diff --git a/plugins/union_pay/internal/union_pay.go b/plugins/union_pay/internal/union_pay.go index f1d3311..b36648b 100644 --- a/plugins/union_pay/internal/union_pay.go +++ b/plugins/union_pay/internal/union_pay.go @@ -26,6 +26,8 @@ const ( queryBizMethod = "mkt.cpn.couponAcqQuery.v1" ) +const notifyBizMethod = "mkt.CpnStateUpdtNotify" + type UnionPayService struct{} func (p *UnionPayService) Order(ctx context.Context, request *proto.OrderRequest) (*proto.OrderResponse, error) { @@ -77,7 +79,7 @@ func (p *UnionPayService) Notify(_ context.Context, request *proto.NotifyRequest return nil, err } - if err = verify(conf, uv, request); err != nil { + if err = verify(conf, uv, notifyBizMethod); err != nil { return nil, err } diff --git a/plugins/union_pay/internal/util.go b/plugins/union_pay/internal/util.go index 7913093..2104b75 100644 --- a/plugins/union_pay/internal/util.go +++ b/plugins/union_pay/internal/util.go @@ -1,7 +1,6 @@ package internal import ( - "codeup.aliyun.com/6552e56cc3b2728a4557fc18/plugin/proto" "fmt" "net/http" "plugins/union_pay/internal/po" @@ -36,10 +35,16 @@ func headers(config *Config, req po.Req, bizMethod string) map[string][]string { return h } -func verify(config *Config, req *po.Notify, request *proto.NotifyRequest) error { +func verify(config *Config, req *po.Notify, notifyBizMethod string) error { if req.Headers.SignMethod != vo.SignMethod { return fmt.Errorf("签名方式不匹配") } + if req.Headers.AppId != config.Config.AppId { + return fmt.Errorf("appId不匹配") + } + if req.Headers.BizMethod != notifyBizMethod { + return fmt.Errorf("业务方法不匹配") + } encodedHash := utils.Sha(req.Headers.Version, config.Config.AppId, req.Headers.BizMethod, req.GetReId(), string(req.ToJson())) lowerStr := strings.ToLower(encodedHash) if utils.Verify(lowerStr, req.Headers.Sign, utils.FormatPEMPrivateKey(config.Extra.RsaNpk)) {