代码之家  ›  专栏  ›  技术社区  ›  ganjan

HTAccess文件阻止支付宝支付通知

  •  0
  • ganjan  · 技术社区  · 15 年前

    下面是Paypal的IPN的$XPOST数据的例子:

    cmd=_notify-validate
    &test_ipn=1
    &payment_type=instant
    &payment_date=18%3A49%3A30+Nov+01%2C+2010+PDT
    &payment_status=Completed
    &address_status=unconfirmed
    &payer_status=unverified
    &first_name=John
    &last_name=Smith
    &payer_email=buyer
    %40paypalsandbox.com
    &payer_id=TESTBUYERID01
    &address_name=John+Smith
    &address_country=United+States
    &address_country_code=US
    &address_zip=95131
    &address_state=CA
    &address_city=San+Jose
    &address_street=123%2C+any+street
    &business=seller%40paypalsandbox.com
    &receiver_email=seller%40paypalsandbox.com
    &receiver_id=TESTSELLERID1
    &residence_country=US
    &item_name=something
    &item_number=AK-1234
    &quantity=1
    &shipping=3.04
    &tax=2.02
    &mc_currency=USD
    &mc_fee=0.44
    &mc_gross=10
    &mc_gross_1=10
    &txn_type=web_accept
    &txn_id=30112149
    &notify_version=2.1
    &custom=10points
    &charset=windows-1252
    &verify_sign=AFcWxV21C7Zyy8mw-cdzleMW.oxFXxXE
    

    当我尝试将此与.htaccess文件一起发送时,会收到403错误。

    HTAccess:

    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^(.*)$ http://%1/$1 [R=301,L]
    
    RewriteCond %{REQUEST_METHOD}  ^(HEAD|TRACE|DELETE|TRACK) [NC,OR]
    RewriteCond %{THE_REQUEST}     ^.*(\\r|\\n|%0A|%0D).* [NC,OR]
    
    RewriteCond %{HTTP_REFERER}    ^(.*)(<|>|’|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
    RewriteCond %{HTTP_COOKIE}     ^.*(<|>|’|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
    RewriteCond %{REQUEST_URI}     ^/(,|;|:|<|>|”>|”<|/|\\\.\.\\).{0,9999}.* [NC,OR]
    
    RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
    RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|scan).* [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|’|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
    
    RewriteCond %{QUERY_STRING}    ^.*(;|<|>|’|”|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR]
    RewriteCond %{QUERY_STRING}    ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR]
    RewriteCond %{QUERY_STRING}    ^.*\.[A-Za-z0-9].* [NC,OR]
    RewriteCond %{QUERY_STRING}    ^.*(<|>|’|%0A|%0D|%27|%3C|%3E|%00).* [NC]
    RewriteRule .* - [F]
    

    如何更改.htaccess文件以使其允许发布$\u数据?

    3 回复  |  直到 15 年前
        1
  •  0
  •   nonot1    15 年前

        2
  •  0
  •   Hamish    15 年前

    可能是这行:

    RewriteCond %{QUERY_STRING}    ^.*\.[A-Za-z0-9].* [NC,OR]
    

    我相信它在查询字符串中的字母数字字符后面的任何句号上都是匹配的。似乎这会使诸如“Shipping=3.04”之类的请求失败

        3
  •  0
  •   ganjan    15 年前

    找到了罪人:

    rewritesecond%http_user_agent ^$[或]