Weniger Sicherheitslücken und Fehler

app.py

@@ -79,6 +79,12 @@ def datei(id):
     return audio
 
 
+def dateiNameFürListe(name):
+    name = name.replace("/", "%2F")
+    name = name + ".json"
+    return name
+
+
 def kartenGeneriren(song):
     id = song["wikiid"]
     print(id)
@@ -112,6 +118,11 @@ def kartenGeneriren(song):
         song["land"] = wikiapi(statements["P495"][0]["value"]["content"], "labels")[
             "de"
         ]
+        song["bild"] = (
+            "Flag_of_"
+            + wikiapi(statements["P495"][0]["value"]["content"], "labels")["en"]
+            + ".svg"
+        )
     if "ytid" not in song and "P1651" in statements:
         song["ytid"] = statements["P1651"][0]["value"]["content"]
     if "ytid" in song:
@@ -123,6 +134,11 @@ def kartenGeneriren(song):
         song["img"] = (
             f"https://commons.wikimedia.org/w/index.php?title=Special:Redirect/file/{statements['P18'][0]['value']['content']}&width=300"
         )
+    if "backimg" not in song and "P495" in statements:
+        song["backimg"] = (
+            f"https://commons.wikimedia.org/w/index.php?title=Special:Redirect/file/Flag_of_{wikiapi(statements['P495'][0]['value']['content'], 'labels')['en']}.svg&width=300"
+        )
+        print(song["backimg"])
     if "img" not in song:
         song["img"] = (
             "https://commons.wikimedia.org/w/index.php?title=Special:Redirect/file/Eurovision_Song_Contest_heart_(2014–2025).svg&width=300"
@@ -142,9 +158,10 @@ def zeit(sekunden):
 @app.route("/")
 def hello_world():
     liste = request.args.get("liste")
+    flag = request.args.get("flag")
     if liste is None:
         return redirect("/playlists")
-    with open(liste + ".json", "r") as f:
+    with open(dateiNameFürListe(liste), "r") as f:
         songs = json.load(f)
     for song in songs:
         kartenGeneriren(song)
@@ -152,7 +169,7 @@ def hello_world():
     for song in songs:
         gesamtLaenge += song["laenge"]
     return render_template(
-        "index.html", karten=songs, gesamtLaenge=gesamtLaenge, liste=liste
+        "index.html", karten=songs, gesamtLaenge=gesamtLaenge, liste=liste, flag=flag
     )
 
 
@@ -167,7 +184,7 @@ def playlists():
 def neueliste():
     name = request.args.get("name")
     if name is not None:
-        with open(name + ".json", "x") as f:
+        with open(dateiNameFürListe(name), "x") as f:
             json.dump([], f)
         return redirect("/?liste=" + name)
     return render_template("neueliste.html", name=name)
@@ -189,14 +206,17 @@ def suche():
 @app.route("/suche", methods=["POST"])
 def suche_finden():
     liste = request.args.get("liste")
-    with open(liste + ".json", "r") as f:
+    if liste:
-        songs = json.load(f)
+        with open(dateiNameFürListe(liste), "r") as f:
-    song = {"wikiid": request.form.get("id")}
+            songs = json.load(f)
-    kartenGeneriren(song)
+        song = {"wikiid": request.form.get("id")}
-    songs.append(song)
+        kartenGeneriren(song)
-    with open(liste + ".json", "w") as f:
+        songs.append(song)
-        json.dump(songs, f, indent=2, ensure_ascii=False)
+        with open(dateiNameFürListe(liste), "w") as f:
-    return redirect("/suche?liste=" + liste, 303)
+            json.dump(songs, f, indent=2, ensure_ascii=False)
+        return redirect("/suche?liste=" + liste, 303)
+    else:
+        return redirect("/")
 
 
 @app.route("/remove")
@@ -204,7 +224,7 @@ def admin():
     liste = request.args.get("liste")
     if liste is None:
         return redirect("/playlists")
-    with open(liste + ".json", "r") as f:
+    with open(dateiNameFürListe(liste), "r") as f:
         songs = json.load(f)
     for song in songs:
         kartenGeneriren(song)
@@ -219,13 +239,22 @@ def admin():
 @app.route("/remove", methods=["POST"])
 def loeschen():
     liste = request.args.get("liste")
-    song = int(request.form.get("index"))
+    if not liste:
-    with open(liste + ".json", "r") as f:
+        return "Du Musst eine Liste angeben", 400
-        print(liste + ".json")
+    song = request.form.get("index")
-        songs = json.load(f)
+    if song is None:
-        print(songs)
+        return "Kein Lied", 400
-    print(songs)
+    try:
-    del songs[song]
+        song = int(song)
-    with open(liste + ".json", "w") as f:
+    except TypeError:
-        json.dump(songs, f, indent=2, ensure_ascii=False)
+        return "Irgendwas ist GANZ falsch", 400
-    return redirect("/remove?liste=" + liste, 303)
+    try:
+        with open(dateiNameFürListe(liste), "x") as f:
+            songs = json.load(f)
+            if len(songs) < song + 1:
+                return "Das Lied Gibt es Nicht", 400
+            del songs[song]
+            json.dump(songs, f, indent=2, ensure_ascii=False)
+        return redirect("/remove?liste=" + liste, 303)
+    except FileNotFoundError:
+        return "Die Liste Ist nicht da (Du kannst Sie anlegen)", 400

templates/index.html

@@ -29,7 +29,7 @@
         font-style: italic;
     }
     img {
-        border-radius: 2%;
+        border-radius: 1rem;
         width: 100%;
         aspect-ratio: 4/3;
         object-fit: contain;

templates/karte.html

@@ -1,42 +1,64 @@
-<article>
+{% if karte.backimg and flag %}
-    <img src="{{ karte.img }}" />
+<style>
-    {% if karte.ytid %}
+    #{{karte.wikiid}} {
-    <p>
+        background-image: url("{{karte.backimg}}");
-        <button id="{{karte_loop.index0}}" onclick="vorherige(this.id)">
+    }
-            Vorherige</button
+    #inkarte{
-        ><button id="{{karte_loop.index0}}" onclick="abspielendiese(this.id)">
+        background-color: white;
-            Abspielen</button
+        border-radius: 1rem;
-        ><button id="{{karte_loop.index0}}" onclick="nächste(this.id)">
+        filter: drop-shadow(6px 6px 10px black);
-            Nächstes
+        padding: 4px;
-        </button>
+    }
-    </p>
+</style>
-    <audio src="/static/{{karte.datei}}"></audio>
+{% endif %}
-    {% endif %}
+<article id="{{ karte.wikiid}}">
-
+    <div id="inkarte">
-    <h2>{{ karte.titel}}</h2>
+        <img src="{{ karte.img }}" />
-
+        {% if karte.ytid %}
-    {% if karte.jahrgang %}
+        <p>
-    <p><b>Jahrgang:</b> {{ karte.jahrgang }}</p>
+            <button id="{{karte_loop.index0}}" onclick="vorherige(this.id)">
-    {% endif %} {% if karte.plazirung%}
+                Vorherige</button
-    <p><b>Plazirung:</b> {{ karte.plazirung }}</p>
+            ><button
-    {% endif %} {% if karte.land %}
+                id="{{karte_loop.index0}}"
-    <p><b>Antretent für:</b> {{karte.land}}</p>
+                onclick="abspielendiese(this.id)"
-    {% endif %}
+            >
-
+                Abspielen</button
-    <p><b>Interpret(en):</b> {{ karte.interprete}}</p>
+            ><button id="{{karte_loop.index0}}" onclick="nächste(this.id)">
-
+                Nächstes
-    <p><b>Länge:</b> {{karte.laenge|zeit}}</p>
+            </button>
-    <p id="gray">
+        </p>
-        {% if karte.text %}
+        <audio src="/static/{{karte.datei}}"></audio>
-        <a id="gray" href="{{ karte.text }}" target="_blank">Original Text</a>
         {% endif %}
-        <a id="gray" href="https://www.wikidata.org/entity/{{karte.wikiid}}"
+
-            >Q-id:{{karte.wikiid}}</a
+        <h2>{{ karte.titel}}</h2>
-        >
+
-    </p>
+        {% if karte.jahrgang %}
-    {% if admin %}
+        <p><b>Jahrgang:</b> {{ karte.jahrgang }}</p>
-    <form method="post">
+        {% endif %} {% if karte.plazirung%}
-        <button name="index" value="{{karte_loop.index0}}">&lt;X&gt;</button>
+        <p><b>Plazirung:</b> {{ karte.plazirung }}</p>
-    </form>
+        {% endif %} {% if karte.land %}
-    {% endif %}
+        <p><b>Antretent für:</b> {{karte.land}}</p>
+        {% endif %}
+
+        <p><b>Interpret(en):</b> {{ karte.interprete}}</p>
+
+        <p><b>Länge:</b> {{karte.laenge|zeit}}</p>
+        <p id="gray">
+            {% if karte.text %}
+            <a id="gray" href="{{ karte.text }}" target="_blank"
+                >Original Text</a
+            >
+            {% endif %}
+            <a id="gray" href="https://www.wikidata.org/entity/{{karte.wikiid}}"
+                >Q-id:{{karte.wikiid}}</a
+            >
+        </p>
+        {% if admin %}
+        <form method="post">
+            <button name="index" value="{{karte_loop.index0}}">
+                &lt;X&gt;
+            </button>
+        </form>
+        {% endif %}
+    </div>
 </article>