<?php
header("Content-type: text/html; charset=windows-1251");
require_once($_SERVER['DOCUMENT_ROOT']."/merchant/payment_config.php");
require_once($_SERVER['DOCUMENT_ROOT']."/config.php");
require_once($_SERVER['DOCUMENT_ROOT']."/funciones.php");
define('PATH_TO_LOG', dirname(__FILE__).'/');
$hash = (isset($_REQUEST["sha1_hash"])) ? strtoupper($_REQUEST["sha1_hash"]) : false;
$site_hash = @strtoupper(sha1($_REQUEST["notification_type"].'&'.$_REQUEST["operation_id"].'&'.$_REQUEST["amount"].'&'.$_REQUEST["currency"].'&'.$_REQUEST["datetime"].'&'.$_REQUEST["sender"].'&'.$_REQUEST["codepro"].'&'.YM_SECRET_KEY.'&'.$_REQUEST["label"]));
// проверка хеш
if ($site_hash != $hash) {
exit('Верификация не пройдена. SHA1_HASH не совпадает.'); // останавливаем скрипт. у вас тут может быть свой код.
}

$m_orderid = ( isset($_REQUEST['label']) && preg_match("|^[\d]{1,11}$|", trim($_REQUEST['label'])) ) ? intval(trim($_REQUEST['label'])) : false;
$amount = (isset($_REQUEST['amount'])) ? floatval($_REQUEST['amount']) : NULL;

$allsumme = mysql_result(mysql_query("SELECT SUM(price) FROM `b_basket` WHERE `fromid`='$m_orderid'"),0);
$allsumme = number_format($allsumme, 2, '.', "");
if($amount >= $allsumme){
$f = @fopen(PATH_TO_LOG."test.txt","a+") or die("error");
@fputs($f,$m_orderid."-".$amount."-".$allsumme);
@fclose($f);
require_once($_SERVER['DOCUMENT_ROOT']."/merchant/success-merch.php");
}else{
exit("Неверная сумма пополнения");
}
?>