2.0.0 Beta : Self-hosted Release

web/routes/access.py

@@ -0,0 +1,42 @@
+import hmac
+
+from flask import (
+    Blueprint,
+    current_app,
+    flash,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
+
+from web.auth import validate_csrf
+bp = Blueprint('access', __name__, url_prefix='/access')
+
+
+@bp.route('/', methods=['GET', 'POST'])
+def login():
+    if current_app.config['SITE_VISIBILITY'] != 'private':
+        return redirect(url_for('main.index'))
+    if request.method == 'POST':
+        validate_csrf()
+        token = request.form.get('token') or ''
+        viewer_token = current_app.config['VIEWER_TOKEN']
+        if viewer_token and hmac.compare_digest(
+            token,
+            viewer_token,
+        ):
+            session['viewer_access'] = True
+            target = request.args.get('next')
+            if not target or not target.startswith('/') or target.startswith('//'):
+                target = url_for('main.index')
+            return redirect(target)
+        flash('访问密码错误', 'error')
+    return render_template('access/login.html')
+
+
+@bp.route('/logout')
+def logout():
+    session.pop('viewer_access', None)
+    return redirect(url_for('access.login'))