mirror of
https://github.com/phishingclub/phishingclub.git
synced 2026-10-12 01:58:53 +02:00
40 lines
1.4 KiB
Go
40 lines
1.4 KiB
Go
package controller
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// Preview renders admin authored preview content isolated from the admin origin.
|
|
type Preview struct {
|
|
Common
|
|
}
|
|
|
|
// previewMaxBodyBytes caps the posted content so an authenticated request can
|
|
// not spill an unbounded body to disk during form parsing. A preview is a page
|
|
// or email template plus inline data urls, well under this.
|
|
const previewMaxBodyBytes = 20 << 20
|
|
|
|
// Render returns the posted content as an html document carrying a sandbox
|
|
// content security policy. The sandbox flag gives the document an opaque origin,
|
|
// so scripts in the previewed content can not read the admin session, cookies or
|
|
// call the API, while the document still gets its own policy and loads its own
|
|
// external images, styles, fonts and scripts for an accurate preview. The
|
|
// security headers middleware sets the strict admin policy on every response;
|
|
// this handler then replaces that header with its own sandbox policy, so the
|
|
// preview does not inherit it. allow-same-origin is deliberately absent.
|
|
func (p *Preview) Render(g *gin.Context) {
|
|
_, _, ok := p.handleSession(g)
|
|
if !ok {
|
|
return
|
|
}
|
|
g.Request.Body = http.MaxBytesReader(g.Writer, g.Request.Body, previewMaxBodyBytes)
|
|
content := g.PostForm("content")
|
|
g.Header(
|
|
"Content-Security-Policy",
|
|
"sandbox allow-scripts allow-forms allow-popups allow-modals",
|
|
)
|
|
g.Data(http.StatusOK, "text/html; charset=utf-8", []byte(content))
|
|
}
|