yannic/stacosys
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

improve form

Browse source
This commit is contained in:
Yax 2021-07-31 05:28:32 +02:00
parent 9c3d088584
commit 1c403ae8b3
1 changed files with 27 additions and 40 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

67
stacosys/interface/form.py
View file

@ -13,54 +13,41 @@ logger = logging.getLogger(__name__)
@app.route("/newcomment", methods=["POST"]) @app.route("/newcomment", methods=["POST"])
def new_form_comment(): def new_form_comment():
try:
data = request.form
logger.info("form data " + str(data))
# validate token: retrieve site entity data = request.form
token = data.get("token", "") logger.info("form data " + str(data))
if token != app.config.get("SITE_TOKEN"):
abort(401)
# honeypot for spammers # honeypot for spammers
captcha = data.get("remarque", "") captcha = data.get("remarque", "")
if captcha: if captcha:
logger.warning("discard spam: data %s" % data) logger.warning("discard spam: data %s" % data)
abort(400)
url = data.get("url", "")
author_name = data.get("author", "").strip()
author_gravatar = data.get("email", "").strip()
author_site = data.get("site", "").lower().strip()
if author_site and author_site[:4] != "http":
author_site = "http://" + author_site
message = data.get("message", "")
# anti-spam again
if not url or not author_name or not message:
logger.warning("empty field: data %s" % data)
abort(400)
if not check_form_data(data.to_dict()):
logger.warning("additional field: data %s" % data)
abort(400)
# add a row to Comment table
dao.create_comment(url, author_name, author_site, author_gravatar, message)
except Exception:
logger.exception("new comment failure")
abort(400) abort(400)
url = data.get("url", "")
author_name = data.get("author", "").strip()
author_gravatar = data.get("email", "").strip()
author_site = data.get("site", "").lower().strip()
if author_site and author_site[:4] != "http":
author_site = "http://" + author_site
message = data.get("message", "")
# anti-spam again
if not url or not author_name or not message:
logger.warning("empty field: data %s" % data)
abort(400)
if not check_form_data(data.to_dict()):
logger.warning("additional field: data %s" % data)
abort(400)
# add a row to Comment table
dao.create_comment(url, author_name, author_site, author_gravatar, message)
return redirect("/redirect/", code=302) return redirect("/redirect/", code=302)
def check_form_data(d): def check_form_data(d):
fields = ["url", "message", "site", "remarque", "author", "token", "email"] fields = ["url", "message", "site", "remarque", "author", "token", "email"]
for field in fields: filtered = dict(filter(lambda x: x[0] not in fields, d.items()))
if field in d: return not filtered
del d[field]
# filtered = dict(filter(lambda x: x[0] not in fields, data.to_dict().items()))
return not d