From 7e9419e1190dbf302f2974da53dc281872d8b1db Mon Sep 17 00:00:00 2001
From: David Gwilliam <dhgwilliam@gmail.com>
Date: Mon, 22 Jun 2026 05:14:18 -0700
Subject: [PATCH] fix: validate ISO path is a file, not a directory; clear
 default value

---
 serve.go          | 13 +++++++++++++
 web/ui/index.html |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/serve.go b/serve.go
index 7685694..6746198 100644
--- a/serve.go
+++ b/serve.go
@@ -309,6 +309,19 @@ func handleDiskPartitions(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, map[string]any{"error": "missing iso parameter"})
 		return
 	}
+	fi, err := os.Stat(iso)
+	if err != nil {
+		writeJSON(w, map[string]any{"error": fmt.Sprintf("cannot access %q: %v", iso, err)})
+		return
+	}
+	if fi.IsDir() {
+		writeJSON(w, map[string]any{"error": fmt.Sprintf("%q is a directory, not an ISO file", iso)})
+		return
+	}
+	if !strings.HasSuffix(strings.ToLower(fi.Name()), ".iso") {
+		writeJSON(w, map[string]any{"error": fmt.Sprintf("%q is not an ISO file", iso)})
+		return
+	}
 	parts, err := listPartitions(iso)
 	if err != nil {
 		writeJSON(w, map[string]any{"error": err.Error()})
diff --git a/web/ui/index.html b/web/ui/index.html
index ca95147..79cecd2 100644
--- a/web/ui/index.html
+++ b/web/ui/index.html
@@ -43,7 +43,7 @@
     <h2 class="section-toggle" data-section="tag-body">Tag Viewer <span class="toggle-icon">▾</span></h2>
     <div id="tag-body">
     <div class="tag-controls">
-      <input type="text" id="tag-iso-path" placeholder="ISO file path" value="./output/isos">
+      <input type="text" id="tag-iso-path" placeholder="./output/isos/YOUR_ISO.iso" value="">
       <button id="tag-browse-btn">Browse</button>
     </div>
     <div id="tag-results" style="display:none">