fix: закрыть уязвимости (CSRF, rate limit, секреты, CSV-injection, LIKE-экранирование)

.env.example

@@ -1,2 +1,7 @@
-SECRET_KEY=replace-with-a-long-random-string
-ADMIN_PASSWORD=replace-with-a-private-admin-password
+# Обязательные переменные. Без них приложение не запустится.
+SECRET_KEY=сгенерируйте-случайную-строку-50-символов
+ADMIN_PASSWORD=надёжный-пароль-админки
+
+# Необязательные
+# FLASK_DEBUG=1        # только для локальной разработки
+# COOKIE_SECURE=1      # включить при работе по HTTPS

app.py

@@ -8,6 +8,9 @@ from hmac import compare_digest
 from pathlib import Path
 
 from flask import Flask, flash, make_response, redirect, render_template, request, session, url_for
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
+from flask_wtf import CSRFProtect
 
 
 BASE_DIR = Path(__file__).resolve().parent
@@ -29,9 +32,21 @@ REQUEST_STATUSES = {
 }
 
 app = Flask(__name__)
-app.config["SECRET_KEY"] = os.getenv("SECRET_KEY", "change-this-secret-key")
+app.config["SECRET_KEY"] = os.environ.get("SECRET_KEY")
+if not app.config["SECRET_KEY"]:
+    raise RuntimeError("SECRET_KEY не задан. Установите переменную окружения SECRET_KEY.")
 app.config["SESSION_COOKIE_HTTPONLY"] = True
 app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
+app.config["SESSION_COOKIE_SECURE"] = os.environ.get("COOKIE_SECURE", "0") == "1"
+
+csrf = CSRFProtect(app)
+
+limiter = Limiter(
+    get_remote_address,
+    app=app,
+    default_limits=["200 per hour"],
+    storage_uri="memory://",
+)
 
 
 def get_connection():
@@ -88,6 +103,7 @@ def index():
 
 
 @app.post("/submit")
+@limiter.limit("10 per minute")
 def submit_request():
     name = request.form.get("name", "").strip()
     contact = request.form.get("contact", "").strip()
@@ -172,8 +188,12 @@ def build_request_query(filters):
         conditions.append("subject = ?")
         parameters.append(filters["subject"])
     if filters["q"]:
-        conditions.append("(name LIKE ? OR contact LIKE ? OR message LIKE ? OR admin_note LIKE ?)")
-        search_pattern = f"%{filters['q']}%"
+        escaped = filters["q"].replace("%", "\\%").replace("_", "\\_")
+        search_pattern = f"%{escaped}%"
+        conditions.append(
+            "(name LIKE ? ESCAPE '\\' OR contact LIKE ? ESCAPE '\\' "
+            "OR message LIKE ? ESCAPE '\\' OR admin_note LIKE ? ESCAPE '\\')"
+        )
         parameters.extend([search_pattern] * 4)
 
     where_clause = f"WHERE {' AND '.join(conditions)}" if conditions else ""
@@ -210,13 +230,16 @@ def fetch_stats(connection):
 
 
 @app.route("/admin/login", methods=["GET", "POST"])
+@limiter.limit("10 per minute")
 def admin_login():
     if session.get("is_admin"):
         return redirect(url_for("admin_dashboard"))
 
     if request.method == "POST":
         password = request.form.get("password", "")
-        admin_password = os.getenv("ADMIN_PASSWORD", "admin123")
+        admin_password = os.environ.get("ADMIN_PASSWORD")
+        if not admin_password:
+            raise RuntimeError("ADMIN_PASSWORD не задан. Установите переменную окружения.")
 
         if compare_digest(password, admin_password):
             session.clear()
@@ -288,6 +311,13 @@ def admin_delete_request(request_id):
     return redirect(url_for("admin_dashboard"))
 
 
+def csv_safe(value):
+    """Защита от CSV-инъекции: значения с формулами экранируются апострофом."""
+    if value and value[0] in ("=", "+", "-", "@", "\t", "\r"):
+        return "'" + value
+    return value
+
+
 @app.get("/admin/export.csv")
 @admin_required
 def admin_export():
@@ -317,15 +347,15 @@ def admin_export():
         writer.writerow(
             [
                 consultation["id"],
-                consultation["name"],
-                consultation["contact"],
+                csv_safe(consultation["name"]),
+                csv_safe(consultation["contact"]),
                 consultation["subject"],
                 consultation["exam"],
                 consultation["format"],
                 consultation["preferred_time"],
                 REQUEST_STATUSES.get(consultation["status"], consultation["status"]),
-                consultation["message"] or "",
-                consultation["admin_note"] or "",
+                csv_safe(consultation["message"] or ""),
+                csv_safe(consultation["admin_note"] or ""),
                 consultation["created_at"],
                 consultation["updated_at"] or "",
             ]
@@ -349,4 +379,4 @@ init_database()
 
 
 if __name__ == "__main__":
-    app.run(debug=True)
+    app.run(debug=os.environ.get("FLASK_DEBUG") == "1")

requirements.txt

@@ -1 +1,3 @@
 Flask>=3.0,<4.0
+Flask-WTF>=1.2,<2.0
+Flask-Limiter>=3.5,<4.0

templates/admin.html

@@ -81,6 +81,7 @@
                             {% if consultation["message"] %}<p class="request-message"><span>Комментарий</span>{{ consultation["message"] }}</p>{% endif %}
                             <div class="request-actions">
                                 <form class="request-status-form" action="{{ url_for('admin_update_status', request_id=consultation["id"]) }}" method="post">
+                                    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                                     <label for="status-{{ consultation["id"] }}">Статус</label>
                                     <select id="status-{{ consultation["id"] }}" name="status">{% for status_key, status_label in statuses.items() %}<option value="{{ status_key }}" {% if consultation["status"] == status_key %}selected{% endif %}>{{ status_label }}</option>{% endfor %}</select>
                                     <button class="mini-button" type="submit">Сохранить</button>
@@ -88,11 +89,13 @@
                                 <details class="request-note" {% if consultation["admin_note"] %}open{% endif %}>
                                     <summary>{% if consultation["admin_note"] %}Изменить заметку{% else %}Добавить заметку{% endif %} <span>＋</span></summary>
                                     <form action="{{ url_for('admin_update_note', request_id=consultation["id"]) }}" method="post">
+                                    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                                         <textarea name="admin_note" rows="2" maxlength="2000" placeholder="Например: перезвонить вечером...">{{ consultation["admin_note"] }}</textarea>
                                         <button class="mini-button" type="submit">Сохранить заметку</button>
                                     </form>
                                 </details>
                                 <form class="request-delete-form" action="{{ url_for('admin_delete_request', request_id=consultation["id"]) }}" method="post" data-confirm="Удалить эту заявку? Восстановить её будет нельзя.">
+                                    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                                     <button class="delete-button" type="submit">Удалить</button>
                                 </form>
                             </div>

templates/admin_login.html

@@ -25,6 +25,7 @@
             {% endif %}
         {% endwith %}
         <form action="{{ url_for('admin_login') }}" method="post" class="admin-login-form">
+            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
             <label for="password">Пароль администратора</label>
             <input id="password" type="password" name="password" placeholder="Введите пароль" autocomplete="current-password" required autofocus>
             <button class="button button-primary form-button" type="submit">Войти в панель <span>↗</span></button>

templates/index.html

@@ -132,6 +132,7 @@
                         {% endif %}
                     {% endwith %}
                     <form action="{{ url_for('submit_request') }}" method="post">
+                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                         <div class="form-row">
                             <label>Ваше имя <span>*</span><input type="text" name="name" placeholder="Например, Мария" required></label>
                             <label>Как связаться <span>*</span><input type="text" name="contact" placeholder="Телефон или Telegram" required></label>