v1.26.2 — **Hotfix. Update immediately if you are on 1.26.1.**

Hotfix. Update immediately if you are on 1.26.1.

Login returned HTTP 500 on 1.26.1

1.26.1 broke the panel on every install. Auth::clientIp() — added in that release to record the real client IP for logging and fail2ban — called itself as its own final fallback instead of reading REMOTE_ADDR. Infinite recursion, stack exhaustion, HTTP 500.

It only triggered when a request arrived with no CF-Connecting-IP and no X-Forwarded-For header, which is every direct request and every request after login. Requests arriving through a Cloudflare Tunnel took an earlier branch and returned before reaching it, which is why it was not caught before release.

One line. No configuration change, no data affected, nothing to undo.

If you are stuck on 1.26.1

The nightly auto-update will apply this. To fix it now from a root shell:

inetp panel_update

If the panel is unreachable and you would rather patch by hand, in /var/www/inetpanel/TiCore/Auth.php change the line inside clientIp():

$ra = self::clientIp();                    // broken
$ra = $_SERVER['REMOTE_ADDR'] ?? '';       // correct

then systemctl reload php8.5-fpm.

Apologies

This should not have shipped. The security fixes in 1.26.1 were tested, but this helper's output was verified without ever calling it on the one code path that recursed. 1.26.1 remains the release that fixes the privilege escalation — please update to 1.26.2 rather than rolling back to 1.26.0.