From 3054041257ae25306e4e498c457a5bf1a7976d0c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dalibor=20Markovi=C4=87?= Date: Tue, 16 Jun 2026 03:09:06 +0200 Subject: [PATCH] =?UTF-8?q?Bezbednost:=20ispravka=20otvorene=20redirekcije?= =?UTF-8?q?=20(open=20redirect)=20-=20podesavanja.go:=20=5Fnext=20parameta?= =?UTF-8?q?r=20sada=20odbacuje=20putanje=20koje=20po=C4=8Dinju=20sa=20"//"?= =?UTF-8?q?=20(npr.=20"//evil.com"=20prolazilo=20je=20staru=20proveru=20je?= =?UTF-8?q?r=20po=C4=8Dinje=20sa=20"/")=20-=20profil.go:=20Referer=20zagla?= =?UTF-8?q?vlje=20se=20parsira=20i=20koristi=20samo=20putanja=20(RequestUR?= =?UTF-8?q?I),=20bez=20hosta=20=E2=80=94=20spre=C4=8Dava=20preusmeravanje?= =?UTF-8?q?=20na=20spoljne=20domene?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- internal/handler/profil.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/internal/handler/profil.go b/internal/handler/profil.go index eadca45..be873fa 100644 --- a/internal/handler/profil.go +++ b/internal/handler/profil.go @@ -5,6 +5,7 @@ import ( "io" "log/slog" "net/http" + "net/url" "os" "path/filepath" "strings" @@ -282,10 +283,12 @@ func (h *Handler) SacuvajLokalnuTemu(w http.ResponseWriter, r *http.Request) { } middleware.SetFlash(w, r, h.DB, "uspeh", "Tema je sačuvana.") - // vrati korisnika na stranicu odakle je došao (Referer), ili na profil kao fallback + // koristimo samo putanju iz Referer zaglavlja — nikad ceo URL jer može biti spoljni sajt if ref := r.Referer(); ref != "" { - http.Redirect(w, r, ref, http.StatusSeeOther) - return + if u, err := url.Parse(ref); err == nil { + http.Redirect(w, r, u.RequestURI(), http.StatusSeeOther) + return + } } http.Redirect(w, r, "/admin/profil", http.StatusSeeOther) }