3x-ui/web
MHSanaei 97967535b6
fix(clients): preserve protocol-specific credentials across multi-inbound syncs (#4538)
fillProtocolDefaults only populates the credential relevant to the
inbound's protocol (c.ID for VLESS, c.Auth for Hysteria, c.Password
for Trojan/Shadowsocks). Each inbound's settings.clients JSON
therefore carries the same client with only one of those fields set.

SyncInbound's update path was unconditionally copying every credential
column from incoming to the existing clients row, so the second sync
(e.g. Hysteria after VLESS) would write UUID="" over a valid VLESS
UUID and Auth="" the other way around. The next GetXrayConfig then
emitted VLESS client entries with no "id" field, and xray-core
crashed on startup with "common/uuid: invalid UUID:".

Guard UUID/Password/Auth/Flow/Security/Reverse against empty
overwrites so each protocol's sync only writes the credentials it
actually owns. Other fields (LimitIP, TotalGB, Comment, etc.) keep
the existing copy-everything behavior so admins can still clear them
through the panel.

Regression test in client_sync_multiprotocol_test.go.

Closes #4538
2026-05-24 22:52:33 +02:00
..
controller feat(frontend): TanStack Query + React Router migration & in-panel API docs (#4541) 2026-05-24 21:34:52 +02:00
entity Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
global Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
job fix: hash-storage panic on SIGHUP and seeder dup-key on cold restart (#4539) 2026-05-24 22:45:14 +02:00
locale v3 2026-05-10 02:13:42 +02:00
middleware Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
network docs: add comments for all functions 2025-09-20 09:35:50 +02:00
runtime Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
service fix(clients): preserve protocol-specific credentials across multi-inbound syncs (#4538) 2026-05-24 22:52:33 +02:00
session Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
translation i18n: translate hardcoded inbound action + security warning strings (#4502) 2026-05-23 19:43:21 +02:00
websocket fix(websocket): order register/unregister via single ops channel 2026-05-19 12:34:53 +02:00
web.go feat(frontend): TanStack Query + React Router migration & in-panel API docs (#4541) 2026-05-24 21:34:52 +02:00