MHSanaei a08bb91f58 fix(settings): reject spaces, '\' and control chars in URI path settings ... webBasePath, subPath, subJsonPath and subClashPath are URL paths, so '/' stays allowed, but spaces, backslashes and control characters break routing. Strip them as you type (shared sanitizePath helper, now also applied to the panel base path) and reject them on save in AllSetting.CheckValid so direct API callers are covered too.		2026-05-30 23:29:08 +02:00
..
controller	refactor(clients): coherent group management — rename, split, extract	2026-05-28 12:59:20 +02:00
entity	fix(settings): reject spaces, '\' and control chars in URI path settings	2026-05-30 23:29:08 +02:00
global	Feat/multi inbound clients (#4469)	2026-05-19 12:20:24 +02:00
job	fix: address open bug reports (#4539, #4538, #4535, #4531, #4515) (#4545)	2026-05-25 00:08:06 +02:00
locale	v3	2026-05-10 02:13:42 +02:00
middleware	feat: complete Zod migration of frontend + bulk client batching (#4599)	2026-05-27 04:26:50 +02:00
network	docs: add comments for all functions	2025-09-20 09:35:50 +02:00
runtime	Feat/multi inbound clients (#4469)	2026-05-19 12:20:24 +02:00
service	fix(clients): reject spaces, '/', '\' and control chars in subscription ID	2026-05-30 23:28:58 +02:00
session	Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)	2026-05-13 12:52:52 +02:00
translation	fix(clients): reject spaces, '/', '\' and control chars in subscription ID	2026-05-30 23:28:58 +02:00
websocket	fix(websocket): order register/unregister via single ops channel	2026-05-19 12:34:53 +02:00
web.go	feat(frontend): TanStack Query + React Router migration & in-panel API docs (#4541)	2026-05-24 21:34:52 +02:00