3x-ui/web/controller
MHSanaei 36e75143fa
fix(frontend): Phase 9 — restore index dashboard, fix login/CSRF, port legacy styles
- Index dashboard regains the 8 cards that were lost in the SPA port
  (3X-UI panel info, Operation Hours, System Load, Usage, Overall Speed,
  Total Data, IP Addresses, Connection Stats), plus a Config button that
  shows the live xray config.json. Version display falls back through
  panelUpdateInfo → window.__X_UI_CUR_VER__ → '?' so dev mode isn't blank.
- Xray config no longer hangs on load: useXraySetting surfaces failures
  instead of leaving a perpetual spinner, and the Vite dev proxy stops
  hijacking POST requests to migrated routes (only GETs get bypassed).
- Inbound page no longer throws __asyncLoader/emitsOptions errors —
  inbound.js was missing imports (NumberFormatter, SizeFormatter,
  Wireguard) and InboundList kept emitting after unmount.
- Login round-trip works after logout: a public /csrf-token endpoint
  bootstraps the SPA before authentication, axios caches the token
  module-level, and the dev 401 handler navigates to /login.html
  instead of reloading the dashboard into a redirect loop.
- legacy.css mirrors the legacy panel's surface/text variables so dark
  and ultra-dark themes match main; every SPA entry imports it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-08 17:21:03 +02:00
..
api.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
base.go docs: add comments for all functions 2025-09-20 09:35:50 +02:00
custom_geo.go Add SSRF protection (#4044) 2026-04-20 00:18:20 +02:00
dist.go fix(frontend): Phase 9 — restore index dashboard, fix login/CSRF, port legacy styles 2026-05-08 17:21:03 +02:00
inbound.go ws/inbounds: realtime fixes + perf for 10k+ client inbounds (#4123) 2026-05-05 17:27:49 +02:00
index.go fix(frontend): Phase 9 — restore index dashboard, fix login/CSRF, port legacy styles 2026-05-08 17:21:03 +02:00
login_limiter.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
login_limiter_test.go refactor(websocket): split controller into service + thin controller 2026-05-08 00:00:44 +02:00
server.go fix(panel): silence update-check WARN spam when offline 2026-05-08 09:51:05 +02:00
setting.go ws/inbounds: realtime fixes + perf for 10k+ client inbounds (#4123) 2026-05-05 17:27:49 +02:00
util.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
websocket.go refactor(websocket): split controller into service + thin controller 2026-05-08 00:00:44 +02:00
xray_setting.go fix: get client reverse tag in the outbound 2026-05-06 00:50:40 +02:00
xui.go feat(server): Phase 8 — cut HTML routes over to web/dist/ 2026-05-08 14:39:55 +02:00