1

controllers/taobao_vegetable.go

@@ -1,6 +1,8 @@
 package controllers
 
 import (
+	"crypto/md5"
+	"fmt"
 	"git.rosy.net.cn/baseapi/platformapi/tao_vegetable"
 	"git.rosy.net.cn/baseapi/platformapi/tiktok_shop/tiktok_api"
 	"git.rosy.net.cn/baseapi/utils"
@@ -12,6 +14,9 @@ import (
 	"github.com/astaxie/beego/server/web"
 	"io/ioutil"
 	"net/http"
+	"net/url"
+	"sort"
+	"strings"
 )
 
 type TaoBaoVegetableController struct {
@@ -69,13 +74,36 @@ func (c *TaoBaoVegetableController) GetCode() {
 	return
 }
 
+func Sign(param url.Values, data, secret string) string {
+	var publicParam = make([]string, 0, 0)
+	for k, v := range param {
+		if k == "sign" {
+			continue
+		}
+		publicParam = append(publicParam, fmt.Sprintf("%s%s", k, v[0]))
+	}
+
+	sort.Strings(publicParam)
+	cc := secret + strings.Join(publicParam, "") + strings.ReplaceAll(strings.ReplaceAll(strings.ReplaceAll(data, "\n", ""), "\t", ""), " ", "") + secret
+	return fmt.Sprintf("%X", md5.Sum([]byte(cc)))
+}
+
 // OrderStatus 订单状态变化 [post]
 func (c *TaoBaoVegetableController) OrderStatus() {
-	c.Data["json"] = tao_vegetable.CallBackResultInfo(nil)
-	c.ServeJSON()
-	return
-
+	urlParam := c.Ctx.Request.URL.RawQuery
+	values, err := url.ParseQuery(urlParam)
 	order, err := api.TaoVegetableApi.ReaderOrderInfo(c.Ctx.Request)
+	sign := Sign(values, utils.Format4Output(order, false), api.TaoVegetableApi.GetAppSecret())
+	if sign != values.Get("sign") { // 49C8CEEDC523CA387A677D08C8861ABC
+		c.Data["json"] = tao_vegetable.CallBackResultSign(fmt.Errorf("非法签名"))
+		c.ServeJSON()
+		return
+	} else {
+		c.Data["json"] = tao_vegetable.CallBackResultInfo(nil)
+		c.ServeJSON()
+		return
+	}
+
 	globals.SugarLogger.Debugf("OrderStatus := %s", utils.Format4Output(order, false))
 	if err != nil {
 		globals.SugarLogger.Debugf("订单状态变化:%s", err.Error())