Xray panel supporting multi-protocol multi-user expire day & traffic & ip limit (Vmess & Vless & Trojan & ShadowSocks & Wireguard)
Find a file
pwnnex 15be803da9
Fix blank Xray Settings page from wrapped xrayTemplateConfig (#4059) (#4069)
`getXraySetting` builds its response as

    { "xraySetting": <db value>, "inboundTags": ..., "outboundTestUrl": ... }

and embeds the raw DB value as the `xraySetting` field without
checking whether the stored value already has that exact shape.

The frontend pulls the textarea content from `result.xraySetting`
and saves it back verbatim. If the DB ever ends up holding the
response-shaped wrapper instead of a real xray config (older
installs where this happened at least once, users who imported a
copy-pasted response into the textarea, a botched migration, etc.),
the next save nests another layer, the one after that nests a
third, and the Vue-side JSON.parse of the resulting blob silently
fails — the Xray Settings page goes blank.

Fix both ends of the round-trip:

* Add `service.UnwrapXrayTemplateConfig`. It peels off any number of
  `xraySetting`-keyed layers, leaving a real xray config behind.
  The check is conservative: if the outer object already contains
  any top-level xray key (`inbounds`, `outbounds`, `routing`, `api`,
  `dns`, `log`, `policy`, `stats`), it is returned unchanged, and
  there is a depth cap to avoid pathological inputs.

* `SaveXraySetting` unwraps before validation so a round-tripped
  wrapper from an already-corrupted page can no longer re-poison
  the DB on save.

* `getXraySetting` unwraps on read and, when it finds a wrapper,
  rewrites the DB with the corrected value. Existing broken installs
  heal themselves on the next visit to the page.

Includes unit tests for the passthrough, single-wrap, multi-wrap,
string-encoded-inner, and false-positive cases.

Co-authored-by: pwnnex <eternxles@gmail.com>
2026-04-21 20:30:02 +02:00
.github CodeQL: ignore v* tag pushes 2026-04-21 15:17:59 +02:00
.vscode DevTools 2025-10-02 01:47:12 +02:00
config v2.9.1 2026-04-21 15:02:06 +02:00
database add hysteria inbound 2026-04-20 16:05:27 +02:00
logger feat: add file logger support (#3575) 2025-10-09 17:39:29 +02:00
media donate: nowpayments 2025-09-18 20:14:10 +02:00
sub sub json fix fragment noises effect 2026-04-21 20:02:39 +02:00
util fix windows build 2026-02-20 02:07:46 +01:00
web Fix blank Xray Settings page from wrapped xrayTemplateConfig (#4059) (#4069) 2026-04-21 20:30:02 +02:00
windows_files Update OpenSSL installer to version 3.6.0 2026-01-05 18:49:30 +01:00
xray fix: prevent AddUser panic on nil flow for VLESS XHTTP clients 2026-04-21 13:04:39 +02:00
.env.example fix: display of outbound traffic (#3604) 2025-12-23 15:43:25 +01:00
.gitignore Moved DB to same app folder on Windows (#3340) 2025-08-13 23:19:59 +02:00
CONTRIBUTING.md fix: display of outbound traffic (#3604) 2025-12-23 15:43:25 +01:00
docker-compose.yml fix: enhance WebSocket stability, resolve XHTTP configurations and fix UI loading shifts (#3997) 2026-04-19 21:01:00 +02:00
DockerEntrypoint.sh chore: X_UI_ENABLE_FAIL2BAN -> XUI_ENABLE_FAIL2BAN (#3030) 2025-05-22 08:21:23 +02:00
Dockerfile Bump Go to 1.26 2026-02-16 01:10:43 +01:00
DockerInit.sh Update Xray-core to v26.4.17 2026-04-20 20:02:43 +02:00
go.mod revert Fix geosite:ru rule (ram leak) 2026-04-21 12:55:16 +02:00
go.sum revert Fix geosite:ru rule (ram leak) 2026-04-21 12:55:16 +02:00
install.sh fix: enhance WebSocket stability, resolve XHTTP configurations and fix UI loading shifts (#3997) 2026-04-19 21:01:00 +02:00
LICENSE 3x-ui 2023-02-09 22:48:06 +03:30
main.go fix windows build 2026-02-20 02:07:46 +01:00
README.ar_EG.md Readme: Remove custom GeoSite/GeoIP DAT section 2026-04-21 20:20:43 +02:00
README.es_ES.md Readme: Remove custom GeoSite/GeoIP DAT section 2026-04-21 20:20:43 +02:00
README.fa_IR.md Readme: Remove custom GeoSite/GeoIP DAT section 2026-04-21 20:20:43 +02:00
README.md Readme: Remove custom GeoSite/GeoIP DAT section 2026-04-21 20:20:43 +02:00
README.ru_RU.md Readme: Remove custom GeoSite/GeoIP DAT section 2026-04-21 20:20:43 +02:00
README.zh_CN.md Readme: Remove custom GeoSite/GeoIP DAT section 2026-04-21 20:20:43 +02:00
update.sh fix: enhance WebSocket stability, resolve XHTTP configurations and fix UI loading shifts (#3997) 2026-04-19 21:01:00 +02:00
x-ui.rc [feat] restart xray-core from cli #3825 2026-02-20 00:03:16 +01:00
x-ui.service.arch [feat] restart xray-core from cli #3825 2026-02-20 00:03:16 +01:00
x-ui.service.debian [feat] restart xray-core from cli #3825 2026-02-20 00:03:16 +01:00
x-ui.service.rhel [feat] restart xray-core from cli #3825 2026-02-20 00:03:16 +01:00
x-ui.sh Fix SSL domain setup on reinstall: reuse existing certs and avoid false success/failure logs (#4004) 2026-04-17 12:19:45 +02:00

English | فارسی | العربية | 中文 | Español | Русский

3x-ui

Release Build GO Version Downloads License Go Reference Go Report Card

3X-UI — advanced, open-source web-based control panel designed for managing Xray-core server. It offers a user-friendly interface for configuring and monitoring various VPN and proxy protocols.

Important

This project is only for personal usage, please do not use it for illegal purposes, and please do not use it in a production environment.

As an enhanced fork of the original X-UI project, 3X-UI provides improved stability, broader protocol support, and additional features.

Quick Start

bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

For full documentation, please visit the project Wiki.

A Special Thanks to

Acknowledgment

  • Iran v2ray rules (License: GPL-3.0): Enhanced v2ray/xray and v2ray/xray-clients routing rules with built-in Iranian domains and a focus on security and adblocking.
  • Russia v2ray rules (License: GPL-3.0): This repository contains automatically updated V2Ray routing rules based on data on blocked domains and addresses in Russia.

Support project

If this project is helpful to you, you may wish to give it a🌟

Buy Me A Coffee
Crypto donation button by NOWPayments

Stargazers over Time

Stargazers over time