MHSanaei d50c419e28 fix(web): read the client address from the proxy end of forwarded headers ... getRemoteIp took a trusted proxy's X-Real-IP first, otherwise the leftmost X-Forwarded-For entry. A proxy that forwards a client-sent X-Real-IP unchanged (Caddy, HAProxy) or appends to X-Forwarded-For leaves both values to the client. X-Forwarded-For is now read from the right, skipping trusted proxies. X-Real-IP is believed only when it agrees with that hop or stands alone, and a disagreement falls back to the proxy's own address. The documented Caddyfile and the docs reverse-proxy generator now overwrite X-Real-IP with the address Caddy saw.		2026-10-24 01:39:23 +02:00
..
api.go	fix(auth): add node-admin token scope for panel updates (#6666)	2026-10-17 23:45:26 +02:00
api_auth_test.go	fix(auth): add node-admin token scope for panel updates (#6666)	2026-10-17 23:45:26 +02:00
base.go
client.go	feat(clients): preserve traffic counters in portable export/import (#6469)	2026-09-27 02:48:40 +02:00
client_happ_test.go	feat(happ): generate Crypt5 subscription links locally (#6494)	2026-09-13 12:44:55 +02:00
client_partial_apply_test.go	perf(tests): copy a migrated template DB instead of migrating per test	2026-09-27 03:04:50 +02:00
client_renewal_preview_test.go	perf(tests): copy a migrated template DB instead of migrating per test	2026-09-27 03:04:50 +02:00
dist.go	feat(web): add network-only PWA installability (#6190)	2026-08-18 15:33:20 +02:00
dist_test.go	feat(web): add network-only PWA installability (#6190)	2026-08-18 15:33:20 +02:00
geodata_test.go	feat(xray): browse geosite/geoip categories from routing rules (#6165)	2026-08-15 17:12:59 +02:00
group.go	fix(groups): report changed bulk moves without restarting xray (#6199)	2026-08-14 19:50:06 +02:00
host.go	feat(hosts): bulk-add multiple hosts to multiple inbounds (#5677)	2026-07-08 23:35:20 +02:00
host_test.go	perf(tests): copy a migrated template DB instead of migrating per test	2026-09-27 03:04:50 +02:00
import_db_restart_test.go	fix(web): restart panel after ImportDB so subPath routes match (#6446) (#6456)	2026-09-13 21:39:15 +02:00
inbound.go	fix(auth): add node-admin token scope for panel updates (#6666)	2026-10-17 23:45:26 +02:00
inbound_node_sync_test.go	fix(auth): add node-admin token scope for panel updates (#6666)	2026-10-17 23:45:26 +02:00
index.go	feat(panel): add sponsor slots fed from sponsors.sanaei.dev	2026-09-26 03:31:51 +02:00
login_limiter.go	Repo-wide self-correcting audit: 54 verified bug fixes (#5970)	2026-07-17 00:33:06 +02:00
login_limiter_test.go	chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms	2026-07-25 16:08:09 +02:00
node.go	fix(nodes): apply a rotated master mTLS certificate without restarting the panel (#6194)	2026-08-15 16:03:42 +02:00
node_credentials_writeonly_test.go	perf(tests): copy a migrated template DB instead of migrating per test	2026-09-27 03:04:50 +02:00
panel_update_test.go	fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)	2026-07-02 18:19:33 +02:00
pwa.go	feat(web): add network-only PWA installability (#6190)	2026-08-18 15:33:20 +02:00
pwa_test.go	feat(web): add network-only PWA installability (#6190)	2026-08-18 15:33:20 +02:00
server.go	fix(server): apply the outbound address policy to remote cert pinning	2026-10-03 13:20:00 +02:00
setting.go	feat(discord): add Discord notification bot service (#6486)	2026-09-13 14:04:53 +02:00
setting_test.go	perf(tests): copy a migrated template DB instead of migrating per test	2026-09-27 03:04:50 +02:00
spa.go	refactor(frontend): replace axios with the native Fetch API	2026-07-08 01:09:18 +02:00
spa_test.go	fix(web): serve panel SPA routes from NoRoute (#5536)	2026-06-24 21:19:12 +02:00
sub_balancer.go	feat(sub): leastLoad member weights for subscription balancers (#6304)	2026-09-02 20:21:27 +02:00
sub_balancer_test.go	perf(tests): copy a migrated template DB instead of migrating per test	2026-09-27 03:04:50 +02:00
util.go	fix(web): read the client address from the proxy end of forwarded headers	2026-10-24 01:39:23 +02:00
util_test.go	fix(web): read the client address from the proxy end of forwarded headers	2026-10-24 01:39:23 +02:00
websocket.go
xray_setting.go	feat(warp): register WARP over MASQUE from the WARP modal	2026-10-11 10:31:01 +02:00
xray_setting_warp_test.go	perf(tests): copy a migrated template DB instead of migrating per test	2026-09-27 03:04:50 +02:00