diff --git a/class/core/site_api.py b/class/core/site_api.py
index e374757ce..cc1749cde 100755
--- a/class/core/site_api.py
+++ b/class/core/site_api.py
@@ -154,6 +154,18 @@ class site_api:
         data['path'] = path
         return public.returnJson(True, 'OK', data)
 
+    def setDirUserIniApi(self):
+        path = request.form.get('path', '').encode('utf-8')
+        filename = path + '/.user.ini'
+        self.delUserInI(path)
+        if os.path.exists(filename):
+            public.execShell("which chattr && chattr -i " + filename)
+            os.remove(filename)
+            return public.returnJson(True, '已清除防跨站设置!')
+        public.writeFile(filename, 'open_basedir=' + path + '/:/tmp/:/proc/')
+        public.execShell("which chattr && chattr +i " + filename)
+        return public.returnJson(True, '已打开防跨站设置!')
+
     def getCertListApi(self):
         try:
             vpath = self.sslDir
@@ -1189,6 +1201,25 @@ location /{
         except:
             return None
 
+    # 清除多余user.ini
+    def delUserInI(self, path, up=0):
+        for p1 in os.listdir(path):
+            try:
+                npath = path + '/' + p1
+                if os.path.isdir(npath):
+                    if up < 100:
+                        self.delUserInI(npath, up + 1)
+                else:
+                    continue
+                useriniPath = npath + '/.user.ini'
+                if not os.path.exists(useriniPath):
+                    continue
+                public.execShell('which chattr && chattr -i ' + useriniPath)
+                public.execShell('rm -f ' + useriniPath)
+            except:
+                continue
+        return True
+
     # 转换时间
     def strfToTime(self, sdate):
         import time
diff --git a/route/static/app/site.js b/route/static/app/site.js
index a7f60782f..9b53b41b4 100755
--- a/route/static/app/site.js
+++ b/route/static/app/site.js
@@ -330,13 +330,13 @@ function webPathEdit(id){
 						+'<p><button class="btn btn-success btn-sm" onclick="SetPathSafe('+id+')">保存</button></p>'
 					+'</div>'
 				+'</div>';
-		$("#webedit-con").html(webPathHtml);
-		
+
+		$("#webedit-con").html(webPathHtml);		
 		$("#userini").change(function(){
-			$.post('/site?action=SetDirUserINI','path='+rdata,function(userini){
+			$.post('/site/set_dir_user_ini','path='+webpath,function(userini){
 				layer.msg(userini.msg+'<p style="color:red;">注意：设置防跨站需要重启PHP才能生效!</p>',{icon:userini.status?1:2});
-			});
-		},'json');
+			},'json');
+		});
 		
 		$("#logs").change(function(){
 			$.post('/site?action=logsOpen','id='+id,function(userini){