Weniger Sicherheitslücken und Fehler

app.py

@@ -79,6 +79,12 @@ def datei(id):
     return audio
 
 
+def dateiNameFürListe(name):
+    name = name.replace("/", "%2F")
+    name = name + ".json"
+    return name
+
+
 def kartenGeneriren(song):
     id = song["wikiid"]
     print(id)
@@ -112,6 +118,11 @@ def kartenGeneriren(song):
         song["land"] = wikiapi(statements["P495"][0]["value"]["content"], "labels")[
             "de"
         ]
+        song["bild"] = (
+            "Flag_of_"
+            + wikiapi(statements["P495"][0]["value"]["content"], "labels")["en"]
+            + ".svg"
+        )
     if "ytid" not in song and "P1651" in statements:
         song["ytid"] = statements["P1651"][0]["value"]["content"]
     if "ytid" in song:
@@ -123,6 +134,11 @@ def kartenGeneriren(song):
         song["img"] = (
             f"https://commons.wikimedia.org/w/index.php?title=Special:Redirect/file/{statements['P18'][0]['value']['content']}&width=300"
         )
+    if "backimg" not in song and "P495" in statements:
+        song["backimg"] = (
+            f"https://commons.wikimedia.org/w/index.php?title=Special:Redirect/file/Flag_of_{wikiapi(statements['P495'][0]['value']['content'], 'labels')['en']}.svg&width=300"
+        )
+        print(song["backimg"])
     if "img" not in song:
         song["img"] = (
             "https://commons.wikimedia.org/w/index.php?title=Special:Redirect/file/Eurovision_Song_Contest_heart_(2014–2025).svg&width=300"
@@ -142,9 +158,10 @@ def zeit(sekunden):
 @app.route("/")
 def hello_world():
     liste = request.args.get("liste")
+    flag = request.args.get("flag")
     if liste is None:
         return redirect("/playlists")
-    with open(liste + ".json", "r") as f:
+    with open(dateiNameFürListe(liste), "r") as f:
         songs = json.load(f)
     for song in songs:
         kartenGeneriren(song)
@@ -152,7 +169,7 @@ def hello_world():
     for song in songs:
         gesamtLaenge += song["laenge"]
     return render_template(
-        "index.html", karten=songs, gesamtLaenge=gesamtLaenge, liste=liste
+        "index.html", karten=songs, gesamtLaenge=gesamtLaenge, liste=liste, flag=flag
     )
 
 
@@ -167,7 +184,7 @@ def playlists():
 def neueliste():
     name = request.args.get("name")
     if name is not None:
-        with open(name + ".json", "x") as f:
+        with open(dateiNameFürListe(name), "x") as f:
             json.dump([], f)
         return redirect("/?liste=" + name)
     return render_template("neueliste.html", name=name)
@@ -189,14 +206,17 @@ def suche():
 @app.route("/suche", methods=["POST"])
 def suche_finden():
     liste = request.args.get("liste")
-    with open(liste + ".json", "r") as f:
+    if liste:
+        with open(dateiNameFürListe(liste), "r") as f:
             songs = json.load(f)
         song = {"wikiid": request.form.get("id")}
         kartenGeneriren(song)
         songs.append(song)
-    with open(liste + ".json", "w") as f:
+        with open(dateiNameFürListe(liste), "w") as f:
             json.dump(songs, f, indent=2, ensure_ascii=False)
         return redirect("/suche?liste=" + liste, 303)
+    else:
+        return redirect("/")
 
 
 @app.route("/remove")
@@ -204,7 +224,7 @@ def admin():
     liste = request.args.get("liste")
     if liste is None:
         return redirect("/playlists")
-    with open(liste + ".json", "r") as f:
+    with open(dateiNameFürListe(liste), "r") as f:
         songs = json.load(f)
     for song in songs:
         kartenGeneriren(song)
@@ -219,13 +239,22 @@ def admin():
 @app.route("/remove", methods=["POST"])
 def loeschen():
     liste = request.args.get("liste")
-    song = int(request.form.get("index"))
+    if not liste:
-    with open(liste + ".json", "r") as f:
+        return "Du Musst eine Liste angeben", 400
-        print(liste + ".json")
+    song = request.form.get("index")
+    if song is None:
+        return "Kein Lied", 400
+    try:
+        song = int(song)
+    except TypeError:
+        return "Irgendwas ist GANZ falsch", 400
+    try:
+        with open(dateiNameFürListe(liste), "x") as f:
             songs = json.load(f)
-        print(songs)
+            if len(songs) < song + 1:
-    print(songs)
+                return "Das Lied Gibt es Nicht", 400
             del songs[song]
-    with open(liste + ".json", "w") as f:
             json.dump(songs, f, indent=2, ensure_ascii=False)
         return redirect("/remove?liste=" + liste, 303)
+    except FileNotFoundError:
+        return "Die Liste Ist nicht da (Du kannst Sie anlegen)", 400

templates/index.html

@@ -29,7 +29,7 @@
         font-style: italic;
     }
     img {
-        border-radius: 2%;
+        border-radius: 1rem;
         width: 100%;
         aspect-ratio: 4/3;
         object-fit: contain;

templates/karte.html

@@ -1,10 +1,27 @@
-<article>
+{% if karte.backimg and flag %}
+<style>
+    #{{karte.wikiid}} {
+        background-image: url("{{karte.backimg}}");
+    }
+    #inkarte{
+        background-color: white;
+        border-radius: 1rem;
+        filter: drop-shadow(6px 6px 10px black);
+        padding: 4px;
+    }
+</style>
+{% endif %}
+<article id="{{ karte.wikiid}}">
+    <div id="inkarte">
         <img src="{{ karte.img }}" />
         {% if karte.ytid %}
         <p>
             <button id="{{karte_loop.index0}}" onclick="vorherige(this.id)">
                 Vorherige</button
-        ><button id="{{karte_loop.index0}}" onclick="abspielendiese(this.id)">
+            ><button
+                id="{{karte_loop.index0}}"
+                onclick="abspielendiese(this.id)"
+            >
                 Abspielen</button
             ><button id="{{karte_loop.index0}}" onclick="nächste(this.id)">
                 Nächstes
@@ -28,7 +45,9 @@
         <p><b>Länge:</b> {{karte.laenge|zeit}}</p>
         <p id="gray">
             {% if karte.text %}
-        <a id="gray" href="{{ karte.text }}" target="_blank">Original Text</a>
+            <a id="gray" href="{{ karte.text }}" target="_blank"
+                >Original Text</a
+            >
             {% endif %}
             <a id="gray" href="https://www.wikidata.org/entity/{{karte.wikiid}}"
                 >Q-id:{{karte.wikiid}}</a
@@ -36,7 +55,10 @@
         </p>
         {% if admin %}
         <form method="post">
-        <button name="index" value="{{karte_loop.index0}}">&lt;X&gt;</button>
+            <button name="index" value="{{karte_loop.index0}}">
+                &lt;X&gt;
+            </button>
         </form>
         {% endif %}
+    </div>
 </article>