soap wsdl 验证

Controller
class Default_SvcController extends Zend_Controller_Action {

    public function webServiceAction() {
        try {
            Default_Service_Svc::logError('--', 'R2036CreateParamter.log');
            ini_set('soap.wsdl_cache_enabled', 1);
            $server = new Zend_Soap_Server(APPLICATION_PATH . '/../data/wsdl/CffSvc.wsdl');
            $server->setClass('Default_Service_Svc');
            $server->handle();
        } catch (Exception $e) {
            $str = var_export($e->getMessage(), true);
            Default_Service_Svc::logError($str, 'R2036CreateParamter.log');
        }
    }

    public function wsdlAction() {
        header('Content-type: text/xml; Charset=utf-8');
        echo file_get_contents(APPLICATION_PATH . '/../data/wsdl/CffSvc.wsdl');
    }

    public function testAction() {
        //接口名称
        $interfaceName = $this->_request->getParam('interfaceName', '');
        $wsdlCache = file_get_contents('http://cff.sfc2.com/default/sys/cleartmp');
        if ($wsdlCache == '1') {
            echo '清除 wsdl 缓存成功<br/>';
        }
        $apiUrl = 'http://cff.sfc2.com/default/svc/wsdl';
        $client = new SoapClient($apiUrl, array(
            'trace' => 1,
            'exceptions' => 1,
            'encoding' => 'UTF-8'
        ));
        $requestHeader = array(
            'customerId' => 'STK01',
            'appToken' => 'asdffffffffffffffffffffffffasdfasdfasdfasdfasdfaffffffffffffffffffffffffffffffddddddddddddddddd',
            'appKey' => 'ffdddfdfdeaadffffffffffffffasdf'
        );
        //更新标准重量区间值
        if (strtolower($interfaceName) == strtolower('updateStandardWeightIntervalValue')) {
            $requestCombination = array(
                'HeaderRequest' => $requestHeader,
                'productId' => 131459,
                'minValue' => '0.1',
                'maxValue' => '0.4',
            );
            $result = $client->updateStandardWeightIntervalValue($requestCombination);
            var_dump($result);
            die;
        }
        echo "---------------{$interfaceName} not exists---------------";
        // var_dump($client->__getFunctions());
    }

}

class Default_SysController extends Zend_Controller_Action {

    public function cleartmpAction() {
        $cmd = ' /bin/rm /tmp/* -rf';
        system($cmd, $value);
        echo $value;
    }

}



wsdl
<?xml version="1.0" encoding="UTF-8"?>
<wsdl:definitions name="CffSvc" targetNamespace="http://cff.sfc2.com/CffSvc/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:tns="http://cff.sfc2.com/CffSvc/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    
    <wsdl:documentation>Create Product Response</wsdl:documentation>
    
    <!-- WSDL types 使用 XML Schema 语法来定义数据类型 -->
    <wsdl:types>
        <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" targetNamespace="http://cff.sfc2.com/CffSvc/">
            <xsd:complexType name="HeaderRequest">
                <xsd:sequence>
                    <xsd:element name="customerId" type="xsd:string" minOccurs="1" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Cff customer ID
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="appToken" type="xsd:string" minOccurs="1" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                App token
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="appKey" type="xsd:string" minOccurs="1" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                app key
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="langId" type="xsd:int" maxOccurs="1" minOccurs="0"></xsd:element>
                </xsd:sequence>
            </xsd:complexType>
            <xsd:element name="updateStandardWeightIntervalValue">
                <xsd:complexType>
                    <xsd:sequence>
                        <xsd:element name="HeaderRequest" type="tns:HeaderRequest" maxOccurs="1" minOccurs="0"></xsd:element>
                        <xsd:element name="productId" type="xsd:string" maxOccurs="1" minOccurs="0"></xsd:element>
                        <xsd:element name="minValue" type="xsd:string" maxOccurs="1" minOccurs="0"></xsd:element>
                        <xsd:element name="maxValue" type="xsd:string" maxOccurs="1" minOccurs="0"></xsd:element>
                    </xsd:sequence>
                </xsd:complexType>
            </xsd:element>
            <xsd:element name="updateStandardWeightIntervalValueResponse">
                <xsd:complexType>
                    <xsd:sequence>
                        <xsd:element name="result" type="xsd:string" maxOccurs="1" minOccurs="1"></xsd:element>
                        <xsd:element name="message" type="xsd:string" maxOccurs="1" minOccurs="1"></xsd:element>
                        <xsd:element name="time" type="xsd:string" maxOccurs="1" minOccurs="0"></xsd:element>
                    </xsd:sequence>
                </xsd:complexType>
            </xsd:element>
        </xsd:schema>
    </wsdl:types>
    
    <!-- WSDL 消息 比作传统编程语言中一个函数调用的参数 -->
    <wsdl:message name="updateStandardWeightIntervalValueRequest">
        <!-- 请求数据类型 -->
        <wsdl:part name="parameters" element="tns:updateStandardWeightIntervalValue"></wsdl:part>
    </wsdl:message>
    <wsdl:message name="updateStandardWeightIntervalValueResponse">
        <!-- 返回数据类型 -->
        <wsdl:part name="parameters" element="tns:updateStandardWeightIntervalValueResponse"></wsdl:part>
    </wsdl:message>
    
    <!-- WSDL 端口 比作传统编程语言中的一个函数库(或一个模块、或一个类)-->
    <wsdl:portType name="CffSvc">
        <!-- 操作名 -->
        <wsdl:operation name="updateStandardWeightIntervalValue">
            <!-- 请求数据 -->
            <wsdl:input message="tns:updateStandardWeightIntervalValueRequest"></wsdl:input>
            <!-- 返回数据 -->
            <wsdl:output message="tns:updateStandardWeightIntervalValueResponse"></wsdl:output>
        </wsdl:operation>
    </wsdl:portType>
    
    <!-- WSDL Bindings 每个端口定义消息格式和协议细节 -->
    <wsdl:binding name="CffSvcSOAP" type="tns:CffSvc">
        <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http" />
        <wsdl:operation name="updateStandardWeightIntervalValue">
            <soap:operation soapAction="http://cff.sfc2.com/CffSvc/updateStandardWeightIntervalValue" />
            <wsdl:input>
                <soap:body use="literal" />
            </wsdl:input>
            <wsdl:output>
                <soap:body use="literal" />
            </wsdl:output>
        </wsdl:operation>
    </wsdl:binding>
    
    <wsdl:service name="CffSvc">
        <wsdl:port binding="tns:CffSvcSOAP" name="CffSvc">
            <wsdl:documentation>Create Product, add sku to you Cff Account.
            </wsdl:documentation>
            <soap:address location="http://api.sfc2.com/default/svc/web-service" />
        </wsdl:port>
    </wsdl:service>
    
</wsdl:definitions>



Service
class Default_Service_Svc {

    protected $_customerId = null;
    protected $_token = null;
    protected $_key = null;
    protected $_auth = false;
    protected $_authType = false;
    protected $_error = null;
    protected $_langId = 0;

    private function authenticate() {
        //固定R2036 的KEY TOKEN
        if ($this->_customerId == 'R2036') {
            $key = 'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDGmDLbsI4jELqCHgWikWqACICp299WSoiWgqghEXkQfvdEvwS5XWpdsSmdQwryR2rtg0DiS3vf74oVYBDJVHgcUdc2ov7QI5TPBqXJped7OoyrqYzaYFYshzGWgYC0wu5RCb71p2+4Z8NwDoJlvMVU4/fD9pL59PW8yYH1u3x4ewIDAQAB';
            $token = 'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDK1YNcdunmWXoK1ys6hyi+LWQdPx6Vmr/9kNlKOw4cK5Q8FWA3nfGeeG49Pq2TlYKVLdSw1fr60AAJFQOuXmol6lmyn+/xwx6j21XLx9/4vdDNSTR8Hcp7oqGNNr5DlI0onhJ7sd+rAxhIOwLNnZv6T/XtVqQNuGVXTq/dX0zkaQIDAQAB';
            if ($token == $this->_token & $key == $this->_key) {
                $this->setLanguage();
                $this->_auth = true;
                return true;
            }
        }
        $customerAuthObj = new Default_Model_CustomerAuthenticate();
        $customerAuth = $customerAuthObj->authenticate($this->_customerId, $this->_token, $this->_key);
        if (!$customerAuth) {
            $this->_error = $this->_customerId . ':Invalidate Token/Key. ' . $this->_customerId;
            return false;
        }
        if (date('Y-m-d', strtotime($customerAuth['ca_expired_date'])) < date('Y-m-d')) {
            $this->_error = $this->_customerId . ':Your API Certificate has expired. Please request for a new API Certificate.';
            return false;
        }

        $this->setLanguage();
        $this->_auth = true;
        $this->_authType = $customerAuth['ca_type'];
        return true;
    }

    private function setLanguage() {
        $user = new Zend_Session_Namespace('user');
        if ($this->_langId == 1) {
            $user->langId = 1;
            $user->lang = 'zh';
        } else {
            $user->langId = 2;
            $user->lang = 'en';
        }
    }

    public static function logError($error, $file = 'Svc.log') {
        $logger = new Zend_Log();
        $uploadDir = APPLICATION_PATH . '/../data/log/';
        $writer = new Zend_Log_Writer_Stream($uploadDir . $file);
        $logger->addWriter($writer);
        $logger->info(date('Y-m-d H:i:s') . ': ' . $error . " \n");
    }

    //更新标准重量区间值
    public function updateStandardWeightIntervalValue($paramter) {
        $this->_customerId = (string) $paramter->HeaderRequest->customerId;
        $this->_token = (string) $paramter->HeaderRequest->appToken;
        $this->_key = (string) $paramter->HeaderRequest->appKey;
        $this->_langId = 2;
        if (isset($paramter->HeaderRequest->langId)) {
            $this->_langId = (string) $paramter->HeaderRequest->langId;
        }
        $productId = (string) $paramter->productId;
        $minValue = (string) $paramter->minValue;
        $maxValue = (string) $paramter->maxValue;
        $date = date('Y-m-d H:i:s');
        $return = array('result' => 'Failure', 'message' => '', 'time' => $date);
        if ($this->_customerId == 'STK01') {
            $this->authenticate();
            if ($this->_auth) {
                if (empty($productId)) {
                    $return['message'] = '产品 ID 不能为空!';
                    return $return;
                }
                if (empty($minValue)) {
                    $return['message'] = '最小标准重量区间值不能为空!';
                    return $return;
                }
                if (empty($maxValue)) {
                    $return['message'] = '最大标准重量区间值不能为空!';
                    return $return;
                }
                $weightValue = array(7 => $minValue, 8 => $maxValue);
                foreach ($weightValue as $key => $value) {
                    $povIds = Merchant_Service_ProductOptionValue::getByProductId($productId, $key);
                    if (count($povIds) == 1) {
                        if ($povIds[0]['po_value'] != $value) {
                            if (!Merchant_Service_ProductOptionValue::modifyByCondition(array('po_value' => $value), $productId, $key, 0)) {
                                $return['message'] = '标准重量区间值更新失败!';
                                return $return;
                            }
                        }
                    } else {
                        $combination = array(
                            'product_id' => $productId,
                            'po_id' => $key,
                            'po_value' => $value,
                            'pov_add_time' => $date,
                        );
                        if (!Merchant_Service_ProductOptionValue::add($combination)) {
                            $return['message'] = '标准重量区间值添加失败!';
                            return $return;
                        }
                    }
                }
                $return['result'] = 'Success';
            } else {
                $return['message'] = $this->_error;
                return $return;
            }
        } else {
            $return['message'] = '接口暂未对外开放,敬请期待!';
        }
        return $return;
    }

}
  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
SOAP是一种基于XML的协议,用于在计算机网络上交换结构化的和适应性强的信息。而WSDL(Web Services Description Language)是用于描述web服务的XML格式文件,它定义了web服务的接口、消息格式和协议细节等信息。虽然SOAPWSDL是非常有用和广泛使用的技术,但它们也可能存在一些漏洞和安全隐患。 首先,通过SOAPWSDL,攻击者可能能够进行信息泄露。具体而言,如果服务提供者在WSDL文件中错误地将敏感信息包含在消息定义中,那么攻击者可以通过查看WSDL文件来获取这些敏感信息,从而导致信息泄露的风险。 其次,使用SOAPWSDL服务时,也可能存在数据篡改的风险。攻击者可能会篡改SOAP消息或WSDL文件中的内容,以修改请求或响应的数据内容。这可能导致数据的错误处理、误导、篡改或破坏。 此外,SOAPWSDL也可能受到拒绝服务(DoS)攻击的风险。攻击者可以发送大量的恶意请求,使服务过载或不可用。这可能会导致服务延迟或完全中断,从而影响服务的可用性和稳定性。 为了解决这些漏洞和提高SOAPWSDL的安全性,我们可以采取一些措施。首先,服务提供者应该在WSDL文件中避免包含敏感信息,并确保对外部用户隐藏所有不必要的细节。其次,使用消息验证技术(如数字签名和加密)来保证数据的完整性和机密性。最后,实施适当的访问控制和流量限制机制,以应对拒绝服务攻击。 综上所述,虽然SOAPWSDL是强大的技术,但它们也可能存在漏洞和安全隐患。因此,在使用它们时,我们必须采取一些安全措施来减少潜在的风险。

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值