From f2c1dc2ba52f1b678d8dfaae1225740fb33cae53 Mon Sep 17 00:00:00 2001 From: AIIrondev Date: Thu, 23 Apr 2026 23:00:22 +0200 Subject: [PATCH] Implement session validation for active users before request processing Co-authored-by: Copilot --- Web/app.py | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/Web/app.py b/Web/app.py index 05cc339..c065168 100755 --- a/Web/app.py +++ b/Web/app.py @@ -339,6 +339,28 @@ def _enforce_user_permissions(): return None +@app.before_request +def _enforce_active_session_user(): + endpoint = request.endpoint or '' + if endpoint == 'static' or endpoint.startswith('static'): + return None + + username = session.get('username') + if not username: + return None + + user = us.get_user(username) + if user: + return None + + session.clear() + if request.path.startswith('/api/') or request.is_json: + return jsonify({'ok': False, 'message': 'Sitzung ungültig. Bitte erneut anmelden.'}), 401 + + flash('Ihre Sitzung ist nicht mehr gültig. Bitte erneut anmelden.', 'error') + return redirect(url_for('login')) + + def _get_asset_version(): """Return a cache-busting asset version tied to deployment state.""" env_version = os.getenv('INVENTAR_ASSET_VERSION', '').strip()