feat: complete unified plugin admin v1.1.0

deploy/uninstall.sh

@@ -10,8 +10,27 @@ SELECTION=all
 PURGE=false
 YES=false
 
+validate_managed_root() {
+  local value=$1 label=$2 component current=""
+  [[ -n "$value" && "$value" = /* ]] || die "$label 必须是绝对路径"
+  [[ "$value" != *$'\n'* && "$value" != *$'\r'* ]] || die "$label 包含非法换行"
+  [[ "$value" != "/" ]] || die "$label 不允许指向根目录"
+  local parts=()
+  IFS='/' read -r -a parts <<< "${value#/}"
+  for component in "${parts[@]}"; do
+    [[ -z "$component" ]] && continue
+    [[ "$component" != "." && "$component" != ".." ]] || die "$label 不能包含 . 或 .. 路径组件"
+    current="$current/$component"
+    [[ ! -L "$current" ]] || die "$label 的路径组件不能是符号链接：$current"
+  done
+  if [[ "$value" != */sub2api-add && "${PLUGIN_ALLOW_CUSTOM_PATHS:-false}" != "true" ]]; then
+    die "$label 必须位于受管的 sub2api-add 目录；如确需自定义路径请显式设置 PLUGIN_ALLOW_CUSTOM_PATHS=true"
+  fi
+}
+
 die() { printf '错误：%s\n' "$*" >&2; exit 1; }
 [[ $EUID -eq 0 ]] || die "请使用 root 或 sudo 运行"
+command -v systemctl >/dev/null 2>&1 || die "缺少 systemd/systemctl"
 
 while (($#)); do
   case "$1" in
@@ -29,6 +48,14 @@ case "$SELECTION" in
   *) die "插件必须是 all、plugin-admin 或 subscription-admin" ;;
 esac
 
+validate_managed_root "$ETC_DIR" PLUGIN_ETC_DIR
+validate_managed_root "$VAR_DIR" PLUGIN_VAR_DIR
+validate_managed_root "$PREFIX" PLUGIN_INSTALL_PREFIX
+validate_managed_root "$SOURCE_DIR" PLUGIN_SOURCE_DIR
+if $PURGE && [[ "${PLUGIN_PURGE_SOURCE:-true}" == "true" && "$SOURCE_DIR" != "$PREFIX" && "${PLUGIN_ALLOW_CUSTOM_PATHS:-false}" != "true" ]]; then
+  die "为避免误删，--purge 默认要求 PLUGIN_SOURCE_DIR 与 PLUGIN_INSTALL_PREFIX 相同"
+fi
+
 if $PURGE && ! $YES; then
   [[ -t 0 ]] || die "非交互环境执行 --purge 时必须同时提供 --yes"
   read -r -p "将删除插件配置和数据，继续？[y/N] " answer
@@ -38,21 +65,27 @@ fi
 for plugin in "${PLUGINS[@]}"; do
   unit="sub2api-$plugin.service"
   systemctl disable --now "$unit" 2>/dev/null || true
-  rm -f "/etc/systemd/system/$unit"
+  rm -f -- "/etc/systemd/system/$unit"
   # Keep the checked-out source clean so a later install can fast-forward it.
   # Only generated binaries are removed unless --purge is explicitly used.
-  rm -f "$PREFIX/$plugin/bin/$plugin"
+  rm -f -- "$PREFIX/$plugin/bin/$plugin"
   if $PURGE; then
-    rm -rf "$PREFIX/$plugin"
-    rm -f "$ETC_DIR/$plugin.env"
-    rm -rf "$VAR_DIR/$plugin"
+    plugin_root="$PREFIX/$plugin"
+    if [[ -d "$plugin_root" && ! -L "$plugin_root" ]]; then
+      rm -rf -- "${plugin_root:?}"
+    fi
+    rm -f -- "$ETC_DIR/$plugin.env"
+    plugin_data="$VAR_DIR/$plugin"
+    if [[ -d "$plugin_data" && ! -L "$plugin_data" ]]; then
+      rm -rf -- "${plugin_data:?}"
+    fi
   fi
 done
 
 systemctl daemon-reload
 if $PURGE && [[ -d "$ETC_DIR" ]]; then rmdir "$ETC_DIR" 2>/dev/null || true; fi
 if $PURGE && [[ -d "$VAR_DIR" ]]; then rmdir "$VAR_DIR" 2>/dev/null || true; fi
-if $PURGE && [[ -d "$SOURCE_DIR" ]]; then rm -rf "$SOURCE_DIR"; fi
+if $PURGE && [[ "${PLUGIN_PURGE_SOURCE:-true}" == "true" && "$SOURCE_DIR" == "$PREFIX" && -d "$SOURCE_DIR" && ! -L "$SOURCE_DIR" ]]; then rm -rf -- "$SOURCE_DIR"; fi
 
 if $PURGE; then
   userdel "$RUN_USER" 2>/dev/null || true