преди 6 години · f3d9802184
--- a/templates/index.html
+++ b/templates/index.html
@@ -1,4 +1,4 @@
 $def with (friends)
 $def with (login_form, friends)

 <head>
    <title>Friends</title>
@@ -15,13 +15,20 @@ $def with (friends)

    <h3>Login, or become a friend!</h3>

    <h3>Regitered friends:</h3>
    
    <form method="POST">
        $:login_form.render()
    </form> 

    
    <ul>
        $for name in friends:
            <li id="t$name.userid">$name.username</li>
        </ul>
    $if session.username:
        <h1>Logged in as $session.username</h1>
        <a href="logout">Logout</a>

        <h3>Registered friends:</h3>
            <ul>
                $for name in friends:
                    <li id="t$name.userid">$name.username</li>
            </ul>
    

 </body>
--- a/vulnapp.py
+++ b/vulnapp.py
@@ -1,10 +1,27 @@
 import web
 render = web.template.render('templates/')
 from web import form

 # Turn of debug because sessions doesnt support it
 web.config.debug = False

 # Define routes
 urls = (
    '/', 'application'
    '/', 'application',
    "/logout", "logout",
 )

 # Initialize application using the web py framework
 app = web.application(urls, globals())

 # Enable sessions
 session = web.session.Session(app, web.session.DiskStore("sessions"), initializer={"username": None})

 # Get html templates
 render = web.template.render('templates/')
 render._add_global(session, 'session')


 # Connect to database
 db = web.database(
    dbn="mysql",
    host='127.0.0.1',
@@ -16,11 +33,32 @@ db = web.database(

 class application():

    login_form = form.Form(
        form.Textbox("username", description="Username"),
        form.Password("password", description="Password"),
        form.Button("submit", type="submit", description="Login"),
    )

    def GET(self):
        name = 'Bob'
        friends = db.select('users')
        return render.index(friends)
        return render.index(self.login_form, friends)

    def POST(self):
        friends = db.select('users')
        data = web.input()
        print("name:", data.username)
        for row in friends:
            print(row)
            print(row.username)
            if data.username == row.username and data.password == row.password:
                friends = db.select('users')
                session.username = data.username
                return render.index(self.login_form, friends)

 class logout:
    def GET(self):
        session.kill()
        return "Logged out"

 if __name__ == "__main__":
    app = web.application(urls, globals())
    app.run()