diff --git a/app.py b/app.py index 8c33e4c..645836d 100644 --- a/app.py +++ b/app.py @@ -20,7 +20,7 @@ cfg.load_files(["data/blazegoat_panel.conf"]) # Load the panel configuration. app.config.update(dict( - DATABASE=os.path.join('data/', 'blazegoat.db'), + DATABASE=os.path.join('data/', 'blazegoat.production.db'), STATIC_FOLDER='static/', DEBUG=cfg.debug, SECRET_KEY=cfg.secret_key, @@ -175,6 +175,8 @@ def register(): error = 'That username is reserved.' elif len(request.form['password']) < 8: error = 'Your password must be eight characters or longer.' + elif len(request.form['username']) > 16: + error = "Your username is longer than 16 characters." else: # Attempt to insert the user try: db.cursor().execute('INSERT INTO users (username, email, password, rank, tempPass) VALUES (?, ?, ?, 4, 0)', @@ -213,7 +215,6 @@ def changepass(): def createServer(): db = get_db() error = None - print(cfg.server_creation_locked) if request.method == 'GET' and cfg.server_creation_locked == True: flash("Server creation has been locked by the administrators.") return redirect(url_for("index")) @@ -225,15 +226,16 @@ def createServer(): db.cursor().execute('INSERT INTO servers (owner, name, jartype) VALUES (?,?,?)', [str(session['username']), request.form['servername'], str(request.form.getlist('jartype')), ]) db.commit() flash('Your server has been created with the following name: ' + request.form['servername']) - return redirect(url_for('index')) - else: - error = "Server creation has been locked by the administrators." + return redirect(url_for("index")) return render_template('servercp/createserver.html', error=error) @app.route('/logout') def logout(): session.pop('logged_in', None) # Pop the session, logging out the user. session.pop('username', None) # Pop the username session cookie + session.pop('is_admin', None) # Pop the userlevel cookies, preventing security issues. + session.pop('is_moderator', None) + session.pop('is_trusted', None) flash('You were logged out.') return redirect(url_for('index')) @@ -255,12 +257,12 @@ def serverIndex(sid): return render_template('errors/404.html') return render_template('servercp/serverpanel.html', error=error, sid=sid) - if request.method == 'POST': - if request.form['name'] == None: - error = 'The server name cannot be empty.' - db.cursor().execute('UPDATE servers SET jartype=?, name=? WHERE sid=?', [request.form['jartype'], request.form['name'], sid]) - db.commit() - return render_template('servercp/serverpanel.html', error=error, sid=sid) + #if request.method == 'POST': + # if request.form['name'] == None: + # error = 'The server name cannot be empty.' + # db.cursor().execute('UPDATE servers SET jartype=?, name=? WHERE sid=?', [request.form['jartype'], request.form['name'], sid]) + # db.commit() + #return render_template('servercp/serverpanel.html', error=error, sid=sid) @app.route('/servers/id//_