security: 移除第三方 qrserver.com，改用本地 qrcode 生成 QR 码

scripts/load_path.py

@@ -50,6 +50,7 @@ PATHS_LOGINED = [
     f"/unipay/paychannel",
     f"/unipay/payfee",
     f"/unipay/payment_log",
+    f"/unipay/qr.dspy",
     f"/unipay/recharge.dspy",
     f"/unipay/recharge.ui",
     f"/unipay/refund.dspy",

wwwroot/qr.dspy

@@ -0,0 +1,14 @@
+import io, urllib.parse
+import qrcode
+from aiohttp import web
+
+data = params_kw.get('data', '')
+if not data:
+	return web.Response(status=400, text='missing data')
+
+data = urllib.parse.unquote(data)
+img = qrcode.make(data, box_size=10, border=2)
+buf = io.BytesIO()
+img.save(buf, format='PNG')
+buf.seek(0)
+return web.Response(body=buf.read(), content_type='image/png')

wwwroot/recharge.dspy

@@ -10,7 +10,7 @@ try:
 			"target":"app.sage_main_content",
 			"options":{"url": code_url}
 		}
-	qr_url = 'https://api.qrserver.com/v1/create-qr-code/?size=280x280&data=' + urllib.parse.quote(code_url, safe='')
+	qr_url = entire_url('/unipay/qr.dspy?data=') + urllib.parse.quote(code_url, safe='')
 	return {
 		"widgettype":"NewWindow",
 		"options":{

wwwroot/user_recharge.dspy

@@ -25,7 +25,7 @@ debug(f'user_recharge.dspy: {params_kw=}')
 
 try:
 	url = await create_payment(request, params_kw)
-	qr_url = 'https://api.qrserver.com/v1/create-qr-code/?size=280x280&data=' + urllib.parse.quote(url, safe='')
+	qr_url = entire_url('/unipay/qr.dspy?data=') + urllib.parse.quote(url, safe='')
 	return {
 		"status": "ok",
 		"data": {