diff --git a/routes.py b/routes.py index dcd4f3a..64091e6 100644 --- a/routes.py +++ b/routes.py @@ -3798,6 +3798,7 @@ def register_routes(app, ctx): SELECT user_id, display_name, + badge_text, bio, bio_mode, website, @@ -3823,6 +3824,7 @@ def register_routes(app, ctx): @app.route("/api/profile", methods=["PATCH"]) def api_update_my_profile(): + if not csrf_valid(): return jsonify({"error": "Security token expired.", "code": "csrf"}), 403 @@ -3840,6 +3842,7 @@ def register_routes(app, ctx): return jsonify({"error": str(error)}), 400 display_name = str(data.get("display_name", "")).strip() + badge_text = str(data.get("badge_text", "")).strip() bio = str(data.get("bio", "")).strip() bio_mode = str(data.get("bio_mode", "txt")).strip().lower() website = str(data.get("website", "")).strip() @@ -3847,6 +3850,8 @@ def register_routes(app, ctx): if len(display_name) > MAX_DISPLAY_NAME_LENGTH: return jsonify({"error": "Display name is too long."}), 400 + if len(badge_text) > MAX_PROFILE_BADGE_LENGTH: + return jsonify({"error": "Badge text is too long."}), 400 if len(bio) > MAX_PROFILE_BIO_LENGTH: return jsonify({"error": "Bio is too long."}), 400 if bio_mode not in PROFILE_BIO_MODES: @@ -3861,6 +3866,7 @@ def register_routes(app, ctx): UPDATE user_profiles SET display_name = ?, + badge_text = ?, bio = ?, bio_mode = ?, website = ?, @@ -3870,6 +3876,7 @@ def register_routes(app, ctx): """, ( display_name or user["username"], + badge_text, bio, bio_mode, website, @@ -3900,6 +3907,7 @@ def register_routes(app, ctx): SELECT user_id, display_name, + badge_text, bio, bio_mode, website, @@ -3918,7 +3926,7 @@ def register_routes(app, ctx): audit("profile_updated", user["id"], "user", str(user["id"])) return jsonify({"profile": profile_payload(html_module, user_payload, user_row, profile_row, settings_row, user)}) - + @app.route("/api/profiles/") def api_get_public_profile(username: str): normalized = normalize_username(username) @@ -3947,6 +3955,7 @@ def register_routes(app, ctx): SELECT user_id, display_name, + badge_text, bio, bio_mode, website,