Final fixes of the user functions to remove the breaking encryption of the username.

Web/app.py

@@ -453,7 +453,7 @@ PERMISSION_ACTION_ENDPOINTS = {
     'admin_reset_user_password': 'can_manage_users',
     'admin_update_user_permissions': 'can_manage_users',
     'admin_anonymize_names': 'can_manage_users',
-    'home_admin': 'can_manage_settings',
+    'home_admin': 'can_borrow',
     'upload_admin': 'can_insert',
     'library_admin': 'can_insert',
     'admin_borrowings': 'can_manage_settings',
@@ -811,6 +811,8 @@ def _page_access_allowed(permissions, endpoint):
     if not permissions or not endpoint:
         return True
     page_permissions = permissions.get('pages', {})
+    if endpoint == "home_admin":
+        return True
     return bool(page_permissions.get(endpoint, True))
 
 
@@ -824,13 +826,10 @@ def _action_access_allowed(permissions, action_key):
 def _permission_denied_fallback_endpoint(permissions, current_endpoint=None):
     username = session.get('username')
     is_admin_user = bool(username and us.check_admin(username))
-    admin_home_allowed = _page_access_allowed(permissions, 'home_admin') and _action_access_allowed(permissions, 'can_manage_settings')
 
     for candidate in ('my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum', 'home_admin'):
         if current_endpoint and candidate == current_endpoint:
             continue
-        if candidate == 'home_admin' and is_admin_user and not admin_home_allowed:
-            continue
         if _page_access_allowed(permissions, candidate):
             return candidate
     return 'logout'
@@ -5555,10 +5554,10 @@ def upload_item():
     app.logger.info(f"Starting image upload session {upload_session_id} - Files: {len(images)}, User: {encrypt_text(username)}")
 
     for index, image in enumerate(images):
-        if upload_mode == 'library':
-            app.logger.info(f"[Upload {upload_session_id}] Skipping manual upload (Library Mode)")
-            skipped_count += 1
-            continue
+        #if upload_mode == 'library':
+        #    app.logger.info(f"[Upload {upload_session_id}] Skipping manual upload (Library Mode)")
+        #    skipped_count += 1
+        #    continue
 
         if not image or not image.filename:
             skipped_count += 1
@@ -8011,7 +8010,7 @@ def user_del():
                 fullname = None
 
             users_list.append({
-                'username': username,  # Username ist plain in DB, kein decrypt_text() notwendig
+                'username': decrypt_text(username),
                 'admin': user.get('Admin', False),
                 'fullname': fullname,
                 'name': name,

Web/modules/database/user.py

@@ -211,6 +211,7 @@ PERMISSION_PRESETS = {
         },
         'pages': {
             'home': True,
+            'home_admin': True,
             'tutorial_page': True,
             'my_borrowed_items': True,
             'notifications_view': True,
@@ -369,10 +370,10 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': update_data})
+    result = users.update_one({'Username': username}, {'$set': update_data})
 
     if result.matched_count == 0:
-        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': update_data})
+        result = users.update_one({'username': username}, {'$set': update_data})
 
     client.close()
     return result.matched_count > 0
@@ -384,7 +385,7 @@ def get_favorites(username):
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    user = users.find_one({'Username': username}) or users.find_one({'username': username})
     client.close()
     if not user:
         return []
@@ -399,7 +400,7 @@ def add_favorite(username, item_id):
         db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
-            {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]},
+            {'$or': [{'Username': username}, {'username': username}]},
             {'$addToSet': {'favorites': ObjectId(item_id)}}
         )
         client.close()
@@ -414,7 +415,7 @@ def remove_favorite(username, item_id):
         db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
-            {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]},
+            {'$or': [{'Username': username}, {'username': username}]},
             {'$pull': {'favorites': ObjectId(item_id)}}
         )
         client.close()
@@ -496,7 +497,7 @@ def check_nm_pwd(username, password):
         db = client[db_name]
         users = db['users']
 
-        query = {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]}
+        query = {'$or': [{'Username': username}, {'username': username}]}
         user_record = users.find_one(query)
 
         if user_record is None:
@@ -507,8 +508,6 @@ def check_nm_pwd(username, password):
                     default_users = client[cfg.MONGODB_DB]['users']
                     user_record_fallback = default_users.find_one(
                         {'$or': [
-                            {'Username': dp.encrypt_text(username)},
-                            {'username': dp.encrypt_text(username)},
                             {'Username': username},
                             {'username': username},
                         ]}
@@ -711,9 +710,9 @@ def make_admin(username):
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': True}})
+    result = users.update_one({'Username': username}, {'$set': {'Admin': True}})
     if result.matched_count == 0:
-        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': True}})
+        result = users.update_one({'username': username}, {'$set': {'Admin': True}})
     client.close()
     return result.matched_count > 0
 
@@ -723,9 +722,9 @@ def remove_admin(username):
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': False}})
+    result = users.update_one({'Username': username}, {'$set': {'Admin': False}})
     if result.matched_count == 0:
-        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': False}})
+        result = users.update_one({'username': username}, {'$set': {'Admin': False}})
     client.close()
     return result.matched_count > 0
 
@@ -737,7 +736,7 @@ def get_user(username):
         def find_in_db(database_name):
             db = client[database_name]
             users = db['users']
-            return users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'username': username}) or users.find_one({'Username': username})
+            return users.find_one({'Username': username}) or users.find_one({'username': username}) or users.find_one({'username': username}) or users.find_one({'Username': username})
 
         tenant_db, tenant_id = _resolve_request_tenant_db()
         if tenant_db:
@@ -773,12 +772,12 @@ def update_active_ausleihung(username, id_item, ausleihung):
     users = db['users']
 
     result = users.update_one(
-        {'Username': dp.encrypt_text(username)},
+        {'Username': username},
         {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}}
     )
     if result.matched_count == 0:
         users.update_one(
-            {'username': dp.encrypt_text(username)},
+            {'username': username},
             {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}}
         )
     client.close()
@@ -791,7 +790,7 @@ def get_active_ausleihung(username):
     db = _get_tenant_db(client)
     users = db['users']
 
-    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    user = users.find_one({'Username': username}) or users.find_one({'username': username})
     client.close()
 
     if not user:
@@ -806,7 +805,7 @@ def has_active_borrowing(username):
         db = _get_tenant_db(client)
         users = db['users']
 
-        user = users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'Username': dp.encrypt_text(username)})
+        user = users.find_one({'username': username}) or users.find_one({'Username': username})
         client.close()
 
         if not user:
@@ -823,9 +822,9 @@ def delete_user(username):
     db = _get_tenant_db(client)
     users = db['users']
 
-    result = users.delete_one({'username': dp.encrypt_text(username)})
+    result = users.delete_one({'username': username})
     if result.deleted_count == 0:
-        result = users.delete_one({'Username': dp.encrypt_text(username)})
+        result = users.delete_one({'Username': username})
 
     client.close()
     return result.deleted_count > 0
@@ -840,9 +839,9 @@ def update_active_borrowing(username, item_id, status):
 
         update_data = {'$set': {'active_borrowing': status, 'borrowed_item': item_id if status else None}}
 
-        result = users.update_one({'username': dp.encrypt_text(username)}, update_data)
+        result = users.update_one({'username': username}, update_data)
         if result.matched_count == 0:
-            result = users.update_one({'Username': dp.encrypt_text(username)}, update_data)
+            result = users.update_one({'Username': username}, update_data)
 
         client.close()
         return result.modified_count > 0
@@ -856,7 +855,7 @@ def get_name(username):
     db = _get_tenant_db(client)
     users = db['users']
 
-    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    user = users.find_one({'Username': username}) or users.find_one({'username': username})
     client.close()
 
     if not user or not user.get("name"):
@@ -871,7 +870,7 @@ def get_last_name(username):
     db = _get_tenant_db(client)
     users = db['users']
 
-    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    user = users.find_one({'Username': username}) or users.find_one({'username': username})
     client.close()
 
     if not user or not user.get("last_name"):
@@ -906,12 +905,12 @@ def update_password(username, new_password):
         hashed_password = hashing(new_password)
 
         result = users.update_one(
-            {'Username': dp.encrypt_text(username)},
+            {'Username': username},
             {'$set': {'Password': hashed_password}}
         )
         if result.matched_count == 0:
             result = users.update_one(
-                {'username': dp.encrypt_text(username)},
+                {'username': username},
                 {'$set': {'Password': hashed_password}}
             )
 
@@ -933,12 +932,12 @@ def update_user_name(username, name, last_name):
         safe_last_name = dp.encrypt_text(last_name.strip()) if last_name else ''
 
         result = users.update_one(
-            {'Username': dp.encrypt_text(username)},
+            {'Username': username},
             {'$set': {'name': safe_name, 'last_name': safe_last_name}}
         )
         if result.matched_count == 0:
             result = users.update_one(
-                {'username': dp.encrypt_text(username)},
+                {'username': username},
                 {'$set': {'name': safe_name, 'last_name': safe_last_name}}
             )
 

Web/templates/library_table.html

@@ -1252,24 +1252,26 @@
         return div.innerHTML;
     }
 
-    // Opens the modal and fetches the data
     function showItemDetail(itemId) {
         const detailContent = document.getElementById('detailContent');
         const detailModal = document.getElementById('detailModal');
 
-        // 1. Show the loading state immediately
         detailContent.innerHTML = '<p>Lade Details...</p>';
         detailModal.style.display = 'flex';
 
-        // 2. Generate Image/Video Gallery Client-Side
         const item = libraryItems.find(i => i._id === itemId);
         let mediaHtml = '';
 
-        if (item && item.Images && item.Images.length > 0) {
-            const imagesHtml = item.Images.map((image, index) => {
+        // Robuste Prüfung: Wir testen gängige Benennungen aus deinem Backend
+        const imageArray = item.Images || item.Bilder || item.images;
+
+        if (item && Array.isArray(imageArray) && imageArray.length > 0) {
+            const imagesHtml = imageArray.map((image, index) => {
+
+                // Dein neuer Code für die exakte Routen-Generierung
                 const imageSrc = image.startsWith('/uploads/') || image.startsWith('http') ?
-                                image :
-                                `{{ url_for('uploaded_file', filename='') }}${image}`;
+                    image :
+                    `{{ url_for('uploaded_file', filename='') }}${image}`;
 
                 const thumbnailInfo = item.ThumbnailInfo && item.ThumbnailInfo[index];
                 const isVideo = isVideoFile(image);
@@ -1280,42 +1282,39 @@
                         : imageSrc;
 
                     if (thumbnailInfo && thumbnailInfo.has_thumbnail) {
-                        return `<div class="video-container" style="position: relative; width: 120px; height: 120px; display: inline-block; margin-right: 15px; margin-bottom: 15px;">
-                                <img src="${videoSrc}" alt="${escapeHtml(item.Name || '')}" class="item-image" style="width: 100%; height: 100%; object-fit: cover; border-radius: 8px; border: 1px solid #ddd;">
-                                <div class="video-preview-overlay" style="position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); color: white; background: rgba(0,0,0,0.6); border-radius: 50%; width: 36px; height: 36px; display: flex; align-items: center; justify-content: center; font-size: 16px;">
-                                    ▶
-                                </div>
-                                </div>`;
+                        return `
+                    <div class="video-container" style="position: relative; width: 120px; height: 120px; display: inline-block; margin-right: 15px; margin-bottom: 15px;">
+                        <img src="${videoSrc}" alt="${escapeHtml(item.Name || 'Medium')}" class="item-image" style="width: 100%; height: 100%; object-fit: cover; border-radius: 8px; border: 1px solid #ddd;">
+                        <div class="video-preview-overlay" style="position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); color: white; background: rgba(0,0,0,0.6); border-radius: 50%; width: 36px; height: 36px; display: flex; align-items: center; justify-content: center; font-size: 16px;">
+                            ▶
+                        </div>
+                    </div>`;
                     } else {
-                         return `<div style="width: 120px; height: 120px; background: #333; color: #fff; display: inline-flex; align-items: center; justify-content: center; border-radius: 8px; margin-right: 15px; margin-bottom: 15px;">VIDEO</div>`;
+                        return `<div style="width: 120px; height: 120px; background: #333; color: #fff; display: inline-flex; align-items: center; justify-content: center; border-radius: 8px; margin-right: 15px; margin-bottom: 15px;">VIDEO</div>`;
                     }
                 } else {
                     const imageSrcFinal = thumbnailInfo && thumbnailInfo.has_thumbnail
                         ? thumbnailInfo.thumbnail_url
                         : imageSrc;
 
-                    return `<img src="${imageSrcFinal}" alt="${escapeHtml(item.Name || '')}" class="item-image" style="width: 120px; height: 120px; object-fit: cover; border-radius: 8px; border: 1px solid #ddd; margin-right: 15px; margin-bottom: 15px;">`;
+                    return `<img src="${imageSrcFinal}" alt="${escapeHtml(item.Name || 'Medium')}" class="item-image" style="width: 120px; height: 120px; object-fit: cover; border-radius: 8px; border: 1px solid #ddd; margin-right: 15px; margin-bottom: 15px;">`;
                 }
             }).join('');
 
             mediaHtml = `<div class="detail-gallery-container" style="margin-bottom: 20px; padding-bottom: 15px; border-bottom: 1px solid #eee; display: flex; flex-wrap: wrap;">${imagesHtml}</div>`;
         }
 
-        // 3. Fetch the data
         fetch(`/api/item_detail/${itemId}`)
             .then(response => {
-                if (!response.ok) {
-                    throw new Error(`HTTP error! status: ${response.status}`);
-                }
+                if (!response.ok) throw new Error(`HTTP error! status: ${response.status}`);
                 return response.text();
             })
             .then(html => {
-                // 4. Clean the HTML and display it, injecting the media gallery before the fetched content
                 detailContent.innerHTML = mediaHtml + DOMPurify.sanitize(html);
             })
             .catch(err => {
                 console.error('Error loading detail:', err);
-                detailContent.innerHTML = '<p>Sorry, we could not load the item details. Please try again later.</p>';
+                detailContent.innerHTML = '<p style="color: red;">Entschuldigung, die Details konnten nicht geladen werden.</p>';
             });
     }