[智价云] 签名校验更新

app/Http/Controllers/Api/Wechat/OfficialNotify.php

@@ -19,11 +19,14 @@ class OfficialNotify extends Controller
      */
     public function callback(EmployeeOpenidModel $EmployeeOpenidModel)
     {
+        // 验证签名
+        $signature = $this->checkSignature();
+        if ($signature) return $signature;
         // 获取微信推送的原始数据
         $xmlData = file_get_contents('php://input');
         $xml = simplexml_load_string($xmlData, 'SimpleXMLElement', LIBXML_NOCDATA);
         $Official = new Official();
-        if(!$xml) return 'success';
+        if (!$xml) return true;
         // 提取关键信息
         $fromUsername = (string)$xml->FromUserName;  // 用户的公众号OpenID
         $toUsername = (string)$xml->ToUserName;      // 公众号原始ID
@@ -48,6 +51,24 @@ class OfficialNotify extends Controller
             }
         }
         // 默认返回成功（微信要求必须返回）
-        return 'success';
+        return true;
+    }
+
+    private function checkSignature()
+    {
+        $signature = $_GET["signature"];
+        $timestamp = $_GET["timestamp"];
+        $nonce = $_GET["nonce"];
+        if (!$signature || !$timestamp || !$nonce) return false;
+        $token = config('wechat.openplat.token', '');
+        $tmpArr = array($token, $timestamp, $nonce);
+        sort($tmpArr, SORT_STRING);
+        $tmpStr = implode($tmpArr);
+        $tmpStr = sha1($tmpStr);
+        if ($tmpStr == $signature) {
+            return $tmpStr;
+        } else {
+            return false;
+        }
     }
 }