Skip to content

Commit 8e7b297

Browse files
committed
fix(proxy): stop emitting allowInsecure for domains with a valid cert
need_valid_ssl already yields False for the modes that are supposed to have a certificate, but the servernames branch overwrote it with True for every non-Reality domain. The guard never gates: re.split on an empty string returns [''], which is truthy, so the block runs for every domain. Xray-core has removed allowInsecure, so configs carrying it are now rejected. Refs hiddify/Hiddify-Manager#5438
1 parent df2371b commit 8e7b297

1 file changed

Lines changed: 1 addition & 5 deletions

File tree

hiddifypanel/hutils/proxy/shared.py

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -322,16 +322,12 @@ def sni_host_server_extractor(domain_db: Domain, hconfigs):
322322

323323

324324
allow_insecure=not domain_db.need_valid_ssl
325-
if all_snis := split_pattern.split((domain_db.servernames or "").strip()):
325+
if all_snis := [s for s in split_pattern.split((domain_db.servernames or "").strip()) if s]:
326326
sni = random_or_none(all_snis) or sni
327327
if 'reality' in domain_db.mode:
328328
allow_insecure=False
329329
if hconfigs[ConfigEnum.core_type] == "singbox": #TODO
330330
sni = all_snis[0]
331-
332-
else:
333-
allow_insecure=True
334-
335331

336332
base = {
337333
'sni': sni,

0 commit comments

Comments
 (0)