3x-ui/web
MHSanaei ea926826fb
fix: hash-storage panic on SIGHUP and seeder dup-key on cold restart (#4539)
Two bugs that combine into an unrecoverable crash loop after a user
enables the Telegram bot in settings on a fresh install.

1. CheckHashStorageJob.Run panics with a nil pointer dereference. The
   cron job is scheduled whenever settings say the bot is enabled, but
   the package-level hash storage is only initialized inside
   Tgbot.Start, which StartPanelOnly intentionally skips
   (startTgBot=false). Toggling the bot on via the panel triggers
   SIGHUP, the storage stays nil, and the cron fires 2 minutes later
   and panics, exiting 2.

2. seedClientsFromInboundJSON is not idempotent. The fresh-install
   early-return path recorded only UserPasswordHash + ApiTokensTable,
   never ClientsTable. After the admin adds clients via the panel
   (which writes to the clients table through SyncInbound), the next
   start runs the seeder for the first time, finds matching emails
   already in the table, and fails with SQLSTATE 23505 on
   idx_clients_email, turning the panic above into an unrecoverable
   crash loop on PostgreSQL.

Fixes:
- web/job/check_hash_storage.go: nil-check the storage before calling
  RemoveExpiredHashes.
- database/db.go: in the fresh-install early-return path, also record
  ClientsTable so the seeder never re-runs against panel-added data.
- database/db.go: hydrate seedClientsFromInboundJSON's byEmail cache
  from existing rows so it merges instead of inserting when a row with
  the same email already lives in the clients table.

Regression tests cover both paths.

Closes #4539
2026-05-24 22:45:14 +02:00
..
controller feat(frontend): TanStack Query + React Router migration & in-panel API docs (#4541) 2026-05-24 21:34:52 +02:00
entity Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
global Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
job fix: hash-storage panic on SIGHUP and seeder dup-key on cold restart (#4539) 2026-05-24 22:45:14 +02:00
locale v3 2026-05-10 02:13:42 +02:00
middleware Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
network docs: add comments for all functions 2025-09-20 09:35:50 +02:00
runtime Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
service feat(clients): add inbound filter + mobile page-size control 2026-05-23 23:31:41 +02:00
session Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
translation i18n: translate hardcoded inbound action + security warning strings (#4502) 2026-05-23 19:43:21 +02:00
websocket fix(websocket): order register/unregister via single ops channel 2026-05-19 12:34:53 +02:00
web.go feat(frontend): TanStack Query + React Router migration & in-panel API docs (#4541) 2026-05-24 21:34:52 +02:00