From 35b5e0989a12f31a0aec81f08039fdbec4166cf5 Mon Sep 17 00:00:00 2001 From: MHSanaei Date: Wed, 14 Oct 2026 17:10:02 +0200 Subject: [PATCH] fix(sponsor): fetch sponsor data from raw.githubusercontent.com The server-side fetch used sponsors.sanaei.dev, a hostname unique to 3x-ui. Without ECH it travels in plaintext SNI, so an on-path observer could tag a server as running the panel from that one connection. raw.githubusercontent.com is shared by countless tools and reveals nothing. The path stays inside TLS. The data source is unchanged: the same MHSanaei/sponsors repo. Refs #6824 --- internal/web/service/panel/sponsor.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/web/service/panel/sponsor.go b/internal/web/service/panel/sponsor.go index d8e6c4ad1..0df1d46db 100644 --- a/internal/web/service/panel/sponsor.go +++ b/internal/web/service/panel/sponsor.go @@ -60,8 +60,8 @@ type sponsorLogo struct { } var ( - sponsorsURL = "https://sponsors.sanaei.dev/3X/sponsors.json" - sponsorLogoBase = "https://sponsors.sanaei.dev/3X/logos/" + sponsorsURL = "https://raw.githubusercontent.com/MHSanaei/sponsors/refs/heads/main/3X/sponsors.json" + sponsorLogoBase = "https://raw.githubusercontent.com/MHSanaei/sponsors/refs/heads/main/3X/logos/" sponsorNow = time.Now // The panel proxies logos from sponsorLogoBase: CSP stays 'self' and no third party sees admin IPs.