From a21f3103bb7b292440bc886b747de64bf9c05eec Mon Sep 17 00:00:00 2001 From: thisgun Date: Thu, 11 Jun 2026 08:13:20 +0000 Subject: [PATCH] =?UTF-8?q?=EB=82=98=EC=9D=B4=EC=8A=A4=ED=8E=98=EC=9D=B4?= =?UTF-8?q?=20=EA=B2=B0=EC=A0=9C=20=EC=9D=91=EB=8B=B5=20=EA=B2=80=EC=A6=9D?= =?UTF-8?q?=20=EB=B3=B4=EA=B0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (cherry picked from commit 50c2d6b6cfeaa10bbb65b2537a05c0525528cc63) --- mobile/shop/nicepay/nicepay_result.php | 16 +++-- mobile/shop/nicepay/orderform.1.php | 11 +-- mobile/shop/nicepay/return_url_result.php | 37 ++++++---- mobile/shop/orderform.sub.php | 7 +- mobile/shop/personalpayform.sub.php | 8 +-- shop/nicepay/cancel_process.php | 42 +++++++---- shop/nicepay/createsigndata.php | 55 +++++++++++---- shop/nicepay/nicepay_result.php | 18 +++-- shop/nicepay/orderform.1.php | 11 +-- shop/settle_nicepay_common.php | 85 +++++++++++++---------- 10 files changed, 189 insertions(+), 101 deletions(-) diff --git a/mobile/shop/nicepay/nicepay_result.php b/mobile/shop/nicepay/nicepay_result.php index c399e0656..8ce1324da 100644 --- a/mobile/shop/nicepay/nicepay_result.php +++ b/mobile/shop/nicepay/nicepay_result.php @@ -117,10 +117,11 @@ if($authResultCode === "0000"){ $ResultCode = nicepay_res('ResultCode', $respArr); $ResultMsg = nicepay_res('ResultMsg', $respArr); $tno = nicepay_res('TID', $respArr); - $amount = (int) nicepay_res('Amt', $respArr, 0); - $app_time = nicepay_res('AuthDate', $respArr); - $pay_method = nicepay_res('PayMethod', $respArr); - $od_app_no = $app_no = nicepay_res('AuthCode', $respArr); // 승인 번호 (신용카드, 계좌이체, 휴대폰) + $response_amt = nicepay_res('Amt', $respArr, 0); + $amount = (int) $response_amt; + $app_time = nicepay_res('AuthDate', $respArr); + $pay_method = nicepay_res('PayMethod', $respArr); + $od_app_no = $app_no = nicepay_res('AuthCode', $respArr); // 승인 번호 (신용카드, 계좌이체, 휴대폰) $pay_type = $NICEPAY_METHOD[$pay_method]; // 승인된 코드가 아니면 결제가 되지 않게 합니다. @@ -129,6 +130,13 @@ if($authResultCode === "0000"){ die(); } + $responseSignature = nicepay_res('Signature', $respArr); + $responseSignData = bin2hex(hash('sha256', $tno . $mid . $response_amt . $merchantKey, true)); + + if ($responseSignature != $responseSignData) { + alert("승인 응답 유효성 검증이 틀려서 결제를 진행할수 없습니다.", G5_SHOP_URL); + } + if ($amount != $order_price) { if($amount > 0) { $od_id = $moid; diff --git a/mobile/shop/nicepay/orderform.1.php b/mobile/shop/nicepay/orderform.1.php index 458ce71a6..5c316728b 100644 --- a/mobile/shop/nicepay/orderform.1.php +++ b/mobile/shop/nicepay/orderform.1.php @@ -71,10 +71,11 @@ function nicepay_create_signdata(frm) var result = true; $.ajax({ url: g5_url+"/shop/nicepay/createsigndata.php", - type: "POST", - data: { - price : frm.good_mny.value - }, + type: "POST", + data: { + price : frm.good_mny.value, + moid : frm.Moid ? frm.Moid.value : '' + }, dataType: "json", async: false, cache: false, @@ -137,4 +138,4 @@ function nicepay_create_signdata(frm) - \ No newline at end of file + diff --git a/mobile/shop/nicepay/return_url_result.php b/mobile/shop/nicepay/return_url_result.php index c20ee5410..575b14e8f 100644 --- a/mobile/shop/nicepay/return_url_result.php +++ b/mobile/shop/nicepay/return_url_result.php @@ -3,12 +3,23 @@ include_once('./_common.php'); include_once(G5_MSHOP_PATH.'/settle_nicepay.inc.php'); $authResultCode = isset($_POST['AuthResultCode']) ? clean_xss_tags($_POST['AuthResultCode']) : ''; // authentication result code 0000:success -$authResultMsg = isset($_POST['AuthResultMsg']) ? clean_xss_tags($_POST['AuthResultMsg']) : ''; // authentication result message -$mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : ''; // merchant id -$moid = isset($_POST['Moid']) ? addslashes(clean_xss_tags(stripslashes($_POST['Moid']))) : ''; // order number - -$sql = " select * from {$g5['g5_shop_order_data_table']} where od_id = '$moid' "; -$row = sql_fetch($sql); +$authResultMsg = isset($_POST['AuthResultMsg']) ? clean_xss_tags($_POST['AuthResultMsg']) : ''; // authentication result message +$mid = isset($_POST['MID']) ? clean_xss_tags($_POST['MID']) : ''; // merchant id +$moid = isset($_POST['Moid']) ? addslashes(clean_xss_tags(stripslashes($_POST['Moid']))) : ''; // order number + +if ($default['de_nicepay_mid'] != $mid) { + alert("요청한 상점 mid와 설정된 mid가 틀리므로 결제를 진행할수 없습니다.", G5_SHOP_URL); +} + +$session_order_id = get_session('ss_order_id'); +$session_personalpay_id = get_session('ss_personalpay_id'); + +if (!$moid || ($session_order_id != $moid && $session_personalpay_id != $moid)) { + alert("요청한 주문번호가 틀려서 결제를 진행할수 없습니다.", G5_SHOP_URL); +} + +$sql = " select * from {$g5['g5_shop_order_data_table']} where od_id = '$moid' and dt_pg = 'nicepay' "; +$row = sql_fetch($sql); if (empty($row)) { die(''); @@ -19,12 +30,12 @@ $data = unserialize(base64_decode($row['dt_data'])); if(isset($data['pp_id']) && $data['pp_id']) { $order_action_url = G5_HTTPS_MSHOP_URL.'/personalpayformupdate.php'; $page_return_url = G5_SHOP_URL.'/personalpayform.php?pp_id='.$data['pp_id']; -} else { - $order_action_url = G5_HTTPS_MSHOP_URL.'/orderformupdate.php'; - $page_return_url = G5_SHOP_URL.'/orderform.php'; - if($_SESSION['ss_direct']) - $page_return_url .= '?sw_direct=1'; -} +} else { + $order_action_url = G5_HTTPS_MSHOP_URL.'/orderformupdate.php'; + $page_return_url = G5_SHOP_URL.'/orderform.php'; + if(isset($_SESSION['ss_direct']) && $_SESSION['ss_direct']) + $page_return_url .= '?sw_direct=1'; +} $params = array(); $var_datas = array(); @@ -84,4 +95,4 @@ if ($authResultCode === '0000') { // 실패시 alert('오류 : '.$authResultMsg.' 코드 : '.$authResultCode, $page_return_url); -} \ No newline at end of file +} diff --git a/mobile/shop/orderform.sub.php b/mobile/shop/orderform.sub.php index aa21e6b43..bb73153dd 100644 --- a/mobile/shop/orderform.sub.php +++ b/mobile/shop/orderform.sub.php @@ -1617,9 +1617,6 @@ function pay_approval() f.TaxFreeAmt.value = pf.comm_free_mny.value; - if (! nicepay_create_signdata(f)) { - return false; - } // 주문 정보 임시저장 @@ -1646,6 +1643,10 @@ function pay_approval() + if (! nicepay_create_signdata(f)) { + return false; + } + nicepayStart(f); return false; diff --git a/mobile/shop/personalpayform.sub.php b/mobile/shop/personalpayform.sub.php index 092f9a718..87591ecc5 100644 --- a/mobile/shop/personalpayform.sub.php +++ b/mobile/shop/personalpayform.sub.php @@ -305,10 +305,6 @@ function pay_approval() f.TaxFreeAmt.value = pf.comm_free_mny.value; - if (! nicepay_create_signdata(f)) { - return false; - } - //var new_win = window.open("about:blank", "tar_opener", "scrollbars=yes,resizable=yes"); @@ -338,6 +334,10 @@ function pay_approval() + if (! nicepay_create_signdata(f)) { + return false; + } + nicepayStart(f); return; diff --git a/shop/nicepay/cancel_process.php b/shop/nicepay/cancel_process.php index 34cb29b4f..398bc190f 100644 --- a/shop/nicepay/cancel_process.php +++ b/shop/nicepay/cancel_process.php @@ -36,17 +36,31 @@ try{ 'CharSet' => 'utf-8' ); - /* - **************************************************************************************** - * - **************************************************************************************** - */ - $response = nicepay_reqPost($data, "https://pg-api.nicepay.co.kr/webapi/cancel_process.jsp"); //Cancel API call - - $result = json_decode($response, true); - -}catch(Exception $e){ - $e->getMessage(); - $ResultCode = "9999"; - $ResultMsg = "통신실패"; -} + /* + **************************************************************************************** + * + **************************************************************************************** + */ + $response = nicepay_reqPost($data, "https://pg-api.nicepay.co.kr/webapi/cancel_process.jsp"); //Cancel API call + + $result = json_decode($response, true); + + if (isset($result['ResultCode'])) { + $responseTid = isset($result['TID']) ? $result['TID'] : $tid; + $responseCancelAmt = isset($result['CancelAmt']) ? $result['CancelAmt'] : $cancelAmt; + $responseSignature = isset($result['Signature']) ? $result['Signature'] : ''; + $responseSignData = bin2hex(hash('sha256', $responseTid . $mid . $responseCancelAmt . $merchantKey, true)); + + if ($responseSignature != $responseSignData) { + $result['ResultCode'] = '9998'; + $result['ResultMsg'] = '취소 응답 유효성 검증 실패'; + } + } + +}catch(Exception $e){ + $e->getMessage(); + $result = array( + 'ResultCode' => '9999', + 'ResultMsg' => '통신실패' + ); +} diff --git a/shop/nicepay/createsigndata.php b/shop/nicepay/createsigndata.php index cf71725b3..648e98728 100644 --- a/shop/nicepay/createsigndata.php +++ b/shop/nicepay/createsigndata.php @@ -2,31 +2,62 @@ include_once('./_common.php'); include_once(G5_SHOP_PATH.'/settle_nicepay.inc.php'); -$orderNumber = get_session('ss_order_id'); -$is_personalpay_order = false; +$session_order_id = get_session('ss_order_id'); +$personalpay_id = get_session('ss_personalpay_id'); +$orderNumber = (isset($_POST['moid']) && !is_array($_POST['moid'])) ? addslashes(clean_xss_tags(stripslashes($_POST['moid']))) : ''; +$price_checked = false; -if (! $orderNumber) { - $orderNumber = get_session('ss_personalpay_id'); - $is_personalpay_order = true; +if (!$orderNumber) { + $orderNumber = $session_order_id; +} + +if (!$orderNumber) { + $orderNumber = $personalpay_id; +} + +if (! ($default['de_pg_service'] == 'nicepay' && $orderNumber)){ + die(json_encode(array('error'=>'올바른 방법으로 이용해 주십시오.'))); +} + +if ($session_order_id != $orderNumber && $personalpay_id != $orderNumber) { + die(json_encode(array('error'=>'주문 정보가 올바르지 않습니다.'))); } -if (! ($default['de_pg_service'] == 'nicepay' && $orderNumber)){ - die(json_encode(array('error'=>'올바른 방법으로 이용해 주십시오.'))); -} - -$price = isset($_POST['price']) ? preg_replace('#[^0-9]#', '', $_POST['price']) : ''; +$price = (isset($_POST['price']) && !is_array($_POST['price'])) ? preg_replace('#[^0-9]#', '', $_POST['price']) : ''; if (strlen($price) < 1) { die(json_encode(array('error'=>'가격이 올바르지 않습니다.'))); } -if ($is_personalpay_order) { - $pp_id = preg_replace('/[^0-9]/', '', get_session('ss_personalpay_id')); +if ($orderNumber) { + $sql = " select dt_data from {$g5['g5_shop_order_data_table']} where od_id = '$orderNumber' and dt_pg = 'nicepay' "; + $row = sql_fetch($sql); + + if (isset($row['dt_data']) && $row['dt_data']) { + $order_data = unserialize(base64_decode($row['dt_data'])); + $order_price = (isset($order_data['good_mny'])) ? preg_replace('#[^0-9]#', '', $order_data['good_mny']) : ''; + + if (strlen($order_price) < 1 || (int)$order_price !== (int)$price) { + die(json_encode(array('error'=>'가격이 올바르지 않습니다.'))); + } + + $price_checked = true; + } +} + +if (!$price_checked && $personalpay_id == $orderNumber) { + $pp_id = preg_replace('/[^0-9]/', '', $personalpay_id); $pp = sql_fetch(" select pp_id, pp_price from {$g5['g5_shop_personalpay_table']} where pp_id = '$pp_id' and pp_use = '1' "); if (! (isset($pp['pp_id']) && $pp['pp_id']) || (int)$pp['pp_price'] !== (int)$price) { die(json_encode(array('error'=>'가격이 올바르지 않습니다.'))); } + + $price_checked = true; +} + +if (!$price_checked) { + die(json_encode(array('error'=>'주문 정보가 올바르지 않습니다.'))); } $ediDate = preg_replace('/[^0-9]/', '', G5_TIME_YMDHIS); diff --git a/shop/nicepay/nicepay_result.php b/shop/nicepay/nicepay_result.php index 3d9fadae8..1aa484395 100644 --- a/shop/nicepay/nicepay_result.php +++ b/shop/nicepay/nicepay_result.php @@ -114,11 +114,12 @@ if($authResultCode === "0000"){ $ResultCode = nicepay_res('ResultCode', $respArr); $ResultMsg = nicepay_res('ResultMsg', $respArr); - $tno = nicepay_res('TID', $respArr); - $amount = (int) nicepay_res('Amt', $respArr, 0); - $app_time = nicepay_res('AuthDate', $respArr); - $pay_method = nicepay_res('PayMethod', $respArr); - $od_app_no = $app_no = nicepay_res('AuthCode', $respArr); // 승인 번호 (신용카드, 계좌이체, 휴대폰) + $tno = nicepay_res('TID', $respArr); + $response_amt = nicepay_res('Amt', $respArr, 0); + $amount = (int) $response_amt; + $app_time = nicepay_res('AuthDate', $respArr); + $pay_method = nicepay_res('PayMethod', $respArr); + $od_app_no = $app_no = nicepay_res('AuthCode', $respArr); // 승인 번호 (신용카드, 계좌이체, 휴대폰) $pay_type = $NICEPAY_METHOD[$pay_method]; // 승인된 코드가 아니면 결제가 되지 않게 합니다. @@ -127,6 +128,13 @@ if($authResultCode === "0000"){ die(); } + $responseSignature = nicepay_res('Signature', $respArr); + $responseSignData = bin2hex(hash('sha256', $tno . $mid . $response_amt . $merchantKey, true)); + + if ($responseSignature != $responseSignData) { + alert("승인 응답 유효성 검증이 틀려서 결제를 진행할수 없습니다.", G5_SHOP_URL); + } + if ($amount != $order_price) { if($amount > 0) { $od_id = $moid; diff --git a/shop/nicepay/orderform.1.php b/shop/nicepay/orderform.1.php index 6ab60fd93..5dec9282c 100644 --- a/shop/nicepay/orderform.1.php +++ b/shop/nicepay/orderform.1.php @@ -73,10 +73,11 @@ function nicepay_create_signdata(frm) var result = true; $.ajax({ url: g5_url+"/shop/nicepay/createsigndata.php", - type: "POST", - data: { - price : frm.good_mny.value - }, + type: "POST", + data: { + price : frm.good_mny.value, + moid : frm.Moid ? frm.Moid.value : '' + }, dataType: "json", async: false, cache: false, @@ -95,4 +96,4 @@ function nicepay_create_signdata(frm) } -