mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-06-07 05:34:17 +00:00
3c11977c77
1. web/controller/index.go Stop logging the submitted plaintext password on failed login. Replace it with "***" in the Telegram notification too. 2. web/controller/server.go + web/html/index.html Convert /panel/api/server/getDb from GET to POST and require an X-Requested-With header. Prevents <img>/<a>/<form> CSRF that would otherwise let an attacker steal the SQLite DB by tricking a logged-in admin into loading a single URL. 3. web/web.go Set Secure=true on the session cookie when TLS cert/key are configured, and tighten SameSite from Lax to Strict for the panel session. |
||
|---|---|---|
| .. | ||
| assets | ||
| controller | ||
| entity | ||
| global | ||
| html | ||
| job | ||
| locale | ||
| middleware | ||
| network | ||
| service | ||
| session | ||
| translation | ||
| websocket | ||
| web.go | ||