From b2546d71a591525f504ea7e7ac2255c42b5e6667 Mon Sep 17 00:00:00 2001 From: midoks Date: Sun, 13 Nov 2022 09:43:33 +0800 Subject: [PATCH] up --- class/core/site_api.py | 163 +++++++++++++++++++++++++++++++++++++++ route/static/app/site.js | 19 +---- 2 files changed, 164 insertions(+), 18 deletions(-) diff --git a/class/core/site_api.py b/class/core/site_api.py index e5d622abb..d109e5910 100755 --- a/class/core/site_api.py +++ b/class/core/site_api.py @@ -774,6 +774,169 @@ class site_api: return mw.returnJson(True, 'OK', result) + def createAcmeApi(self): + siteName = request.form.get('siteName', '') + updateOf = request.form.get('updateOf', '') + domains = request.form.get('domains', '') + force = request.form.get('force', '') + renew = request.form.get('renew', '') + email_args = request.form.get('email', '') + + domains = json.loads(domains) + email = mw.M('users').getField('email') + if email_args.strip() != '': + mw.M('users').setField('email', email_args) + email = email_args + + if not len(domains): + return mw.returnJson(False, '请选择域名') + + file = self.getHostConf(siteName) + if os.path.exists(file): + siteConf = mw.readFile(file) + if siteConf.find('301-END') != -1: + return mw.returnJson(False, '检测到您的站点做了301重定向设置，请先关闭重定向!') + + # 检测存在反向代理 + data_path = self.getProxyDataPath(siteName) + data_content = mw.readFile(data_path) + if data_content != False: + try: + data = json.loads(data_content) + except: + pass + for proxy in data: + proxy_dir = "{}/{}".format(self.proxyPath, siteName) + proxy_dir_file = proxy_dir + '/' + proxy['id'] + '.conf' + if os.path.exists(proxy_dir_file): + return mw.returnJson(False, '检测到您的站点做了反向代理设置，请先关闭反向代理!') + + letpath = self.sslDir + siteName + csrpath = letpath + "/fullchain.pem" # 生成证书路径 + keypath = letpath + "/privkey.pem" # 密钥文件路径 + + actionstr = updateOf + siteInfo = mw.M('sites').where( + 'name=?', (siteName,)).field('id,name,path').find() + path = self.getSitePath(siteName) + srcPath = siteInfo['path'] + + # 检测acme是否安装 + if mw.isAppleSystem(): + user = mw.execShell( + "who | sed -n '2, 1p' |awk '{print $1}'")[0].strip() + acem = '/Users/' + user + '/.acme.sh/acme.sh' + else: + acem = '/root/.acme.sh/acme.sh' + if not os.path.exists(acem): + acem = '/.acme.sh/acme.sh' + if not os.path.exists(acem): + try: + mw.execShell("curl -sS curl https://get.acme.sh | sh") + except: + return mw.returnJson(False, '尝试自动安装ACME失败,请通过以下命令尝试手动安装

安装命令: curl https://get.acme.sh | sh

' + acem) + if not os.path.exists(acem): + return mw.returnJson(False, '尝试自动安装ACME失败,请通过以下命令尝试手动安装

安装命令: curl https://get.acme.sh | sh

' + acem) + + # 避免频繁执行 + checkAcmeRun = mw.execShell('ps -ef|grep acme.sh |grep -v grep') + if checkAcmeRun[0] != '': + return mw.returnJson(False, '正在申请或更新SSL中...') + + if force == 'true': + force_bool = True + + if renew == 'true': + execStr = acem + " --renew --yes-I-know-dns-manual-mode-enough-go-ahead-please" + else: + execStr = acem + " --issue --force" + + # 确定主域名顺序 + domainsTmp = [] + if siteName in domains: + domainsTmp.append(siteName) + for domainTmp in domains: + if domainTmp == siteName: + continue + domainsTmp.append(domainTmp) + domains = domainsTmp + + domainCount = 0 + for domain in domains: + if mw.checkIp(domain): + continue + if domain.find('*.') != -1: + return mw.returnJson(False, '泛域名不能使用【文件验证】的方式申请证书!') + execStr += ' -w ' + path + execStr += ' -d ' + domain + domainCount += 1 + if domainCount == 0: + return mw.returnJson(False, '请选择域名(不包括IP地址与泛域名)!') + + home_path = '/root/.acme.sh/' + domains[0] + home_cert = home_path + '/fullchain.cer' + home_key = home_path + '/' + domains[0] + '.key' + + if not os.path.exists(home_cert): + home_path = '/.acme.sh/' + domains[0] + home_cert = home_path + '/fullchain.cer' + home_key = home_path + '/' + domains[0] + '.key' + + if mw.isAppleSystem(): + user = mw.execShell( + "who | sed -n '2, 1p' |awk '{print $1}'")[0].strip() + acem = '/Users/' + user + '/.acme.sh/' + if not os.path.exists(home_cert): + home_path = acem + domains[0] + home_cert = home_path + '/fullchain.cer' + home_key = home_path + '/' + domains[0] + '.key' + + # print home_cert + cmd = 'export ACCOUNT_EMAIL=' + email + ' && ' + execStr + # print(domains) + # print(cmd) + result = mw.execShell(cmd) + + if not os.path.exists(home_cert.replace("\*", "*")): + data = {} + data['err'] = result + data['out'] = result[0] + data['msg'] = '签发失败,我们无法验证您的域名:

1、检查域名是否绑定到对应站点

\ +

2、检查域名是否正确解析到本服务器,或解析还未完全生效

\ +

3、如果您的站点设置了反向代理,或使用了CDN,请先将其关闭

\ +

4、如果您的站点设置了301重定向,请先将其关闭

\ +

5、如果以上检查都确认没有问题，请尝试更换DNS服务商

' + data['result'] = {} + if result[1].find('new-authz error:') != -1: + data['result'] = json.loads( + re.search("{.+}", result[1]).group()) + if data['result']['status'] == 429: + data['msg'] = '签发失败,您尝试申请证书的失败次数已达上限!

1、检查域名是否绑定到对应站点

\ +

2、检查域名是否正确解析到本服务器,或解析还未完全生效

\ +

3、如果您的站点设置了反向代理,或使用了CDN,请先将其关闭

\ +

4、如果您的站点设置了301重定向,请先将其关闭

\ +

5、如果以上检查都确认没有问题，请尝试更换DNS服务商

' + data['status'] = False + return mw.getJson(data) + + if not os.path.exists(letpath): + mw.execShell("mkdir -p " + letpath) + mw.execShell("ln -sf \"" + home_cert + "\" \"" + csrpath + '"') + mw.execShell("ln -sf \"" + home_key + "\" \"" + keypath + '"') + mw.execShell('echo "let" > "' + letpath + '/README"') + if(actionstr == '2'): + return mw.returnJson(True, '证书已更新!') + + # 写入配置文件 + result = self.setSslConf(siteName) + if not result['status']: + return mw.getJson(result) + result['csr'] = mw.readFile(csrpath) + result['key'] = mw.readFile(keypath) + mw.restartWeb() + + return mw.returnJson(True, 'OK', result) + def httpToHttpsApi(self): siteName = request.form.get('siteName', '') file = self.getHostConf(siteName) diff --git a/route/static/app/site.js b/route/static/app/site.js index 9a3bacabe..85f3fcf09 100755 --- a/route/static/app/site.js +++ b/route/static/app/site.js @@ -2083,24 +2083,7 @@ function opSSL(type,id,siteName){ },'json'); break; case 'other': - $(".tab-con").html(other); - var key = ''; - var csr = ''; - var loadT = layer.msg('正在提交任务...',{icon:16,time:0,shade: [0.3, '#000']}); - $.post('site/get_ssl','siteName='+siteName,function(data){ - layer.close(loadT); - var rdata = data['data']; - if (rdata.type == 0){ - setCookie('letssl', 1); - } - if(rdata.status){ - $(".ssl-btn").append(""); - } - if(rdata.key == false) rdata.key = ''; - if(rdata.csr == false) rdata.csr = ''; - $("#key").val(rdata.key); - $("#csr").val(rdata.csr); - },'json'); + layer.msg("错误类型", {icon:5}); break; } }