Skip to content
Snippets Groups Projects
routes.py 4.79 KiB
Newer Older
Joona Erkkilä's avatar
Joona Erkkilä committed
from flask import Flask, render_template, request, redirect, session
import sqlite3
import sys
from app import app

database = 'webstore.db'

def generate_csrf_token():
    if 'csrf_token' not in session:
        session['csrf_token'] = str(random.randint(1000, 9999))
    return session['csrf_token']

Joona Erkkilä's avatar
Joona Erkkilä committed
### Implementing fix for CSRF:
# def check_csrf():
#   if session["csrf_token"] != request.form["csrf_token"]:
#       return False
###

Joona Erkkilä's avatar
Joona Erkkilä committed
@app.route('/')
def index():
    if 'username' in session:
        return redirect('/store')
    else:
        return redirect('/login')

@app.route('/register', methods=['GET', 'POST'])
def register():
    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']

        connection = sqlite3.connect(database)
        cursor = connection.cursor()

        cursor.execute("SELECT * FROM users WHERE username = ?", (username,))
        existing_user = cursor.fetchone()

        if existing_user:
            return render_template('register.html', error='Username already taken')

        cursor.execute("INSERT INTO users (username, password) VALUES (?, ?)",
                       (username, password))
        connection.commit()

        connection.close()

        return redirect('/login')

    return render_template('register.html')

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']

        # SQL injection vulnerability
        db = sqlite3.connect(database)
        cursor = db.cursor()

        query = "SELECT * FROM users WHERE username = '{}' AND password = '{}'".format(username, password)
        user = db.execute(query)

        if user:
            session['username'] = username
            return redirect('/store')
        else:
            return render_template('login.html', error='Invalid username or password')

    return render_template('login.html')

# Store page
@app.route('/store')
def store():
    if 'username' in session:
        connection = sqlite3.connect(database)
        cursor = connection.cursor()
        cursor.execute("SELECT id, name, price FROM Products")
        products = cursor.fetchall()
        connection.close()
        products = list(products)
        return render_template('store.html', username=session['username'], products=products)
    return redirect('/login')

@app.route('/cart')
def cart():
    if 'username' in session:
        connection = sqlite3.connect(database)
        cursor = connection.cursor()

        cursor.execute("SELECT * FROM History WHERE username = ?", (session['username'],))
        cart_items = cursor.fetchall()

        connection.close()

        return render_template('cart.html', username=session['username'], cart=cart_items)

    return redirect('/login')

@app.route('/add_to_cart/<int:product_id>')
def add_to_cart(product_id):
    if 'username' in session:
        connection = sqlite3.connect(database)
        cursor = connection.cursor()

        cursor.execute("SELECT * FROM Products WHERE id = ?", (product_id,))
        product = cursor.fetchone()

        if product:
            cursor.execute("INSERT INTO History (username, product_name, price) VALUES (?, ?, ?)",
                           (session['username'], product[1], product[2]))
            connection.commit()

        connection.close()

    return redirect('/store')

# Missing CSRF token validation
@app.route('/remove_from_cart/<int:item_id>')
def remove_from_cart(item_id):
    if 'username' in session:
        connection = sqlite3.connect(database)
        cursor = connection.cursor()

        cursor.execute("DELETE FROM History WHERE id = ?", (item_id,))
        connection.commit()

        connection.close()

    return redirect('/cart')

@app.route('/logout')
def logout():
    session.pop('username', None)
    return redirect('/login')

@app.route('/admin')
def admin():
Joona Erkkilä's avatar
Joona Erkkilä committed
### Implementing fix for broken access control:
Joona Erkkilä's avatar
Joona Erkkilä committed
#    if 'admin' in session:
Joona Erkkilä's avatar
Joona Erkkilä committed
#        return render_template('admin.html')
#    else:
#        return render_template('/')
###
Joona Erkkilä's avatar
Joona Erkkilä committed
    return render_template('admin.html')

@app.route('/admin/add_product', methods=['POST'])
def add_product():
    name = request.form['product_name']
    price = request.form['price']

    connection = sqlite3.connect(database)
    cursor = connection.cursor()

    cursor.execute("INSERT INTO Products (name, price) VALUES (?, ?)",
                   (name, price))
    connection.commit()

    connection.close()

    return redirect('/admin')

@app.route('/checkout')
def checkout():
    if 'username' in session:
        connection = sqlite3.connect(database)
        cursor = connection.cursor()

        cursor.execute("DELETE FROM History")
        connection.commit()

        connection.close()
        return redirect('/store')