Bezbednost: rešeno 7 kritičnih nalaza (HP-01 do HP-07)

internal/middleware/bezbednost.go

@@ -14,7 +14,7 @@ func BezbednostHeaders() func(http.Handler) http.Handler {
 			h.Set("Content-Security-Policy",
 				"default-src 'self'; "+
 					"style-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; "+
-					"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.tailwindcss.com https://cdn.jsdelivr.net; "+
+					"script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com https://cdn.jsdelivr.net; "+
 					"img-src 'self' data: blob:; "+
 					"font-src 'self'; "+
 					"connect-src 'self'")

internal/middleware/csrf.go

@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"net/http"
+	"os"
 )
 
 const csrfKolacic = "ntech_csrf"
@@ -38,6 +39,7 @@ func CsrfMiddleware(next http.Handler) http.Handler {
 					Path:     "/",
 					MaxAge:   86400 * 30,
 					HttpOnly: true,
+					Secure:   os.Getenv("NTECH_ENV") == "production",
 					SameSite: http.SameSiteStrictMode,
 				})
 			}

internal/middleware/flash.go

@@ -29,17 +29,31 @@ func GetFlash(r *http.Request, db *sql.DB) *model.FlashPoruka {
 	if err != nil {
 		return nil
 	}
+
+	tx, err := db.BeginTx(r.Context(), nil)
+	if err != nil {
+		return nil
+	}
+	defer tx.Rollback()
+
 	var flashJSON sql.NullString
-	if err := db.QueryRowContext(r.Context(),
+	if err := tx.QueryRowContext(r.Context(),
 		`SELECT flash FROM sesije WHERE token = ?`, kolacic.Value).Scan(&flashJSON); err != nil {
 		return nil
 	}
 	if !flashJSON.Valid || flashJSON.String == "" {
 		return nil
 	}
-	// briše pre parsiranja — ako parsiranje ne uspe, poruka se svakako ne prikazuje
-	db.ExecContext(r.Context(),
-		`UPDATE sesije SET flash = NULL WHERE token = ?`, kolacic.Value)
+
+	if _, err := tx.ExecContext(r.Context(),
+		`UPDATE sesije SET flash = NULL WHERE token = ?`, kolacic.Value); err != nil {
+		return nil
+	}
+
+	if err := tx.Commit(); err != nil {
+		return nil
+	}
+
 	var f model.FlashPoruka
 	if err := json.Unmarshal([]byte(flashJSON.String), &f); err != nil {
 		return nil