142 commits

Author	SHA1	Message	Date
root	d5bf2858ce	fix: query shared MariaDB for node states instead of local DB ... In shared mode, the master may use SQLite locally while workers write heartbeats to the shared MariaDB. The /list endpoint now opens a temporary MariaDB connection to query node_states when the local DB is not MariaDB.	2026-04-24 18:01:59 +08:00
root	c1a9831e85	chore: bump version to v1.6.1	2026-04-24 17:44:17 +08:00
root	2721dd0f13	chore: bump version to v1.6.0-beta	2026-04-24 17:25:02 +08:00
root	67435b892b	chore: bump version to v1.5.4.1-beta	2026-04-24 16:16:00 +08:00
root	582037ae70	fix: settings save button and multiple UI bugs ... - Fix duplicate :min attributes on a-input-number (webPort, subPort, tgCpu) - Fix mismatched closing tags (a-input/a-switch instead of a-input-number) - Fix twoFactorEnable toggle receiving MouseEvent instead of boolean - Fix noise input handlers referencing undefined global `event` - Add error handling to settings change detection polling loop - Bump version to v1.5.4-beta	2026-04-24 15:44:48 +08:00
root	288635adfc	fix: Clash YAML injection, path validation, and default template ... - Quote all YAML string values with %q to prevent injection - Remove unused host parameter from GetClash - Add backend path normalization for SubClashPath - Log StreamSettings JSON unmarshal errors - Expand template panel by default and provide default template	2026-04-24 14:35:28 +08:00
root	11cdb07e89	feat: add Clash YAML subscription endpoint with template injection ... Add /clash/:subid endpoint that returns complete Clash YAML config. User provides full template (DNS, routing, proxy-groups, rules) in settings, panel generates proxies from inbound/client data and injects via proxies: [] placeholder replacement. - New SubClashService reads template, generates vmess/vless/trojan/ss proxy entries with transport (ws/grpc/h2/tcp/httpupgrade), TLS, and Reality support - Settings: subClashEnable, subClashPath, subClashURI, subClashTemplate - UI: Clash settings tab, QR code on subpage, Desktop dropdown with clash-verge:// deep link preferring Clash URL - Version bump to v1.5.2-beta	2026-04-24 11:25:10 +08:00
root	1a02ebb024	fix: MariaDB JSON_EACH compatibility for subscription and traffic queries ... Replace SQLite-only JSON_EACH with DB-type branching (JSON_TABLE for MariaDB) in subscription, client traffic, and migration queries. Bump version to v1.5.1.	2026-04-24 10:16:48 +08:00
root	51f17922fa	fix: resolve shared-mode traffic flush blocked by stale inboundId=0 delta ... The traffic-pending.json file could contain a stale client traffic delta with inboundId=0 (created before the InboundId resolution fix). When flushToDatabase tried to INSERT this into client_traffics, it violated the foreign key constraint fk_inbounds_client_stats, causing the entire transaction to roll back and blocking ALL traffic from being written to MariaDB. - Skip deltas with InboundID==0 in flushToDatabase with a warning log - Share a single TrafficPendingStore between XrayTrafficJob and the flush loop to eliminate a race condition from dual file instances - Add test for zero InboundID skip behavior	2026-04-24 02:56:23 +08:00
root	157fb93f24	chore: bump version to v1.4.5-beta	2026-04-24 02:31:00 +08:00
Sora39831	e50b2f471d	feat: improve mariadb flow, db settings init, and traffic flush	2026-04-15 16:58:49 +08:00
Sora39831	36826706ec	feat: add node config and startup validation	2026-04-10 11:13:52 +08:00
Sora39831	8e9e36e1b8	Fix turnstile tab re-render and bump version	2026-04-08 15:34:50 +08:00
Sora39831	b0ce1a7ace	refactor(settings): organize x-ui.json by module and purpose	2026-04-04 14:46:24 +08:00
Sora39831	c94372a22c	fix: address all code review issues for MariaDB support ... - Prevent DBPassword from leaking to frontend (json:"-") - Make migration direction explicit via --direction flag, set dbType only after success - Use driver-appropriate DROP INDEX IF EXISTS for SQLite vs MariaDB - Build DSN with mysql.Config.FormatDSN() to prevent injection with special chars - Close DB before re-initialization in InitDB - Add migration tests (5 tests using SQLite in-memory DBs) - Parse JSON once in GetDBConfigFromJSON instead of 7 times - Use Go binary for dbType in shell script instead of fragile grep - Add rollback on failure in db_switch_to_sqlite - Validate DB settings in CheckValid	2026-04-03 09:53:20 +08:00
Sora39831	e3d1a94d89	feat: add JSON config helpers for DB type and MariaDB settings	2026-04-03 09:24:39 +08:00
Sora39831	09f84782b0	test: add unit tests for critical modules and fix flaky redirect middleware ... - Add tests for config, database, model, util/common, util/crypto, util/random, web/middleware, web/service, and xray packages - Fix redirect middleware using slice instead of map to guarantee deterministic longest-prefix-first matching order	2026-04-03 08:44:51 +08:00
Sora39831	30b27bf091	feat: migrate settings to JSON file, add Cloudflare SSL in installer ... - config: add GetSettingPath for JSON-based settings storage - setting.go: load/save settings from JSON file instead of DB; keep xrayTemplateConfig in DB; fix ResetSettings to not clear users - xray_setting.go: save xray template config to DB directly - install.sh: add Cloudflare SSL option (wildcard via DNS), allow user to input custom credentials on fresh install, fix existing install logic to preserve user config	2026-04-02 16:16:52 +08:00
MHSanaei	52fdf5d429	v2.8.11	2026-03-04 13:54:01 +01:00
MHSanaei	84013b0b3f	v2.8.10	2026-02-11 18:21:43 +01:00
MHSanaei	06c49b92f8	v2.8.9	2026-02-01 04:05:02 +01:00
MHSanaei	d8c783a296	v2.8.8	2026-01-18 18:01:58 +01:00
MHSanaei	7b0a3929ff	v2.8.7	2026-01-05 19:00:36 +01:00
MHSanaei	e69a31dd59	v2.8.6	2026-01-03 06:44:39 +01:00
Nebulosa	c061337ce7	Set log folder variable to /var/log/3x-ui (#3599) ... * Set log folder variable to /var/log/3x-ui * Set log folder as x-ui and create the log folder * Create the log folder in install and update scripts	2026-01-02 16:11:32 +01:00
mhsanaei	01d4a7488d	v2.8.5	2025-10-15 11:40:40 +02:00
mhsanaei	104526aab2	v2.8.4	2025-09-24 11:47:43 +02:00
mhsanaei	020bc9d77c	v2.8.3	2025-09-21 21:20:45 +02:00
mhsanaei	eacfbc86b5	security fix: Command built from user-controlled sources CWE-78 ... https://cwe.mitre.org/data/definitions/78.html https://owasp.org/www-community/attacks/Command_Injection	2025-09-21 17:39:30 +02:00
mhsanaei	6ced549dea	docs: add comments for all functions	2025-09-20 09:35:50 +02:00
mhsanaei	0ffd27c0aa	v2.8.2	2025-09-19 00:22:15 +02:00
mhsanaei	3764ece26c	v2.8.1	2025-09-17 13:51:41 +02:00
mhsanaei	5408a2f82c	v2.8.0	2025-09-14 22:09:36 +02:00
mhsanaei	82ddd10627	Fixed: update Xray Core on Windows	2025-09-10 21:12:37 +02:00
mhsanaei	b1ea8005e4	v2.7.0	2025-09-10 08:43:46 +02:00
mhsanaei	7b039d219e	v2.6.8	2025-09-08 00:29:30 +02:00
mhsanaei	2750f46c01	v2.6.7	2025-08-30 16:05:33 +02:00
fgsfds	6879a8fbcb	Moved DB to same app folder on Windows (#3340) ... * moved db to user folder on windows * moved db to local appdata * made getDBFolderPath func private * added getWindowsDbPath() func * fix --------- Co-authored-by: mhsanaei <ho3ein.sanaei@gmail.com>	2025-08-13 23:19:59 +02:00
mhsanaei	4d02756e1e	v2.6.6	2025-08-08 20:52:04 +02:00
mhsanaei	4b03e9d919	v2.6.5	2025-08-04 19:12:37 +02:00
mhsanaei	73a5722cca	v2.6.3	2025-08-03 12:22:28 +02:00
mhsanaei	b7164805f8	v2.6.2	2025-07-06 20:58:10 +02:00
mhsanaei	c81c27073c	v2.6.1	2025-07-02 11:28:24 +02:00
mhsanaei	ef625c75d8	v2.6.0	2025-05-16 14:26:20 +02:00
mhsanaei	3d54e33051	v2.5.8	2025-04-30 11:24:06 +02:00
mhsanaei	236dddf482	v2.5.7	2025-04-11 12:11:39 +02:00
mhsanaei	2ffde55f8f	v2.5.6 - Happy Nowruz	2025-03-20 10:54:54 +01:00
mhsanaei	1893c3814d	v2.5.5	2025-03-10 14:33:58 +01:00
mhsanaei	d6d05a9b4d	v2.5.4	2025-03-05 15:42:51 +01:00
mhsanaei	31e1581d6b	v2.5.3	2025-02-25 18:43:29 +01:00