🎉 Fix: Address security vulnerability in admin-unified module & related files (#XXXXXX)
This commit is contained in:
@@ -8,6 +8,119 @@
|
||||
// Chart.js Instanzen Global verfügbar machen
|
||||
window.statsCharts = {};
|
||||
|
||||
// API Base URL Detection
|
||||
function detectApiBaseUrl() {
|
||||
const currentPort = window.location.port;
|
||||
const currentProtocol = window.location.protocol;
|
||||
const currentHost = window.location.hostname;
|
||||
|
||||
// Development-Umgebung (Port 5000)
|
||||
if (currentPort === '5000') {
|
||||
return `${currentProtocol}//${currentHost}:${currentPort}`;
|
||||
}
|
||||
|
||||
// Production-Umgebung (Port 443 oder kein Port)
|
||||
if (currentPort === '443' || currentPort === '') {
|
||||
return `${currentProtocol}//${currentHost}`;
|
||||
}
|
||||
|
||||
// Fallback für andere Ports
|
||||
return window.location.origin;
|
||||
}
|
||||
|
||||
const API_BASE_URL = detectApiBaseUrl();
|
||||
|
||||
/**
|
||||
* Zentrale API-Response-Validierung mit umfassendem Error-Handling
|
||||
* @param {Response} response - Fetch Response-Objekt
|
||||
* @param {string} context - Kontext der API-Anfrage für bessere Fehlermeldungen
|
||||
* @returns {Promise<Object>} - Validierte JSON-Daten
|
||||
* @throws {Error} - Bei Validierungsfehlern
|
||||
*/
|
||||
async function validateApiResponse(response, context = 'API-Anfrage') {
|
||||
try {
|
||||
// 1. HTTP Status Code prüfen
|
||||
if (!response.ok) {
|
||||
// Spezielle Behandlung für bekannte Fehler-Codes
|
||||
switch (response.status) {
|
||||
case 401:
|
||||
throw new Error(`Authentifizierung fehlgeschlagen (${context})`);
|
||||
case 403:
|
||||
throw new Error(`Zugriff verweigert (${context})`);
|
||||
case 404:
|
||||
throw new Error(`Ressource nicht gefunden (${context})`);
|
||||
case 429:
|
||||
throw new Error(`Zu viele Anfragen (${context})`);
|
||||
case 500:
|
||||
throw new Error(`Serverfehler (${context})`);
|
||||
case 503:
|
||||
throw new Error(`Service nicht verfügbar (${context})`);
|
||||
default:
|
||||
throw new Error(`HTTP ${response.status}: ${response.statusText} (${context})`);
|
||||
}
|
||||
}
|
||||
|
||||
// 2. Content-Type prüfen (muss application/json enthalten)
|
||||
const contentType = response.headers.get('content-type');
|
||||
if (!contentType || !contentType.includes('application/json')) {
|
||||
// Versuche Response-Text zu lesen für bessere Fehlermeldung
|
||||
const responseText = await response.text();
|
||||
|
||||
// Prüfe auf HTML-Fehlerseiten (typisch für 404/500 Seiten)
|
||||
if (responseText.includes('<!DOCTYPE html>') || responseText.includes('<html')) {
|
||||
console.warn(`❌ HTML-Fehlerseite erhalten statt JSON (${context}):`, responseText.substring(0, 200));
|
||||
throw new Error(`Server-Fehlerseite erhalten statt JSON-Response (${context})`);
|
||||
}
|
||||
|
||||
console.warn(`❌ Ungültiger Content-Type (${context}):`, contentType);
|
||||
console.warn(`❌ Response-Text (${context}):`, responseText.substring(0, 500));
|
||||
throw new Error(`Ungültiger Content-Type: ${contentType || 'fehlt'} (${context})`);
|
||||
}
|
||||
|
||||
// 3. JSON parsing mit detailliertem Error-Handling
|
||||
let data;
|
||||
try {
|
||||
data = await response.json();
|
||||
} catch (jsonError) {
|
||||
// Versuche rohen Text zu lesen für Debugging
|
||||
const rawText = await response.text();
|
||||
console.error(`❌ JSON-Parsing-Fehler (${context}):`, jsonError);
|
||||
console.error(`❌ Raw Response (${context}):`, rawText.substring(0, 1000));
|
||||
throw new Error(`Ungültige JSON-Response: ${jsonError.message} (${context})`);
|
||||
}
|
||||
|
||||
// 4. Prüfe auf null/undefined Response
|
||||
if (data === null || data === undefined) {
|
||||
throw new Error(`Leere Response erhalten (${context})`);
|
||||
}
|
||||
|
||||
// 5. Validiere Response-Struktur (wenn success-Feld erwartet wird)
|
||||
if (typeof data === 'object' && data.hasOwnProperty('success')) {
|
||||
if (!data.success && data.error) {
|
||||
console.warn(`❌ API-Fehler (${context}):`, data.error);
|
||||
throw new Error(`API-Fehler: ${data.error} (${context})`);
|
||||
}
|
||||
}
|
||||
|
||||
// Erfolgreiche Validierung
|
||||
console.log(`✅ API-Response validiert (${context}):`, data);
|
||||
return data;
|
||||
|
||||
} catch (error) {
|
||||
// Error-Logging mit Kontext
|
||||
console.error(`❌ validateApiResponse fehlgeschlagen (${context}):`, error);
|
||||
console.error(`❌ Response-Details (${context}):`, {
|
||||
status: response.status,
|
||||
statusText: response.statusText,
|
||||
url: response.url,
|
||||
headers: Object.fromEntries(response.headers.entries())
|
||||
});
|
||||
|
||||
// Re-throw mit erweiterten Informationen
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
// Chart.js Konfiguration für Dark/Light Theme
|
||||
function getChartTheme() {
|
||||
const isDark = document.documentElement.classList.contains('dark');
|
||||
@@ -75,7 +188,7 @@ function getDefaultChartOptions() {
|
||||
// Job Status Doughnut Chart
|
||||
async function createJobStatusChart() {
|
||||
try {
|
||||
const response = await fetch('/api/stats/charts/job-status');
|
||||
const response = await fetch(`${API_BASE_URL}/api/stats/charts/job-status`);
|
||||
const data = await response.json();
|
||||
|
||||
if (!response.ok) {
|
||||
@@ -140,7 +253,7 @@ async function createJobStatusChart() {
|
||||
// Drucker-Nutzung Bar Chart
|
||||
async function createPrinterUsageChart() {
|
||||
try {
|
||||
const response = await fetch('/api/stats/charts/printer-usage');
|
||||
const response = await fetch(`${API_BASE_URL}/api/stats/charts/printer-usage`);
|
||||
const data = await response.json();
|
||||
|
||||
if (!response.ok) {
|
||||
@@ -180,7 +293,7 @@ async function createPrinterUsageChart() {
|
||||
// Jobs Timeline Line Chart
|
||||
async function createJobsTimelineChart() {
|
||||
try {
|
||||
const response = await fetch('/api/stats/charts/jobs-timeline');
|
||||
const response = await fetch(`${API_BASE_URL}/api/stats/charts/jobs-timeline`);
|
||||
const data = await response.json();
|
||||
|
||||
if (!response.ok) {
|
||||
|
||||
Reference in New Issue
Block a user