WooYun.org

/api/tenpay/return_url.php


require_once(dirname(dirname(dirname(__FILE__)))."/data/db.config.php");


require_once(dirname(dirname(dirname(__FILE__)))."/include/mysql.class.php");


$db = new mysql($db_config['dbhost'], $db_config['dbuser'], $db_config['dbpass'], $db_config['dbname'], ALL_PS, $db_config['charset']);





/* 密钥 */


$key =$tenpay[sy_tenpaycode];


//密钥没有定义


=========


tenpay_data.php


<?php


/*


 * Created on 2012


 * Link for shyflc@**.**.**.**


 * This PHPYun.Rencai System Powered by PHPY**.**.**.**


 */


$tenpaydata=array("sy_weburl"=>"http://**.**.**.**","sy_tenpayid"=>"","sy_tenpaycode"=>"")//没有定义KEY 所以是空~~


;


?>


=========


/* 创建支付应答对象 */


$resHandler = new PayResponseHandler();


$resHandler->setKey($key);//还是key没有初始化~~





//判断签名


if($resHandler->isTenpaySign()) {//验证过程


/**********************************3


	function isTenpaySign() {


		$cmdno = $this->getParameter("cmdno");


		$pay_result = $this->getParameter("pay_result");


		$date = $this->getParameter("date");


		$transaction_id = $this->getParameter("transaction_id");


		$sp_billno = $this->getParameter("sp_billno");


		$total_fee = $this->getParameter("total_fee");		


		$fee_type = $this->getParameter("fee_type");


		$attach = $this->getParameter("attach");


		$key = $this->getKey();


		


		$signPars = "";


		//组织签名串


$signPars = "cmdno=" . $cmdno . "&" .


				"pay_result=" . $pay_result . "&" .


				"date=" . $date . "&" .


				"transaction_id=" . $transaction_id . "&" .


				"sp_billno=" . $sp_billno . "&" .


				"total_fee=" . $total_fee . "&" .


				"fee_type=" . $fee_type . "&" .


				"attach=" . $attach . "&" .


				"key=" . $key;


				


		$sign = strtolower(md5($signPars));//key是空 其他都是可控 我们之间就可以生成key 所以验证形同虚设 没有设置key的时候


***********************************/





	//交易单号


	$transaction_id = $resHandler->getParameter("transaction_id");





	//本站单号


	$sp_billno = $resHandler->getParameter("sp_billno");





	//金额,以分为单位


	$total_fee = $resHandler->getParameter("total_fee");





	//支付结果


	$pay_result = $resHandler->getParameter("pay_result");


	//类型


	$attach = $resHandler->getParameter("attach");





	if( "0" == $pay_result ) {





		//------------------------------


		//处理业务开始


		//------------------------------





		//注意交易单不要重复处理


		//注意判断返回金额


//处理本站信息开始


echo "select * from `".$db_config["def"]."company_order` where `order_id`='$sp_billno'";


	$sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='$sp_billno'");


	


    $row=mysql_fetch_array($sql);