Fix verification for namecheap domains not *owned* by the calling user

[EverPresent]

The NameCheap DNS plugin is using NameCheap's domains.getList api call to try and verify that the user has access to the requested domain. That works great as long as the user is the primary owner of the domain. If the user is just a user who has been granted administrative DNS rights to the domain, then the domains.getList api will not include that domain in the response. See http://disq.us/p/1q6v9x9 for NameCheap's official comment (short story, getList only returns domains the user owns, not ones they've been granted admin rights for).

I changed the code so that it will first attempt to verify that the user has permissions to the domain by calling the original domains.getList api endpoint. If that verification fails, then it falls back to calling the domains.dns.getHosts api endpoint directly.

[EverPresent]

I added this small guard branch because $h was being set to the TLD, which obviously can not be the only part of the domain name. However, since my domain was not being returned in the response from the getList api call, the if statement a few lines down was finding that $response does contain the string "com" (unsurprisingly). It was then setting the _sub_domain and _domain variables both to "com" (obviously wrong) and returning success.

With my update, this method will correctly return false for domains which are not returned in $response. The _get_root method will then fall back to trying another method of verifying that this user has access to the requested domain.

[Neilpang]

Good.

Would you like to create an issue for namecheap dns api? so that users can report bugs to it.

https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide#10-please-create-a-new-issue-for-future-bugs

Thanks.

[EverPresent]

Sure. I just created the issue at #2107