初步改写的支付宝支付代码，仅测试了担保支付

1. order/model.php 的 getOrderFromAlipay方法

主要改动：回调回来仅判断是否是合法回调（签名验证）后就查询出对应的订单

/**
     * Get order id from the alipay return.
     * 
     * @param  string $mode  return|notify
     * @access public
     * @return object
     */
    public function getOrderFromAlipay($mode = 'return')
    {
        $this->app->loadClass('alipay', true);
        $alipay = new alipay($this->config->alipay);
        $orderID = 0;
        
        if($mode == 'return')
        {
            if($this->get->is_success =='T' and $alipay->checkNotify($_GET) )
            {
            	$orderID = $this->get->out_trade_no;
                $sn      = $this->get->trade_no;
            }else {
            	return false;
            }
        }
        elseif($mode == 'notify')
        {
            if($alipay->checkNotify($_POST))
            {
                $orderID = $this->post->out_trade_no;
                $sn      = $this->post->trade_no;
            }else {
            	return false;
            }
        }
        if($orderID) $orderID = $this->getRawOrder($orderID);
        $order = $this->getByID($orderID);
		if($order) {
	        $order->sn = $sn;
	        return $order;
		}else {
			return false;
		}
    }

2. order/control.php的 processAlipayOrder方法

主要改动：根据回调回来的交易状态和退款状态以及订单本身的状态进行不同处理

/**
     * Process alipay order.
     * 
     * @param  string $mode 
     * @access public
     * @return void
     */
    public function processAlipayOrder($mode = 'return')
    {
//        $this->order->saveAlipayLog(); 调试用，修改了get回调也打印
    	$this->app->loadClass('alipay', true);
        $alipay = new alipay($this->config->alipay);
        /* Get the orderID from the alipay. */
        $order = $this->order->getOrderFromAlipay($mode);
        if(empty($order)) die('STOP!');
		
        $data = array();
        if($_POST) {
        	$data = $_POST;
        }else {
        	$data = $_GET;
        }
        $trade_status = $data['trade_status'];
        $refund_status = false;
        if(isset($data->refund_status)) {
        	$refund_status = $data['refund_status'];
        }
        $result = false;
        if($refund_status) {
        	//退款通知
        	if($refund_status == 'REFUND_SUCCESS') {
        		//退款完成
        		$result = $this->order->cancel($order->id,'退款完成');
        	}else {
	        	if($order->payStatus == 'not_paid') {
	        		if($order->status =='normal')
	        		//没有受到付款信息（比如支付宝付款通知失败的场景，客户已经付款了，但是系统不知道，此时如果要求付款时可以的
	        		if($refund_status == 'WAIT_SELLER_AGREE') {
	        			//支付宝征求系统同意
	        			$result = $this->order->cancel($order->id,'未收到付款信息时申请退款');
	        			//TODO: 发送同意退款
	        		}else {
	        			$result = true;
	        		}
	        			
	        	}
            }
        }else {
        	//交易通知
        	 if($order->payStatus == 'not_paid') {
        	 	//还没有付款
        	 	if($trade_status == 'WAIT_SELLER_SEND_GOODS' 
        	 			|| $trade_status == 'WAIT_BUYER_CONFIRM_GOODS'  
        	 			|| $trade_status == 'TRADE_FINISHED' 
        	 			|| $trade_status == 'TRADE_SUCCESS') {
        	 		$result = $this->order->processOrder($order);
        	 	}elseif($trade_status == 'TRADE_CLOSED') {
        	 		//没付款就结束交易了
        	 		$result = $this->order->cancel($order->id,'取消付款');
        	 	}
        	 }elseif($order->payStatus == 'paid')  {
        	 	//已经付款了
        	 	if($trade_status == 'TRADE_FINISHED') {
        	 		//交易完成
        	 		$result = $this->order->finish($order->id);
        	 	}else {
        	 		$result = true;
        	 	}
        	 }
        }
        
        /* Process the order. */
       // $result = $this->order->processOrder($order);
        /* Notify mode. */
        if($mode == 'notify')
        {
            if($result) die('success');
            die('fail');
        }
        /* Return model. */
        $order = $this->order->getOrderByRawID($order->id);
        $this->view->order  = $order;
        $this->view->result = $result;
        $this->display('order', 'processorder'); 
    }

希望能有些参考作用

楼主辛苦了，感谢！

稍后我去试试。