Realex支付集成中SHA1哈希计算错误解析与解决方案

<response timestamp="20211208142721">
<merchantid>OUR MERCHANT ID IS INSERTED HERE</merchantid>
<account>website</account>
<orderid>scsi45880</orderid>
<result>505</result>
<message>sha1hash incorrect - check your code and the Developers Documentation</message>
</response>

// 错误的哈希字符串构建
$payer_temp_var = "$timestamp.$merchantid.$rlx_orderid.$pay_amount.$currency.$payer_ref";
$payersha1hash = sha1($payer_temp_var);
$payertmp = "$payersha1hash.$payer_secret";
$payersha1hash = sha1($payertmp);

// 正确的哈希字符串构建
$payer_temp_var = "$timestamp.$merchantid.$rlx_orderid.$payer_ref";
$payersha1hash = sha1($payer_temp_var);
$payertmp = "$payersha1hash.$payer_secret";
$payersha1hash = sha1($payertmp);

<?php

// ... (省略了初始化和其它不相关的代码) ...

$merchantid = 'your_merchant_id'; // 替换为您的商户ID
$account = 'your_account';         // 替换为您的账户名
$secret = 'your_auth_secret';     // 替换为您的主密钥（用于auth请求）
$payer_secret = 'your_payer_secret'; // 替换为您的付款人密钥（如果不同）

$timestamp = strftime("%Y%m%d%H%M%S"); // 获取当前时间戳
$rlx_orderid = "scsi" . rand(10000, 99999); // 生成唯一的订单ID
$payer_ref = sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
            mt_rand(0, 0xffff),
            mt_rand(0, 0x0C2f) | 0x4000,
            mt_rand(0, 0x3fff) | 0x8000,
            mt_rand(0, 0x2Aff), mt_rand(0, 0xffD3), mt_rand(0, 0xff4B)
    ); // 生成付款人参考

// --- 针对 Payer-New 请求的 SHA1 哈希计算 ---
// 重要的：这里不包含 $pay_amount 和 $currency
$payer_temp_var = "$timestamp.$merchantid.$rlx_orderid.$payer_ref";
$payersha1hash = sha1($payer_temp_var);
$payertmp = "$payersha1hash.$payer_secret"; // 使用付款人密钥
$payersha1hash = sha1($payertmp);

// 构建 Payer-New XML 请求
$payer_string = "<?xml version='1.0' encoding='UTF-8'?>
    <request type='payer-new' timestamp='$timestamp'>
      <merchantid>$merchantid</merchantid>
      <account>$account</account>
      <orderid>$rlx_orderid</orderid>
      <payer ref='$payer_ref' type='Retail'>
        <!-- ... 更多付款人详细信息 ... -->
      </payer>
      <sha1hash>$payersha1hash</sha1hash>
    </request>";

// ... (使用 cURL 发送请求的代码) ...

// --- 针对 Auth (支付授权) 请求的 SHA1 哈希计算 (作为对比) ---
// 注意：这里需要包含 $pay_amount, $currency 和 $cardNumber
$amount = $_POST['amount'];
$pay_amount = $amount * 100; // 金额通常以最小货币单位表示 (例如：欧元分)
$currency = "EUR";
$cardNumber = $_POST['cardnnumber']; // 实际卡号，用于哈希，但通常不直接发送到API

$auth_temp_var = "$timestamp.$merchantid.$rlx_orderid.$pay_amount.$currency.$cardNumber";
$sha1hash_auth = sha1($auth_temp_var);
$authtmp = "$sha1hash_auth.$secret"; // 使用主密钥
$sha1hash_auth = sha1($authtmp);

// 构建 Auth XML 请求
$field_string = "<request timestamp='$timestamp' type='auth'>
    <merchantid>$merchantid</merchantid>
    <account>$account</account>
    <channel>MOTO</channel>
    <orderid>$rlx_orderid</orderid>
    <amount currency='$currency'>$pay_amount</amount>               
    <card>
                <number>$cardNumber</number>
                <expdate>...</expdate>
                <chname>...</chname>
                <type>...</type>
                <cvn>...</cvn>
    </card>
    <autosettle flag='1' />
    <sha1hash>$sha1hash_auth</sha1hash>
</request>";

// ... (使用 cURL 发送请求的代码) ...

?>