kevin
e314b05670
- #20 AuthRequired 改为 AuthRequired(db)：受保护路由每次回库校验 Status == StatusNormal 且未软删，失败清 session（保留 lang/csrf_token， 与登录轮换口径一致）并 302 /login；session user_id 先断言为数值再入 GORM（呼应 #19），AdminRequired 同步加固；SetUserContext 仅在用户 存在且状态正常时置 is_logged_in——禁用用户发评论不再自动通过， 回落游客审核策略 - #21 头像两个分支（UploadAvatar / UpdateProfile）强制 Category == image，解码失败直接拒绝、删除"回退存原始字节"路径， 统一经 processAvatar 解码→256px 缩放→JPEG 重编码；addUploadFileType 增加危险扩展黑名单（.html/.htm/.xhtml/.xht/.svg/.xml/.js/.mjs）， 拒绝添加并在上传设置页提示（模板 + 中英 i18n） - 附带修复：processAvatar 依赖的 png/gif 解码器此前未注册（旧代码靠 回退存原始字节掩盖，PNG 头像从未真正处理过），补 blank import - 新增回归测试 session_upload_security_test.go（6 用例：禁用/锁定/ 软删旧 cookie 302、锁定用户评论转 pending、6 组危险扩展拒绝、 伪装扩展名头像拒绝且磁盘零写入、正常图片转存 .jpg；已变异验证： 去掉任一修复对应测试即失败） - SECURITY_TODO.md 勾选 #20/#21 并更新执行顺序
149 lines
9.4 KiB
HTML
149 lines
9.4 KiB
HTML
{{define "settings_upload"}}
|
|
{{template "header" .}}
|
|
<section class="max-w-5xl mx-auto px-4 py-12">
|
|
<h2 class="text-3xl font-bold text-gray-900 mb-2">{{index .Tr "settings_upload_title"}}</h2>
|
|
<p class="text-gray-500 mb-4">{{index .Tr "settings_upload_desc"}}</p>
|
|
|
|
<div class="flex gap-2 mb-8">
|
|
<a href="/admin/settings/site" class="px-4 py-2 rounded-lg text-sm font-medium bg-gray-200 text-gray-700 hover:bg-gray-300 transition-colors">{{index .Tr "settings_site_title"}}</a>
|
|
<a href="/admin/settings/navlinks" class="px-4 py-2 rounded-lg text-sm font-medium bg-gray-200 text-gray-700 hover:bg-gray-300 transition-colors">{{index .Tr "settings_navlinks_title"}}</a>
|
|
<a href="/admin/settings/upload" class="px-4 py-2 rounded-lg text-sm font-medium bg-blue-600 text-white">{{index .Tr "settings_upload_title"}}</a>
|
|
<a href="/admin/settings/download" class="px-4 py-2 rounded-lg text-sm font-medium bg-gray-200 text-gray-700 hover:bg-gray-300 transition-colors">{{index .Tr "settings_download_title"}}</a>
|
|
</div>
|
|
|
|
{{if .Success}}
|
|
<div class="bg-green-50 border border-green-200 text-green-700 px-4 py-3 rounded-lg mb-6">{{.Success}}</div>
|
|
{{end}}
|
|
{{if .Error}}
|
|
<div class="bg-red-50 border border-red-200 text-red-700 px-4 py-3 rounded-lg mb-6">{{.Error}}</div>
|
|
{{end}}
|
|
|
|
<!-- Global policy -->
|
|
<form action="/admin/settings/upload" method="post" class="bg-white rounded-xl shadow-sm border border-gray-200 p-6 mb-8">
|
|
<input type="hidden" name="_csrf" value="{{.CSRFToken}}">
|
|
<input type="hidden" name="action" value="save_config">
|
|
<div class="grid grid-cols-1 sm:grid-cols-3 gap-4 mb-4">
|
|
<div>
|
|
<label class="block text-sm font-semibold text-gray-700 mb-1">{{index .Tr "settings_default_size"}}</label>
|
|
<input type="number" name="default_max_size" min="0" step="0.1" value="{{.DefaultMaxSizeMB}}"
|
|
class="w-full border border-gray-300 rounded-lg px-3 py-2">
|
|
</div>
|
|
<div>
|
|
<label class="block text-sm font-semibold text-gray-700 mb-1">{{index .Tr "settings_storage_dir"}}</label>
|
|
<input type="text" name="storage_dir" value="{{.Upload.StorageDir}}"
|
|
class="w-full border border-gray-300 rounded-lg px-3 py-2">
|
|
</div>
|
|
<div class="flex items-end">
|
|
<label class="inline-flex items-center gap-2 text-sm text-gray-700">
|
|
<input type="checkbox" name="enabled" value="1" {{if .Upload.Enabled}}checked{{end}}>
|
|
{{index .Tr "settings_uploads_enabled"}}
|
|
</label>
|
|
</div>
|
|
</div>
|
|
<button type="submit"
|
|
class="bg-blue-600 text-white px-6 py-2 rounded-lg font-medium hover:bg-blue-700 transition-colors">
|
|
{{index .Tr "settings_save"}}
|
|
</button>
|
|
</form>
|
|
|
|
<!-- File types table -->
|
|
<div class="bg-white rounded-xl shadow-sm border border-gray-200 overflow-hidden mb-8">
|
|
<div class="px-4 py-3 border-b border-gray-200">
|
|
<h3 class="font-semibold text-gray-800">{{index .Tr "settings_file_types"}}</h3>
|
|
</div>
|
|
<table class="w-full text-left">
|
|
<thead class="bg-gray-50 border-b border-gray-200">
|
|
<tr>
|
|
<th class="px-4 py-3 text-sm font-semibold text-gray-600">{{index .Tr "settings_extension"}}</th>
|
|
<th class="px-4 py-3 text-sm font-semibold text-gray-600">{{index .Tr "settings_mime"}}</th>
|
|
<th class="px-4 py-3 text-sm font-semibold text-gray-600">{{index .Tr "settings_category"}}</th>
|
|
<th class="px-4 py-3 text-sm font-semibold text-gray-600">{{index .Tr "settings_max_size"}}</th>
|
|
<th class="px-4 py-3 text-sm font-semibold text-gray-600">{{index .Tr "settings_enabled"}}</th>
|
|
<th class="px-4 py-3 text-sm font-semibold text-gray-600 text-right">{{index .Tr "settings_actions"}}</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody class="divide-y divide-gray-100">
|
|
{{range .FileTypes}}
|
|
<tr class="hover:bg-gray-50">
|
|
<td class="px-4 py-3 text-sm text-gray-800 font-mono">{{.Extension}}</td>
|
|
<td class="px-4 py-3 text-sm text-gray-500">{{.MimeType}}</td>
|
|
<td class="px-4 py-3 text-sm text-gray-500">{{index $.Tr (printf "cat_%s" .Category)}}</td>
|
|
<td class="px-4 py-3 text-sm text-gray-500">
|
|
<form action="/admin/settings/upload" method="post" class="flex items-center gap-1">
|
|
<input type="hidden" name="_csrf" value="{{$.CSRFToken}}">
|
|
<input type="hidden" name="action" value="size_type">
|
|
<input type="hidden" name="id" value="{{.ID}}">
|
|
<input type="number" name="max_size" min="0" step="0.1" value="{{.MaxSizeMB}}"
|
|
class="w-20 border border-gray-300 rounded px-2 py-1 text-sm">
|
|
<button type="submit" class="text-blue-600 hover:text-blue-800 text-xs">{{index $.Tr "settings_update"}}</button>
|
|
</form>
|
|
</td>
|
|
<td class="px-4 py-3 text-sm">
|
|
{{if .Enabled}}<span class="text-xs bg-green-100 text-green-700 px-2 py-1 rounded">✓</span>
|
|
{{else}}<span class="text-xs bg-gray-200 text-gray-500 px-2 py-1 rounded">—</span>{{end}}
|
|
</td>
|
|
<td class="px-4 py-3 text-sm text-right whitespace-nowrap">
|
|
<form action="/admin/settings/upload" method="post" class="inline">
|
|
<input type="hidden" name="_csrf" value="{{$.CSRFToken}}">
|
|
<input type="hidden" name="action" value="toggle_type">
|
|
<input type="hidden" name="id" value="{{.ID}}">
|
|
<button type="submit" class="text-gray-600 hover:text-gray-800 font-medium mr-3 cursor-pointer bg-transparent border-none">{{index $.Tr "settings_toggle"}}</button>
|
|
</form>
|
|
<form action="/admin/settings/upload" method="post" class="inline"
|
|
onsubmit="return confirm('{{index $.Tr "article_delete_confirm"}}');">
|
|
<input type="hidden" name="_csrf" value="{{$.CSRFToken}}">
|
|
<input type="hidden" name="action" value="delete_type">
|
|
<input type="hidden" name="id" value="{{.ID}}">
|
|
<button type="submit" class="text-red-600 hover:text-red-800 font-medium cursor-pointer bg-transparent border-none">{{index $.Tr "settings_delete"}}</button>
|
|
</form>
|
|
</td>
|
|
</tr>
|
|
{{end}}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<!-- Add file type -->
|
|
<form action="/admin/settings/upload" method="post" class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
|
|
<input type="hidden" name="_csrf" value="{{.CSRFToken}}">
|
|
<input type="hidden" name="action" value="add_type">
|
|
<h3 class="font-semibold text-gray-800 mb-4">{{index .Tr "settings_add_type"}}</h3>
|
|
<div class="grid grid-cols-1 sm:grid-cols-4 gap-4 mb-4">
|
|
<div>
|
|
<label class="block text-xs font-semibold text-gray-600 mb-1">{{index .Tr "settings_extension"}}</label>
|
|
<input type="text" name="extension" placeholder=".pdf" required
|
|
class="w-full border border-gray-300 rounded-lg px-3 py-2">
|
|
</div>
|
|
<div>
|
|
<label class="block text-xs font-semibold text-gray-600 mb-1">{{index .Tr "settings_mime"}}</label>
|
|
<input type="text" name="mime_type" placeholder="application/pdf"
|
|
class="w-full border border-gray-300 rounded-lg px-3 py-2">
|
|
</div>
|
|
<div>
|
|
<label class="block text-xs font-semibold text-gray-600 mb-1">{{index .Tr "settings_category"}}</label>
|
|
<select name="category" class="w-full border border-gray-300 rounded-lg px-3 py-2">
|
|
<option value="image">{{index .Tr "cat_image"}}</option>
|
|
<option value="document">{{index .Tr "cat_document"}}</option>
|
|
<option value="archive">{{index .Tr "cat_archive"}}</option>
|
|
<option value="video">{{index .Tr "cat_video"}}</option>
|
|
<option value="other">{{index .Tr "cat_other"}}</option>
|
|
</select>
|
|
</div>
|
|
<div>
|
|
<label class="block text-xs font-semibold text-gray-600 mb-1">{{index .Tr "settings_max_size"}} (0=default)</label>
|
|
<input type="number" name="max_size" min="0" step="0.1" value="0"
|
|
class="w-full border border-gray-300 rounded-lg px-3 py-2">
|
|
</div>
|
|
</div>
|
|
<label class="inline-flex items-center gap-2 text-sm text-gray-700 mb-4">
|
|
<input type="checkbox" name="enabled" value="1" checked> {{index .Tr "settings_enabled"}}
|
|
</label>
|
|
<button type="submit"
|
|
class="block bg-blue-600 text-white px-6 py-2 rounded-lg font-medium hover:bg-blue-700 transition-colors">
|
|
{{index .Tr "settings_add_type"}}
|
|
</button>
|
|
</form>
|
|
</section>
|
|
{{template "footer" .}}
|
|
{{end}}
|