pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-02 19:25:05 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(frontend): keep node-reported values one URL path segment

Browse Source 
InboundInfoModal put a client's email into /panel/api/clients/ips and
clearIps unencoded, and the host mutations did the same with a host
group id. Both values reach the master from a node's sync without the
panel's own character rules, so "../" and "?" in them chose the route
and query of the admin's authenticated POST; the IP-log request fires as
soon as the window opens. Encode them as every other client route in
the SPA already does.
This commit is contained in:
MHSanaei
2026-11-01 00:08:35 +01:00
parent daf5b16eda
commit d3df3e9ea7
3 changed files with 79 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/pages/inbounds/info/InboundInfoModal.tsx
+8 -3
View File
@@ -69,7 +69,9 @@ export default function InboundInfoModal({
if (!clientStats?.email) return;
setRefreshing(true);
try {
const msg = await HttpUtil.post(`/panel/api/clients/ips/${clientStats.email}`);
const msg = await HttpUtil.post(
`/panel/api/clients/ips/${encodeURIComponent(clientStats.email)}`,
);
if (!msg?.success) {
setClientIpsText((msg?.obj as string) || 'No IP record');
setClientIpsArray([]);
@@ -101,7 +103,9 @@ export default function InboundInfoModal({
const clearClientIps = useCallback(async () => {
if (!clientStats?.email) return;
const msg = await HttpUtil.post(`/panel/api/clients/clearIps/${clientStats.email}`);
const msg = await HttpUtil.post(
`/panel/api/clients/clearIps/${encodeURIComponent(clientStats.email)}`,
);
if (msg?.success) {
setClientIpsArray([]);
setClientIpsText(t('tgbot.noIpRecord'));
@@ -223,7 +227,8 @@ export default function InboundInfoModal({
setClientIpsText('');
if (ipLimitEnable && (clientSet?.limitIp ?? 0) > 0 && stats?.email) {
void HttpUtil.post(`/panel/api/clients/ips/${stats.email}`).then((msg) => {
const email = encodeURIComponent(stats.email);
void HttpUtil.post(`/panel/api/clients/ips/${email}`).then((msg) => {
if (!msg?.success) {
setClientIpsText((msg?.obj as string) || 'No IP record');
return;