MHSanaei ce532e8df7 fix(web): start a fresh session at login ...

SetLoginUser added the user to whatever session the login request
carried, so its CSRF token outlived the login. Anyone can fetch an
anonymous session with its token, and a host on a sibling domain can
plant that cookie in the admin's browser. Clear the session before the
user is stored; the next page load or token fetch mints a new token.

2026-10-31 09:05:28 +00:00

..

amneziawg

feat(amneziawg): add opt-in Linux kernel datapath (#6877)

2026-10-25 13:24:50 +01:00

amneziawgkern

feat(amneziawg): add opt-in Linux kernel datapath (#6877)

2026-10-25 13:24:50 +01:00

amneziawgnet

fix(tests): stabilize local network fixtures

2026-10-25 11:44:58 +01:00

config

v3.11.0

2026-10-25 20:08:14 +01:00

crypto/nodetoken

fix(nodetoken): stop refusing every node-token key file on Windows

2026-09-27 15:55:42 +02:00

database

fix(database): replace the stored session secret once on upgrade

2026-10-31 08:10:36 +00:00

eventbus

chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms

2026-07-25 16:08:09 +02:00

logger

fix(logger): reuse the open log rotator when InitLogger runs again

2026-09-27 15:32:20 +02:00

mtproto

feat(mtproto): expose mtg-multi's per-IP pending-handshake limit

2026-10-14 16:46:20 +02:00

nodee2e

perf(ip-sync): avoid redundant client IP reads and writes (#6930)

2026-10-25 14:13:18 +01:00

pia

chore(build): bump Go toolchain to 1.27.0

2026-08-23 21:57:03 +02:00

sub

fix(sub): bound what a remote routing profile renders to

2026-10-31 09:00:06 +00:00

testpg

test(database): give each package its own schema when tests run on PostgreSQL (#6594)

2026-09-26 21:13:42 +02:00

tuic

fix(xray): bound what the in-process config loader is asked to expand

2026-10-31 08:43:30 +00:00

tunnelmonitor

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

util

fix(sub): treat external subscription providers as untrusted input

2026-10-31 08:53:27 +00:00

web

fix(web): start a fresh session at login

2026-10-31 09:05:28 +00:00

xray

fix(traffic): keep client accounting independent of outbound counters

2026-10-31 08:46:13 +00:00