WooYun.org

//余额支付方式，服务器端处理
    public function pay_balance(){
        
        $sign = Req::post('sign');//从post中获取sign
        $args = Req::post();
        unset($args['sign']);
        $total_fee = Req::post('total_fee');//直接从post获取
        $attach = Filter::int(Req::post('attach'));
        $return['attach']     = Req::post('attach');
        $return['total_fee']  = floatval(Req::post('total_fee'));
        $return['order_no']   = Req::post('order_no');
        $return['return_url'] = Req::post('return_url');
。。。
        if(floatval($return['total_fee']) < 0 || $return['order_no'] == '' || $return['return_url'] == '')
        {
            $msg = array('type'=>'fail','msg'=>'支付参数不正确！');
            $this->redirect('/index/msg',false,$msg);
        }
        else{//订单正常的话，就开始支付了
            $payment = new Payment($attach);//attach为孔的时候，$payment也会为空
            $paymentInfo = $payment->getPayment();//paymentInfo为空
            $pay_balance = new pay_balance();
            $filter_param = $pay_balance->filterParam($args);
            //对待签名参数数组排序
            $para_sort = $pay_balance->argSort($filter_param);
            
            $mysign = $pay_balance->buildSign($para_sort,$paymentInfo['partner_key']);//最后$paymentInfo['partner_key']也为空，所以无所谓数据库里key是什么了，直接不用他
            if($mysign == $sign)  //sign是post过来的，绕过
            {
                $user_id = $this->user['id'];
                $model = new Model("customer");
                $customer = $model->where("user_id=".$user_id)->find();
                if($customer['balance']>=$total_fee){
                    $order = $model->table("order")->where("order_no='".Filter::sql($return['order_no'])."' and user_id=".$user_id)->find();
                    if($order){
                        if($order['pay_status']==0){
                            $flag = $model->table("customer")->where("user_id=".$user_id)->data(array('balance'=>"`balance`-".$total_fee))->update();  //total_fee进入查询
                            $return['order_status'] = 'TINY_SECCESS';
。。。。

public function buildSign($sort_para,$key,$sign_type = "MD5") 
{ //把数组所有元素，按照“参数=参数值”的模式用“&”字符拼接成字符串 
$prestr = $this->createLinkstring($sort_para); 
//把拼接后的字符串再与安全校验码直接连接起来 
$prestr = $prestr.$key;  //key为空
$mysgin = md5($prestr); 
return $mysgin; 
}