Fix 401 error on sign request on verify

2026-07-27 01:17:08 +03:30
parent afc23165bd
commit cdefe88afe
3 changed files with 71 additions and 12 deletions
@@ -49,12 +49,22 @@ class MontifyHmacSigner
    public function verifyReturnSignature(array $query): bool
    {
        $signature = (string) ($query['signature'] ?? '');
-        if ($signature === '') {
+        if ($signature === '' || !ctype_xdigit($signature)) {
            return false;
        }

        unset($query['signature']);
-        $expected = hash_hmac('sha256', $this->stableStringify($query), $this->clientSecret);
+
+        // فقط اسکالرها — همه string طبق مستند پارتنر
+        $payload = [];
+        foreach ($query as $key => $value) {
+            if (!is_string($key) || is_array($value) || $value === null) {
+                continue;
+            }
+            $payload[$key] = (string) $value;
+        }
+
+        $expected = hash_hmac('sha256', $this->stableStringify($payload), $this->clientSecret);

        return $this->hashEqualsHex($signature, $expected);
    }