mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-11-02 11:15:03 +03:00
d63583caaf
The Telegram login alert is a list of "label: value" lines, and the username, whatever the visitor typed on the login form, was inserted with its line breaks intact. Text after a break read as the panel's own IP and time lines, letting a failed login forge the alert. Control characters and Unicode line separators in the username become spaces, in the failed and the successful alert alike.