Security-Seite: Reichweiten-/Access-Control-Check (nur Booleans+Anzahl, keine Werte) - Profil-Privinfelder, Foto-IDOR, LV-Plan, Directory, anonyme iCal, Klassenliste

app/static/app.js

@@ -519,6 +519,38 @@ function initUidSuggest() {
   });
 }
 
+/* ================= Security-Check ================= */
+async function runProbe() {
+  const btn = $("#probe-btn");
+  const st = $("#probe-status");
+  const inp = $("#probe-uid");
+  const uid = inp ? inp.value.trim() : "";
+  btn.disabled = true;
+  st.textContent = "Läuft… 8–10 Requests gegen das CIS, ein paar Sekunden.";
+  try {
+    const r = await fetch("/api/security/probe" + (uid ? "?uid=" + encodeURIComponent(uid) : ""));
+    const j = await r.json();
+    if (j.error) { st.textContent = j.error; return; }
+    st.textContent = "";
+    document.querySelector("#probe-table tbody").innerHTML = j.checks.map((c, i) => `<tr>
+      <td class="num">${i + 1}</td>
+      <td>${esc(c.name)}</td>
+      <td>${c.ok ? '<span class="badge badge-red">REICHWEITE</span>'
+                  : '<span class="badge badge-green">GESCHÜTZT</span>'}</td>
+      <td>${esc(c.info || "")}</td>
+    </tr>`).join("");
+    $("#probe-table").style.display = "";
+    const tt = $("#probe-target");
+    tt.innerHTML = `Ziel dieses Laufs: <span class="mono">${esc(j.target)}</span> · ` +
+      `Semester ${esc(j.semester)} · Beim nächsten Klick neues Zufallsziel.`;
+    tt.style.display = "block";
+  } catch (e) {
+    st.textContent = "Fehler: " + e.message;
+  } finally {
+    btn.disabled = false;
+  }
+}
+
 /* ================= boot ================= */
 document.addEventListener("DOMContentLoaded", () => {
   if (window.__PLAN_DATA__) initPlan();

app/static/style.css

@@ -239,6 +239,7 @@ table.data .num { text-align: right; font-variant-numeric: tabular-nums; }
 .person-name { margin: 0 0 10px; font-size: 26px; color: var(--ink); }
 .person-badges { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 16px; }
 .badge-green { background: #dcfce7; color: var(--green); }
+.badge-red { background: #fee2e2; color: var(--red); }
 .person-kv { width: 100%; border-collapse: collapse; margin-bottom: 18px; }
 .person-kv td { padding: 7px 10px 7px 0; border-bottom: 1px solid var(--line); font-size: 14.5px; }
 .person-kv td:first-child { color: var(--muted); width: 180px; font-weight: 600; }