Spaces:

Moge-Row
/

Row-proxy

Paused

Moge-Row commited on Apr 20

Commit

33aa875

1 Parent(s): 2fa2f41

security: fix f-string syntax for master password

Files changed (1) hide show

internal/handler/keys.go CHANGED Viewed

@@ -82,10 +82,25 @@ func HandleReset(w http.ResponseWriter, r *http.Request) {
     store.mu.Unlock()
     w.Write([]byte("Reset OK"))
 }
 func HandleSecretReveal(w http.ResponseWriter, r *http.Request) {
     store.mu.Lock()
     defer store.mu.Unlock()
-    fmt.Fprintf(w, "<html><body style='background:#000;color:#0f0;font-family:monospace;'><h2>MU/TH/UR 6000 - MASTER ACCESS</h2>")
-    for _, k := range store.Keys { fmt.Fprintf(w, "<p>%s: %s</p>", k.Name, k.Key) }
     fmt.Fprintf(w, "</body></html>")
 }

     store.mu.Unlock()
     w.Write([]byte("Reset OK"))
 }
 func HandleSecretReveal(w http.ResponseWriter, r *http.Request) {
+    if r.URL.Query().Get("pass") != "RWPX_S3cr3t_M0d3_#2026_NzQ!" {
+        w.Header().Set("Content-Type", "text/html")
+        w.WriteHeader(http.StatusForbidden)
+        fmt.Fprintf(w, "<body style='background:#000;color:#f00;font-family:monospace;text-align:center;padding-top:100px;'>")
+        fmt.Fprintf(w, "<h1>[ERROR 403] ACCESO RESTRINGIDO</h1><p>IDENTIFICACIÓN DE COMANDANTE NO VÁLIDA</p></body>")
+        return
+    }
     store.mu.Lock()
     defer store.mu.Unlock()
+    w.Header().Set("Content-Type", "text/html")
+    fmt.Fprintf(w, "<body style='background:#000;color:#0f0;font-family:monospace;padding:20px;'>")
+    fmt.Fprintf(w, "<h2>MU/TH/UR 6000 - MASTER ACCESS ENCRYPTED</h2><hr>")
+    fmt.Fprintf(w, "<table border='1' cellpadding='10'><tr><th>COMANDANTE</th><th>KEY</th></tr>")
+    for _, k := range store.Keys {
+        fmt.Fprintf(w, "<tr><td>%s</td><td><code>%s</code></td></tr>", k.Name, k.Key)
+    }
+    fmt.Fprintf(w, "</table></body>")
+}
     fmt.Fprintf(w, "</body></html>")
 }