MHSanaei 80e168787e fix(xray): confine log.access/error to the panel log folder ...

An authenticated admin could set xrayTemplateConfig.log.access/error to an
arbitrary path (via the raw Xray editor or a wholesale DB import), making the
supervised Xray process write its log there — an arbitrary file write as the
Xray user (root in many deployments). resolveXrayLogPaths now reduces any log
path to its base filename under config.GetLogFolder(), so absolute paths and
".." traversal can no longer escape the log folder; "" and "none" still
disable logging.

2026-06-12 14:25:06 +02:00

..

config

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

database

feat(sub): per-inbound sort order for subscription links

2026-06-12 12:03:22 +02:00

logger

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

mtproto

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

sub

feat(sub): per-inbound sort order for subscription links

2026-06-12 12:03:22 +02:00

util

fix(xhttp): stop injecting scMaxEachPostBytes/scMinPostsIntervalMs defaults (#5141)

2026-06-12 01:50:37 +02:00

web

fix(xray): confine log.access/error to the panel log folder

2026-06-12 14:25:06 +02:00

xray

feat(online): use xray online-stats API for onlines and access-log-free IP limit

2026-06-11 19:42:03 +02:00