Файл: public_html/result.php
Строк: 53
<?php
define('BASE_DIR', $_SERVER['DOCUMENT_ROOT']);
define('TIME', time());
require_once(BASE_DIR.'/inc/init.php');
print_r($_POST);
#webmoney
if (isset($_POST['LMI_PAYMENT_NO']))
{
if (isset($_POST['LMI_PREREQUEST']))
{
if ($_POST['LMI_PAYEE_PURSE'] != WMR) { exit('Неверный кошелёк получателя...'); }
$query = $mysqli->query("SELECT `id` FROM `".PREFIX."_history_pay` WHERE `id` = '".(int)$_POST['LMI_PAYMENT_NO']."' LIMIT 1");
if ($query->num_rows)
{
exit('yes');
}
exit('Что то пошло не так...');
}
$hash = strtoupper(hash('sha256', $_POST['LMI_PAYEE_PURSE'].$_POST['LMI_PAYMENT_AMOUNT'].$_POST['LMI_PAYMENT_NO'].$_POST['LMI_MODE'].$_POST['LMI_SYS_INVS_NO'].$_POST['LMI_SYS_TRANS_NO'].$_POST['LMI_SYS_TRANS_DATE'].SECRET_KEY_WEBMONEY.$_POST['LMI_PAYER_PURSE'].$_POST['LMI_PAYER_WM']));
if ($hash == $_POST['LMI_HASH'])
{
$query = $mysqli->query("SELECT * FROM `".PREFIX."_history_pay` WHERE `id` = '".(int)$_POST['LMI_PAYMENT_NO']."' and `status` = '0' LIMIT 1");
if ($query->num_rows)
{
$res = $query->fetch_assoc();
if (sprintf("%.2f", $res['price'] + ($res['price']*$obEngine->getConfig('comm_pay')/100)) != $_POST['LMI_PAYMENT_AMOUNT']) { exit(); }
addZakaz($res, $_POST['LMI_PAYER_PURSE'], 'WebMoney');
}
}
exit();
}
else
{
print_r($_REQUEST);
}
#payeer
if (isset($_POST['m_operation_id']) && isset($_POST['m_sign']))
{
if ($_SERVER['REMOTE_ADDR'] != '37.59.221.230') return;
$arHash = array($_POST['m_operation_id'],
$_POST['m_operation_ps'],
$_POST['m_operation_date'],
$_POST['m_operation_pay_date'],
$_POST['m_shop'],
$_POST['m_orderid'],
$_POST['m_amount'],
$_POST['m_curr'],
$_POST['m_desc'],
$_POST['m_status'],
SECRET_KEY_PAYEER);
$sign_hash = strtoupper(hash('sha256', implode(':', $arHash)));
if ($_POST['m_sign'] == $sign_hash && $_POST['m_status'] == 'success')
{
$query = $mysqli->query("SELECT * FROM `".PREFIX."_history_pay` WHERE `id` = '".(int)$_POST['m_orderid']."' and `status` = '0' LIMIT 1");
if ($query->num_rows)
{
$res = $query->fetch_assoc();
if (sprintf("%.2f", $res['price'] + ($res['price']*$obEngine->getConfig('comm_pay')/100)) != $_POST['m_amount']) { exit($_POST['m_orderid'].'|error'); }
addZakaz($res, '', 'Payeer');
exit($_POST['m_orderid'].'|success');
}
}
exit($_POST['m_orderid'].'|error');
}
#merchant
if (isset($_POST['merchant']) && $_POST['merchant'] == 'directpay')
{
if (!isset($_SESSION['user_id'])) { exit(header('Location: /fail.php')); }
$query = $mysqli->query("SELECT * FROM `".PREFIX."_history_pay` WHERE `id` = '".(int)$_POST['id_zakaz']."' and `status` = '0' LIMIT 1");
if ($query->num_rows)
{
$res = $query->fetch_assoc();
if ($users_info['money'] < $res['price']) { exit(header('Location: /fail.php')); }
$mysqli->query("UPDATE `".PREFIX."_users` SET `money` = `money` - '".$res['price']."' WHERE `id` = '".$_SESSION['user_id']."'");
addZakaz($res, 'Баланс', 'Баланс');
?><meta http-equiv="Refresh" content="1; URL= /success.php"/><?
exit(header('Location: /success.php'));
}
}