Python实现支付宝在线支付
文章摘自https://www.cnblogs.com/ctztake/p/8513628.html
windows系统安装Python虚拟环境
首先保证你的系统已经安装好了Python
安装virtualenv
C:\WINDOWS\system32>pip3 install virtualenv Collecting virtualenv Downloading virtualenv-15.1.0-py2.py3-none-any.whl (1.8MB) 100% |████████████████████████████████| 1.8MB 110kB/s Installing collected packages: virtualenv Successfully installed virtualenv-15.1.0
C:\WINDOWS\system32>
安装virtualenvwrapper
virtualenvwrapper是virtualenv的一个方便管理虚拟环境的管理器
pip3 install virtualenvwrapper
指定虚拟环境,保存路径
首先在要保存虚拟环境的地方创建一个Evns目录,然后将这个目录添加到系统环境变量,以后创建的虚拟环境就会保存在这个目录,重启系统后生效
创建虚拟环境,创建后会自动进入虚拟环境
mkvirtualenv 虚拟环境名称
[root@192 xu_ni_huan_jing]# mkvirtualenv jxiou Using base prefix '/usr/local' New python executable in /usr/xu_ni_huan_jing/jxiou/bin/python3.5 Also creating executable in /usr/xu_ni_huan_jing/jxiou/bin/python Installing setuptools, pip, wheel...done. virtualenvwrapper.user_scripts creating /usr/xu_ni_huan_jing/jxiou/bin/predeactivate virtualenvwrapper.user_scripts creating /usr/xu_ni_huan_jing/jxiou/bin/postdeactivate virtualenvwrapper.user_scripts creating /usr/xu_ni_huan_jing/jxiou/bin/preactivate virtualenvwrapper.user_scripts creating /usr/xu_ni_huan_jing/jxiou/bin/postactivate virtualenvwrapper.user_scripts creating /usr/xu_ni_huan_jing/jxiou/bin/get_env_details (jxiou) [root@192 xu_ni_huan_jing]#
5.退出虚拟环境
deactivate
(jxiou) [root@192 xu_ni_huan_jing]# deactivate [root@192 xu_ni_huan_jing]#
6.查看有哪些虚拟环境
workon
[root@192 /]# workon jxiou2 jxiou [root@192 /]#
7.进入一个指定的虚拟环境
workon jxiou(虚拟环境名称)
[root@192 /]# workon jxiou (jxiou) [root@192 /]#
8.虚拟环境创建好后,创建Django项目,创建好数据库,开始本地调试支付请求
支付宝接口集成 ,本地环境调试支付请求
1。首先登录 蚂蚁金服网站,也就是支付宝开发者平台
登录蚂蚁金服开发者平台后,创建沙箱应用
也就是支付宝给开发者提供的调试环境应用
注意这里我们一定选择RSA2(SHA256)密钥(推荐),这个是比较安全的方式,
2.我们设置应用公钥
设置公钥,访问https://docs.open.alipay.com/291/105971/ 这个网址
下载生成公钥的工具
下载解压后
生成公钥
生成公钥后会得到两个文件
注意:这两个文件很重要一定要保存好
生成公钥后,将公钥填写到信息配置里
当我们填写好公钥保存后,会自动给我们生成支付宝公钥
将生成的支付宝公钥,复制下载写在一个TXT文件里
这样我们就有了3个秘钥
将3个秘钥修改成英文或者拼音名称后,放到网站项目中
在秘钥txt文件里,秘钥内容的头部和结尾加上两行字符串,注意所有秘钥都要加
-----BEGIN PRIVATE KEY----- 秘钥内容.... -----END PRIVATE KEY-----
3.支付宝,支付集成代码
#!/usr/bin/env python # -*- coding:utf8 -*-
# pip install pycryptodome 需要模块加密方面的模块
author = ‘bobby’
from datetime import datetime
from Crypto.PublicKey import RSA
from Crypto.Signature import PKCS1_v1_5
from Crypto.Hash import SHA256
from base64 import b64encode, b64decode
from urllib.parse import quote_plus
from urllib.parse import urlparse, parse_qs
from urllib.request import urlopen
from base64 import decodebytes, encodebytes
import json
class AliPay(object):
“”"
支付宝支付接口
“”"
def init(self, appid, app_notify_url, app_private_key_path,
alipay_public_key_path, return_url, debug=False):
self.appid = appid
self.app_notify_url = app_notify_url
self.app_private_key_path = app_private_key_path
self.app_private_key = None
self.return_url = return_url
with open(self.app_private_key_path) as fp:
self.app_private_key = RSA.importKey(fp.read())
self.alipay_public_key_path </span>=<span style="color: #000000;"> alipay_public_key_path
with open(self.alipay_public_key_path) as fp:
self.alipay_public_key </span>=<span style="color: #000000;"> RSA.import_key(fp.read())
</span><span style="color: #0000ff;">if</span> debug <span style="color: #0000ff;">is</span><span style="color: #000000;"> True:
self.</span><span style="color: #800080;">__gateway</span> = <span style="color: #800000;">"</span><span style="color: #800000;">https://openapi.alipaydev.com/gateway.do</span><span style="color: #800000;">"</span>
<span style="color: #0000ff;">else</span><span style="color: #000000;">:
self.</span><span style="color: #800080;">__gateway</span> = <span style="color: #800000;">"</span><span style="color: #800000;">https://openapi.alipay.com/gateway.do</span><span style="color: #800000;">"</span>
<span style="color: #0000ff;">def</span> direct_pay(self, subject, out_trade_no, total_amount, return_url=None, **<span style="color: #000000;">kwargs):
biz_content </span>=<span style="color: #000000;"> {
</span><span style="color: #800000;">"</span><span style="color: #800000;">subject</span><span style="color: #800000;">"</span><span style="color: #000000;">: subject,
</span><span style="color: #800000;">"</span><span style="color: #800000;">out_trade_no</span><span style="color: #800000;">"</span><span style="color: #000000;">: out_trade_no,
</span><span style="color: #800000;">"</span><span style="color: #800000;">total_amount</span><span style="color: #800000;">"</span><span style="color: #000000;">: total_amount,
</span><span style="color: #800000;">"</span><span style="color: #800000;">product_code</span><span style="color: #800000;">"</span>: <span style="color: #800000;">"</span><span style="color: #800000;">FAST_INSTANT_TRADE_PAY</span><span style="color: #800000;">"</span><span style="color: #000000;">,
</span><span style="color: #008000;">#</span><span style="color: #008000;"> "qr_pay_mode":4</span>
}
biz_content.update(kwargs)
data </span>= self.build_body(<span style="color: #800000;">"</span><span style="color: #800000;">alipay.trade.page.pay</span><span style="color: #800000;">"</span><span style="color: #000000;">, biz_content, self.return_url)
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> self.sign_data(data)
</span><span style="color: #0000ff;">def</span> build_body(self, method, biz_content, return_url=<span style="color: #000000;">None):
data </span>=<span style="color: #000000;"> {
</span><span style="color: #800000;">"</span><span style="color: #800000;">app_id</span><span style="color: #800000;">"</span><span style="color: #000000;">: self.appid,
</span><span style="color: #800000;">"</span><span style="color: #800000;">method</span><span style="color: #800000;">"</span><span style="color: #000000;">: method,
</span><span style="color: #800000;">"</span><span style="color: #800000;">charset</span><span style="color: #800000;">"</span>: <span style="color: #800000;">"</span><span style="color: #800000;">utf-8</span><span style="color: #800000;">"</span><span style="color: #000000;">,
</span><span style="color: #800000;">"</span><span style="color: #800000;">sign_type</span><span style="color: #800000;">"</span>: <span style="color: #800000;">"</span><span style="color: #800000;">RSA2</span><span style="color: #800000;">"</span><span style="color: #000000;">,
</span><span style="color: #800000;">"</span><span style="color: #800000;">timestamp</span><span style="color: #800000;">"</span>: datetime.now().strftime(<span style="color: #800000;">"</span><span style="color: #800000;">%Y-%m-%d %H:%M:%S</span><span style="color: #800000;">"</span><span style="color: #000000;">),
</span><span style="color: #800000;">"</span><span style="color: #800000;">version</span><span style="color: #800000;">"</span>: <span style="color: #800000;">"</span><span style="color: #800000;">1.0</span><span style="color: #800000;">"</span><span style="color: #000000;">,
</span><span style="color: #800000;">"</span><span style="color: #800000;">biz_content</span><span style="color: #800000;">"</span><span style="color: #000000;">: biz_content
}
</span><span style="color: #0000ff;">if</span> return_url <span style="color: #0000ff;">is</span> <span style="color: #0000ff;">not</span><span style="color: #000000;"> None:
data[</span><span style="color: #800000;">"</span><span style="color: #800000;">notify_url</span><span style="color: #800000;">"</span>] =<span style="color: #000000;"> self.app_notify_url
data[</span><span style="color: #800000;">"</span><span style="color: #800000;">return_url</span><span style="color: #800000;">"</span>] =<span style="color: #000000;"> self.return_url
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> data
</span><span style="color: #0000ff;">def</span><span style="color: #000000;"> sign_data(self, data):
data.pop(</span><span style="color: #800000;">"</span><span style="color: #800000;">sign</span><span style="color: #800000;">"</span><span style="color: #000000;">, None)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 排序后的字符串</span>
unsigned_items =<span style="color: #000000;"> self.ordered_data(data)
unsigned_string </span>= <span style="color: #800000;">"</span><span style="color: #800000;">&</span><span style="color: #800000;">"</span>.join(<span style="color: #800000;">"</span><span style="color: #800000;">{0}={1}</span><span style="color: #800000;">"</span>.format(k, v) <span style="color: #0000ff;">for</span> k, v <span style="color: #0000ff;">in</span><span style="color: #000000;"> unsigned_items)
sign </span>= self.sign(unsigned_string.encode(<span style="color: #800000;">"</span><span style="color: #800000;">utf-8</span><span style="color: #800000;">"</span><span style="color: #000000;">))
ordered_items </span>=<span style="color: #000000;"> self.ordered_data(data)
quoted_string </span>= <span style="color: #800000;">"</span><span style="color: #800000;">&</span><span style="color: #800000;">"</span>.join(<span style="color: #800000;">"</span><span style="color: #800000;">{0}={1}</span><span style="color: #800000;">"</span>.format(k, quote_plus(v)) <span style="color: #0000ff;">for</span> k, v <span style="color: #0000ff;">in</span><span style="color: #000000;"> ordered_items)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 获得最终的订单信息字符串</span>
signed_string = quoted_string + <span style="color: #800000;">"</span><span style="color: #800000;">&sign=</span><span style="color: #800000;">"</span> +<span style="color: #000000;"> quote_plus(sign)
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> signed_string
</span><span style="color: #0000ff;">def</span><span style="color: #000000;"> ordered_data(self, data):
complex_keys </span>=<span style="color: #000000;"> []
</span><span style="color: #0000ff;">for</span> key, value <span style="color: #0000ff;">in</span><span style="color: #000000;"> data.items():
</span><span style="color: #0000ff;">if</span><span style="color: #000000;"> isinstance(value, dict):
complex_keys.append(key)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 将字典类型的数据dump出来</span>
<span style="color: #0000ff;">for</span> key <span style="color: #0000ff;">in</span><span style="color: #000000;"> complex_keys:
data[key] </span>= json.dumps(data[key], separators=(<span style="color: #800000;">'</span><span style="color: #800000;">,</span><span style="color: #800000;">'</span>, <span style="color: #800000;">'</span><span style="color: #800000;">:</span><span style="color: #800000;">'</span><span style="color: #000000;">))
</span><span style="color: #0000ff;">return</span> sorted([(k, v) <span style="color: #0000ff;">for</span> k, v <span style="color: #0000ff;">in</span><span style="color: #000000;"> data.items()])
</span><span style="color: #0000ff;">def</span><span style="color: #000000;"> sign(self, unsigned_string):
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 开始计算签名</span>
key =<span style="color: #000000;"> self.app_private_key
signer </span>=<span style="color: #000000;"> PKCS1_v1_5.new(key)
signature </span>=<span style="color: #000000;"> signer.sign(SHA256.new(unsigned_string))
</span><span style="color: #008000;">#</span><span style="color: #008000;"> base64 编码,转换为unicode表示并移除回车</span>
sign = encodebytes(signature).decode(<span style="color: #800000;">"</span><span style="color: #800000;">utf8</span><span style="color: #800000;">"</span>).replace(<span style="color: #800000;">"</span><span style="color: #800000;">\n</span><span style="color: #800000;">"</span>, <span style="color: #800000;">""</span><span style="color: #000000;">)
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> sign
</span><span style="color: #0000ff;">def</span><span style="color: #000000;"> _verify(self, raw_content, signature):
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 开始计算签名</span>
key =<span style="color: #000000;"> self.alipay_public_key
signer </span>=<span style="color: #000000;"> PKCS1_v1_5.new(key)
digest </span>=<span style="color: #000000;"> SHA256.new()
digest.update(raw_content.encode(</span><span style="color: #800000;">"</span><span style="color: #800000;">utf8</span><span style="color: #800000;">"</span><span style="color: #000000;">))
</span><span style="color: #0000ff;">if</span> signer.verify(digest, decodebytes(signature.encode(<span style="color: #800000;">"</span><span style="color: #800000;">utf8</span><span style="color: #800000;">"</span><span style="color: #000000;">))):
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> True
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> False
</span><span style="color: #0000ff;">def</span><span style="color: #000000;"> verify(self, data, signature):
</span><span style="color: #0000ff;">if</span> <span style="color: #800000;">"</span><span style="color: #800000;">sign_type</span><span style="color: #800000;">"</span> <span style="color: #0000ff;">in</span><span style="color: #000000;"> data:
sign_type </span>= data.pop(<span style="color: #800000;">"</span><span style="color: #800000;">sign_type</span><span style="color: #800000;">"</span><span style="color: #000000;">)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 排序后的字符串</span>
unsigned_items =<span style="color: #000000;"> self.ordered_data(data)
message </span>= <span style="color: #800000;">"</span><span style="color: #800000;">&</span><span style="color: #800000;">"</span>.join(u<span style="color: #800000;">"</span><span style="color: #800000;">{}={}</span><span style="color: #800000;">"</span>.format(k, v) <span style="color: #0000ff;">for</span> k, v <span style="color: #0000ff;">in</span><span style="color: #000000;"> unsigned_items)
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> self._verify(message, signature)
if name == “main”:
“”“支付请求过程”""
# 传递参数初始化支付类
alipay = AliPay(
appid=“2016080800192023”, # 设置签约的appid
app_notify_url=“http://projectsedus.com/”, # 异步支付通知url
app_private_key_path=u"ying_yong_si_yao.txt", # 设置应用私钥
alipay_public_key_path=“zhi_fu_bao_gong_yao.txt”, # 支付宝的公钥,验证支付宝回传消息使用,不是你自己的公钥,
debug=True, # 默认False, # 设置是否是沙箱环境,True是沙箱环境
return_url=“http://47.92.87.172:8000/” # 同步支付通知url
)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 传递参数执行支付类里的direct_pay方法,返回签名后的支付参数,</span>
url =<span style="color: #000000;"> alipay.direct_pay(
subject</span>=<span style="color: #800000;">"</span><span style="color: #800000;">测试订单</span><span style="color: #800000;">"</span>, <span style="color: #008000;">#</span><span style="color: #008000;"> 订单名称</span>
<span style="color: #008000;">#</span><span style="color: #008000;"> 订单号生成,一般是当前时间(精确到秒)+用户ID+随机数</span>
out_trade_no=<span style="color: #800000;">"</span><span style="color: #800000;">201702021225</span><span style="color: #800000;">"</span>, <span style="color: #008000;">#</span><span style="color: #008000;"> 订单号</span>
total_amount=100, <span style="color: #008000;">#</span><span style="color: #008000;"> 支付金额</span>
return_url=<span style="color: #800000;">"</span><span style="color: #800000;">http://47.92.87.172:8000/</span><span style="color: #800000;">"</span> <span style="color: #008000;">#</span><span style="color: #008000;"> 支付成功后,跳转url</span>
)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 将前面后的支付参数,拼接到支付网关</span>
<span style="color: #008000;">#</span><span style="color: #008000;"> 注意:下面支付网关是沙箱环境,</span>
re_url = <span style="color: #800000;">"</span><span style="color: #800000;">https://openapi.alipaydev.com/gateway.do?{data}</span><span style="color: #800000;">"</span>.format(data=<span style="color: #000000;">url)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(re_url)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 最终进行签名后组合成支付宝的url请求</span></span></pre>
4.生成支付URL后,我们用这个URL模拟支付一下
注意:沙箱环境,支付的时候要用沙箱账号里提供的支付账号才可以支付
支付成功后已经,跳转到我们设置的同步处理页面
5.支付宝支付成功后通知接口验证
#!/usr/bin/env python # -*- coding:utf8 -*-
# pip install pycryptodome 需要模块加密方面的模块
author = ‘bobby’
from datetime import datetime
from Crypto.PublicKey import RSA
from Crypto.Signature import PKCS1_v1_5
from Crypto.Hash import SHA256
from base64 import b64encode, b64decode
from urllib.parse import quote_plus
from urllib.parse import urlparse, parse_qs
from urllib.request import urlopen
from base64 import decodebytes, encodebytes
import json
class AliPay(object):
“”"
支付宝支付接口
“”"
def init(self, appid, app_notify_url, app_private_key_path,
alipay_public_key_path, return_url, debug=False):
self.appid = appid
self.app_notify_url = app_notify_url
self.app_private_key_path = app_private_key_path
self.app_private_key = None
self.return_url = return_url
with open(self.app_private_key_path) as fp:
self.app_private_key = RSA.importKey(fp.read())
self.alipay_public_key_path </span>=<span style="color: #000000;"> alipay_public_key_path
with open(self.alipay_public_key_path) as fp:
self.alipay_public_key </span>=<span style="color: #000000;"> RSA.import_key(fp.read())
</span><span style="color: #0000ff;">if</span> debug <span style="color: #0000ff;">is</span><span style="color: #000000;"> True:
self.</span><span style="color: #800080;">__gateway</span> = <span style="color: #800000;">"</span><span style="color: #800000;">https://openapi.alipaydev.com/gateway.do</span><span style="color: #800000;">"</span>
<span style="color: #0000ff;">else</span><span style="color: #000000;">:
self.</span><span style="color: #800080;">__gateway</span> = <span style="color: #800000;">"</span><span style="color: #800000;">https://openapi.alipay.com/gateway.do</span><span style="color: #800000;">"</span>
<span style="color: #0000ff;">def</span> direct_pay(self, subject, out_trade_no, total_amount, return_url=None, **<span style="color: #000000;">kwargs):
biz_content </span>=<span style="color: #000000;"> {
</span><span style="color: #800000;">"</span><span style="color: #800000;">subject</span><span style="color: #800000;">"</span><span style="color: #000000;">: subject,
</span><span style="color: #800000;">"</span><span style="color: #800000;">out_trade_no</span><span style="color: #800000;">"</span><span style="color: #000000;">: out_trade_no,
</span><span style="color: #800000;">"</span><span style="color: #800000;">total_amount</span><span style="color: #800000;">"</span><span style="color: #000000;">: total_amount,
</span><span style="color: #800000;">"</span><span style="color: #800000;">product_code</span><span style="color: #800000;">"</span>: <span style="color: #800000;">"</span><span style="color: #800000;">FAST_INSTANT_TRADE_PAY</span><span style="color: #800000;">"</span><span style="color: #000000;">,
</span><span style="color: #008000;">#</span><span style="color: #008000;"> "qr_pay_mode":4</span>
}
biz_content.update(kwargs)
data </span>= self.build_body(<span style="color: #800000;">"</span><span style="color: #800000;">alipay.trade.page.pay</span><span style="color: #800000;">"</span><span style="color: #000000;">, biz_content, self.return_url)
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> self.sign_data(data)
</span><span style="color: #0000ff;">def</span> build_body(self, method, biz_content, return_url=<span style="color: #000000;">None):
data </span>=<span style="color: #000000;"> {
</span><span style="color: #800000;">"</span><span style="color: #800000;">app_id</span><span style="color: #800000;">"</span><span style="color: #000000;">: self.appid,
</span><span style="color: #800000;">"</span><span style="color: #800000;">method</span><span style="color: #800000;">"</span><span style="color: #000000;">: method,
</span><span style="color: #800000;">"</span><span style="color: #800000;">charset</span><span style="color: #800000;">"</span>: <span style="color: #800000;">"</span><span style="color: #800000;">utf-8</span><span style="color: #800000;">"</span><span style="color: #000000;">,
</span><span style="color: #800000;">"</span><span style="color: #800000;">sign_type</span><span style="color: #800000;">"</span>: <span style="color: #800000;">"</span><span style="color: #800000;">RSA2</span><span style="color: #800000;">"</span><span style="color: #000000;">,
</span><span style="color: #800000;">"</span><span style="color: #800000;">timestamp</span><span style="color: #800000;">"</span>: datetime.now().strftime(<span style="color: #800000;">"</span><span style="color: #800000;">%Y-%m-%d %H:%M:%S</span><span style="color: #800000;">"</span><span style="color: #000000;">),
</span><span style="color: #800000;">"</span><span style="color: #800000;">version</span><span style="color: #800000;">"</span>: <span style="color: #800000;">"</span><span style="color: #800000;">1.0</span><span style="color: #800000;">"</span><span style="color: #000000;">,
</span><span style="color: #800000;">"</span><span style="color: #800000;">biz_content</span><span style="color: #800000;">"</span><span style="color: #000000;">: biz_content
}
</span><span style="color: #0000ff;">if</span> return_url <span style="color: #0000ff;">is</span> <span style="color: #0000ff;">not</span><span style="color: #000000;"> None:
data[</span><span style="color: #800000;">"</span><span style="color: #800000;">notify_url</span><span style="color: #800000;">"</span>] =<span style="color: #000000;"> self.app_notify_url
data[</span><span style="color: #800000;">"</span><span style="color: #800000;">return_url</span><span style="color: #800000;">"</span>] =<span style="color: #000000;"> self.return_url
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> data
</span><span style="color: #0000ff;">def</span><span style="color: #000000;"> sign_data(self, data):
data.pop(</span><span style="color: #800000;">"</span><span style="color: #800000;">sign</span><span style="color: #800000;">"</span><span style="color: #000000;">, None)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 排序后的字符串</span>
unsigned_items =<span style="color: #000000;"> self.ordered_data(data)
unsigned_string </span>= <span style="color: #800000;">"</span><span style="color: #800000;">&</span><span style="color: #800000;">"</span>.join(<span style="color: #800000;">"</span><span style="color: #800000;">{0}={1}</span><span style="color: #800000;">"</span>.format(k, v) <span style="color: #0000ff;">for</span> k, v <span style="color: #0000ff;">in</span><span style="color: #000000;"> unsigned_items)
sign </span>= self.sign(unsigned_string.encode(<span style="color: #800000;">"</span><span style="color: #800000;">utf-8</span><span style="color: #800000;">"</span><span style="color: #000000;">))
ordered_items </span>=<span style="color: #000000;"> self.ordered_data(data)
quoted_string </span>= <span style="color: #800000;">"</span><span style="color: #800000;">&</span><span style="color: #800000;">"</span>.join(<span style="color: #800000;">"</span><span style="color: #800000;">{0}={1}</span><span style="color: #800000;">"</span>.format(k, quote_plus(v)) <span style="color: #0000ff;">for</span> k, v <span style="color: #0000ff;">in</span><span style="color: #000000;"> ordered_items)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 获得最终的订单信息字符串</span>
signed_string = quoted_string + <span style="color: #800000;">"</span><span style="color: #800000;">&sign=</span><span style="color: #800000;">"</span> +<span style="color: #000000;"> quote_plus(sign)
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> signed_string
</span><span style="color: #0000ff;">def</span><span style="color: #000000;"> ordered_data(self, data):
complex_keys </span>=<span style="color: #000000;"> []
</span><span style="color: #0000ff;">for</span> key, value <span style="color: #0000ff;">in</span><span style="color: #000000;"> data.items():
</span><span style="color: #0000ff;">if</span><span style="color: #000000;"> isinstance(value, dict):
complex_keys.append(key)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 将字典类型的数据dump出来</span>
<span style="color: #0000ff;">for</span> key <span style="color: #0000ff;">in</span><span style="color: #000000;"> complex_keys:
data[key] </span>= json.dumps(data[key], separators=(<span style="color: #800000;">'</span><span style="color: #800000;">,</span><span style="color: #800000;">'</span>, <span style="color: #800000;">'</span><span style="color: #800000;">:</span><span style="color: #800000;">'</span><span style="color: #000000;">))
</span><span style="color: #0000ff;">return</span> sorted([(k, v) <span style="color: #0000ff;">for</span> k, v <span style="color: #0000ff;">in</span><span style="color: #000000;"> data.items()])
</span><span style="color: #0000ff;">def</span><span style="color: #000000;"> sign(self, unsigned_string):
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 开始计算签名</span>
key =<span style="color: #000000;"> self.app_private_key
signer </span>=<span style="color: #000000;"> PKCS1_v1_5.new(key)
signature </span>=<span style="color: #000000;"> signer.sign(SHA256.new(unsigned_string))
</span><span style="color: #008000;">#</span><span style="color: #008000;"> base64 编码,转换为unicode表示并移除回车</span>
sign = encodebytes(signature).decode(<span style="color: #800000;">"</span><span style="color: #800000;">utf8</span><span style="color: #800000;">"</span>).replace(<span style="color: #800000;">"</span><span style="color: #800000;">\n</span><span style="color: #800000;">"</span>, <span style="color: #800000;">""</span><span style="color: #000000;">)
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> sign
</span><span style="color: #0000ff;">def</span><span style="color: #000000;"> _verify(self, raw_content, signature):
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 开始计算签名</span>
key =<span style="color: #000000;"> self.alipay_public_key
signer </span>=<span style="color: #000000;"> PKCS1_v1_5.new(key)
digest </span>=<span style="color: #000000;"> SHA256.new()
digest.update(raw_content.encode(</span><span style="color: #800000;">"</span><span style="color: #800000;">utf8</span><span style="color: #800000;">"</span><span style="color: #000000;">))
</span><span style="color: #0000ff;">if</span> signer.verify(digest, decodebytes(signature.encode(<span style="color: #800000;">"</span><span style="color: #800000;">utf8</span><span style="color: #800000;">"</span><span style="color: #000000;">))):
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> True
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> False
</span><span style="color: #0000ff;">def</span><span style="color: #000000;"> verify(self, data, signature):
</span><span style="color: #0000ff;">if</span> <span style="color: #800000;">"</span><span style="color: #800000;">sign_type</span><span style="color: #800000;">"</span> <span style="color: #0000ff;">in</span><span style="color: #000000;"> data:
sign_type </span>= data.pop(<span style="color: #800000;">"</span><span style="color: #800000;">sign_type</span><span style="color: #800000;">"</span><span style="color: #000000;">)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 排序后的字符串</span>
unsigned_items =<span style="color: #000000;"> self.ordered_data(data)
message </span>= <span style="color: #800000;">"</span><span style="color: #800000;">&</span><span style="color: #800000;">"</span>.join(u<span style="color: #800000;">"</span><span style="color: #800000;">{}={}</span><span style="color: #800000;">"</span>.format(k, v) <span style="color: #0000ff;">for</span> k, v <span style="color: #0000ff;">in</span><span style="color: #000000;"> unsigned_items)
</span><span style="color: #0000ff;">return</span><span style="color: #000000;"> self._verify(message, signature)
if name == “main”:
“”“支付宝支付成功后通知接口验证”""
<span style="color: #008000;">#</span><span style="color: #008000;"> 接收支付宝支付成功后,向我们设置的同步支付通知url,请求的参数</span>
return_url = <span style="color: #800000;">'</span><span style="color: #800000;">http://47.92.87.172:8000/?total_amount=100.00&timestamp=2017-10-11+22%3A44%3A17&sign=dHW%2F25EDd%2BYKqkU5krhseDNIOEyDpdJzSAaoqhTC0nlv8%2FEmrQVd0WqgGK0CS8Pax8sK4jIOdGLFa6lQEbIfzvH3Na2W949yCAYX04JL1Bi02wog7a8L7vfW9Kj%2BjfTQxumGH%2B1Drbezdg9gKOx3tX0cb1yBBdfifK6l1%2BE5UjggGbY60F6SD8A8XI06NMWb4ViU%2FLYtBhwAwU2koy1IK2%2BtBJM1xYFuBRlcWF61xCxexHwO0WEA3AwVRW1miuJjOpGiBTOwPI9Huj0WhkyRebIjBhSxReJdZIdTfAgwj4oqo4jAJCHDa6DKBM0H3wjKKXSyMeMBGKQB0Uv2rNdyng%3D%3D&trade_no=2017101121001004320200174640&sign_type=RSA2&auth_app_id=2016080800192023&charset=utf-8&seller_id=2088102170418468&method=alipay.trade.page.pay.return&app_id=2016080800192023&out_trade_no=201702021227&version=1.0</span><span style="color: #800000;">'</span>
<span style="color: #008000;">#</span><span style="color: #008000;"> 将同步支付通知url,传到urlparse</span>
o =<span style="color: #000000;"> urlparse(return_url)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 获取到URL的各种参数</span>
query =<span style="color: #000000;"> parse_qs(o.query)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 定义一个字典来存放,循环获取到的URL参数</span>
processed_query =<span style="color: #000000;"> {}
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 将URL参数里的sign字段拿出来</span>
ali_sign = query.pop(<span style="color: #800000;">"</span><span style="color: #800000;">sign</span><span style="color: #800000;">"</span><span style="color: #000000;">)[0]
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 传递参数初始化支付类</span>
alipay =<span style="color: #000000;"> AliPay(
appid</span>=<span style="color: #800000;">"</span><span style="color: #800000;">2016080800192023</span><span style="color: #800000;">"</span>, <span style="color: #008000;">#</span><span style="color: #008000;"> 设置签约的appid</span>
app_notify_url=<span style="color: #800000;">"</span><span style="color: #800000;">http://projectsedus.com/</span><span style="color: #800000;">"</span>, <span style="color: #008000;">#</span><span style="color: #008000;"> 异步支付通知url</span>
app_private_key_path=u<span style="color: #800000;">"</span><span style="color: #800000;">ying_yong_si_yao.txt</span><span style="color: #800000;">"</span>, <span style="color: #008000;">#</span><span style="color: #008000;"> 设置应用私钥</span>
alipay_public_key_path=<span style="color: #800000;">"</span><span style="color: #800000;">zhi_fu_bao_gong_yao.txt</span><span style="color: #800000;">"</span>, <span style="color: #008000;">#</span><span style="color: #008000;"> 支付宝的公钥,验证支付宝回传消息使用,不是你自己的公钥,</span>
debug=True, <span style="color: #008000;">#</span><span style="color: #008000;"> 默认False, # 设置是否是沙箱环境,True是沙箱环境</span>
return_url=<span style="color: #800000;">"</span><span style="color: #800000;">http://47.92.87.172:8000/</span><span style="color: #800000;">"</span> <span style="color: #008000;">#</span><span style="color: #008000;"> 同步支付通知url</span>
)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 循环出URL里的参数</span>
<span style="color: #0000ff;">for</span> key, value <span style="color: #0000ff;">in</span><span style="color: #000000;"> query.items():
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 将循环到的参数,以键值对形式追加到processed_query字典</span>
processed_query[key] =<span style="color: #000000;"> value[0]
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 将循环组合的参数字典,以及拿出来的sign字段,传进支付类里的verify方法,返回验证合法性,返回布尔值,True为合法,表示支付确实成功了,这就是验证是否是伪造支付成功请求</span>
<span style="color: #0000ff;">print</span><span style="color: #000000;">(alipay.verify(processed_query, ali_sign))
# 如果别人伪造支付成功请求,它不知道我们的支付宝公钥,伪造的就无法通过验证,测试可以将支付宝公钥更改一下,在验证就会失败,别忘了改回来
远程测试支付成功后返回服务器验证
首先准备一台服务器,将开发环境和项目同步到服务器上,并且在服务器上配置好python虚拟环境和所需python插件包
项目同步到服务器上,也就是将本地项目,上传到服务器进行同步
配置服务器信息
2
上传项目
数据上传后,在服务器配置数据库访问权限,和配置python环境
配置远程调试
1,在阿里云后台,开放8000端口
2,在服务器开发8000端口
vim /etc/sysconfig/iptables
# Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT #添加配置项 -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 8000 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT
重启防火墙
service iptables restart
设置当前,使用的数据库用户,可以任意ip访问
让数据库用户可以从外部登陆和本地登陆
1
grant all privileges(除授权外的所有权限) on *.*(表示所有数据库的所有表) to 'test_user(授权的用户名)'@'localhost(授权ip)' identified by 'test_user(用户密码)';
grant all privileges on *.* to 'test_user'@'localhost' identified by 'test_user';
2
grant all privileges(除授权外的所有权限) on *.*(表示所有数据库的所有表) to 'test_user(授权的用户名)'@'%(所有ip)' identified by 'test_user(用户密码)';
grant all privileges on *.* to 'test_user'@'%' identified by 'test_user';
配置项目的settings.py文件
DATABASES = { 'default': { 'ENGINE': 'django.db.backends.mysql', #配置数据库引擎名称 'NAME': 'jxiou', #数据库名称 'USER': 'test_user', #数据库用户名 'PASSWORD': 'test_user', #数据库密码 'HOST': '47.52.39.160', #数据库链接地址,为服务器ip 'PORT': '3306', #数据库端口 } }
2
# SECURITY WARNING: don't run with debug turned on in production! DEBUG = True
ALLOWED_HOSTS = [’*’] # 允许任意ip访问项目
开始远程调试
2
3
4
5
此时,就可以用服务器ip加8000端口,访问服务器网站了
前面,我们在本地调试了支付宝支付请求,这下我们要调试,支付宝支付成功后向我们服务器返回请求我们要验证返回的请求,,所以需要将远程服务器启动来,接收支付宝的返回
settings.py
import os
# Build paths inside the project like this: os.path.join(BASE_DIR, …)
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(file)))
# 支付宝目录路径设置
ying_yong_si_yao = os.path.join(BASE_DIR, ‘app1/alipay/ying_yong_si_yao.txt’)
zhi_fu_bao_gong_yao = os.path.join(BASE_DIR, ‘app1/alipay/zhi_fu_bao_gong_yao.txt’)
urls.py
from django.conf.urls import url from django.contrib import admin from app1.views import alipaview
urlpatterns = [
url(r’^admin/’, admin.site.urls),
# 支付宝返回url
url(r’^alipa/’, alipaview, name=‘alipa’),
]
views.py
#!/usr/bin/env python # -*- coding:utf8 -*- from django.shortcuts import render
# Create your views here.
from django.shortcuts import render,HttpResponse
from django.views.decorators.csrf import csrf_exempt,csrf_protect
from app1.alipay.alipay import AliPay
from jxiou.settings import ying_yong_si_yao, zhi_fu_bao_gong_yao
@csrf_exempt
def alipaview(request):
if request.method == “GET”:
processed_dict = {} # 接收支付宝传递参数
for key, value in request.GET.items(): # 循环参数
processed_dict[key] = value # 将参数添加到字典
sign = processed_dict.pop(‘sign’, None) # 单独拿出sign字段
<span style="color: #008000;">#</span><span style="color: #008000;"> 传递参数初始化支付类</span>
alipay =<span style="color: #000000;"><span style="background-color: #ff99cc;"> AliPay</span>(
appid</span>=<span style="color: #800000;">"</span><span style="color: #800000;">2016080800192023</span><span style="color: #800000;">"</span>, <span style="color: #008000;">#</span><span style="color: #008000;"> 设置签约的appid</span>
app_notify_url=<span style="color: #800000;">"</span><span style="color: #800000;">http://47.52.39.160:8000/alipa/</span><span style="color: #800000;">"</span>, <span style="color: #008000;">#</span><span style="color: #008000;"> 异步支付通知url</span>
app_private_key_path=ying_yong_si_yao, <span style="color: #008000;">#</span><span style="color: #008000;"> 设置应用私钥</span>
alipay_public_key_path=zhi_fu_bao_gong_yao, <span style="color: #008000;">#</span><span style="color: #008000;"> 支付宝的公钥,验证支付宝回传消息使用,不是你自己的公钥,</span>
debug=True, <span style="color: #008000;">#</span><span style="color: #008000;"> 默认False, # 设置是否是沙箱环境,True是沙箱环境</span>
return_url=<span style="color: #800000;">"</span><span style="color: #800000;">http://47.52.39.160:8000/alipa/</span><span style="color: #800000;">"</span> <span style="color: #008000;">#</span><span style="color: #008000;"> 同步支付通知url,跳转地址</span>
)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 验证支付宝返回的合法性</span>
yan_zhen =<span style="color: #000000;"> alipay.verify(processed_dict, sign)
</span><span style="color: #0000ff;">if</span> yan_zhen <span style="color: #0000ff;">is</span> True: <span style="color: #008000;">#</span><span style="color: #008000;"> 判断如果合法</span>
out_trade_no = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">out_trade_no</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 商户订单号</span>
trade_no = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">trade_no</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 支付宝交易号</span>
buyer_id = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">buyer_id</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 买家支付宝用户号</span>
trade_status = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">trade_status</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 交易状态</span>
total_amount = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">total_amount</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 订单金额</span>
receipt_amount = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">receipt_amount</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 实收金额</span>
subject = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">subject</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 订单标题</span>
gmt_payment = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">gmt_payment</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 交易付款时间</span>
<span style="color: #008000;">#</span><span style="color: #008000;"> 数据库操作</span>
<span style="color: #0000ff;">print</span><span style="color: #000000;">(out_trade_no)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(trade_no)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(buyer_id)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(trade_status)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(total_amount)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(receipt_amount)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(subject)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(gmt_payment)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 向支付宝返回success,告诉他我们已经处理,不然他会不停的通知</span>
<span style="color: #0000ff;">return</span> HttpResponse(<span style="color: #800000;">'</span><span style="color: #800000;">success</span><span style="color: #800000;">'</span><span style="color: #000000;">)
</span></span><span style="background-color: #ffcc99;"><span style="color: #0000ff;">if</span> request.method == <span style="color: #800000;">"</span><span style="color: #800000;">POST</span><span style="color: #800000;">"</span>: <span style="color: #008000;">#</span><span style="color: #008000;"> post请求支付宝异步通知</span>
processed_dict = {} <span style="color: #008000;">#</span><span style="color: #008000;"> 接收支付宝传递参数</span>
<span style="color: #0000ff;">for</span> key, value <span style="color: #0000ff;">in</span> request.POST.items(): <span style="color: #008000;">#</span><span style="color: #008000;"> 循环参数</span>
processed_dict[key] = value <span style="color: #008000;">#</span><span style="color: #008000;"> 将参数添加到字典</span>
sign = processed_dict.pop(<span style="color: #800000;">'</span><span style="color: #800000;">sign</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 单独拿出sign字段</span>
<span style="color: #008000;">#</span><span style="color: #008000;"> 传递参数初始化支付类</span>
alipay =<span style="color: #000000;"><span style="background-color: #ff99cc;"> AliPay</span>(
appid</span>=<span style="color: #800000;">"</span><span style="color: #800000;">2016080800192023</span><span style="color: #800000;">"</span>, <span style="color: #008000;">#</span><span style="color: #008000;"> 设置签约的appid</span>
app_notify_url=<span style="color: #800000;">"</span><span style="color: #800000;">http://47.52.39.160:8000/alipa/</span><span style="color: #800000;">"</span>, <span style="color: #008000;">#</span><span style="color: #008000;"> 异步支付通知url</span>
app_private_key_path=ying_yong_si_yao, <span style="color: #008000;">#</span><span style="color: #008000;"> 设置应用私钥</span>
alipay_public_key_path=zhi_fu_bao_gong_yao, <span style="color: #008000;">#</span><span style="color: #008000;"> 支付宝的公钥,验证支付宝回传消息使用,不是你自己的公钥,</span>
debug=True, <span style="color: #008000;">#</span><span style="color: #008000;"> 默认False, # 设置是否是沙箱环境,True是沙箱环境</span>
return_url=<span style="color: #800000;">"</span><span style="color: #800000;">http://47.52.39.160:8000/alipa/</span><span style="color: #800000;">"</span> <span style="color: #008000;">#</span><span style="color: #008000;"> 同步支付通知url</span>
)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 验证支付宝返回的合法性</span>
yan_zhen =<span style="color: #000000;"> alipay.verify(processed_dict, sign)
</span><span style="color: #0000ff;">if</span> yan_zhen <span style="color: #0000ff;">is</span> True: <span style="color: #008000;">#</span><span style="color: #008000;"> 判断如果合法</span>
out_trade_no = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">out_trade_no</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 商户订单号</span>
trade_no = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">trade_no</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 支付宝交易号</span>
buyer_id = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">buyer_id</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 买家支付宝用户号</span>
trade_status = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">trade_status</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 交易状态</span>
total_amount = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">total_amount</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 订单金额</span>
receipt_amount = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">receipt_amount</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 实收金额</span>
subject = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">subject</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 订单标题</span>
gmt_payment = processed_dict.get(<span style="color: #800000;">'</span><span style="color: #800000;">gmt_payment</span><span style="color: #800000;">'</span>, None) <span style="color: #008000;">#</span><span style="color: #008000;"> 交易付款时间</span>
<span style="color: #008000;">#</span><span style="color: #008000;"> 数据库操作</span>
<span style="color: #0000ff;">print</span><span style="color: #000000;">(out_trade_no)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(trade_no)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(buyer_id)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(trade_status)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(total_amount)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(receipt_amount)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(subject)
</span><span style="color: #0000ff;">print</span><span style="color: #000000;">(gmt_payment)
</span><span style="color: #008000;">#</span><span style="color: #008000;"> 向支付宝返回success,告诉他我们已经处理,不然他会不停的通知</span>
<span style="color: #0000ff;">return</span> HttpResponse(<span style="color: #800000;">'</span><span style="color: #800000;">success</span><span style="color: #800000;">'</span>)</span></pre>
WAIT_BUYER_PAY 交易创建,等待买家付款
TRADE_CLOSED 未付款交易超时关闭,或支付完成后全额退款
TRADE_SUCCESS 交易支付成功
TRADE_FINISHED 交易结束,不可退款