diff --git a/digital-avatar-app/backend/routers/tokens.py b/digital-avatar-app/backend/routers/tokens.py index a4bc8aa..3a030b6 100644 --- a/digital-avatar-app/backend/routers/tokens.py +++ b/digital-avatar-app/backend/routers/tokens.py @@ -1087,12 +1087,12 @@ async def huihui_virtual_payment_notify(request: Request, db: Session = Depends( callback_env = int(payload.get("env")) except (TypeError, ValueError, WechatVirtualPaymentError): raise HTTPException(status_code=422, detail="invalid virtual payment details") + callback_open_id = str(payload.get("openId") or "").strip() if ( isinstance(payload.get("amountCents"), bool) or isinstance(payload.get("env"), bool) or not user - or not user.wechat_mp_openid - or str(payload.get("openId") or "") != user.wechat_mp_openid + or (callback_open_id and callback_open_id != user.wechat_mp_openid) or not expected_product_id or str(payload.get("productId") or "") != expected_product_id or amount_cents != order.price_cents