From 341a6e61ee60ef17a6178a1f578635d6316b5982 Mon Sep 17 00:00:00 2001 From: Bkolb Date: Thu, 2 Apr 2026 12:31:54 +0200 Subject: [PATCH] html refactoring --- app/flask-postgres/app/app.py | 66 +++++++++++-- app/flask-postgres/app/templates/base.html | 56 +++++++++++ app/flask-postgres/app/templates/login.html | 82 ++++----------- app/flask-postgres/app/templates/profil.html | 82 +++------------ .../app/templates/pwdchange.html | 99 ++++++------------- 5 files changed, 177 insertions(+), 208 deletions(-) create mode 100644 app/flask-postgres/app/templates/base.html diff --git a/app/flask-postgres/app/app.py b/app/flask-postgres/app/app.py index 94c0603..d0026b4 100644 --- a/app/flask-postgres/app/app.py +++ b/app/flask-postgres/app/app.py @@ -270,6 +270,30 @@ def get_current_user(): "is_admin": user_is_admin() if session.get("user_id") else False, } +def get_current_user_mandant_level(): + user_id = session.get("user_id") + if not user_id: + return None + + conn = get_connection() + cur = conn.cursor() + + cur.execute(""" + SELECT m.level + FROM app_user u + JOIN mandant m ON m.id = u.mandant_id + WHERE u.id = %s + """, (user_id,)) + + row = cur.fetchone() + + cur.close() + conn.close() + + if row is None: + return None + + return row[0] def admin_required(view_func): @wraps(view_func) @@ -407,16 +431,42 @@ def health(): return f"DB Fehler: {exc}\n", 500 +@app.route("/videos/") +@login_required +def protected_videos(filename): + mandant_level = get_current_user_mandant_level() + if mandant_level is None: + abort(403) + + basename = os.path.basename(filename) + first_char = basename[:1].upper() + + # Level 0 und 1: alles erlaubt + if mandant_level in (0, 1): + allowed = True + + # Level 2: nur A und B + elif mandant_level == 2: + allowed = first_char in ("A", "B") + + # Level 3: nur A + elif mandant_level == 3: + allowed = first_char == "A" + + else: + allowed = False + + if not allowed: + abort(403) + + return send_from_directory("/app/images/videos", filename) + @app.route("/images/") -def images(filename): - - # 🔒 Schutz für Videos +def serve_image(filename): if filename.startswith("videos/"): - if not session.get("user_id"): - return redirect(url_for("login", next=request.path)) - - return send_from_directory("images", filename) - + abort(403) + + return send_from_directory("/app/images", filename) @app.route("/styles/") def serve_style(filename): diff --git a/app/flask-postgres/app/templates/base.html b/app/flask-postgres/app/templates/base.html new file mode 100644 index 0000000..a34fa21 --- /dev/null +++ b/app/flask-postgres/app/templates/base.html @@ -0,0 +1,56 @@ + + + + + + {{ page_title }} + + + + + +
+
+ +
+ + + +
+ + + +
+
+ + +
+
+ + {% block content %} + {% endblock %} + +
+
+ + + \ No newline at end of file diff --git a/app/flask-postgres/app/templates/login.html b/app/flask-postgres/app/templates/login.html index ecba7de..eb36510 100644 --- a/app/flask-postgres/app/templates/login.html +++ b/app/flask-postgres/app/templates/login.html @@ -1,71 +1,25 @@ - - - - - - {{ page_title }} - - - -
-
-
- - - -
+{% extends "base.html" %} - -
-
+

Login

-
- -
- - \ No newline at end of file +{% endblock %} \ No newline at end of file diff --git a/app/flask-postgres/app/templates/profil.html b/app/flask-postgres/app/templates/profil.html index 5eb6c51..bb22126 100644 --- a/app/flask-postgres/app/templates/profil.html +++ b/app/flask-postgres/app/templates/profil.html @@ -1,72 +1,20 @@ - - - - - - {{ page_title }} - - - -
-
-
- - - -
+{% extends "base.html" %} - -
-
+

Profil

-
-
-

Profil

+ + + + + + + +
ID{{ profile.id }}
Name{{ profile.name }}
E-Mail{{ profile.email }}
Mandant{{ profile.mandant_name }} ({{ profile.mandant_kuerzel }})
Mandant E-Mail{{ profile.mandant_email or '-' }}
Mandant Level{{ profile.mandant_level }}
- - - - - - - +
+ Passwort ändern +
- - - - - - - - - - -
ID{{ profile.id }}
Name{{ profile.name }}
E-Mail{{ profile.email }}
Mandant{{ profile.mandant_name }} ({{ profile.mandant_kuerzel }})
Status{{ profile.status }}
Letzter Login{{ profile.last_login }}
Mandant E-Mail{{ profile.mandant_email }}
Mandant Level{{ profile.mandant_level }}
- -
- Passwort ändern -
- -
-
- - \ No newline at end of file +{% endblock %} \ No newline at end of file diff --git a/app/flask-postgres/app/templates/pwdchange.html b/app/flask-postgres/app/templates/pwdchange.html index dc3a3c6..c224c63 100644 --- a/app/flask-postgres/app/templates/pwdchange.html +++ b/app/flask-postgres/app/templates/pwdchange.html @@ -1,78 +1,39 @@ - - - - - - {{ page_title }} - - - -
-
-
- - - -
+{% extends "base.html" %} - -
-
+

Passwort ändern

-
- -
- - \ No newline at end of file +
+ + Zurück zum Profil +
+ + + +{% endblock %} \ No newline at end of file