tom/dpl
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
620 Commits 8 Branches 0 Tags 77 MiB
299a69cd51
Commit Graph

349 Commits

Author SHA1 Message Date
yootus
299a69cd51 QuantumultX下发Anytls节点 (#880) 
QuantumultX最新版本支持Anytls了，做适配
 2026-04-16 19:31:24 +08:00
xboard
a0f6b324a4 fix: reset traffic stats when copying server nodes 2026-04-11 20:24:43 +08:00
Valentin Lobstein
cf5cece77f Fix: CVE-2026-39912 - Magic link token leak in loginWithMailLink (#873) 
The loginWithMailLink endpoint returns the magic login link in the
HTTP response body, allowing unauthenticated account takeover.

The fix returns true instead of the link. The email delivery is
the authentication factor.

Bug inherited from V2Board commit 9b707aaf (2022-06-27).
 2026-04-10 02:44:20 +08:00
xboard
f7118ab0bd fix: stop sending VLESS decryption when encryption is disabled 2026-04-08 11:05:55 +08:00
yootus
7af8d3be47 Loon和Surfboard适配anytls (#854) 
* Loon适配anytls

* Surfboard适配anytls

Surfboard适配anytls
 2026-04-02 15:47:41 +08:00
NFamou
06ff341290 Merge pull request #856 from NFamou/master 
支持Surfboard下发SS2022
 2026-04-02 15:46:55 +08:00
Xboard
f0af3b6832 Revert "feat: Track user traffic per node (server_id)" 2026-03-30 18:17:27 +08:00
xboard
209e862374 feat: add Vless Encryption support 2026-03-30 17:03:37 +08:00
Xboard
0ea23b24c9 Merge pull request #755 from socksprox/feat/server-id-stat-user 
feat: Track user traffic per node (server_id)
 2026-03-30 13:55:11 +08:00
Xboard
df4e143cf5 Merge pull request #689 from socksprox/fix-user-generation-multiple-prefix 
Fix user generation with email_prefix to support multiple users
 2026-03-30 13:32:46 +08:00
Xboard
da3fa92e6d Merge pull request #786 from lithromantic/master 
Add sha256salt hashing option in password verification
 2026-03-30 13:05:39 +08:00
xboard
1e7fa93f99 feat: node traffic limit & batch operations 
- Traffic monitoring with transfer_enable limit
- Batch delete nodes
- Reset traffic (single/batch)
 2026-03-30 02:50:56 +08:00
xboard
dbfb2f1376 fix: escape Telegram Markdown special characters 2026-03-30 01:46:56 +08:00
xboard
7cd1fb185b Revert "fix: escape Telegram Markdown special characters (fix #450)" 
This reverts commit e10ec47140.
 2026-03-29 17:48:49 +08:00
lithromantic
cafc6902d6 Merge branch 'cedar2025:master' into master 2026-03-29 00:00:34 +01:00
Xboard
ed6ffbd878 Merge pull request #832 from Dlphine/fix/raw-array-access-data-get 
fix: replace raw array access with data_get() to prevent Undefined array key
 2026-03-28 17:38:44 +08:00
xboard
e10ec47140 fix: escape Telegram Markdown special characters (fix #450) 2026-03-28 09:10:54 +08:00
xboard
a8aee3e992 feat: revoke other sessions when changing password (fix #414) 2026-03-28 08:31:24 +08:00
xboard
7af0764031 feat: implement email case-insensitive queries (fix #318) 2026-03-28 07:09:21 +08:00
Dlphine
62981bc2e8 fix: replace raw array access with data_get() to prevent Undefined array key 
- Migrate $protocol_settings['key'] to data_get($protocol_settings, 'key') across General, SingBox, Shadowrocket, Surfboard, QuantumultX
- Prevents PHP 8 Undefined array key fatal errors when optional protocol_settings fields are missing
- Same class of bug that caused #735
 2026-03-27 13:51:28 +08:00
xboard
c8ef04d55f fix: use ServerService::getServer() for node lookup in WebSocket 2026-03-26 03:51:58 +08:00
xboard
b9276470eb fix: resolve device sync issues and refactor WebSocket server 2026-03-26 03:33:01 +08:00
xboard
b487d6c561 refactor: restructure device limit system 2026-03-25 17:50:16 +08:00
xboard
d179f49bbb feat: ws notify nodes when user traffic is exhausted 2026-03-25 01:44:55 +08:00
xboard
8b776b1ea1 feat: Trojan Reality support and protocol distribution optimizations 2026-03-23 14:56:41 +08:00
xboard
f289e48cc5 fix: intval u/d to avoid bigint overflow (#821) 2026-03-22 19:13:07 +08:00
Xboard
75d3b254be Merge pull request #789 from socksprox/feat/or-filter-logic 
feat: Add OR logic support to user fetch API filters
 2026-03-21 07:49:03 +08:00
xboard
8137a11008 feat: Add admin bulk-mail placeholder variables and template rendering 2026-03-19 05:02:16 +08:00
xboard
63f5080006 fix(runtime): force app_url/force_https per-request via middlewar 2026-03-19 04:22:17 +08:00
xboard
287302729f fix: fix brutal-opts configure for clashMeta 2026-03-17 12:26:10 +08:00
xboard
2e4bfe08df feat: Refactor uTLS & Multiplex Support, Node Status Push Optimization 
- Server/ServerSave/Server.php: Unified utls and multiplex schema, validation, and defaults for vmess/vless/trojan/mieru protocols, enabling more flexible protocol configuration.
- Protocols (SingBox/ClashMeta/Shadowrocket/Stash/General): All protocol generators now support utls (client-fingerprint/fp) and multiplex options. Removed getRandFingerprint, replaced with getTlsFingerprint supporting random/custom fingerprints.
- Helper.php: Refactored TLS fingerprint utility to support object/string/random input.
- ServerService: Abstracted updateMetrics method to unify HTTP/WS node status caching logic.
- NodeWebSocketServer: Improved node connection, status push, and full sync logic; adjusted log levels; clarified push logic.
- ServerController: Reused ServerService for node metrics handling, reducing code duplication.
- Docs: Improved aapanel installation docs, added fix for empty admin dashboard.
 2026-03-16 23:09:56 +08:00
xboard
d6986a4493 fix: correct node_sync queue assignment in horizon 2026-03-16 02:28:28 +08:00
xboard
2bc4c98be6 feat(ClashMeta): enhance Shadowsocks plugin support 2026-03-15 11:36:43 +08:00
xboard
3e8284cf70 refactor: rename ws-server command and update configuration 2026-03-15 10:57:21 +08:00
xboard
dbcf90927b fix(ws): enabel unix socket support for redis connection 2026-03-15 10:47:31 +08:00
xboard
ff30088f8a fix: missing ws-server core and update routine 2026-03-15 10:20:42 +08:00
xboard
d92c32fab5 feat: introduce WebSocket sync for XBoard nodes 
- Implement Workerman-based `xboard:ws-server` for real-time node synchronization.
- Support custom routes, outbounds, and certificate configurations via JSON.
- Optimize scheduled tasks with `lazyById` to minimize memory footprint.
- Enhance reactivity using Observers for `Plan`, `Server`, and `ServerRoute`.
- Expand protocol support for `httpupgrade`, `h2`, and `mieru`.
 2026-03-15 09:49:11 +08:00
xboard
90a5065162 refactor: rewrite restoreProtectedPlugins to use file copy instead of git 
- Dockerfile: backup plugins/ to /opt/default-plugins/ at build time
- Replace exec/git-based restore with pure PHP File::copyDirectory()
- Only restore plugins defined in Plugin::PROTECTED_PLUGINS
- Delete target directory before copy to prevent stale files
- Remove function_exists('exec') guard (no longer needed)
 2026-03-11 08:30:12 +08:00
xboard
662e1343d2 feat: add configurable ticket_must_wait_reply setting 2026-03-11 07:31:09 +08:00
xboard
627281f9e6 perf: fix getTrafficRank slow query with index and batch loading 2026-03-11 07:01:19 +08:00
xboard
76edd15186 refactor: replace database logging with file logging and admin audit log 2026-03-11 06:50:07 +08:00
xboard
2b2a51e73b refactor: move subscribe templates to dedicated database table 2026-03-11 05:47:29 +08:00
xboard
ac8283a7bf feat(config): support custom telegram webhook url 2026-03-11 02:50:33 +08:00
xboard
e355f2b61a fix(register): handle invalid invite code as API error (#792) 2026-03-11 02:09:25 +08:00
xboard
b20d12d510 feat(surge): add SS2022, SOCKS5, HTTP support 2026-03-09 07:32:51 +08:00
xboard
48fd340b0b fix: apply device_limit from plan when assigning via gift card (#630) 2026-03-09 06:51:10 +08:00
xboard
6f860c784a fix: return dynamic rate instead of base rate in user server list (#709) 2026-03-09 06:47:30 +08:00
xboard
cadfefbbdd fix: always set uTLS fingerprint for TLS connections in General protocol (#673) 2026-03-09 06:45:28 +08:00
xboard
7ecd549042 fix: validate random_int parameters in Helper::randomPort to prevent min > max error 2026-03-09 06:32:10 +08:00
xboard
6db54d904b fix(stash): correct TCP/HTTP network type handling in node generation 2026-03-09 05:39:51 +08:00