3x-ui/web/controller
MHSanaei c6f15cd53f
Some checks are pending
CI / go-test (push) Waiting to run
CI / codegen (push) Waiting to run
CI / govulncheck (push) Waiting to run
CI / frontend (push) Waiting to run
CodeQL Advanced / Analyze (go) (push) Waiting to run
CodeQL Advanced / Analyze (actions) (push) Waiting to run
CodeQL Advanced / Analyze (javascript-typescript) (push) Waiting to run
Release 3X-UI / build (386) (push) Waiting to run
Release 3X-UI / build (amd64) (push) Waiting to run
Release 3X-UI / build (arm64) (push) Waiting to run
Release 3X-UI / build (armv5) (push) Waiting to run
Release 3X-UI / build (armv6) (push) Waiting to run
Release 3X-UI / build (armv7) (push) Waiting to run
Release 3X-UI / build (s390x) (push) Waiting to run
Release 3X-UI / Build for Windows (push) Waiting to run
refactor(api)!: move /panel/setting and /panel/xray under /panel/api
Settings and Xray config endpoints now live at /panel/api/setting/* and /panel/api/xray/*, registered under the existing /panel/api group so they inherit the same Bearer-or-session auth (checkAPIAuth) as the rest of the API. An API token is a full-admin credential, so this just makes the surface consistent. The SPA page routes /panel/settings and /panel/xray are unchanged.

BREAKING CHANGE: the old /panel/setting/* and /panel/xray/* paths are removed. External callers must switch to the /panel/api/ prefix. Frontend call sites, API docs, the dev proxy, and the route-documentation test are updated to match.
2026-06-06 16:22:41 +02:00
..
api.go refactor(api)!: move /panel/setting and /panel/xray under /panel/api 2026-06-06 16:22:41 +02:00
api_docs_test.go refactor(api)!: move /panel/setting and /panel/xray under /panel/api 2026-06-06 16:22:41 +02:00
base.go v3 2026-05-10 02:13:42 +02:00
client.go feat(nodes): multi-hop node attribution for chained sub-nodes (#4983) (#5005) 2026-06-06 12:33:39 +02:00
custom_geo.go v3 2026-05-10 02:13:42 +02:00
dist.go fix(api-docs): target the panel base path in OpenAPI servers 2026-06-06 16:22:08 +02:00
dist_test.go fix(api-docs): target the panel base path in OpenAPI servers 2026-06-06 16:22:08 +02:00
group.go refactor(clients): coherent group management — rename, split, extract 2026-05-28 12:59:20 +02:00
inbound.go feat(inbounds): add multi-select and bulk delete 2026-05-31 00:29:24 +02:00
index.go fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop 2026-05-13 14:08:16 +02:00
login_limiter.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
login_limiter_test.go refactor(websocket): split controller into service + thin controller 2026-05-08 00:00:44 +02:00
node.go feat(nodes): multi-hop node attribution for chained sub-nodes (#4983) (#5005) 2026-06-06 12:33:39 +02:00
server.go feat(nodes): multi-hop node attribution for chained sub-nodes (#4983) (#5005) 2026-06-06 12:33:39 +02:00
setting.go feat: complete Zod migration of frontend + bulk client batching (#4599) 2026-05-27 04:26:50 +02:00
util.go fix(node): keep client/inbound edits working when a node is offline (#4923, #4931) 2026-06-05 02:26:57 +02:00
util_test.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
websocket.go v3 2026-05-10 02:13:42 +02:00
xray_setting.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
xui.go refactor(api)!: move /panel/setting and /panel/xray under /panel/api 2026-06-06 16:22:41 +02:00