From c583472e3ee2c4ade1a42592e4b9fb86b05ee1c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dalibor=20Markovi=C4=87?= Date: Tue, 30 Jun 2026 14:27:20 +0200 Subject: [PATCH] =?UTF-8?q?Pode=C5=A1avanja:=20ispravka=20preuzimanja=20ba?= =?UTF-8?q?ckup-a=20(hx-boost),=20CodeQL=20request-forgery=20(SSRF)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- internal/handler/podesavanja.go | 8 ++++++-- web/templates/stranice/podesavanja.html | 2 +- web/templates/stranice/podesavanja_sistem.html | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/internal/handler/podesavanja.go b/internal/handler/podesavanja.go index 1b3a4ee..5c31749 100644 --- a/internal/handler/podesavanja.go +++ b/internal/handler/podesavanja.go @@ -947,11 +947,15 @@ func (h *Handler) TestFiskalizacije(w http.ResponseWriter, r *http.Request) { // 10.x.x.x, 172.16-31.x.x, 127.x.x.x). URL rekonstruišemo kroz url.URL{} // iz validiranih komponenti da CodeQL prepozna sanitizaciju. parsedURL, err := url.Parse(pfrURL) - if err != nil || !jePrivatnaAdresa(parsedURL.Hostname()) { - http.Error(w, "Nevažeći PFR URL — dozvoljeni su samo lokalni/privatni hostovi (127.x, 192.168.x, 10.x, 172.16-31.x)", http.StatusBadRequest) + if err != nil { + http.Error(w, "Nevažeći PFR URL", http.StatusBadRequest) return } host := parsedURL.Hostname() + if !jePrivatnaAdresa(host) { + http.Error(w, "Nevažeći PFR URL — dozvoljeni su samo lokalni/privatni hostovi (127.x, 192.168.x, 10.x, 172.16-31.x)", http.StatusBadRequest) + return + } port := 4566 if p := parsedURL.Port(); p != "" { if n, e := strconv.Atoi(p); e == nil && n > 0 && n <= 65535 { diff --git a/web/templates/stranice/podesavanja.html b/web/templates/stranice/podesavanja.html index e23326c..da29a57 100644 --- a/web/templates/stranice/podesavanja.html +++ b/web/templates/stranice/podesavanja.html @@ -267,7 +267,7 @@
Verzija programa: {{.Verzija}}
- diff --git a/web/templates/stranice/podesavanja_sistem.html b/web/templates/stranice/podesavanja_sistem.html index b5dc7c4..dd41a19 100644 --- a/web/templates/stranice/podesavanja_sistem.html +++ b/web/templates/stranice/podesavanja_sistem.html @@ -14,7 +14,7 @@
Verzija programa: {{.Verzija}}
-