function confirmUser($username, $password)
{
    global $conn;
    /* Add slashes if necessary (for query) */
    if (!get_magic_quotes_gpc()) {
        $username = addslashes($username);
    }
    /* Verify that user is in database */
    $q = "select password from " . DB_PREFIX . "users where username = '{$username}' limit 1";
    $result = mysql_query($q, $conn);
    if (!$result || mysql_numrows($result) < 1) {
        return 1;
        // Indicates username failure
    }
    /* Retrieve password from result, strip slashes */
    $dbarray = mysql_fetch_array($result);
    // combine password in database with key
    $dbarray['password'] = hmac($_SESSION['key'], stripslashes($dbarray['password']));
    $password = stripslashes($password);
    /* Validate that password is correct */
    if ($password == $dbarray['password']) {
        return 0;
        // Success! Username and password confirmed
    } else {
        return 2;
        // Indicates password failure
    }
}

 private function _sign($data)
 {
     if (is_null($this->_macKey)) {
         throw new Exception("EMPTY_MACKEY");
     }
     return hmac($this->_macKey, $data);
 }

 private function _verifySign($domain, $text, $sign)
 {
     include_once KFL_DIR . '/Libs/Cache.class.php';
     $filename = $domain . ".txt";
     $cache = new Cache(86400 * 300, 0);
     $cache->setCacheStore("file");
     // or memcache
     $cache->setCacheDir(APP_TEMP_DIR);
     $cache->setCacheFile($filename);
     if ($cache->isCached()) {
         $client = unserialize($cache->fetch());
     } else {
         require_once 'ClientModel.class.php';
         $ClientModel = new ClientModel();
         $client = $ClientModel->getClientByName($domain);
         if ($client) {
             $cache->save(serialize($client));
         } else {
             return false;
         }
     }
     $this->_private_key = $client['private_key'];
     if (hmac($this->_private_key, $text, 'sha1') == $sign) {
         return true;
     } else {
         return false;
     }
 }

function gda_add_hash($key, $text)
{
    if ($key == "") {
        return "NOHASH\n" . $text;
    } else {
        return hmac($key, $text) . "\n" . $text;
    }
}

function InsertFP ($loginid, $x_tran_key, $amount, $sequence, $currency = "")
{

$tstamp = time ();

$fingerprint = hmac ($x_tran_key, $loginid . "^" . $sequence . "^" . $tstamp . "^" . $amount . "^" . $currency);

echo ('<input type="hidden" name="x_fp_sequence" value="' . $sequence . '">' );
echo ('<input type="hidden" name="x_fp_timestamp" value="' . $tstamp . '">' );
echo ('<input type="hidden" name="x_fp_hash" value="' . $fingerprint . '">' );


return (0);

}

function decrypt($key, $data)
{
    $decodedData = base64_decode($data);
    // TODO: Check that data is at least bigger than HMAC + IV length
    error_log("key in Decrypt is: " . $key);
    $hmac = substr($decodedData, 0, 32);
    error_log("hmac in Decrypt is: " . $hmac);
    $iv = substr($decodedData, 32, 16);
    error_log("iv in Decrypt is: " . $iv);
    $data = substr($decodedData, 48);
    error_log("data in Decrypt is: " . $data);
    if ($hmac != hmac($key, $iv . $data)) {
        // TODO: Handle HMAC validation failure
        return 0;
    }
    //echo "no error";
    return openssl_decrypt($data, 'aes-256-cbc', hashKey($key), true, $iv);
}

function checkLogin()
{
    /* Check if user has been remembered */
    if (isset($_COOKIE['c_name']) && isset($_COOKIE['c_pass'])) {
        $_SESSION['username'] = $_COOKIE['c_name'];
        $_SESSION['password'] = hmac($_SESSION['key'], $_COOKIE['c_pass']);
    }
    /* Username and password have been set */
    if (isset($_SESSION['username']) && isset($_SESSION['password'])) {
        /* Confirm that username and password are valid */
        if (confirmUser($_SESSION['username'], $_SESSION['password']) != 0) {
            /* Variables are incorrect, user not logged in */
            unset($_SESSION['username']);
            unset($_SESSION['password']);
            // reset cookies
            if (isset($_COOKIE['c_name'])) {
                setcookie("c_name", "", time() - 60 * 60 * 24 * 100, "/");
            }
            if (isset($_COOKIE['c_pass'])) {
                setcookie("c_pass", "", time() - 60 * 60 * 24 * 100, "/");
            }
            return false;
        }
        // log user data
        if (!isset($_SESSION['logged'])) {
            $_SESSION['logged'] = true;
            global $conn;
            /* Add slashes if necessary (for query) */
            $username = $_SESSION['username'];
            $ip = $_SERVER['REMOTE_ADDR'];
            if (!get_magic_quotes_gpc()) {
                $username = addslashes($username);
                $ip = addslashes($ip);
            }
            $q = "UPDATE " . DB_PREFIX . "users SET ip = '{$ip}', lastdate = " . time() . " WHERE username = '{$username}'";
            mysql_query($q, $conn);
        }
        return true;
    } else {
        return false;
    }
}

        die('Этот заказ уже оплачен');
    } else {
        $url = $okay->config->root_url . '/order/' . $order->url;
        header('location:' . $url);
        exit;
    }
}
////////////////////////////////////
// Проверка контрольной подписи
////////////////////////////////////
if ($_REQUEST['check'] == "1") {
    $param = $_REQUEST['ext_transact'] . $_REQUEST['num_shop'] . $_REQUEST['keyt_shop'] . $_REQUEST['identified'] . $_REQUEST['sum'] . $_REQUEST['comment'];
    $sign = hmac($settings['skeys'], $param);
} else {
    $param = $_REQUEST['transact'] . $_REQUEST['status'] . $_REQUEST['result'] . $_REQUEST['ext_transact'] . $_REQUEST['num_shop'] . $_REQUEST['keyt_shop'] . '1' . $_REQUEST['sum'] . $_REQUEST['comment'];
    $sign = hmac($settings['skeys'], $param);
}
if ($sign != $_REQUEST['sign']) {
    if ($_REQUEST['check'] == "1") {
        die("Контрольная подпись не верна");
    } else {
        $url = $okay->config->root_url . '/order/' . $order->url;
        header('location:' . $url);
        exit;
    }
}
////////////////////////////////////
// Проверка суммы платежа
////////////////////////////////////
// Сумма заказа у нас в магазине
$order_amount = $okay->money->convert($order->total_price, $method->currency_id, false);

//.........这里部分代码省略.........
                                $opts['id'] = 'nobody';
                                $ticket = base64_encode(getTicket($_SERVER['REMOTE_ADDR'], $opts['email'], 10));
                                $enc = base64_encode($opts['email']);
                                $body = qualifiedUrl($formatter->link_url('UserPreferences', "?action=userform&login={$enc}&verify_email={$ticket}"));
                                $body = _("Please confirm your e-mail address") . "\n" . $body . "\n";
                                $ret = wiki_sendmail($body, $opts);
                                $options['msg'] .= '<br/>' . _("E-mail verification mail sent");
                            }
                        }
                    }
                } else {
                    $options['msg'] .= '<br/>' . _("Your email address is not valid");
                }
            } else {
                if ($user->id == "Anonymous" and !empty($options['login_id']) and isset($options['password']) and !isset($options['passwordagain'])) {
                    if (method_exists($user, 'login')) {
                        $user->login($formatter, $options);
                        $params = array();
                        $params['value'] = $options['page'];
                        do_goto($formatter, $params);
                        return;
                    }
                    # login
                    $userdb = $DBInfo->udb;
                    if ($userdb->_exists($id)) {
                        $user = $userdb->getUser($id);
                        $login_ok = 0;
                        if (!empty($DBInfo->use_safelogin)) {
                            if (isset($options['challenge']) and $options['_chall'] == $options['challenge']) {
                                #print '<pre>';
                                #print $options['password'].'<br />';
                                #print hmac($options['challenge'],$user->info['password']);
                                #print '</pre>';
                                if (hmac($options['challenge'], $user->info['password']) == $options['password']) {
                                    $login_ok = 1;
                                }
                            } else {
                                # with no javascript browsers
                                $md5pw = md5($options['password']);
                                if ($md5pw == $user->info['password']) {
                                    $login_ok = 1;
                                }
                            }
                        }
                        if ($login_ok or $user->checkPasswd($options['password']) === true) {
                            $options['msg'] = sprintf(_("Successfully login as '%s'"), $id);
                            $options['id'] = $user->id;
                            if ($user->id == 'Anonymous') {
                                // special case. login success but ID is not acceptable
                                $options['msg'] = _("Invalid user ID. Please register again");
                            } else {
                                $formatter->header($user->setCookie());
                                if (!isset($user->info['login_success'])) {
                                    $user->info['login_success'] = 0;
                                }
                                if (!isset($user->info['login_fail'])) {
                                    $user->info['login_fail'] = 0;
                                }
                                $user->info['login_success']++;
                                $user->info['last_login'] = gmdate("Y/m/d H:i:s", time());
                                $user->info['login_fail'] = 0;
                                // reset login
                                $user->info['remote'] = $_SERVER['REMOTE_ADDR'];
                                $userdb->saveUser($user);
                                $use_refresh = 1;
                            }

 function sdb_request($action, $params = array())
 {
     global $adminer, $connection;
     list($host, $params['AWSAccessKeyId'], $secret) = $adminer->credentials();
     $params['Action'] = $action;
     $params['Timestamp'] = gmdate('Y-m-d\\TH:i:s+00:00');
     $params['Version'] = '2009-04-15';
     $params['SignatureVersion'] = 2;
     $params['SignatureMethod'] = 'HmacSHA1';
     ksort($params);
     $query = '';
     foreach ($params as $key => $val) {
         $query .= '&' . rawurlencode($key) . '=' . rawurlencode($val);
     }
     $query = str_replace('%7E', '~', substr($query, 1));
     $query .= "&Signature=" . urlencode(base64_encode(hmac('sha1', "POST\n" . preg_replace('~^https?://~', '', $host) . "\n/\n{$query}", $secret, true)));
     @ini_set('track_errors', 1);
     // @ - may be disabled
     $file = @file_get_contents(preg_match('~^https?://~', $host) ? $host : "http://{$host}", false, stream_context_create(array('http' => array('method' => 'POST', 'content' => $query, 'ignore_errors' => 1))));
     if (!$file) {
         $connection->error = $php_errormsg;
         return false;
     }
     libxml_use_internal_errors(true);
     $xml = simplexml_load_string($file);
     if (!$xml) {
         $error = libxml_get_last_error();
         $connection->error = $error->message;
         return false;
     }
     if ($xml->Errors) {
         $error = $xml->Errors->Error;
         $connection->error = "{$error->Message} ({$error->Code})";
         return false;
     }
     $connection->error = '';
     $tag = $action . "Result";
     return $xml->{$tag} ? $xml->{$tag} : true;
 }

	        		                <input type=hidden name=x_show_form value="PAYMENT_FORM">
	        		                <input type=hidden name=x_relay_response value="TRUE">
	        		                <input type=hidden name=x_login value="<?php 
                                print $authorize_login;
                                ?>
">
						<input type=hidden name=x_fp_sequence value="<?php 
                                print $r->id;
                                ?>
">
						<input type=hidden name=x_fp_timestamp value="<?php 
                                print $x_time;
                                ?>
">
						<input type=hidden name=x_fp_hash value="<?php 
                                print hmac($authorize_secret, $authorize_login . "^" . $r->id . "^" . $x_time . "^" . sprintf("%01.2f", $money_authorize) . "^");
                                ?>
">
	        		                <input type=hidden name=x_receipt_link_url value="<?php 
                                print GetSetting("payment_url");
                                ?>
">
	        		                <input type=hidden name=x_relay_url value="<?php 
                                print $full_www_path . "online_authorize.php";
                                ?>
">
			                        <input type=hidden name=x_description value="<?php 
                                print $company_name;
                                ?>
: bill <?php 
                                print $sid;

 public function build_signature($request, $consumer, $token)
 {
     $base_string = $request->get_signature_base_string();
     $request->base_string = $base_string;
     $key_parts = array(!empty($consumer->secret) ? $consumer->secret : '', $token ? $token->secret : "");
     $key_parts = OAuthUtil::urlencode_rfc3986($key_parts);
     $key = implode('&', $key_parts);
     if (!function_exists('hash_hmac')) {
         return base64_encode(hmac($key, $base_string));
     } else {
         return base64_encode(hash_hmac('sha1', $base_string, $key, true));
     }
 }

 private function checkid($wait)
 {
     if (empty($_REQUEST['openid_return_to'])) {
         return $this->error400('return_to');
     }
     $return_to = $_REQUEST['openid_return_to'];
     if (empty($_REQUEST['openid_identity'])) {
         return $this->error_get($return_to, 'identity');
     }
     $identity = $_REQUEST['openid_identity'];
     if ($identity != litepublisher::$site->url . $this->url) {
         return $this->error_get($return_to, 'identity');
     }
     $trust_root = !empty($_REQUEST['openid_trust_root']) ? $_REQUEST['openid_trust_root'] : $return_to;
     if ($trust_root != $return_to) {
         if (!$this->urldescends($return_to, $trust_root)) {
             return $this->error500('Invalidtrust');
         }
     }
     $assoc_handle = !empty($_REQUEST['openid_assoc_handle']) ? $_REQUEST['openid_assoc_handle'] : null;
     $sreg_required = !empty($_REQUEST['openid_sreg_required']) ? $_REQUEST['openid_sreg_required'] : '';
     $sreg_optional = !empty($_REQUEST['openid_sreg_optional']) ? $_REQUEST['openid_sreg_optional'] : '';
     //join  fields
     $sreg_required .= ',' . $sreg_optional;
     $auth = tauthdigest::i();
     if (litepublisher::$options->cookieenabled) {
         if (!litepublisher::$options->user) {
             return litepublisher::$urlmap->redir('/admin/login/');
         }
     } elseif (!$auth->Auth()) {
         return $auth->headers();
     }
     if (litepublisher::$options->group != 'admin') {
         return 404;
     }
     $q = strpos($return_to, '?') ? '&' : '?';
     $cancel_url = $return_to . $q . 'openid.mode=cancel';
     if ($wait && (!in_array($trust_root, $this->trusted) || $this->confirm)) {
         //вывести форму и проверит результат формы
         if (empty($_POST['submit'])) {
             if (!empty($_REQUEST['openid_assoc_handle']) && isset($this->keys[$_REQUEST['openid_assoc_handle']])) {
                 $this->keys[$_REQUEST['openid_assoc_handle']]['request'] = $_REQUEST;
                 $this->save();
             }
             $html = tadminhtml::i();
             $html->section = 'openidserver';
             $lang = tlocal::i('openidserver');
             $args = targs::i();
             $args->trust_root = $trust_root;
             $args->assoc_handle = $assoc_handle;
             $form = $html->trustform($args);
             return tsimplecontent::html($form);
         } else {
             switch ($_POST['accept']) {
                 case 'yes':
                     break;
                 case 'yesall':
                     $this->trusted[] = $trust_root;
                     $this->save();
                     break;
                 default:
                     return $this->redir($cancel_url);
             }
         }
     }
     $keys = array('mode' => 'id_res', 'identity' => litepublisher::$site->url . $this->url, 'return_to' => $return_to);
     if (!($shared_secret = $this->GetSecret($assoc_handle))) {
         if ($assoc_handle != null) {
             $keys['invalidate_handle'] = $assoc_handle;
             if (isset($this->keys[$assoc_handle])) {
                 unset($this->keys[$assoc_handle]);
             }
         }
         $this->NewKeys($assoc_handle, $shared_secret, $lifetime);
     }
     $keys['assoc_handle'] = $assoc_handle;
     foreach (explode(',', $sreg_required) as $key) {
         if (!isset($_REQUEST[$key])) {
             continue;
         }
         $skey = 'sreg.' . $key;
         if ($value = $this->GetReg($key)) {
             $keys[$skey] = $value;
         }
     }
     $tokens = '';
     foreach ($keys as $key => $value) {
         $tokens .= "{$key}:{$value}\n";
     }
     $keys['signed'] = implode(',', array_keys($keys));
     $keys['sig'] = base64_encode(hmac($shared_secret, $tokens));
     return $this->RedirKeys($return_to, $keys);
 }

 function checkPasswd($passwd, $chall = 0)
 {
     if (strlen($passwd) < 3) {
         return false;
     }
     if ($chall) {
         if (hmac($chall, $this->info['password']) == $passwd) {
             return true;
         }
     } else {
         if (crypt($passwd, $this->info['password']) == $this->info['password']) {
             return true;
         }
     }
     return false;
 }

 private function _createSign($text)
 {
     return hmac($this->_private_key, $text, 'sha1');
 }

$contractName = $_REQUEST["contractName"];
$contractName = decodeUtf8($contractName);
$invoiceTitle = $_REQUEST["invoiceTitle"];
$invoiceTitle = decodeUtf8($invoiceTitle);
$mobile = $_REQUEST["mobile"];
$orderId = $_REQUEST["orderId"];
$payDate = $_REQUEST["payDate"];
$reserved = $_REQUEST["reserved"];
$reserved = decodeUtf8($reserved);
$status = $_REQUEST["status"];
$amtItem = $_REQUEST["amtItem"];
$signData = $merchantId . $payNo . $requestId . $returnCode . $message . $sigTyp . $type . $version . $amount . $banks . $contractName . $invoiceTitle . $mobile . $orderId . $payDate . $reserved . $status;
// if($version == "1.0.1")
$signData = $merchantId . $payNo . $requestId . $returnCode . $message . $sigTyp . $type . $version . $amount . $banks . $contractName . $invoiceTitle . $mobile . $orderId . $payDate . $reserved . $status . $amtItem;
$hash = hmac("", $signData);
$newhmac = hmac($signKey, $hash);
RecordLog("YGM", "###hmac" . $hmac . "###");
RecordLog("YGM", "###newhmac" . $newhmac . "###");
@(list($_, $order_id, $city_id, $_) = explode('-', $orderId, 4));
if (Table::Fetch('pay', $orderId)) {
    die('SUCCESS');
}
$v_amount = $amount / 100;
if ($_ == 'charge') {
    if ($newhmac == $hmac) {
        @(list($_, $user_id, $create_time, $_) = explode('-', $orderId, 4));
        ZFlow::CreateFromCharge($v_amount, $user_id, $create_time, 'cmpay');
        // 记录日志
        RecordMyLog("流水号:" . $payNo);
        RecordMyLog("支付金额:" . $amount);
        RecordMyLog("金额明细:" . $amtItem);

 /**
  * 响应操作
  */
 function respond()
 {
     $payment = get_payment('yeepay_abchina');
     $merchant_id = $payment['yp_account'];
     // 获取商户编号
     $merchant_key = $payment['yp_key'];
     // 获取秘钥
     $message_type = trim($_REQUEST['r0_Cmd']);
     $succeed = trim($_REQUEST['r1_Code']);
     // 获取交易结果,1成功,-1失败
     $trxId = trim($_REQUEST['r2_TrxId']);
     $amount = trim($_REQUEST['r3_Amt']);
     // 获取订单金额
     $cur = trim($_REQUEST['r4_Cur']);
     // 获取订单货币单位
     $product_id = trim($_REQUEST['r5_Pid']);
     // 获取产品ID
     $orderid = trim($_REQUEST['r6_Order']);
     // 获取订单ID
     $userId = trim($_REQUEST['r7_Uid']);
     // 获取产品ID
     $merchant_param = trim($_REQUEST['r8_MP']);
     // 获取商户私有参数
     $bType = trim($_REQUEST['r9_BType']);
     // 获取订单ID
     $mac = trim($_REQUEST['hmac']);
     // 获取安全加密串
     ///生成加密串,注意顺序
     $ScrtStr = $merchant_id . $message_type . $succeed . $trxId . $amount . $cur . $product_id . $orderid . $userId . $merchant_param . $bType;
     $mymac = hmac($ScrtStr, $merchant_key);
     $v_result = false;
     if (strtoupper($mac) == strtoupper($mymac)) {
         if ($succeed == '1') {
             ///支付成功
             $v_result = true;
             order_paid($orderid);
         }
     }
     return $v_result;
 }

/**
 * Testing for setup
 * @global array $profile
 */
function test_mode()
{
    global $profile, $p, $g;
    if ($profile['allow_test'] != true) {
        error_403();
    }
    @ini_set('max_execution_time', 180);
    $test_expire = time() + 120;
    $test_ss_enc = 'W7hvmld2yEYdDb0fHfSkKhQX+PM=';
    $test_ss = base64_decode($test_ss_enc);
    $test_token = "alpha:bravo\ncharlie:delta\necho:foxtrot";
    $test_server_private = '11263846781670293092494395517924811173145217135753406847875706165886322533899689335716152496005807017390233667003995430954419468996805220211293016296351031812246187748601293733816011832462964410766956326501185504714561648498549481477143603650090931135412673422192550825523386522507656442905243832471167330268';
    $test_client_public = base64_decode('AL63zqI5a5p8HdXZF5hFu8p+P9GOb816HcHuvNOhqrgkKdA3fO4XEzmldlb37nv3+xqMBgWj6gxT7vfuFerEZLBvuWyVvR7IOGZmx0BAByoq3fxYd3Fpe2Coxngs015vK37otmH8e83YyyGo5Qua/NAf13yz1PVuJ5Ctk7E+YdVc');
    $res = array();
    // bcmath
    $res['bcmath'] = extension_loaded('bcmath') ? 'pass' : 'warn - not loaded';
    // gmp
    if ($profile['allow_gmp']) {
        $res['gmp'] = extension_loaded('gmp') ? 'pass' : 'warn - not loaded';
    } else {
        $res['gmp'] = 'pass - n/a';
    }
    // get_temp_dir
    $res['logfile'] = is_writable($profile['logfile']) ? 'pass' : "warn - log is not writable";
    // session & new_assoc
    user_session();
    list($test_assoc, $test_new_ss) = new_assoc($test_expire);
    $res['session'] = $test_assoc != session_id() ? 'pass' : 'fail';
    // secret
    @session_unregister('shared_secret');
    list($check, $check2) = secret($test_assoc);
    $res['secret'] = $check == $test_new_ss ? 'pass' : 'fail';
    // expire
    $res['expire'] = $check2 <= $test_expire ? 'pass' : 'fail';
    // base64
    $res['base64'] = base64_encode($test_ss) == $test_ss_enc ? 'pass' : 'fail';
    // hmac
    $test_sig = base64_decode('/VXgHvZAOdoz/OTa5+XJXzSGhjs=');
    $check = hmac($test_ss, $test_token);
    $res['hmac'] = $check == $test_sig ? 'pass' : sprintf("fail - '%s'", base64_encode($check));
    if ($profile['use_bigmath']) {
        // bigmath powmod
        $test_server_public = '102773334773637418574009974502372885384288396853657336911033649141556441102566075470916498748591002884433213640712303846640842555822818660704173387461364443541327856226098159843042567251113889701110175072389560896826887426539315893475252988846151505416694218615764823146765717947374855806613410142231092856731';
        $check = bmpowmod($g, $test_server_private, $p);
        $res['bmpowmod-1'] = $check == $test_server_public ? 'pass' : sprintf("fail - '%s'", $check);
        // long
        $test_client_long = '133926731803116519408547886573524294471756220428015419404483437186057383311250738749035616354107518232016420809434801736658109316293127101479053449990587221774635063166689561125137927607200322073086097478667514042144489248048756916881344442393090205172004842481037581607299263456852036730858519133859409417564';
        $res['long'] = long($test_client_public) == $test_client_long ? 'pass' : 'fail';
        // bigmath powmod 2
        $test_client_share = '19333275433742428703546496981182797556056709274486796259858099992516081822015362253491867310832140733686713353304595602619444380387600756677924791671971324290032515367930532292542300647858206600215875069588627551090223949962823532134061941805446571307168890255137575975911397744471376862555181588554632928402';
        $check = bmpowmod($test_client_long, $test_server_private, $p);
        $res['bmpowmod-2'] = $check == $test_client_share ? 'pass' : sprintf("fail - '%s'", $check);
        // bin
        $test_client_mac_s1 = base64_decode('G4gQQkYM6QmAzhKbVKSBahFesPL0nL3F2MREVwEtnVRRYI0ifl9zmPklwTcvURt3QTiGBd+9Dn3ESLk5qka6IO5xnILcIoBT8nnGVPiOZvTygfuzKp4tQ2mXuIATJoa7oXRGmBWtlSdFapH5Zt6NJj4B83XF/jzZiRwdYuK4HJI=');
        $check = bin($test_client_share);
        $res['bin'] = $check == $test_client_mac_s1 ? 'pass' : sprintf("fail - '%s'", base64_encode($check));
    } else {
        $res['bigmath'] = 'fail - big math functions are not available.';
    }
    // sha1_20
    $test_client_mac_s1 = base64_decode('G4gQQkYM6QmAzhKbVKSBahFesPL0nL3F2MREVwEtnVRRYI0ifl9zmPklwTcvURt3QTiGBd+9Dn3ESLk5qka6IO5xnILcIoBT8nnGVPiOZvTygfuzKp4tQ2mXuIATJoa7oXRGmBWtlSdFapH5Zt6NJj4B83XF/jzZiRwdYuK4HJI=');
    $test_client_mac_s2 = base64_decode('0Mb2t9d/HvAZyuhbARJPYdx3+v4=');
    $check = sha1_20($test_client_mac_s1);
    $res['sha1_20'] = $check == $test_client_mac_s2 ? 'pass' : sprintf("fail - '%s'", base64_encode($check));
    // x_or
    $test_client_mac_s3 = base64_decode('i36ZLYAJ1rYEx1VEHObrS8hgAg0=');
    $check = x_or($test_client_mac_s2, $test_ss);
    $res['x_or'] = $check == $test_client_mac_s3 ? 'pass' : sprintf("fail - '%s'", base64_encode($check));
    $out = "<table border=1 cellpadding=4>\n";
    foreach ($res as $test => $stat) {
        $code = substr($stat, 0, 4);
        $color = $code == 'pass' ? '#9f9' : ($code == 'warn' ? '#ff9' : '#f99');
        $out .= sprintf("<tr><th>%s</th><td style='background:%s'>%s</td></tr>\n", $test, $color, $stat);
    }
    $out .= "</table>";
    wrap_html($out);
}

{
    // RFC 2104 HMAC implementation for php.
    // Creates an md5 HMAC.
    // Eliminates the need to install mhash to compute a HMAC
    // Hacked by Lance Rushing
    $b = 64;
    // byte length for md5
    if (strlen($key) > $b) {
        $key = pack("H*", md5($key));
    }
    $key = str_pad($key, $b, chr(0x0));
    $ipad = str_pad('', $b, chr(0x36));
    $opad = str_pad('', $b, chr(0x5c));
    $k_ipad = $key ^ $ipad;
    $k_opad = $key ^ $opad;
    return md5($k_opad . pack("H*", md5($k_ipad . $data)));
}
$hasError = false;
$msg = "OK";
$uid = $_REQUEST['uid'];
$data = $_REQUEST['data'];
$sign = $_REQUEST['sign'];
$seq = $_REQUEST['seq'];
$cookie = $_REQUEST['cookie'];
$check = hmac($uid, $data);
if ($check != $sign) {
    $hasError = true;
    $msg = "FAILED";
}
$rank = "not yet known";
echo "oygSubmitScoreJSONComplete({  \"envelope\":  {\"success\":" . ($hasError ? "false" : "true") . ", \"seq\":" . $seq . ", \"cookie\":" . $cookie . ", \"msg\":\"" . $msg . "\"}, \"data\": {\"rank\": \"" . $rank . "\"}});";

 function hmac_md5($key, $data)
 {
     return hmac('md5', $key, $data);
 }