From 4c8a143086549d77d21fcec4fce0bb7d97b60821 Mon Sep 17 00:00:00 2001
From: neil <gitsrc@neilpang.com>
Date: Mon, 20 Jul 2026 10:02:54 +0800
Subject: [PATCH] fix proxmoxve/proxmoxbs deploy: fail on non-2xx API response

The success check only grepped "message" from the response body, but
PVE/PBS auth failures return HTTP 401 with an empty body, so wrong or
unauthorized API tokens were reported as "Certificate successfully
deployed". Also _retval captured the exit code of the message pipeline
instead of _post. Check the HTTP status line from $HTTP_HEADER and
capture _post's exit code directly.

fix https://github.com/acmesh-official/acme.sh/issues/7141
---
 deploy/proxmoxbs.sh | 27 +++++++++++++++++----------
 deploy/proxmoxve.sh | 27 +++++++++++++++++----------
 2 files changed, 34 insertions(+), 20 deletions(-)

diff --git a/deploy/proxmoxbs.sh b/deploy/proxmoxbs.sh
index 179b0369..30599a44 100644
--- a/deploy/proxmoxbs.sh
+++ b/deploy/proxmoxbs.sh
@@ -116,17 +116,24 @@ HEREDOC
   export HTTPS_INSECURE=1
   export _H1="Authorization: PBSAPIToken=${_proxmoxbs_header_api_token}"
   response=$(_post "$_json_payload" "$_target_url" "" POST "application/json")
+  _retval=$?
+  # The API errors out with a non-2xx HTTP status and an empty body,
+  # so the status line is checked too, not only the response body.
+  _status_code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
+  _debug2 "HTTP status" "$_status_code"
   response="$(echo "$response" | _json_decode | _normalizeJson)"
   message=$(echo "$response" | _egrep_o '"message":"[^"]*' | cut -d : -f 2 | tr -d '"')
-  _retval=$?
-  if [ "${_retval}" -eq 0 ] && [ -z "$message" ]; then
-    _debug3 response "$response"
-    _info "Certificate successfully deployed"
-    return 0
-  else
-    _err "Certificate deployment failed: $message"
-    _debug "Response" "$response"
-    return 1
-  fi
+  case "$_status_code" in
+  2[0-9][0-9])
+    if [ "${_retval}" -eq 0 ] && [ -z "$message" ]; then
+      _debug3 response "$response"
+      _info "Certificate successfully deployed"
+      return 0
+    fi
+    ;;
+  esac
+  _err "Certificate deployment failed (HTTP status $_status_code). $message"
+  _debug "Response" "$response"
+  return 1
 
 }
diff --git a/deploy/proxmoxve.sh b/deploy/proxmoxve.sh
index b6298ee7..fd8d69d8 100644
--- a/deploy/proxmoxve.sh
+++ b/deploy/proxmoxve.sh
@@ -128,17 +128,24 @@ HEREDOC
   export HTTPS_INSECURE=1
   export _H1="Authorization: PVEAPIToken=${_proxmoxve_header_api_token}"
   response=$(_post "$_json_payload" "$_target_url" "" POST "application/json")
+  _retval=$?
+  # The API errors out with a non-2xx HTTP status and an empty body,
+  # so the status line is checked too, not only the response body.
+  _status_code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
+  _debug2 "HTTP status" "$_status_code"
   response="$(echo "$response" | _json_decode | _normalizeJson)"
   message=$(echo "$response" | _egrep_o '"message":"[^"]*' | cut -d : -f 2 | tr -d '"')
-  _retval=$?
-  if [ "${_retval}" -eq 0 ] && [ -z "$message" ]; then
-    _debug3 response "$response"
-    _info "Certificate successfully deployed"
-    return 0
-  else
-    _err "Certificate deployment failed: $message"
-    _debug "Response" "$response"
-    return 1
-  fi
+  case "$_status_code" in
+  2[0-9][0-9])
+    if [ "${_retval}" -eq 0 ] && [ -z "$message" ]; then
+      _debug3 response "$response"
+      _info "Certificate successfully deployed"
+      return 0
+    fi
+    ;;
+  esac
+  _err "Certificate deployment failed (HTTP status $_status_code). $message"
+  _debug "Response" "$response"
+  return 1
 
 }