update

app/Http/Controllers/OrderController.php

@@ -191,13 +191,13 @@ class OrderController extends Controller
         ]);
     }
 
-    private function alipayF2F ($tradeNo, $totalAmount) {
+    private function alipayF2F ($tradeNo, $totalAmount, Request $request) {
         $gateway = Omnipay::create('Alipay_AopF2F');
         $gateway->setSignType('RSA2'); //RSA/RSA2
         $gateway->setAppId(config('v2board.alipay_appid'));
         $gateway->setPrivateKey(config('v2board.alipay_privkey')); // 可以是路径，也可以是密钥内容
         $gateway->setAlipayPublicKey(config('v2board.alipay_pubkey')); // 可以是路径，也可以是密钥内容
-        $gateway->setNotifyUrl(config('v2board.app_url', env('APP_URL')) . '/api/v1/guest/order/alipayNotify');
+        $gateway->setNotifyUrl($request->getSchemeAndHttpHost() . '/api/v1/guest/order/alipayNotify');
         $request = $gateway->purchase();
         $request->setBizContent([
             'subject'      => config('v2board.app_name', 'V2Board') . ' - 订阅',

public/env.example.js

@@ -0,0 +1,5 @@
+window.v2board = {
+  title: 'V2Board',
+  theme: '1',
+  host: ''
+}

routes/web.php

@@ -1,5 +1,5 @@
 <?php
-
+use Illuminate\Http\Request;
 /*
 |--------------------------------------------------------------------------
 | Web Routes
@@ -11,7 +11,10 @@
 |
 */
 
-Route::get('/', function () {
+Route::get('/', function (Request $request) {
+    if (config('v2board_url') && ($request->getSchemeAndHttpHost() !== config('v2board.url'))) {
+        abort(403, 'forbidden');
+    }
     return view('app', [
         'title' => config('v2board.app_name', 'V2Board'),
         'theme' => config('v2board.app_theme', 1),