data)){
+            LogUtil::info('签名校验失败', self::LOG_MODULE, __FUNCTION__);
+            return self::response201('签名校验失败');
+        }
+
         // 校验回调信息
         if (empty($params['resp_code']) || $params['resp_code'] != '00000000' || empty($resp_data['req_seq_id'])) {
             LogUtil::info('回调信息有误', self::LOG_MODULE, __FUNCTION__, "resp_code error");

application/utils/PayUtil.php

@@ -13,6 +13,7 @@ class PayUtil
         'sys_id' => '6666000145960408',
         'product_id' => 'YMFZS',
         'rsaPrivateKey' => 'MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCWjQ+o6u8TgOQETBJs/OebvIZMLZ7J0kyAfyKXECl44R2EvfOWTNhtnDc6ZuaXegBoNo8u+skVxzy8k+unoBNghpct/BCaXc2op0F/3/3kc+Y5I74PX2lF//4MvCNP1ia+ykfHJkdnlfz2W8c2Tc1L311PPQ4dsB0c6mup/NjV1DX0WkAXWsMCHSss1iRLLb5mqVJtCkSbPmuSZV+bm+JASsD5goo32245HxqNbjKm/fi+OfZ9ONKl0wT+Ch5SQEbQAr61yhIyHdlqc7o7xupbYFKjT4ez8Y3VU4U1uKu57x2cKI0ETwsASALDqgvYS6mFjJFC3LcEjskyAAi1a+HNAgMBAAECggEABvS1iIRyT2BhKKGrKEX3HYb0XYiuEX0Z88Xr/zbL873S81MjcgpS5Z2WH6ipds44PphmvTDxIYR3Fe9vr+sBejA9w+4lhjxXSDeSGypqPKfuNy2jlmo+HvHY9xWqPAIVADOwZU8rdWnEqk1LQwMNPTgww3x6rnx4m+Fo4A3Cpv54vrK7f4fTUaaD8gHRFkSkkCvNJYEZdd5OLqCKwuAwL6vxwhX/tBuNa+zltw+9fV+FCnaBlkVncU8j8os7FBoT7MTbMoijDG78b1feUofuWUmn4A+lb/hH9R2zTNaTlGzTdyj/hybkPmz3TMPsymzIxpr239z8HZvVfnBiScFUAQKBgQDhj/mGKM7tkYuR+gRgBwlvtsPyru3DmaqabkweBz6nL9c7F5bVrLuoSZRkZTEfwU/lHDpRPqP6elLdv7NQvPt6deXZIt+LqXHcFr8k/l0xhT4EaUcYjVyj0rVfLrjM8y4yVruDEJm9d3PjYoe4vF2+TSZ3gXqwEOCflVB2Xk9eDQKBgQCq3dPb5Xj+O/8IaiGnLP/iED7hJ27EupR9MbvNS760e03dTHePKnfoeVJve06cx380RLM2mEicFUz7ee1+Kvu/79v4OabBn9WDDFMME0nb52FyRDf9jkG6jB2bKP8olVhufCvhsjxJXXCNepAZwi3m4CgWz5km3AMe77f276liwQKBgGkY9GKWURRQZH+3xqIXpUXwGozRBOfGib869Sxoo8Cygc5+x0D4ItfesM22eJUbNWbDKEkCrtTeeg3obFyKMYJ1vIrXvOEOKocp8hYCjtmsA6F6jC3cb/XFD80xr9mO1U+PKf9/lKK7LbwdBLAG1Ib+25WDNu8ibgbtQ3hjqQdhAoGBAJMHcyjDm4vZgKly+iZq2H1k0VbZob1zeBcK1rnfteiEOgp1pGPzfV70FvWLO6g5GsKVY0lVXRXCVo4G61AoGJ2e/r/ojBANQ6MS1duMNYAe6IF1JmDvKqwlqcw8SORZLtFT1EbQIoRW/WUg1CL2Lp1+wcBvPzBrHdxfFwRMUouBAoGBAKusKZFR5bqj5NDb3Uli3D0H48PxTOq5iNvkG9L/wUfUTV1p1e0bnQ+ViEmh6LdLEuvVnClDTFuyaxFe3mp0lREcPYsdk4sYXkBvTO5B7CkoVtoNLPZxfYEDRkDbCQ9LniE155qP0ikEhf4pQRB2RNuC0DfO2O5uoYXdp+uFiuNt',
+        'huiRsaPublicKey' => 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkA7CU0t1vIlnRC8vT2pD2CiSUb5KpVI2lOzHaNlxAQyFRfTfe4xAFw2XMxYvv4f2jgWlQwYTC13+m9aboQglzJtw7VXtw4G8I5DEDnYOiU2Z2vC/TaRFw3OLICk7H8WuWKN6Rn2iiVsauh+Jy31G9MOlUbFbIQjfw1J0NIbscbUsvCwUrc1DG3onM1aFTyFjTTmLYw7SjCkX7T4SKaBfP6Nqn87d8fkrcP6ruXHt4Zmf6xAFcTBuwpw9FRjzHn4bpxDatFleO9KFqHoBTDe0EGWHWhmShG7Mn1ubAGWJ/OUe9CLEOKVSnNYtR7MFlhoO+DmYlz5iSy7lYWmS6sTpGwIDAQAB',
     ];
 
     public function __construct()
@@ -61,6 +62,11 @@ class PayUtil
         return $this->sha_with_rsa_sign($post_data, $this->config['rsaPrivateKey']);
     }
 
+    public function checkSign($signature, $data)
+    {
+        return $this->verifySign_sort($signature,$data,$this->config['huiRsaPublicKey']);
+    }
+
     /**
      * 私钥加签（对数据源排序），可用于 V2 版本接口数据加签
      *
@@ -82,6 +88,22 @@ class PayUtil
         }
     }
 
+    /**
+     * 汇付公钥验签（对数据源排序），可用于 V2 版本接口返回数据验签
+     *
+     * @param string $signature 签文
+     * @param array $data 原数据(array)
+     * @param string $rsaPublicKey 公钥
+     * @param int $alg 默认 OPENSSL_ALGO_SHA256
+     * @return false|int 验证结果：成功/失败
+     */
+    private function verifySign_sort($signature, $data, $rsaPublicKey, $alg = OPENSSL_ALGO_SHA256)
+    {
+        $key = "-----BEGIN PUBLIC KEY-----\n" . wordwrap($rsaPublicKey, 64, "\n", true) . "\n-----END PUBLIC KEY-----";
+        ksort($data);
+        return openssl_verify(json_encode($data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE), base64_decode($signature), $key, $alg);
+    }
+
     private function success($message = '', $data = [])
     {
         $this->message = $message;