hiddifypanel 9.0.0.dev23__tar.gz → 9.0.0.dev25__tar.gz

{hiddifypanel-9.0.0.dev23 → hiddifypanel-9.0.0.dev25}/HISTORY.md

@@ -51,6 +51,10 @@
 
 #### Fix
 
+* Security concern. 
+
+* Permission issue. 
+
 * Bug in new domain. 
 
 * Domains not removed. 
@@ -302,6 +306,14 @@
 
 
 
+## 8.7.0 (2023-11-02)
+
+#### Fix
+
+* Api issues and resolve security issue. 
+
+
+
 ## 8.6.11 (2023-10-19)
 
 #### Fix

{hiddifypanel-9.0.0.dev23 → hiddifypanel-9.0.0.dev25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: hiddifypanel
-Version: 9.0.0.dev23
+Version: 9.0.0.dev25
 Summary: hiddifypanel multi proxy panel
 Home-page: https://github.com/hiddify/hiddify-manager/
 Author: hiddify
@@ -11,7 +11,7 @@ Requires-Dist: async-timeout==4.0.3
 Requires-Dist: babel==2.12.1
 Requires-Dist: bootstrap-flask==2.2.0
 Requires-Dist: click==8.1.3
-Requires-Dist: cloudflare~=2.11.7
+Requires-Dist: cloudflare==2.12.4
 Requires-Dist: cryptography>=41.0.0
 Requires-Dist: cython==3.0.3
 Requires-Dist: dynaconf==3.2.3
@@ -25,11 +25,11 @@ Requires-Dist: flask-babelex==0.9.4
 Requires-Dist: flask-restful==0.3.9
 Requires-Dist: Flask-WTF==1.1.1
 Requires-Dist: gunicorn==20.1.0
-Requires-Dist: h2~=4.1.0
+Requires-Dist: h2==4.1.0
 Requires-Dist: json5==0.9.14
 Requires-Dist: lastversion==3.3.2
 Requires-Dist: MarkupSafe==2.0.1
-Requires-Dist: maxminddb~=2.4.0
+Requires-Dist: maxminddb==2.4.0
 Requires-Dist: netifaces==0.11.0
 Requires-Dist: paramiko==3.3.1
 Requires-Dist: ping3==4.0.4
@@ -77,7 +77,7 @@ Requires-Dist: mkdocs; extra == "test"
 # How to use it
 Please visit https://github.com/hiddify/hiddify-manager/wiki for the installation.
 
-# Source Code: https://github.com/hiddify1/HiddifyPanel/
+# Source Code: https://github.com/hiddify/HiddifyPanel/
 <!--
 ## Installation
 

{hiddifypanel-9.0.0.dev23 → hiddifypanel-9.0.0.dev25}/README.md

@@ -5,7 +5,7 @@
 # How to use it
 Please visit https://github.com/hiddify/hiddify-manager/wiki for the installation.
 
-# Source Code: https://github.com/hiddify1/HiddifyPanel/
+# Source Code: https://github.com/hiddify/HiddifyPanel/
 <!--
 ## Installation
 

hiddifypanel-9.0.0.dev25/hiddifypanel/VERSION

@@ -0,0 +1 @@
+9.0.0.dev25

hiddifypanel-9.0.0.dev25/hiddifypanel/VERSION.py

@@ -0,0 +1,3 @@
+__version__='9.0.0.dev25'
+from datetime import datetime
+__release_date__= datetime.strptime('2023-11-02','%Y-%m-%d')

{hiddifypanel-9.0.0.dev23 → hiddifypanel-9.0.0.dev25}/hiddifypanel/drivers/user_driver.py

@@ -41,7 +41,7 @@ def get_enabled_users():
     return res
 
 
-def add_client(user):
+def add_client(user: User):
     for driver in drivers:
         try:
             driver.add_client(user)
@@ -49,7 +49,7 @@ def add_client(user):
             hiddify.error(f'ERROR! {driver.__class__.__name__} has error {e} in add client for user={user.uuid}')
 
 
-def remove_client(user):
+def remove_client(user: User):
     for driver in drivers:
         try:
             driver.remove_client(user)

{hiddifypanel-9.0.0.dev23 → hiddifypanel-9.0.0.dev25}/hiddifypanel/models/admin.py

@@ -68,6 +68,18 @@ class AdminUser(db.Model, SerializerMixin):
                 sub_admin_ids += sub_admin.recursive_sub_admins_ids(depth-1, seen=seen)
         return sub_admin_ids
 
+    def remove(model):
+        if model.id == 1 or model.id == g.admin.id:
+            raise ValidationError(_("Owner can not be deleted!"))
+        users=model.recursive_users_query().all()
+        for u in users:
+            u.added_by=g.admin.id
+        
+        DailyUsage.query.filter(DailyUsage.admin_id.in_(model.recursive_sub_admins_ids())).update({'admin_id':g.admin.id})
+        AdminUser.query.filter(AdminUser.id.in_(model.recursive_sub_admins_ids())).delete()
+
+        db.session.commit()
+
     def __str__(self):
         return str(self.name)
 

{hiddifypanel-9.0.0.dev23 → hiddifypanel-9.0.0.dev25}/hiddifypanel/models/user.py

@@ -178,6 +178,14 @@ class User(db.Model, SerializerMixin):
         }
 
 
+def remove(user: User, commit=True):
+    from hiddifypanel.drivers import user_driver
+    user_driver.remove_client(user)
+    user.delete()
+    if commit:
+        db.session.commit()
+
+
 def is_user_active(u):
     """
     The "is_user_active" function checks if the input user object "u" is active by verifying if their mode is not

{hiddifypanel-9.0.0.dev23 → hiddifypanel-9.0.0.dev25}/hiddifypanel/panel/admin/AdminstratorAdmin.py

@@ -7,9 +7,9 @@ from wtforms.validators import Regexp, ValidationError
 from .adminlte import AdminLTEModelView
 from flask_babelex import gettext as __
 from flask_babelex import lazy_gettext as _
-from hiddifypanel.panel import hiddify,cf_api
+from hiddifypanel.panel import hiddify, cf_api
 from flask import Markup
-from flask import Flask,g,url_for
+from flask import Flask, g, url_for
 from flask_sqlalchemy import SQLAlchemy
 from flask_admin import Admin
 from flask_admin.contrib.sqla import ModelView
@@ -19,104 +19,106 @@ import datetime
 from wtforms.widgets import ListWidget, CheckboxInput
 from sqlalchemy.orm import backref
 # Define a custom field type for the related domains
-from flask_admin.form.fields import Select2TagsField,Select2Field
+from flask_admin.form.fields import Select2TagsField, Select2Field
 from wtforms import SelectField
 
+
 class AdminModeField(SelectField):
     def __init__(self, label=None, validators=None, **kwargs):
         super(AdminModeField, self).__init__(label, validators, **kwargs)
-        if g.admin.mode in [AdminMode.agent,AdminMode.admin]:
-            self.choices = [ (AdminMode.agent.value, 'agent')]
-        elif g.admin.mode==AdminMode.admin:
-            self.choices = [ (AdminMode.agent.value, 'agent'),(AdminMode.admin.value, 'Admin'),]
-        elif g.admin.mode==AdminMode.super_admin:
-            self.choices = [(AdminMode.agent.value, 'agent'),(AdminMode.admin.value, 'Admin'),(AdminMode.super_admin.value, 'Super Admin')]
-
+        if g.admin.mode in [AdminMode.agent, AdminMode.admin]:
+            self.choices = [(AdminMode.agent.value, 'agent')]
+        elif g.admin.mode == AdminMode.admin:
+            self.choices = [(AdminMode.agent.value, 'agent'), (AdminMode.admin.value, 'Admin'),]
+        elif g.admin.mode == AdminMode.super_admin:
+            self.choices = [(AdminMode.agent.value, 'agent'), (AdminMode.admin.value, 'Admin'), (AdminMode.super_admin.value, 'Super Admin')]
 
 
 class SubAdminsField(SelectField):
-    def __init__(self, label=None, validators=None,*args, **kwargs):
+    def __init__(self, label=None, validators=None, *args, **kwargs):
         kwargs.pop("allow_blank")
-        super().__init__(label, validators,*args, **kwargs)
-        self.choices=[(admin.id,admin.name) for admin in g.admin.sub_admins]
-        self.choices+=[(g.admin.id,g.admin.name)]
+        super().__init__(label, validators, *args, **kwargs)
+        self.choices = [(admin.id, admin.name) for admin in g.admin.sub_admins]
+        self.choices += [(g.admin.id, g.admin.name)]
+
+
 class AdminstratorAdmin(AdminLTEModelView):
     column_hide_backrefs = False
-    column_list = ["name",'UserLinks','mode','can_add_admin','max_active_users','max_users','online_users','comment']
-    form_columns = ["name",'mode','can_add_admin','max_active_users','max_users','comment',"uuid"]
+    column_list = ["name", 'UserLinks', 'mode', 'can_add_admin', 'max_active_users', 'max_users', 'online_users', 'comment']
+    form_columns = ["name", 'mode', 'can_add_admin', 'max_active_users', 'max_users', 'comment', "uuid"]
     list_template = 'model/admin_list.html'
     # edit_modal = True
     # form_overrides = {'work_with': Select2Field}
-    
+
     form_overrides = {
         'mode': AdminModeField,
         'parent_admin': SubAdminsField
     }
     column_labels = {
-        "Actions":_("actions"),
-        "UserLinks":_("user.user_links"),
+        "Actions": _("actions"),
+        "UserLinks": _("user.user_links"),
         "name": _("user.name"),
-        "mode":_("Mode"),
-        "uuid":_("user.UUID"),
-        "comment":_("Note"),
-        'max_active_users':_("Max Active Users"),
-        'max_users':_('Max Users'),
-        "online_users":_("Online Users"),
-        'can_add_admin':_("Can add sub admin")
+        "mode": _("Mode"),
+        "uuid": _("user.UUID"),
+        "comment": _("Note"),
+        'max_active_users': _("Max Active Users"),
+        'max_users': _('Max Users'),
+        "online_users": _("Online Users"),
+        'can_add_admin': _("Can add sub admin")
 
     }
     form_args = {
-    'uuid': {
-        'validators': [Regexp(r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$',message=__("Should be a valid uuid"))]
-    #     'label': 'First Name',
-    #     'validators': [required()]
-    }}
-    
+        'uuid': {
+            'validators': [Regexp(r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$', message=__("Should be a valid uuid"))]
+            #     'label': 'First Name',
+            #     'validators': [required()]
+        }}
+
     column_descriptions = dict(
         comment=_("Add some text that is only visible to super_admin."),
         mode=_("Define the admin mode. "),
     )
     # create_modal = True
     can_export = False
-    
+
     # column_list = ["domain",'sub_link_only', "mode","alias", "domain_ip", "cdn_ip"]
     # column_editable_list=["domain"]
     # column_filters=["domain","mode"]
-  
-    
+
     column_searchable_list = ["name", "uuid"]
-    
+
     # form_columns=['domain','sub_link_only','alias','mode','cdn_ip','show_domains']
 
     def _ul_formatter(view, context, model, name):
-        
-        return Markup(" ".join([hiddify.get_user_link(model.uuid,d,'admin',model.name) for d in get_panel_domains()]))
-    
+
+        return Markup(" ".join([hiddify.get_user_link(model.uuid, d, 'admin', model.name) for d in get_panel_domains()]))
+
     @property
     def can_create(self):
-        return g.admin.can_add_admin or g.admin.mode==AdminMode.super_admin
+        return g.admin.can_add_admin or g.admin.mode == AdminMode.super_admin
+
     def _name_formatter(view, context, model, name):
-        proxy_path=hconfig(ConfigEnum.proxy_path)
-        d=get_panel_domains()[0]
+        proxy_path = hconfig(ConfigEnum.proxy_path)
+        d = get_panel_domains()[0]
         if d:
-            link=f"<a target='_blank' href='/{proxy_path}/{model.uuid}/admin/#{model.name}'>{model.name} <i class='fa-solid fa-arrow-up-right-from-square'></i></a>"
+            link = f"<a target='_blank' href='/{proxy_path}/{model.uuid}/admin/#{model.name}'>{model.name} <i class='fa-solid fa-arrow-up-right-from-square'></i></a>"
             if model.parent_admin:
-                return Markup(model.parent_admin.name +"&rlm;&lrm; / &rlm;&lrm;"+link)
+                return Markup(model.parent_admin.name + "&rlm;&lrm; / &rlm;&lrm;"+link)
             return Markup(link)
         else:
             return model.name
 
     def _online_users_formatter(view, context, model, name):
-        last_day=datetime.datetime.now()-datetime.timedelta(days=1)
-        u=model.recursive_users_query().filter(User.last_online>last_day).count()
-        t=model.recursive_users_query().count()
+        last_day = datetime.datetime.now()-datetime.timedelta(days=1)
+        u = model.recursive_users_query().filter(User.last_online > last_day).count()
+        t = model.recursive_users_query().count()
         # actives=[u for u in model.recursive_users_query().all() if is_user_active(u)]
         # allusers=model.recursive_users_query().count()
         # onlines=[p for p in  users  if p.last_online and p.last_online>last_day]
         # return Markup(f"<a class='btn btn-xs btn-default' href='{url_for('flask.user.index_view',admin_id=model.id)}'> {_('Online')}: {onlines}</a>")
-        rate=round(u*100/(t+0.000001))
-        state= "danger" if u>=t else ('warning' if  rate>80 else 'success')
-        color= "#ff7e7e" if u>=t else ('#ffc107' if  rate>80 else '#9ee150')
+        rate = round(u*100/(t+0.000001))
+        state = "danger" if u >= t else ('warning' if rate > 80 else 'success')
+        color = "#ff7e7e" if u >= t else ('#ffc107' if rate > 80 else '#9ee150')
         return Markup(f"""
         <div class="progress progress-lg position-relative" style="min-width: 100px;">
           <div class="progress-bar progress-bar-striped" role="progressbar" style="width: {rate}%;background-color: {color};" aria-valuenow="{rate}" aria-valuemin="0" aria-valuemax="100"></div>
@@ -124,14 +126,15 @@ class AdminstratorAdmin(AdminLTEModelView):
 
         </div>
         """)
+
     def _max_users_formatter(view, context, model, name):
-        u=model.recursive_users_query().count()
-        if model.mode== AdminMode.super_admin:
+        u = model.recursive_users_query().count()
+        if model.mode == AdminMode.super_admin:
             return f"{u} / ∞"
-        t=model.max_users
-        rate=round(u*100/(t+0.000001))
-        state= "danger" if u>=t else ('warning' if  rate>80 else 'success')
-        color= "#ff7e7e" if u>=t else ('#ffc107' if  rate>80 else '#9ee150')
+        t = model.max_users
+        rate = round(u*100/(t+0.000001))
+        state = "danger" if u >= t else ('warning' if rate > 80 else 'success')
+        color = "#ff7e7e" if u >= t else ('#ffc107' if rate > 80 else '#9ee150')
         return Markup(f"""
         <div class="progress progress-lg position-relative" style="min-width: 100px;">
           <div class="progress-bar progress-bar-striped" role="progressbar" style="width: {rate}%;background-color: {color};" aria-valuenow="{rate}" aria-valuemin="0" aria-valuemax="100"></div>
@@ -139,46 +142,45 @@ class AdminstratorAdmin(AdminLTEModelView):
 
         </div>
         """)
-        
+
     def _max_active_users_formatter(view, context, model, name):
-        
-        actives=[u for u in model.recursive_users_query().all() if is_user_active(u)]
-        u=len(actives)
-        if model.mode== AdminMode.super_admin:
+
+        actives = [u for u in model.recursive_users_query().all() if is_user_active(u)]
+        u = len(actives)
+        if model.mode == AdminMode.super_admin:
             return f"{u} / ∞"
-        t=model.max_active_users
-        rate=round(u*100/(t+0.000001))
-        state= "danger" if u>=t else ('warning' if  rate>80 else 'success')
-        color= "#ff7e7e" if u>=t else ('#ffc107' if  rate>80 else '#9ee150')
+        t = model.max_active_users
+        rate = round(u*100/(t+0.000001))
+        state = "danger" if u >= t else ('warning' if rate > 80 else 'success')
+        color = "#ff7e7e" if u >= t else ('#ffc107' if rate > 80 else '#9ee150')
         return Markup(f"""
         <div class="progress progress-lg position-relative" style="min-width: 100px;">
           <div class="progress-bar progress-bar-striped" role="progressbar" style="width: {rate}%;background-color: {color};" aria-valuenow="{rate}" aria-valuemin="0" aria-valuemax="100"></div>
               <span class='badge position-absolute' style="left:auto;right:auto;width: 100%;font-size:1em">{u} {_('user.home.usage.from')} {t}</span>
 
         </div>
-        """)    
+        """)
 
     column_formatters = {
         'name': _name_formatter,
         'online_users': _online_users_formatter,
         'max_users': _max_users_formatter,
         'max_active_users': _max_active_users_formatter,
-        'UserLinks':_ul_formatter
-        
+        'UserLinks': _ul_formatter
+
     }
+
     def search_placeholder(self):
         return f"{_('search')} {_('user.UUID')} {_('user.name')}"
 
-
     # def is_accessible(self):
     #     return g.admin.mode==AdminMode.super_admin
 
-
     def get_query(self):
-            # Get the base query
+        # Get the base query
         query = super().get_query()
 
-        admin_ids=g.admin.recursive_sub_admins_ids()
+        admin_ids = g.admin.recursive_sub_admins_ids()
         query = query.filter(AdminUser.id.in_(admin_ids))
 
         return query
@@ -188,67 +190,50 @@ class AdminstratorAdmin(AdminLTEModelView):
         # Get the base count query
         query = super().get_count_query()
 
-        admin_ids=g.admin.recursive_sub_admins_ids()
+        admin_ids = g.admin.recursive_sub_admins_ids()
         query = query.filter(AdminUser.id.in_(admin_ids))
 
         return query
 
-
     def on_model_change(self, form, model, is_created):
-        
+
         # if model.id==1:
         #     model.parent_admin_id=0
         #     model.parent_admin=None
         # else:
         #     model.parent_admin_id=1
         #     model.parent_admin=AdminUser.query.filter(AdminUser.id==1).first()
-        if model.id!=1 and model.parent_admin==None:
-            model.parent_admin_id=g.admin.id
-            model.parent_admin=g.admin
+        if model.id != 1 and model.parent_admin == None:
+            model.parent_admin_id = g.admin.id
+            model.parent_admin = g.admin
 
-        if g.admin.mode!=AdminMode.super_admin and model.mode==AdminMode.super_admin:
+        if g.admin.mode != AdminMode.super_admin and model.mode == AdminMode.super_admin:
             raise ValidationError("Sub-Admin can not have more power!!!!")
-        if model.mode==AdminMode.agent and model.mode!=AdminMode.agent:
+        if model.mode == AdminMode.agent and model.mode != AdminMode.agent:
             raise ValidationError("Sub-Admin can not have more power!!!!")
-        
-    def on_model_delete(self, model):
-        if model.id==1 or model.id==g.admin.id:
-            raise ValidationError(_("Owner can not be deleted!"))
-        users=model.recursive_users_query().all()
-        for u in users:
-            u.added_by=g.admin.id
-        
-        DailyUsage.query.filter(DailyUsage.admin_id.in_(model.recursive_sub_admins_ids())).update({'admin_id':g.admin.id})
-        AdminUser.query.filter(AdminUser.id.in_(model.recursive_sub_admins_ids())).delete()
-
-        db.session.commit()
-
 
+    def on_model_delete(self, model):
+        model.remove()
 
     def get_query_for_parent_admin(self):
         admin_user_id = self.get_pk_value()
         sub_admins_ids = set(recursive_sub_admins_ids(AdminUser.query.get(admin_user_id)))
         return AdminUser.query.filter(AdminUser.id.in_(sub_admins_ids)).with_entities(AdminUser.id, AdminUser.name)
 
-
     def on_form_prefill(self, form, id=None):
-        
-        
-        if g.admin.mode!=AdminMode.super_admin:
+
+        if g.admin.mode != AdminMode.super_admin:
             del form.mode
             del form.can_add_admin
-            
-        if g.admin.id==form._obj.id:
+
+        if g.admin.id == form._obj.id:
             del form.max_users
             del form.max_active_users
             del form.comment
             del form.can_add_admin
             if getattr(form, 'mode'):
                 del form.mode
-        elif form._obj.mode==AdminMode.super_admin:
+        elif form._obj.mode == AdminMode.super_admin:
             del form.max_users
             del form.max_active_users
             del form.can_add_admin
-        
-        
-        

{hiddifypanel-9.0.0.dev23 → hiddifypanel-9.0.0.dev25}/hiddifypanel/panel/admin/Backup.py

@@ -53,6 +53,8 @@ class Backup(FlaskView):
         if restore_form.validate_on_submit():
             set_hconfig(ConfigEnum.first_setup, False)
             file = restore_form.restore_file.data
+            if isinstance(file, list):
+                file = file[0]
             json_data = json.load(file)
 
             hiddify.set_db_from_json(json_data,

{hiddifypanel-9.0.0.dev23 → hiddifypanel-9.0.0.dev25}/hiddifypanel/panel/commercial/restapi/resources.py

@@ -14,32 +14,38 @@ from hiddifypanel.drivers import user_driver
 
 
 class UserResource(Resource):
-    def get(self, uuid=None):
-        uuid = request.args['uuid'] if 'uuid' in request.args else None
+    decorators = [hiddify.super_admin]
+
+    def get(self):
+        uuid = request.args.get('uuid')
         if uuid:
-            product = User.query.filter(User.uuid == uuid).first() or abort(204)
-            return jsonify(product.to_dict())
+            user = user_by_uuid(uuid) or abort(404, "user not found")
+            return jsonify(user.to_dict())
 
-        products = User.query.all() or abort(204)
-        return jsonify(
-            [product.to_dict() for product in products]
-        )
+        users = User.query.all() or abort(502, "WTF!")
+        return jsonify([user.to_dict() for user in users])
 
     def post(self):
         data = request.json
-        ### because add_client method accepts a user object not uuid the api returns 502 error.I have a possible fix for this
-        user = User.query.filter(User.uuid == data['uuid']).first() or abort(204)
+        uuid = data.get('uuid') or abort(422, "Parameter issue: 'uuid'")
         hiddify.add_or_update_user(**data)
+        user = user_by_uuid(uuid) or abort(502, "unknown issue! user is not added")
         user_driver.add_client(user)
         hiddify.quick_apply_users()
+        return jsonify({'status': 200, 'msg': 'ok'})
 
+    def delete(self):
+        uuid = request.args.get('uuid') or abort(422, "Parameter issue: 'uuid'")
+        user = user_by_uuid(uuid) or abort(404, "user not found")
+        user.remove()
+        hiddify.quick_apply_users()
         return jsonify({'status': 200, 'msg': 'ok'})
-    
-        ### start aliz dev
-    ### desc : it is better to have a delete method to manage users more programatically :)
+
+        # start aliz dev
+    # desc : it is better to have a delete method to manage users more programatically :)
     def delete(self, uuid=None):
         uuid = request.args['uuid'] if 'uuid' in request.args else None
-        if uuid:     
+        if uuid:
             user = User.query.filter(User.uuid == uuid).first() or abort(204)
             if user is not None:
                 hiddify.remove_user(uuid)
@@ -47,30 +53,37 @@ class UserResource(Resource):
                 hiddify.quick_apply_users()
                 return jsonify({'status': 200, 'msg': 'ok'})
             else:
-                return jsonify({'status': 204, 'msg': 'user not found'})     
+                return jsonify({'status': 204, 'msg': 'user not found'})
         else:
             return jsonify({'status': 204, 'msg': 'uuid not found'})
-    ### end aliz dev
+    # end aliz dev
 
 
 class AdminUserResource(Resource):
+    decorators = [hiddify.super_admin]
+
     def get(self, uuid=None):
-        uuid = request.args['uuid'] if 'uuid' in request.args else None
+        uuid = request.args.get('uuid')
         if uuid:
-            product = AdminUser.query.filter(AdminUser.uuid == uuid).first() or abort(204)
-            return jsonify(product.to_dict())
+            admin = get_admin_user_db(uuid) or abort(404, "user not found")
+            return jsonify(admin.to_dict())
 
-        products = AdminUser.query.all() or abort(204)
-        return jsonify(
-            [product.to_dict() for product in products]
-        )
+        admins = AdminUser.query.all() or abort(502, "WTF!")
+        return jsonify([admin.to_dict() for admin in admins])
 
     def post(self):
         data = request.json
+        uuid = data.get('uuid') or abort(422, "Parameter issue: 'uuid'")
         hiddify.add_or_update_admin(**data)
 
         return jsonify({'status': 200, 'msg': 'ok'})
 
+    def delete(self):
+        uuid = request.args.get('uuid') or abort(422, "Parameter issue: 'uuid'")
+        admin = get_admin_user_db(uuid) or abort(404, "admin not found")
+        admin.remove()
+        return jsonify({'status': 200, 'msg': 'ok'})
+
 
 # class DomainResource(Resource):
 #     def get(self,domain=None):

{hiddifypanel-9.0.0.dev23 → hiddifypanel-9.0.0.dev25}/hiddifypanel/panel/common.py

@@ -27,11 +27,14 @@ def init_app(app):
             # Create github issue link
             issue_link = generate_github_issue_link_for_500_error(e, trace)
 
-            last_version = hiddify.get_latest_release_version('hiddifypanel')
-            has_update = "T" not in hiddifypanel.__version__ and "dev" not in hiddifypanel.__version__ and f'{last_version}' != hiddifypanel.__version__
-            return render_template('500.html', error=e, trace=trace, has_update=has_update, last_version=last_version, issue_link=issue_link), 500
-        # if e.code in [400, 401, 403]:
-        #     return render_template('access-denied.html', error=e), e.code
+            last_version = hiddify.get_latest_release_version('hiddifypanel')//TODO: add dev update check
+            if "T" in hiddifypanel.__version__:
+                has_update = False
+            else:
+                has_update = "dev" not in hiddifypanel.__version__ and f'{last_version}' != hiddifypanel.__version__
+            return render_template('500.html', error=e, trace=trace, has_update=has_update, last_version=last_version), 500
+        # if e.code in [400,401,403]:
+        #     return render_template('access-denied.html',error=e), e.code
 
         return render_template('error.html', error=e), e.code