MHSanaei 68a981c0c3 fix(server): guard access-log parser against malformed lines ...

GetXrayLogs split each Xray access-log line on whitespace and then read
fixed offsets — parts[1] for the timestamp and parts[i+1] after the "from",
"accepted" and "email:" markers — without checking the line had that many
fields. A truncated or malformed line (the logged destination is
attacker-influenced) indexed past the slice and panicked; the panel handler
returned a 500 via Gin's recovery.

Extract the per-line field parsing into parseAccessLogFields and length
guard every positional lookup so a short line yields a partial entry
instead of panicking.

2026-07-15 04:44:53 +02:00

..

email

fix(email): bound every SMTP step with a connection deadline

2026-07-15 04:41:22 +02:00

integration

fix(integration): cap WARP API response body size

2026-07-15 04:36:30 +02:00

outbound

feat: Add outbound egress metadata (IP + country) (#5886)

2026-07-12 15:09:52 +02:00

panel

fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)

2026-07-02 18:19:33 +02:00

tgbot

fix(tgbot): require admin for privileged callbacks, not just the first switch

2026-07-15 04:27:38 +02:00

access_log_parse_test.go

fix(server): guard access-log parser against malformed lines

2026-07-15 04:44:53 +02:00

api_scale_postgres_test.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

backup_filename_test.go

feat(backup): prefix backup filenames with date and time (#5606)

2026-06-27 12:08:20 +02:00

bulk_clients_test.go

fix(node): stop client edits from tearing down node inbounds and harden reconcile fingerprints

2026-07-05 02:06:58 +02:00

bulk_traffic_test.go

fix(client): delete external-link rows when bulk-deleting clients

2026-07-15 00:09:41 +02:00

client_add_dedupe_test.go

fix(client): stop duplicate client entries accumulating in inbound settings

2026-07-05 21:17:25 +02:00

client_apply_field_test.go

fix(client): apply enable-by-email to every inbound a client is attached to

2026-07-15 01:46:03 +02:00

client_bulk_flow_test.go

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

client_bulk_reenable_test.go

fix(client): persist a bulk adjustment's applied field even when the sibling field is skipped

2026-07-14 23:39:51 +02:00

client_bulk_reset_reenable_test.go

fix(clients): surface bulk-reset auto-enable failures (#5763)

2026-07-08 20:53:42 +02:00

client_bulk.go

fix(client): delete external-link rows when bulk-deleting clients

2026-07-15 00:09:41 +02:00

client_create_reuse_test.go

fix(clients): reuse stored credentials when re-adding an existing identity

2026-07-11 22:48:51 +02:00

client_crud.go

fix(client): honor keepTraffic when deleting a client that is attached to inbounds

2026-07-14 23:54:48 +02:00

client_delete_continue_test.go

fix(clients): finish deleting from every inbound when one fails

2026-07-11 22:48:57 +02:00

client_delete_node_baseline_test.go

fix(client): clean node_client_traffics rows when deleting a client

2026-07-07 15:05:22 +02:00

client_delete_node_full_test.go

fix(node): fully delete clients on nodes instead of only detaching them

2026-07-05 20:28:26 +02:00

client_effective_flow_test.go

fix(flow): restore XTLS Vision when an inbound becomes flow-eligible (#5520)

2026-06-24 13:02:42 +02:00

client_email_validation_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_external_link.go

feat(sub): per-client external links and remote subscriptions

2026-06-14 20:57:14 +02:00

client_flow_isolation_test.go

fix: enable XTLS vision flow for VLESS+XHTTP+vlessenc in UI and share links (#5157) (#5185)

2026-06-11 12:04:02 +02:00

client_group_node_sync_test.go

fix(client): clear group when removed in the single-client editor

2026-06-17 15:55:56 +02:00

client_group_reset_test.go

fix(groups): keep group traffic totals stable across client resets and deletes

2026-07-02 09:17:47 +02:00

client_groups.go

refactor: use the built-in max/min to simplify the code (#5751)

2026-07-05 01:58:18 +03:00

client_inbound_apply.go

fix(client): apply enable-by-email to every inbound a client is attached to

2026-07-15 01:46:03 +02:00

client_link.go

feat(mtproto): per-client ad-tags, management-API auth, and record secret sync

2026-07-07 12:00:43 +02:00

client_locks_test.go

fix(client): stop holding the inbound-lock registry mutex while waiting on one inbound

2026-07-14 23:50:34 +02:00

client_locks.go

fix(client): stop holding the inbound-lock registry mutex while waiting on one inbound

2026-07-14 23:50:34 +02:00

client_lookup.go

fix(flow): restore XTLS Vision when an inbound becomes flow-eligible (#5520)

2026-06-24 13:02:42 +02:00

client_paging.go

fix(clients): include Telegram ID in client list search (#5888)

2026-07-10 12:20:35 +02:00

client_portable.go

fix(groups): keep group traffic totals stable across client resets and deletes

2026-07-02 09:17:47 +02:00

client_sync_mtproto_test.go

feat(mtproto): per-client ad-tags, management-API auth, and record secret sync

2026-07-07 12:00:43 +02:00

client_sync_multiprotocol_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_traffic.go

fix(traffic): re-enable clients and serialize the write in Reset All Client Traffic

2026-07-15 02:08:06 +02:00

client_update_enable_test.go

fix(clients): re-enable depleted clients on API renewal (#5619)

2026-06-29 13:39:03 +02:00

client_update_rename_test.go

fix(clients): rename client record atomically with inbound settings

2026-07-11 22:48:54 +02:00

client_wireguard_crud_test.go

fix(node): fully delete clients on nodes instead of only detaching them

2026-07-05 20:28:26 +02:00

client_wireguard_test.go

feat(wireguard): make client allowedIPs editable with validation

2026-07-02 09:45:54 +02:00

client_wireguard.go

feat(wireguard): make client allowedIPs editable with validation

2026-07-02 09:45:54 +02:00

client.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

config.json

feat: apply inbound/outbound/routing changes live via Xray gRPC API

2026-06-10 23:01:33 +02:00

del_shared_email_runtime_test.go

fix(node): fully delete clients on nodes instead of only detaching them

2026-07-05 20:28:26 +02:00

fallback.go

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

global_traffic_test.go

fix(node): stop force-restarting a node's Xray when its clients auto-disable

2026-07-02 13:27:36 +02:00

host_test.go

feat(hosts): bulk-add multiple hosts to multiple inbounds (#5677)

2026-07-08 23:35:20 +02:00

host.go

fix(node): adopt a node inbound's host overrides into the master

2026-07-11 23:17:57 +02:00

inbound_autorenew_test.go

perf(scale): speed up traffic, auto-renew, and node bulk ops at 50k-100k clients

2026-06-20 10:35:46 +02:00

inbound_client_ips_merge_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

inbound_client_ips.go

fix(node): stop Postgres deadlocks and deleted-client resurrection in node sync

2026-07-02 13:37:06 +02:00

inbound_client_traffic_test.go

fix(traffic): persist delayed-start expiry only for converted clients

2026-07-02 16:24:18 +02:00

inbound_clients.go

feat(mtproto): adopt dolonet/mtg-multi and make MTProto inbounds multi-client

2026-07-06 16:04:32 +02:00

inbound_disable.go

fix(traffic): disable depleted clients by id instead of a second full scan

2026-07-02 16:24:18 +02:00

inbound_durable_postgres_test.go

fix(inbounds): apply runtime changes after the DB commit (#5768)

2026-07-08 22:12:28 +02:00

inbound_finalmask_reality_test.go

fix(inbound): accept WireGuard clients when creating an inbound

2026-07-14 23:47:43 +02:00

inbound_flow_restore_test.go

fix(flow): restore XTLS Vision when an inbound becomes flow-eligible (#5520)

2026-06-24 13:02:42 +02:00

inbound_flow_restore.go

fix(flow): restore XTLS Vision when an inbound becomes flow-eligible (#5520)

2026-06-24 13:02:42 +02:00

inbound_import_external_proxy_test.go

fix(inbound): convert legacy externalProxy to hosts on import

2026-06-27 13:50:06 +02:00

inbound_import_shared_clients_test.go

fix(inbound): avoid UNIQUE email constraint when importing inbounds that share clients

2026-06-12 13:00:04 +02:00

inbound_migration_test.go

Test-quality audit: fix 2 prod bugs, strengthen weak tests, add mutation/fuzz/CI tooling (#5345)

2026-06-15 15:17:03 +02:00

inbound_migration.go

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

inbound_mtproto_apply_test.go

fix(mtproto): stop dropping connections on client/inbound edits; add live updates + ad-tag (#5838)

2026-07-07 01:13:24 +02:00

inbound_mtproto_client_test.go

fix(mtproto): stop dropping connections on client/inbound edits; add live updates + ad-tag (#5838)

2026-07-07 01:13:24 +02:00

inbound_mtproto_desired_test.go

fix(mtproto): stop dropping connections on client/inbound edits; add live updates + ad-tag (#5838)

2026-07-07 01:13:24 +02:00

inbound_mtproto_test.go

fix(mtproto): stop persisting a vestigial inbound-level secret

2026-07-06 17:55:57 +02:00

inbound_mtproto_txfail_test.go

fix(inbound): request an xray restart when toggling a routed MTProto inbound

2026-07-15 00:14:00 +02:00

inbound_mtproto.go

feat(mtproto): enforce per-client quota & expiry via mtg-multi limits

2026-07-08 15:30:56 +02:00

inbound_node_ips_test.go

fix(nodes): cloned-node attribution, node-hosted client display (online/speed/counts), and sync robustness (#5488)

2026-06-22 20:20:55 +02:00

inbound_node_ips.go

fix(node): stop Postgres deadlocks and deleted-client resurrection in node sync

2026-07-02 13:37:06 +02:00

inbound_node_reconcile_test.go

fix(node): never sweep a node's inbounds before their first adoption

2026-07-11 22:48:57 +02:00

inbound_node.go

fix(node): adopt a node inbound's host overrides into the master

2026-07-11 23:17:57 +02:00

inbound_options_node_address_test.go

fix(panel): use the hosting node address for WireGuard client configs (#5679)

2026-07-03 01:12:32 +02:00

inbound_protocol_test.go

fix: enable XTLS vision flow for VLESS+XHTTP+vlessenc in UI and share links (#5157) (#5185)

2026-06-11 12:04:02 +02:00

inbound_protocol.go

fix: enable XTLS vision flow for VLESS+XHTTP+vlessenc in UI and share links (#5157) (#5185)

2026-06-11 12:04:02 +02:00

inbound_settings_clients_test.go

fix(clients): parse only settings.clients across protocols (#5855)

2026-07-08 20:31:00 +02:00

inbound_settings_clients.go

fix(clients): parse only settings.clients across protocols (#5855)

2026-07-08 20:31:00 +02:00

inbound_sub_sort_test.go

feat(sub): per-inbound sort order for subscription links

2026-06-12 12:03:22 +02:00

inbound_sublink.go

feat(inbounds): apply remark template to Export all inbound links

2026-06-27 11:22:45 +02:00

inbound_tgbot_lookup_test.go

fix(tgbot): find clients by tgId regardless of settings JSON formatting

2026-07-05 20:18:59 +02:00

inbound_traffic_global.go

feat(node-sync): push global client usage to nodes for display and local enforcement

2026-06-11 15:14:08 +02:00

inbound_traffic.go

fix(traffic): keep node reset propagation out of the serial traffic writer

2026-07-15 02:13:23 +02:00

inbound_update_tag_test.go

fix(inbound): scope port-conflict check to the stored node on update (#5833)

2026-07-09 01:18:30 +02:00

inbound_util.go

feat(sub): per-inbound sort order for subscription links

2026-06-12 12:03:22 +02:00

inbound.go

fix(inbound): request an xray restart when toggling a routed MTProto inbound

2026-07-15 00:14:00 +02:00

metric_history_test.go

chore: bump deps and modernize test loops

2026-06-26 00:10:30 +02:00

metric_history.go

perf(metrics): tiered rollup history (7d at ~1.5MB) and cleaner ranges

2026-06-25 23:30:13 +02:00

mtproto_fake_test.go

fix(mtproto): stop dropping connections on client/inbound edits; add live updates + ad-tag (#5838)

2026-07-07 01:13:24 +02:00

node_bulk_dispatch_test.go

fix(inbounds): apply runtime changes after the DB commit (#5768)

2026-07-08 22:12:28 +02:00

node_client_breakdown_test.go

fix(inbounds): apply runtime changes after the DB commit (#5768)

2026-07-08 22:12:28 +02:00

node_client_expiry_sync_test.go

fix(node): show the activated first-use deadline on the Clients page

2026-07-02 09:36:07 +02:00

node_client_renew_sync_test.go

fix(node): start a fresh quota window when a node auto-renews a client

2026-07-07 15:05:23 +02:00

node_client_traffic_sum_test.go

fix(node): stop Postgres deadlocks and deleted-client resurrection in node sync

2026-07-02 13:37:06 +02:00

node_delete_orphan_test.go

fix(nodes): block node delete while inbounds are still attached (#5394)

2026-06-20 01:09:53 +02:00

node_dirty_test.go

fix(node): fully delete clients on nodes instead of only detaching them

2026-07-05 20:28:26 +02:00

node_host_adopt_test.go

fix(node): adopt a node inbound's host overrides into the master

2026-07-11 23:17:57 +02:00

node_mtls_test.go

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

node_mtls.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

node_netmetrics_test.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

node_origin_guid_test.go

fix(nodes): cloned-node attribution, node-hosted client display (online/speed/counts), and sync robustness (#5488)

2026-06-22 20:20:55 +02:00

node_shared_guid_test.go

fix(nodes): cloned-node attribution, node-hosted client display (online/speed/counts), and sync robustness (#5488)

2026-06-22 20:20:55 +02:00

node_tag_sync_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

node_test.go

fix(node): match prefixed central tags when filtering a selected-mode node snapshot

2026-07-14 23:32:03 +02:00

node_tree_test.go

fix(inbounds): apply runtime changes after the DB commit (#5768)

2026-07-08 22:12:28 +02:00

node_tree.go

fix(nodes): cloned-node attribution, node-hosted client display (online/speed/counts), and sync robustness (#5488)

2026-06-22 20:20:55 +02:00

node.go

fix(node): match prefixed central tags when filtering a selected-mode node snapshot

2026-07-14 23:32:03 +02:00

outbound_subscription_ssrf_test.go

fix(security): dial outbound subscriptions through the SSRF guard

2026-07-15 04:07:04 +02:00

outbound_subscription_test.go

fix(subscription): bound outbound response body (#5493)

2026-06-23 10:48:01 +02:00

outbound_subscription.go

fix(security): dial outbound subscriptions through the SSRF guard

2026-07-15 04:07:04 +02:00

port_conflict_test.go

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

port_conflict.go

fix(inbounds): flag conflicts with the reserved Xray API port (#5304)

2026-06-15 17:21:06 +02:00

reality_scan_test.go

feat(reality): add live REALITY target scanner with IP/CIDR discovery

2026-06-26 22:18:47 +02:00

reality_scan.go

refactor: modernize Go with strings.SplitSeq and maps.Copy

2026-07-08 22:10:54 +02:00

reset_writer_test.go

fix(traffic): keep node reset propagation out of the serial traffic writer

2026-07-15 02:13:23 +02:00

scale_helpers_test.go

refactor: modernize Go with strings.SplitSeq and maps.Copy

2026-07-08 22:10:54 +02:00

server_import_sniff_test.go

feat(server): sniff sqlite panel restore uploads and keep the fallback on failure

2026-07-12 20:14:22 +02:00

server_import_stage_test.go

feat(server): sniff sqlite panel restore uploads and keep the fallback on failure

2026-07-12 20:14:22 +02:00

server_pg_restore_test.go

feat(db): add pgclient command to install or upgrade PostgreSQL client tools

2026-07-06 09:24:18 +02:00

server_vlessenc_test.go

feat(web): vless encryption new modes (#5517)

2026-06-24 21:22:42 +02:00

server_xray_checksum_test.go

fix(xray): verify the release archive checksum before installing (#5396)

2026-06-20 00:37:35 +02:00

server.go

fix(server): guard access-log parser against malformed lines

2026-07-15 04:44:53 +02:00

setting_clash_test.go

feat(sub): auto-detect subscription format by User-Agent (Updated) (#5826)

2026-07-14 13:01:40 +02:00

setting_mtls_test.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

setting_mtls.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

setting_security_test.go

feat(settings): let users clear stored secrets from the UI

2026-07-02 13:57:34 +02:00

setting.go

feat(sub): auto-detect subscription format by User-Agent (Updated) (#5826)

2026-07-14 13:01:40 +02:00

shadowsocks_client_key_test.go

fix(inbound): regenerate SS-2022 client PSKs on method key-size change

2026-06-17 14:11:35 +02:00

stream_network_alias_test.go

feat(xray): update xray-core to v26.7.11 and adapt panel

2026-07-12 00:30:47 +02:00

sub_uri_base_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

sync_scale_postgres_test.go

fix(node): fully delete clients on nodes instead of only detaching them

2026-07-05 20:28:26 +02:00

traffic_commit_test.go

fix(traffic): re-enable clients and serialize the write in Reset All Client Traffic

2026-07-15 02:08:06 +02:00

traffic_poll_scale_test.go

test(scale): cover traffic poll, ws payloads, ip-limit job, sub and xray config at 500k

2026-07-02 16:12:46 +02:00

traffic_writer_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

traffic_writer.go

fix(service): serialize client/inbound writes to prevent Postgres deadlock

2026-06-17 15:55:47 +02:00

url_safety.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

ws_payload_scale_test.go

test(scale): cover traffic poll, ws payloads, ip-limit job, sub and xray config at 500k

2026-07-02 16:12:46 +02:00

xray_config_inject_test.go

fix(mtproto): stop dropping connections on client/inbound edits; add live updates + ad-tag (#5838)

2026-07-07 01:13:24 +02:00

xray_config_scale_test.go

test(scale): cover traffic poll, ws payloads, ip-limit job, sub and xray config at 500k

2026-07-02 16:12:46 +02:00

xray_metrics.go

feat(notifications): event bus architecture with Telegram and SMTP subscribers (#5326)

2026-06-15 21:03:41 +02:00

xray_restart_test.go

fix(xray): retry a failed pending-restart instead of dropping the config change

2026-07-15 03:27:40 +02:00

xray_setting_dns_routing_test.go

fix(routing): allow dns.servers on private IPs past the geoip:private block rule (#5774)

2026-07-08 20:28:11 +02:00

xray_setting_dns_routing.go

fix(routing): allow dns.servers on private IPs past the geoip:private block rule (#5774)

2026-07-08 20:28:11 +02:00

xray_setting_routing_sync_test.go

fix(xray): keep source- and domains-scoped routing rules when an inbound is deleted

2026-07-15 03:17:33 +02:00

xray_setting_routing_sync.go

fix(xray): keep source- and domains-scoped routing rules when an inbound is deleted

2026-07-15 03:17:33 +02:00

xray_setting_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

xray_setting.go

feat(xray): update xray-core to v26.7.11 and adapt panel

2026-07-12 00:30:47 +02:00

xray_strip_rules_test.go

Add Enable/Disable Toggle for Xray Routing Rules (#5296)

2026-06-15 00:43:49 +02:00

xray_wireguard_config_test.go

feat(wireguard): multi-client support

2026-06-28 00:44:38 +02:00

xray_xhttp_session_test.go

feat(xhttp): support sessionID* rename + sessionIDTable/Length (xray v26.6.22) (#5506)

2026-06-23 17:38:16 +02:00

xray.go

fix(xray): retry a failed pending-restart instead of dropping the config change

2026-07-15 03:27:40 +02:00