WooYun.org

function payment_balance()
    {
    	$urlStr  = '';
    	$user_id = intval($this->user['user_id']);		
    	$return['attach']     = IReq::get('attach');
     	$return['total_fee']  = IReq::get('total_fee');    	
    	$return['order_no']   = IReq::get('order_no');
    	$return['return_url'] = IReq::get('return_url');
    	$sign                 = IReq::get('sign');
    	if(stripos($return['order_no'],'recharge_') !== false)
    	{
    		IError::show(403,'余额支付方式不能用于在线充值');
    		exit;
    	}
    	if(floatval($return['total_fee']) <= 0 || $return['order_no'] == '' || $return['return_url'] == '')
    	{
    		IError::show(403,'支付参数不正确');
    	}
    	else
    	{
    		$paymentDB  = new IModel('payment');
    		$paymentRow = $paymentDB->getObj('class_name = "balance" ');
    		$pkey       = Payment::getConfigParam($paymentRow['id'],'M_PartnerKey');
    			
    		echo gettype($pkey);    	 
	    	//md5校验
	    	ksort($return);
			foreach($return as $key => $val)
			{		
				$urlStr .= $key.'='.urlencode($val).'&';
			}
			$urlStr .= $user_id.$pkey;	
			if($sign != md5($urlStr))         //********问题点在这里！！！*******
			{
				IError::show(403,'数据校验不正确');
			}
			else
			{
		    	$memberObj = new IModel('member');
		    	$memberRow = $memberObj->getObj('user_id = '.$user_id);
		    	if(empty($memberRow))
		    	{
		    		IError::show(403,'用户信息不存在');
		    		exit;
		    	}
		    	else if($memberRow['balance'] < $return['total_fee'])
		    	{
		    		IError::show(403,'账户余额不足');
		    		exit;
		    	}
		    	else
		    	{
		    		$orderObj = new IModel('order');
		    		$orderRow = $orderObj->getObj('order_no  = "'.IFilter::act($return['order_no']).'" and pay_status = 0 and user_id = '.$user_id);
		    		if(empty($orderRow))
		    		{
		    			IError::show(403,'订单已经被处理过，请查看订单状态');
		    			exit;
		    		}
					$dataArray  = array('balance' => 'balance - '.IFilter::act($return['total_fee']));
					$memberObj->setData($dataArray);
			    	$is_success = $memberObj->update('user_id = '.$user_id,'balance');
			    	if($is_success)
			    	{
			    		$return['is_success'] = 'T';
			    	}
			    	else
			    	{
			    		$return['is_success'] = 'F';
			    	}
			    	ksort($return);
			    	//返还的URL地址
					$responseUrl = '';
					foreach($return as $key => $val)
					{
						$responseUrl .= $key.'='.urlencode($val).'&';
					}
					$nextUrl = urldecode($return['return_url']);
					if(stripos($nextUrl,'?') === false)
					{
						$return_url = $nextUrl.'?'.$responseUrl;
					}
					else
					{
						$return_url = $nextUrl.'&'.$responseUrl;
					}
					//计算要发送的md5校验
					$urlStrMD5  = md5($responseUrl.$user_id.$pkey);
					//拼接进返还的URL中
					$return_url.= 'sign='.$urlStrMD5;
			    	header('location:'.$return_url);
		    	}
			}
    	}
    }
}

<?php
	$urlStr  = '';
	$pkey = '';
	$user_id= 1;
	$return['attach']     = "1";
	$return['total_fee']  = '0.01';
	$return['order_no']   = '20150207214421724325';
	$return['return_url'] = urldecode("http%3A%2F%2F192.168.0.107%2Findex.php%3Fcontroller%3Dblock%26action%3Dcallback%26_id%3D1");
	ksort($return);
	foreach($return as $key => $val)
		{		
			$urlStr .= $key.'='.urlencode($val).'&';
		}
	$urlStr .= $user_id.$pkey;	
	echo md5($urlStr);
?>