serve.go

@@ -309,6 +309,19 @@ func handleDiskPartitions(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, map[string]any{"error": "missing iso parameter"})
 		return
 	}
+	fi, err := os.Stat(iso)
+	if err != nil {
+		writeJSON(w, map[string]any{"error": fmt.Sprintf("cannot access %q: %v", iso, err)})
+		return
+	}
+	if fi.IsDir() {
+		writeJSON(w, map[string]any{"error": fmt.Sprintf("%q is a directory, not an ISO file", iso)})
+		return
+	}
+	if !strings.HasSuffix(strings.ToLower(fi.Name()), ".iso") {
+		writeJSON(w, map[string]any{"error": fmt.Sprintf("%q is not an ISO file", iso)})
+		return
+	}
 	parts, err := listPartitions(iso)
 	if err != nil {
 		writeJSON(w, map[string]any{"error": err.Error()})

web/ui/index.html

@@ -43,7 +43,7 @@
     <h2 class="section-toggle" data-section="tag-body">Tag Viewer <span class="toggle-icon">▾</span></h2>
     <div id="tag-body">
     <div class="tag-controls">
-      <input type="text" id="tag-iso-path" placeholder="ISO file path" value="./output/isos">
+      <input type="text" id="tag-iso-path" placeholder="./output/isos/YOUR_ISO.iso" value="">
       <button id="tag-browse-btn">Browse</button>
     </div>
     <div id="tag-results" style="display:none">