Support OVH credentials scoped to a specific zone

When creating OVH API credentials, one can scope them to a specific subset of routes. Specifically, this allows to limit acme.sh to a specific zone as the zone is part of the URL. This is an important security/safety net feature.

diff --git a/dnsapi/dns_ovh.sh b/dnsapi/dns_ovh.sh
index 6c1edb4d59cd3d648a1b7f433202a3bf5e101d8a..eaa90bdfbcf1d677aed23c1d02f7e1d425f87b18 100755 (executable)
--- a/dnsapi/dns_ovh.sh
+++ b/dnsapi/dns_ovh.sh
@@ -238,7 +238,7 @@ _get_root() {
       return 1
     fi
 
-    if ! _contains "$response" "This service does not exist" >/dev/null; then
+    if ! _contains "$response" "This service does not exist" >/dev/null && ! _contains "$response" "NOT_GRANTED_CALL" >/dev/null; then
       _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
       _domain="$h"
       return 0