daknuett/scientific-programming-exercises
2
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

added ex26

Browse Source
This commit is contained in:
Daniel Knüttel 2018-12-06 12:29:59 +01:00
parent 67ebc11121
commit 5806cc2444
1 changed files with 124 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

124
ex_26.py Normal file
View File

@ -0,0 +1,124 @@
import re
import sqlite3
import cherrypy
import uuid
import smtplib
def isinsecurepassword(password):
if(len(password) < 8):
return True
if(len(set(password)) < 4):
return True
return False
def simplehash(password):
"""
XXX: ONLY FOR DEMO PURPOSES!
"""
result = 0xff
for i in password:
result ^= ord(i)
return result
class InputValidationServer(object):
def __init__(self, db):
self._db_name = db
self._rzid_pattern = re.compile("[a-z]{3}[0-9]{5}")
self._email_password = "foobar"
self._email_user = "dummy@daknuett.eu"
@cherrypy.expose
def index(self):
return '''
<html>
<head>
<title>Input Validation Form</title>
</head>
<body>
<form action="submit">
<p>
password: <input type="password" name="password"/>
</p>
<p>
email: <input type="email" name="email"/>
</p>
<p>
RZ Kennung: <input type="text" name="rzid"/>
</p>
<input type=submit name="submit" value="Submit"/>
</form
</body>
</html>'''
@cherrypy.expose
def submit(self, password, email, rzid, submit):
if(not self._rzid_pattern.match(rzid)):
return '''<html><head><title>Error</title></head><body><h1>Error: invalid RZ Kennung.</h1></body></html>'''
confirmation_id = str(uuid.uuid4())
db = sqlite3.connect(self._db_name)
cursor = db.cursor()
cursor.execute("SELECT COUNT(rzid) FROM users WHERE rzid=?", (rzid,))
if(cursor.fetchone()[0]):
db.close()
return '''<html><head><title>Error</title></head><body><h1>Error: RZ Kennung in use.</h1></body></html>'''
cursor.execute("INSERT INTO users(rzid, email, password, confirmation_id) VALUES(?, ?, ?, ?)",
(rzid, email, simplehash(password), confirmation_id))
db.commit()
smtp = smtplib.SMTP("daknuett.eu", 587)
smtp.ehlo()
smtp.starttls()
smtp.login(self._email_user, self._email_password)
smtp.sendmail(self._email_user, [email],
'\r\n'.join(['To: %s' % email
, 'From: %s' % self._email_user
, 'Subject: %s' % "confirm your email address"
, "\n\r", "http://localhost:8080/confirm?confirmation_id={}".format(confirmation_id)]))
smtp.close()
db.close()
if(isinsecurepassword(password)):
return '''<html><head><title>OK</title></head><body><h1>Check your mailbox for the confirmation email</h1>
<p>Also your password is pretty unsecure</p></body></html>'''
return '''<html><head><title>OK</title></head><body><h1>Check your mailbox for the confirmation email</h1></body></html>'''
@cherrypy.expose
def confirm(self, confirmation_id):
db = sqlite3.connect(self._db_name)
cursor = db.cursor()
cursor.execute("SELECT rzid FROM users WHERE confirmation_id=?", (confirmation_id,))
try:
rzid = cursor.fetchone()[0]
except:
return '''<html><head><title>Error</title></head><body><h1>Error: unknown confirmation ID</h1></body></html>'''
cursor.execute("UPDATE users SET confirmation_id='' WHERE rzid=?", (rzid,))
return '''<html><head><title>OK</title></head><body><h1>Your account is activated.</h1></body></html>'''
with open("example.db", "w"):
pass
db = sqlite3.connect("example.db")
db.cursor().execute("CREATE TABLE users(rzid TEXT, email TEXT, password INT, confirmation_id TEXT)")
db.commit()
db.close()
app = InputValidationServer("example.db")
cherrypy.quickstart(app)