changes to the register process to make it more streamlined

Web/app.py

@@ -18,6 +18,7 @@ Features:
 """
 
 from flask import Flask, render_template, request, redirect, url_for, session, flash, send_from_directory, get_flashed_messages, jsonify, Response, make_response, send_file, abort
+from flask_wtf.csrf import CSRFProtect
 from werkzeug.utils import secure_filename
 from werkzeug.middleware.proxy_fix import ProxyFix
 from werkzeug.exceptions import HTTPException
@@ -115,6 +116,7 @@ app.config['PREFERRED_URL_SCHEME'] = 'https' if app.config['SESSION_COOKIE_SECUR
 # app.config['QR_CODE_FOLDER'] = cfg.QR_CODE_FOLDER  # QR Code storage deactivated
 app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_port=1)
 app.register_blueprint(terminplaner_bp, url_prefix='/terminplaner')
+csrf = CSRFProtect(app)
 
 """--------------------------------------------------------------Path Init-------------------------------------------------------"""
 
@@ -1984,7 +1986,7 @@ def _upload_student_cards_excel():
 
     if not current_permissions['actions'].get('can_manage_user', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
 
     if not cfg.MODULES.is_enabled('student_cards'):
         flash('Schülerausweis-Modul ist deaktiviert.', 'error')
@@ -3653,7 +3655,7 @@ def api_library_item_update(item_id):
     
     if not current_permissions['actions'].get('can_edit', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
     if not cfg.MODULES.is_enabled('library'):
         return jsonify({'ok': False, 'message': 'Bibliotheks-Modul ist deaktiviert.'}), 403
 
@@ -3886,7 +3888,7 @@ def student_cards_admin():
     
     if not current_permissions['actions'].get('can_manage_users', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
     if not cfg.MODULES.is_enabled('student_cards'):
         flash('Schülerausweis-Modul ist deaktiviert.', 'error')
         return redirect(url_for('home_admin'))
@@ -4031,7 +4033,7 @@ def student_cards_print():
         
     if not current_permissions['actions'].get('can_manage_users', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
     if not cfg.MODULES.is_enabled('student_cards'):
         flash('Schülerausweis-Modul ist deaktiviert.', 'error')
         return redirect(url_for('home_admin'))
@@ -4065,7 +4067,7 @@ def student_card_barcode_print():
         
     if not current_permissions['actions'].get('can_manage_users', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
     if not cfg.MODULES.is_enabled('student_cards'):
         flash('Schülerausweis-Modul ist deaktiviert.', 'error')
         return redirect(url_for('home_admin'))
@@ -4098,7 +4100,7 @@ def student_card_barcode_download():
         
     if not current_permissions['actions'].get('can_manage_users', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
     if not cfg.MODULES.is_enabled('student_cards'):
         flash('Schülerausweis-Modul ist deaktiviert.', 'error')
         return redirect(url_for('home_admin'))
@@ -4282,7 +4284,7 @@ def student_card_single_barcode_download(card_id):
         
     if not current_permissions['actions'].get('can_manage_users', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
     if not cfg.MODULES.is_enabled('student_cards'):
         flash('Schülerausweis-Modul ist deaktiviert.', 'error')
         return redirect(url_for('home_admin'))
@@ -6366,7 +6368,7 @@ def delete_item(id):
     
     if not cfg.MODULES.is_enabled('inventory'):
         flash('Bibliotheks-Modul ist deaktiviert.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
     
     # Resolve all related item ids (grouped variants) and load their data
     group_item_ids = it.get_group_item_ids(id)
@@ -6504,7 +6506,7 @@ def bulk_delete_items():
     
     if not cfg.MODULES.is_enabled('inventory'):
         flash('Bibliotheks-Modul ist deaktiviert.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
 
     payload = request.get_json(silent=True) or {}
     item_ids = payload.get('item_ids') or request.form.getlist('item_ids')
@@ -6569,7 +6571,7 @@ def edit_item(id):
     
     if not cfg.MODULES.is_enabled('inventory'):
         flash('Bibliotheks-Modul ist deaktiviert.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
     
     # Strip whitespace from all text fields
     name = sanitize_form_value(request.form.get('name'))
@@ -6699,7 +6701,7 @@ def update_group():
 
     if not current_permissions['actions'].get('can_edit', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion (Löschen) auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
     
     data = request.get_json()
     series_group_id = data.get('series_group_id')
@@ -7047,9 +7049,10 @@ def ausleihen(id):
         if current_permissions['actions'].get('can_borrow') and not is_library_item:
             if student_card_id:
                 student_user = us.get_user_by_student_card(student_card_id)
+                app.logger.debug(f"Borrowing on behalf of student card {student_card_id}: found user {student_user}")
                 if not student_user:
                     flash('Keine Schülerin/kein Schüler mit dieser Ausweis-ID gefunden.', 'error')
-                    return redirect(url_for('library'))
+                    return redirect(url_for('library_view'))
                 effective_borrower = student_user.get('Username') or student_user.get('username') or username
                 if borrow_duration_days is None:
                     try:
@@ -7915,7 +7918,7 @@ def register():
             name = (request.form.get('name') or '').strip()
             last_name = (request.form.get('last-name') or '').strip()
 
-            # Generate a username from the first 2 letters of first and last name.
+            # Generate a username from the first 3 letters of first and last name.
             username = us.build_unique_username_from_name(name, last_name)
             
             permission_preset = (request.form.get('permission_preset') or 'standard_user').strip()
@@ -9086,7 +9089,7 @@ def library_item_invoices(item_id):
                 
     if not current_permissions['pages'].get('library_loans_admin', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
 
     client = None
     try:
@@ -9993,7 +9996,7 @@ def fetch_book_info(isbn):
             
     if not current_permissions['actions'].get('can_insert', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
 
     if not cfg.MODULES.is_enabled('library'):
         return jsonify({"error": "Bibliotheks-Modul ist deaktiviert."}), 403
@@ -10044,7 +10047,7 @@ def download_book_cover():
             
     if not current_permissions['actions'].get('can_insert', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('library'))
+        return redirect(url_for('library_view'))
     if not cfg.MODULES.is_enabled('library'):
         return jsonify({"error": "Bibliotheks-Modul ist deaktiviert."}), 403
     

Web/modules/database/user.py

@@ -97,18 +97,18 @@ def build_name_synonym(first_name, last_name=''):
     last = _clean_name_fragment(last_name)
 
     if first and last:
-        return (first[:2] + last[:2]).title()
+        return (first[:3] + last[:3]).title()
 
     combined = (first + last)
     if not combined:
         return 'User'
-    return combined[:4].title()
+    return combined[:6].title()
 
 
 def build_username_from_name(first_name, last_name=''):
     """
     Build a deterministic username abbreviation from first and last name.
-    Uses 2 letters from each name and stores it lowercase.
+    Uses 3 letters from each name and stores it lowercase.
     
     Args:
         first_name (str): First name
@@ -123,12 +123,12 @@ def build_username_from_name(first_name, last_name=''):
 
 def build_unique_username_from_name(first_name, last_name=''):
     """
-    Build a unique username from the first 2 letters of the first name and
-    the first 2 letters of the last name.
+    Build a unique username from the first 3 letters of the first name and
+    the first 3 letters of the last name.
     """
     first = _clean_name_fragment(first_name)
     last = _clean_name_fragment(last_name)
-    base_username = (first[:2] + last[:2]).lower()
+    base_username = (first[:3] + last[:3]).lower()
 
     if not base_username:
         base_username = 'user'
@@ -594,8 +594,8 @@ def student_card_exists(student_card_id):
         return False
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
-    users = db['users']
-    exists = users.find_one({'StudentCardId': normalized}) is not None
+    users = db['student_cards']
+    exists = users.find_one({'SchülerName': normalized}) is not None
     client.close()
     return exists
 
@@ -607,8 +607,8 @@ def get_user_by_student_card(student_card_id):
         return None
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
-    users = db['users']
-    found_user = users.find_one({'StudentCardId': normalized})
+    users = db['student_cards']
+    found_user = users.find_one({'SchülerName': normalized})
     client.close()
     return found_user
 

Web/templates/register.html

@@ -1,11 +1,3 @@
-<!--
-   Copyright 2025-2026 AIIrondev
-
-   Licensed under the Inventarsystem EULA (Endbenutzer-Lizenzvertrag).
-   See Legal/LICENSE for the full license text.
-   Unauthorized commercial use, SaaS hosting, or removal of branding is prohibited.
-   For commercial licensing inquiries: https://github.com/AIIrondev
--->
 {% extends "base.html" %}
 
 {% block title %}Register{% endblock %}
@@ -33,6 +25,10 @@
     <div class="content">
         <div class="form-card">
             <form method="POST" action="{{ url_for('register') }}">
+                
+                <!-- CSRF-Schutz (Zwingend erforderlich für POST) -->
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+
                 <div class="form-group">
                     <label for="name">Vorname</label>
                     <div class="input-container">
@@ -44,7 +40,7 @@
                         <span class="input-icon">👤</span>
                         <input type="text" id="last-name" name="last-name" placeholder="Geben Sie den Nachnamen ein" required onchange="generateUsername()" oninput="generateUsername()">
                     </div>
-                    <label for="username">Benutzername <span style="color: #9ca3af;">(wird automatisch generiert)</span></label>
+                    <label for="username">Benutzername <span style="color: #9ca3af;">(Vorschau - wird serverseitig finalisiert)</span></label>
                     <div class="input-container">
                         <span class="input-icon">👤</span>
                         <input type="text" id="username" name="username" placeholder="Automatisch aus Name und Nachname" readonly style="background-color: #f3f4f6; cursor: not-allowed;">
@@ -64,9 +60,22 @@
                             <li id="pw-rule-symbol" class="pw-rule">Mindestens ein Sonderzeichen</li>
                         </ul>
                     </div>
-                    <div class="input-container">
-                        <span class="input-icon">🔒</span>
-                        <input type="password" id="password" name="password" placeholder="Geben Sie ein sicheres Passwort ein" required>
+                    
+                    <div class="input-wrapper">
+                        <div class="input-container">
+                            <span class="input-icon">🔒</span>
+                            <!-- HTML5 Pattern blockiert unsichere Passwörter vor dem Absenden -->
+                            <input type="password" 
+                                   id="password" 
+                                   name="password" 
+                                   placeholder="Geben Sie ein sicheres Passwort ein" 
+                                   required
+                                   pattern="(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[^a-zA-Z0-9]).{12,}">
+                        </div>
+                        <button type="button" class="btn-secondary" id="toggle-pw-btn" onclick="togglePasswordVisibility()" title="Passwort anzeigen/verbergen">👁️</button>
+                    </div>
+                    <div class="pw-actions">
+                        <button type="button" class="btn-secondary" onclick="generateSecurePassword()">🎲 Automatisches Passwort generieren</button>
                     </div>
                 </div>
 
@@ -258,31 +267,6 @@ input::placeholder {
     background-color: #27ae60;
 }
 
-.navigation-buttons {
-    text-align: center;
-    margin: 1.5rem 0;
-}
-
-.back-button {
-    display: inline-flex;
-    align-items: center;
-    color: var(--primary-color);
-    text-decoration: none;
-    font-weight: 500;
-    transition: var(--transition);
-    padding: 0.5rem 1rem;
-    border-radius: var(--border-radius);
-}
-
-.back-button:hover {
-    background-color: rgba(52, 152, 219, 0.1);
-}
-
-.back-icon {
-    margin-right: 0.5rem;
-    font-size: 1.2rem;
-}
-
 .flash-container {
     margin-bottom: 1.5rem;
 }
@@ -422,49 +406,147 @@ input::placeholder {
     margin: 4px 0;
     color: #1f2937;
 }
+
+/* Neue Styles für die Passwort-Erweiterungen */
+.pw-actions {
+    display: flex;
+    gap: 8px;
+    margin-top: 8px;
+}
+
+.btn-secondary {
+    padding: 8px 12px;
+    border: 1px solid #d1d5db;
+    background-color: #f3f4f6;
+    border-radius: 4px;
+    cursor: pointer;
+    font-size: 0.9em;
+    transition: background-color 0.2s;
+}
+
+.btn-secondary:hover {
+    background-color: #e5e7eb;
+}
+
+.input-wrapper {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    width: 100%;
+}
+
+.input-wrapper .input-container {
+    flex-grow: 1;
+    margin: 0;
+}
 </style>
 
 <script>
-// Function to generate username from first and last name (helper function)
+// Hilfsfunktion: Umlaute auflösen und Sonderzeichen entfernen
 function cleanNameForUsername(text) {
     if (!text) return '';
-    // Remove special characters, convert umlauts, lowercase
-    let cleaned = text
-        .replace(/[^a-zA-Zäöüß\s-]/g, '')
-        .trim()
-        .toLowerCase();
-    
-    // Convert German umlauts to ASCII
-    cleaned = cleaned
+    let cleaned = text.trim().toLowerCase()
         .replace(/ä/g, 'ae')
         .replace(/ö/g, 'oe')
         .replace(/ü/g, 'ue')
-        .replace(/ß/g, 'ss');
-    
+        .replace(/ß/g, 'ss')
+        .replace(/[^a-z]/g, '');
     return cleaned;
 }
 
-// Generate username from name and last_name fields
+// Hilfsfunktion: Erster Buchstabe groß
+function formatPart(str, len) {
+    if (!str) return '';
+    const part = str.slice(0, len);
+    return part.charAt(0).toUpperCase() + part.slice(1);
+}
+
+// Generiert die Vorschau des Benutzernamens (z.B. SimFri)
 function generateUsername() {
-    const firstName = cleanNameForUsername(document.getElementById('name').value || '');
-    const lastName = cleanNameForUsername(document.getElementById('last-name').value || '');
+    const firstName = cleanNameForUsername(document.getElementById('name').value);
+    const lastName = cleanNameForUsername(document.getElementById('last-name').value);
     let username = '';
     
     if (firstName && lastName) {
-        username = (firstName.slice(0, 3) + lastName.slice(0, 3));
+        username = formatPart(firstName, 3) + formatPart(lastName, 3);
     } else if (firstName) {
-        username = firstName.slice(0, 6);
+        username = formatPart(firstName, 6);
     } else if (lastName) {
-        username = lastName.slice(0, 6);
+        username = formatPart(lastName, 6);
     }
     
-    // Set the username field
     const usernameField = document.getElementById('username');
     if (usernameField) {
         usernameField.value = username || '';
     }
 }
 
+// PASSWORT GENERATOR
+function generateSecurePassword() {
+    const length = 16;
+    const charsetLower = "abcdefghijklmnopqrstuvwxyz";
+    const charsetUpper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+    const charsetNum = "0123456789";
+    const charsetSym = "!@#$%^&*()_+~|}{[]:;?><,.-=";
+
+    let password = "";
+    // Garantiert mindestens 1 Zeichen aus jeder Kategorie
+    password += charsetLower[Math.floor(Math.random() * charsetLower.length)];
+    password += charsetUpper[Math.floor(Math.random() * charsetUpper.length)];
+    password += charsetNum[Math.floor(Math.random() * charsetNum.length)];
+    password += charsetSym[Math.floor(Math.random() * charsetSym.length)];
+
+    const allChars = charsetLower + charsetUpper + charsetNum + charsetSym;
+    // Restliche Zeichen auffüllen
+    for (let i = 4; i < length; i++) {
+        password += allChars[Math.floor(Math.random() * allChars.length)];
+    }
+
+    // Passwort durchmischen
+    password = password.split('').sort(() => 0.5 - Math.random()).join('');
+
+    const pwField = document.getElementById('password');
+    pwField.value = password;
+    
+    // Automatisch sichtbar machen, damit der User es kopieren kann
+    pwField.type = 'text';
+    document.getElementById('toggle-pw-btn').textContent = '🙈';
+    
+    updatePasswordRules();
+}
+
+// PASSWORT SICHTBARKEIT UMSCHALTEN
+function togglePasswordVisibility() {
+    const pwField = document.getElementById('password');
+    const toggleBtn = document.getElementById('toggle-pw-btn');
+    if (pwField.type === "password") {
+        pwField.type = "text";
+        toggleBtn.textContent = '🙈';
+    } else {
+        pwField.type = "password";
+        toggleBtn.textContent = '👁️';
+    }
+}
+
+// Globale Funktion für Passwort-Update
+function updatePasswordRules() {
+    const passwordInput = document.getElementById('password');
+    if (!passwordInput) return;
+
+    const value = String(passwordInput.value || '');
+    
+    const setRuleState = (id, ok) => {
+        const node = document.getElementById(id);
+        if (node) node.classList.toggle('ok', !!ok);
+    };
+
+    setRuleState('pw-rule-length', value.length >= 12);
+    setRuleState('pw-rule-lower', /[a-z]/.test(value));
+    setRuleState('pw-rule-upper', /[A-Z]/.test(value));
+    setRuleState('pw-rule-digit', /[0-9]/.test(value));
+    setRuleState('pw-rule-symbol', /[^A-Za-z0-9]/.test(value));
+}
+
 document.addEventListener('DOMContentLoaded', function () {
     const permissionPresets = {{ permission_presets | tojson }};
     const presetSelect = document.getElementById('permission-preset');
@@ -507,34 +589,6 @@ document.addEventListener('DOMContentLoaded', function () {
     }
 
     const passwordInput = document.getElementById('password');
-    const passwordRules = {
-        length: document.getElementById('pw-rule-length'),
-        lower: document.getElementById('pw-rule-lower'),
-        upper: document.getElementById('pw-rule-upper'),
-        digit: document.getElementById('pw-rule-digit'),
-        symbol: document.getElementById('pw-rule-symbol')
-    };
-
-    function setRuleState(node, ok) {
-        if (!node) {
-            return;
-        }
-        node.classList.toggle('ok', !!ok);
-    }
-
-    function updatePasswordRules() {
-        if (!passwordInput) {
-            return;
-        }
-
-        const value = String(passwordInput.value || '');
-        setRuleState(passwordRules.length, value.length >= 12);
-        setRuleState(passwordRules.lower, /[a-z]/.test(value));
-        setRuleState(passwordRules.upper, /[A-Z]/.test(value));
-        setRuleState(passwordRules.digit, /[0-9]/.test(value));
-        setRuleState(passwordRules.symbol, /[^A-Za-z0-9]/.test(value));
-    }
-
     if (passwordInput) {
         passwordInput.addEventListener('input', updatePasswordRules);
         passwordInput.addEventListener('blur', updatePasswordRules);