- Override Ant Design default selected row background in dark mode with theme color
- Restructure batch action toolbar with nested flex containers for better spacing and wrapping
- Bump version to v1.7.3.2
- Android: clash://install-config (Clash Meta for Android)
- iOS: shadowrocket://add/sub/ (Shadowrocket)
- Desktop: clash-verge://install-config (Clash Verge)
- Extended API to return subEnable/subUrl for standard subscription
- New API endpoint /panel/api/inbounds/userSubscriptions for non-admin users
- Redesigned /panel/user with Clash link card (copy button) and Quick Import dropdown (Android/iOS/Desktop with icons)
- Added i18n keys for en_US and zh_CN
- Bumped version to v1.7.2.5
Proxy entry fields were at same indent level as list item marker,
causing "invalid yaml" in Clash Verge. Fixed to 4-space indent for
fields and 6-space for nested *-opts sub-fields.
- Fix REALITY settings extraction: publicKey/shortIds/fingerprint are
nested under realitySettings.settings, not directly under realitySettings
- Add network field to all proxy entries (default "tcp")
- Move non-REALITY fingerprint into else branch to avoid duplication
- Add splitTemplate() to split at proxies:/proxy-groups: markers (like mihomo-gen)
- Store clash_template.yaml and servers.yaml as files alongside x-ui.json
- Add Clash/Servers editors in Xray advanced config page
- Support multi-server proxy generation (each server × each client)
- Remove inline template editor from Clash settings panel
- Bump version to v1.7.2.1
The middleware was changed to trust CF-Connecting-IP instead of
X-Real-IP/X-Forwarded-For, but the tests still used the old headers.
TestRateLimitMiddleware_DifferentIPsIndependent was failing because
all requests fell back to the same httptest RemoteAddr.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Worker nodes with remote MariaDB experienced slow configuration because
config_after_update() and config_after_install() made 5-8 separate
x-ui setting CLI calls, each spawning a new Go process and re-initing
the DB connection. Add a single -settingStatus flag that returns all
needed info in one call, reducing DB inits from 5-6 down to 2.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When behind Cloudflare CDN, RemoteAddr shows CF's IP, breaking rate
limiting and logging. Trust CF-Connecting-IP (set by CF, cannot be
spoofed by clients) and fall back to RemoteAddr for direct connections.
- Add RateLimitMiddleware(10/min) to POST /login (previously unprotected)
- Use RemoteAddr instead of X-Real-IP/X-Forwarded-For in getRemoteIp() and rate limiter
- Prevents brute-force login and rate-limit bypass via spoofed headers
Replace worker's plain HTML table with the same a-table used by master,
fixing inconsistencies: missing role column, no error ellipsis, dead-code
empty state ternary, and duplicate a-empty elements.
gh release upload can fail with "release not found" when called
immediately after gh release create due to GitHub API propagation
delay. Add a 5s sleep after create and retry the upload up to 3 times.
