security: fix PR #13 review findings

orders.py

@@ -80,12 +80,12 @@ class OrdersHandler(BaseHTTPRequestHandler):
             else:
                 self.send_json_response(400, {"error": "Missing amount field"})
         elif self.path == "/admin/backup":
-            if not getattr(self, "_user_id", None) == "admin":
-                self.send_json_response(403, {"error": "Forbidden - admin access required"})
-                return
             if not self.check_auth():
                 self.send_json_response(401, {"error": "Unauthorized"})
                 return
+            if not getattr(self, "_user_id", None) == "admin":
+                self.send_json_response(403, {"error": "Forbidden - admin access required"})
+                return
             content_length = int(self.headers.get("Content-Length", 0))
             body = self.rfile.read(content_length).decode()
             data = json.loads(body)
@@ -130,6 +130,10 @@ class OrdersHandler(BaseHTTPRequestHandler):
         host = host.strip()
         if len(host) > 255:
             return None
+        if host.startswith('--'):
+            return None
+        if ' ' in host:
+            return None
         ip_pattern = r'^(\d{1,3}\.){3}\d{1,3}$'
         domain_pattern = r'^([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$'
         if re.match(ip_pattern, host):