update 2026-08-19 20:34:50

luci-app-passwall/root/usr/share/passwall/monitor.sh

@@ -27,6 +27,8 @@ while [ 1 -eq 1 ]; do
 			*dns2socks*) cmd_check=${cmd_check//:/ } ;;
 		esac
 
+		cmd_check=$(printf '%s' "$cmd_check" | sed 's/[^a-zA-Z0-9 ]/\\&/g')
+
 		filename=$(basename "$file")
 		stats_file="${RESTART_STATS_DIR}/${filename}.count"
 		if [ -s "$stats_file" ]; then
@@ -38,11 +40,11 @@ while [ 1 -eq 1 ]; do
 		# 检查是否超过最大重启次数
 		[ "$restart_count" -ge "$MAX_RESTART_COUNT" ] && continue
 
-		if ! busybox pgrep -f "$cmd_check" >/dev/null; then
+		if ! busybox pgrep -f "${cmd_check}" >/dev/null; then
 			restart_count=$((restart_count + 1))
 			echo "$restart_count" > "$stats_file"
 			#echo "${cmd} 进程挂掉，重启" >> /tmp/log/passwall.log
-			sh -c "nohup $cmd 2>&1 &"
+			sh -c "nohup ${cmd} 2>&1 &"
 			sleep 1
 		fi
 	done

luci-app-passwall/root/usr/share/passwall/subscribe.lua

@@ -1471,8 +1471,6 @@ local function processData(szType, content, add_mode, group, sub_cfg)
 		result.tls_serverName = params.sni
 		result.tls_pinSHA256 = params.pcs or params.pinsha256
 		result.tls_CertByName = params.vcn
-		local insecure = params.allowinsecure or params.insecure
-		result.tls_allowInsecure = (insecure == "1" or insecure == "0") and insecure or (sub_allowinsecure and "1" or "0")
 		result.hysteria2_up_mbps = params.upmbps or (sub_cfg and sub_hy_up_mbps or nil)
 		result.hysteria2_down_mbps = params.downmbps or (sub_cfg and sub_hy_down_mbps or nil)
 		result.hysteria2_hop = params.mport
@@ -1484,19 +1482,26 @@ local function processData(szType, content, add_mode, group, sub_cfg)
 			result.hysteria2_obfs_MinPacketSize = params.minpacketsize or "512"
 			result.hysteria2_obfs_MaxPacketSize = params.maxpacketsize or "1200"
 		end
-
 		if (sub_hysteria2_type == "sing-box" and has_singbox) or (sub_hysteria2_type == "xray" and has_xray) then
 			local is_singbox = sub_hysteria2_type == "sing-box" and has_singbox
 			result.type = is_singbox and 'sing-box' or 'Xray'
 			result.protocol = "hysteria2"
 			result.use_finalmask = (params.fm and params.fm ~= "") and "1" or nil
 			result.finalmask = (params.fm and params.fm ~= "") and api.base64Encode(params.fm) or nil
+			if is_singbox and (params.pcs or params.pinsha256) then
+				params.allowinsecure = "1"
+			end
 		elseif has_hysteria2 then
 			result.type = "Hysteria2"
+			if params.pcs or params.pinsha256 then
+				params.allowinsecure = "0"
+			end
 		else
 			log("跳过 Hysteria2 节点，因未适配到 Hysteria2 核心程序，或未正确设置节点使用类型。")
 			return nil
 		end
+		local insecure = params.allowinsecure or params.insecure
+		result.tls_allowInsecure = (insecure == "1" or insecure == "0") and insecure or (sub_allowinsecure and "1" or "0")
 	elseif szType == 'tuic' then
 		if has_singbox then
 			result.type = 'sing-box'