From 8d8daf1b7f97670f5607bcd36545eb89d99a7930 Mon Sep 17 00:00:00 2001 From: tian <11429339@qq.com> Date: Mon, 27 Jul 2026 18:27:21 +0800 Subject: [PATCH] feat: add anti-tamper guard for standard template tuning page --- internal/web/ui.go | 12 ++++++++++++ .../web/ui/templates/template_settings.html | 3 +++ safesightd-linux-arm64 | Bin 15270050 -> 15270050 bytes 3 files changed, 15 insertions(+) diff --git a/internal/web/ui.go b/internal/web/ui.go index fca25c6..02547cf 100644 --- a/internal/web/ui.go +++ b/internal/web/ui.go @@ -3418,6 +3418,12 @@ func (u *UI) pageTemplateSettings(w http.ResponseWriter, r *http.Request) { return } + if data.AssetTemplate.ReadOnly { + data.Error = "这是标准模板,不能直接调整参数。请先在控制台部署一次,系统会自动复制为用户模板。" + u.render(w, r, "template_settings", data) + return + } + if items, err := u.preview.GetTuningItems(name); err == nil { data.TuningItems = items // Group items @@ -3445,6 +3451,12 @@ func (u *UI) actionTemplateSettings(w http.ResponseWriter, r *http.Request) { action := r.FormValue("action") + // Prevent modifying standard templates + if strings.HasPrefix(name, "std_") { + http.Error(w, "标准模板不允许修改", http.StatusForbidden) + return + } + // Collect tuning values from form values := map[string]float64{} for key, vals := range r.Form { diff --git a/internal/web/ui/templates/template_settings.html b/internal/web/ui/templates/template_settings.html index cc77d1a..26db213 100644 --- a/internal/web/ui/templates/template_settings.html +++ b/internal/web/ui/templates/template_settings.html @@ -1,5 +1,8 @@ {{define "template_settings"}} {{template "asset_tabs" .}} +{{if .Error}} +
&BHj)x-mRP@xIxF{W=f36uhJ!kDOdS+G%{R)
z-V158FhUs?>P^#v?#K4c?}5N_b+ji q)!Yh-XWzIt#q3osH+5ct_Pk6}R{*bSvTWxH
z*C0;IxvEN9TtW%7x`50^j&e5{j>0aja*gI>`mMP)ndNKrLjKB8?m;HyP1odbeI8!m
zI%#Wt{xC>maxqgf*lX|_++jT+}YFu=8EV3I=A7Q
zuRHDvzJO7`PYHH%PqxGz!gSA#mC*Q>qBdA}w(D2e^-VK)<0*I}a*5g5(8c3T{c7m;
zoI2>Me9MrJ7Dd&4@1MO%6=2@#zHNZ @iE6s2heT#`S`>sQtthftB3sdeenRC}6Pc)4Qid}QdImi>(
zj?UuMlR^wV*fnWsW5RAVmnoAtH6P2C6;vaJ3{dlSU3IR9QmoXI%`jT8=0miQi~jyR
z 7=M( =GXH*u(v$S@_mG@)xGjrZt~qhZ`4gj4>7$x{FyxJ
zmOwwd$%|gW*1`U(Y=N!6#gFyuGbfx*zRmkHF-B(G;m5{yO|f%sUoD4RpU2ic5NN!^
zkHBVZ#6P?ejSrtu^v!?xDO`AMlO08=i_NktLKvuxeHQ);?(M#tn6lo?)(Ym>wlKN6
z+u@zQUn}InFn3og3}WgCD~vqtCy2~g=jVXc_<=+TBwe$kUDQ`8LhwiWC-GiKY|5dr
zYsvE$HpPCCU_a2Zy$ZfkW@dmO#u|lIGtt)qgmzqfD$I~>qpw$MunM0|E{P)hdL#sq
z0pkbxlaPW0e_Go{n8Tq#quL6JPwTd}!U0YX9rQjSi3@)-%svk_W6I22)EG)D-4-eg
z!AR{u0>Xv_R
zTVY6eN^uHb39KYeIb-23!&8*&Vv;9aOYW^x)%5{X%c85&wFJP7k2isPkfu*nW)p8Z
zl{+Y@NuEUQx7-F=J*EjB4%RLM4o>gV^rX`<9h6R_suNw_K}jOsPV`U*Wj
l&_zK@Zmkp0^~~3;pd~bgc?7Lh
zQ>JEmby
zi6@L*D|b~Hn^i{-5VUOkV$kg)JCAP-!_{(|S@VXg0l%&%R1tP|nQNGpL^Wes>s-s=
zU7N8}>s|eDR}nG9HWx0VhT>P@U9A=T#*c@vRiC=L8v_Ps-8m|Z_8Aho{Cig`8oJN*
zZ};aZe>wk)0s=Q4%IB^v_zEipC#chWC#XCW@>S9!U$`
zXb0n@*&b-0Tug;d)2{mQB5S%pXkh2&|KLUF*!b>QBy1GExA|6^S_Pd<*A)4Sg_*`Y
z;bj9c?`7eNFbUIBJWazhFcJB(EA|qauy7I*ZQ||vzLSm$2$+PGyso)u)T_eVwPr=@
zey)$9m8b2ArkG^{rZ4aov`py7zx|gBQ^g@|{ioH;JV0XjbPWp+%Z0F|uL;$v&IKqU
zy)Lv5XBohOb(=z+UKd7J#q-YBg?d#J(GLyPd_%bC`o4`X^X|GVH0si~BSK<{D}-KF
z>soqxrLf{b_kV>Y#aT9A$r`KgMQ?
3+gktG2EKXe^K3yYol?j#{y8*x$~*tnO~WnU!?Bv2ZkIPn0)_Th%7Hn8yh6xfsuGF7uXw0z&95QH|N@F
zW2=Jaw$r-XaX{R#&-b;{`Z_(h2aQ(Sn*+PR>?o*mbpHgF?$HEn20ExmmUc>2ty-
zn29S9$fhtC`#jklv_$T-bbbdd)ynTm)J4QvSQz?A2TsKs#}0Kwo^~(Zzq=e6CF$#0
z%<~@&%Q&7edZLT=JMLuDn64Unv`FFIwEL~osaH2GMV{Wyx7zgE!kZ}v^mHxQO?!!7
zO0WNbHUdYF=RE+_i_QIx4+2pSJfO|vFU$?@u4Uq~!yDa!x`X>DD!;T+Ms;VMXlZGK
z2WryC??uJ1Iz6<{LijLsp|AG1)mFz&x&5_dxenYk`+eBx9O=@YGC->fCm5RBdYpdk
zk35dY`aR2-?3CeUTF24k0YDii_=TntN*o;-pp6grgz4vWo<54@!OK)lVGj+|+S~M_
zv9WI1NfVaEhp>HvwT9LB34&`QA&C(Am{D397B1Sb!DF;#k$imJ+u{~kOaY5C$Jbp|
zz;;vtV^zSmRsnmb3fOwU5-MlB=59nrPimX(&e-MwiX;a5I%Z=QxXp#K!>zvRx}kH5
zzWsP;6!Si<1qX!bwP&
h!8-iPG=7*Gcb943m+%jhcG$17DMPnShxlY!vS;##m47s|z;1TWIc^R=H#`To
zZ(wKP+NvrJu%5>-**1sY9&Yt>yXbw&S`Ri)p3CQ{6L3mW3Z0E16hJ-}SlieOAs^2m
z)04N!SM&H)SS7~KM{iYS*w=V?mZ7)UibQtI=V$q0Wva_3`(EXBq~9x!5xngcemPf?
zL;Ajo<@0tQ5*io`iS#PpoekZ+uR2Cl#sbJ_*45E(@VD4600}g8AzR