From e8cdf4acb2b36a815393f594bbf40d74da25e809 Mon Sep 17 00:00:00 2001 From: 2000-Trek Date: Wed, 21 Jun 2023 22:21:45 +0200 Subject: [PATCH] fixed splite injektion --- main.py | 8 +++++--- templates/documentation.html | 1 + 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/main.py b/main.py index d9f6329..d47561f 100644 --- a/main.py +++ b/main.py @@ -8,6 +8,7 @@ import atexit import sys import uuid import json +import urllib.parse db_path = 'mate.db' conn = sqlite3.connect(db_path, check_same_thread=False) @@ -42,7 +43,8 @@ def list(): users = c.fetchall() text = "" for i in users: - text = text + f'

{i[1]}: {i[2]}

Change balance:



' + username = urllib.parse.quote_plus(i[1]) + text = text + f'

{i[1]}: {i[2]}

Change balance:



' return ''' @@ -59,7 +61,7 @@ def list(): @app.route("/list/user", methods=['GET']) def user_info(): - username = request.args.get("user") + username = urllib.parse.unquote_plus(request.args.get("user")) c.execute("SELECT * FROM users WHERE username = ?", [username]) user_list = c.fetchall() if user_list != []: @@ -119,7 +121,7 @@ def adduser(): c.execute("INSERT or IGNORE INTO users (username, balance) VALUES (?, 0)", [user]) conn.commit() socketio.emit("update", "update") - return 'Added user user and tag list

The creator of this website accepts no liability for any linguistic or technical errors!

' + return 'Added user user and tag list' else: return '

Error: 170

user and tag list' diff --git a/templates/documentation.html b/templates/documentation.html index 1c2d163..fe7840d 100644 --- a/templates/documentation.html +++ b/templates/documentation.html @@ -14,6 +14,7 @@

 

API:

+

Nobody wants to know how the API works

Error Codes:

170: Tag already exists

054: Tag does not exists