mirror of
https://github.com/Buriburizaem0n/nezha_domains.git
synced 2026-09-19 17:50:12 +00:00
listServerGroup returned every group, including ones whose only servers are HideForGuest=true (or that have zero members), to unauthenticated callers. The group name itself is then leaked to guests even though every server it references is hidden from them. Guest visitors now only see groups that contain at least one guest- visible server. Authenticated members and admins keep full visibility (including their own empty groups) so management UI still works. Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>