Dasko/GoNtech
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Podešavanja: ispravka preuzimanja backup-a (hx-boost), CodeQL request-forgery (SSRF)

Browse Source
This commit is contained in:
Dasko
2026-06-30 14:27:20 +02:00
parent 030049befd
commit c583472e3e
3 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/handler/podesavanja.go
+6 -2
View File
@@ -947,11 +947,15 @@ func (h *Handler) TestFiskalizacije(w http.ResponseWriter, r *http.Request) {
// 10.x.x.x, 172.16-31.x.x, 127.x.x.x). URL rekonstruišemo kroz url.URL{}
// iz validiranih komponenti da CodeQL prepozna sanitizaciju.
parsedURL, err := url.Parse(pfrURL)
if err != nil || !jePrivatnaAdresa(parsedURL.Hostname()) {
http.Error(w, "Nevažeći PFR URL — dozvoljeni su samo lokalni/privatni hostovi (127.x, 192.168.x, 10.x, 172.16-31.x)", http.StatusBadRequest)
if err != nil {
http.Error(w, "Nevažeći PFR URL", http.StatusBadRequest)
return
}
host := parsedURL.Hostname()
if !jePrivatnaAdresa(host) {
http.Error(w, "Nevažeći PFR URL — dozvoljeni su samo lokalni/privatni hostovi (127.x, 192.168.x, 10.x, 172.16-31.x)", http.StatusBadRequest)
return
}
port := 4566
if p := parsedURL.Port(); p != "" {
if n, e := strconv.Atoi(p); e == nil && n > 0 && n <= 65535 {
web/templates/stranice/podesavanja.html
+1 -1
View File
@@ -267,7 +267,7 @@
<div style="display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:12px;">
<div class="pomocni-tekst">Verzija programa: <span style="color:var(--tekst-glavni);font-weight:500;">{{.Verzija}}</span></div>
<div style="display:flex;gap:8px;flex-wrap:wrap;">
<a hx-boost="true" hx-target="#glavni-sadrzaj" hx-select="#glavni-sadrzaj" hx-swap="outerHTML" href="/podesavanja/backup"
<a href="/podesavanja/backup"
style="display:inline-flex;align-items:center;gap:6px;padding:8px 16px;background:var(--kartica);border:0.5px solid var(--ivica);border-radius:8px;font-size:13px;color:var(--tekst-sporedni);text-decoration:none;transition:background 0.2s;"
onmouseover="this.style.background='var(--pozadina)'" onmouseout="this.style.background='var(--kartica)'">
<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
web/templates/stranice/podesavanja_sistem.html
+1 -1
View File
@@ -14,7 +14,7 @@
<div style="display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:12px;">
<div class="pomocni-tekst">Verzija programa: <span style="color:var(--tekst-glavni);font-weight:500;">{{.Verzija}}</span></div>
<div style="display:flex;gap:8px;flex-wrap:wrap;">
<a hx-boost="true" hx-target="#glavni-sadrzaj" hx-select="#glavni-sadrzaj" hx-swap="outerHTML" href="/podesavanja/backup"
<a href="/podesavanja/backup"
style="display:inline-flex;align-items:center;gap:6px;padding:8px 16px;background:var(--kartica);border:0.5px solid var(--ivica);border-radius:8px;font-size:13px;color:var(--tekst-sporedni);text-decoration:none;transition:background 0.2s;"
onmouseover="this.style.background='var(--pozadina)'" onmouseout="this.style.background='var(--kartica)'">
<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>