Files
go_blog/templates/admin/settings_download.html
T
kevin 38cd09f723 fix: 安全加固,修复 P0/P1 安全漏洞
P0(高危):
- 新增全局 CSRF 中间件(同步器令牌),覆盖全部 30 个表单与 AJAX 请求
- 修复附件上传/列表/删除越权(IDOR),增加 admin/上传者/文章作者所有权校验
- 登录/注册成功后会话轮换,修复会话固定
- 会话密钥改用 crypto/rand 生成,配置缺失 secret 时拒绝启动

P1(中危):
- session 与 comment_uid cookie 增加 Secure/SameSite 标志
- 新增安全响应头:CSP、X-Content-Type-Options、X-Frame-Options、HSTS 等
- 新增 web.trusted_proxies 配置,修复 X-Forwarded-For 伪造
- 修复浏览量记录 goroutine 访问已回收 gin.Context 的数据竞争

补充 17 个安全回归测试(middleware/handlers),go test -race 全绿
2026-08-19 12:33:09 +08:00

109 lines
7.0 KiB
HTML

{{define "settings_download"}}
{{template "header" .}}
<section class="max-w-4xl mx-auto px-4 py-12">
<h2 class="text-3xl font-bold text-gray-900 mb-2">{{index .Tr "settings_download_title"}}</h2>
<p class="text-gray-500 mb-4">{{index .Tr "settings_download_desc"}}</p>
<div class="flex gap-2 mb-8">
<a href="/admin/settings/site" class="px-4 py-2 rounded-lg text-sm font-medium bg-gray-200 text-gray-700 hover:bg-gray-300 transition-colors">{{index .Tr "settings_site_title"}}</a>
<a href="/admin/settings/navlinks" class="px-4 py-2 rounded-lg text-sm font-medium bg-gray-200 text-gray-700 hover:bg-gray-300 transition-colors">{{index .Tr "settings_navlinks_title"}}</a>
<a href="/admin/settings/upload" class="px-4 py-2 rounded-lg text-sm font-medium bg-gray-200 text-gray-700 hover:bg-gray-300 transition-colors">{{index .Tr "settings_upload_title"}}</a>
<a href="/admin/settings/download" class="px-4 py-2 rounded-lg text-sm font-medium bg-blue-600 text-white">{{index .Tr "settings_download_title"}}</a>
</div>
{{if .Success}}
<div class="bg-green-50 border border-green-200 text-green-700 px-4 py-3 rounded-lg mb-6">{{.Success}}</div>
{{end}}
<div class="bg-white rounded-xl shadow-sm border border-gray-200 overflow-hidden mb-8">
<table class="w-full text-left">
<thead class="bg-gray-50 border-b border-gray-200">
<tr>
<th class="px-4 py-3 text-sm font-semibold text-gray-600">{{index .Tr "settings_url_name"}}</th>
<th class="px-4 py-3 text-sm font-semibold text-gray-600">{{index .Tr "settings_base_url"}}</th>
<th class="px-4 py-3 text-sm font-semibold text-gray-600">{{index .Tr "settings_priority"}}</th>
<th class="px-4 py-3 text-sm font-semibold text-gray-600">{{index .Tr "settings_is_default"}}</th>
<th class="px-4 py-3 text-sm font-semibold text-gray-600">{{index .Tr "settings_enabled"}}</th>
<th class="px-4 py-3 text-sm font-semibold text-gray-600 text-right">{{index .Tr "settings_actions"}}</th>
</tr>
</thead>
<tbody class="divide-y divide-gray-100">
{{range .BaseURLs}}
<tr class="hover:bg-gray-50">
<td class="px-4 py-3 text-sm text-gray-800">{{.Name}}</td>
<td class="px-4 py-3 text-sm text-gray-500 break-all">{{.BaseURL}}</td>
<td class="px-4 py-3 text-sm text-gray-500">{{.Priority}}</td>
<td class="px-4 py-3 text-sm">
{{if .IsDefault}}<span class="text-xs bg-blue-100 text-blue-700 px-2 py-1 rounded"></span>{{end}}
</td>
<td class="px-4 py-3 text-sm">
{{if .Enabled}}<span class="text-xs bg-green-100 text-green-700 px-2 py-1 rounded"></span>
{{else}}<span class="text-xs bg-gray-200 text-gray-500 px-2 py-1 rounded"></span>{{end}}
</td>
<td class="px-4 py-3 text-sm text-right whitespace-nowrap">
<form action="/admin/settings/download" method="post" class="inline">
<input type="hidden" name="_csrf" value="{{$.CSRFToken}}">
<input type="hidden" name="action" value="default">
<input type="hidden" name="id" value="{{.ID}}">
<button type="submit" class="text-blue-600 hover:text-blue-800 font-medium mr-3 cursor-pointer bg-transparent border-none">{{index $.Tr "settings_set_default"}}</button>
</form>
<form action="/admin/settings/download" method="post" class="inline">
<input type="hidden" name="_csrf" value="{{$.CSRFToken}}">
<input type="hidden" name="action" value="toggle">
<input type="hidden" name="id" value="{{.ID}}">
<button type="submit" class="text-gray-600 hover:text-gray-800 font-medium mr-3 cursor-pointer bg-transparent border-none">{{index $.Tr "settings_toggle"}}</button>
</form>
<form action="/admin/settings/download" method="post" class="inline"
onsubmit="return confirm('{{index $.Tr "article_delete_confirm"}}');">
<input type="hidden" name="_csrf" value="{{$.CSRFToken}}">
<input type="hidden" name="action" value="delete">
<input type="hidden" name="id" value="{{.ID}}">
<button type="submit" class="text-red-600 hover:text-red-800 font-medium cursor-pointer bg-transparent border-none">{{index $.Tr "settings_delete"}}</button>
</form>
</td>
</tr>
{{else}}
<tr>
<td colspan="6" class="px-4 py-12 text-center text-gray-500"></td>
</tr>
{{end}}
</tbody>
</table>
</div>
<!-- Add base URL -->
<form action="/admin/settings/download" method="post" class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
<input type="hidden" name="_csrf" value="{{.CSRFToken}}">
<input type="hidden" name="action" value="add">
<h3 class="font-semibold text-gray-800 mb-4">{{index .Tr "settings_add_url"}}</h3>
<div class="grid grid-cols-1 sm:grid-cols-3 gap-4 mb-4">
<div>
<label class="block text-xs font-semibold text-gray-600 mb-1">{{index .Tr "settings_url_name"}}</label>
<input type="text" name="name" placeholder="CDN"
class="w-full border border-gray-300 rounded-lg px-3 py-2">
</div>
<div class="sm:col-span-2">
<label class="block text-xs font-semibold text-gray-600 mb-1">{{index .Tr "settings_base_url"}}</label>
<input type="text" name="base_url" placeholder="https://cdn.example.com/uploads" required
class="w-full border border-gray-300 rounded-lg px-3 py-2">
</div>
</div>
<div class="flex items-center gap-6">
<div>
<label class="block text-xs font-semibold text-gray-600 mb-1">{{index .Tr "settings_priority"}}</label>
<input type="number" name="priority" value="0"
class="w-24 border border-gray-300 rounded-lg px-3 py-2">
</div>
<label class="inline-flex items-center gap-2 text-sm text-gray-700 mt-5">
<input type="checkbox" name="enabled" value="1" checked> {{index .Tr "settings_enabled"}}
</label>
</div>
<button type="submit"
class="mt-4 bg-blue-600 text-white px-6 py-2 rounded-lg font-medium hover:bg-blue-700 transition-colors">
{{index .Tr "settings_add_url"}}
</button>
</form>
</section>
{{template "footer" .}}
{{end}}