xyzshop/vapi/control/merchant.php

<?php

class merchantControl extends vbaseControl
{
    private $mMchid;
    private $mAdminid;
    private $mUseKey;

    public function __construct()
    {
        parent::__construct();

        $mchid = $_POST['mchid'];
        $mchinfo = Model('merchant')->getMerchantInfo(['mchid' => $mchid]);
        if(empty($mchinfo)) {
            throw new Exception("合作方ID：{$mchid}不存在");
        }
        else {
            $this->mAdminid = intval($mchinfo['admin_id']);
        }

        if ($mchinfo['merchant_state'] != 1) {
            throw new Exception("机构已被关闭。");
        }

        $ips = unserialize($mchinfo['ip_white_list']);

        if(!empty($ips)) {
            $addr = $_SERVER['REMOTE_ADDR'];
            Log::record("request ip:{$addr}",Log::DEBUG);

            if(!in_array($addr,$ips)) {
                throw new Exception("请求地址不在白名单中");
            }
        }

        $this->mUseKey = intval($mchinfo['use_key']);
        if($this->mUseKey && !$this->verify_md5($mchinfo['secure_key'])) {
            throw new UnSignException();
        }

        $this->mMchid = intval($mchid);
    }

    public function mchid() : int
    {
        return $this->mMchid;
    }
    public function adminid() : int {
        return $this->mAdminid;
    }

    private function verify_md5($key)
    {
        $input = $_GET;
        $sign = $input['sign'];

        $input['sign'] = null;
        $input['from'] = null;

        $body = $this->sign_body($input);

        if($this->mUseKey) {
            $body .= "&key={$key}";
        }

        return ($sign == md5($body));
    }

    protected function check_empty($value)
    {
        if (!isset($value))
            return true;
        if ($value === null)
            return true;
        if (trim($value) === "")
            return true;

        return false;
    }

    private function sign_body($params)
    {
        ksort($params);

        $content = "";
        $i = 0;
        foreach ($params as $k => $v)
        {
            if (false === $this->check_empty($v) && "@" != substr($v, 0, 1))
            {
                if ($i == 0) {
                    $content .= "{$k}" . "=" . urlencode($v);
                } else {
                    $content .= "&" . "{$k}" . "=" . urlencode($v);
                }
                $i++;
            }
        }

        return $content;
    }
}