Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def run(self, project_name):
demo_project = Project.query.get(project_name)
db.session.delete(demo_project)
db.session.commit()
def reset_password():
form = ResetPasswordForm()
token = request.args.get("token")
if not token:
return render_template(
"reset_password.html", form=form, error=_("No token provided")
)
project_id = Project.verify_token(token)
if not project_id:
return render_template(
"reset_password.html", form=form, error=_("Invalid token")
)
project = Project.query.get(project_id)
if not project:
return render_template(
"reset_password.html", form=form, error=_("Unknown project")
)
if request.method == "POST" and form.validate():
project.password = generate_password_hash(form.password.data)
db.session.add(project)
db.session.commit()
flash(_("Password successfully reset."))
return redirect(url_for(".home"))
return render_template("reset_password.html", form=form)
def wrapper(*args, **kwargs):
auth = request.authorization
project_id = kwargs.get("project_id")
# Use Basic Auth
if auth and project_id and auth.username == project_id:
project = Project.query.get(auth.username)
if project and check_password_hash(project.password, auth.password):
# The whole project object will be passed instead of project_id
kwargs.pop("project_id")
return f(*args, project=project, **kwargs)
else:
# Use Bearer token Auth
auth_header = request.headers.get("Authorization", "")
auth_token = ""
try:
auth_token = auth_header.split(" ")[1]
except IndexError:
abort(401)
project_id = Project.verify_token(auth_token, token_type="non_timed_token")
if auth_token and project_id:
project = Project.query.get(project_id)
if project:
project = Project.query.get(auth.username)
if project and check_password_hash(project.password, auth.password):
# The whole project object will be passed instead of project_id
kwargs.pop("project_id")
return f(*args, project=project, **kwargs)
else:
# Use Bearer token Auth
auth_header = request.headers.get("Authorization", "")
auth_token = ""
try:
auth_token = auth_header.split(" ")[1]
except IndexError:
abort(401)
project_id = Project.verify_token(auth_token, token_type="non_timed_token")
if auth_token and project_id:
project = Project.query.get(project_id)
if project:
kwargs.pop("project_id")
return f(*args, project=project, **kwargs)
abort(401)
def pull_project(endpoint, values):
"""When a request contains a project_id value, transform it directly
into a project by checking the credentials stored in the session.
With administration credentials, one can access any project.
If not, redirect the user to an authentication form
"""
if endpoint == "authenticate":
return
if not values:
values = {}
project_id = values.pop("project_id", None)
if project_id:
project = Project.query.get(project_id)
if not project:
raise Redirect303(url_for(".create_project", project_id=project_id))
is_admin = session.get("is_admin")
if session.get(project.id) or is_admin:
# add project into kwargs and call the original function
g.project = project
else:
# redirect to authentication page
raise Redirect303(url_for(".authenticate", project_id=project_id))
def validate_id(form, field):
form.id.data = slugify(field.data)
if (form.id.data == "dashboard") or Project.query.get(form.id.data):
message = _(
'A project with this identifier ("%(project)s") already exists. '
"Please choose a new identifier",
project=form.id.data,
)
raise ValidationError(Markup(message))