GitHub/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-06-04 03:19:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(clients): reject spaces, '/', '\' and control chars in subscription ID

Browse Source 
Like the client email, the subId is embedded directly in subscription
URLs, so the same characters break it. Validate it on the backend
(Create + Update) and the frontend (Zod), with a localized message
across all 13 locales. An empty subId stays allowed (it is then
auto-generated).
This commit is contained in:
MHSanaei
2026-05-30 23:28:58 +02:00
parent a0865a67fd
commit 2fa7be86dc
16 changed files with 64 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
frontend/src/schemas/client.ts
View File

@@ -119,7 +119,7 @@ export const GroupSummarySchema = z.object({
export const GroupSummaryListSchema = z.array(GroupSummarySchema).nullable().transform((v) => v ?? []);
export function emailHasForbiddenChars(value: string): boolean {
export function hasForbiddenClientChars(value: string): boolean {
if (value.includes('/') || value.includes('\\') || value.includes(' ')) return true;
for (let i = 0; i < value.length; i++) {
const code = value.charCodeAt(i);
@@ -133,8 +133,8 @@ export const ClientFormSchema = z.object({
.string()
.trim()
.min(1, 'pages.clients.email')
.refine((v) => !emailHasForbiddenChars(v), 'pages.clients.emailInvalidChars'),
subId: z.string(),
.refine((v) => !hasForbiddenClientChars(v), 'pages.clients.emailInvalidChars'),
subId: z.string().refine((v) => !hasForbiddenClientChars(v), 'pages.clients.subIdInvalidChars'),
uuid: z.string(),
password: z.string(),
auth: z.string(),