kevin
38cd09f723
P0（高危）: - 新增全局 CSRF 中间件（同步器令牌），覆盖全部 30 个表单与 AJAX 请求 - 修复附件上传/列表/删除越权（IDOR），增加 admin/上传者/文章作者所有权校验 - 登录/注册成功后会话轮换，修复会话固定 - 会话密钥改用 crypto/rand 生成，配置缺失 secret 时拒绝启动 P1（中危）: - session 与 comment_uid cookie 增加 Secure/SameSite 标志 - 新增安全响应头：CSP、X-Content-Type-Options、X-Frame-Options、HSTS 等 - 新增 web.trusted_proxies 配置，修复 X-Forwarded-For 伪造 - 修复浏览量记录 goroutine 访问已回收 gin.Context 的数据竞争 补充 17 个安全回归测试（middleware/handlers），go test -race 全绿
77 lines
4.0 KiB
HTML
77 lines
4.0 KiB
HTML
{{define "dashboard"}}
|
|
{{template "header" .}}
|
|
<section class="max-w-5xl mx-auto px-4 py-12">
|
|
<div class="flex items-center justify-between mb-8">
|
|
<div>
|
|
<h2 class="text-3xl font-bold text-gray-900">{{index .Tr "dash_title"}}</h2>
|
|
<p class="text-gray-500 mt-1">{{index .Tr "dash_welcome"}} <span class="font-medium text-gray-700">{{.Username}}</span>!</p>
|
|
</div>
|
|
<form action="/logout" method="post" class="m-0">
|
|
<input type="hidden" name="_csrf" value="{{.CSRFToken}}">
|
|
<button
|
|
type="submit"
|
|
class="bg-gray-200 text-gray-700 px-4 py-2 rounded-lg font-medium hover:bg-gray-300 transition-colors cursor-pointer"
|
|
>
|
|
{{index .Tr "logout"}}
|
|
</button>
|
|
</form>
|
|
</div>
|
|
|
|
<!-- Stats -->
|
|
<div class="grid grid-cols-1 md:grid-cols-3 gap-6 mb-10">
|
|
<div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
|
|
<p class="text-sm text-gray-500 uppercase tracking-wider">{{index .Tr "dash_posts"}}</p>
|
|
<p class="text-3xl font-bold text-gray-900 mt-1">{{.PostCount}}
|
|
<span class="text-sm font-normal text-gray-400">({{.PublishedCount}} {{index .Tr "dash_published"}})</span>
|
|
</p>
|
|
</div>
|
|
<div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
|
|
<p class="text-sm text-gray-500 uppercase tracking-wider">{{index .Tr "dash_pages"}}</p>
|
|
<p class="text-3xl font-bold text-gray-900 mt-1">0</p>
|
|
</div>
|
|
<div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
|
|
<p class="text-sm text-gray-500 uppercase tracking-wider">{{index .Tr "dash_users"}}</p>
|
|
<p class="text-3xl font-bold text-gray-900 mt-1">{{.UserCount}}</p>
|
|
</div>
|
|
</div>
|
|
|
|
<!-- Placeholder for future features -->
|
|
<div class="bg-white rounded-xl shadow-sm border border-gray-200 p-8 text-center">
|
|
<h3 class="text-xl font-semibold text-gray-800 mb-2">{{index .Tr "dash_mgmt_title"}}</h3>
|
|
<p class="text-gray-500 mb-6">{{index .Tr "dash_mgmt_desc"}}</p>
|
|
<div class="flex justify-center gap-3 flex-wrap">
|
|
<a href="/admin/articles/new"
|
|
class="inline-flex items-center gap-2 bg-blue-600 text-white px-6 py-3 rounded-lg font-medium hover:bg-blue-700 transition-colors">
|
|
<svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
|
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"/>
|
|
</svg>
|
|
{{index .Tr "dash_new_article"}}
|
|
</a>
|
|
<a href="/admin/articles"
|
|
class="inline-flex items-center gap-2 bg-gray-200 text-gray-700 px-6 py-3 rounded-lg font-medium hover:bg-gray-300 transition-colors">
|
|
{{index .Tr "article_manage"}}
|
|
</a>
|
|
{{if eq .Role "admin"}}
|
|
<a href="/admin/users"
|
|
class="inline-flex items-center gap-2 bg-gray-200 text-gray-700 px-6 py-3 rounded-lg font-medium hover:bg-gray-300 transition-colors">
|
|
{{index .Tr "dash_user_mgmt"}}
|
|
</a>
|
|
<a href="/admin/comments"
|
|
class="inline-flex items-center gap-2 bg-gray-200 text-gray-700 px-6 py-3 rounded-lg font-medium hover:bg-gray-300 transition-colors">
|
|
{{index .Tr "comment_manage"}}
|
|
</a>
|
|
<a href="/admin/settings/site"
|
|
class="inline-flex items-center gap-2 bg-gray-200 text-gray-700 px-6 py-3 rounded-lg font-medium hover:bg-gray-300 transition-colors">
|
|
{{index .Tr "settings_nav"}}
|
|
</a>
|
|
<a href="/admin/analytics/views"
|
|
class="inline-flex items-center gap-2 bg-gray-200 text-gray-700 px-6 py-3 rounded-lg font-medium hover:bg-gray-300 transition-colors">
|
|
{{index .Tr "analytics_views_title"}}
|
|
</a>
|
|
{{end}}
|
|
</div>
|
|
</div>
|
|
</section>
|
|
{{template "footer" .}}
|
|
{{end}}
|