From 6cc4708472c5e58a186442d83466b04dd2b9d5b8 Mon Sep 17 00:00:00 2001 From: Patrick Sulzle Date: Mon, 14 Mar 2022 15:27:25 +0100 Subject: [PATCH 1/6] Developed an unsafe way to pass arguments. Do not use! --- frontend/app.py | 3 +++ frontend/templates/login.html | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/frontend/app.py b/frontend/app.py index 0f4b93c..22081be 100644 --- a/frontend/app.py +++ b/frontend/app.py @@ -28,7 +28,10 @@ def groclist_login(): mycol = mydb["groclist_users"] username = request.form['username'] password = request.form['password'] + name = "" if mycol.find_one({"username": username, "password": password}): + # for user_info in mycol.find({}, {"name": 0}): + # print("Welkom", user_info) return redirect(url_for('groclist_welcome')) else: error = 'Username of wachtwoord onbekend. Probeer opnieuw' diff --git a/frontend/templates/login.html b/frontend/templates/login.html index 3ada399..2ab79f8 100644 --- a/frontend/templates/login.html +++ b/frontend/templates/login.html @@ -2,7 +2,7 @@ Groclist - login page - +
From e9ca0e90d5b73c1d69712a6e6f32e95b17cd73d4 Mon Sep 17 00:00:00 2001 From: Patrick Sulzle Date: Mon, 14 Mar 2022 17:55:49 +0100 Subject: [PATCH 2/6] Concept of getting documents from mongodb is working in get_doc.py --- backend/get_doc.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 backend/get_doc.py diff --git a/backend/get_doc.py b/backend/get_doc.py new file mode 100644 index 0000000..be64da8 --- /dev/null +++ b/backend/get_doc.py @@ -0,0 +1,13 @@ +import pymongo +import getpass + +myclient = pymongo.MongoClient("mongodb://admin:pass@localhost:27017/") +username = input("Username :") +#password = getpass.getpass("Password: ") + +mydb = myclient["groclist_db"] +mycol = mydb["groclist_users"] + +email = mycol.find_one({"username": username}, {"_id": 0, "name": 1, "email": 1}) + +print (email) From ba40af743d1c5e3a2afc01c4086c9a00bc72063a Mon Sep 17 00:00:00 2001 From: Patrick Sulzle Date: Tue, 15 Mar 2022 20:57:21 +0100 Subject: [PATCH 3/6] Code review and sanitation. More understanding of concepts --- frontend/app.py | 26 ++++++++++++++------------ frontend/groclist.py | 33 +++++++++++++++++++++++++++++++++ frontend/templates/welcome.html | 3 ++- 3 files changed, 49 insertions(+), 13 deletions(-) create mode 100644 frontend/groclist.py diff --git a/frontend/app.py b/frontend/app.py index 22081be..cad0262 100644 --- a/frontend/app.py +++ b/frontend/app.py @@ -2,7 +2,10 @@ import pymongo from flask import Flask, request, render_template, url_for, redirect app = Flask(__name__) - +myclient = pymongo.MongoClient("mongodb://admin:pass@localhost:27017") +mydb = myclient["groclist_db"] +mycol_users = mydb["groclist_users"] +username="" @app.route("/", methods=['GET', 'POST']) def groclist_home(): @@ -15,29 +18,28 @@ def groclist_home(): return render_template('index.html',error=error) -@app.route("/welcome") -def groclist_welcome(): - return render_template("welcome.html") - @app.route("/login", methods=['GET', 'POST']) def groclist_login(): error = None if request.method == 'POST': - myclient = pymongo.MongoClient("mongodb://admin:pass@localhost:27017") - mydb = myclient["groclist_db"] - mycol = mydb["groclist_users"] username = request.form['username'] password = request.form['password'] - name = "" - if mycol.find_one({"username": username, "password": password}): - # for user_info in mycol.find({}, {"name": 0}): - # print("Welkom", user_info) + if mycol_users.find_one({"username": username, "password": password}): return redirect(url_for('groclist_welcome')) else: error = 'Username of wachtwoord onbekend. Probeer opnieuw' return render_template("login.html", error=error) +@app.route("/welcome", methods=['GET', 'POST']) +def groclist_welcome(): + if request.method == 'GET': + userid = mycol_users.find_one({"username": username}, {"_id": 1}) + print(userid) + return render_template("welcome.html", userid=userid) + else: + error = "Userid is niet bekend. Database defect" + return render_template("index.html", error=error) app.add_url_rule("/welcome", "welcome", groclist_welcome) diff --git a/frontend/groclist.py b/frontend/groclist.py new file mode 100644 index 0000000..20de421 --- /dev/null +++ b/frontend/groclist.py @@ -0,0 +1,33 @@ +import pymongo +from flask import Flask, request, render_template, redirect, url_for + +# initialize connection to database +app = Flask(__name__) +config = { + "username": "admin", + "password": "pass", + "server": "localhost:27017", +} +connector = "mongodb://{}:{}@{}".format(config["username"],config["password"], config["server"] +client = pymongo.MongoClient(connector) +db = client["groclist"] + +@app.route("/") +def main(): + return render_template("login.html") + +@app.route("/login", methods=["POST"]) +def login() + error = None + username = request.form["username"] + password = request.form["password"] + if db.cred.find_one({"username": username, "password": password}) + auth_user_id = db.cred.find_one({"username": username},{"_id", 1}) + return redirect(url_for("welcome", id=auth_user_id["_id"])) + else: + error = "Usernaam of wachtwoord onbekend, probeer opnieuw" + return render_template("login.html", error=error) + +@app.route("/welcome") +def welcome(id) + diff --git a/frontend/templates/welcome.html b/frontend/templates/welcome.html index ea8b5c8..dd1c619 100644 --- a/frontend/templates/welcome.html +++ b/frontend/templates/welcome.html @@ -6,8 +6,9 @@
-

Welcome to GrocList

+

Welcome to GrocList


+ Hello userid: {{ userid }}

Click here to go home.

From 8ac4d3efc0cce9d307256ba7d6b85ccf579aace0 Mon Sep 17 00:00:00 2001 From: Patrick Sulzle Date: Wed, 16 Mar 2022 13:46:10 +0100 Subject: [PATCH 4/6] bughunting for /login --- backend/add_user.py | 20 +++++++++++++------ frontend/groclist.py | 37 ++++++++++++++++++++++------------- frontend/templates/404.html | 4 ++++ frontend/templates/index.html | 4 ++-- frontend/templates/login.html | 2 +- 5 files changed, 44 insertions(+), 23 deletions(-) create mode 100644 frontend/templates/404.html diff --git a/backend/add_user.py b/backend/add_user.py index 4a66feb..515372b 100644 --- a/backend/add_user.py +++ b/backend/add_user.py @@ -2,21 +2,29 @@ import pymongo import getpass import uuid -myclient = pymongo.MongoClient("mongodb://admin:pass@localhost:27017/") +# initialize connection to database +config = { + "username": "admin", + "password": "pass", + "server": "localhost:27017", +} +connector = "mongodb://{}:{}@{}".format(config["username"],config["password"], config["server"]) +client = pymongo.MongoClient(connector) +db = client["groclist"] + username = input("Username: ") password = getpass.getpass("Password: ") uuid = str(uuid.uuid4()) email = input("Email-adres: ") full_name = input("Volledige naam: ") -mydb = myclient["groclist_db"] -mycol = mydb["groclist_users"] +col = db["cred"] -mydict = {"username": username, "password": password, "groclist_uuid": uuid, "email": email, "name": full_name} -if mycol.find_one({"username": username}): +mydict = {"username": username, "password": password, "uuid": uuid, "email": email, "name": full_name} +if col.find_one({"username": username}): print("Username already exists\n") exit() else: - x = mycol.insert_one(mydict) + x = col.insert_one(mydict) print("User created") diff --git a/frontend/groclist.py b/frontend/groclist.py index 20de421..dd8302d 100644 --- a/frontend/groclist.py +++ b/frontend/groclist.py @@ -8,26 +8,35 @@ config = { "password": "pass", "server": "localhost:27017", } -connector = "mongodb://{}:{}@{}".format(config["username"],config["password"], config["server"] +connector = "mongodb://{}:{}@{}".format(config["username"],config["password"], config["server"]) client = pymongo.MongoClient(connector) db = client["groclist"] @app.route("/") def main(): - return render_template("login.html") + return render_template("index.html") -@app.route("/login", methods=["POST"]) -def login() +@app.route("/login", methods=["GET","POST"]) +def login(): error = None - username = request.form["username"] - password = request.form["password"] - if db.cred.find_one({"username": username, "password": password}) - auth_user_id = db.cred.find_one({"username": username},{"_id", 1}) - return redirect(url_for("welcome", id=auth_user_id["_id"])) - else: - error = "Usernaam of wachtwoord onbekend, probeer opnieuw" - return render_template("login.html", error=error) + if request.method == "POST": + username = request.form["username"] + password = request.form["password"] + if db.cred.find_one({"username": username, "password": password}): + auth_user_id = db.cred.find_one({"username": username},{"uuid", 1}) + if auth_user_id: + app.logger.info(auth_user_id) + return render_template("welcome.html", id=auth_user_id["uuid"]) + else: + return render_template("404.html") + else: + error = "Usernaam of wachtwoord onbekend, probeer opnieuw" + return render_template("login.html", error=error) -@app.route("/welcome") -def welcome(id) +@app.route("/welcome/", methods=['GET']) +def welcome(id): + print("Hello: ", id) +# start server with run method +if __name__ == "__main__": + app.run(debug=True) \ No newline at end of file diff --git a/frontend/templates/404.html b/frontend/templates/404.html new file mode 100644 index 0000000..8fca942 --- /dev/null +++ b/frontend/templates/404.html @@ -0,0 +1,4 @@ +{% extends "base.html" %} +{% block content %} +

not found

+{% endblock %} \ No newline at end of file diff --git a/frontend/templates/index.html b/frontend/templates/index.html index e64d639..41a68be 100644 --- a/frontend/templates/index.html +++ b/frontend/templates/index.html @@ -11,7 +11,7 @@

Welkom bij Groclist

-
- + +
{% endblock %} diff --git a/frontend/templates/login.html b/frontend/templates/login.html index 2ab79f8..03938fe 100644 --- a/frontend/templates/login.html +++ b/frontend/templates/login.html @@ -6,7 +6,7 @@
-

Please login

+

Please login


Date: Wed, 16 Mar 2022 17:07:05 +0100 Subject: [PATCH 6/6] bughunting voorbij. in functie login een , i.p.v. een : --- frontend/groclist.py | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/frontend/groclist.py b/frontend/groclist.py index f1a5bad..71ab2b0 100644 --- a/frontend/groclist.py +++ b/frontend/groclist.py @@ -1,5 +1,5 @@ import pymongo -from flask import Flask, request, render_template, redirect, url_for +from flask import Flask, request, render_template, redirect, url_for, abort # initialize connection to database app = Flask(__name__) @@ -22,8 +22,8 @@ def login(): if request.method == "POST": username = request.form["username"] password = request.form["password"] - if db.user_cred.find_one({"username": username, "password": password}): - auth_user_id = db.user_cred.find_one({"username": username},{"uuid", 1}) + if db.user_cred.find_one({"username": username, "password": password}): + auth_user_id = db.user_cred.find_one({"username": username},{"uuid": 1}) if auth_user_id: app.logger.info(auth_user_id) return render_template("welcome.html", id=auth_user_id["uuid"]) @@ -36,7 +36,12 @@ def login(): @app.route("/welcome/", methods=['GET']) def welcome(id): print("Hello: ", id) - + +@app.errorhandler(404) +def not_found(error): + app.logger.info(error) + return render_template("404.html"), 404 + # start server with run method if __name__ == "__main__": - app.run(debug=True) \ No newline at end of file + app.run(debug=True)