From bb7fc001cd1bf53f9fa898d18f213f02bc9b2f9a Mon Sep 17 00:00:00 2001 From: Zed <124834187+zZedix@users.noreply.github.com> Date: Sun, 5 Oct 2025 13:22:40 +0330 Subject: [PATCH 1/3] Improve local IP detection and ensure socket cleanup --- app/utils/system.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/utils/system.py b/app/utils/system.py index 5fbc20717..68b0be637 100644 --- a/app/utils/system.py +++ b/app/utils/system.py @@ -70,6 +70,7 @@ def get_public_ip(): except httpx.RequestError: pass + sock = None try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.connect(("8.8.8.8", 80)) @@ -79,7 +80,8 @@ def get_public_ip(): except (socket.error, IndexError): pass finally: - sock.close() + if sock: + sock.close() return "127.0.0.1" From f602c52a5ff81f89a38df1e06dd3627ad072bf5f Mon Sep 17 00:00:00 2001 From: Zed <124834187+zZedix@users.noreply.github.com> Date: Sun, 5 Oct 2025 13:31:29 +0330 Subject: [PATCH 2/3] Harden get_subscription_payload against malformed tokens --- app/utils/jwt.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/app/utils/jwt.py b/app/utils/jwt.py index 54adf2c99..29250b0f6 100644 --- a/app/utils/jwt.py +++ b/app/utils/jwt.py @@ -84,9 +84,18 @@ async def get_subscription_payload(token: str) -> dict | None: sha256((u_token + await get_secret_key()).encode("utf-8")).digest(), altchars=b"-_" ).decode("utf-8")[:10] if u_signature == u_token_resign: - u_username = u_token_dec_str.split(",")[0] - u_created_at = int(u_token_dec_str.split(",")[1]) - return {"username": u_username, "created_at": datetime.fromtimestamp(u_created_at, tz=timezone.utc)} + parts = u_token_dec_str.split(",") + if len(parts) != 2: + return + u_username, u_created_at_str = parts + try: + u_created_at = int(u_created_at_str) + except ValueError: + return + return { + "username": u_username, + "created_at": datetime.fromtimestamp(u_created_at, tz=timezone.utc), + } else: return except jwt.exceptions.PyJWTError: From c12c90407e7557274e84a643e9c83e8661f842d3 Mon Sep 17 00:00:00 2001 From: Zed <124834187+zZedix@users.noreply.github.com> Date: Sun, 5 Oct 2025 19:00:25 +0330 Subject: [PATCH 3/3] =?UTF-8?q?Updated=20SQL=20cleanup=20queries=20to=20us?= =?UTF-8?q?e=20SQLAlchemy=E2=80=99s=20supported=20notin=5F=20operators,=20?= =?UTF-8?q?preventing=20AttributeErrors=20that=20previously=20stopped=20su?= =?UTF-8?q?bscription/pruning=20jobs=20from=20deleting=20stale=20records?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- app/db/crud/host.py | 2 +- app/jobs/cleanup_subscription_updates.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/db/crud/host.py b/app/db/crud/host.py index f55c7095d..5bad3aa14 100644 --- a/app/db/crud/host.py +++ b/app/db/crud/host.py @@ -44,7 +44,7 @@ async def get_inbounds_not_in_tags(db: AsyncSession, excluded_tags: List[str]) - Returns: List of ProxyInbound objects not matching any tag in the list """ - stmt = select(ProxyInbound).where(ProxyInbound.tag.not_in(excluded_tags)) + stmt = select(ProxyInbound).where(ProxyInbound.tag.notin_(excluded_tags)) result = await db.execute(stmt) return result.scalars().all() diff --git a/app/jobs/cleanup_subscription_updates.py b/app/jobs/cleanup_subscription_updates.py index c657fe5c2..ba0800359 100644 --- a/app/jobs/cleanup_subscription_updates.py +++ b/app/jobs/cleanup_subscription_updates.py @@ -44,7 +44,7 @@ async def cleanup_user_subscription_updates(): # Delete records not in keep list result = await db.execute( delete(UserSubscriptionUpdate).where( - UserSubscriptionUpdate.user_id == user_id, UserSubscriptionUpdate.id.not_in(keep_ids) + UserSubscriptionUpdate.user_id == user_id, UserSubscriptionUpdate.id.notin_(keep_ids) ) ) total_deleted += result.rowcount @@ -63,7 +63,7 @@ async def cleanup_user_subscription_updates(): result = await db.execute( delete(UserSubscriptionUpdate).where( - UserSubscriptionUpdate.user_id.in_(user_ids), UserSubscriptionUpdate.id.not_in(keep_subquery) + UserSubscriptionUpdate.user_id.in_(user_ids), UserSubscriptionUpdate.id.notin_(keep_subquery) ) ) logger.info(f"Cleaned up {result.rowcount} old subscription updates")