OkunElya/PC-Seq-Exam-WebApp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

unfixing safe code

Browse Source
This commit is contained in:
OkunElya
2025-12-16 01:51:19 +10:00
parent f18f545e33
commit 532556dacd
1 changed files with 43 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
src/app.py
View File

@@ -7,12 +7,14 @@ DB_PATH = "./data/database.db"
conn = sqlite3.connect(DB_PATH)
cursor = conn.cursor()
cursor.execute("CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, login TEXT NOT NULL UNIQUE, password TEXT NOT NULL)")
cursor.execute(
"CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, login TEXT NOT NULL UNIQUE, password TEXT NOT NULL)"
)
app = FastAPI(
docs_url=None, # Disable Swagger UI
redoc_url=None, # Disable ReDoc
openapi_url=None # Disable OpenAPI JSON schema
docs_url=None, # Disable Swagger UI
redoc_url=None, # Disable ReDoc
openapi_url=None, # Disable OpenAPI JSON schema
)
STYLES = """
@@ -27,6 +29,7 @@ body {
</style>
"""
@app.get("/register", response_class=HTMLResponse)
async def register_form():
return f"""
@@ -44,17 +47,21 @@ async def register_form():
</html>
"""
@app.post("/register")
async def register(login: str = Form(...), password: str = Form(...)):
try:
cursor.execute("INSERT INTO users (login, password) VALUES (?, ?)", (login, password))
cursor.execute(
f"INSERT INTO users (login, password) VALUES ('{login}', '{password}')"
)
conn.commit()
response = RedirectResponse(url="/welcome", status_code=302)
response.set_cookie("login", login)
response.set_cookie("password", password)
response.set_cookie("password", password)
return response
except sqlite3.IntegrityError:
return HTMLResponse(f"""
return HTMLResponse(
f"""
<html>
<head><title>Ошибка регистрации</title>{STYLES}</head>
<body>
@@ -62,7 +69,10 @@ async def register(login: str = Form(...), password: str = Form(...)):
<a href='/register'>Попробовать снова</a>
</body>
</html>
""", status_code=400)
""",
status_code=400,
)
@app.get("/login", response_class=HTMLResponse)
async def login_form():
@@ -81,17 +91,21 @@ async def login_form():
</html>
"""
@app.post("/login")
async def login(login: str = Form(...), password: str = Form(...)):
cursor.execute("SELECT * FROM users WHERE login=? AND password=?", (login, password))
user = cursor.fetchone()
cursor.execute(
f"SELECT * FROM users WHERE login='{login}' AND password='{password}'"
)
user = cursor.fetchall()
if user:
response = RedirectResponse(url="/welcome", status_code=302)
response.set_cookie("login", login)
response.set_cookie("password", password)
return response
else:
return HTMLResponse(f"""
return HTMLResponse(
f"""
<html>
<head><title>Ошибка входа</title>{STYLES}</head>
<body>
@@ -99,7 +113,10 @@ async def login(login: str = Form(...), password: str = Form(...)):
<a href='/login'>Попробовать снова</a>
</body>
</html>
""", status_code=401)
""",
status_code=401,
)
@app.get("/welcome", response_class=HTMLResponse)
async def welcome(request: Request):
@@ -107,29 +124,30 @@ async def welcome(request: Request):
password = request.cookies.get("password")
if not login or not password:
return RedirectResponse(url="/login")
cursor.execute("SELECT * FROM users WHERE login=? AND password=?", (login, password))
user = cursor.fetchone()
cursor.execute(
f"SELECT * FROM users WHERE login='{login}' AND password='{password}'"
)
user = cursor.fetchall()
if user:
return f"""
<html>
<head><title>Добро пожаловать</title>{STYLES}</head>
<body>
<h1>Привет, {login}</h1>
<form action="/logout" method="post" onsubmit="return logoutAlert();">
<button type="submit">Выйти</button>
</form>
<script>
function logoutAlert() {{
alert('Вы вышли из аккаунта');
return true;
}}
</script>
<button onclick="
document.cookie = 'login=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;';
document.cookie = 'password=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;';
window.location.href = '/login';
">Выйти</button>
</body>
</html>
"""
else:
return RedirectResponse(url="/login")
@app.post("/logout")
async def logout():
response = RedirectResponse(url="/login", status_code=302)
@@ -137,6 +155,7 @@ async def logout():
response.delete_cookie("password")
return response
@app.get("/", include_in_schema=False)
async def root():
return RedirectResponse(url="/login")
return RedirectResponse(url="/login")