xboard
a0f6b324a4
fix: reset traffic stats when copying server nodes
2026-04-11 20:24:43 +08:00
Valentin Lobstein
cf5cece77f
Fix: CVE-2026-39912 - Magic link token leak in loginWithMailLink ( #873 )
...
The loginWithMailLink endpoint returns the magic login link in the
HTTP response body, allowing unauthenticated account takeover.
The fix returns true instead of the link. The email delivery is
the authentication factor.
Bug inherited from V2Board commit 9b707aaf (2022-06-27).
2026-04-10 02:44:20 +08:00
xboard
9c03a344f9
fix(update): avoid duplicate safe.directory entries for repo and admin submodule
2026-04-09 20:31:19 +08:00
xboard
5f0af1290c
docs: add donation section
2026-04-09 00:21:28 +08:00
xboard
f7118ab0bd
fix: stop sending VLESS decryption when encryption is disabled
2026-04-08 11:05:55 +08:00
yootus
7af8d3be47
Loon和Surfboard适配anytls ( #854 )
...
* Loon适配anytls
* Surfboard适配anytls
Surfboard适配anytls
2026-04-02 15:47:41 +08:00
NFamou
06ff341290
Merge pull request #856 from NFamou/master
...
支持Surfboard下发SS2022
2026-04-02 15:46:55 +08:00
xboard
8e83143721
updata admin asset
2026-04-02 05:51:16 +08:00
Xboard
076370c3d3
Merge pull request #841 from cedar2025/revert-755-feat/server-id-stat-user
...
Revert "feat: Track user traffic per node (server_id)"
2026-03-30 18:18:35 +08:00
Xboard
f0af3b6832
Revert "feat: Track user traffic per node (server_id)"
2026-03-30 18:17:27 +08:00
xboard
8ebc9e76d0
Remove duplicate doc files
2026-03-30 18:04:41 +08:00
xboard
de7701066c
fix: remove 2026_03_28_050000_lowercase_existing_emails.php
2026-03-30 17:59:39 +08:00
xboard
209e862374
feat: add Vless Encryption support
2026-03-30 17:03:37 +08:00
Xboard
0ea23b24c9
Merge pull request #755 from socksprox/feat/server-id-stat-user
...
feat: Track user traffic per node (server_id)
2026-03-30 13:55:11 +08:00
Xboard
df4e143cf5
Merge pull request #689 from socksprox/fix-user-generation-multiple-prefix
...
Fix user generation with email_prefix to support multiple users
2026-03-30 13:32:46 +08:00
Xboard
da3fa92e6d
Merge pull request #786 from lithromantic/master
...
Add sha256salt hashing option in password verification
2026-03-30 13:05:39 +08:00
xboard
22a5b2b03c
update 2026_03_28_161536_add_traffic_fields_to_servers.php
2026-03-30 02:58:09 +08:00
xboard
1e7fa93f99
feat: node traffic limit & batch operations
...
- Traffic monitoring with transfer_enable limit
- Batch delete nodes
- Reset traffic (single/batch)
2026-03-30 02:50:56 +08:00
xboard
dbfb2f1376
fix: escape Telegram Markdown special characters
2026-03-30 01:46:56 +08:00
xboard
7cd1fb185b
Revert "fix: escape Telegram Markdown special characters ( fix #450 )"
...
This reverts commit e10ec47140
2026-03-29 17:48:49 +08:00
lithromantic
cafc6902d6
Merge branch 'cedar2025:master' into master
2026-03-29 00:00:34 +01:00
Xboard
ed6ffbd878
Merge pull request #832 from Dlphine/fix/raw-array-access-data-get
...
fix: replace raw array access with data_get() to prevent Undefined array key
2026-03-28 17:38:44 +08:00
xboard
457dfeb0e9
fix: use getHost() for proper host comparison in safe mode
2026-03-28 15:52:25 +08:00
xboard
e10ec47140
fix: escape Telegram Markdown special characters ( fix #450 )
2026-03-28 09:10:54 +08:00
xboard
a8aee3e992
feat: revoke other sessions when changing password ( fix #414 )
2026-03-28 08:31:24 +08:00
xboard
a2ffaf2ac8
fix: add ru-RU.json
2026-03-28 07:44:43 +08:00
xboard
b19ae5c581
fix: iOS Safari autofill not filling email field ( Fixes #330 )
2026-03-28 07:41:57 +08:00
xboard
7af0764031
feat: implement email case-insensitive queries ( fix #318 )
2026-03-28 07:09:21 +08:00
Dlphine
62981bc2e8
fix: replace raw array access with data_get() to prevent Undefined array key
...
- Migrate $protocol_settings['key'] to data_get($protocol_settings, 'key') across General, SingBox, Shadowrocket, Surfboard, QuantumultX
- Prevents PHP 8 Undefined array key fatal errors when optional protocol_settings fields are missing
- Same class of bug that caused #735
2026-03-27 13:51:28 +08:00
xboard
3659d9f784
feat: add Russian language support and remove v2board theme
2026-03-26 23:35:30 +08:00
xboard
c8ef04d55f
fix: use ServerService::getServer() for node lookup in WebSocket
2026-03-26 03:51:58 +08:00
xboard
b9276470eb
fix: resolve device sync issues and refactor WebSocket server
2026-03-26 03:33:01 +08:00
xboard
b487d6c561
refactor: restructure device limit system
2026-03-25 17:50:16 +08:00
xboard
d179f49bbb
feat: ws notify nodes when user traffic is exhausted
2026-03-25 01:44:55 +08:00
xboard
8b776b1ea1
feat: Trojan Reality support and protocol distribution optimizations
2026-03-23 14:56:41 +08:00
xboard
8c8c55e2bc
update admin assets submodule
2026-03-23 11:00:31 +08:00
xboard
f289e48cc5
fix: intval u/d to avoid bigint overflow ( #821 )
2026-03-22 19:13:07 +08:00
Xboard
75d3b254be
Merge pull request #789 from socksprox/feat/or-filter-logic
...
feat: Add OR logic support to user fetch API filters
2026-03-21 07:49:03 +08:00
xboard
8137a11008
feat: Add admin bulk-mail placeholder variables and template rendering
2026-03-19 05:02:16 +08:00
xboard
63f5080006
fix(runtime): force app_url/force_https per-request via middlewar
2026-03-19 04:22:17 +08:00
xboard
656539963f
fix(compose): use named volume for redis socket
2026-03-17 22:50:29 +08:00
xboard
4628a3bc62
fix(admin): fix giftcard form validation and template creation issues
2026-03-17 18:35:21 +08:00
xboard
64f78599e9
fix(admin): fix node manage tooltip error
2026-03-17 14:13:48 +08:00
Xboard
e6a2b9facc
Add port mapping for 1panel service
2026-03-17 13:16:43 +08:00
xboard
287302729f
fix: fix brutal-opts configure for clashMeta
2026-03-17 12:26:10 +08:00
xboard
da84eec1b8
fix(admin): resolve translation key issues
2026-03-17 11:44:17 +08:00
xboard
57a81046ff
fix:Fix DynamicForm default value sync, payment unit conversion, advanced config tabs, AnyTLS translation, and UI overlap issues. Fixed #807
2026-03-17 03:21:27 +08:00
Xboard
bb91062911
Add ws-server service configuration to 1panel.md
2026-03-17 02:36:21 +08:00
xboard
6b1256d88f
fix(admin): fix order assign
2026-03-17 00:54:26 +08:00
xboard
2e4bfe08df
feat: Refactor uTLS & Multiplex Support, Node Status Push Optimization
...
- Server/ServerSave/Server.php: Unified utls and multiplex schema, validation, and defaults for vmess/vless/trojan/mieru protocols, enabling more flexible protocol configuration.
- Protocols (SingBox/ClashMeta/Shadowrocket/Stash/General): All protocol generators now support utls (client-fingerprint/fp) and multiplex options. Removed getRandFingerprint, replaced with getTlsFingerprint supporting random/custom fingerprints.
- Helper.php: Refactored TLS fingerprint utility to support object/string/random input.
- ServerService: Abstracted updateMetrics method to unify HTTP/WS node status caching logic.
- NodeWebSocketServer: Improved node connection, status push, and full sync logic; adjusted log levels; clarified push logic.
- ServerController: Reused ServerService for node metrics handling, reducing code duplication.
- Docs: Improved aapanel installation docs, added fix for empty admin dashboard.
2026-03-16 23:09:56 +08:00
