xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-09-04 01:17:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sub): apply the device limit to ?view=raw

Browse Source 
subJsons and subClashs served the raw body and returned before enforceHwid ran,
so appending ?view=raw to a JSON or Clash subscription URL handed out a complete,
client-consumable config however many devices were already registered. The branch
exists to stop a browser's Accept: text/html from being answered with the info
page, not to skip the gate.

Gate the raw branch and leave the other gate where it was, below
maybeServeSubPage, so the HTML info page stays ungated as before.
This commit is contained in:
Sanaei
2026-09-03 18:06:35 +02:00
parent f9de0226fe
commit f17e4684e0
2 changed files with 28 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/sub/controller.go
+8 -1
View File
@@ -705,9 +705,13 @@ func (a *SUBController) loadSubTemplate(themeDir string) (*template.Template, er
return tmpl, nil
}
// subJsons handles HTTP requests for JSON subscription configurations.
// subJsons handles HTTP requests for JSON subscription configurations. The
// device limit is enforced on every body route, ?view=raw included (#GHSA-7ww3).
func (a *SUBController) subJsons(c *gin.Context) {
if strings.EqualFold(c.Query("view"), "raw") {
if !a.enforceHwid(c) {
return
}
if !a.serveJsonBody(c, a.jsonAlwaysArray, "application/json; charset=utf-8", true) {
writeSubError(c, nil)
}
@@ -760,6 +764,9 @@ func (a *SUBController) serveJsonBody(c *gin.Context, alwaysReturnArray bool, co
func (a *SUBController) subClashs(c *gin.Context) {
if strings.EqualFold(c.Query("view"), "raw") {
if !a.enforceHwid(c) {
return
}
if !a.serveClashBody(c, true) {
writeSubError(c, nil)
}