1 <?php 2 3 namespace app\api\controller; 4 5 use think\Controller; 6 use think\Db; 7 use think\Request; 8 use think\Url; 9 use think\Cache; 10 use think\Log; 11 12 class WeChatPayNotifyV3 extends Controller 13 { 14 private $appid = 'wx33682xxxxxxxxxx'; 15 private $appsecret = '3d502b31fxxxxxxxxxxx'; 16 private $merchantid = '1611xxxxxxxxxx'; 17 private $merchantSerialNumber = '2616F66DE286CBxxxxxxxxx'; 18 private $apiV3key = 'jwCq2VaVMdiRE9Oxxxxxxxxxxx'; 19 20 private $pingtai_public_key_path = ROOT_PATH . 'runtime' . DS . 'wechat' . DS . 'wechatpay' . DS . 'cert.pem';//平台证书，不是商户的证书， 21 private $apiclient_key = ROOT_PATH . 'runtime' . DS . 'wechat' . DS . 'mch' . DS . 'private' . DS . 'apiclient_key.pem';//商户api私钥 22 23 const KEY_LENGTH_BYTE = 32; 24 const AUTH_TAG_LENGTH_BYTE = 16; 25 26 //回调地址 27 public function notifyUrl() 28 { 29 30 31 32 try { 33 //code... 34 35 $header = $this->getHeaders(); //读取http头信息 见下文 36 $body = file_get_contents('php://input'); //读取微信传过来的信息，是一个json字符串 37 38 if (empty($header) || empty($body)) { 39 throw new \Exception('通知参数为空', 2001); 40 } 41 42 $timestamp = $header['WECHATPAY-TIMESTAMP']; 43 $nonce = $header['WECHATPAY-NONCE']; 44 $signature = $header['WECHATPAY-SIGNATURE']; 45 $serialNo = $header['WECHATPAY-SERIAL']; 46 if (empty($timestamp) || empty($nonce) || empty($signature) || empty($serialNo)) { 47 throw new \Exception('通知头参数为空', 2002); 48 } 49 $cert = $this->getzhengshuDb(1); 50 51 if ($cert != $serialNo) { 52 throw new \Exception('验签失败', 2005); 53 } 54 $message = "$timestamp\n$nonce\n$body\n"; 55 56 //校验签名 57 if (!$this->verify($message, $signature, $this->pingtai_public_key_path)) { //$this->pingtai_public_key_path是获取平台证书序列号$this->getzhengshuDb()时保存下来的平台公钥文件 58 throw new \Exception('验签失败', 2005); 59 } 60 61 $decodeBody = json_decode($body, true); 62 if (empty($decodeBody) || !isset($decodeBody['resource'])) { 63 throw new \Exception('通知参数内容为空', 2003); 64 } 65 $decodeBodyResource = $decodeBody['resource']; 66 $decodeData_res = $this->decryptToString($decodeBodyResource['associated_data'], $decodeBodyResource['nonce'], $decodeBodyResource['ciphertext'], ''); //解密resource 67 $decodeData = json_decode($decodeData_res, true); 68 Log::write($decodeData); 69 70 //返回结果格式 71 //array ( 72 // 'mchid' => 'xxx', 73 // 'appid' => 'xxxxxxx', 74 // 'out_trade_no' => '1217752501201407033233368026', 75 // 'transaction_id' => '4200001336202201037507057791', 76 // 'trade_type' => 'NATIVE', 77 // 'trade_state' => 'SUCCESS', 78 // 'trade_state_desc' => '支付成功', 79 // 'bank_type' => 'OTHERS', 80 // 'attach' => '', 81 // 'success_time' => '2022-01-03T19:43:05+08:00', 82 // 'payer' => 83 // array ( 84 // 'openid' => 'ovs326bgwfA4o8jlFQXMEma2JZek', 85 // ), 86 // 'amount' => 87 // array ( 88 // 'total' => 1, 89 // 'payer_total' => 1, 90 // 'currency' => 'CNY', 91 // 'payer_currency' => 'CNY', 92 // ), 93 // ) 94 //执行自己的代码start 95 96 //执行自己的代码end 97 98 $arr = array("code" => "SUCCESS", "message" => ""); 99 echo json_encode($arr); 100 101 } catch (\Exception $e) { 102 Log::error($e->getMessage()); 103 $arr = array("code" => "ERROR", "message" => $e->getMessage()); 104 echo json_encode($arr); 105 } 106 } 107 //获取微信回调http头信息 108 public function getHeaders() 109 { 110 $headers = array(); 111 foreach ($_SERVER as $key => $value) { 112 if ('HTTP_' == substr($key, 0, 5)) { 113 $headers[str_replace('_', '-', substr($key, 5))] = $value; 114 } 115 if (isset($_SERVER['PHP_AUTH_DIGEST'])) { 116 $header['AUTHORIZATION'] = $_SERVER['PHP_AUTH_DIGEST']; 117 } elseif (isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW'])) { 118 $header['AUTHORIZATION'] = base64_encode($_SERVER['PHP_AUTH_USER'] . ':' . $_SERVER['PHP_AUTH_PW']); 119 } 120 if (isset($_SERVER['CONTENT_LENGTH'])) { 121 $header['CONTENT-LENGTH'] = $_SERVER['CONTENT_LENGTH']; 122 } 123 if (isset($_SERVER['CONTENT_TYPE'])) { 124 $header['CONTENT-TYPE'] = $_SERVER['CONTENT_TYPE']; 125 } 126 } 127 return $headers; 128 } 129 //获取平台证书序列号 130 public function getzhengshuDb($getNew = 0) 131 { 132 if ($getNew !== 1) { 133 dump(file_get_contents($this->pingtai_public_key_path)); 134 } 135 $url = "https://api.mch.weixin.qq.com/v3/certificates"; 136 $timestamp = time(); //时间戳 137 $nonce = $this->nonce_str(); //获取一个随机数 138 $body = ""; 139 $mch_private_key = $this->getPrivateKey(); //读取商户api证书私钥 140 $merchant_id = $this->merchantid; //服务商商户号 141 $serial_no = $this->merchantSerialNumber; //在API安全中获取 142 $sign = $this->sign($url, 'GET', $timestamp, $nonce, $body, $mch_private_key, $merchant_id, $serial_no); //签名 143 144 $header = [ 145 'Authorization:WECHATPAY2-SHA256-RSA2048 ' . $sign, 146 'Accept:application/json', 147 'User-Agent:' . $merchant_id 148 ]; 149 $result = $this->curl($url, '', $header, 'GET'); 150 $result = json_decode($result, true); 151 $serial_no = $result['data'][0]['serial_no']; 152 file_put_contents(ROOT_PATH . 'runtime' . DS . 'wechat' . DS . 'wechatpay' . DS . 'serial_no.text', $serial_no); 153 154 $encrypt_certificate = $result['data'][0]['encrypt_certificate']; 155 $sign_key = $this->apiV3key; //在API安全中设置 156 $result = $this->decryptToString($encrypt_certificate['associated_data'], $encrypt_certificate['nonce'], $encrypt_certificate['ciphertext'], $sign_key); //解密 157 158 file_put_contents($this->pingtai_public_key_path, $result); 159 160 return $serial_no; 161 } 162 //生成随机字符串 163 public function nonce_str($length = 32) 164 { 165 $chars = "abcdefghijklmnopqrstuvwxyz0123456789"; 166 $str = ""; 167 for ($i = 0; $i < $length; $i++) { 168 $str .= substr($chars, mt_rand(0, strlen($chars) - 1), 1); 169 } 170 return $str; 171 } 172 //读取商户api证书私钥 173 public function getPrivateKey() 174 { 175 return openssl_get_privatekey(file_get_contents($this->apiclient_key)); //微信商户平台中下载下来，保存到服务器直接读取 176 177 } 178 //签名 179 public function sign($url, $http_method, $timestamp, $nonce, $body, $mch_private_key, $merchant_id, $serial_no) 180 { 181 $url_parts = parse_url($url); 182 $canonical_url = ($url_parts['path'] . (!empty($url_parts['query']) ? "?${url_parts['query']}" : "")); 183 $message = 184 $http_method . "\n" . 185 $canonical_url . "\n" . 186 $timestamp . "\n" . 187 $nonce . "\n" . 188 $body . "\n"; 189 openssl_sign($message, $raw_sign, $mch_private_key, 'sha256WithRSAEncryption'); 190 $sign = base64_encode($raw_sign); 191 $schema = 'WECHATPAY2-SHA256-RSA2048'; 192 $token = sprintf( 193 'mchid="%s",nonce_str="%s",signature="%s",timestamp="%d",serial_no="%s"', 194 $merchant_id, 195 $nonce, 196 $sign, 197 $timestamp, 198 $serial_no 199 ); 200 return $token; 201 } 202 //curl提交 203 public function curl($url, $data = [], $header, $method = 'POST') 204 { 205 $curl = curl_init(); 206 curl_setopt($curl, CURLOPT_URL, $url); 207 curl_setopt($curl, CURLOPT_HTTPHEADER, $header); 208 curl_setopt($curl, CURLOPT_HEADER, false); 209 curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); 210 curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false); 211 if ($method == "POST") { 212 curl_setopt($curl, CURLOPT_POST, TRUE); 213 curl_setopt($curl, CURLOPT_POSTFIELDS, $data); 214 } 215 $result = curl_exec($curl); 216 curl_close($curl); 217 return $result; 218 } 219 220 private function decryptToString($associatedData, $nonceStr, $ciphertext, $aesKey = '') 221 { 222 if (empty($aesKey)) { 223 $aesKey = $this->apiV3key; //微信商户平台 api安全中设置获取 224 } 225 $ciphertext = \base64_decode($ciphertext); 226 if (strlen($ciphertext) <= self::AUTH_TAG_LENGTH_BYTE) { 227 return false; 228 } 229 // ext-sodium (default installed on >= PHP 7.2) 230 if ( 231 function_exists('\sodium_crypto_aead_aes256gcm_is_available') && \sodium_crypto_aead_aes256gcm_is_available() 232 ) { 233 return \sodium_crypto_aead_aes256gcm_decrypt($ciphertext, $associatedData, $nonceStr, $aesKey); 234 } 235 236 // ext-libsodium (need install libsodium-php 1.x via pecl) 237 if ( 238 function_exists('\Sodium\crypto_aead_aes256gcm_is_available') && \Sodium\crypto_aead_aes256gcm_is_available() 239 ) { 240 return \Sodium\crypto_aead_aes256gcm_decrypt($ciphertext, $associatedData, $nonceStr, $aesKey); 241 } 242 243 // openssl (PHP >= 7.1 support AEAD) 244 if (PHP_VERSION_ID >= 70100 && in_array('aes-256-gcm', \openssl_get_cipher_methods())) { 245 $ctext = substr($ciphertext, 0, -self::AUTH_TAG_LENGTH_BYTE); 246 $authTag = substr($ciphertext, -self::AUTH_TAG_LENGTH_BYTE); 247 248 return \openssl_decrypt( 249 $ctext, 250 'aes-256-gcm', 251 $aesKey, 252 \OPENSSL_RAW_DATA, 253 $nonceStr, 254 $authTag, 255 $associatedData 256 ); 257 } 258 259 throw new \RuntimeException('AEAD_AES_256_GCM需要PHP 7.1以上或者安装libsodium-php'); 260 } 261 //签名验证操作 262 private function verify($message, $signature, $merchantPublicKey) 263 { 264 if (!in_array('sha256WithRSAEncryption', \openssl_get_md_methods(true))) { 265 throw new \RuntimeException("当前PHP环境不支持SHA256withRSA"); 266 } 267 $signature = base64_decode($signature); 268 $a = openssl_verify($message, $signature, $this->getWxPublicKey($merchantPublicKey), 'sha256WithRSAEncryption'); 269 return $a; 270 } 271 //获取平台公钥 获取平台证书序列号时存起来的cert.pem文件 272 protected function getWxPublicKey($key) 273 { 274 $public_content = file_get_contents($key); 275 $a = openssl_get_publickey($public_content); 276 return $a; 277 } 278 }