MHSanaei 33b029e1ca fix(security): confine GetCertHash to known cert files (CWE-22) ...

Resolve CodeQL go/path-injection (alert #96): the certFile path from
the getCertHash endpoint flowed straight into os.ReadFile, letting an
authenticated request read arbitrary files by path. Validate it against
an allow-list of certificate files the panel already references (inbound
TLS certificateFile values plus the panel's own web cert) and read the
config-sourced path rather than the caller-supplied one, breaking the
taint flow while preserving arbitrary cert locations.

2026-06-21 17:56:17 +02:00

..

email

feat(memory): add memory threshold alerts (#5366)

2026-06-21 17:45:33 +02:00

integration

refactor(frontend): move form-item hints from extra to tooltip

2026-06-17 17:24:16 +02:00

outbound

fix(outbounds): test subscriptions in Test All, skip direct/dns

2026-06-13 11:48:02 +02:00

panel

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

tgbot

feat(memory): add memory threshold alerts (#5366)

2026-06-21 17:45:33 +02:00

api_scale_postgres_test.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

bulk_clients_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

bulk_traffic_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_apply_field_test.go

fix(client): apply per-field client edits to every inbound of the email (#5039)

2026-06-12 01:22:15 +02:00

client_bulk.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

client_crud.go

fix(client): clear group when removed in the single-client editor

2026-06-17 15:55:56 +02:00

client_email_validation_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_external_link.go

feat(sub): per-client external links and remote subscriptions

2026-06-14 20:57:14 +02:00

client_flow_isolation_test.go

fix: enable XTLS vision flow for VLESS+XHTTP+vlessenc in UI and share links (#5157) (#5185)

2026-06-11 12:04:02 +02:00

client_group_node_sync_test.go

fix(client): clear group when removed in the single-client editor

2026-06-17 15:55:56 +02:00

client_groups.go

feat(groups): show upload/download breakdown in group traffic

2026-06-12 15:30:41 +02:00

client_inbound_apply.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

client_link.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_locks.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_lookup.go

feat(node-sync): push global client usage to nodes for display and local enforcement

2026-06-11 15:14:08 +02:00

client_paging.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_sync_multiprotocol_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_traffic.go

fix(traffic): prevent phantom quota consumption from stale node data (#5412)

2026-06-20 00:36:35 +02:00

client.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

config.json

feat: apply inbound/outbound/routing changes live via Xray gRPC API

2026-06-10 23:01:33 +02:00

fallback.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

global_traffic_test.go

feat(node-sync): push global client usage to nodes for display and local enforcement

2026-06-11 15:14:08 +02:00

host_test.go

feat(hosts): managed Hosts for per-host subscription link overrides (#5409)

2026-06-17 12:06:55 +02:00

host.go

feat(hosts): managed Hosts for per-host subscription link overrides (#5409)

2026-06-17 12:06:55 +02:00

inbound_autorenew_test.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

inbound_client_ips_merge_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

inbound_client_ips.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

inbound_client_traffic_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

inbound_clients.go

fix(ui): classify ended clients as depleted, not disabled, on inbounds page

2026-06-11 14:05:02 +02:00

inbound_disable.go

feat(node-sync): push global client usage to nodes for display and local enforcement

2026-06-11 15:14:08 +02:00

inbound_import_shared_clients_test.go

fix(inbound): avoid UNIQUE email constraint when importing inbounds that share clients

2026-06-12 13:00:04 +02:00

inbound_migration_test.go

Test-quality audit: fix 2 prod bugs, strengthen weak tests, add mutation/fuzz/CI tooling (#5345)

2026-06-15 15:17:03 +02:00

inbound_migration.go

Test-quality audit: fix 2 prod bugs, strengthen weak tests, add mutation/fuzz/CI tooling (#5345)

2026-06-15 15:17:03 +02:00

inbound_mtproto_test.go

feat(mtproto): route Telegram egress through Xray routing rules

2026-06-12 17:58:45 +02:00

inbound_node_ips_test.go

feat(nodes): per-node client IP attribution for IP-limit

2026-06-15 23:50:05 +02:00

inbound_node_ips.go

feat(nodes): per-node client IP attribution for IP-limit

2026-06-15 23:50:05 +02:00

inbound_node_reconcile_test.go

feat(node): per node outbound routing (#5275)

2026-06-14 23:10:52 +02:00

inbound_node.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

inbound_protocol_test.go

fix: enable XTLS vision flow for VLESS+XHTTP+vlessenc in UI and share links (#5157) (#5185)

2026-06-11 12:04:02 +02:00

inbound_protocol.go

fix: enable XTLS vision flow for VLESS+XHTTP+vlessenc in UI and share links (#5157) (#5185)

2026-06-11 12:04:02 +02:00

inbound_sub_sort_test.go

feat(sub): per-inbound sort order for subscription links

2026-06-12 12:03:22 +02:00

inbound_sublink.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

inbound_traffic_global.go

feat(node-sync): push global client usage to nodes for display and local enforcement

2026-06-11 15:14:08 +02:00

inbound_traffic.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

inbound_update_tag_test.go

feat: add inbound share address strategy (#5162)

2026-06-11 20:24:15 +02:00

inbound_util.go

feat(sub): per-inbound sort order for subscription links

2026-06-12 12:03:22 +02:00

inbound.go

fix(inbound): persist streamSettings for tunnel so sockopt saves

2026-06-21 02:34:57 +02:00

metric_history.go

feat(metrics): extend history bucket options to include 12h, 24h, and 48h intervals (#5467)

2026-06-21 17:29:22 +02:00

node_bulk_dispatch_test.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

node_client_expiry_sync_test.go

fix(nodes): sync "start after first connect" expiry so un-activated nodes do not reset it (#5319)

2026-06-15 15:46:19 +02:00

node_client_traffic_sum_test.go

fix(traffic): prevent phantom quota consumption from stale node data (#5412)

2026-06-20 00:36:35 +02:00

node_delete_orphan_test.go

fix(nodes): block node delete while inbounds are still attached (#5394)

2026-06-20 01:09:53 +02:00

node_dirty_test.go

fix(node): mark node dirty on Update so sync reconciles before snapshot sweep (#5469)

2026-06-21 17:27:53 +02:00

node_mtls_test.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

node_mtls.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

node_netmetrics_test.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

node_origin_guid_test.go

feat: add inbound share address strategy (#5162)

2026-06-11 20:24:15 +02:00

node_tag_sync_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

node_test.go

feat: allow selecting inbounds synchronized from nodes (#5178)

2026-06-11 20:48:26 +02:00

node_tree_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

node_tree.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

node.go

fix(node): mark node dirty on Update so sync reconciles before snapshot sweep (#5469)

2026-06-21 17:27:53 +02:00

outbound_subscription_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

outbound_subscription.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

port_conflict_test.go

fix(inbounds): flag conflicts with the reserved Xray API port (#5304)

2026-06-15 17:21:06 +02:00

port_conflict.go

fix(inbounds): flag conflicts with the reserved Xray API port (#5304)

2026-06-15 17:21:06 +02:00

scale_helpers_test.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

server_vlessenc_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

server_xray_checksum_test.go

fix(xray): verify the release archive checksum before installing (#5396)

2026-06-20 00:37:35 +02:00

server.go

fix(security): confine GetCertHash to known cert files (CWE-22)

2026-06-21 17:56:17 +02:00

setting_mtls_test.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

setting_mtls.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

setting_security_test.go

feat(notifications): event bus architecture with Telegram and SMTP subscribers (#5326)

2026-06-15 21:03:41 +02:00

setting.go

feat(memory): add memory threshold alerts (#5366)

2026-06-21 17:45:33 +02:00

shadowsocks_client_key_test.go

fix(inbound): regenerate SS-2022 client PSKs on method key-size change

2026-06-17 14:11:35 +02:00

sub_uri_base_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

sync_scale_postgres_test.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

traffic_writer_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

traffic_writer.go

fix(service): serialize client/inbound writes to prevent Postgres deadlock

2026-06-17 15:55:47 +02:00

url_safety.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

xray_config_inject_test.go

feat(mtproto): route Telegram egress through Xray routing rules

2026-06-12 17:58:45 +02:00

xray_metrics.go

feat(notifications): event bus architecture with Telegram and SMTP subscribers (#5326)

2026-06-15 21:03:41 +02:00

xray_setting_routing_sync_test.go

fix(routing): sync xray rules when panel inbound tags change or are deleted (#5367)

2026-06-20 01:18:31 +02:00

xray_setting_routing_sync.go

fix(routing): sync xray rules when panel inbound tags change or are deleted (#5367)

2026-06-20 01:18:31 +02:00

xray_setting_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

xray_setting.go

refactor(frontend): move form-item hints from extra to tooltip

2026-06-17 17:24:16 +02:00

xray_strip_rules_test.go

Add Enable/Disable Toggle for Xray Routing Rules (#5296)

2026-06-15 00:43:49 +02:00

xray.go

Add Enable/Disable Toggle for Xray Routing Rules (#5296)

2026-06-15 00:43:49 +02:00