From a24c1f0957a06ca0446395da889339796a5bbcd7 Mon Sep 17 00:00:00 2001 From: OkunElya Date: Tue, 16 Dec 2025 01:51:19 +1000 Subject: [PATCH] unfixing safe code --- src/app.py | 67 +++++++++++++++++++++++++++++++++++------------------- 1 file changed, 43 insertions(+), 24 deletions(-) diff --git a/src/app.py b/src/app.py index 902a355..b90bd1e 100644 --- a/src/app.py +++ b/src/app.py @@ -7,12 +7,14 @@ DB_PATH = "./data/database.db" conn = sqlite3.connect(DB_PATH) cursor = conn.cursor() -cursor.execute("CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, login TEXT NOT NULL UNIQUE, password TEXT NOT NULL)") +cursor.execute( + "CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, login TEXT NOT NULL UNIQUE, password TEXT NOT NULL)" +) app = FastAPI( - docs_url=None, # Disable Swagger UI - redoc_url=None, # Disable ReDoc - openapi_url=None # Disable OpenAPI JSON schema + docs_url=None, # Disable Swagger UI + redoc_url=None, # Disable ReDoc + openapi_url=None, # Disable OpenAPI JSON schema ) STYLES = """ @@ -27,6 +29,7 @@ body { """ + @app.get("/register", response_class=HTMLResponse) async def register_form(): return f""" @@ -44,17 +47,21 @@ async def register_form(): """ + @app.post("/register") async def register(login: str = Form(...), password: str = Form(...)): try: - cursor.execute("INSERT INTO users (login, password) VALUES (?, ?)", (login, password)) + cursor.execute( + f"INSERT INTO users (login, password) VALUES ('{login}', '{password}')" + ) conn.commit() response = RedirectResponse(url="/welcome", status_code=302) response.set_cookie("login", login) - response.set_cookie("password", password) + response.set_cookie("password", password) return response except sqlite3.IntegrityError: - return HTMLResponse(f""" + return HTMLResponse( + f""" Ошибка регистрации{STYLES} @@ -62,7 +69,10 @@ async def register(login: str = Form(...), password: str = Form(...)): Попробовать снова - """, status_code=400) + """, + status_code=400, + ) + @app.get("/login", response_class=HTMLResponse) async def login_form(): @@ -81,17 +91,21 @@ async def login_form(): """ + @app.post("/login") async def login(login: str = Form(...), password: str = Form(...)): - cursor.execute("SELECT * FROM users WHERE login=? AND password=?", (login, password)) - user = cursor.fetchone() + cursor.execute( + f"SELECT * FROM users WHERE login='{login}' AND password='{password}'" + ) + user = cursor.fetchall() if user: response = RedirectResponse(url="/welcome", status_code=302) response.set_cookie("login", login) response.set_cookie("password", password) return response else: - return HTMLResponse(f""" + return HTMLResponse( + f""" Ошибка входа{STYLES} @@ -99,7 +113,10 @@ async def login(login: str = Form(...), password: str = Form(...)): Попробовать снова - """, status_code=401) + """, + status_code=401, + ) + @app.get("/welcome", response_class=HTMLResponse) async def welcome(request: Request): @@ -107,29 +124,30 @@ async def welcome(request: Request): password = request.cookies.get("password") if not login or not password: return RedirectResponse(url="/login") - cursor.execute("SELECT * FROM users WHERE login=? AND password=?", (login, password)) - user = cursor.fetchone() + cursor.execute( + f"SELECT * FROM users WHERE login='{login}' AND password='{password}'" + ) + user = cursor.fetchall() if user: return f""" Добро пожаловать{STYLES}

Привет, {login}

-
- -
- + + """ + else: return RedirectResponse(url="/login") + @app.post("/logout") async def logout(): response = RedirectResponse(url="/login", status_code=302) @@ -137,6 +155,7 @@ async def logout(): response.delete_cookie("password") return response + @app.get("/", include_in_schema=False) async def root(): - return RedirectResponse(url="/login") \ No newline at end of file + return RedirectResponse(url="/login")