diff --git a/app.py b/app.py index a6b24f0..d0bbd75 100644 --- a/app.py +++ b/app.py @@ -5,7 +5,7 @@ from datetime import datetime from pattern import Pattern -import sqlite3, os, flask_login, dotenv, secrets, html +import sqlite3, os, flask_login, dotenv, secrets, html, time if os.path.exists(".env"): dotenv.load_dotenv(".env") @@ -132,7 +132,7 @@ def register(): elif request.method == "POST": if request.form["username"] != html.escape(request.form["username"], quote=True): - return "No XSS please" + return Response("No XSS please", 400) username = html.escape(request.form["username"], quote=True) pattern = Pattern.from_str(request.form["pattern"]) @@ -161,13 +161,31 @@ def profile(): def profile_external(username): return render_template("profile.jinja2", username=username, grid_size=os.getenv("GRID_SIZE", 15), logged_in_account=False) +@app.route("/submit_post", methods=["POST"]) +@login_required +def submit_post(): + username = flask_login.current_user.id + pattern, comment = Pattern.from_str(request.form["pattern"]), request.form["comment"] + + if comment != html.escape(comment, quote=True): + return Response("No XSS please", 400) + + cur = get_db().cursor() + + cur.execute("INSERT INTO Posts (username, comment, pattern, creation_time) VALUES (?, ?, ?, ?)", (username, comment, pattern.to_json_str(), int(time.time()))) + + get_db().commit() + cur.close() + + return "success" + @app.route("/change_username", methods=["POST"]) @login_required def change_username(): username = flask_login.current_user.id if request.form["new_username"] != html.escape(request.form["new_username"], quote=True): - return "No XSS please" + return Response("No XSS please", 400) new_username = html.escape(request.form["new_username"], quote=True) diff --git a/static/pumpkin.js b/static/pumpkin.js index 0e1b892..708c5f7 100644 --- a/static/pumpkin.js +++ b/static/pumpkin.js @@ -153,7 +153,6 @@ function unlight_pumpkin(ctx, cell_size, currentPattern) { function setup_lightbtn(ctx, cell_size, lightbtn_id, pattern) { let lit = { value: false }; - document.getElementById(lightbtn_id).addEventListener('click', function(event) { if (lit.value) { lit.value = false; diff --git a/templates/index.jinja2 b/templates/index.jinja2 index 1fab799..bb729b3 100644 --- a/templates/index.jinja2 +++ b/templates/index.jinja2 @@ -20,6 +20,7 @@ {% block body %}

Posts

+
@@ -38,12 +39,41 @@
+ + {% endblock body %} \ No newline at end of file