From 997b6f937a3ff3cb7eaceb286a92423f84ca1fbc Mon Sep 17 00:00:00 2001 From: Aleksandr Safronov Date: Fri, 14 Aug 2026 08:31:51 +0200 Subject: [PATCH] fix(proxy): stop emitting allowInsecure for domains with a valid cert need_valid_ssl already yields False for the modes that are supposed to have a certificate, but the servernames branch overwrote it with True for every non-Reality domain. The guard never gates: re.split on an empty string returns [''], which is truthy, so the block runs for every domain. Xray-core has removed allowInsecure, so configs carrying it are now rejected. Refs hiddify/Hiddify-Manager#5438 --- hiddifypanel/hutils/proxy/shared.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/hiddifypanel/hutils/proxy/shared.py b/hiddifypanel/hutils/proxy/shared.py index ca42dde89..fe966ba9c 100644 --- a/hiddifypanel/hutils/proxy/shared.py +++ b/hiddifypanel/hutils/proxy/shared.py @@ -350,16 +350,13 @@ def sni_host_server_extractor(domain_db: Domain, hconfigs): server = str(random_or_none(hutils.network.get_domain_ips_cached(server)) or server) allow_insecure = not domain_db.need_valid_ssl - if all_snis := split_pattern.split((domain_db.servernames or "").strip()): + if all_snis := [s for s in split_pattern.split((domain_db.servernames or "").strip()) if s]: sni = random_or_none(all_snis) or sni if domain_db.is_reality(): allow_insecure = False if hconfigs[ConfigEnum.core_type] == "singbox": # TODO sni = all_snis[0] - else: - allow_insecure = True - base = { "sni": sni, "host": host,