hiddifypanel 10.70.8__py3-none-any.whl → 10.80.0__py3-none-any.whl

hiddifypanel/panel/admin/DomainAdmin.py

@@ -16,6 +16,7 @@ from hiddifypanel.panel import hiddify, custom_widgets
 from .adminlte import AdminLTEModelView
 from hiddifypanel import hutils
 
+from loguru import logger
 from flask import current_app
 # Define a custom field type for the related domains
 
@@ -152,132 +153,165 @@ class DomainAdmin(AdminLTEModelView):
 
     # TODO: refactor this function
     def on_model_change(self, form, model, is_created):
-        model.domain = (model.domain or '').lower()
+        # Sanitize domain input
+        model.domain = (model.domain or '').lower().strip()
+        
+        # Basic validation
         if model.domain == '' and model.mode != DomainType.fake:
             raise ValidationError(_("domain.empty.allowed_for_fake_only"))
-        configs = get_hconfigs()
-        for c in configs:
-            if "domain" in c and c not in [ConfigEnum.decoy_domain, ConfigEnum.reality_fallback_domain] and c.category != 'hidden':
-                if model.domain == configs[c]:
-                    raise ValidationError(_("You have used this domain in: ") + _(f"config.{c}.label"))
-
-        for td in Domain.query.filter(Domain.mode == DomainType.reality, Domain.domain != model.domain).all():
-            # print(td)
-            if td.servernames and (model.domain in td.servernames.split(",")):
-                raise ValidationError(_("You have used this domain in: ") + _(f"config.reality_server_names.label") + td.domain)
-
-        if is_created and Domain.query.filter(Domain.domain == model.domain, Domain.child_id == model.child_id).count() > 1:
-            raise ValidationError(_("You have used this domain in: "))
 
+        self._validate_not_used_before(model,is_created)
         ipv4_list = hutils.network.get_ips(4)
         ipv6_list = hutils.network.get_ips(6)
+        server_ips = [*ipv4_list, *ipv6_list]
 
-        if not ipv4_list and not ipv6_list:
+        if not server_ips:
             raise ValidationError(_("Couldn't find your ip addresses"))
 
+        # Validate domain based on mode
         if "*" in model.domain and model.mode not in [DomainType.cdn, DomainType.auto_cdn_ip]:
             raise ValidationError(_("Domain can not be resolved! there is a problem in your domain"))
 
-        skip_check = "*" in model.domain or model.domain == ""
+        cloudflare_updated=self._update_cloudflare(model, ipv4_list,ipv6_list)
+        
+        
+        self._validate_domain_ips(model, server_ips)
+
+        # Handle CDN IP settings
+        if model.mode == DomainType.direct and model.cdn_ip:
+            model.cdn_ip = ""
+            raise ValidationError(_("Specifying CDN IP is only valid for CDN mode"))
+            
+        if model.mode == DomainType.fake and not model.cdn_ip:
+            model.cdn_ip = str(server_ips[0])
+            
+        if model.cdn_ip:
+            try:
+                hutils.network.auto_ip_selector.get_clean_ip(str(model.cdn_ip))
+            except Exception:
+                raise ValidationError(_("Error in auto cdn format"))
+                    
+        # Update show domains
+        if len(model.show_domains) == Domain.query.count():
+            model.show_domains = []
+                
+        # Handle mode-specific settings
+        if model.mode == DomainType.old_xtls_direct and not hconfig(ConfigEnum.xtls_enable):
+            set_hconfig(ConfigEnum.xtls_enable, True)
+            hutils.proxy.get_proxies().invalidate_all()
+        elif model.mode == DomainType.reality:
+            self._validate_reality_settings(model, server_ips)
+                
+            # Signal config update if needed
+        old_db_domain = Domain.by_domain(model.domain)
+        if is_created or not old_db_domain or old_db_domain.mode != model.mode:
+            # return hiddify.reinstall_action(complete_install=False, domain_changed=True)
+            hutils.flask.flash_config_success(restart_mode=ApplyMode.apply_config, domain_changed=True)
+
+            
+
+    def _update_cloudflare(self, model, ipv4_list,ipv6_list):
         if hconfig(ConfigEnum.cloudflare) and model.mode not in [DomainType.fake, DomainType.relay, DomainType.reality]:
             try:
                 proxied = model.mode in [DomainType.cdn, DomainType.auto_cdn_ip]
-                hutils.network.cf_api.add_or_update_dns_record(model.domain, str(ipv4_list[0]), "A", proxied=proxied)
+                if ipv4_list:
+                    hutils.network.cf_api.add_or_update_dns_record(model.domain, str(ipv4_list[0]), "A", proxied=proxied)
                 if ipv6_list:
                     hutils.network.cf_api.add_or_update_dns_record(model.domain, str(ipv6_list[0]), "AAAA", proxied=proxied)
-
-                skip_check = True
+                return True
             except Exception as e:
                 raise ValidationError(__("cloudflare.error") + f' {e}')
-        # elif model.mode==DomainType.auto_cdn_ip:
-        # if model.alias and not model.alias.replace("_", "").isalnum():
-        #     hutils.flask.flash(__("Using alias with special charachters may cause problem in some clients like FairVPN."), 'warning')
-            # raise ValidationError(_("You have to add your cloudflare api key to use this feature: "))
+        return False
 
-        dips = hutils.network.get_domain_ips(model.domain)
-        server_ips = [*ipv4_list, *ipv6_list]
-        if model.sub_link_only:
-            if not dips:
-                raise ValidationError(_("Domain can not be resolved! there is a problem in your domain"))  # type: ignore
-        elif not skip_check:
-            if not dips:
-                raise ValidationError(_("Domain can not be resolved! there is a problem in your domain"))  # type: ignore
-
-            domain_ip_is_same_as_panel = False
-
-            for mip in server_ips:
-                domain_ip_is_same_as_panel |= mip in dips
-            server_ips_str = ', '.join(list(map(str, server_ips)))
-            dips_str = ', '.join(list(map(str, dips)))
-
-            if model.mode == DomainType.direct and not domain_ip_is_same_as_panel:
-                # hutils.flask.flash(__(f"Domain IP={dip} is not matched with your ip={', '.join(list(map(str, ipv4_list)))} which is required in direct mode"),category='error')
-                raise ValidationError(
-                    __("Domain IP=%(domain_ip)s is not matched with your ip=%(server_ip)s which is required in direct mode", server_ip=server_ips_str, domain_ip=dips_str))  # type: ignore
-
-            if domain_ip_is_same_as_panel and model.mode in [DomainType.cdn, DomainType.relay, DomainType.fake, DomainType.auto_cdn_ip]:
-                #     # hutils.flask.flash(__(f"In CDN mode, Domain IP={dip} should be different to your ip={', '.join(list(map(str, ipv4_list)))}"), 'warning')
-                raise ValidationError(__("In CDN mode, Domain IP=%(domain_ip)s should be different to your ip=%(server_ip)s",
-                                      server_ip=server_ips_str, domain_ip=dips_str))  # type: ignore
-
-            # if model.mode in [DomainType.ss_faketls, DomainType.telegram_faketls]:
-            #     if len(Domain.query.filter(Domain.mode==model.mode and Domain.id!=model.id).all())>0:
-            #         ValidationError(f"another {model.mode} is exist")
-
-        model.domain = model.domain.lower()
-        if model.mode == DomainType.direct and model.cdn_ip:
-            model.cdn_ip = ""
-            raise ValidationError(f"Specifying CDN IP is only valid for CDN mode")
+    def _validate_reality_settings(self, model, server_ips):
+        """Validate REALITY protocol settings with proper error handling"""
+        if not hconfig(ConfigEnum.reality_enable):
+            set_hconfig(ConfigEnum.reality_enable, True)
+            hutils.proxy.get_proxies().invalidate_all()
 
-        if model.mode == DomainType.fake and not model.cdn_ip:
-            model.cdn_ip = str(server_ips[0])
+        model.servernames = (model.servernames or model.domain).lower().strip()
+        domains_to_check = set()
+        for v in [model.domain, model.servernames]:
+            domains_to_check.update(d.strip() for d in v.split(",") if d.strip())
 
-        # if model.mode==DomainType.fake and model.cdn_ip!=myip:
-        #     raise ValidationError(f"Specifying CDN IP is only valid for CDN mode")
+        for d in domains_to_check:
+            # Check REALITY compatibility
+            if not hutils.network.is_domain_reality_friendly(d):
+                raise ValidationError(_("Domain is not REALITY friendly!") + f' {d}')
 
-        # # Update the many-to-many relationship
-        if len(model.show_domains) == Domain.query.count():
-            model.show_domains = []
-        if model.mode == DomainType.old_xtls_direct:
-            if not hconfig(ConfigEnum.xtls_enable):
-                set_hconfig(ConfigEnum.xtls_enable, True)
-                hutils.proxy.get_proxies().invalidate_all()
-        elif model.mode == DomainType.reality:
-            if not hconfig(ConfigEnum.reality_enable):
-                set_hconfig(ConfigEnum.reality_enable, True)
-                hutils.proxy.get_proxies().invalidate_all()
-            model.servernames = (model.servernames or model.domain).lower()
-            for v in set([model.domain, model.servernames]):
-                for d in v.split(","):
-                    if not d:
-                        continue
-                    if not hutils.network.is_domain_reality_friendly(d):  # the minimum requirement for the REALITY protocol is to have tls1.3 and h2
-                        raise ValidationError(_("Domain is not REALITY friendly!") + f' {d}')
-
-                    if not hutils.network.is_in_same_asn(d, server_ips[0]):
-                        dip = next(iter(dips))
+            try:
+                if not hutils.network.is_in_same_asn(d, server_ips[0]):
+                    domain_ips = hutils.network.get_domain_ips(d)
+                    if domain_ips:
+                        dip = next(iter(domain_ips))
                         server_asn = hutils.network.get_ip_asn(server_ips[0])
-                        domain_asn = hutils.network.get_ip_asn(dip)  # type: ignore
-                        msg = _("domain.reality.asn_issue") + \
-                            (f"<br> Server ASN={server_asn}<br>{d}_ASN={domain_asn}" if server_asn or domain_asn else "")
+                        domain_asn = hutils.network.get_ip_asn(dip)
+                        msg = _("domain.reality.asn_issue")
+                        if server_asn or domain_asn:
+                            msg += f"<br> Server ASN={server_asn}<br>{d}_ASN={domain_asn}"
                         hutils.flask.flash(msg, 'warning')
+            except Exception as e:
+                logger.warning(f"ASN check failed for domain {d}: {str(e)}")
 
-            for d in model.servernames.split(","):
-                if not hutils.network.fallback_domain_compatible_with_servernames(model.domain, d):
-                    msg = _("REALITY Fallback domain is not compaitble with server names!") + f' {d} != {model.domain}'
-                    hutils.flask.flash(msg, 'warning')
+        # Check fallback compatibility
+        for d in model.servernames.split(","):
+            if d.strip() and not hutils.network.fallback_domain_compatible_with_servernames(model.domain, d):
+                msg = _("REALITY Fallback domain is not compatible with server names!") + f' {d} != {model.domain}'
+                hutils.flask.flash(msg, 'warning')
 
-        if (model.cdn_ip):
-            try:
-                hutils.network.auto_ip_selector.get_clean_ip(str(model.cdn_ip))
-            except BaseException:
-                raise ValidationError(_("Error in auto cdn format"))
 
-        old_db_domain = Domain.by_domain(model.domain)
-        if is_created or not old_db_domain or old_db_domain.mode != model.mode:
-            # return hiddify.reinstall_action(complete_install=False, domain_changed=True)
-            hutils.flask.flash_config_success(restart_mode=ApplyMode.apply_config, domain_changed=True)
+    def _validate_not_used_before(self, model,is_created):
+        configs = get_hconfigs()
+        for c in configs:
+            if "domain" in c and c not in [ConfigEnum.decoy_domain, ConfigEnum.reality_fallback_domain] and c.category != 'hidden':
+                if model.domain == configs[c]:
+                    raise ValidationError(_("You have used this domain in: ") + _(f"config.{c}.label"))
+
+        for td in Domain.query.filter(Domain.mode == DomainType.reality, Domain.domain != model.domain).all():
+            # print(td)
+            if td.servernames and (model.domain in td.servernames.split(",")):
+                raise ValidationError(_("You have used this domain in: ") + _(f"config.reality_server_names.label") + td.domain)
 
+        if is_created and Domain.query.filter(Domain.domain == model.domain, Domain.child_id == model.child_id).count() > 1:
+            raise ValidationError(_("You have used this domain in: "))
+
+    def _validate_domain_ips(self, model, server_ips):
+        """Validate domain IP resolution and matching"""
+        
+        # Skip validation for wildcard or empty domains
+        if (model.domain.startswith('*') or not model.domain) and model.mode not in [DomainType.direct]:
+            return True
+        if model.mode in [DomainType.fake, DomainType.reality, DomainType.relay]:
+            return True
+        # Resolve domain IPs with timeout
+        try:
+            dips = hutils.network.get_domain_ips(model.domain)
+        except Exception as e:
+            logger.error(f"Error resolving domain {model.domain}: {str(e)}")
+            raise ValidationError(_("Domain cannot be resolved! Please check DNS settings"))
+        
+        # Validate resolution success
+        if not dips:
+            raise ValidationError(_("Domain cannot be resolved! Please check DNS settings"))
+        
+        # Check IP matching based on mode
+        domain_ip_matches_server = any(ip in dips for ip in server_ips)
+        server_ips_str = ', '.join(map(str, server_ips))
+        dips_str = ', '.join(map(str, dips))
+    
+        if not domain_ip_matches_server and model.mode in [DomainType.direct]:
+            raise ValidationError(
+                __("Domain IP=%(domain_ip)s is not matched with your ip=%(server_ip)s which is required in direct mode",
+                    server_ip=server_ips_str, domain_ip=dips_str))
+                
+        if domain_ip_matches_server and model.mode in [DomainType.cdn, DomainType.relay, DomainType.fake, DomainType.auto_cdn_ip]:
+            raise ValidationError(
+                __("In CDN mode, Domain IP=%(domain_ip)s should be different to your ip=%(server_ip)s",
+                    server_ip=server_ips_str, domain_ip=dips_str))
+                
+        return True
+    
+        
     # def after_model_change(self,form, model, is_created):
     #     if model.show_domains.count==0:
     #         db.session.bulk_save_objects(ShowDomain(model.id,model.id))

hiddifypanel/panel/admin/ProxyAdmin.py

@@ -96,6 +96,8 @@ def get_all_proxy_form(empty=False):
 
     for cdn in categories1:
         class CDNForm(FlaskForm):
+            class Meta:
+                csrf = False
             pass
         cdn_proxies = [c for c in proxies if c.cdn == cdn]
         pgroup = {
@@ -107,6 +109,8 @@ def get_all_proxy_form(empty=False):
         protos = sorted([c for c in {pgroup.get(c.proto, c.proto): 1 for c in cdn_proxies}])
         for proto in protos:
             class ProtoForm(FlaskForm):
+                class Meta:
+                    csrf = False
                 pass
             proto_proxies = [c for c in cdn_proxies if pgroup.get(c.proto, c.proto) == proto]
             for proxy in proto_proxies:

hiddifypanel/panel/admin/QuickSetup.py

@@ -10,7 +10,7 @@ from flask_wtf import FlaskForm
 from flask_bootstrap import SwitchField
 from hiddifypanel.panel import hiddify
 from flask_classful import FlaskView
-from wtforms.validators import ValidationError
+from wtforms.validators import ValidationError, Length, InputRequired
 # from gettext import gettext as _
 
 from hiddifypanel.models import Domain, DomainType, StrConfig, ConfigEnum, get_hconfigs
@@ -28,12 +28,14 @@ class QuickSetup(FlaskView):
         if next:
             step = step + 1
         form = {1: get_lang_form,
-                2: get_quick_setup_form,
-                3: get_proxy_form}
+                2: get_password_form,
+                3: get_quick_setup_form,
+                4: get_proxy_form}
 
         return form[step](empty=empty or next)
 
     def index(self):
+
         return render_template(
             'quick_setup.html',
             form=self.current_form(),
@@ -45,11 +47,12 @@ class QuickSetup(FlaskView):
     def post(self):
         if request.args.get('changepw') == "true":
             AdminUser.current_admin_or_owner().uuid = str(uuid.uuid4())
+            # AdminUser.current_admin_or_owner().password = hutils.random.get_random_password()
             db.session.commit()
 
         set_hconfig(ConfigEnum.first_setup, False)
         form = self.current_form()
-        if not form.validate_on_submit() or form.step.data not in ["1", "2", "3"]:
+        if not form.validate_on_submit() or form.step.data not in ["1", "2", "3","4"]:
             hutils.flask.flash(_('config.validation-error'), 'danger')
             return render_template(
                 'quick_setup.html', form=form,
@@ -69,7 +72,7 @@ def get_lang_form(empty=False):
             default=hconfig(ConfigEnum.admin_lang))
         # lang=wtf.SelectField(_("config.lang.label"),choices=[("en",_("lang.en")),("fa",_("lang.fa"))],description=_("config.lang.description"),default=hconfig(ConfigEnum.lang))
         country = wtf.SelectField(
-            _("config.country.label"), choices=[("ir", _("Iran")), ("zh", _("China")), ("other", "Others")],
+            _("config.country.label"), choices=[("ir", _("Iran")), ("zh", _("China")), ("ru", _("Russia")),  ("other", "Others")],
             description=_("config.country.description"),
             default=hconfig(ConfigEnum.country))
         lang_submit = wtf.SubmitField(_('Submit'))
@@ -84,9 +87,9 @@ def get_lang_form(empty=False):
 
             return render_template(
                 'quick_setup.html', form=view.current_form(next=True),
-                admin_link=admin_link(),
-                ipv4=hutils.network.get_ip_str(4),
-                ipv6=hutils.network.get_ip_str(6),
+                # admin_link=admin_link(),
+                # ipv4=hutils.network.get_ip_str(4),
+                # ipv6=hutils.network.get_ip_str(6),
                 show_domain_info=False)
 
     form = LangForm(None)if empty else LangForm()
@@ -94,6 +97,34 @@ def get_lang_form(empty=False):
     return form
 
 
+def get_password_form(empty=False):
+    class PasswordForm(FlaskForm):
+        step = wtf.HiddenField(default="1")
+        admin_pass = wtf.PasswordField(
+            _("user.password.title"),
+            description=_("user.password.description"),
+            default="",validators=[
+                
+                InputRequired(message=_("user.password.validation-required")), 
+                Length(min=8, message=_("user.password.validation-lenght"))
+        
+            ])
+        password_submit = wtf.SubmitField(_('Submit'))
+
+        def post(self, view):
+            AdminUser.current_admin_or_owner().update_password(self.admin_pass.data)
+
+            return render_template(
+                'quick_setup.html', form=view.current_form(next=True),
+                admin_link=admin_link(),
+                ipv4=hutils.network.get_ip_str(4),
+                ipv6=hutils.network.get_ip_str(6),
+                show_domain_info=False)
+
+    form = PasswordForm(None)if empty else PasswordForm()
+    form.step.data = "2"
+    return form
+
 def get_proxy_form(empty=False):
     class ProxyForm(FlaskForm):
         step = wtf.HiddenField(default="3")
@@ -127,7 +158,7 @@ def get_proxy_form(empty=False):
         setattr(ProxyForm, f'{cf.key}', field)
     setattr(ProxyForm, "submit_global", wtf.fields.SubmitField(_('Submit')))
     form = ProxyForm(None) if empty else ProxyForm()
-    form.step.data = "3"
+    form.step.data = "4"
     return form
 
 
@@ -210,7 +241,7 @@ def get_quick_setup_form(empty=False):
                 show_domain_info=False)
 
     form = BasicConfigs(None) if empty else BasicConfigs()
-    form.step.data = "2"
+    form.step.data = "3"
     return form
 
 
@@ -220,11 +251,11 @@ def validate_domain(form, field):
     if dip is None:
         raise ValidationError(_("Domain can not be resolved! there is a problem in your domain"))
 
-    myip = hutils.network.get_ip(4)
-    myip6 = hutils.network.get_ip(4)
-    if dip and myip != dip and (not myip6 or myip6 != dip):
+    myips = hutils.network.get_ips()
+      # Fixed: Changed from get_ip(4) to get_ip(6)
+    if dip not in myips:
         raise ValidationError(_("Domain (%(domain)s)-> IP=%(domain_ip)s is not matched with your ip=%(server_ip)s which is required in direct mode",
-                              server_ip=myip, domain_ip=dip, domain=domain))
+                              server_ip=myips, domain_ip=dip, domain=domain))
 
 
 def validate_domain_cdn(form, field):
@@ -235,10 +266,10 @@ def validate_domain_cdn(form, field):
     if dip is None:
         raise ValidationError(_("Domain can not be resolved! there is a problem in your domain"))
 
-    myip = hutils.network.get_ip(4)
-    if myip == dip:
+    myips = hutils.network.get_ips()
+    if dip in myips:
         raise ValidationError(_("In CDN mode, Domain IP=%(domain_ip)s should be different to your ip=%(server_ip)s",
-                              server_ip=myip, domain_ip=dip, domain=domain))
+                              server_ip=myips, domain_ip=dip, domain=domain))
 
 
 def admin_link():

hiddifypanel/panel/admin/SettingAdmin.py

@@ -137,6 +137,10 @@ class SettingAdmin(FlaskView):
                 form = get_config_form()
         else:
             hutils.flask.flash(_('config.validation-error'), 'danger')  # type: ignore
+            for field, errors in form.errors.items():
+                for error in errors:
+                    hutils.flask.flash(error, 'danger')  # type: ignore
+            
 
         return reset_action or render_template('config.html', form=form)
 
@@ -185,6 +189,8 @@ def get_config_form():
             continue
 
         class CategoryForm(FlaskForm):
+            class Meta:
+                csrf = False
             description_for_fieldset = wtf.TextAreaField("", description=_(f'config.{cat}.description'), render_kw={"class": "d-none"})
         for c2 in cat_configs:
             if not (c2 in configs_key):

hiddifypanel/panel/admin/UserAdmin.py

@@ -27,7 +27,7 @@ from hiddifypanel import hutils
 class UserAdmin(AdminLTEModelView):
     column_default_sort = ('id', False)  # Sort by username in ascending order
 
-    column_sortable_list = ["is_active", "name", "current_usage", 'mode', "remaining_days", "comment", 'last_online', "uuid", 'remaining_days']
+    column_sortable_list = ["is_active", "name", "current_usage", 'mode', "remaining_days", "max_ips", "comment", 'last_online', "uuid"]
     column_searchable_list = ["uuid", "name"]
     column_list = ["is_active", "name", "UserLinks", "current_usage", "remaining_days", "comment", 'last_online', 'mode', 'admin', "uuid"]
     column_editable_list = ["comment", "name", "uuid"]
@@ -37,8 +37,8 @@ class UserAdmin(AdminLTEModelView):
         # 'disable_user': SwitchField(_("Disable User"))
     }
     list_template = 'model/user_list.html'
-
-    form_columns = ["name", "comment", "usage_limit", "reset_usage", "package_days", "reset_days", "mode", "uuid", "enable",]
+# "max_ips",
+    form_columns = ["name","comment", "usage_limit", "reset_usage", "package_days", "reset_days", "mode", "uuid", "enable"]
     # form_excluded_columns = ['current_usage', 'monthly', 'telegram_id', 'last_online', 'expiry_time', 'last_reset_time', 'current_usage_GB',
     #  'start_date', 'added_by', 'admin', 'details', 'max_ips', 'ed25519_private_key', 'ed25519_public_key', 'username', 'password']
     page_size = 50
@@ -48,7 +48,6 @@ class UserAdmin(AdminLTEModelView):
     # can_export = True
     # form_overrides = dict(monthly=SwitchField)
     form_overrides = {
-
         'start_date': custom_widgets.DaysLeftField,
         'mode': custom_widgets.EnumSelectField,
         'usage_limit': custom_widgets.UsageField
@@ -71,7 +70,8 @@ class UserAdmin(AdminLTEModelView):
             'validators': [Regexp(r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$', message=__("Should be a valid uuid"))]
             #     'label': 'First Name',
             #     'validators': [required()]
-        }
+        },
+        
         # ,
         # 'expiry_time':{
         # "":'%Y-%m-%d'
@@ -131,7 +131,7 @@ class UserAdmin(AdminLTEModelView):
         if model.is_active:
             link = '<i class="fa-solid fa-circle-check text-success"></i> '
         elif len(model.devices):
-            link = '<i class="fa-solid fa-users-slash text-danger" title="{_("Too many Connected IPs")}"></i>'
+            link = f'<i class="fa-solid fa-users-slash text-danger" title="{_("Too many Connected IPs")}"></i>'
         else:
             link = '<i class="fa-solid fa-circle-xmark text-danger"></i> '
 
@@ -161,8 +161,8 @@ class UserAdmin(AdminLTEModelView):
 
     def _usage_formatter(view, context, model, name):
         u = round(model.current_usage_GB, 3)
-        t = round(model.usage_limit_GB, 3)
-        rate = round(u * 100 / (t + 0.000001))
+        t = max(round(model.usage_limit_GB, 3), 0.001)  # Prevent division by zero
+        rate = min(round(u * 100 / t), 100)  # Cap at 100%
         state = "danger" if u >= t else ('warning' if rate > 80 else 'success')
         color = "#ff7e7e" if u >= t else ('#ffc107' if rate > 80 else '#9ee150')
         return Markup(f"""
@@ -225,36 +225,45 @@ class UserAdmin(AdminLTEModelView):
 
     def on_form_prefill(self, form, id=None):
         # print("================",form._obj.start_date)
-        if id is None or form._obj is None or form._obj.start_date is None:
+        if form._obj is None:
+            return
+
+        if id is None or form._obj.start_date is None or form._obj.current_usage==0:
             msg = _("Package not started yet.")
             # form.reset['class']="d-none"
-            delattr(form, 'reset_days')
-            delattr(form, 'reset_usage')
-            # delattr(form,'disable_user')
+        if form._obj.start_date is None:
+            if hasattr(form, 'reset_days'):
+                delattr(form, 'reset_days')
         else:
-            remaining = form._obj.remaining_days  # remaining_days(form._obj)
+            remaining = form._obj.remaining_days
             relative_remaining = hutils.convert.format_timedelta(datetime.timedelta(days=remaining))
             msg = _("Remaining about %(relative)s, exactly %(days)s days", relative=relative_remaining, days=remaining)
             form.reset_days.label.text += f" ({msg})"
-            usr_usage = f" ({_('user.home.usage.title')} {round(form._obj.current_usage_GB,3)}GB)"
-            form.reset_usage.label.text += usr_usage
-            form.reset_usage.data = False
             form.reset_days.data = False
 
-            form.usage_limit.label.text += usr_usage
-
-            # if form._obj.mode==UserMode.disable:
-            #     delattr(form,'disable_user')
-            # form.disable_user.data=form._obj.mode==UserMode.disable
-            if form._obj.start_date:
-                started = form._obj.start_date - datetime.date.today()
-                msg = _("Started from %(relative)s", relative=hutils.convert.format_timedelta(started))
-                form.package_days.label.text += f" ({msg})"
-                if started.days <= 0:
-                    exact_start = _("Started %(days)s days ago", days=-started.days)
-                else:
-                    exact_start = _("Will Start in %(days)s days", days=started.days)
-                form.package_days.description += f" ({exact_start})"
+        # Handle reset_usage field
+        if form._obj.current_usage == 0:
+            if hasattr(form, 'reset_usage'):
+                delattr(form, 'reset_usage')
+        else:
+            usr_usage = f" ({_('user.home.usage.title')} {round(form._obj.current_usage_GB,3)}GB)"
+            if hasattr(form, 'reset_usage'):
+                form.reset_usage.label.text += usr_usage
+                form.reset_usage.data = False
+            
+            if hasattr(form, 'usage_limit'):
+                form.usage_limit.label.text += usr_usage
+
+        # Handle package days info
+        if form._obj.start_date and hasattr(form, 'package_days'):
+            started = form._obj.start_date - datetime.date.today()
+            msg = _("Started from %(relative)s", relative=hutils.convert.format_timedelta(started))
+            form.package_days.label.text += f" ({msg})"
+            if started.days <= 0:
+                exact_start = _("Started %(days)s days ago", days=-started.days)
+            else:
+                exact_start = _("Will Start in %(days)s days", days=started.days)
+            form.package_days.description += f" ({exact_start})"
 
     def get_edit_form(self):
         form = super().get_edit_form()
@@ -265,26 +274,44 @@ class UserAdmin(AdminLTEModelView):
         return form
 
     def on_model_change(self, form, model, is_created):
-        model.max_ips = max(3, model.max_ips or 10000)
+        # Validate max_ips
+        try:
+            model.max_ips = max(3, min(int(model.max_ips or 10000), 10000))
+        except (ValueError, TypeError):
+            model.max_ips = 1000
+            
+        # Show donation message
         if len(User.query.all()) % 4 == 0:
             hutils.flask.flash(('<div id="show-modal-donation"></div>'), ' d-none')
+            
+        # Validate UUID
         if not re.match("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$", model.uuid):
             raise ValidationError('Invalid UUID e.g.,' + str(uuid.uuid4()))
+            
+        # Handle reset flags
         if hasattr(form, 'reset_usage') and form.reset_usage.data:
             model.current_usage_GB = 0
-        # if model.telegram_id and model.telegram_id != '0' and not re.match(r"^[1-9]\d*$", model.telegram_id):
-        #     raise ValidationError('Invalid Telegram ID')
-        # if form.disable_user.data:
-        #     model.mode=UserMode.disable
+            
         if hasattr(form, 'reset_days') and form.reset_days.data:
             model.start_date = None
-        model.package_days = min(model.package_days, 10000)
+            
+        # Validate package days
+        try:
+            model.package_days = min(int(model.package_days), 10000)
+        except (ValueError, TypeError):
+            model.package_days = 10000
+            
+        # Handle user ownership
         old_user = User.by_id(model.id)
         if not model.added_by or model.added_by == 1:
             model.added_by = g.account.id
+            
+        # Validate user limits
         if not g.account.can_have_more_users():
             raise ValidationError(_('You have too much users! You can have only %(active)s active users and %(total)s users',
                                   active=g.account.max_active_users, total=g.account.max_users))
+                                  
+        # Handle UUID changes
         if old_user and old_user.uuid != model.uuid:
             user_driver.remove_client(old_user)
 

hiddifypanel/panel/admin/adminlte.py

@@ -3,6 +3,7 @@ from hiddifypanel import auth
 from flask_admin.form import SecureForm
 
 
+
 class AdminLTEModelView(ModelView):
     form_base_class = SecureForm
     edit_modal = True
@@ -17,6 +18,5 @@ class AdminLTEModelView(ModelView):
     edit_modal_template = 'flask-admin/model/modals/edit.html'
     details_modal_template = 'flask-admin/model/modals/details.html'
 
-    # form_base_class = SecureForm
     def inaccessible_callback(self, name, **kwargs):
         return auth.redirect_to_login()  # type: ignore