mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-11-06 05:05:01 +03:00
d3df3e9ea7
InboundInfoModal put a client's email into /panel/api/clients/ips and clearIps unencoded, and the host mutations did the same with a host group id. Both values reach the master from a node's sync without the panel's own character rules, so "../" and "?" in them chose the route and query of the admin's authenticated POST; the IP-log request fires as soon as the window opens. Encode them as every other client route in the SPA already does.