MHSanaei b1108a9e81 fix(web): match the WebSocket origin on scheme and port, not only host ...

The live-update socket accepted any Origin whose host name matched, but
cookies do not separate ports or schemes, so a page served by another
service on the same host name could open it with the admin's session.
Only http(s) origins are accepted now (https when the panel terminates
TLS itself), and the port must match whenever the Host header has one.

2026-10-31 09:06:41 +00:00

..

api_auth_test.go

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

api.go

fix(middleware): log rejected CSRF requests with the trusted client address (#6692)

2026-10-24 04:51:21 +02:00

base.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_happ_test.go

feat(happ): generate Crypt5 subscription links locally (#6494)

2026-09-13 12:44:55 +02:00

client_lookup_test.go

feat(api): add client lookup by subscription ID (#6908)

2026-10-24 04:54:14 +02:00

client_partial_apply_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

client_renewal_preview_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

client.go

feat(api): add client lookup by subscription ID (#6908)

2026-10-24 04:54:14 +02:00

csrf_log_test.go

fix(web): refuse oversized login usernames before recording them

2026-10-31 09:04:27 +00:00

dist_test.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

dist.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

geodata_test.go

feat(xray): browse geosite/geoip categories from routing rules (#6165)

2026-08-15 17:12:59 +02:00

group.go

fix(groups): report changed bulk moves without restarting xray (#6199)

2026-08-14 19:50:06 +02:00

host_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

host.go

feat(clients): bind host rules to individual clients in subscriptions (#6620)

2026-10-24 12:33:02 +02:00

import_db_restart_test.go

fix(web): restart panel after ImportDB so subPath routes match (#6446) (#6456)

2026-09-13 21:39:15 +02:00

inbound_node_sync_test.go

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

inbound.go

feat(amneziawg): add opt-in Linux kernel datapath (#6877)

2026-10-25 13:24:50 +01:00

index.go

fix(web): refuse oversized login usernames before recording them

2026-10-31 09:04:27 +00:00

login_limiter_test.go

fix(web): count login attempts per address and while they are checked

2026-10-31 09:04:23 +00:00

login_limiter.go

fix(web): count login attempts per address and while they are checked

2026-10-31 09:04:23 +00:00

node_credentials_writeonly_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

node.go

fix(nodes): apply a rotated master mTLS certificate without restarting the panel (#6194)

2026-08-15 16:03:42 +02:00

panel_update_test.go

fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)

2026-07-02 18:19:33 +02:00

pwa_test.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

pwa.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

server.go

fix(server): apply the outbound address policy to remote cert pinning

2026-10-03 13:20:00 +02:00

setting_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

setting.go

feat(tgbot): rebuild the Telegram bot around editable screens and inline lists (#6760)

2026-10-24 12:39:56 +02:00

spa_test.go

fix(web): serve panel SPA routes from NoRoute (#5536)

2026-06-24 21:19:12 +02:00

spa.go

fix(middleware): log rejected CSRF requests with the trusted client address (#6692)

2026-10-24 04:51:21 +02:00

sub_balancer_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

sub_balancer.go

feat(sub): leastLoad member weights for subscription balancers (#6304)

2026-09-02 20:21:27 +02:00

util_test.go

fix(web): read the client address from the proxy end of forwarded headers

2026-10-24 01:39:23 +02:00

util.go

fix(web): read the client address from the proxy end of forwarded headers

2026-10-24 01:39:23 +02:00

websocket_test.go

fix(web): match the WebSocket origin on scheme and port, not only host

2026-10-31 09:06:41 +00:00

websocket.go

fix(web): match the WebSocket origin on scheme and port, not only host

2026-10-31 09:06:41 +00:00

xray_setting_warp_test.go

fix(outbound): store subscription refreshes without trusting the row read

2026-10-31 08:31:03 +00:00

xray_setting.go

fix(outbound): store subscription refreshes without trusting the row read

2026-10-31 08:31:03 +00:00