Weniger Sicherheitslücken und Fehler

app.py

@@ -79,6 +79,12 @@ def datei(id):
     return audio
 
 
+def dateiNameFürListe(name):
+    name = name.replace("/", "%2F")
+    name = name + ".json"
+    return name
+
+
 def kartenGeneriren(song):
     id = song["wikiid"]
     print(id)
@@ -112,6 +118,11 @@ def kartenGeneriren(song):
         song["land"] = wikiapi(statements["P495"][0]["value"]["content"], "labels")[
             "de"
         ]
+        song["bild"] = (
+            "Flag_of_"
+            + wikiapi(statements["P495"][0]["value"]["content"], "labels")["en"]
+            + ".svg"
+        )
     if "ytid" not in song and "P1651" in statements:
         song["ytid"] = statements["P1651"][0]["value"]["content"]
     if "ytid" in song:
@@ -123,6 +134,11 @@ def kartenGeneriren(song):
         song["img"] = (
             f"https://commons.wikimedia.org/w/index.php?title=Special:Redirect/file/{statements['P18'][0]['value']['content']}&width=300"
         )
+    if "backimg" not in song and "P495" in statements:
+        song["backimg"] = (
+            f"https://commons.wikimedia.org/w/index.php?title=Special:Redirect/file/Flag_of_{wikiapi(statements['P495'][0]['value']['content'], 'labels')['en']}.svg&width=300"
+        )
+        print(song["backimg"])
     if "img" not in song:
         song["img"] = (
             "https://commons.wikimedia.org/w/index.php?title=Special:Redirect/file/Eurovision_Song_Contest_heart_(2014–2025).svg&width=300"
@@ -142,9 +158,10 @@ def zeit(sekunden):
 @app.route("/")
 def hello_world():
     liste = request.args.get("liste")
+    flag = request.args.get("flag")
     if liste is None:
         return redirect("/playlists")
-    with open(liste + ".json", "r") as f:
+    with open(dateiNameFürListe(liste), "r") as f:
         songs = json.load(f)
     for song in songs:
         kartenGeneriren(song)
@@ -152,7 +169,7 @@ def hello_world():
     for song in songs:
         gesamtLaenge += song["laenge"]
     return render_template(
-        "index.html", karten=songs, gesamtLaenge=gesamtLaenge, liste=liste
+        "index.html", karten=songs, gesamtLaenge=gesamtLaenge, liste=liste, flag=flag
     )
 
 
@@ -167,7 +184,7 @@ def playlists():
 def neueliste():
     name = request.args.get("name")
     if name is not None:
-        with open(name + ".json", "x") as f:
+        with open(dateiNameFürListe(name), "x") as f:
             json.dump([], f)
         return redirect("/?liste=" + name)
     return render_template("neueliste.html", name=name)
@@ -189,14 +206,17 @@ def suche():
 @app.route("/suche", methods=["POST"])
 def suche_finden():
     liste = request.args.get("liste")
-    with open(liste + ".json", "r") as f:
-        songs = json.load(f)
-    song = {"wikiid": request.form.get("id")}
-    kartenGeneriren(song)
-    songs.append(song)
-    with open(liste + ".json", "w") as f:
-        json.dump(songs, f, indent=2, ensure_ascii=False)
-    return redirect("/suche?liste=" + liste, 303)
+    if liste:
+        with open(dateiNameFürListe(liste), "r") as f:
+            songs = json.load(f)
+        song = {"wikiid": request.form.get("id")}
+        kartenGeneriren(song)
+        songs.append(song)
+        with open(dateiNameFürListe(liste), "w") as f:
+            json.dump(songs, f, indent=2, ensure_ascii=False)
+        return redirect("/suche?liste=" + liste, 303)
+    else:
+        return redirect("/")
 
 
 @app.route("/remove")
@@ -204,7 +224,7 @@ def admin():
     liste = request.args.get("liste")
     if liste is None:
         return redirect("/playlists")
-    with open(liste + ".json", "r") as f:
+    with open(dateiNameFürListe(liste), "r") as f:
         songs = json.load(f)
     for song in songs:
         kartenGeneriren(song)
@@ -219,13 +239,22 @@ def admin():
 @app.route("/remove", methods=["POST"])
 def loeschen():
     liste = request.args.get("liste")
-    song = int(request.form.get("index"))
-    with open(liste + ".json", "r") as f:
-        print(liste + ".json")
-        songs = json.load(f)
-        print(songs)
-    print(songs)
-    del songs[song]
-    with open(liste + ".json", "w") as f:
-        json.dump(songs, f, indent=2, ensure_ascii=False)
-    return redirect("/remove?liste=" + liste, 303)
+    if not liste:
+        return "Du Musst eine Liste angeben", 400
+    song = request.form.get("index")
+    if song is None:
+        return "Kein Lied", 400
+    try:
+        song = int(song)
+    except TypeError:
+        return "Irgendwas ist GANZ falsch", 400
+    try:
+        with open(dateiNameFürListe(liste), "x") as f:
+            songs = json.load(f)
+            if len(songs) < song + 1:
+                return "Das Lied Gibt es Nicht", 400
+            del songs[song]
+            json.dump(songs, f, indent=2, ensure_ascii=False)
+        return redirect("/remove?liste=" + liste, 303)
+    except FileNotFoundError:
+        return "Die Liste Ist nicht da (Du kannst Sie anlegen)", 400