fix(security): mitigación parcial de vulnerabilidad siguiendo guías OWASP 🔒

SPotes22 · SPotes22 · commit 34e9fc075353 · 2025-09-20T15:45:53.000-05:00
diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,7 @@
 .env
-/venv
+env
+env/
+venv/
 venv
 *.key
 *.sqlite3
@@ -11,3 +13,8 @@ AutoCommit.py
 check_files.py
 auditor
 auditor/
+review/
+node_modules/
+node_modules
+package.json
+
diff --git a/cuarentena/pagina_inofensiva.html b/cuarentena/pagina_inofensiva.html
@@ -0,0 +1,6 @@
+<html>  
+<body>  
+  <h1>Página Inofensiva</h1>  
+  <img src="http://127.0.0.1:8080/logout" width="0" height="0"> 
+</body>  
+</html>  
diff --git a/servidor.py b/servidor.py
@@ -43,12 +43,14 @@
 argon2 = Argon2(app)
 ph = PasswordHasher()
 
+print("configuracion inicial completada ...")
 
 # --- CONFIGURACIÓN DE CARPETAS ---
 UPLOAD_FOLDER = './cuarentena'
 os.makedirs(UPLOAD_FOLDER, exist_ok=True)
 app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
 
+print("verificacion de archivos demo ...")
 
 # --- USUARIOS BASE ---
 users = {
@@ -66,7 +68,8 @@
     }
 }
 
-
+print("usuarios base generados...")
+'''
 # --- DEMO USERS DESDE ENV ---
 try:
     demo_users_env = os.getenv("DEMO_USERS", "[]")
@@ -79,7 +82,8 @@
 except Exception as e:
     print(f"[WARN] No se pudieron cargar demo_users: {e}")
 
-
+print("usuarios demo creados ....")
+'''
 # --- LOGIN MANAGER ---
 login_manager = LoginManager(app)
 login_manager.login_view = 'login'
@@ -95,7 +99,7 @@ def load_user(user_id):
             return Usuario(user_id, users[user_id]['role'])
         return None
 
-
+print("login initializied... Starting app....")
 # --- RUTAS ---
 @app.route('/')
 def home():
@@ -120,7 +124,7 @@ def login():
         return render_template("login.html", error="Credenciales inválidas.")
     return render_template("login.html")
 
-@app.route('/logout')
+@app.route('/logout',methods=['GET','POST'])
 @login_required
 def logout():
     logout_user()
@@ -217,7 +221,7 @@ def handle_message(data):
 
 # --- INICIO ---
 if __name__ == '__main__':
-    port = int(os.environ.get("PORT", 10000))
+    port = int(os.environ.get("PORT", 8080))
     socketio.run(app, host='0.0.0.0', port=port) # 👉 Para gunicorn/render
-
+    print(f"app running at host : 0.0.0.0 and port {port}")
 application = app

-Original file line number
+Diff line change
@@ @@ -0,0 +1,6 @@ @@
 +<html>
 +<body>
 +  <h1>Página Inofensiva</h1>
 +  <img src="http://127.0.0.1:8080/logout" width="0" height="0">
 +</body>
 +</html>