MHSanaei 2fa7be86dc fix(clients): reject spaces, '/', '\' and control chars in subscription ID ...

Like the client email, the subId is embedded directly in subscription
URLs, so the same characters break it. Validate it on the backend
(Create + Update) and the frontend (Zod), with a localized message
across all 13 locales. An empty subId stays allowed (it is then
auto-generated).

2026-05-30 23:28:58 +02:00

..

api_token.go

feat(api-tokens): manage multiple named tokens; add tab/section anchor URLs

2026-05-13 16:34:31 +02:00

client_email_validation_test.go

fix(clients): reject spaces, '/', '\' and control chars in subscription ID

2026-05-30 23:28:58 +02:00

client_flow_isolation_test.go

fix(clients): store flow per-inbound for shared clients

2026-05-29 02:35:53 +02:00

client_sync_multiprotocol_test.go

feat: complete Zod migration of frontend + bulk client batching (#4599)

2026-05-27 04:26:50 +02:00

client_test.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

client.go

fix(clients): reject spaces, '/', '\' and control chars in subscription ID

2026-05-30 23:28:58 +02:00

config.json

fix(xray): allow private-IP destinations via freedom finalRules

2026-05-19 15:42:16 +02:00

custom_geo_test.go

v3

2026-05-10 02:13:42 +02:00

custom_geo.go

fix(security): SSRF-guard node and remote HTTP clients

2026-05-13 13:33:53 +02:00

fallback.go

feat(fallbacks): add per-rule dest override

2026-05-28 21:17:49 +02:00

inbound.go

fix(clients): store flow per-inbound for shared clients

2026-05-29 02:35:53 +02:00

metric_history.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

node_test.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

node.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

nord.go

feat(xray/nord): searchable server list + colored load tag, surface API errors

2026-05-11 10:06:01 +02:00

outbound.go

fix(xray): test UDP outbounds via xray probe (#4657) + Vision testseed & Flow form fixes

2026-05-29 21:07:01 +02:00

panel_other.go

feat: add panel update functionality via web GUI (#4117)

2026-04-28 18:46:55 +02:00

panel_test.go

feat: add panel update functionality via web GUI (#4117)

2026-04-28 18:46:55 +02:00

panel_unix.go

feat: add panel update functionality via web GUI (#4117)

2026-04-28 18:46:55 +02:00

panel.go

feat(settings): panel network proxy for the panel's own outbound requests

2026-05-28 00:45:32 +02:00

port_conflict_test.go

refactor(inbound-tag): drop protocol segment from canonical shape

2026-05-28 15:50:00 +02:00

port_conflict.go

refactor(inbound-tag): drop protocol segment from canonical shape

2026-05-28 15:50:00 +02:00

server_vlessenc_test.go

Feat: clarify VLESS encryption auth selection (#4271)

2026-05-12 11:39:28 +02:00

server.go

feat(settings): panel network proxy for the panel's own outbound requests

2026-05-28 00:45:32 +02:00

setting_security_test.go

feat(api-tokens): manage multiple named tokens; add tab/section anchor URLs

2026-05-13 16:34:31 +02:00

setting.go

feat(settings): include email in default remarkModel pattern

2026-05-28 11:08:59 +02:00

tgbot_test.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

tgbot.go

change tg message when send qrCode (#4623)

2026-05-28 17:26:45 +02:00

traffic_writer_test.go

Fix: traffic writer restart freeze (#4265)

2026-05-12 11:36:05 +02:00

traffic_writer.go

Fix: traffic writer restart freeze (#4265)

2026-05-12 11:36:05 +02:00

url_safety.go

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)

2026-05-13 12:52:52 +02:00

user.go

fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop

2026-05-13 14:08:16 +02:00

warp.go

fix(warp): set license against Cloudflare API and surface errors inline

2026-05-13 21:13:16 +02:00

websocket.go

v3

2026-05-10 02:13:42 +02:00

xray_metrics.go

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)

2026-05-13 12:52:52 +02:00

xray_setting_test.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

xray_setting.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

xray.go

feat(fallbacks): add per-rule dest override

2026-05-28 21:17:49 +02:00