* fix(clients): include Telegram ID in client list search
clientMatchesSearch only checked Email/SubID/Comment/UUID/Password/Auth,
so searching the client list for a Telegram user ID never matched even
though the field is stored on every client.
This is a real regression, not a field that was simply never included:
before the paged search endpoint (#4500), the frontend searched with
ObjectUtil.deepSearch() over the full client object, which recursed into
every field including tgId. Replacing that with a fixed backend field
list silently dropped it (along with a few other fields, but tgId is the
one that's actually needed here since it's the panel's own way of
looking a client up when it only knows their Telegram ID).
TgID is int64 (0 = unset), so it can't sit in the existing []string
candidates array — matched separately via strconv, and skipped when 0 to
avoid a needle of "0" spuriously matching every client without a
Telegram ID.
Fixes#5880
* fix(clients): drop explanatory comment, mention Telegram ID in search hint
Addresses review feedback on #5888:
- Removed the // comment block above the TgID check in
clientMatchesSearch per repo convention (code should read on its own).
- Updated searchPlaceholder in all 13 locale files to mention Telegram ID,
since the search box now actually matches on it.
* test(clients): remove TgID search test per maintainer request
* fix(inbound): reject finalmask configured together with REALITY security
finalmask wraps the connection before REALITY's own handshake takes
over (TcpmaskManager.WrapListener -> WrapConnServer runs at Accept()
time, ahead of reality.Server()). reality.Server() does an unchecked
type assertion assuming a raw *net.TCPConn; with finalmask in front,
that assertion panics and takes down the entire xray-core process on
the very first connection to the inbound - not just that connection.
Upstream (XTLS/Xray-core#6453) confirmed this will be documented as
unsupported rather than made graceful, so the panel needs to stop this
combination from being saved rather than relying on docs.
AddInbound/UpdateInbound now reject streamSettings with
security=reality and a non-empty finalmask.tcp/udp with a clear error
instead of letting it reach Xray.
Related: MHSanaei/3x-ui#5857
* fix(inbound): heal legacy rows and narrow the finalmask+REALITY guard
Per review feedback on #5861:
- Narrow the check to finalmask.tcp only. xray-core's TcpmaskManager
(the thing that wraps the TCP listener ahead of REALITY's handshake,
the actual cause of the panic) is only constructed when tcp masks
are present; a finalmask.udp-only config never touches that accept
path and doesn't reproduce the crash, so it shouldn't be rejected.
Extracted the shared check into finalMaskRealityTcpMasks() so both
the save-time guard and the config-build heal below use one
definition of "dangerous".
- Heal already-saved bad rows in GetXrayConfig(), the same way
liftXhttpSessionIDKeys and HealShadowsocksClientMethods heal other
legacy data at config-build time. AddInbound/UpdateInbound only cover
the two save paths - a row that already carries this combination
(saved before this guard existed, synced from a node, restored from
a backup, or edited directly in the DB) would still crash Xray-core
on the next restart without this.
- Add end-to-end tests exercising AddInbound, UpdateInbound, and
GetXrayConfig directly (seeding rows through the real DB) rather
than only unit-testing the extracted helper in isolation, so a
wiring regression in any of the three call sites gets caught.
* fix(ldap): convert default total GB to bytes when auto-creating clients
LdapSyncJob.buildClient stored ldapDefaultTotalGB directly into
Client.TotalGB without the GB-to-bytes conversion every other client
creation path applies (client form's gbToBytes, tgbot's
limitTraffic*1024^3, client_inbound_apply.go's totalGB*1024^3). A
"Default total (GB)" of 10 was persisted as 10 bytes, depleting the
client almost immediately.
Closes#5852
* test(ldap): pin the GB-to-bytes conversion in buildClient
Per review feedback on #5854: the existing test only exercised
defGB=0, so it wouldn't have caught the missing conversion.
mrnickson-hue