fix: 罚款微信支付使用俱乐部openid并安全解析微信响应

users/views.py

@@ -12005,6 +12005,14 @@ class FaKuanPayView(APIView):
             dingdanid = f"FK{timestamp_ms:011d}{timestamp_ns:06d}{random_num:02d}"
 
             from jituan.services.club_write import resolve_club_id_for_write
+            from jituan.services.club_user import get_payment_openid
+            pay_openid, _ = get_payment_openid(request)
+            if not pay_openid:
+                return Response({
+                    'code': 400,
+                    'message': '用户openid不存在，无法发起微信支付',
+                }, status=status.HTTP_400_BAD_REQUEST)
+
             chongzhi_jilu = Czjilu.query.create(
                 dingdan_id=dingdanid,
                 zhuangtai=9,
@@ -12019,7 +12027,7 @@ class FaKuanPayView(APIView):
                 pay_params = self.generate_wechat_pay_params(
                     dingdanid=dingdanid,
                     jine=jine,
-                    openid=request.user.OpenID,
+                    openid=pay_openid,
                     pay_type='fakuan'
                 )
             except Exception as e:
@@ -12104,12 +12112,25 @@ class FaKuanPayView(APIView):
             timeout=10
         )
 
+        logger.info(f"罚款微信支付响应: {response.text}")
+
         root = ET.fromstring(response.content)
-        return_code = root.find('return_code').text
-        result_code = root.find('result_code').text
+
+        return_code_node = root.find('return_code')
+        if return_code_node is None or return_code_node.text is None:
+            logger.error(f"微信返回缺少return_code，原始: {response.text}")
+            raise Exception('微信支付接口异常，缺少return_code')
+        return_code = return_code_node.text
+
+        result_code_node = root.find('result_code')
+        result_code = result_code_node.text if result_code_node is not None else None
 
         if return_code == 'SUCCESS' and result_code == 'SUCCESS':
-            prepay_id = root.find('prepay_id').text
+            prepay_id_node = root.find('prepay_id')
+            if prepay_id_node is None or prepay_id_node.text is None:
+                logger.error(f"统一下单成功但无prepay_id，原始: {response.text}")
+                raise Exception('微信支付接口异常，缺少prepay_id')
+            prepay_id = prepay_id_node.text
             timestamp = str(int(time.time()))
             nonce_str = ''.join(random.choices(string.ascii_letters + string.digits, k=32))
             package = f'prepay_id={prepay_id}'
@@ -12139,10 +12160,15 @@ class FaKuanPayView(APIView):
         else:
             err_code = root.find('err_code')
             err_code_des = root.find('err_code_des')
+            return_msg = root.find('return_msg')
             error_details = f"return_code: {return_code}"
-            if err_code is not None:
+            if result_code:
+                error_details += f", result_code: {result_code}"
+            if return_msg is not None and return_msg.text:
+                error_details += f", return_msg: {return_msg.text}"
+            if err_code is not None and err_code.text:
                 error_details += f", err_code: {err_code.text}"
-            if err_code_des is not None:
+            if err_code_des is not None and err_code_des.text:
                 error_details += f", err_code_des: {err_code_des.text}"
             raise Exception(f"微信支付下单失败: {error_details}")