From 44c045b0569b2ec3a7b3b65451a88eaba5f05394 Mon Sep 17 00:00:00 2001
From: neil <gitsrc@neilpang.com>
Date: Sun, 12 Jul 2026 11:36:45 +0800
Subject: [PATCH] notify: add the customscript hook

The wiki has documented "21. Set notification for customscript" since
2022 but the implementation (#4193) was never merged, so following the
wiki failed with "Cannot find the hook file". Same interface as
documented: the script gets subject, content and status code as three
arguments. Unlike #4193, the target script is invoked directly instead
of through eval -- the subject/content contain domain names and CA
messages, and eval would allow command injection through them.

https://github.com/acmesh-official/acme.sh/issues/6377
---
 notify/customscript.sh | 44 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 notify/customscript.sh

diff --git a/notify/customscript.sh b/notify/customscript.sh
new file mode 100644
index 00000000..ba8b07cb
--- /dev/null
+++ b/notify/customscript.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env sh
+
+# Support calling a custom script for notifications
+#
+# export CUSTOMSCRIPT_PATH="/usr/local/bin/acme-notification.sh"
+#
+# The script is called with three arguments:
+#   $1  subject
+#   $2  content
+#   $3  status code (0: success, 1: error, 2: skipped)
+
+customscript_send() {
+  _subject="$1"
+  _content="$2"
+  _statusCode="$3" #0: success, 1: error 2($RENEW_SKIP): skipped
+  _debug "_subject" "$_subject"
+  _debug "_content" "$_content"
+  _debug "_statusCode" "$_statusCode"
+
+  CUSTOMSCRIPT_PATH="${CUSTOMSCRIPT_PATH:-$(_readaccountconf_mutable CUSTOMSCRIPT_PATH)}"
+  if [ -z "$CUSTOMSCRIPT_PATH" ]; then
+    _err "You didn't specify the custom script path CUSTOMSCRIPT_PATH yet."
+    return 1
+  fi
+  if ! _exists "$CUSTOMSCRIPT_PATH"; then
+    _err "The custom script $CUSTOMSCRIPT_PATH does not exist or is not executable."
+    return 1
+  fi
+  _saveaccountconf_mutable CUSTOMSCRIPT_PATH "$CUSTOMSCRIPT_PATH"
+
+  # Invoke directly, never through eval: the subject and content contain
+  # domain names and CA messages, eval would allow command injection.
+  _customscript_result="$("$CUSTOMSCRIPT_PATH" "$_subject" "$_content" "$_statusCode" 2>&1)"
+  _customscript_rc="$?"
+  _debug2 "_customscript_result" "$_customscript_result"
+
+  if [ "$_customscript_rc" != "0" ]; then
+    _err "custom script execution error ($_customscript_rc): $_customscript_result"
+    return 1
+  fi
+
+  _info "custom script executed successfully."
+  return 0
+}