admin/Xboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
623 Commits 3 Branches 0 Tags
fea7d97aa31ee411d0ec6c53bafd74b0252b7016
Commit Graph

352 Commits

Author SHA1 Message Date
Xboard fea7d97aa3 Update installer URL to use 'dev' branch 2026-04-17 12:54:22 +08:00
xboard a74cc2f19d feat: show install command on machine creation 2026-04-17 06:47:05 +08:00
xboard e297b5fe9f feat: machine mode, ECH subscriptions, batch ops & security hardening 2026-04-17 03:02:53 +08:00
yootus edbd8de356 QuantumultX下发Anytls节点 (#880) 
QuantumultX最新版本支持Anytls了，做适配
 2026-04-16 19:31:24 +08:00
xboard 13756956a6 fix: reset traffic stats when copying server nodes 2026-04-11 20:24:43 +08:00
Valentin Lobstein 121511523f Fix: CVE-2026-39912 - Magic link token leak in loginWithMailLink (#873) 
The loginWithMailLink endpoint returns the magic login link in the
HTTP response body, allowing unauthenticated account takeover.

The fix returns true instead of the link. The email delivery is
the authentication factor.

Bug inherited from V2Board commit bdb10bed (2022-06-27).
 2026-04-10 02:44:20 +08:00
xboard 58ef46f754 fix: stop sending VLESS decryption when encryption is disabled 2026-04-08 11:05:55 +08:00
yootus ec49ba3fd1 Loon和Surfboard适配anytls (#854) 
* Loon适配anytls

* Surfboard适配anytls

Surfboard适配anytls
 2026-04-02 15:47:41 +08:00
NFamou b7c8b31a91 Merge pull request #856 from NFamou/master 
支持Surfboard下发SS2022
 2026-04-02 15:46:55 +08:00
Xboard c5a8c836c0 Revert "feat: Track user traffic per node (server_id)" 2026-03-30 18:17:27 +08:00
xboard 5f1afe4bdc feat: add Vless Encryption support 2026-03-30 17:03:37 +08:00
Xboard 0cd20d12dd Merge pull request #755 from socksprox/feat/server-id-stat-user 
feat: Track user traffic per node (server_id)
 2026-03-30 13:55:11 +08:00
Xboard b4a94d1605 Merge pull request #689 from socksprox/fix-user-generation-multiple-prefix 
Fix user generation with email_prefix to support multiple users
 2026-03-30 13:32:46 +08:00
Xboard 7879a9ef85 Merge pull request #786 from lithromantic/master 
Add sha256salt hashing option in password verification
 2026-03-30 13:05:39 +08:00
xboard a58d66d72e feat: node traffic limit & batch operations 
- Traffic monitoring with transfer_enable limit
- Batch delete nodes
- Reset traffic (single/batch)
 2026-03-30 02:50:56 +08:00
xboard daf3055b42 fix: escape Telegram Markdown special characters 2026-03-30 01:46:56 +08:00
xboard 3744ebcd5a Revert "fix: escape Telegram Markdown special characters (fix #450)" 
This reverts commit 23294c1f93.
 2026-03-29 17:48:49 +08:00
lithromantic 6cac241144 Merge branch 'cedar2025:master' into master 2026-03-29 00:00:34 +01:00
Xboard 76a800ddbb Merge pull request #832 from Dlphine/fix/raw-array-access-data-get 
fix: replace raw array access with data_get() to prevent Undefined array key
 2026-03-28 17:38:44 +08:00
xboard 23294c1f93 fix: escape Telegram Markdown special characters (fix #450) 2026-03-28 09:10:54 +08:00
xboard 130f7c82a8 feat: revoke other sessions when changing password (fix #414) 2026-03-28 08:31:24 +08:00
xboard 7fbd1bb92d feat: implement email case-insensitive queries (fix #318) 2026-03-28 07:09:21 +08:00
Dlphine 5dd4cd4bc9 fix: replace raw array access with data_get() to prevent Undefined array key 
- Migrate $protocol_settings['key'] to data_get($protocol_settings, 'key') across General, SingBox, Shadowrocket, Surfboard, QuantumultX
- Prevents PHP 8 Undefined array key fatal errors when optional protocol_settings fields are missing
- Same class of bug that caused #735
 2026-03-27 13:51:28 +08:00
xboard 3c3639613e fix: use ServerService::getServer() for node lookup in WebSocket 2026-03-26 03:51:58 +08:00
xboard 74b5ef0b27 fix: resolve device sync issues and refactor WebSocket server 2026-03-26 03:33:01 +08:00
xboard 420521d90a refactor: restructure device limit system 2026-03-25 17:50:16 +08:00
xboard 73a37a07dd feat: ws notify nodes when user traffic is exhausted 2026-03-25 01:44:55 +08:00
xboard 7dacb69275 feat: Trojan Reality support and protocol distribution optimizations 2026-03-23 14:56:41 +08:00
xboard 08d68cbcae fix: intval u/d to avoid bigint overflow (#821) 2026-03-22 19:13:07 +08:00
Xboard b779bd4fd5 Merge pull request #789 from socksprox/feat/or-filter-logic 
feat: Add OR logic support to user fetch API filters
 2026-03-21 07:49:03 +08:00
xboard 64e6d8148e feat: Add admin bulk-mail placeholder variables and template rendering 2026-03-19 05:02:16 +08:00
xboard 47983dec40 fix(runtime): force app_url/force_https per-request via middlewar 2026-03-19 04:22:17 +08:00
xboard ee55d7fa72 fix: fix brutal-opts configure for clashMeta 2026-03-17 12:26:10 +08:00
xboard b55091a066 feat: Refactor uTLS & Multiplex Support, Node Status Push Optimization 
- Server/ServerSave/Server.php: Unified utls and multiplex schema, validation, and defaults for vmess/vless/trojan/mieru protocols, enabling more flexible protocol configuration.
- Protocols (SingBox/ClashMeta/Shadowrocket/Stash/General): All protocol generators now support utls (client-fingerprint/fp) and multiplex options. Removed getRandFingerprint, replaced with getTlsFingerprint supporting random/custom fingerprints.
- Helper.php: Refactored TLS fingerprint utility to support object/string/random input.
- ServerService: Abstracted updateMetrics method to unify HTTP/WS node status caching logic.
- NodeWebSocketServer: Improved node connection, status push, and full sync logic; adjusted log levels; clarified push logic.
- ServerController: Reused ServerService for node metrics handling, reducing code duplication.
- Docs: Improved aapanel installation docs, added fix for empty admin dashboard.
 2026-03-16 23:09:56 +08:00
xboard c24e09f0c7 fix: correct node_sync queue assignment in horizon 2026-03-16 02:28:28 +08:00
xboard 3d082853d7 feat(ClashMeta): enhance Shadowsocks plugin support 2026-03-15 11:36:43 +08:00
xboard 199c146672 refactor: rename ws-server command and update configuration 2026-03-15 10:57:21 +08:00
xboard 98a4964c7c fix(ws): enabel unix socket support for redis connection 2026-03-15 10:47:31 +08:00
xboard ccdbe9d607 fix: missing ws-server core and update routine 2026-03-15 10:20:42 +08:00
xboard 010275b09e feat: introduce WebSocket sync for XBoard nodes 
- Implement Workerman-based `xboard:ws-server` for real-time node synchronization.
- Support custom routes, outbounds, and certificate configurations via JSON.
- Optimize scheduled tasks with `lazyById` to minimize memory footprint.
- Enhance reactivity using Observers for `Plan`, `Server`, and `ServerRoute`.
- Expand protocol support for `httpupgrade`, `h2`, and `mieru`.
 2026-03-15 09:49:11 +08:00
xboard 0c6ec87ce5 refactor: rewrite restoreProtectedPlugins to use file copy instead of git 
- Dockerfile: backup plugins/ to /opt/default-plugins/ at build time
- Replace exec/git-based restore with pure PHP File::copyDirectory()
- Only restore plugins defined in Plugin::PROTECTED_PLUGINS
- Delete target directory before copy to prevent stale files
- Remove function_exists('exec') guard (no longer needed)
 2026-03-11 08:30:12 +08:00
xboard 8bb4682e98 feat: add configurable ticket_must_wait_reply setting 2026-03-11 07:31:09 +08:00
xboard 2d538c15de perf: fix getTrafficRank slow query with index and batch loading 2026-03-11 07:01:19 +08:00
xboard ec20847f31 refactor: replace database logging with file logging and admin audit log 2026-03-11 06:50:07 +08:00
xboard 6efedcebd4 refactor: move subscribe templates to dedicated database table 2026-03-11 05:47:29 +08:00
xboard b340652b4d feat(config): support custom telegram webhook url 2026-03-11 02:50:33 +08:00
xboard 562064712d fix(register): handle invalid invite code as API error (#792) 2026-03-11 02:09:25 +08:00
xboard 90f84455d3 feat(surge): add SS2022, SOCKS5, HTTP support 2026-03-09 07:32:51 +08:00
xboard 01bcf43ae8 fix: apply device_limit from plan when assigning via gift card (#630) 2026-03-09 06:51:10 +08:00
xboard 2e0b10e643 fix: return dynamic rate instead of base rate in user server list (#709) 2026-03-09 06:47:30 +08:00