From 5ab46abb21dd6e6a31dc0a3c0a89c1e43eb53d05 Mon Sep 17 00:00:00 2001 From: Antonia Koch <146366740+AntoniaBK@users.noreply.github.com> Date: Thu, 2 May 2024 12:08:10 +0200 Subject: [PATCH] Fix: validate username --- website/web/__init__.py | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/website/web/__init__.py b/website/web/__init__.py index 28eb6c9..89eea04 100644 --- a/website/web/__init__.py +++ b/website/web/__init__.py @@ -1636,14 +1636,13 @@ def capture_web() -> str | Response | WerkzeugResponse: @app.route('/simple_capture', methods=['GET','POST']) @flask_login.login_required # type: ignore[misc] def simple_capture() -> str | Response | WerkzeugResponse: - if flask_login.current_user.is_authenticated: - user = flask_login.current_user.get_id() - else: - user = src_request_ip(request) + user = flask_login.current_user.get_id() + if not re.match("^[A-Za-z0-9]+$", user): + # Username has been manipulated + flash('User is not permitted.', 'error') + return redirect(url_for('submit_capture')) + if request.method == 'POST': - if not re.match("^[A-Za-z]+$", user): - flash('User is not permitted.', 'error') - return redirect(url_for('simple_capture')) if not (request.form.get('url') or request.form.get('urls')): flash('Invalid submission: please submit at least a URL.', 'error') return render_template('simple_capture.html')