Hamed 19f2f21d81 fix(inbounds): reject incompatible VLESS fallbacks and prevent Xray crashes (#7003) ...

Xray refuses a VLESS inbound with server decryption whenever fallbacks is non-nil, even an empty list, so an API or imported inbound with decryption and fallbacks: [] took every inbound down. Empty fallback arrays are now normalized away on add, update, config build and node push; non-empty ones are refused with decryption, enabling decryption over stored fallback rules is refused, and a legacy conflicting row holds back the running core instead of stopping it. The form, API docs and locales follow. Closes #7001.

2026-11-03 15:52:30 +01:00

..

api_auth_test.go

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

api.go

fix(middleware): log rejected CSRF requests with the trusted client address (#6692)

2026-10-24 04:51:21 +02:00

base.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_happ_test.go

feat(happ): generate Crypt5 subscription links locally (#6494)

2026-09-13 12:44:55 +02:00

client_lookup_test.go

feat(api): add client lookup by subscription ID (#6908)

2026-10-24 04:54:14 +02:00

client_partial_apply_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

client_renewal_preview_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

client.go

feat(api): add client lookup by subscription ID (#6908)

2026-10-24 04:54:14 +02:00

csrf_log_test.go

fix(web): refuse oversized login usernames before recording them

2026-10-31 09:04:27 +00:00

dist_test.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

dist.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

geodata_test.go

feat(xray): browse geosite/geoip categories from routing rules (#6165)

2026-08-15 17:12:59 +02:00

group.go

fix(groups): report changed bulk moves without restarting xray (#6199)

2026-08-14 19:50:06 +02:00

host_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

host.go

feat(clients): bind host rules to individual clients in subscriptions (#6620)

2026-10-24 12:33:02 +02:00

import_db_restart_test.go

fix(web): restart panel after ImportDB so subPath routes match (#6446) (#6456)

2026-09-13 21:39:15 +02:00

inbound_node_sync_test.go

fix(api): cap the client traffic list a master pushes by entry count

2026-10-31 14:25:21 +01:00

inbound_vless_fallback_test.go

fix(inbounds): reject incompatible VLESS fallbacks and prevent Xray crashes (#7003)

2026-11-03 15:52:30 +01:00

inbound.go

fix(traffic): restore quota-disabled inbounds when their traffic is reset (#6962)

2026-11-02 15:50:25 +01:00

index.go

fix(web): refuse oversized login usernames before recording them

2026-10-31 09:04:27 +00:00

login_limiter_test.go

fix(web): count login attempts per address and while they are checked

2026-10-31 09:04:23 +00:00

login_limiter.go

fix(web): count login attempts per address and while they are checked

2026-10-31 09:04:23 +00:00

node_credentials_writeonly_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

node.go

fix(nodes): apply a rotated master mTLS certificate without restarting the panel (#6194)

2026-08-15 16:03:42 +02:00

panel_update_test.go

fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)

2026-07-02 18:19:33 +02:00

pwa_test.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

pwa.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

server.go

fix(server): apply the outbound address policy to remote cert pinning

2026-10-03 13:20:00 +02:00

setting_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

setting.go

feat(tgbot): rebuild the Telegram bot around editable screens and inline lists (#6760)

2026-10-24 12:39:56 +02:00

spa_test.go

fix(web): serve panel SPA routes from NoRoute (#5536)

2026-06-24 21:19:12 +02:00

spa.go

fix(middleware): log rejected CSRF requests with the trusted client address (#6692)

2026-10-24 04:51:21 +02:00

sub_balancer_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

sub_balancer.go

feat(sub): leastLoad member weights for subscription balancers (#6304)

2026-09-02 20:21:27 +02:00

util_test.go

fix(web): read the client address from the proxy end of forwarded headers

2026-10-24 01:39:23 +02:00

util.go

fix(web): read the client address from the proxy end of forwarded headers

2026-10-24 01:39:23 +02:00

websocket_test.go

fix(web): match the WebSocket origin on scheme and port, not only host

2026-10-31 09:06:41 +00:00

websocket.go

fix(web): match the WebSocket origin on scheme and port, not only host

2026-10-31 09:06:41 +00:00

xray_setting_warp_test.go

fix(outbound): store subscription refreshes without trusting the row read

2026-10-31 08:31:03 +00:00

xray_setting.go

fix(outbound): store subscription refreshes without trusting the row read

2026-10-31 08:31:03 +00:00