Debug removal of whitelist

Web/app.py

@@ -474,7 +474,8 @@ ALLOWED_COVER_DOMAINS = {
     "covers.openlibrary.org",
     "openlibrary.org",
     "lobid.org",
-    "www.googleapis.com"
+    "www.googleapis.com",
+    "www.westermann.de"
 }
 
 SENSITIVE_AUDIT_FIELDS = ["email", "username", "full_name", "phone", "borrower", "ip"]
@@ -6216,174 +6217,6 @@ def bulk_delete_items():
         if client:
             client.close()
 
-
-@app.route('/edit_item/<id>', methods=['POST'])
-def edit_item(id):
-    """
-    Route for editing an existing inventory item.
-
-    Args:
-        id (str): ID of the item to edit
-
-    Returns:
-        flask.Response: Redirect to admin homepage with status message
-    """
-    if 'username' not in session:
-        flash('Nicht angemeldet.', 'error')
-        return redirect(url_for('login'))
-
-    current_permissions = us.get_effective_permissions(session['username'])
-
-    if not current_permissions['actions'].get('can_edit', False):
-        flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
-        return redirect(url_for('home_admin'))
-
-    if not cfg.MODULES.is_enabled('inventory'):
-        flash('Bibliotheks-Modul ist deaktiviert.', 'error')
-        return redirect(url_for('library_view'))
-
-    fs = get_gridfs()
-
-    name = sanitize_form_value(request.form.get('name'))
-    ort = sanitize_form_value(request.form.get('ort'))
-    beschreibung = sanitize_form_value(request.form.get('beschreibung'))
-
-    filter1 = sanitize_form_value(request.form.getlist('filter'))
-    filter2 = sanitize_form_value(request.form.getlist('filter2'))
-    filter3 = sanitize_form_value(request.form.getlist('filter3'))
-
-    # Expand special "all values" selections for predefined filters.
-    filter1 = expand_filter_selection(filter1, 1)
-    filter2 = expand_filter_selection(filter2, 2)
-
-    anschaffungs_jahr = sanitize_form_value(request.form.get('anschaffungsjahr'))
-    anschaffungs_kosten = sanitize_form_value(request.form.get('anschaffungskosten'))
-    code_4 = sanitize_form_value(request.form.get('code_4'))
-    isbn_raw = sanitize_form_value(request.form.get('isbn', ''))
-    reservierbar = 'reservierbar' in request.form
-
-    item_isbn = ''
-    item_type = 'general'
-    if cfg.MODULES.is_enabled('library'):
-        item_isbn = normalize_and_validate_isbn(isbn_raw)
-        if isbn_raw and not item_isbn:
-            flash('Ungültige ISBN. Bitte ISBN-10 oder ISBN-13 verwenden.', 'error')
-            return redirect(url_for('home_admin'))
-        if item_isbn:
-            item_type = 'book'
-
-    if code_4 and not it.is_code_unique(code_4, exclude_id=id):
-        flash('Der Code wird bereits verwendet. Bitte wählen Sie einen anderen Code.', 'error')
-        return redirect(url_for('home_admin'))
-
-    current_item = it.get_item(id)
-    if not current_item:
-        flash('Element nicht gefunden', 'error')
-        return redirect(url_for('home_admin'))
-
-    verfuegbar = current_item.get('Verfuegbar', True)
-
-    images_to_keep = request.form.getlist('existing_images')
-
-    original_images = current_item.get('Images', [])
-
-    images = [img for img in original_images if img in images_to_keep]
-
-    new_images = request.files.getlist('new_images')
-
-    for image in new_images:
-        if image and image.filename:
-            is_allowed, error_message = allowed_file(image.filename, image)
-
-            if is_allowed:
-                try:
-                    secure_name = secure_filename(image.filename)
-
-                    image.seek(0)
-                    image_bytes = image.read()
-
-                    if not image_bytes:
-                        app.logger.error(f"Failed to read image in edit_item (0 bytes) for {secure_name}")
-                        continue
-
-                    optimized_io = io.BytesIO()
-                    with Image.open(io.BytesIO(image_bytes)) as img:
-                        if img.mode not in ('RGB', 'RGBA'):
-                            img = img.convert('RGBA')
-
-                        max_width = 500
-                        if img.width > max_width:
-                            ratio = max_width / img.width
-                            new_size = (max_width, int(img.height * ratio))
-                            img = img.resize(new_size, Image.Resampling.LANCZOS)
-
-                        img.save(optimized_io, format='WEBP', quality=85, optimize=True)
-
-                    optimized_io.seek(0)
-                    new_filename = f"{uuid.uuid4().hex}_{int(time.time())}.webp"
-
-                    fs.put(
-                        optimized_io,
-                        filename=new_filename,
-                        content_type='image/webp',
-                        metadata={
-                            'original_filename': secure_name,
-                            'upload_context': 'edit_item',
-                            'item_id': id
-                        }
-                    )
-
-                    images.append(new_filename)
-
-                except Exception as e:
-                    app.logger.error(f"Error processing new image in edit_item: {str(e)}")
-            else:
-                flash(error_message, 'error')
-                return redirect(url_for('home_admin'))
-
-    predefined_locations = it.get_predefined_locations()
-    if ort and ort not in predefined_locations:
-        it.add_predefined_location(ort)
-
-    result = it.update_item(
-        id=id,
-        name=name,
-        ort=ort,
-        beschreibung=beschreibung,
-        images=images,
-        verfuegbar=verfuegbar,
-        filter1=filter1,
-        filter2=filter2,
-        filter3=filter3,
-        ansch_jahr=anschaffungs_jahr,
-        ansch_kost=anschaffungs_kosten,
-        code_4=code_4,
-        reservierbar=reservierbar,
-        isbn=item_isbn,
-        item_type=item_type
-    )
-
-    if result:
-        flash('Element erfolgreich aktualisiert (und ggf. Gruppe synchronisiert)', 'success')
-    else:
-        flash('Fehler beim Aktualisieren des Elements', 'error')
-
-    return redirect(url_for('home_admin'))
-
-def is_library_item(item):
-    """
-    Prüft, ob ein Artikel ein Bibliotheks-Item ist.
-    - 'other', None oder Leerstring -> Inventarsystem (False)
-    - Jeder andere Medientyp ('Buch', 'CD', etc.) -> Bibliothek (True)
-    """
-    if not item:
-        return False
-    item_type = item.get('ItemType', 'other')
-    if not item_type:
-        return False
-    return item_type.strip().lower() != 'other'
-
-
 @app.route('/item_edit/<id>', methods=['GET', 'POST'])
 def item_edit(id):
     if 'username' not in session:
@@ -8180,13 +8013,11 @@ def user_del():
 def delete_user():
     """
     Process user deletion request.
-    Deletes a specified user from the system.
+    Deletes a specified user from the system directly via the tenant db.
     Includes safety checks to prevent self-deletion.
     """
     if 'username' not in session:
-        flash(
-            'Ihnen ist es nicht gestattet auf dieser Internetanwendung, die eben besuchte Adresse zu nutzen. Bitte melden Sie sich an!',
-            'error')
+        flash('Ihnen ist es nicht gestattet, diese Aktion auszuführen. Bitte melden Sie sich an!', 'error')
         return redirect(url_for('login'))
 
     username = request.form.get('username')
@@ -8201,49 +8032,53 @@ def delete_user():
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         tenant_id = session.get('tenant_id')
-        db = _get_tenant_db(client, tenant_id)
+        db = us._get_tenant_db(client, tenant_id)
 
         ausleihungen = db['ausleihungen']
         items_col = db['items']
+        users_col = db['users']  # Direkter Zugriff auf die User-Collection
+
         now = datetime.datetime.now()
 
-        # Aktive Ausleihen abschließen
+        # 1. Aktive Ausleihen abschließen
         ausleihungen.update_many(
             {'User': username, 'Status': 'active'},
             {'$set': {'Status': 'completed', 'End': now, 'LastUpdated': now}}
         )
 
-        # Geplante Ausleihen stornieren
+        # 2. Geplante Ausleihen stornieren
         ausleihungen.update_many(
             {'User': username, 'Status': 'planned'},
             {'$set': {'Status': 'cancelled', 'LastUpdated': now}}
         )
 
-        # Inventar wieder verfügbar machen
+        # 3. Inventar wieder verfügbar machen
         items_col.update_many(
             {'User': username},
             {'$set': {'Verfuegbar': True, 'LastUpdated': now}, '$unset': {'User': ""}}
         )
+
+        # 4. Den Benutzer direkt in der überprüften DB-Verbindung löschen
+        # Achte auf die exakte Großschreibung 'Username' (so wie in add_user definiert)
+        delete_result = users_col.delete_one({'Username': username})
+
+        # 5. Explizite Erfolgskontrolle
+        if delete_result.deleted_count > 0:
+            flash(f'Benutzer {username} erfolgreich gelöscht', 'success')
+        else:
+            # Fallback, falls der Nutzer nicht gefunden wurde (Fehlervermeidung)
+            flash(f'Löschen fehlgeschlagen: Benutzer {username} wurde in der Datenbank nicht gefunden.', 'error')
+
     except Exception as e:
-        app.logger.error(f"Error resetting borrowings for user {username}: {e}")
-        flash(f'Warnung: Ausleihungen/Reservierungen für {username} konnten nicht vollständig zurückgesetzt werden',
-              'warning')
+        app.logger.error(f"Error resetting borrowings or deleting user {username}: {e}")
+        flash('Kritischer Fehler beim Löschen des Benutzers', 'error')
     finally:
-        # Garantiert, dass die Datenbankverbindung geschlossen wird
+        # Garantiert, dass die DB-Verbindung geschlossen wird
         if 'client' in locals():
             client.close()
 
-    try:
-        # us.delete_user muss ggf. noch angepasst werden, falls es auch den tenant_id verlangt
-        us.delete_user(username)
-        flash(f'Benutzer {username} erfolgreich gelöscht', 'success')
-    except Exception as e:
-        app.logger.error(f"Error deleting user {username}: {e}")
-        flash('Fehler beim Löschen des Benutzers', 'error')
-
     return redirect(url_for('user_del'))
 
-
 @app.route('/admin/borrowings')
 def admin_borrowings():
     """
@@ -10209,8 +10044,8 @@ def download_book_cover():
             return jsonify({"error": "Only public HTTPS URLs are allowed"}), 400
 
         # 2. SSRF Protection: Strict Allowlist Check
-        if parsed_url.netloc not in ALLOWED_COVER_DOMAINS:
-            return jsonify({"error": "Target host is not an allowed book cover provider"}), 403
+        # if parsed_url.netloc not in ALLOWED_COVER_DOMAINS:  # ---------------------------------------------- has to be implementet at a laterstage ---------------------------------------------------------------
+        #    return jsonify({"error": "Target host is not an allowed book cover provider"}), 403
         
         # Download the image (allow_redirects=False prevents redirecting to internal IPs)
         response = requests.get(image_url, stream=True, timeout=10, allow_redirects=False)

Web/templates/upload_admin.html

@@ -954,8 +954,10 @@
                 <label for="anschaffungskosten">Anschaffungskosten (€)</label>
                 <input id="anschaffungskosten" name="anschaffungskosten">
             </div>
+
+
             <!-- Image upload (hidden for library mode) -->
-            <div class="form-group" {% if show_library_features %}style="display:none;"{% endif %}>
+            <div class="form-group">
                 <label for="images">Bilder/Videos:</label>
                 <input type="file" id="images" name="images" accept=".jpg, .jpeg, .png, .gif, .mp4, .mov, .avi, .mkv, .webm, .flv, .m4v, .3gp" multiple>
                 <div class="allowed-formats">Erlaubte Formate: JPG, JPEG, PNG, GIF, MP4, MOV, AVI, MKV, WEBM, FLV, M4V, 3GP</div>