dev/glo
3
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

login

Browse Source
This commit is contained in:
admin 2026-10-04 02:23:04 +00:00
parent ae470857c5
commit af7fc6ab99
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
app.py
View File

@ -1860,7 +1860,6 @@ def api_me():
} }
) )
@app.route("/api/register", methods=["POST"]) @app.route("/api/register", methods=["POST"])
def register(): def register():
limited = rate_limited("register") limited = rate_limited("register")
@ -1875,6 +1874,10 @@ def register():
except ValueError as error: except ValueError as error:
return jsonify({"error": str(error)}), 400 return jsonify({"error": str(error)}), 400
access_key = data.get("access_key", "")
if not PRIVATE_ACCESS_KEY or not isinstance(access_key, str) or access_key.strip() != PRIVATE_ACCESS_KEY:
return jsonify({"error": "Invalid private access key."}), 403
username = normalize_username(data.get("username")) username = normalize_username(data.get("username"))
password = data.get("password", "") password = data.get("password", "")
@ -1917,12 +1920,13 @@ def register():
INSERT OR IGNORE INTO user_profiles ( INSERT OR IGNORE INTO user_profiles (
user_id, user_id,
display_name, display_name,
badge_text,
bio, bio,
bio_mode, bio_mode,
website, website,
location, location,
updated_at updated_at
) VALUES (?, ?, '', 'txt', '', '', ?) ) VALUES (?, ?, '', '', 'txt', '', '', ?)
""", """,
(user["id"], username, now_iso()), (user["id"], username, now_iso()),
) )
@ -1952,7 +1956,6 @@ def register():
} }
), 201 ), 201
@app.route("/api/login", methods=["POST"]) @app.route("/api/login", methods=["POST"])
def login(): def login():
limited = rate_limited("login") limited = rate_limited("login")
@ -1967,6 +1970,10 @@ def login():
except ValueError as error: except ValueError as error:
return jsonify({"error": str(error)}), 400 return jsonify({"error": str(error)}), 400
access_key = data.get("access_key", "")
if not PRIVATE_ACCESS_KEY or not isinstance(access_key, str) or access_key.strip() != PRIVATE_ACCESS_KEY:
return jsonify({"error": "Invalid private access key."}), 403
username = normalize_username(data.get("username")) username = normalize_username(data.get("username"))
password = data.get("password", "") password = data.get("password", "")
@ -2004,7 +2011,6 @@ def login():
} }
) )
@app.route("/api/logout", methods=["POST"]) @app.route("/api/logout", methods=["POST"])
def logout(): def logout():
if not csrf_valid(): if not csrf_valid():