tools/utils.py

@@ -1,5 +1,4 @@
-from flask import Flask,  url_for, session, redirect, request
-from functools import wraps
+from flask import Flask
 import sqlite3
 import os
 import string
@@ -15,17 +14,6 @@ DATABASE = app.config['DATABASE']
 DOSSIER_PERSO = app.config['DOSSIER_APP']
 DATABASE = app.config['DATABASE']
 
-
-def login_required(f):
-    @wraps(f)
-    def decorated_function(*args, **kwargs):
-        if 'username' not in session:
-            return redirect(url_for('loginlogout.login', next=request.url))
-        return f(*args, **kwargs)
-    return decorated_function
-
-
-
 def append_to_log(log_line, user):
     log_file=os.path.join(DOSSIER_PERSO, user, "log.txt")
     logs=open(log_file, "r")

views/blog.py

@@ -7,7 +7,6 @@ import sqlite3
 from markdown import markdown
 from tools.filesutils import getFileSizeKo
 import string
-from tools.utils import login_required
 
 blog = Blueprint('blog', __name__, template_folder='templates')
 
@@ -25,8 +24,8 @@ DOSSIER_PUBLIC= app.config['DOSSIER_PUBLIC']+'/'
 ################################################################################
 
 @blog.route('/myblog/new-article/', methods=['GET', 'POST'])
-@login_required
 def new_article():
+    if 'username' in session:
         user = '%s'% escape(session['username'])
         folder_blog = DOSSIER_PERSO + user + "/blog/articles/"
         if request.method == 'POST':
@@ -48,10 +47,12 @@ def new_article():
             return redirect(url_for('blog.list_articles_blog'))
         else:
             return render_template('new_article_blog.html')
+    else:
+        return redirect(BASE_URL, code=401)
 
 @blog.route('/myblog/list-articles/', methods=['GET'])
-@login_required
 def list_articles_blog():
+    if 'username' in session:
         user = '%s'% escape(session['username'])
         conn = sqlite3.connect(DATABASE) # Connexion à la base de donnée
         cursor = conn.cursor() # Création de l'objet "curseur"
@@ -72,10 +73,13 @@ def list_articles_blog():
                                list_posts=posts,
                                nb_articles=nb_articles
                                )
+    else:
+        return redirect(BASE_URL, code=401)
+
 
 @blog.route('/myblog/delete/<title>')
-@login_required
 def delete(title):
+    if 'username' in session :
         user='%s'% escape(session['username'])
         folder_blog = DOSSIER_PERSO + user + "/blog/articles/"
         folder_blog_public = DOSSIER_PUBLIC + user + "/blog/articles/"
@@ -88,10 +92,12 @@ def delete(title):
         os.remove(folder_blog+filename+".md")
         os.remove(folder_blog_public+filename+".html")
         return redirect(url_for('blog.list_articles_blog'))
+    else:
+        return redirect(BASE_URL, code=401) # sinon on redirige vers login
 
 @blog.route('/myblog/edit/<title>', methods=['GET', 'POST'])
-@login_required
 def edit(title):
+    if 'username' in session :
         user='%s'% escape(session['username'])
         filename = title.replace(" ", "_") + ".md"
         folder_blog = DOSSIER_PERSO + user + "/blog/articles/"
@@ -126,6 +132,8 @@ def edit(title):
                                    section='Post-it',
                                    oldpost=oldpost,
                                    content=content)
+    else:
+        return redirect(BASE_URL, code=401)
 
 @blog.route('/blog/<username>/', methods=['GET'])
 def view(username):

views/filesupload.py

@@ -9,7 +9,6 @@ import sqlite3
 import os
 from shutil import move
 from tools.filesutils import getFileSizeMo, getFileSizeKo, check_and_create
-from tools.utils import login_required
 
 filesupload = Blueprint('filesupload', __name__, template_folder='templates')
 
@@ -29,22 +28,10 @@ BASE_URL= app.config['BASE_URL']
 
 
 @filesupload.route( '/filesupload/', methods=['GET', 'POST'])
-@login_required
 def uploadfiles():
+    if 'username' in session :
        user = '%s'% escape(session['username'])
        if request.method == 'POST' :
-        
-        if 'fic' not in request.files:
-            flash(u'Mauvais format de ficher', 'error')
-            return redirect(request.url)
-        file = request.files['fic']
-       
-        # If the user does not select a file, the browser submits an
-        # empty file without a filename.
-        if file.filename == '':
-            flash(u'Vous avez oubliez de selectionner un fichier', 'error' )
-            return redirect(request.url)
-         
            files = request.files.getlist('fic')
            for f in files :
                nom = secure_filename(f.filename)
@@ -78,15 +65,19 @@ def uploadfiles():
                        LOG.close() # Ferme log.txt
                        flash(u'Fichier envoyé avec succés', 'succes')
                        
-    
+           else:
+               flash(u'Error : Vous avez oublié le fichier !', 'error')
+               return redirect(url_for('filesupload.uploadfiles'))
        resp = make_response(render_template('up_up.html', section="Upload"))
        resp.set_cookie('username', session['username'])
        return resp
+    else :
+        return redirect(BASE_URL, code=401)
 
 
 @filesupload.route('/view/')
-@login_required
 def list():
+    if 'username' in session :
         
         user = '%s'% escape(session['username'])
 
@@ -120,17 +111,22 @@ def list():
                                listFilesPrivate=listFilesPrivate,
                                listFilesPublic=listFilesPublic)
     
+    else :
+        return redirect(BASE_URL, code=401)
 
 @filesupload.route('/myfiles/<username>/<filename>')
-@login_required
 def myfiles(username, filename):
+    if 'username' in session :
         user = '%s' % escape(session['username'])
         return send_from_directory(
             os.path.join(DOSSIER_PERSO, username, 'files'), filename )
+    else :
+        return redirect(BASE_URL, code=401)
 
 @filesupload.route('/make_public/<filename>')
-@login_required
 def move_public(filename):
+    if 'username' in session:
+        
         user = '%s' % escape(session['username'])
         check_and_create(DOSSIER_PUBLIC + user + '/files/')
         check_and_create(DOSSIER_PERSO + user + '/files/')
@@ -139,10 +135,12 @@ def move_public(filename):
         dst = os.path.join(DOSSIER_PUBLIC, user, 'files/')
         move (src, dst)
         return redirect(url_for('filesupload.list', _external=True))
+    else:
+        return redirect(BASE_URL, code=401)
 
 @filesupload.route('/make_private/<filename>')
-@login_required
 def move_private(filename):
+    if 'username' in session:
         user = '%s' % escape(session['username'])
         check_and_create(DOSSIER_PUBLIC + user + '/files/')
         check_and_create(DOSSIER_PERSO + user + '/files/')
@@ -150,13 +148,19 @@ def move_private(filename):
         dst = os.path.join(DOSSIER_PERSO, user, 'files/')
         move (src, dst)
         return redirect(url_for('filesupload.list', _external=True))
+    else:
+        return redirect(BASE_URL, code=401)
 
     
+@filesupload.route('/public/<username>/<filename>')
+def publicfiles(username, filename):
+    return send_from_directory(
+            os.path.join(DOSSIER_PUBLIC, username, 'files'), filename )
     
 
 @filesupload.route('/remove_privateFile/<filename>')
-@login_required
 def remove_privateFile(filename):
+    if 'username' in session :
         user = '%s' % escape(session['username'])
         filename = secure_filename(filename)
         try:
@@ -164,11 +168,13 @@ def remove_privateFile(filename):
         except FileNotFoundError:
              flash(u'Fichier {filename} inexistant.'.format(filename=filename), 'error')
         return redirect(url_for('filesupload.list', _external=True))
+    else :
+       return redirect(BASE_URL, code=401)
    
     
 @filesupload.route('/remove_publicFile/<filename>')
-@login_required
 def remove_publicFile(filename):
+    if 'username' in session :
         user = '%s' % escape(session['username'])
         filename = secure_filename(filename)
         try:
@@ -176,6 +182,8 @@ def remove_publicFile(filename):
         except FileNotFoundError:
              flash(u'Fichier {filename} inexistant.'.format(filename=filename), 'error')
         return redirect(url_for('filesupload.list', _external=True))
+    else :
+       return redirect(BASE_URL, code=401)
 
 @filesupload.route('/theme.min.css')
 def theme():
@@ -185,8 +193,3 @@ def theme():
             return send_file(DOSSIER_PERSO+ user +'/theme.min.css', mimetype='text/css')
     else:
         return send_file("static/default.min.css", mimetype='text/css')
-
-@filesupload.route('/public/<username>/<filename>')
-def publicfiles(username, filename):
-    return send_from_directory(
-            os.path.join(DOSSIER_PUBLIC, username, 'files'), filename )

views/gallery.py

@@ -8,7 +8,6 @@ import time
 import sqlite3
 import os
 from tools.filesutils import check_and_create
-from tools.utils import login_required
 
 mygallery = Blueprint('mygallery', __name__, template_folder='templates')
 
@@ -26,8 +25,8 @@ DATABASE = app.config['DATABASE']
 #################################################################################################
 
 @mygallery.route( '/gallery/')
-@login_required
 def gallery():
+    if 'username' in session :
         user ='%s' % escape(session['username'])
         check_and_create(DOSSIER_PUBLIC + user + '/images/')
         check_and_create(DOSSIER_PUBLIC + user + '/images/thumbnails/')
@@ -39,25 +38,30 @@ def gallery():
                                section='Gallery',
                                THUMBNAILS=THUMBNAILS,
                                fichiers=fichiers)
-
+    else :
+       return redirect(url_for('loginlogout.login'), code=401)
 
 @mygallery.route('/myfiles/images/<filename>')
-@login_required
 def myimg(filename):
+    if 'username' in session :
         UTILISATEUR='%s' % escape(session['username'])
         return send_from_directory(
             os.path.join(DOSSIER_PERSO, UTILISATEUR, 'images'), filename )
+    else :
+        return redirect(BASE_URL, code=401)
 
 @mygallery.route('/myfiles/images/thumbnails/<filename>')
-@login_required
 def mythumbnails(filename):
+    if 'username' in session :
         UTILISATEUR='%s' % escape(session['username'])
         return send_from_directory(
             os.path.join(DOSSIER_PERSO, UTILISATEUR, 'images/thumbnails'), filename )
+    else :
+        return redirect(BASE_URL, code=401)
 
 @mygallery.route('/remove_privateImage/<filename>')
-@login_required
 def remove_privateImage(filename):
+    if 'username' in session :
         user = '%s' % escape(session['username'])
         filename = secure_filename(filename)    
         try:
@@ -69,8 +73,8 @@ def remove_privateImage(filename):
               
 
 @mygallery.route('/remove_publicImage/<filename>')
-@login_required
 def remove_publicImage(filename):
+    if 'username' in session :
         user = '%s' % escape(session['username'])
         filename = secure_filename(filename)    
         try:

views/loginlogout.py

@@ -6,7 +6,6 @@ from socket import gethostname
 from os import remove, system 
 from tools.utils import email_disp, valid_token_register, valid_passwd, valid_username, gen_token, totp_is_valid
 from tools.mailer import Mailer
-from tools.utils import login_required
 
 app = Flask( 'pywallter' )
 app.config.from_pyfile('config.py')
@@ -30,34 +29,8 @@ BACKUP_TIME = app.config['BACKUP_TIME']
 
 loginlogout = Blueprint('loginlogout', __name__, template_folder='templates')
 
-
-@loginlogout.route( '/' )
-def index():
-    conn = sqlite3.connect(DATABASE) # Connexion à la base de donnée
-    cursor = conn.cursor() # Création de l'objet "curseur"
-    cursor.execute("""SELECT token passwd FROM users where name=? """, ("pywallter", ))
-    tmp = cursor.fetchone()
-    conn.close
-    if tmp:
-        token = tmp[0]
-    else:
-        token = None
-
-    if 'username' in session :
-        return redirect(url_for('profil.profile'))
-    else :
-        if token:
-            hostname = gethostname()
-            url_inscription = BASE_URL+'inscription/'+token
-            return render_template('inscription.html', signin_enable=app.config['SIGNIN_ENABLE'],
-                                   token=token, hostname=hostname,
-                                   url_inscription=url_inscription,
-                                   MAIL_SERVER=MAIL_SERVER)
-        else:
-            return redirect(url_for('loginlogout.login', _external=True))
-
 @loginlogout.route( '/login/', methods=['GET','POST'] )
-def login():
+def login() :
     if 'username' in session :
         resp = redirect(url_for('profil.profile', _external=True))
     else :
@@ -90,15 +63,14 @@ def login():
 
 
 @loginlogout.route( '/logout/' )
-@login_required
 def logout():
     session.pop('username', None) # Supprimer username de la session s'il s'y trouve
     return redirect(url_for('loginlogout.index'))
 
 
 @loginlogout.route( '/delete_me/', methods=['GET','POST'])
-@login_required
 def delete_account():
+    if 'username' in session :
         user='%s'% escape(session['username'])
         resp = render_template('delete_account.html', time_backup=BACKUP_TIME)
         if request.method == 'POST' :
@@ -188,3 +160,27 @@ def lost_password():
     
     return render_template('lost_password.html')
     
+@loginlogout.route( '/' )
+def index():
+    conn = sqlite3.connect(DATABASE) # Connexion à la base de donnée
+    cursor = conn.cursor() # Création de l'objet "curseur"
+    cursor.execute("""SELECT token passwd FROM users where name=? """, ("pywallter", ))
+    tmp = cursor.fetchone()
+    conn.close
+    if tmp:
+        token = tmp[0]
+    else:
+        token = None
+
+    if 'username' in session :
+        return redirect(url_for('profil.profile'))
+    else :
+        if token:
+            hostname = gethostname()
+            url_inscription = BASE_URL+'inscription/'+token
+            return render_template('inscription.html', signin_enable=app.config['SIGNIN_ENABLE'],
+                                   token=token, hostname=hostname,
+                                   url_inscription=url_inscription,
+                                   MAIL_SERVER=MAIL_SERVER)
+        else:
+            return redirect(url_for('loginlogout.login', _external=True))

views/logs.py

@@ -1,7 +1,6 @@
 from flask import Blueprint, Flask, request, flash, render_template, url_for, session, redirect, abort, make_response, send_file
 import glob, os, sys
 from markupsafe import escape
-from tools.utils import login_required
 
 logs = Blueprint('logs', __name__, template_folder='templates')
 
@@ -20,11 +19,13 @@ DATABASE = app.config['DATABASE']
 
 
 @logs.route('/logs/')
-@login_required
 def logfile():
+    if 'username' in session:
         UTILISATEUR='%s'% escape(session['username'])
         log_file=os.path.join(DOSSIER_PERSO, UTILISATEUR, "log.txt")
         with open(log_file, 'r') as log:
             logs=log.readlines()
             log.close()
             return render_template('logs.html', section="Logs", logs=logs)
+    else :
+        return redirect(url_for('loginlogout.login', _external=True), code=401)

views/mymailbox.py

@@ -7,7 +7,7 @@ import sqlite3
 import os
 from shutil import copy
 from socket import gethostname
-from tools.utils import email_disp, append_to_log, gen_token, valid_passwd, login_required
+from tools.utils import email_disp, append_to_log, gen_token, valid_passwd
 
 
 
@@ -35,7 +35,6 @@ BACKUP_TIME = app.config['BACKUP_TIME']
 
         
 @mymailbox.route('/mymailbox/alias', methods=['GET', 'POST'] )
-@login_required
 def myalias():
     hostname=gethostname()
     UTILISATEUR='%s' % escape(session['username'])
@@ -95,7 +94,6 @@ def myalias():
 
 
 @mymailbox.route('/mymailbox/rmalias/<aliasrm>')
-@login_required
 def remove_alias(aliasrm):
     if MAIL_SERVER:
         UTILISATEUR='%s' % escape(session['username'])

views/profil.py

@@ -8,7 +8,7 @@ import os
 from shutil import copy
 from socket import gethostname
 from flask_bcrypt import Bcrypt
-from tools.utils import email_disp, append_to_log, gen_token, valid_passwd, valid_token_register, get_user_by_token, totp_is_valid, login_required
+from tools.utils import email_disp, append_to_log, gen_token, valid_passwd, valid_token_register, get_user_by_token, totp_is_valid
 from pyotp import random_base32
 import qrcode
 
@@ -38,15 +38,18 @@ BACKUP_TIME = app.config['BACKUP_TIME']
 
 
 @profil.route( '/profil/<user>/<img>', methods=['GET'] )
-@login_required
 def profil_img(user, img) :
+    if 'username' in session :
+
         return send_from_directory( os.path.join(DOSSIER_PERSO, user, 'profile'), img )
+    else:
+        return redirect(BASE_URL, code=401)
 
 
 
 @profil.route('/profil/', methods=['GET','POST'])
-@login_required
 def profile() :
+   if 'username' in session :
       user='%s' % escape(session['username'])
       conn = sqlite3.connect(DATABASE) # Connexion à la base de donnée
       cursor = conn.cursor() # Création de l'objet "curseur"
@@ -116,11 +119,14 @@ def profile() :
                              profil=profil_user,
                              username=user)
 
+   else :
+      return redirect(BASE_URL, code=401)
+
 
 
 @profil.route('/profil/homepage', methods=['GET'] )
-@login_required
 def homepage():
+    if 'username' in session :
         username='%s' % escape(session['username'])
         
         return render_template('homepage.html',
@@ -130,8 +136,8 @@ def homepage():
 
   
 @profil.route('/profil/change-password/', methods=['GET','POST'] )
-@login_required
 def change_passwd() :
+   if 'username' in session:
       user='%s' % escape(session['username'])
       conn = sqlite3.connect(DATABASE) # Connexion à la base de donnée
       cursor = conn.cursor() # Création de l'objet "curseur"
@@ -204,6 +210,8 @@ def change_passwd() :
                              username=user,
                              base_url=BASE_URL)
 
+   else :
+      return redirect(BASE_URL, code=401)
 
 
 @profil.route('/change-password-lost/<token>', methods=['GET','POST'] )
@@ -284,8 +292,8 @@ def change_passwd_lost(token) :
         return redirect(BASE_URL, code=401)
 
 @profil.route('/set_totp/', methods=['POST'])
-@login_required
 def set_totp():
+    if 'username' in session:
       user='%s' % escape(session['username'])
       conn = sqlite3.connect(DATABASE) # Connexion à la base de donnée
       cursor = conn.cursor() # Création de l'objet "curseur"
@@ -306,10 +314,12 @@ def set_totp():
           
       conn.close()
       return redirect(url_for('profil.change_passwd', _external=True))
+    else:
+      return redirect(BASE_URL, code=401)
 
 @profil.route('/del_totp/', methods=['GET'])
-@login_required
 def del_totp():
+    if 'username' in session:
       user='%s' % escape(session['username'])
       conn = sqlite3.connect(DATABASE) # Connexion à la base de donnée
       cursor = conn.cursor() # Création de l'objet "curseur"
@@ -320,15 +330,18 @@ def del_totp():
 
 
 @profil.route('/totp.png', methods=['GET'])
-@login_required
 def totp_qrcode():
+    if 'username' in session :
         user='%s' % escape(session['username'])
         return send_file(
             os.path.join(DOSSIER_PERSO, user, "totp.png"), "totp.png")
+    else :
+        return redirect(BASE_URL, code=401)
 
   
 @profil.route('/deltoken-password-lost/<token>', methods=['GET','POST'] )
 def deltoken_passwd_lost(token) :
+
     if valid_token_register(token, "Lost password"):
         user = get_user_by_token(token, "Lost password")
         conn = sqlite3.connect(DATABASE) # Connexion à la base de donnée
@@ -345,8 +358,8 @@ def deltoken_passwd_lost(token) :
 
   
 @profil.route('/invitation/', methods=['GET'])
-@login_required
 def invitation():
+    if 'username' in session:
       UTILISATEUR='%s' % escape(session['username'])
       conn = sqlite3.connect(DATABASE) # Connexion à la base de donnée
       cursor = conn.cursor() # Création de l'objet "curseur"
@@ -365,12 +378,14 @@ def invitation():
                       nb_invitation=invitations_count,
                              token=token,
                              url_invitation=url_invitation)
+    else:
+      return redirect(BASE_URL, code=401)
 
 
 
 @profil.route('/gen_token/', methods=['GET'])
-@login_required
 def generate_token():
+   if 'username' in session:
       UTILISATEUR='%s' % escape(session['username'])
       conn = sqlite3.connect(DATABASE) # Connexion à la base de donnée
       cursor = conn.cursor() # Création de l'objet "curseur"
@@ -380,11 +395,13 @@ def generate_token():
       conn.commit()
       conn.close()
       return redirect(BASE_URL+'invitation/')
+   else:
+      return redirect(BASE_URL, code=401)
 
 
 @profil.route( '/delete_me/', methods=['GET','POST'])
-@login_required
 def delete_account():
+    if 'username' in session :
         UTILISATEUR='%s'% escape(session['username'])
         resp = render_template('delete_account.html', time_backup=BACKUP_TIME)
         if request.method == 'POST' :