change to the CRFS

Web/app.py

@@ -18,7 +18,6 @@ Features:
 """
 
 from flask import Flask, render_template, request, redirect, url_for, session, flash, send_from_directory, get_flashed_messages, jsonify, Response, make_response, send_file, abort
-from flask_wtf.csrf import CSRFProtect
 from werkzeug.utils import secure_filename
 from werkzeug.middleware.proxy_fix import ProxyFix
 from werkzeug.exceptions import HTTPException
@@ -116,7 +115,6 @@ app.config['PREFERRED_URL_SCHEME'] = 'https' if app.config['SESSION_COOKIE_SECUR
 # app.config['QR_CODE_FOLDER'] = cfg.QR_CODE_FOLDER  # QR Code storage deactivated
 app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_port=1)
 app.register_blueprint(terminplaner_bp, url_prefix='/terminplaner')
-csrf = CSRFProtect(app)
 
 """--------------------------------------------------------------Path Init-------------------------------------------------------"""
 
@@ -7905,66 +7903,69 @@ def terminplan():
 @app.route('/register', methods=['GET', 'POST'])
 def register():
     """
-    User registration route.false
+    User registration route.
     Returns:
         flask.Response: Rendered template or redirect
     """
     if 'username' not in session:
-        flash('Ihnen ist es nicht gestattet auf dieser Internetanwendung, die eben besuchte Adrrese zu nutzen, versuchen sie es erneut nach dem sie sich mit einem berechtigten Nutzer angemeldet haben!', 'error')
+        flash('Ihnen ist es nicht gestattet auf dieser Internetanwendung, die eben besuchte Adresse zu nutzen, versuchen Sie es erneut, nachdem Sie sich mit einem berechtigten Nutzer angemeldet haben!', 'error')
         return redirect(url_for('login'))
-    if 'username' in session:
+        
-        if request.method == 'POST':
+    if request.method == 'POST':
-            password = request.form['password']
+        password = request.form.get('password', '')
-            name = (request.form.get('name') or '').strip()
+        name = (request.form.get('name') or '').strip()
-            last_name = (request.form.get('last-name') or '').strip()
+        last_name = (request.form.get('last-name') or '').strip()
 
-            # Generate a username from the first 3 letters of first and last name.
+        username = us.build_unique_username_from_name(name, last_name)
-            username = us.build_unique_username_from_name(name, last_name)
+        
+        permission_preset = (request.form.get('permission_preset') or 'standard_user').strip()
+        use_custom_permissions = request.form.get('use_custom_permissions') == 'on'
+        
+        if not username or not password or not name or not last_name:
+            flash('Bitte füllen Sie alle Felder aus', 'error')
+            return redirect(url_for('register'))
             
-            permission_preset = (request.form.get('permission_preset') or 'standard_user').strip()
+        if not us.check_password_strength(password):
-            use_custom_permissions = request.form.get('use_custom_permissions') == 'on'
+            flash('Passwort ist zu schwach oder entspricht nicht den Richtlinien', 'error')
+            return redirect(url_for('register'))
+
+        action_permissions = None
+        page_permissions = None
+        if use_custom_permissions:
+            action_permissions = {}
+            for action_key, _ in PERMISSION_ACTION_OPTIONS:
+                action_permissions[action_key] = request.form.get(f'action_{action_key}') == 'on'
+
+            page_permissions = {}
+            for endpoint_name, _ in PERMISSION_PAGE_OPTIONS:
+                page_permissions[endpoint_name] = request.form.get(f'page_{endpoint_name}') == 'on'
             
-            if not username or not password or not name or not last_name:
+        us.add_user(
-                flash('Bitte füllen Sie alle Felder aus', 'error')
+            username,
-                return redirect(url_for('register'))
+            password,
-            if not us.check_password_strength(password):
+            name,
-                flash('Passwort ist zu schwach', 'error')
+            last_name,
-                return redirect(url_for('register'))
+            is_student=False,
-
+            student_card_id=None,
-            action_permissions = None
+            max_borrow_days=None,
-            page_permissions = None
+            permission_preset=permission_preset,
-            if use_custom_permissions:
+            action_permissions=action_permissions,
-                action_permissions = {}
+            page_permissions=page_permissions,
-                for action_key, _ in PERMISSION_ACTION_OPTIONS:
-                    action_permissions[action_key] = request.form.get(f'action_{action_key}') == 'on'
-
-                page_permissions = {}
-                for endpoint_name, _ in PERMISSION_PAGE_OPTIONS:
-                    page_permissions[endpoint_name] = request.form.get(f'page_{endpoint_name}') == 'on'
-                
-            us.add_user(
-                username,
-                password,
-                name,
-                last_name,
-                is_student=False,
-                student_card_id=None,
-                max_borrow_days=None,
-                permission_preset=permission_preset,
-                action_permissions=action_permissions,
-                page_permissions=page_permissions,
-            )
-            return redirect(url_for('home_admin'))
-        return render_template(
-            'register.html',
-            library_module_enabled=cfg.MODULES.is_enabled('library'),
-            student_cards_module_enabled=cfg.MODULES.is_enabled('student_cards'),
-            student_default_borrow_days=cfg.STUDENT_DEFAULT_BORROW_DAYS,
-            student_max_borrow_days=cfg.STUDENT_MAX_BORROW_DAYS
         )
-    flash('Sie sind nicht berechtigt, diese Seite anzuzeigen', 'error')
+        
-    return redirect(url_for('login'))
+        flash(f'Benutzer "{username}" wurde erfolgreich registriert!', 'success')
+        return redirect(url_for('home_admin'))
 
+    return render_template(
+        'register.html',
+        library_module_enabled=cfg.MODULES.is_enabled('library'),
+        student_cards_module_enabled=cfg.MODULES.is_enabled('student_cards'),
+        student_default_borrow_days=cfg.STUDENT_DEFAULT_BORROW_DAYS,
+        student_max_borrow_days=cfg.STUDENT_MAX_BORROW_DAYS,
+        permission_presets=getattr(us, 'PERMISSION_PRESETS', {}),
+        permission_action_options=PERMISSION_ACTION_OPTIONS,
+        permission_page_options=PERMISSION_PAGE_OPTIONS
+    )
 
 @app.route('/user_del', methods=['GET'])
 def user_del():

Web/requirements.txt

@@ -1,4 +1,5 @@
 flask
+flask-wtf
 werkzeug
 gunicorn
 pymongo

Web/templates/register.html

@@ -25,9 +25,6 @@
     <div class="content">
         <div class="form-card">
             <form method="POST" action="{{ url_for('register') }}">
-                
-                <!-- CSRF-Schutz (Zwingend erforderlich für POST) -->
-                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
 
                 <div class="form-group">
                     <label for="name">Vorname</label>

requirements.txt

@@ -1,4 +1,5 @@
 flask
+flask-wtf
 werkzeug
 gunicorn
 pymongo==4.6.3