43 lines
1.1 KiB
Python
43 lines
1.1 KiB
Python
import hmac
|
|
|
|
from flask import (
|
|
Blueprint,
|
|
current_app,
|
|
flash,
|
|
redirect,
|
|
render_template,
|
|
request,
|
|
session,
|
|
url_for,
|
|
)
|
|
|
|
from web.auth import validate_csrf
|
|
bp = Blueprint('access', __name__, url_prefix='/access')
|
|
|
|
|
|
@bp.route('/', methods=['GET', 'POST'])
|
|
def login():
|
|
if current_app.config['SITE_VISIBILITY'] != 'private':
|
|
return redirect(url_for('main.index'))
|
|
if request.method == 'POST':
|
|
validate_csrf()
|
|
token = request.form.get('token') or ''
|
|
viewer_token = current_app.config['VIEWER_TOKEN']
|
|
if viewer_token and hmac.compare_digest(
|
|
token,
|
|
viewer_token,
|
|
):
|
|
session['viewer_access'] = True
|
|
target = request.args.get('next')
|
|
if not target or not target.startswith('/') or target.startswith('//'):
|
|
target = url_for('main.index')
|
|
return redirect(target)
|
|
flash('访问密码错误', 'error')
|
|
return render_template('access/login.html')
|
|
|
|
|
|
@bp.route('/logout')
|
|
def logout():
|
|
session.pop('viewer_access', None)
|
|
return redirect(url_for('access.login'))
|