qimall/addons/WechatVideoShop/api/modules/v1/controllers/ServiceController.php

<?php

namespace addons\WechatVideoShop\api\modules\v1\controllers;

use yii\web\Controller;

class ServiceController extends Controller
{

    public $enableCsrfValidation = false;

    public function actionCallback()
    {

        $params = $this->request->get();
        $encryptData = $this->request->post();
        \Yii::error(__METHOD__ . '->微信服务市场异步: ' . var_export($params, true) . '->encryptData: ' . var_export($encryptData, true));

        //  校验token
        if (\Yii::$app->request->isGet && !empty(\Yii::$app->request->get('echostr'))) {
            //  校验数据签名
            $data = $this->request->get();
            $valid = \Yii::$app->services->validate->validate($data, [
                [['signature', 'timestamp', 'nonce', 'echostr'], 'required'],
            ]);
            \Yii::error(__METHOD__ . '->params: ' . var_export($data, true));
            if ($valid === false) return false;

            $signature = $data["signature"];
            $timestamp = $data["timestamp"];
            $nonce = $data["nonce"];

            $tmpArr = array('zaNpZPZiemLXY6mHkZRpR2dBv6RgWce', $timestamp, $nonce);
            sort($tmpArr, SORT_STRING);
            $tmpStr = implode($tmpArr);
            $tmpStr = sha1($tmpStr);
            if ($tmpStr == $signature) {
                return $data['echostr'];
            } else {
                return 'fail';
            }
        }
    }
}