【安全加密】充值回调伪造：签名校验与重放拦截

-- 充值回调：签名校验
local player = class(actor)
local SECRET = "pay_secret_2026"
local function verifySign(params, sign)
    local keys = {}
    for k in pairs(params) do keys[#keys + 1] = k end
    table.sort(keys)
    local parts = {}
    for _, k in ipairs(keys) do
        parts[#parts + 1] = k .. "=" .. tostring(params[k])
    end
    local expect = string.upper(md5(table.concat(parts, "&") .. "&key=" .. SECRET))
    return expect == string.upper(sign)
end

-- 重放拦截：流水号与时间窗
local player = class(actor)
local function processCallback(params)
    local orderNo = params.orderno
    if getplayvar(player, "HUMAN", "Paid_" .. orderNo) == 1 then
        sendmsg(player, 1, 0, "订单已处理，请勿重复提交。")
        return false
    end
    if math.abs(os.time() - tonumber(params.ts or 0)) > 300 then
        sendmsg(player, 1, 0, "回调时间窗口过期。")
        return false
    end
    setplayvar(player, "HUMAN", "Paid_" .. orderNo, 1, true)
    giveitem(player, "元宝", tonumber(params.amount) or 0)
    return true
end