3x-ui/web
pwnnex 15be803da9
Fix blank Xray Settings page from wrapped xrayTemplateConfig (#4059) (#4069)
`getXraySetting` builds its response as

    { "xraySetting": <db value>, "inboundTags": ..., "outboundTestUrl": ... }

and embeds the raw DB value as the `xraySetting` field without
checking whether the stored value already has that exact shape.

The frontend pulls the textarea content from `result.xraySetting`
and saves it back verbatim. If the DB ever ends up holding the
response-shaped wrapper instead of a real xray config (older
installs where this happened at least once, users who imported a
copy-pasted response into the textarea, a botched migration, etc.),
the next save nests another layer, the one after that nests a
third, and the Vue-side JSON.parse of the resulting blob silently
fails — the Xray Settings page goes blank.

Fix both ends of the round-trip:

* Add `service.UnwrapXrayTemplateConfig`. It peels off any number of
  `xraySetting`-keyed layers, leaving a real xray config behind.
  The check is conservative: if the outer object already contains
  any top-level xray key (`inbounds`, `outbounds`, `routing`, `api`,
  `dns`, `log`, `policy`, `stats`), it is returned unchanged, and
  there is a depth cap to avoid pathological inputs.

* `SaveXraySetting` unwraps before validation so a round-tripped
  wrapper from an already-corrupted page can no longer re-poison
  the DB on save.

* `getXraySetting` unwraps on read and, when it finds a wrapper,
  rewrites the DB with the corrected value. Existing broken installs
  heal themselves on the next visit to the page.

Includes unit tests for the passthrough, single-wrap, multi-wrap,
string-encoded-inner, and false-positive cases.

Co-authored-by: pwnnex <eternxles@gmail.com>
2026-04-21 20:30:02 +02:00
..
assets Fix xhttp xPadding settings missing from generated links (panel + subs) (#4065) 2026-04-21 19:15:51 +02:00
controller Fix blank Xray Settings page from wrapped xrayTemplateConfig (#4059) (#4069) 2026-04-21 20:30:02 +02:00
entity Add SSRF protection (#4044) 2026-04-20 00:18:20 +02:00
global Refactor code and fix linter warnings (#3627) 2026-01-05 05:54:56 +01:00
html sub json fix fragment noises effect 2026-04-21 20:02:39 +02:00
job revert: Disconnect client due to exceeded IP limit (#3948) 2026-04-19 21:52:40 +02:00
locale update dependencies 2026-03-04 13:05:29 +01:00
middleware docs: add comments for all functions 2025-09-20 09:35:50 +02:00
network docs: add comments for all functions 2025-09-20 09:35:50 +02:00
service Fix blank Xray Settings page from wrapped xrayTemplateConfig (#4059) (#4069) 2026-04-21 20:30:02 +02:00
session v2.9.0 2026-04-20 21:43:49 +02:00
translation feat: Add NordVPN NordLynx (WireGuard) integration (#3827) 2026-04-20 00:41:50 +02:00
websocket fix: enhance WebSocket stability, resolve XHTTP configurations and fix UI loading shifts (#3997) 2026-04-19 21:01:00 +02:00
web.go revert Fix geosite:ru rule (ram leak) 2026-04-21 12:55:16 +02:00