4dde61e8dbcc8402f4dc245de120f514b1a2dc21
4
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Z User
|
d6e64ab313 |
chore(release): set version to v1.0.0
Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. |
||
|
風雪
|
2f3856704b |
fix(frontend): local QR generation, JWT expiry, CSP, axios CVE
- H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. |
||
|
dzx941
|
28f4c14057 |
fix: align listener generation with mihomo official spec
- Port now supports mihomo ports format (single/range/list) - Add explicit RoutingMark field support - Auto-propagate UDP flag for vmess/vless/trojan/anytls/trusttunnel - Update validator to accept port ranges - Sync visual config and client converter port types - Rename module from dzx941 to kazeyukiro - Fix missing golang-jwt dependency - Fix frontend tsconfig and add missing axios/zustand dependencies |
||
|
dzx941
|
5b4cb63a73 |
fix: align listener generation with mihomo official spec
- Port now supports mihomo ports format (single/range/list) - Add explicit RoutingMark field support - Auto-propagate UDP flag for vmess/vless/trojan/anytls/trusttunnel - Update validator to accept port ranges - Sync visual config and client converter port types - Rename module from dzx941 to kazeyukiro - Fix missing ExpiresAt in JWTClaims - Fix nodeDTO Port type to string - Fix frontend tsconfig and add missing dependencies |