def create_post():
database = Mongo(database="test",
collection="posts",
ServerSelectionTimeoutMS=5000)
insert_success = True
form = forms.CreatePostForm(request.form)
if form.validate() and request.method == "POST":
if not "username" in session:
flash("You have to be logged in to add a post")
else:
post = {
"title": form.title.data,
"content": form.content.data,
"description": form.description.data,
"approved": False,
"xss_protection_disabled": False,
"author": session["username"]
}
try:
database.insert(post)
flash("Post was created")
flash("Admin soon will check your post")
except DuplicateKeyError:
flash("This post title exist")
return render_template("posts/create_post_form.html", form=form)
def list_post():
database = Mongo(database="test",
collection="posts",
ServerSelectionTimeoutMS=5000)
all_post = database.find(how_many="all",
data_filter={"approved": True},
projection={
"content": 1,
"title": 1,
"description": 1,
"author": 1
})
return render_template("posts/show_posts.html", posts=all_post)
def signup():
database = Mongo(database="test",
collection="user",
ServerSelectionTimeoutMS=5000)
form = UserRegisterForm(request.form)
if form.validate() and request.method == "POST":
user = {
"username": form.username.data,
"password_hash": create_hash(form.password.data),
"trusted_user":
False # trusted_user posts will not be protected from xss attack
}
if database.find(data_filter={"username": form.username.data}) is None:
database.insert(user)
flash(
message=f"Your account has been registered {form.username.data}"
)
return redirect(url_for("user.signup_sucess", _method="GET"))
else:
flash(message="An account with this nickname already exists")
return redirect(url_for("user.signup_sucess", _method="GET"))
return render_template("auth/signup_form.html", form=form)
def password_checker(username, password) -> bool:
"""
Chceck if password is equal to user password
:param username:check password for this user
:param password:
:return:
True if password match, False otherwise
"""
database = Mongo(database="test",
collection="user",
ServerSelectionTimeoutMS=5000)
user_password_hash_db = database.find(data_filter={"username": username},
projection={
"password_hash": 1,
"_id": 0
})
if isinstance(user_password_hash_db, dict):
print(user_password_hash_db)
if bcrypt.checkpw(
password.encode("utf-8"),
hashed_password=user_password_hash_db["password_hash"].encode(
"utf-8")):
return True
return False
def get_post(title):
database = Mongo(database="test",
collection="posts",
ServerSelectionTimeoutMS=5000)
post = database.find(how_many="one",
data_filter={
"approved": True,
"title": title
},
projection={
"content": 1,
"author": 1,
"title": 1,
"xss_protection_disabled": 1
})
database = Mongo(database="test",
collection="user",
ServerSelectionTimeoutMS=5000)
author = database.find(how_many="one",
data_filter={"username": post["author"]},
projection={"trusted_user": 1})
return render_template("posts/render_post.html", post=post, author=author)
from flask import Blueprint, render_template, request, redirect, url_for, flash, session
import bcrypt
from werkzeug.utils import redirect
from Flask_blog.database.db import Mongo
from Flask_blog.user.forms import UserRegisterForm, UserLoginForm
user = Blueprint("user", __name__)
database = Mongo(database="test",
collection="user",
ServerSelectionTimeoutMS=5000)
def create_hash(password: str):
"""
Create password hash using bcrypt
:param password:
:return: password hash
"""
return bcrypt.hashpw(password.encode("utf-8"),
bcrypt.gensalt(rounds=14)).decode("utf-8")
@user.route("/register", methods=["GET", "POST"])
def signup():
database = Mongo(database="test",
collection="user",
ServerSelectionTimeoutMS=5000)
form = UserRegisterForm(request.form)
if form.validate() and request.method == "POST":
def test_connection():
load_environment_variables()
assert environ["MONGO_URI"]
mongo_instance = Mongo(url=environ["MONGO_URI"],
ServerSelectionTimeoutMS=5000)
mongo_instance.find()
def admin_login():
database = Mongo(database="test",
collection="user",
ServerSelectionTimeoutMS=5000)
return render_template("admin/admin_login.html")