86 lines
2.3 KiB
Python
86 lines
2.3 KiB
Python
#!/usr/bin/env python3
|
|
# -*- coding: utf-8 -*-
|
|
"""Bad authentication + a bunch of other smelly code"""
|
|
|
|
|
|
import sqlite3
|
|
|
|
from flask import Flask, jsonify, render_template_string, request, session
|
|
|
|
app = Flask(__name__)
|
|
app.secret_key = "secret"
|
|
|
|
|
|
def init_db():
|
|
conn = sqlite3.connect("users.db")
|
|
c = conn.cursor()
|
|
|
|
c.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS users (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
username TEXT NOT NULL,
|
|
password TEXT NOT NULL -- Storing passwords in plain text (for demonstration only)
|
|
)
|
|
"""
|
|
)
|
|
|
|
c.execute("DELETE FROM users") # Clear existing data for demonstration purposes
|
|
c.execute(
|
|
"INSERT INTO users (username, password) VALUES ('admin', 'password')"
|
|
) # Weak credentials
|
|
c.execute("INSERT INTO users (username, password) VALUES ('alice', 'password123')")
|
|
c.execute("INSERT INTO users (username, password) VALUES ('bob', 'password456')")
|
|
|
|
conn.commit()
|
|
conn.close()
|
|
|
|
|
|
@app.route("/login", methods=["GET", "POST"])
|
|
def login():
|
|
if request.method == "POST":
|
|
username = request.form["username"]
|
|
password = request.form["password"]
|
|
|
|
if username == "admin" and password == "password":
|
|
session["logged_in"] = True
|
|
return "Logged in as admin!"
|
|
|
|
conn = sqlite3.connect("users.db")
|
|
user = conn.execute(
|
|
"SELECT * FROM users WHERE username = ? AND password = ?",
|
|
(username, password),
|
|
).fetchone()
|
|
conn.close()
|
|
|
|
if user:
|
|
session["logged_in"] = True
|
|
return f"Logged in as {username}!"
|
|
|
|
return "Invalid credentials", 401
|
|
|
|
return render_template_string(
|
|
"""
|
|
<form method="post">
|
|
Username: <input type="text" name="username"><br>
|
|
Password: <input type="password" name="password"><br>
|
|
<input type="submit" value="Login">
|
|
</form>
|
|
"""
|
|
)
|
|
|
|
|
|
@app.route("/user", methods=["GET"])
|
|
def get_user():
|
|
username = request.args.get("username")
|
|
query = f"SELECT * FROM users WHERE username = '{username}'"
|
|
conn = sqlite3.connect("users.db")
|
|
user = conn.execute(query).fetchone()
|
|
conn.close()
|
|
|
|
return jsonify(dict(user)) if user else "User not found", 404
|
|
|
|
|
|
if __name__ == "__main__":
|
|
init_db()
|
|
app.run(debug=True)
|