pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-01 11:42:07 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(sub): never use X-Real-IP as the subscription host (#6608)

Browse Source 
ResolveRequest and the panel's resolveHost fell back to X-Real-IP for the host when a trusted proxy sent no X-Forwarded-Host. X-Real-IP names the visitor, so behind nginx with only that header set, subscription and exported links advertised the subscriber's own public IP as the server.

The host now comes from a trusted X-Forwarded-Host, else the dialed request Host. X-Real-IP stays a client-IP source only.

Fixes #6589.
This commit is contained in:
mrchatam
2026-09-26 22:43:46 +03:30
committed by GitHub
parent 66df77665f
commit 169cd86e00
4 changed files with 54 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/controller/inbound.go
+2 -8
View File
@@ -442,11 +442,8 @@ func (a *InboundController) importInbound(c *gin.Context) {
notifyClientsChanged()
}
// resolveHost mirrors what sub.SubService.ResolveRequest does for the host
// field: prefers X-Forwarded-Host (first entry of any list, port stripped),
// then X-Real-IP, then the host portion of c.Request.Host. Keeping it in the
// controller layer means the service interface stays HTTP-agnostic — service
// methods receive a plain host string instead of a *gin.Context.
// resolveHost mirrors SubService.ResolveRequest's host: trusted X-Forwarded-Host,
// else the dialed request Host. X-Real-IP names the visitor, not the panel (#6589).
func resolveHost(c *gin.Context) string {
if isTrustedForwardedRequest(c) {
if h := strings.TrimSpace(c.GetHeader("X-Forwarded-Host")); h != "" {
@@ -458,9 +455,6 @@ func resolveHost(c *gin.Context) string {
}
return h
}
if h := c.GetHeader("X-Real-IP"); h != "" {
return h
}
}
if h, _, err := net.SplitHostPort(c.Request.Host); err == nil {
return h