mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-06-06 05:04:22 +00:00
5ffd896a7c
Adds SanitizeHTTPURL / SanitizePublicHTTPURL to reject private-range and loopback targets before any outbound HTTP request (node probe, xray download, outbound test, external traffic inform, tgbot API server, panel updater). Forwarded headers (X-Real-IP, X-Forwarded-For, X-Forwarded-Host) are now only trusted when the direct connection arrives from a CIDR in TrustedProxyCIDRs. CSP policy is tightened with a per-request nonce. HTTP server gains read/write/idle timeouts. Panel updater downloads the script to a temp file instead of piping curl into shell. Xray archive download adds a size cap and response-code check. backuptotgbot is changed from GET to POST. |
||
|---|---|---|
| .. | ||
| config.json | ||
| custom_geo.go | ||
| custom_geo_test.go | ||
| inbound.go | ||
| metric_history.go | ||
| node.go | ||
| nord.go | ||
| outbound.go | ||
| panel.go | ||
| panel_other.go | ||
| panel_test.go | ||
| panel_unix.go | ||
| port_conflict.go | ||
| port_conflict_test.go | ||
| server.go | ||
| setting.go | ||
| setting_security_test.go | ||
| tgbot.go | ||
| tgbot_test.go | ||
| traffic_writer.go | ||
| url_safety.go | ||
| user.go | ||
| warp.go | ||
| websocket.go | ||
| xray.go | ||
| xray_setting.go | ||
| xray_setting_test.go | ||