From 149092a3a05ed4857c302d2999c7d88fdd172c9e Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Thu, 16 Jul 2026 17:25:34 +0800
Subject: [PATCH] =?UTF-8?q?security:=20=E7=A7=BB=E9=99=A4=E7=AC=AC?=
 =?UTF-8?q?=E4=B8=89=E6=96=B9=20qrserver.com=EF=BC=8C=E6=94=B9=E7=94=A8?=
 =?UTF-8?q?=E6=9C=AC=E5=9C=B0=20qrcode=20=E7=94=9F=E6=88=90=20QR=20?=
 =?UTF-8?q?=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/load_path.py       |  1 +
 wwwroot/qr.dspy            | 14 ++++++++++++++
 wwwroot/recharge.dspy      |  2 +-
 wwwroot/user_recharge.dspy |  2 +-
 4 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100644 wwwroot/qr.dspy

diff --git a/scripts/load_path.py b/scripts/load_path.py
index afb4c37..1a9afa7 100644
--- a/scripts/load_path.py
+++ b/scripts/load_path.py
@@ -50,6 +50,7 @@ PATHS_LOGINED = [
     f"/unipay/paychannel",
     f"/unipay/payfee",
     f"/unipay/payment_log",
+    f"/unipay/qr.dspy",
     f"/unipay/recharge.dspy",
     f"/unipay/recharge.ui",
     f"/unipay/refund.dspy",
diff --git a/wwwroot/qr.dspy b/wwwroot/qr.dspy
new file mode 100644
index 0000000..723a5b6
--- /dev/null
+++ b/wwwroot/qr.dspy
@@ -0,0 +1,14 @@
+import io, urllib.parse
+import qrcode
+from aiohttp import web
+
+data = params_kw.get('data', '')
+if not data:
+	return web.Response(status=400, text='missing data')
+
+data = urllib.parse.unquote(data)
+img = qrcode.make(data, box_size=10, border=2)
+buf = io.BytesIO()
+img.save(buf, format='PNG')
+buf.seek(0)
+return web.Response(body=buf.read(), content_type='image/png')
diff --git a/wwwroot/recharge.dspy b/wwwroot/recharge.dspy
index 2faa390..2855b0a 100644
--- a/wwwroot/recharge.dspy
+++ b/wwwroot/recharge.dspy
@@ -10,7 +10,7 @@ try:
 			"target":"app.sage_main_content",
 			"options":{"url": code_url}
 		}
-	qr_url = 'https://api.qrserver.com/v1/create-qr-code/?size=280x280&data=' + urllib.parse.quote(code_url, safe='')
+	qr_url = entire_url('/unipay/qr.dspy?data=') + urllib.parse.quote(code_url, safe='')
 	return {
 		"widgettype":"NewWindow",
 		"options":{
diff --git a/wwwroot/user_recharge.dspy b/wwwroot/user_recharge.dspy
index f763d1f..2c3400d 100644
--- a/wwwroot/user_recharge.dspy
+++ b/wwwroot/user_recharge.dspy
@@ -25,7 +25,7 @@ debug(f'user_recharge.dspy: {params_kw=}')
 
 try:
 	url = await create_payment(request, params_kw)
-	qr_url = 'https://api.qrserver.com/v1/create-qr-code/?size=280x280&data=' + urllib.parse.quote(url, safe='')
+	qr_url = entire_url('/unipay/qr.dspy?data=') + urllib.parse.quote(url, safe='')
 	return {
 		"status": "ok",
 		"data": {