Sanaei f9de0226fe fix(xray): confine log paths written under any key case ...

resolveXrayLogPaths looked the log object up by the exact keys "access" and
"error", but xray-core decodes that object with encoding/json, which falls back
to a case-insensitive field match. "Access": "/tmp/pwn.log" therefore reached
AccessLog untouched and Xray — root, in a standard install — created the file
there, reopening the arbitrary write that GHSA-jm48-m3rr-9hgg closed.

Fold every case variant onto the canonical key before confining it. When both a
canonical key and a variant are present the canonical value wins, so a
"none" cannot be overridden by a smuggled "Access" path.

2026-09-03 18:06:15 +02:00

..

controller

fix: do not type successfull login twice (#6374)

2026-09-03 17:00:25 +02:00

entity

feat(sub): client-side balancers for the JSON subscription (#6243)

2026-08-23 22:34:20 +02:00

global

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

job

fix(job): expire stored client IPs of offline clients

2026-08-24 13:27:40 +02:00

locale

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

middleware

fix(web): tighten database restore body-cap exemption (#5609)

2026-06-28 15:00:55 +02:00

network

style: format struct literals and whitespace

2026-08-24 00:06:01 +02:00

runtime

feat(amneziawg): add native AmneziaWG protocol support (#6105)

2026-08-24 02:41:15 +02:00

service

fix(xray): confine log paths written under any key case

2026-09-03 18:06:15 +02:00

session

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

translation

feat(sub): leastLoad member weights for subscription balancers (#6304)

2026-09-02 20:21:27 +02:00

websocket

fix(nodes): keep the credential-presence flag on the node heartbeat push

2026-07-28 17:38:46 +02:00

cadence_test.go

Add remote routing URL support (#6168)

2026-08-18 16:02:11 +02:00

routes_contract_test.go

fix(api): authenticate GET /panel/api/openapi.json + pin the route registry to the router (#6133)

2026-07-29 08:00:05 +02:00

web_mtls_test.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

web_mtls.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

web.go

feat(amneziawg): add native AmneziaWG protocol support (#6105)

2026-08-24 02:41:15 +02:00