3x-ui

mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-07-05 20:34:20 +00:00

Files

T

MHSanaei e40554a7d5 fix(inbound): require email when adding or updating a client

AddInboundClient and UpdateInboundClient previously accepted an
empty Email field for every protocol except shadowsocks (where
email doubles as the client ID). Empty emails break downstream
features that key off email — IP-limit logging, traffic stats,
client-online tracking, subscription remarks.

Reject empty/whitespace-only emails at the service layer so the
API surface (POST /panel/api/inbounds/addClient and
/updateClient/:id) returns a clear error instead of persisting
an unidentifiable client.

Also drop the stale `len(Email) > 0` guard in UpdateInboundClient
that became dead code once empty emails are rejected.

2026-05-13 13:45:31 +02:00

controller

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275 )

2026-05-13 12:52:52 +02:00

entity

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275 )

2026-05-13 12:52:52 +02:00

global

Refactor code and fix linter warnings (#3627 )

2026-01-05 05:54:56 +01:00

job

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275 )