Значения UDF в PayUMoney, приводящие к несоответствию хэша
Я пытаюсь интегрировать PayUMoney. Во время тестирования я обнаружил, что на странице success.php он возвращал недопустимую транзакцию при несоответствии условия хешу. При дальнейшей отладке я обнаружил, что проблема возникает, когда я использую значения UDF1, UDF2,...... Если я удаляю эти поля или просто оставляю это поле пустым, то все работает нормально, хэш-совпадения и показывают правильное сообщение об успехе. Но если я использую значения UDF, то возникает несоответствие хеша.
Success.php
<?php
$status=$_POST["status"];
$firstname=$_POST["firstname"];
$amount=$_POST["amount"];
$txnid=$_POST["txnid"];
$posted_hash=$_POST["hash"];
$key=$_POST["key"];
$productinfo=$_POST["productinfo"];
$email=$_POST["email"];
$salt="adaYhsjhe";
// Salt should be same Post Request
if(isset($_POST["additionalCharges"])){
$additionalCharges=$_POST["additionalCharges"];
$retHashSeq = $additionalCharges.'|'.$salt.'|'.$status.'|||||||||||'.$email.'|'.$firstname.'|'.$productinfo.'|'.$amount.'|'.$txnid.'|'.$key;
}else{
$retHashSeq = $salt.'|'.$status.'|||||||||||'.$email.'|'.$firstname.'|'.$productinfo.'|'.$amount.'|'.$txnid.'|'.$key;
}
$hash = hash("sha512", $retHashSeq);
if($hash != $posted_hash){
echo "Invalid Transaction. Please try again";
}else{
echo "<h3>Thank You. Your order status is ". $status .".</h3>";
echo "<h4>Your Transaction ID for this transaction is ".$txnid.".</h4>";
echo "<h4>We have received a payment of Rs. " . $amount . ". Your order will soon be shipped.</h4>";
}
?>
payumoney.php
<?php
include('../../config/db.php');
$gate = $pdo->prepare("SELECT gate_option1, gate_option2 FROM gateways WHERE gate_name = 'payumoney'");
$gate-> execute();
$gateway = $gate->fetch();
// Merchant Key and Salt as provided by Payu.
$MERCHANT_KEY = $gateway['gate_option1'];
$SALT = $gateway['gate_option2'];
$PAYU_BASE_URL = "https://sandboxsecure.payu.in"; // For Sandbox Mode
//$PAYU_BASE_URL = "https://secure.payu.in"; // For Production Mode
$action = '';
$posted = array();
if(!empty($_POST)){
//print_r($_POST);
foreach($_POST as $key => $value){
$posted[$key] = $value;
}
}
$formError = 0;
if(empty($posted['txnid'])){
// Generate random transaction id
$txnid = substr(hash('sha256', mt_rand() . microtime()), 0, 20);
}else{
$txnid = $posted['txnid'];
}
$hash = '';
// Hash Sequence
$hashSequence = "key|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5|udf6|udf7|udf8|udf9|udf10";
if(empty($posted['hash']) && sizeof($posted) > 0) {
if(
empty($posted['key'])
|| empty($posted['txnid'])
|| empty($posted['amount'])
|| empty($posted['firstname'])
|| empty($posted['email'])
|| empty($posted['phone'])
|| empty($posted['productinfo'])
|| empty($posted['surl'])
|| empty($posted['furl'])
|| empty($posted['service_provider'])
){
$formError = 1;
}else{
//$posted['productinfo'] = json_encode(json_decode('[{"name":"tutionfee","description":"","value":"500","isRequired":"false"},{"name":"developmentfee","description":"monthly tution fee","value":"1500","isRequired":"false"}]'));
$hashVarsSeq = explode('|', $hashSequence);
$hash_string = '';
foreach($hashVarsSeq as $hash_var) {
$hash_string .= isset($posted[$hash_var]) ? $posted[$hash_var] : '';
$hash_string .= '|';
}
$hash_string .= $SALT;
$hash = strtolower(hash('sha512', $hash_string));
$action = $PAYU_BASE_URL . '/_payment';
}
}else if(!empty($posted['hash'])){
$hash = $posted['hash'];
$action = $PAYU_BASE_URL . '/_payment';
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>PayUMoney Payments</title>
</head>
<body>
<form method="post" action="<?php echo $action; ?>" id="payumoney">
<input type="hidden" name="key" value="<?php echo $MERCHANT_KEY ?>" />
<input type="hidden" name="hash" value="<?php echo $hash ?>"/>
<input type="hidden" name="txnid" value="<?php echo $txnid ?>" />
<input type="hidden" name="amount" value="<?php echo number_format($_POST['amount'], 2, '.', ''); ?>" />
<input type="hidden" name="firstname" id="firstname" value="<?php echo $_POST['firstname']; ?>" />
<input type="hidden" name="email" id="email" value="<?php echo $_POST['email']; ?>" />
<input type="hidden" name="phone" value="<?php echo $_POST['phone']; ?>" />
<input type="hidden" name="productinfo" value="Wallet Recharge" />
<input type="hidden" name="surl" value="http://<?php echo dirname($_SERVER['HTTP_HOST'].$_SERVER["REQUEST_URI"]); ?>/ipn.php" />
<input type="hidden" name="furl" value="http://<?php echo $_SERVER['HTTP_HOST']; ?>/sites/redapple/failed.php" />
<input type="hidden" name="curl" value="http://<?php echo $_SERVER['HTTP_HOST']; ?>/sites/redapple/failed.php" />
<input type="hidden" name="service_provider" value="payu_paisa" size="64" />
<input type="hidden" name="udf1" value="<?php echo $_POST['udf1']; ?>" />
<input type="hidden" name="udf2" value="<?php //echo $_POST['udf2']; ?>" />
</form>
<script type="text/javascript">
document.getElementById("payumoney").submit();
</script>
</body>
</html>