Файл: payment/result.php
Строк: 92
<?php
declare(strict_types=1);
/* by Метриум (Стэлп) */
if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST') { http_response_code(405); exit('NO'); }
require_once '../system/common.php';
require_once 'sett.php';
if (!payment_ready()) { http_response_code(503); exit('NO'); }
$required = ['amount','nonce','signature','user_id','count','product'];
foreach ($required as $key) {
if (!isset($_POST[$key])) { http_response_code(400); exit('NO'); }
}
$amount = payment_amount($_POST['amount']);
$nonce = preg_replace('/[^0-9]/', '', (string)$_POST['nonce']) ?: '';
$incoming = strtolower(trim((string)$_POST['signature']));
$uid = max(0, (int)$_POST['user_id']);
$count = max(0, (int)$_POST['count']);
$type = (string)$_POST['product'];
if ($uid <= 0 || $type !== 'gold' || !isset($payment_gold_packages[$count]) ||
payment_amount($payment_gold_packages[$count]) !== $amount || $nonce === '') {
http_response_code(400); exit('NO');
}
$expected = hash_hmac('sha256', $payment_merchant_id.'|'.$amount.'|'.$nonce.'|'.$uid.'|'.$count, $payment_secret);
if (!hash_equals($expected, $incoming)) { http_response_code(403); exit('NO'); }
$receipt = hash('sha256', $incoming.'|'.$amount.'|'.$nonce.'|'.$uid.'|'.$count.'|'.$type);
$pdo = db_pdo();
try {
$pdo->beginTransaction();
$exists = db_fetch_one('SELECT `receipt_hash` FROM `payment_receipts` WHERE `receipt_hash`=:h FOR UPDATE', ['h'=>$receipt]);
if ($exists) { $pdo->commit(); exit('YES'); }
if (!db_fetch_one('SELECT `id` FROM `users` WHERE `id`=:u FOR UPDATE', ['u'=>$uid])) {
throw new RuntimeException('user not found');
}
$sale = db_fetch_one('SELECT `time` FROM `skilka` WHERE `id`=7 LIMIT 1');
$mult = ((int)($sale['time'] ?? 0) > time()) ? 2 : 1;
$credited = $count * $mult;
db_execute('INSERT INTO `payment_receipts` (`receipt_hash`,`user`,`gold`,`amount`,`created_at`) VALUES (:h,:u,:g,:a,:t)', ['h'=>$receipt,'u'=>$uid,'g'=>$count,'a'=>$amount,'t'=>time()]);
db_execute('UPDATE `users` SET `g`=`g`+:g WHERE `id`=:u', ['g'=>$credited,'u'=>$uid]);
db_execute('INSERT INTO `contacts` (`user`,`ho`,`time`) VALUES (:u,2,:t) ON DUPLICATE KEY UPDATE `time`=VALUES(`time`)', ['u'=>$uid,'t'=>time()]);
db_execute('INSERT INTO `mail` (`from`,`time`,`read`,`to`,`text`) VALUES (0,:t,0,:u,:x)', ['t'=>time(),'u'=>$uid,'x'=>'Вы купили '.$count.' золота'.($mult > 1 ? ' и получили x2 по активной акции.' : '!')]);
$pdo->commit();
try {
game_bonus_offer_register_topup($uid, $count);
} catch (Throwable $bonusError) {
if (function_exists('app_log_write')) {
app_log_write('PAYMENT', 'Bonus kit grant delayed', ['uid'=>$uid,'type'=>get_class($bonusError)]);
}
}
exit('YES');
} catch (Throwable $e) {
if ($pdo->inTransaction()) { $pdo->rollBack(); }
if (function_exists('app_log_write')) {
app_log_write('PAYMENT', 'Payment callback failed', ['uid'=>$uid,'type'=>get_class($e)]);
}
http_response_code(500);
exit('NO');
}