From f691e7534d61a9462a3cf815c6ded11292961eeb Mon Sep 17 00:00:00 2001 From: bton Date: Wed, 6 Mar 2024 20:41:45 +0100 Subject: [PATCH] AHHH escape --- Website/__init__.py | 14 +++++++------- tests/test_website.py | 10 +++++----- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/Website/__init__.py b/Website/__init__.py index 5d9bae9..a3fc975 100644 --- a/Website/__init__.py +++ b/Website/__init__.py @@ -3,8 +3,8 @@ from flask import Flask, render_template, render_template_string, request, make_ from flask_socketio import SocketIO, join_room, leave_room from flask_session import Session from markupsafe import escape -from .db import get_db -import .db as db +from Website.db import get_db +import Website.db as db from datetime import datetime finished = None preis = 150 #Ein Getraenk @@ -55,7 +55,7 @@ def create_app(test_config=None): c = db.cursor() c.execute("SELECT * FROM users") users = c.fetchall() - return render_template("list.html", users=users, preis=preis/100) + return render_template("list.html", users=escape(users), preis=escape(preis/100)) @app.route("/transactionlist") def transactionlist(): @@ -115,7 +115,7 @@ def create_app(test_config=None): if user != None : c.execute(f"SELECT * FROM tags WHERE userid={user[0]}") tags = c.fetchall() - return render_template("user.html", user=user, tags=tags) + return render_template("user.html", user=escape(user), tags=escape(tags)) else: return render_template("error.html", error_code="043") @@ -135,7 +135,7 @@ def create_app(test_config=None): user_name = user[1] db.remove_user(user_id) socketio.emit("update", "update") - return render_template("removeuser.html", user_name=user_name) + return render_template("removeuser.html", user_name=escape(user_name)) else: return render_template("error.html", error_code="043") @@ -185,7 +185,7 @@ def create_app(test_config=None): session_id = uuid.uuid4() session[id] = session_id user_queue.put([user_id, "add", session_id]) - return render_template("addtag.html", user=user_id) + return render_template("addtag.html", user=escape(user_id)) @socketio.on('addtag') def request_addtag(data): @@ -226,7 +226,7 @@ def create_app(test_config=None): session_id = uuid.uuid4() session[id] = session_id user_queue.put([user_id, "remove", session_id]) - return render_template("removetag.html", user=user_id) + return render_template("removetag.html", user=escape(user_id)) else: db = get_db() c = db.cursor() diff --git a/tests/test_website.py b/tests/test_website.py index a8359a4..4f985b3 100644 --- a/tests/test_website.py +++ b/tests/test_website.py @@ -23,14 +23,14 @@ def test_index(client): #/adduser def test_adduser(client): - response = client.get('/adduser/user') + response = client.post('/adduser/user', data={}) assert "418" in response.data.decode('utf-8') def test_adduser_new(app, client): with app.app_context(): db = get_db() assert db is get_db() - response = client.get('/adduser/user?username=test') + response = client.post('/adduser/user', data={user_name:"test"}) c = db.cursor() c.execute("SELECT * FROM users WHERE username = ?", ["test"]) data = c.fetchone() @@ -40,7 +40,7 @@ def test_adduser_new(app, client): assert data[2] == 0 def test_adduser_allreadyexists(client): - response = client.get('/adduser/user?username=test') + response = client.post('/adduser/user', data={username:"test"}) assert "Error: 757" in response.data.decode('utf-8') #/addtag @@ -49,7 +49,7 @@ def test_addtag(client): assert response.data.decode('utf-8') == "Error: 095" def test_addtag_userid_nan(client): - response = client.get('/addtag?id=test') + response = client.post('/addtag', data={id:1}) assert response.data.decode('utf-8') == "Error: 095" def test_add_tag_direktli(app): @@ -166,4 +166,4 @@ def test_sqlinjektion_adduser(app, client): assert data[1] == i assert data[2] == 0 assert "tag was sucsesfully added" in response.data.decode('utf-8') - count += 1 \ No newline at end of file + count += 1