From 567edc43a74f4f12e64b05584ba69557199ef64c Mon Sep 17 00:00:00 2001 From: Aiirondev Date: Fri, 14 Aug 2026 11:15:12 +0200 Subject: [PATCH 1/7] Slight changes to make the username appear correctly --- Web/app.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Web/app.py b/Web/app.py index b5fa923..943a84b 100755 --- a/Web/app.py +++ b/Web/app.py @@ -7564,7 +7564,7 @@ def user_del(): last_name = "" fullname = None users_list.append({ - 'username': username, + 'username': decrypt_text(username), 'admin': user.get('Admin', False), 'fullname': fullname, 'name': name, From 821636908fbe996960b8caca67bb9c0f3b27811f Mon Sep 17 00:00:00 2001 From: Aiirondev Date: Fri, 14 Aug 2026 11:51:10 +0200 Subject: [PATCH 2/7] changes to the user authentification --- Web/app.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/Web/app.py b/Web/app.py index bd479fa..93670a7 100755 --- a/Web/app.py +++ b/Web/app.py @@ -824,13 +824,10 @@ def _action_access_allowed(permissions, action_key): def _permission_denied_fallback_endpoint(permissions, current_endpoint=None): username = session.get('username') is_admin_user = bool(username and us.check_admin(username)) - admin_home_allowed = _page_access_allowed(permissions, 'home_admin') and _action_access_allowed(permissions, 'can_manage_settings') for candidate in ('my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum', 'home_admin'): if current_endpoint and candidate == current_endpoint: continue - if candidate == 'home_admin' and is_admin_user and not admin_home_allowed: - continue if _page_access_allowed(permissions, candidate): return candidate return 'logout' From 237c79be5823e279c6f23e9cd613c4a52cd85c58 Mon Sep 17 00:00:00 2001 From: Aiirondev Date: Fri, 14 Aug 2026 11:58:44 +0200 Subject: [PATCH 3/7] changes to the user authentication --- Web/app.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Web/app.py b/Web/app.py index 93670a7..6287b44 100755 --- a/Web/app.py +++ b/Web/app.py @@ -453,7 +453,7 @@ PERMISSION_ACTION_ENDPOINTS = { 'admin_reset_user_password': 'can_manage_users', 'admin_update_user_permissions': 'can_manage_users', 'admin_anonymize_names': 'can_manage_users', - 'home_admin': 'can_manage_settings', + 'home_admin': 'can_borrow', 'upload_admin': 'can_insert', 'library_admin': 'can_insert', 'admin_borrowings': 'can_manage_settings', From fc0fdf847235619081ccc431bd82559117455f3d Mon Sep 17 00:00:00 2001 From: Aiirondev Date: Fri, 14 Aug 2026 12:05:23 +0200 Subject: [PATCH 4/7] change to the authentification system to allow the user acces o the main page --- Web/modules/database/user.py | 1 + 1 file changed, 1 insertion(+) diff --git a/Web/modules/database/user.py b/Web/modules/database/user.py index 2ccbb07..8b293c3 100755 --- a/Web/modules/database/user.py +++ b/Web/modules/database/user.py @@ -211,6 +211,7 @@ PERMISSION_PRESETS = { }, 'pages': { 'home': True, + 'home_admin': True, 'tutorial_page': True, 'my_borrowed_items': True, 'notifications_view': True, From 2d7cec075c41dc6d3ed95013485dfa8d1b5418e6 Mon Sep 17 00:00:00 2001 From: Aiirondev Date: Fri, 14 Aug 2026 12:08:31 +0200 Subject: [PATCH 5/7] workaround for existing misused users --- Web/app.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Web/app.py b/Web/app.py index 6287b44..c781e76 100755 --- a/Web/app.py +++ b/Web/app.py @@ -811,6 +811,8 @@ def _page_access_allowed(permissions, endpoint): if not permissions or not endpoint: return True page_permissions = permissions.get('pages', {}) + if endpoint == "home_admin": + return True return bool(page_permissions.get(endpoint, True)) From 61d726f8f4a13b07907affffe624c081656d3883 Mon Sep 17 00:00:00 2001 From: Aiirondev Date: Fri, 14 Aug 2026 14:17:54 +0200 Subject: [PATCH 6/7] Final fixes of the user functions to remove the breaking encryption of the username. --- Web/modules/database/user.py | 52 +++++++++++++++++------------------- 1 file changed, 25 insertions(+), 27 deletions(-) diff --git a/Web/modules/database/user.py b/Web/modules/database/user.py index 8b293c3..3091ed9 100755 --- a/Web/modules/database/user.py +++ b/Web/modules/database/user.py @@ -370,10 +370,10 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_ client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) db = _get_tenant_db(client) users = db['users'] - result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': update_data}) + result = users.update_one({'Username': username}, {'$set': update_data}) if result.matched_count == 0: - result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': update_data}) + result = users.update_one({'username': username}, {'$set': update_data}) client.close() return result.matched_count > 0 @@ -385,7 +385,7 @@ def get_favorites(username): client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) db = _get_tenant_db(client) users = db['users'] - user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) + user = users.find_one({'Username': username}) or users.find_one({'username': username}) client.close() if not user: return [] @@ -400,7 +400,7 @@ def add_favorite(username, item_id): db = _get_tenant_db(client) users = db['users'] users.update_one( - {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]}, + {'$or': [{'Username': username}, {'username': username}]}, {'$addToSet': {'favorites': ObjectId(item_id)}} ) client.close() @@ -415,7 +415,7 @@ def remove_favorite(username, item_id): db = _get_tenant_db(client) users = db['users'] users.update_one( - {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]}, + {'$or': [{'Username': username}, {'username': username}]}, {'$pull': {'favorites': ObjectId(item_id)}} ) client.close() @@ -497,7 +497,7 @@ def check_nm_pwd(username, password): db = client[db_name] users = db['users'] - query = {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]} + query = {'$or': [{'Username': username}, {'username': username}]} user_record = users.find_one(query) if user_record is None: @@ -508,8 +508,6 @@ def check_nm_pwd(username, password): default_users = client[cfg.MONGODB_DB]['users'] user_record_fallback = default_users.find_one( {'$or': [ - {'Username': dp.encrypt_text(username)}, - {'username': dp.encrypt_text(username)}, {'Username': username}, {'username': username}, ]} @@ -712,9 +710,9 @@ def make_admin(username): client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) db = _get_tenant_db(client) users = db['users'] - result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': True}}) + result = users.update_one({'Username': username}, {'$set': {'Admin': True}}) if result.matched_count == 0: - result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': True}}) + result = users.update_one({'username': username}, {'$set': {'Admin': True}}) client.close() return result.matched_count > 0 @@ -724,9 +722,9 @@ def remove_admin(username): client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) db = _get_tenant_db(client) users = db['users'] - result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': False}}) + result = users.update_one({'Username': username}, {'$set': {'Admin': False}}) if result.matched_count == 0: - result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': False}}) + result = users.update_one({'username': username}, {'$set': {'Admin': False}}) client.close() return result.matched_count > 0 @@ -738,7 +736,7 @@ def get_user(username): def find_in_db(database_name): db = client[database_name] users = db['users'] - return users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'username': username}) or users.find_one({'Username': username}) + return users.find_one({'Username': username}) or users.find_one({'username': username}) or users.find_one({'username': username}) or users.find_one({'Username': username}) tenant_db, tenant_id = _resolve_request_tenant_db() if tenant_db: @@ -774,12 +772,12 @@ def update_active_ausleihung(username, id_item, ausleihung): users = db['users'] result = users.update_one( - {'Username': dp.encrypt_text(username)}, + {'Username': username}, {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}} ) if result.matched_count == 0: users.update_one( - {'username': dp.encrypt_text(username)}, + {'username': username}, {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}} ) client.close() @@ -792,7 +790,7 @@ def get_active_ausleihung(username): db = _get_tenant_db(client) users = db['users'] - user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) + user = users.find_one({'Username': username}) or users.find_one({'username': username}) client.close() if not user: @@ -807,7 +805,7 @@ def has_active_borrowing(username): db = _get_tenant_db(client) users = db['users'] - user = users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'Username': dp.encrypt_text(username)}) + user = users.find_one({'username': username}) or users.find_one({'Username': username}) client.close() if not user: @@ -824,9 +822,9 @@ def delete_user(username): db = _get_tenant_db(client) users = db['users'] - result = users.delete_one({'username': dp.encrypt_text(username)}) + result = users.delete_one({'username': username}) if result.deleted_count == 0: - result = users.delete_one({'Username': dp.encrypt_text(username)}) + result = users.delete_one({'Username': username}) client.close() return result.deleted_count > 0 @@ -841,9 +839,9 @@ def update_active_borrowing(username, item_id, status): update_data = {'$set': {'active_borrowing': status, 'borrowed_item': item_id if status else None}} - result = users.update_one({'username': dp.encrypt_text(username)}, update_data) + result = users.update_one({'username': username}, update_data) if result.matched_count == 0: - result = users.update_one({'Username': dp.encrypt_text(username)}, update_data) + result = users.update_one({'Username': username}, update_data) client.close() return result.modified_count > 0 @@ -857,7 +855,7 @@ def get_name(username): db = _get_tenant_db(client) users = db['users'] - user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) + user = users.find_one({'Username': username}) or users.find_one({'username': username}) client.close() if not user or not user.get("name"): @@ -872,7 +870,7 @@ def get_last_name(username): db = _get_tenant_db(client) users = db['users'] - user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) + user = users.find_one({'Username': username}) or users.find_one({'username': username}) client.close() if not user or not user.get("last_name"): @@ -907,12 +905,12 @@ def update_password(username, new_password): hashed_password = hashing(new_password) result = users.update_one( - {'Username': dp.encrypt_text(username)}, + {'Username': username}, {'$set': {'Password': hashed_password}} ) if result.matched_count == 0: result = users.update_one( - {'username': dp.encrypt_text(username)}, + {'username': username}, {'$set': {'Password': hashed_password}} ) @@ -934,12 +932,12 @@ def update_user_name(username, name, last_name): safe_last_name = dp.encrypt_text(last_name.strip()) if last_name else '' result = users.update_one( - {'Username': dp.encrypt_text(username)}, + {'Username': username}, {'$set': {'name': safe_name, 'last_name': safe_last_name}} ) if result.matched_count == 0: result = users.update_one( - {'username': dp.encrypt_text(username)}, + {'username': username}, {'$set': {'name': safe_name, 'last_name': safe_last_name}} ) From 21ad639081facbb525b72cef616ab3c8b947d3fb Mon Sep 17 00:00:00 2001 From: Aiirondev Date: Fri, 14 Aug 2026 20:20:59 +0200 Subject: [PATCH 7/7] changes to make the default redirect endpoint in chase of page authentication error --- Web/app.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Web/app.py b/Web/app.py index c781e76..48b4a5d 100755 --- a/Web/app.py +++ b/Web/app.py @@ -825,9 +825,8 @@ def _action_access_allowed(permissions, action_key): def _permission_denied_fallback_endpoint(permissions, current_endpoint=None): username = session.get('username') - is_admin_user = bool(username and us.check_admin(username)) - for candidate in ('my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum', 'home_admin'): + for candidate in ('home_admin', 'my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum'): if current_endpoint and candidate == current_endpoint: continue if _page_access_allowed(permissions, candidate):