tom/dpl
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
682 Commits 8 Branches 0 Tags 77 MiB
7622b49cb3
Commit Graph

118 Commits

Author SHA1 Message Date
hellcat
6c9422d055 Add authenticated Telegram ticket replies and notification tracking 2026-10-11 11:58:19 +08:00
hellcat
ad42a0e1e7 feat(mail): add Resend delivery, inbox replies and notification tiers 2026-10-10 18:53:35 +08:00
xboard
4f48e61a2c fix(order): prevent duplicate refunds and redemptions 
Refs #1021
 2026-08-30 04:50:34 +08:00
asukassa
9d125527cb
fix: reindex device IP array before JSON encoding (#1045) 2026-08-30 01:07:37 +08:00
yootus
c9ef5768e0 fix(order): calculate invitation commission after balance deduction (#1020) 
Calculate invitation commission from the amount remaining after balance deductions, preventing duplicate commission on internally credited payments.
 2026-08-30 00:39:20 +08:00
socksprox
34bb1fdbcf Rename v2_order.refund_amount to surplus_credit (#967) 
The old name was misleading — this column tracks surplus credit returned
to the user's internal balance during plan upgrades, not a payment
gateway refund. The new name aligns with the existing surplus_amount
and surplus_order_ids naming convention.

Co-authored-by: socksprox <info@shadowfly.net>
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-02 11:49:58 +08:00
xboard
4e9dfd6018 fix(security): harden registration email code validation 2026-05-22 22:05:33 +08:00
xboard
1eb085d4c0 fix(security): harden password reset email code validation 2026-05-22 21:52:34 +08:00
xboard
0fa4b4e0fc fix(security): prevent payment gateway credentials leakage via OrderResource 2026-04-23 10:26:35 +08:00
xboard
a9cae6dc19 refactor: core plugins to plugins-core 2026-04-18 23:31:59 +08:00
xboard
4431641197 fix: unify Trojan server_name/allow_insecure to tls_settings across all protocols 2026-04-18 21:00:21 +08:00
xboard
8131bf4748 fix: ticket reply_status semantics, N+1 query, and admin reply auto-reopen 2026-04-18 16:40:21 +08:00
xboard
d406e440a7 feat: email template management with DB override, modern mail redesign 2026-04-18 15:41:23 +08:00
xboard
f5ff15e415 fix: dedup device IPs, reset stale online_count on disconnect and scheduled cleanup (#886) 2026-04-18 02:57:55 +08:00
xboard
8e35be3097 fix(plugin): improve plugin install and uninstall migration handling 2026-04-17 23:11:03 +08:00
xboard
6796b70179 feat: machine mode, ECH subscriptions, batch ops & security hardening 2026-04-17 03:02:53 +08:00
Valentin Lobstein
cf5cece77f Fix: CVE-2026-39912 - Magic link token leak in loginWithMailLink (#873) 
The loginWithMailLink endpoint returns the magic login link in the
HTTP response body, allowing unauthenticated account takeover.

The fix returns true instead of the link. The email delivery is
the authentication factor.

Bug inherited from V2Board commit 9b707aaf (2022-06-27).
 2026-04-10 02:44:20 +08:00
xboard
f7118ab0bd fix: stop sending VLESS decryption when encryption is disabled 2026-04-08 11:05:55 +08:00
xboard
209e862374 feat: add Vless Encryption support 2026-03-30 17:03:37 +08:00
xboard
1e7fa93f99 feat: node traffic limit & batch operations 
- Traffic monitoring with transfer_enable limit
- Batch delete nodes
- Reset traffic (single/batch)
 2026-03-30 02:50:56 +08:00
xboard
7cd1fb185b Revert "fix: escape Telegram Markdown special characters (fix #450)" 
This reverts commit e10ec47140.
 2026-03-29 17:48:49 +08:00
xboard
e10ec47140 fix: escape Telegram Markdown special characters (fix #450) 2026-03-28 09:10:54 +08:00
xboard
7af0764031 feat: implement email case-insensitive queries (fix #318) 2026-03-28 07:09:21 +08:00
xboard
c8ef04d55f fix: use ServerService::getServer() for node lookup in WebSocket 2026-03-26 03:51:58 +08:00
xboard
b9276470eb fix: resolve device sync issues and refactor WebSocket server 2026-03-26 03:33:01 +08:00
xboard
b487d6c561 refactor: restructure device limit system 2026-03-25 17:50:16 +08:00
xboard
d179f49bbb feat: ws notify nodes when user traffic is exhausted 2026-03-25 01:44:55 +08:00
xboard
8b776b1ea1 feat: Trojan Reality support and protocol distribution optimizations 2026-03-23 14:56:41 +08:00
xboard
8137a11008 feat: Add admin bulk-mail placeholder variables and template rendering 2026-03-19 05:02:16 +08:00
xboard
63f5080006 fix(runtime): force app_url/force_https per-request via middlewar 2026-03-19 04:22:17 +08:00
xboard
2e4bfe08df feat: Refactor uTLS & Multiplex Support, Node Status Push Optimization 
- Server/ServerSave/Server.php: Unified utls and multiplex schema, validation, and defaults for vmess/vless/trojan/mieru protocols, enabling more flexible protocol configuration.
- Protocols (SingBox/ClashMeta/Shadowrocket/Stash/General): All protocol generators now support utls (client-fingerprint/fp) and multiplex options. Removed getRandFingerprint, replaced with getTlsFingerprint supporting random/custom fingerprints.
- Helper.php: Refactored TLS fingerprint utility to support object/string/random input.
- ServerService: Abstracted updateMetrics method to unify HTTP/WS node status caching logic.
- NodeWebSocketServer: Improved node connection, status push, and full sync logic; adjusted log levels; clarified push logic.
- ServerController: Reused ServerService for node metrics handling, reducing code duplication.
- Docs: Improved aapanel installation docs, added fix for empty admin dashboard.
 2026-03-16 23:09:56 +08:00
xboard
d92c32fab5 feat: introduce WebSocket sync for XBoard nodes 
- Implement Workerman-based `xboard:ws-server` for real-time node synchronization.
- Support custom routes, outbounds, and certificate configurations via JSON.
- Optimize scheduled tasks with `lazyById` to minimize memory footprint.
- Enhance reactivity using Observers for `Plan`, `Server`, and `ServerRoute`.
- Expand protocol support for `httpupgrade`, `h2`, and `mieru`.
 2026-03-15 09:49:11 +08:00
xboard
e355f2b61a fix(register): handle invalid invite code as API error (#792) 2026-03-11 02:09:25 +08:00
xboard
48fd340b0b fix: apply device_limit from plan when assigning via gift card (#630) 2026-03-09 06:51:10 +08:00
xboard
6f860c784a fix: return dynamic rate instead of base rate in user server list (#709) 2026-03-09 06:47:30 +08:00
Xboard
8d5ead43ac Merge pull request #734 from kelly5454/master 
fix: Type error when redeeming gift card
 2026-03-09 04:56:14 +08:00
xboard
7801a0fb19 feat: add v2node support 2025-11-22 20:33:38 +08:00
xboard
af431d178e fix: preserve theme config when upgrading theme 2025-11-07 19:25:40 +08:00
kelly5454
e26677813c fix: exchange gift card type error 2025-10-30 21:08:39 +08:00
xboard
fc685ae9b5 feat(plugin): auto-decode JSON config values by type in PluginManager 2025-10-20 18:56:44 +08:00
xboard
245ddc56e7 fix: avoid getCurrentCommit on cache hit 2025-09-26 19:04:17 +08:00
xboard
8176afb073 fix(plugin): remove stale plugin records when files missing; adjust logging 2025-09-23 14:59:22 +08:00
xboard
471ec94ae3 fix 2025-09-16 18:44:44 +08:00
xboard
371fd791ac fix: improve date calculation for month-end reset schedules 2025-08-31 20:30:02 +08:00
Miku
69637949ce fix(order): correct renewal handling for onetime plan 
fixes onetime plan renewal logic
 2025-08-29 23:24:48 +08:00
xboard
4f7f3d7168 feat: optimize server.user.get hook definition 2025-08-29 19:21:49 +08:00
xboard
72ead1cf8f fix: support resources/views directory for plugin views 2025-08-23 15:26:09 +08:00
xboard
95c5a6e94c fix(auth): handle null redirect in quick login url 2025-08-21 18:57:19 +08:00
xboard
adc8b61359 fix: fix user expiration date display and update issues 
- Fix 1970 year display for unlimited validity users
- Resolve SQL error in user update endpoint
- Closes #625
 2025-08-08 03:04:44 +08:00
xboard
fe4f8d5875 fix: change user default_at to 0 2025-07-27 08:11:42 +08:00