mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-09-27 01:32:08 +03:00
sdhfsl
a2ca023336
* fix(panel): accept 2FA codes from adjacent TOTP windows CheckUser compared only gotp.Now(), so a code submitted at the end of its 30s window (or with slight client/server clock drift) failed with 'invalid 2fa code', while the immediate retry in the next window succeeded. Accept current +/-1 window, the standard TOTP skew tolerance. Fixes MHSanaei/3x-ui#6535 * fix(panel): share TOTP skew tolerance with VerifyTwoFactorCode Move the +/-1 window helper to internal/util/totp so both 2FA acceptance points use it: login (CheckUser) and disable/rebind plus username/password changes (VerifyTwoFactorCode). Also shrink comments to the 2-line house rule and anchor the unit test mid-window to avoid a step-boundary flake. Addresses review on #6546 (MEDIUM + 2 LOWs). * fix(sub): send panel guid as X-HWID on outbound subscription fetch Outbound subscriptions hit the same HWID-limited donor 404 as client external links (#6559/#6567). Identify this panel with GetPanelGuid plus X-Device-OS, honoring the externalSubSendHwid opt-out. Fixes MHSanaei/3x-ui#6574 * fix(sub): send the external-subscription X-HWID from outbound fetches too The outbound fetch used panelGuid while client external links send the externalSubHwid id from #6567, so an HWID-limited provider counted one panel as two devices. It also re-added the externalSubSendHwid opt-out that #6567 dropped. Move the id into service.ExternalSubscriptionHwid, keeping the externalSubHwid row so existing installs keep their slot, and send it from both paths. The outbound test now fails on the panelGuid version. --------- Co-authored-by: sdhfsl <sdhfsl@users.noreply.github.com> Co-authored-by: MHSanaei <ho3ein.sanaei@gmail.com>
61 lines
1.8 KiB
Go
61 lines
1.8 KiB
Go
package service
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database"
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
|
)
|
|
|
|
// #6574: an outbound subscription fetch must send the id client external links
|
|
// already send (#6559), or an HWID-limited provider counts the panel twice.
|
|
func TestOutboundFetchSendsExternalSubscriptionHwid(t *testing.T) {
|
|
setupSettingTestDB(t)
|
|
|
|
var gotHwid string
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
gotHwid = r.Header.Get("X-HWID")
|
|
_, _ = w.Write([]byte("outbounds:\n"))
|
|
}))
|
|
defer srv.Close()
|
|
|
|
svc := NewOutboundSubscriptionService()
|
|
sub, err := svc.Create("hwid-test", srv.URL, "", "", true, 3600, true, false, false)
|
|
if err != nil {
|
|
t.Fatalf("create: %v", err)
|
|
}
|
|
t.Cleanup(func() { _ = svc.Delete(sub.Id) })
|
|
|
|
if _, err := svc.Refresh(sub.Id); err != nil {
|
|
t.Fatalf("refresh: %v", err)
|
|
}
|
|
var row model.Setting
|
|
if err := database.GetDB().Where("key = ?", "externalSubHwid").First(&row).Error; err != nil {
|
|
t.Fatalf("no persisted externalSubHwid after the fetch: %v", err)
|
|
}
|
|
if gotHwid == "" || gotHwid != row.Value {
|
|
t.Fatalf("X-HWID = %q, want the persisted externalSubHwid %q", gotHwid, row.Value)
|
|
}
|
|
}
|
|
|
|
func TestExternalSubscriptionHwidIsStableAndPersisted(t *testing.T) {
|
|
setupSettingTestDB(t)
|
|
|
|
first := ExternalSubscriptionHwid()
|
|
if first == "" {
|
|
t.Fatal("ExternalSubscriptionHwid returned empty")
|
|
}
|
|
if second := ExternalSubscriptionHwid(); second != first {
|
|
t.Fatalf("hwid not stable: %q vs %q", first, second)
|
|
}
|
|
var row model.Setting
|
|
if err := database.GetDB().Where("key = ?", "externalSubHwid").First(&row).Error; err != nil {
|
|
t.Fatalf("hwid not persisted: %v", err)
|
|
}
|
|
if row.Value != first {
|
|
t.Fatalf("persisted hwid %q != returned %q", row.Value, first)
|
|
}
|
|
}
|