fix: 禁止支付环节修改支付方式，修复 payType 绕过漏洞

Co-authored-by: Cursor <cursoragent@cursor.com>

fs-service-system/src/main/java/com/fs/store/service/impl/FsStoreOrderServiceImpl.java

@@ -420,7 +420,7 @@ public class FsStoreOrderServiceImpl implements IFsStoreOrderService
         if(!Objects.equals(order.getStatus(), OrderInfoEnum.STATUS_0.getValue())){
             return R.error("订单状态不正确");
         }
-        R payTypeError = validateAppPayType(param.getPayType());
+        R payTypeError = validatePayTypeNotModified(order, param.getPayType());
         if (payTypeError != null) {
             return payTypeError;
         }
@@ -467,22 +467,18 @@ public class FsStoreOrderServiceImpl implements IFsStoreOrderService
             else{
                 String config=configService.selectConfigByKey("store.config");
                 StoreConfig storeConfig= JSONUtil.toBean(config,StoreConfig.class);
-                if(param.getPayType().equals(1)){
-                    order.setPayType("1");
+                if(order.getPayType().equals("1")){
                     order.setPayMoney(order.getPayPrice());
                     order.setPayDelivery(BigDecimal.ZERO);
                 }
-                else if(param.getPayType().equals(2)){
-                    order.setPayType("2");
+                else if(order.getPayType().equals("2")){
                     BigDecimal payMoney=order.getPayPrice().multiply(new BigDecimal(storeConfig.getPayRate())).divide(new BigDecimal(100));
                     payMoney=new BigDecimal(payMoney.setScale(0, BigDecimal.ROUND_HALF_UP).longValue());
                     order.setPayDelivery(order.getPayPrice().subtract(payMoney));
                     order.setPayMoney(payMoney);
                 }
-                else if(param.getPayType().equals(3)){
-                    //货到付款
-                    order.setPayType("3");
-                    order.setPayDelivery(order.getPayPrice() );
+                else if(order.getPayType().equals("3")){
+                    order.setPayDelivery(order.getPayPrice());
                     order.setPayMoney(BigDecimal.ZERO);
                 }
                 orderService.updateFsStoreOrder(order);
@@ -531,7 +527,7 @@ public class FsStoreOrderServiceImpl implements IFsStoreOrderService
 
                 PayProcessContext processContext = new PayProcessContext();
                 processContext.setOrderId(param.getOrderId());
-                processContext.setPayType(param.getPayType());
+                processContext.setPayType(Integer.valueOf(order.getPayType()));
                 processContext.setPaymentId(storePayment.getPaymentId());
                 processContext.setPayCode(storePayment.getPayCode());
                 processContext.setWxMiniProgramConfig(wConfig);
@@ -551,9 +547,8 @@ public class FsStoreOrderServiceImpl implements IFsStoreOrderService
                 }
             }
             else if(order.getPayType().equals("3")){
-                //货到付款
                 orderService.payConfirm(2,order.getId(),null,null,null,null);
-                return R.ok().put("payType",param.getPayType());
+                return R.ok().put("payType",Integer.valueOf(order.getPayType()));
             }
             return R.error();
         }
@@ -3721,94 +3716,7 @@ public class FsStoreOrderServiceImpl implements IFsStoreOrderService
         if(order==null){
             return R.error("订单不存在");
         }
-        if(order.getStatus()!= OrderInfoEnum.STATUS_0.getValue()){
-            return R.error("订单状态不正确");
-        }
-        R payTypeError = validateAppPayType(param.getPayType());
-        if (payTypeError != null) {
-            return payTypeError;
-        }
-
-        Object isPaying =redisCache.getCacheObject("isPaying:"+order.getId());
-        if(ObjectUtil.isNotNull(isPaying)){
-            return R.error("正在支付中...");
-        }
-        List<FsStorePayment>  payments=fsStorePaymentMapper.selectFsStorePaymentByOrder(order.getId());
-        if(payments.size()>0){
-            for(FsStorePayment payment : payments){
-                if(StringUtils.isEmpty(payment.getTradeNo())){
-                    continue;
-                }
-                OrderQueryDTO orderQueryDTO = new OrderQueryDTO();
-                orderQueryDTO.setLowOrderId("store-"+payment.getPayCode());
-                RequestDTO<QueryOrderRestDTO> requestDTO = new RequestDTO<>();
-
-                QueryOrderRestDTO queryOrderRestDTO = new QueryOrderRestDTO();
-
-                queryOrderRestDTO.setOrderFlowNo(payment.getTradeNo());
-                TzConfigInfoDTO tzConfigInfoDTO = TzConfigUtils.getConfig();
-
-                queryOrderRestDTO.setPlatMerCstNo(tzConfigInfoDTO.getPlatMerCstNo());
-
-                requestDTO.setReqBody(queryOrderRestDTO);
-                requestDTO.setReqHeader(TzReqHeaderDTO.getInstance(payment.getPayCode()));
-                try {
-                    TzReqResultDTO<QueryOrderInfoDTO> resultDTO = tzBankService.payQueryOrder(requestDTO);
-                    if(ObjectUtil.isNotNull(resultDTO)){
-                        QueryOrderInfoDTO body = resultDTO.getBody();
-                        if(ObjectUtil.isNotNull(body)){
-                            if("80".equals(body.getStatus()) || "90".equals(body.getStatus())){
-                                // 更新订单状态和支付状态
-//                                payment.setStatus(1);
-//                                fsStorePaymentMapper.updateFsStorePayment(payment);
-                                orderService.payConfirm(1, order.getId(), payment.getPayCode(),
-                                        payment.getTradeNo(),
-                                        body.getChlTrxId(),
-                                        payment.getTradeNo());
-                                return R.error("订单已支付，请刷新页面");
-                            }
-                        }
-                    }
-                } catch (Exception e) {
-                    throw new RuntimeException(e);
-                }
-            }
-        }
-        FsUser user=userService.selectFsUserById(order.getUserId());
-        if(user!=null&& StringUtils.isNotEmpty(user.getMaOpenId())){
-            //已改价处理
-            if(order.getIsEditMoney()!=null&&order.getIsEditMoney()==1){
-                //改过价不做处理
-            }
-            else{
-                String config=configService.selectConfigByKey("store.config");
-                StoreConfig storeConfig= JSONUtil.toBean(config,StoreConfig.class);
-                if(param.getPayType().equals(1)){
-                    order.setPayType("1");
-                    order.setPayMoney(order.getPayPrice());
-                    order.setPayDelivery(BigDecimal.ZERO);
-                }
-                else if(param.getPayType().equals(2)){
-
-                    order.setPayType("2");
-                    BigDecimal payMoney=order.getPayPrice().multiply(new BigDecimal(storeConfig.getPayRate())).divide(new BigDecimal(100));
-                    payMoney=new BigDecimal(payMoney.setScale(0, BigDecimal.ROUND_HALF_UP).longValue());
-                    order.setPayDelivery(order.getPayPrice().subtract(payMoney));
-                    order.setPayMoney(payMoney);
-                }
-                else if(param.getPayType().equals(3)){
-                    //货到付款
-                    order.setPayType("3");
-                    order.setPayDelivery(order.getPayPrice() );
-                    order.setPayMoney(BigDecimal.ZERO);
-                }
-                orderService.updateFsStoreOrder(order);
-            }
-            return R.ok().put("order",order);
-        }
-        else{
-            return R.error("用户OPENID不存在");
-        }
+        return R.error("不允许修改支付方式");
     }
 
     @Override
@@ -3936,11 +3844,17 @@ public class FsStoreOrderServiceImpl implements IFsStoreOrderService
     }
 
     /**
-     * 校验 App 端支付类型，禁止通过 payType=3（货到付款）绕过在线支付。
+     * 校验支付请求中的 payType 与下单时一致，禁止支付环节修改支付方式。
      */
-    private R validateAppPayType(Integer payType) {
-        if (Objects.equals(payType, 3)) {
-            return R.error("不支持该支付方式");
+    private R validatePayTypeNotModified(FsStoreOrder order, Integer requestPayType) {
+        if (requestPayType == null) {
+            return R.error("支付方式不能为空");
+        }
+        if (StringUtils.isEmpty(order.getPayType())) {
+            return R.error("订单支付方式异常");
+        }
+        if (!Objects.equals(String.valueOf(requestPayType), order.getPayType())) {
+            return R.error("不允许修改支付方式");
         }
         return null;
     }