hellcat
208536e1cb
style(mail): apply tutorial design to default email templates
2026-10-09 18:46:25 +08:00
hellcat
cd117604a3
feat: add branded tutorials and display-only plan device settings
2026-10-08 18:01:02 +08:00
xboard
4f48e61a2c
fix(order): prevent duplicate refunds and redemptions
...
Refs #1021
2026-08-30 04:50:34 +08:00
asukassa
9d125527cb
fix: reindex device IP array before JSON encoding ( #1045 )
2026-08-30 01:07:37 +08:00
JW-3154
e074bef702
fix(Shadowrocket.php): add missing bandwidth params for Hysteria2 ( #1031 )
...
* fix(Shadowrocket): add missing bandwidth params for Hysteria2
Fixes a critical issue where Hysteria 2 silently downgrades to non-Brutal congestion control (BBR/Reno) on Shadowrocket clients.
* Refactor bandwidth parameters assignment
Update bandwidth parameters to only include positive values.
---------
Co-authored-by: Xboard <147830212+cedar2025@users.noreply.github.com>
2026-08-30 00:55:14 +08:00
muyichun
7cfe061469
fix: correct Alipay F2F request timestamp ( #1024 )
...
Co-authored-by: muyichun <25608102+muyichun@users.noreply.github.com>
2026-08-30 00:42:46 +08:00
yootus
c9ef5768e0
fix(order): calculate invitation commission after balance deduction ( #1020 )
...
Calculate invitation commission from the amount remaining after balance deductions, preventing duplicate commission on internally credited payments.
2026-08-30 00:39:20 +08:00
JW-3154
60ba57142b
fix (General.php): VLESS parsing issue ( #1017 )
...
Replace urlencode with rawurlencode to prevent spaces from being improperly converted to '+' in node names (e.g., 'HKG 01' becoming 'HKG+01').
A tiny one-line change that significantly improves the UX.
2026-08-07 21:44:44 +08:00
xboard
8ecb762d77
fix(admin): keep ticket detail open after reply, etc.
2026-06-18 00:56:23 +08:00
JW-3154
6141430a88
Fix TUIC congestion control at Shadowrocket.php ( #968 )
...
Fixes an issue where the TUIC congestion_control parameter was not being passed to clients on Shadowrocket. This PR adds the missing parameter to the URL query string, fetching it from $protocol_settings with a default and safe fallback to 'cubic', ensuring panel configurations are properly respected by the client.
2026-06-06 11:11:01 +08:00
socksprox
34bb1fdbcf
Rename v2_order.refund_amount to surplus_credit ( #967 )
...
The old name was misleading — this column tracks surplus credit returned
to the user's internal balance during plan upgrades, not a payment
gateway refund. The new name aligns with the existing surplus_amount
and surplus_order_ids naming convention.
Co-authored-by: socksprox <info@shadowfly.net>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-02 11:49:58 +08:00
xboard
8f66a9af94
feat: add admin user plugin hooks
...
Added hooks:
- admin.user.fetch.query
- admin.user.transform
- admin.user.detail
- admin.user.update.rules
- admin.user.update.messages
- admin.user.update.params
- admin.user.update.before
- admin.user.update.after
- admin.user.secret.reset
- admin.user.destroy.before
- admin.user.destroy.after
2026-05-26 02:23:23 +08:00
xboard
4e9dfd6018
fix(security): harden registration email code validation
2026-05-22 22:05:33 +08:00
xboard
1eb085d4c0
fix(security): harden password reset email code validation
2026-05-22 21:52:34 +08:00
socksprox
f2ac5db4bd
feat(sing-box): include/exclude outbound tags with safe regex and fallback ( #916 )
...
- Add optional include/exclude patterns on selector/urltest outbounds (stripped before client)
- Safe preg_match: bare patterns use ~ delimiter with escape; delimited regex supported; invalid patterns logged, no throw
- Add fallback when filtering yields empty outbounds (string or ordered list: exact tag or pattern)
- Prevents broken routing when dynamic node sets match no filter
Made-with: Cursor
Co-authored-by: socksprox <info@shadowfly.net>
2026-05-03 10:06:30 +08:00
socksprox
689dc5ffa8
Fix redis ownership ( #927 )
...
Co-authored-by: socksprox <info@shadowfly.net>
2026-05-03 09:38:53 +08:00
Xboard
d22a12cb34
Update Docker commands for V2board Dev migration
2026-04-30 00:49:52 +08:00
Xboard
449ccc3a1a
Fix service names in v2board migration steps
...
Updated commands for database wipe and migration in v2board migration guide.
2026-04-30 00:49:37 +08:00
Xboard
42e5dac982
Update docker commands for migration to use xboard
2026-04-30 00:49:19 +08:00
Xboard
e2e489e85e
Modify upgrade command for older compose.yaml
...
Updated command for upgrading using older compose.yaml.
2026-04-25 20:43:35 +08:00
xboard
3b0b42c51d
refactor(middleware): split V2 server middleware to drop node_type
2026-04-23 19:24:34 +08:00
xboard
cf26ab3210
docs(upgrade): note pre-2026-04-19 compose upgrade command
2026-04-23 12:23:08 +08:00
xboard
382efe5aa5
fix(caddy): preserve X-Forwarded-For chain so Laravel TrustProxies resolves real client IP
2026-04-23 11:39:58 +08:00
xboard
0fa4b4e0fc
fix(security): prevent payment gateway credentials leakage via OrderResource
2026-04-23 10:26:35 +08:00
xboard
b8944e2341
fix(docker): re-apply www ownership to /www at entrypoint
2026-04-20 01:39:24 +08:00
xboard
a7c7120d8a
chore(docker): all-in-one redis no longer listens on TCP
2026-04-20 01:14:52 +08:00
xboard
0598351c10
fix: backfill utls for legacy vless reality nodes
2026-04-20 00:08:00 +08:00
Xboard
f714767205
Update installation instructions for aapanel-docker
2026-04-19 23:33:32 +08:00
xboard
66861500c3
fix(deploy): make install/update redis-independent and clean stale octane state
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-19 23:23:27 +08:00
xboard
8379f1d1cd
docs: update readme
2026-04-19 21:57:56 +08:00
xboard
3f82b00972
refactor: all-in-one docker deployment with auto-tuned resources and per-mode compose templates
2026-04-19 21:18:15 +08:00
xboard
135164056a
fix: restore stripped protocol_settings fields for tuic/mieru/vmess
2026-04-19 00:45:47 +08:00
xboard
a9cae6dc19
refactor: core plugins to plugins-core
2026-04-18 23:31:59 +08:00
xboard
4431641197
fix: unify Trojan server_name/allow_insecure to tls_settings across all protocols
2026-04-18 21:00:21 +08:00
xboard
e0f41257db
feat(admin): batch node-machine binding & frontend update
2026-04-18 19:38:31 +08:00
xboard
6be8137ed5
fix: commit composer.lock for reproducible Docker builds
2026-04-18 16:56:41 +08:00
xboard
8131bf4748
fix: ticket reply_status semantics, N+1 query, and admin reply auto-reopen
2026-04-18 16:40:21 +08:00
xboard
775590dc21
fix: Shadowrocket Trojan whitelist bug and xhttp support
2026-04-18 16:07:22 +08:00
xboard
d406e440a7
feat: email template management with DB override, modern mail redesign
2026-04-18 15:41:23 +08:00
xboard
a7fae4cc6d
fix: batchUpdate use model instance to trigger observer
2026-04-18 04:26:25 +08:00
xboard
f5ff15e415
fix: dedup device IPs, reset stale online_count on disconnect and scheduled cleanup ( #886 )
2026-04-18 02:57:55 +08:00
xboard
7652882fe5
feat: add xhttp subscriptions, network monitoring, chart legend toggle and ticket sender labels
2026-04-18 02:02:06 +08:00
xboard
8e35be3097
fix(plugin): improve plugin install and uninstall migration handling
2026-04-17 23:11:03 +08:00
xboard
b9f3bc29dc
fix: support both GET and POST for handshake endpoint (backward compatibility)
2026-04-17 20:59:48 +08:00
Xboard
2671cd3f2d
Update installer URL to use 'dev' branch
2026-04-17 12:54:22 +08:00
xboard
83b43e8664
feat: show install command on machine creation
2026-04-17 06:47:05 +08:00
xboard
6796b70179
feat: machine mode, ECH subscriptions, batch ops & security hardening
2026-04-17 03:02:53 +08:00
yootus
299a69cd51
QuantumultX下发Anytls节点 ( #880 )
...
QuantumultX最新版本支持Anytls了，做适配
2026-04-16 19:31:24 +08:00
xboard
a0f6b324a4
fix: reset traffic stats when copying server nodes
2026-04-11 20:24:43 +08:00
Valentin Lobstein
cf5cece77f
Fix: CVE-2026-39912 - Magic link token leak in loginWithMailLink ( #873 )
...
The loginWithMailLink endpoint returns the magic login link in the
HTTP response body, allowing unauthenticated account takeover.
The fix returns true instead of the link. The email delivery is
the authentication factor.
Bug inherited from V2Board commit 9b707aaf (2022-06-27).
2026-04-10 02:44:20 +08:00
