ui: локальный Tabler dashboard + 150 проверенных TG-источников и probe 595 каналов

omni/serve.py

@@ -220,6 +220,7 @@ class Handler(BaseHTTPRequestHandler):
         self.send_response(code)
         self.send_header("Content-Type", ctype)
         self.send_header("Content-Length", str(len(data)))
+        self.send_header("X-Content-Type-Options", "nosniff")
         self.send_header("Cache-Control", "no-store")
         self.end_headers()
         self.wfile.write(data)
@@ -238,6 +239,24 @@ class Handler(BaseHTTPRequestHandler):
                 return self._send(404, "no ui", "text/plain")
             return self._send(200, f.read_bytes(), "text/html; charset=utf-8")
 
+        if path.startswith("/assets/"):
+            # Only vendored public assets; never expose data, sessions or arbitrary files.
+            root = (WEB / "vendor").resolve()
+            types = {".css": "text/css; charset=utf-8",
+                     ".js": "text/javascript; charset=utf-8",
+                     ".svg": "image/svg+xml", ".png": "image/png",
+                     ".woff": "font/woff", ".woff2": "font/woff2"}
+            try:
+                asset = (WEB / urllib.parse.unquote(path[len("/assets/"):])).resolve()
+                asset.relative_to(root)
+                ctype = types.get(asset.suffix.lower())
+                if not ctype or not asset.is_file():
+                    return self._send(404, "not found", "text/plain")
+                data = asset.read_bytes()
+            except (OSError, ValueError):
+                return self._send(404, "not found", "text/plain")
+            return self._send(200, data, ctype)
+
         if path == "/api/panels":
             import json as _json
             fp = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "data", "panels.json")