增加派单id合法性判断不合法派单则放弃

app/Http/Middleware/QuickAppGetPackage.php

@@ -19,7 +19,7 @@ class QuickAppGetPackage extends BaseMiddleware
     {
         // 获取头部信息
         $package     = $request->header('x-package', '');
-        
+
         $origin_package = $package;
         //FIXME 海天包传成浩瀚了，特殊处理下，这个名字就给海天用
 //         if($package =='com.beidao.kuaiying.haohan'){
@@ -32,8 +32,14 @@ class QuickAppGetPackage extends BaseMiddleware
 //        }
 
         $package = get_real_package($package);
-
         $channel_id = QappPackageService::getChannelId($package);
+        $sendOrderId  = $request->header('send-order-id',0);
+        if($request->input('send_order_id',0)){
+            $sendOrderId = $request->input('send_order_id',0);
+        }
+        $sendOrderId = check_qapp_send_order_id($channel_id,$sendOrderId) ? $sendOrderId : 0;
+        $request->headers->set('send-order-id',$sendOrderId);
+        $request->merge(['send_order_id' => $sendOrderId]);
         if($channel_id > 0){
             return $next($request);
         }else{

app/Http/Routes/QuickApp/QuickAppRoutes.php

@@ -13,7 +13,7 @@ Route::group(['domain' => env('QUICKAPP_DOMAIN'), 'namespace' => 'App\Http\Contr
     // vivo推送回调
     Route::any('push/vivoback', 'Push\PushController@vivoCallback');
 
-    Route::group(['prefix' => 'api', 'middleware' => 'checkSign'], function () {
+    Route::group(['prefix' => 'api', 'middleware' =>['checkSign','getPackage']], function () {
         //登录
         Route::post('login', 'Oauth\UsersController@index');
     });

app/Libs/Helpers.php

@@ -834,4 +834,30 @@ if (!function_exists("check_qapp_auth")){
         }
          return  false;
     }
+}
+
+/**
+ *
+ * name: check_qapp_send_order_id
+ *  判断派单id是否属于所访问的站点
+ * @param mixed  $channelId 站点id
+ * @param mixed $sendOrderId 派单id
+ * @return bool
+ * date 2022/09/09 10:50
+ */
+if (!function_exists("check_qapp_send_order_id)")){
+    function check_qapp_send_order_id($channelId = 0 ,$sendOrderId = 0){
+
+        if ($sendOrderId <  1  || $channelId < 1){
+            return false;
+        }
+        $sendOrderChannelId =  Redis::hGet("qapp:send_order:distribution_channel",$sendOrderId);
+        if ($sendOrderChannelId < 1 ){
+            $sendOrderChannelId = \DB::table('qapp_send_orders')->where('send_order_id','=',$sendOrderId)->value('distribution_channel_id');
+            if ($sendOrderChannelId > 0 ){
+                Redis::hSet("qapp:send_order:distribution_channel",$sendOrderId,$sendOrderChannelId);
+            }
+        }
+        return  trim($channelId) === trim($sendOrderChannelId);
+    }
 }