Newer
Older
from flask import Flask, render_template, request, redirect, session
import sqlite3
import sys
from app import app
database = 'webstore.db'
def generate_csrf_token():
if 'csrf_token' not in session:
session['csrf_token'] = str(random.randint(1000, 9999))
return session['csrf_token']
### Implementing fix for CSRF:
# def check_csrf():
# if session["csrf_token"] != request.form["csrf_token"]:
# return False
###
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
@app.route('/')
def index():
if 'username' in session:
return redirect('/store')
else:
return redirect('/login')
@app.route('/register', methods=['GET', 'POST'])
def register():
if request.method == 'POST':
username = request.form['username']
password = request.form['password']
connection = sqlite3.connect(database)
cursor = connection.cursor()
cursor.execute("SELECT * FROM users WHERE username = ?", (username,))
existing_user = cursor.fetchone()
if existing_user:
return render_template('register.html', error='Username already taken')
cursor.execute("INSERT INTO users (username, password) VALUES (?, ?)",
(username, password))
connection.commit()
connection.close()
return redirect('/login')
return render_template('register.html')
@app.route('/login', methods=['GET', 'POST'])
def login():
if request.method == 'POST':
username = request.form['username']
password = request.form['password']
# SQL injection vulnerability
db = sqlite3.connect(database)
cursor = db.cursor()
query = "SELECT * FROM users WHERE username = '{}' AND password = '{}'".format(username, password)
user = db.execute(query)
if user:
session['username'] = username
return redirect('/store')
else:
return render_template('login.html', error='Invalid username or password')
return render_template('login.html')
# Store page
@app.route('/store')
def store():
if 'username' in session:
connection = sqlite3.connect(database)
cursor = connection.cursor()
cursor.execute("SELECT id, name, price FROM Products")
products = cursor.fetchall()
connection.close()
products = list(products)
return render_template('store.html', username=session['username'], products=products)
return redirect('/login')
@app.route('/cart')
def cart():
if 'username' in session:
connection = sqlite3.connect(database)
cursor = connection.cursor()
cursor.execute("SELECT * FROM History WHERE username = ?", (session['username'],))
cart_items = cursor.fetchall()
connection.close()
return render_template('cart.html', username=session['username'], cart=cart_items)
return redirect('/login')
@app.route('/add_to_cart/<int:product_id>')
def add_to_cart(product_id):
if 'username' in session:
connection = sqlite3.connect(database)
cursor = connection.cursor()
cursor.execute("SELECT * FROM Products WHERE id = ?", (product_id,))
product = cursor.fetchone()
if product:
cursor.execute("INSERT INTO History (username, product_name, price) VALUES (?, ?, ?)",
(session['username'], product[1], product[2]))
connection.commit()
connection.close()
return redirect('/store')
# Missing CSRF token validation
@app.route('/remove_from_cart/<int:item_id>')
def remove_from_cart(item_id):
if 'username' in session:
connection = sqlite3.connect(database)
cursor = connection.cursor()
cursor.execute("DELETE FROM History WHERE id = ?", (item_id,))
connection.commit()
connection.close()
return redirect('/cart')
@app.route('/logout')
def logout():
session.pop('username', None)
return redirect('/login')
@app.route('/admin')
def admin():
# return render_template('admin.html')
# else:
# return render_template('/')
###
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
return render_template('admin.html')
@app.route('/admin/add_product', methods=['POST'])
def add_product():
name = request.form['product_name']
price = request.form['price']
connection = sqlite3.connect(database)
cursor = connection.cursor()
cursor.execute("INSERT INTO Products (name, price) VALUES (?, ?)",
(name, price))
connection.commit()
connection.close()
return redirect('/admin')
@app.route('/checkout')
def checkout():
if 'username' in session:
connection = sqlite3.connect(database)
cursor = connection.cursor()
cursor.execute("DELETE FROM History")
connection.commit()
connection.close()
return redirect('/store')