Alex-Devera/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-06-06 13:14:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5
3x-ui/web/controller
History
farhadh 5ffd896a7c
fix(security): SSRF prevention, trusted-proxy header gating, CSP nonce, HTTP timeouts 
Adds SanitizeHTTPURL / SanitizePublicHTTPURL to reject private-range
and loopback targets before any outbound HTTP request (node probe,
xray download, outbound test, external traffic inform, tgbot API
server, panel updater). Forwarded headers (X-Real-IP, X-Forwarded-For,
X-Forwarded-Host) are now only trusted when the direct connection
arrives from a CIDR in TrustedProxyCIDRs. CSP policy is tightened with
a per-request nonce. HTTP server gains read/write/idle timeouts. Panel
updater downloads the script to a temp file instead of piping curl into
shell. Xray archive download adds a size cap and response-code check.
backuptotgbot is changed from GET to POST.
2026-05-11 21:16:23 +02:00
..
api.go fix(security): SSRF prevention, trusted-proxy header gating, CSP nonce, HTTP timeouts 2026-05-11 21:16:23 +02:00
base.go feat(auth): block panel with default admin/admin credentials and guide credential change 2026-05-11 21:16:22 +02:00
custom_geo.go v3 2026-05-10 02:13:42 +02:00
dist.go feat(auth): block panel with default admin/admin credentials and guide credential change 2026-05-11 21:16:22 +02:00
inbound.go fix(security): SSRF prevention, trusted-proxy header gating, CSP nonce, HTTP timeouts 2026-05-11 21:16:23 +02:00
index.go feat(auth): block panel with default admin/admin credentials and guide credential change 2026-05-11 21:16:22 +02:00
login_limiter.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
login_limiter_test.go refactor(websocket): split controller into service + thin controller 2026-05-08 00:00:44 +02:00
node.go feat(nodes): traffic-writer queue, full-mirror sync, WS event fixes 2026-05-10 16:25:23 +02:00
server.go fix: backup path with webbasepath (#4223) 2026-05-10 22:48:35 +02:00
setting.go feat(auth): block panel with default admin/admin credentials and guide credential change 2026-05-11 21:16:22 +02:00
util.go fix(security): SSRF prevention, trusted-proxy header gating, CSP nonce, HTTP timeouts 2026-05-11 21:16:23 +02:00
util_test.go fix(security): SSRF prevention, trusted-proxy header gating, CSP nonce, HTTP timeouts 2026-05-11 21:16:23 +02:00
websocket.go v3 2026-05-10 02:13:42 +02:00
xray_setting.go fix(security): SSRF prevention, trusted-proxy header gating, CSP nonce, HTTP timeouts 2026-05-11 21:16:23 +02:00
xui.go feat(panel): in-panel API documentation page 2026-05-11 13:57:42 +02:00