MHSanaei 4813a2fe00 fix(api-token): hash tokens at rest and show plaintext only once ...

Store API tokens as SHA-256 hashes instead of plaintext and return the token value only in the create response. List no longer exposes the token, and the UI drops the Show/Copy buttons in favor of a one-time reveal modal at creation.

Match hashes the presented bearer token before the constant-time compare, and a migration hashes any pre-existing plaintext rows in place so existing tokens keep authenticating. Docs and translations updated.

2026-06-03 22:57:50 +02:00

..

api_token.go

fix(api-token): hash tokens at rest and show plaintext only once

2026-06-03 22:57:50 +02:00

bulk_clients_test.go

perf(clients): batch bulk attach/detach to cut per-item DB work

2026-06-02 03:59:10 +02:00

client_email_validation_test.go

fix(clients): reject spaces, '/', '\' and control chars in subscription ID

2026-05-30 23:28:58 +02:00

client_flow_isolation_test.go

fix(clients): keep reverse tag clearable and preserve flow on attach

2026-06-02 23:47:03 +02:00

client_group_node_sync_test.go

fix(clients): persist group for node-inbound clients

2026-05-31 15:25:21 +02:00

client_sync_multiprotocol_test.go

test: name temp sqlite db x-ui.db to match the real db filename

2026-05-31 15:25:05 +02:00

client_test.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

client.go

fix(clients): keep reverse tag clearable and preserve flow on attach

2026-06-02 23:47:03 +02:00

config.json

fix(xray): default freedom finalRules to allow-all so reverse egress works

2026-06-02 15:58:48 +02:00

custom_geo_test.go

fix(panel-proxy): route custom geo and http(s) Telegram through panelProxy

2026-06-03 14:57:49 +02:00

custom_geo.go

fix(panel-proxy): route custom geo and http(s) Telegram through panelProxy

2026-06-03 14:57:49 +02:00

fallback.go

fix(fallbacks): allow free-form dest entries for external servers (#4748)

2026-06-02 00:17:21 +02:00

inbound_client_traffic_test.go

fix(clients): use client_inbounds link to resolve inbound, not stale id

2026-06-03 13:42:32 +02:00

inbound_migration_test.go

fix(postgres): commit client traffic backfill in migration

2026-06-01 00:43:42 +02:00

inbound_update_tag_test.go

fix(inbound): re-derive auto tags on edit and keep node tags consistent

2026-06-01 05:08:29 +02:00

inbound.go

fix(online): scope per-inbound online to inbounds that carried traffic

2026-06-03 16:19:00 +02:00

metric_history.go

feat(dashboard): more System History metrics, persistence & localized labels

2026-06-03 12:16:31 +02:00

node_client_traffic_sum_test.go

fix(nodes): sum client traffic across nodes instead of overwriting

2026-06-01 22:54:56 +02:00

node_tag_sync_test.go

fix(inbound): re-derive auto tags on edit and keep node tags consistent

2026-06-01 05:08:29 +02:00

node_test.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

node.go

fix(nodes): Set Cert from Panel uses the node's own web cert for node inbounds

2026-06-03 16:41:02 +02:00

nord.go

feat(xray/nord): searchable server list + colored load tag, surface API errors

2026-05-11 10:06:01 +02:00

outbound.go

fix(xray): test UDP outbounds via xray probe (#4657) + Vision testseed & Flow form fixes

2026-05-29 21:07:01 +02:00

panel_other.go

feat: add panel update functionality via web GUI (#4117)

2026-04-28 18:46:55 +02:00

panel_proxy_test.go

fix(panel-proxy): route custom geo and http(s) Telegram through panelProxy

2026-06-03 14:57:49 +02:00

panel_test.go

feat: add panel update functionality via web GUI (#4117)

2026-04-28 18:46:55 +02:00

panel_unix.go

feat: add panel update functionality via web GUI (#4117)

2026-04-28 18:46:55 +02:00

panel.go

feat(settings): panel network proxy for the panel's own outbound requests

2026-05-28 00:45:32 +02:00

port_conflict_test.go

fix(inbounds): drop listen address from auto-generated inbound tag

2026-06-01 09:33:49 +02:00

port_conflict.go

fix(inbounds): drop listen address from auto-generated inbound tag

2026-06-01 09:33:49 +02:00

server_vlessenc_test.go

Feat: clarify VLESS encryption auth selection (#4271)

2026-05-12 11:39:28 +02:00

server.go

feat(dashboard): more System History metrics, persistence & localized labels

2026-06-03 12:16:31 +02:00

setting_security_test.go

feat(api-tokens): manage multiple named tokens; add tab/section anchor URLs

2026-05-13 16:34:31 +02:00

setting.go

feat(settings): move the remark model control to the subscription tab

2026-06-03 02:45:16 +02:00

sub_uri_base_test.go

style: gofmt -s (doc-comment list separator, struct field alignment)

2026-06-02 03:58:58 +02:00

tgbot_test.go

fix(panel-proxy): route custom geo and http(s) Telegram through panelProxy

2026-06-03 14:57:49 +02:00

tgbot.go

fix(panel-proxy): route custom geo and http(s) Telegram through panelProxy

2026-06-03 14:57:49 +02:00

traffic_writer_test.go

Fix: traffic writer restart freeze (#4265)

2026-05-12 11:36:05 +02:00

traffic_writer.go

Fix: traffic writer restart freeze (#4265)

2026-05-12 11:36:05 +02:00

url_safety.go

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)

2026-05-13 12:52:52 +02:00

user.go

fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop

2026-05-13 14:08:16 +02:00

warp.go

fix(warp): persist client_id so WARP outbound gets reserved bytes (#4781)

2026-06-01 23:14:40 +02:00

websocket.go

v3

2026-05-10 02:13:42 +02:00

xray_metrics.go

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)

2026-05-13 12:52:52 +02:00

xray_setting_test.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

xray_setting.go

Feat/multi inbound clients (#4469)

2026-05-19 12:20:24 +02:00

xray.go

feat(fallbacks): add per-rule dest override

2026-05-28 21:17:49 +02:00