diff --git a/client/app.go b/client/app.go
index 8666904..cd960f8 100644
--- a/client/app.go
+++ b/client/app.go
@@ -16,6 +16,7 @@ import (
"io"
"log"
"mime/multipart"
+ "net"
"net/http"
"net/url"
"os"
@@ -154,6 +155,7 @@ type App struct {
wifiRejected bool
quitDialogShown bool
monitoringTornDown bool
+ localBrowserActive bool // trình duyệt local — chỉ cho phép localhost
chatUnread int
replyStaffID uint
fetchAppsMu sync.Mutex
@@ -276,6 +278,9 @@ func (a *App) startup(ctx context.Context) {
// Khởi chạy vòng lặp đọc local storage của trang Rikkei Portal khi chưa đăng nhập
go a.authStorageScanner()
+
+ // Chặn thoát localhost khi đang dùng trình duyệt local
+ go a.localBrowserGuardLoop()
}
func (a *App) handleGuardViolation(kind, reason string) {
@@ -588,6 +593,7 @@ func (a *App) startLocalServer() {
w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
return
}
+ a.setLocalBrowserActive(false)
go func() {
guard.SuppressFor(5 * time.Second)
runtime.WindowReloadApp(a.ctx)
@@ -604,6 +610,46 @@ func (a *App) startLocalServer() {
go a.purgeWebViewDiskCache()
w.Write([]byte("ok"))
})
+ mux.HandleFunc("/local-browser", func(w http.ResponseWriter, r *http.Request) {
+ blocked := strings.TrimSpace(r.URL.Query().Get("blocked"))
+ from := strings.TrimSpace(r.URL.Query().Get("from"))
+ w.Header().Set("Content-Type", "text/html; charset=utf-8")
+ notice := ""
+ if blocked == "1" {
+ notice = `Đã chặn liên kết ngoài mạng. Trình duyệt này chỉ mở localhost / 127.0.0.1.
`
+ if from != "" {
+ notice += `Đã chặn: ` + html.EscapeString(from) + `
`
+ }
+ }
+ _, _ = fmt.Fprintf(w, localBrowserHTML, notice)
+ })
+ mux.HandleFunc("/local-browser-go", func(w http.ResponseWriter, r *http.Request) {
+ w.Header().Set("Access-Control-Allow-Origin", "*")
+ if r.Method == "OPTIONS" {
+ w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+ return
+ }
+ raw := strings.TrimSpace(r.URL.Query().Get("url"))
+ if raw == "" {
+ http.Error(w, "missing url", http.StatusBadRequest)
+ return
+ }
+ if !strings.Contains(raw, "://") {
+ raw = "http://" + raw
+ }
+ if !isLoopbackURL(raw) {
+ http.Error(w, "only localhost allowed", http.StatusForbidden)
+ return
+ }
+ a.mu.Lock()
+ a.localBrowserActive = true
+ a.mu.Unlock()
+ go func() {
+ guard.SuppressFor(3 * time.Second)
+ runtime.WindowExecJS(a.ctx, fmt.Sprintf("window.location.href = %q", raw))
+ }()
+ w.Write([]byte("ok"))
+ })
go func() {
_ = server.ListenAndServe()
@@ -690,6 +736,94 @@ document.addEventListener('keydown', function(e){