tom/dpl
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
673 Commits 8 Branches 0 Tags 77 MiB
30645f96d5
Commit Graph

382 Commits

Author SHA1 Message Date
hellcat
966a8b2c32 feat(admin): integrate mail flow controls into email settings page 2026-10-11 09:48:58 +08:00
hellcat
ad42a0e1e7 feat(mail): add Resend delivery, inbox replies and notification tiers 2026-10-10 18:53:35 +08:00
hellcat
cd117604a3 feat: add branded tutorials and display-only plan device settings 2026-10-08 18:01:02 +08:00
xboard
4f48e61a2c fix(order): prevent duplicate refunds and redemptions 
Refs #1021
 2026-08-30 04:50:34 +08:00
asukassa
9d125527cb
fix: reindex device IP array before JSON encoding (#1045) 2026-08-30 01:07:37 +08:00
JW-3154
e074bef702
fix(Shadowrocket.php): add missing bandwidth params for Hysteria2 (#1031) 
* fix(Shadowrocket): add missing bandwidth params for Hysteria2

Fixes a critical issue where Hysteria 2 silently downgrades to non-Brutal congestion control (BBR/Reno) on Shadowrocket clients.

* Refactor bandwidth parameters assignment

Update bandwidth parameters to only include positive values.

---------

Co-authored-by: Xboard <147830212+cedar2025@users.noreply.github.com>
 2026-08-30 00:55:14 +08:00
yootus
c9ef5768e0 fix(order): calculate invitation commission after balance deduction (#1020) 
Calculate invitation commission from the amount remaining after balance deductions, preventing duplicate commission on internally credited payments.
 2026-08-30 00:39:20 +08:00
JW-3154
60ba57142b
fix (General.php): VLESS parsing issue (#1017) 
Replace urlencode with rawurlencode to prevent spaces from being improperly converted to '+' in node names (e.g., 'HKG 01' becoming 'HKG+01'). 

A tiny one-line change that significantly improves the UX.
 2026-08-07 21:44:44 +08:00
JW-3154
6141430a88 Fix TUIC congestion control at Shadowrocket.php (#968) 
Fixes an issue where the TUIC congestion_control parameter was not being passed to clients on Shadowrocket. This PR adds the missing parameter to the URL query string, fetching it from $protocol_settings with a default and safe fallback to 'cubic', ensuring panel configurations are properly respected by the client.
 2026-06-06 11:11:01 +08:00
socksprox
34bb1fdbcf Rename v2_order.refund_amount to surplus_credit (#967) 
The old name was misleading — this column tracks surplus credit returned
to the user's internal balance during plan upgrades, not a payment
gateway refund. The new name aligns with the existing surplus_amount
and surplus_order_ids naming convention.

Co-authored-by: socksprox <info@shadowfly.net>
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-02 11:49:58 +08:00
xboard
8f66a9af94 feat: add admin user plugin hooks 
Added hooks:

- admin.user.fetch.query

- admin.user.transform

- admin.user.detail

- admin.user.update.rules

- admin.user.update.messages

- admin.user.update.params

- admin.user.update.before

- admin.user.update.after

- admin.user.secret.reset

- admin.user.destroy.before

- admin.user.destroy.after
 2026-05-26 02:23:23 +08:00
xboard
4e9dfd6018 fix(security): harden registration email code validation 2026-05-22 22:05:33 +08:00
xboard
1eb085d4c0 fix(security): harden password reset email code validation 2026-05-22 21:52:34 +08:00
socksprox
f2ac5db4bd feat(sing-box): include/exclude outbound tags with safe regex and fallback (#916) 
- Add optional include/exclude patterns on selector/urltest outbounds (stripped before client)
- Safe preg_match: bare patterns use ~ delimiter with escape; delimited regex supported; invalid patterns logged, no throw
- Add fallback when filtering yields empty outbounds (string or ordered list: exact tag or pattern)
- Prevents broken routing when dynamic node sets match no filter

Made-with: Cursor

Co-authored-by: socksprox <info@shadowfly.net>
 2026-05-03 10:06:30 +08:00
xboard
3b0b42c51d refactor(middleware): split V2 server middleware to drop node_type 2026-04-23 19:24:34 +08:00
xboard
0fa4b4e0fc fix(security): prevent payment gateway credentials leakage via OrderResource 2026-04-23 10:26:35 +08:00
xboard
66861500c3 fix(deploy): make install/update redis-independent and clean stale octane state 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-04-19 23:23:27 +08:00
xboard
3f82b00972 refactor: all-in-one docker deployment with auto-tuned resources and per-mode compose templates 2026-04-19 21:18:15 +08:00
xboard
135164056a fix: restore stripped protocol_settings fields for tuic/mieru/vmess 2026-04-19 00:45:47 +08:00
xboard
a9cae6dc19 refactor: core plugins to plugins-core 2026-04-18 23:31:59 +08:00
xboard
4431641197 fix: unify Trojan server_name/allow_insecure to tls_settings across all protocols 2026-04-18 21:00:21 +08:00
xboard
e0f41257db feat(admin): batch node-machine binding & frontend update 2026-04-18 19:38:31 +08:00
xboard
8131bf4748 fix: ticket reply_status semantics, N+1 query, and admin reply auto-reopen 2026-04-18 16:40:21 +08:00
xboard
775590dc21 fix: Shadowrocket Trojan whitelist bug and xhttp support 2026-04-18 16:07:22 +08:00
xboard
d406e440a7 feat: email template management with DB override, modern mail redesign 2026-04-18 15:41:23 +08:00
xboard
a7fae4cc6d fix: batchUpdate use model instance to trigger observer 2026-04-18 04:26:25 +08:00
xboard
f5ff15e415 fix: dedup device IPs, reset stale online_count on disconnect and scheduled cleanup (#886) 2026-04-18 02:57:55 +08:00
xboard
7652882fe5 feat: add xhttp subscriptions, network monitoring, chart legend toggle and ticket sender labels 2026-04-18 02:02:06 +08:00
xboard
8e35be3097 fix(plugin): improve plugin install and uninstall migration handling 2026-04-17 23:11:03 +08:00
xboard
b9f3bc29dc fix: support both GET and POST for handshake endpoint (backward compatibility) 2026-04-17 20:59:48 +08:00
Xboard
2671cd3f2d Update installer URL to use 'dev' branch 2026-04-17 12:54:22 +08:00
xboard
83b43e8664 feat: show install command on machine creation 2026-04-17 06:47:05 +08:00
xboard
6796b70179 feat: machine mode, ECH subscriptions, batch ops & security hardening 2026-04-17 03:02:53 +08:00
yootus
299a69cd51 QuantumultX下发Anytls节点 (#880) 
QuantumultX最新版本支持Anytls了，做适配
 2026-04-16 19:31:24 +08:00
xboard
a0f6b324a4 fix: reset traffic stats when copying server nodes 2026-04-11 20:24:43 +08:00
Valentin Lobstein
cf5cece77f Fix: CVE-2026-39912 - Magic link token leak in loginWithMailLink (#873) 
The loginWithMailLink endpoint returns the magic login link in the
HTTP response body, allowing unauthenticated account takeover.

The fix returns true instead of the link. The email delivery is
the authentication factor.

Bug inherited from V2Board commit 9b707aaf (2022-06-27).
 2026-04-10 02:44:20 +08:00
xboard
f7118ab0bd fix: stop sending VLESS decryption when encryption is disabled 2026-04-08 11:05:55 +08:00
yootus
7af8d3be47 Loon和Surfboard适配anytls (#854) 
* Loon适配anytls

* Surfboard适配anytls

Surfboard适配anytls
 2026-04-02 15:47:41 +08:00
NFamou
06ff341290 Merge pull request #856 from NFamou/master 
支持Surfboard下发SS2022
 2026-04-02 15:46:55 +08:00
Xboard
f0af3b6832 Revert "feat: Track user traffic per node (server_id)" 2026-03-30 18:17:27 +08:00
xboard
209e862374 feat: add Vless Encryption support 2026-03-30 17:03:37 +08:00
Xboard
0ea23b24c9 Merge pull request #755 from socksprox/feat/server-id-stat-user 
feat: Track user traffic per node (server_id)
 2026-03-30 13:55:11 +08:00
Xboard
df4e143cf5 Merge pull request #689 from socksprox/fix-user-generation-multiple-prefix 
Fix user generation with email_prefix to support multiple users
 2026-03-30 13:32:46 +08:00
Xboard
da3fa92e6d Merge pull request #786 from lithromantic/master 
Add sha256salt hashing option in password verification
 2026-03-30 13:05:39 +08:00
xboard
1e7fa93f99 feat: node traffic limit & batch operations 
- Traffic monitoring with transfer_enable limit
- Batch delete nodes
- Reset traffic (single/batch)
 2026-03-30 02:50:56 +08:00
xboard
dbfb2f1376 fix: escape Telegram Markdown special characters 2026-03-30 01:46:56 +08:00
xboard
7cd1fb185b Revert "fix: escape Telegram Markdown special characters (fix #450)" 
This reverts commit e10ec47140.
 2026-03-29 17:48:49 +08:00
lithromantic
cafc6902d6 Merge branch 'cedar2025:master' into master 2026-03-29 00:00:34 +01:00
Xboard
ed6ffbd878 Merge pull request #832 from Dlphine/fix/raw-array-access-data-get 
fix: replace raw array access with data_get() to prevent Undefined array key
 2026-03-28 17:38:44 +08:00
xboard
e10ec47140 fix: escape Telegram Markdown special characters (fix #450) 2026-03-28 09:10:54 +08:00