風雪
2f3856704b
- H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8.
28 lines
1.4 KiB
HTML
28 lines
1.4 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<link rel="icon" type="image/svg+xml" href="/favicon.svg" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover, maximum-scale=1" />
|
|
<meta name="theme-color" content="#07152d" />
|
|
<!--
|
|
Security headers.
|
|
Note: <meta http-equiv> CSP is a defense-in-depth baseline; the
|
|
authoritative policy should still be sent by the backend / reverse
|
|
proxy as a real HTTP `Content-Security-Policy` response header
|
|
(meta tags cannot express `frame-ancestors`, but we set
|
|
X-Frame-Options DENY here as a belt-and-braces fallback).
|
|
-->
|
|
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; worker-src 'self' blob:; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none';" />
|
|
<meta name="referrer" content="same-origin" />
|
|
<meta http-equiv="X-Frame-Options" content="DENY" />
|
|
<meta http-equiv="X-Content-Type-Options" content="nosniff" />
|
|
<meta http-equiv="Referrer-Policy" content="same-origin" />
|
|
<title>3m-ui · Mihomo Core Manager UI</title>
|
|
</head>
|
|
<body>
|
|
<div id="root"></div>
|
|
<script type="module" src="/src/main.tsx"></script>
|
|
</body>
|
|
</html>
|