- Override Ant Design default selected row background in dark mode with theme color
- Restructure batch action toolbar with nested flex containers for better spacing and wrapping
- Bump version to v1.7.3.2
- Android: clash://install-config (Clash Meta for Android)
- iOS: shadowrocket://add/sub/ (Shadowrocket)
- Desktop: clash-verge://install-config (Clash Verge)
- Extended API to return subEnable/subUrl for standard subscription
- New API endpoint /panel/api/inbounds/userSubscriptions for non-admin users
- Redesigned /panel/user with Clash link card (copy button) and Quick Import dropdown (Android/iOS/Desktop with icons)
- Added i18n keys for en_US and zh_CN
- Bumped version to v1.7.2.5
- Add splitTemplate() to split at proxies:/proxy-groups: markers (like mihomo-gen)
- Store clash_template.yaml and servers.yaml as files alongside x-ui.json
- Add Clash/Servers editors in Xray advanced config page
- Support multi-server proxy generation (each server × each client)
- Remove inline template editor from Clash settings panel
- Bump version to v1.7.2.1
The middleware was changed to trust CF-Connecting-IP instead of
X-Real-IP/X-Forwarded-For, but the tests still used the old headers.
TestRateLimitMiddleware_DifferentIPsIndependent was failing because
all requests fell back to the same httptest RemoteAddr.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When behind Cloudflare CDN, RemoteAddr shows CF's IP, breaking rate
limiting and logging. Trust CF-Connecting-IP (set by CF, cannot be
spoofed by clients) and fall back to RemoteAddr for direct connections.
- Add RateLimitMiddleware(10/min) to POST /login (previously unprotected)
- Use RemoteAddr instead of X-Real-IP/X-Forwarded-For in getRemoteIp() and rate limiter
- Prevents brute-force login and rate-limit bypass via spoofed headers
Replace worker's plain HTML table with the same a-table used by master,
fixing inconsistencies: missing role column, no error ellipsis, dead-code
empty state ternary, and duplicate a-empty elements.
Self-closing custom elements (<a-empty />) are invalid in HTML5
in-DOM templates. The browser treats them as opening tags, causing
subsequent sibling elements to become children. This made the
worker's node info table a child of the hidden <a-empty>, so it
never rendered when nodes.length > 0.
- ShouldBindJSON → ShouldBind with form tags (axios sends url-encoded)
- dbType dropdown value "mysql" → "mariadb" to match backend
- Replace inline styles with theme-aware CSS classes for dark mode
v-else on <table> element was not recognized by Vue template compiler,
causing the worker node info table to never render. Use v-if="nodes.length > 0"
instead to ensure the table renders when data is available.
- Replace a-descriptions/a-descriptions-item with plain HTML table in
nodes.html — the components were missing from the antd.min.js bundle
due to tree-shaking, causing the worker node view to render empty
- Fix ensureDefaultNodeSettings to write defaults to both "node" and
"other" groups for backward compatibility (tests were failing)
Silent error swallowing made it impossible to diagnose why worker
couldn't see master's heartbeat. Now logs errors from:
- updateNodeState upsert failures
- writeStateToSharedMariaDB connection/write failures
- getNodeStatesShared query failures
- list endpoint shows state count in logs
Also improved First() call to not overwrite state on error.
Bump version to v1.6.5.
When master uses SQLite locally, updateNodeState only wrote to local DB.
Workers querying shared MariaDB never saw the master's heartbeat.
Now master also writes its heartbeat to the shared MariaDB via a
temporary connection when MariaDB connection settings are configured.
Bump version to v1.6.4.
Node settings (nodeRole, nodeId, syncInterval, trafficFlushInterval)
now have defaults in the settings system. On fresh install, they are
automatically created in x-ui.json under the 'node' group. The
settingGroupAliases now look in 'node' first, then 'other' for
backward compatibility.
In shared mode, the master may use SQLite locally while workers
write heartbeats to the shared MariaDB. The /list endpoint now
opens a temporary MariaDB connection to query node_states when
the local DB is not MariaDB.
- Add nodeController field and route group in api.go
- Add /panel/nodes page route in xui.go
- Verified node.go does not add duplicate checkAdmin middleware
Expose node management API endpoints for the cluster feature:
- GET /node/list — returns connected nodes with online status
- GET /node/config — returns current node + DB configuration
- POST /node/config — validates and persists node settings to x-ui.json
- Replace plain textarea with CodeMirror editor (YAML syntax highlighting, line numbers, auto-indent) for Clash subscription template
- Fix confAlerts crash when subClashURI/subURI/subJsonURI is null/undefined (prevented save button from enabling)
- Add yaml.js CodeMirror mode asset
- Include docs and .gitignore cleanup
