2156 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
lolka1333	a70fa84d95	Merge bc8394681d into 169b216d7e	2026-04-07 15:58:56 +03:00
test999	bc8394681d	Fix: inbounds switch	2026-04-07 15:58:50 +03:00
test999	93436bccba	fix(websocket): resolve channel race condition and graceful shutdown deadlock	2026-04-07 04:52:28 +03:00
test999	7e6e66ebfc	gofmt	2026-04-06 17:13:53 +03:00
test999	1c35a5eeba	Fix	2026-04-06 17:02:59 +03:00
test999	64f790932a	This commit fixes structural payload issues preventing XHTTP from functioning correctly and eliminates WebSocket log spam. ... - **[Fix X-Padding UI]** Added missing `cookie` and `query` options to X-Padding Placement. Fixes the issue where using Cookie fallback triggers whole HTTP Cookie header interception and silent drop in Xray-core. (Resolves [#3992](https://github.com/MHSanaei/3x-ui/issues/3992)) - **[Fix Uplink Data Options]** Replaced the invalid `query` option with `cookie` in Uplink Data Placement dropdown to prevent Xray-core backend panic `unsupported uplink data placement: query`. - **[Fix WebSockets Spam]** Boosted `maxMessageSize` boundary to 100MB and gracefully handled fallback fetch signals via `broadcastInvalidate` to avoid buffer dropping spam. (Resolves [#3984](https://github.com/MHSanaei/3x-ui/issues/3984))	2026-04-06 15:04:35 +03:00
test999	367152556a	**Fixes & Changes:** ... 1. **Fixed XPadding Placement Dropdown**: - Added the missing `cookie` and `query` options to `xPaddingPlacement` (`stream_xhttp.html`). - *Why:* Previously, users wanting `cookie` obfuscation were forced to use the `header` placement string. This caused Xray-core to blindly intercept the entire monolithic HTTP Cookie header, failing internal padding-length validations and causing the inbound to silently drop the connection. 2. **Fixed Uplink Data Placement Validation**: - Replaced the unsupported `query` option with `cookie` in `uplinkDataPlacement`. - *Why:* Xray-core's `transport_internet.go` explicitly forbids `query` as an uplink placement option. Selecting it from the UI previously sent a payload that would cause Xray-core to instantly throw an `unsupported uplink data placement: query` panic. Adding `cookie` perfectly aligns the UI with Xray-core restrictions. ### Related Issues - Resolves #3992	2026-04-06 15:00:43 +03:00
test999	1606f39a89	Fix bug	2026-04-06 13:45:09 +03:00
test999	e7f2790236	feat: add bulk client management support and improve inbound data handling	2026-04-06 13:21:33 +03:00
test999	97f284c9a7	feat: implement real-time traffic monitoring and UI updates using a high-performance WebSocket hub and background job system	2026-04-06 08:16:10 +03:00
Yunheng Liu	169b216d7e	perf: replace /dev/urandom | tr with openssl rand to fix CPU spike (#3887)	2026-04-01 13:59:48 +02:00
MHSanaei	7e6d80efa5	Bump Go and dependency versions ... Update go toolchain to 1.26.1 and upgrade multiple direct and indirect modules (examples: github.com/gin-contrib/gzip v1.2.6, github.com/gin-contrib/sessions v1.1.0, github.com/go-ldap/ldap/v3 v3.4.13, github.com/goccy/go-json v0.10.6, github.com/pelletier/go-toml/v2 v2.3.0, github.com/shirou/gopsutil/v4 v4.26.3, github.com/xtls/xray-core v1.260327.0, golang.org/x/crypto v0.49.0, google.golang.org/grpc v1.80.0). go.sum updated accordingly to lock the new versions. Routine dependency refresh to pull in fixes and improvements.	2026-04-01 13:47:27 +02:00
kazan417	38d87230d3	Update x-ui.sh (#3947) ... looks like now cert management is option 19	2026-03-18 19:45:45 +01:00
MHSanaei	f0f98c7122	Add Go code analyzer workflow	2026-03-17 23:01:15 +01:00
Abdalrahman	554981d9d3	feat(tgbot): send connection links and qrs on client creation (closes #3320)\n\n- Refactored inline keyboards into getCommonClientButtons to respect DRY\n- Extended SubmitAddClient callback handlers to dispatch individual links and QR codes to the bot chat on success. (#3888)	2026-03-17 22:09:49 +01:00
Nikolay	a08f1c6c13	Update translate.ru_RU.toml (#3889) ... Change to plural (geofiles, not geofile)	2026-03-17 21:24:09 +01:00
Alimpo	7f7ae0c547	fix: stop overwriting client_traffics.enable with JSON enable in GetClientTrafficByEmail (#3931) ... When a client hit traffic/expiry limit, disableInvalidClients sets client_traffics.enable=false and removes the user from Xray. GetClientTrafficByEmail was overwriting that with settings.clients[].enable (admin config), so ResetClientTraffic never saw the client as disabled and did not re-add the user. Clients could not connect until manually disabled/re-enabled. Now the DB runtime enable flag is preserved; reset correctly re-adds the user to Xray.	2026-03-17 21:20:24 +01:00
HamidReza Sadeghzadeh	60abeaad66	fix: Ban new IPs with fail2ban instead of disconnected the client. (#3919) ... * fix: Ban new IPs with fail2ban instead of disconnected the client. * fix: Remove unused strconv import * fix: Revert log fail2ban format	2026-03-17 21:18:10 +01:00
dependabot[bot]	a6d0100381	Bump docker/metadata-action from 5 to 6 (#3942) ... Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5 to 6. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/v5...v6) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-17 21:10:09 +01:00
dependabot[bot]	6767f76ccf	Bump actions/upload-artifact from 4 to 7 (#3941) ... Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-17 21:09:56 +01:00
dependabot[bot]	e4add73c9e	Bump actions/checkout from 5 to 6 (#3940) ... Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-17 21:05:43 +01:00
dependabot[bot]	ff72090e1a	Bump docker/setup-buildx-action from 3 to 4 (#3938) ... Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-17 21:05:28 +01:00
dependabot[bot]	a3e1bd59df	Bump docker/build-push-action from 6 to 7 (#3937) ... Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v6...v7) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-17 21:05:07 +01:00
dependabot[bot]	5bbb48a8fd	Bump docker/setup-qemu-action from 3 to 4 (#3936) ... Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3 to 4. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/v3...v4) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-17 21:04:54 +01:00
dependabot[bot]	ee84d585f9	Bump docker/login-action from 3 to 4 (#3939) ... Bumps [docker/login-action](https://github.com/docker/login-action) from 3 to 4. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3...v4) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-17 21:04:41 +01:00
Sanaei	7b03346cfc	Set package ecosystem to GitHub Actions in dependabot.yml	2026-03-17 21:03:32 +01:00
MHSanaei	258b08fff3	Update fail2ban filter regex in x-ui.sh	2026-03-08 11:53:34 +01:00
Aleksei Sidorenko	a2097ad062	feat: mask password in telegram notification on 2FA failure (#3884)	2026-03-04 18:26:53 +01:00
MHSanaei	52fdf5d429	v2.8.11	2026-03-04 13:54:01 +01:00
MHSanaei	34d8885075	Adjust KCP MTU when selecting xDNS mask	2026-03-04 13:39:14 +01:00
MHSanaei	5740996436	update dependencies	2026-03-04 13:05:29 +01:00
Artur	874aae8080	Add cron to ubuntu packages (#3875)	2026-03-04 12:36:45 +01:00
子寒	842fae18d7	Add 'default' runlevel to x-ui service in Alpine (#3854) ... it should be 'default' runlevel when add x-ui service to openrc, default is 'sysinit' runlevel. 'sysinit' runlevel is unnecessary,maybe. if not, there is an error when call to function 'check_enabled()' as command 'grep default -c' can`t print 'default' runlevel. check_enabled() { if [[ $release == "alpine" ]]; then if [[ $(rc-update show | grep -F 'x-ui' | grep default -c) == 1 ]]; then return 0 else return 1 fi	2026-03-04 12:32:01 +01:00
Happ-dev	ccd223aeea	Fix DeepLink for Happ, remove encoding URL (#3863) ... Co-authored-by: y.sivushkin <y.sivushkin@corp.101xp.com>	2026-03-04 12:29:46 +01:00
Aleksei Sidorenko	96b8fe472c	Fix: escape HTML characters in tgbot start command (#3883)	2026-03-04 11:35:24 +01:00
Nabi KaramAliZadeh	59b695ba83	fix: remove excluded paths from gzip middleware in router initialization (#3860)	2026-03-01 15:18:16 +01:00
Alireza Ahmadi	159b85f979	Merge pull request #3828 from MHSanaei/restartXrayOption ... [feat] restart xray-core from cli #3825	2026-02-25 21:09:42 +01:00
Alireza Ahmadi	3ec5b3589f	fix windows build	2026-02-20 02:07:46 +01:00
Alireza Ahmadi	2b1d3e7347	[feat] restart xray-core from cli #3825	2026-02-20 00:03:16 +01:00
MHSanaei	37f0880f8f	Bump Go to 1.26	2026-02-16 01:10:43 +01:00
MHSanaei	5b796672e9	Improve telego client robustness and retries ... Add a createRobustFastHTTPClient helper to configure fasthttp.Client with better timeouts, connection limits, retries and optional SOCKS5 proxy dialing. Validate and sanitize proxy and API server URLs instead of returning early on invalid values, and build telego.Bot options dynamically. Reduce long-polling timeout to detect connection issues faster and adjust update retrieval comments. Implement exponential-backoff retry logic for SendMessage calls to handle transient connection/timeouts and improve delivery reliability; also reduce inter-message delay for better throughput.	2026-02-14 22:49:19 +01:00
MHSanaei	3fa0da38c9	Add timeouts and delays to backup sends ... Add rate-limit friendly delays and context timeouts when sending backups via Telegram. Iterate admin IDs with index to sleep 1s between sends; add 30s context.WithTimeout for each SendDocument call and defer file.Close() for opened files; insert a 500ms pause between sending DB and config files. These changes improve resource cleanup and reduce chance of Telegram rate-limit/timeout failures.	2026-02-14 22:31:41 +01:00
MHSanaei	8eb1225734	translate bug fix #3789	2026-02-14 21:41:20 +01:00
MHSanaei	e5c0fe3edf	bug fix #3785	2026-02-11 22:21:09 +01:00
MHSanaei	f4057989f5	Require HTTP 200 from curl before using IP ... Replace simple curl+trim checks with a response+http_code parse to ensure the remote URL returns HTTP 200 and a non-empty body before assigning server_ip. Changes applied to install.sh, update.sh and x-ui.sh: use curl -w to append the status code, extract http_code and ip_result, and only set server_ip when http_code == 200 and ip_result is non-empty. This makes the IP discovery more robust against error pages or partial responses while keeping the existing timeout behavior.	2026-02-11 21:32:23 +01:00
MHSanaei	84013b0b3f	v2.8.10	2026-02-11 18:21:43 +01:00
MHSanaei	511adffc5b	Remove allowInsecure ... Remove the deprecated `allowInsecure`	2026-02-11 18:21:23 +01:00
bakatrouble	fc6344b840	Fix ipv6 hostname parsing for subscriptions (#3782)	2026-02-11 15:33:53 +01:00
emirjorge	b3555ce1b8	Update translate.es_ES.toml (#3766) ... Fix some trasnslations :)	2026-02-09 23:40:03 +01:00
MHSanaei	c2f409c3c4	fix security issue	2026-02-09 23:36:10 +01:00