diff --git a/core/app.py b/core/app.py index dbe8784..d978daa 100644 --- a/core/app.py +++ b/core/app.py @@ -38,9 +38,7 @@ def login(): email= request.form['email'] password = request.form['password'] if general_check(password,7,20) and check_email(email): - #TODO by Houssem 1- sanatize data passed from user if User.valid_login(email,password): - # Hacky code here <.< uuid = User.get_id_by_email(email) User.login(uuid) return redirect(url_for('index')) @@ -245,7 +243,7 @@ def new_report(): user = User.get_by_id(_id) error = None if user['banned'] == True: - error = "You are not allowed, to add a report because you are banned!" + error = "You are not allowed to add a report because you are banned!" return view.render_template(view='banned.html',error=error) return view.render_template(view='add.html',error=error) return redirect(url_for('index')) @@ -256,12 +254,8 @@ def register(): email = request.form['email'] password = request.form['password'] username = request.form['name'] - firstpartner = request.form['firstpartner'] - secondpartner = request.form['secondpartner'] - thirdpartner = request.form['thirdpartner'] - #TODO by houssem 1- sanatize data passed from user - if check_email(email) == True and general_check(password,7,20) and general_check(username,4,20) and general_check(firstpartner,4,20) and general_check(secondpartner,0,20) and general_check(thirdpartner,0,20): - user = User.register(username,email,password,firstpartner,secondpartner,thirdpartner) + if check_email(email) == True and general_check(password,7,20) and general_check(username,4,20): + user = User.register(username,email,password) if user: return redirect(url_for('index')) error= 'Account already exists!' diff --git a/core/config.py b/core/config.py index d997d1e..93d1978 100644 --- a/core/config.py +++ b/core/config.py @@ -13,8 +13,9 @@ class StaticVars: """ global vars to be passed""" SITE_NAME= 'BugBountyTN' SITE_URL= 'https://127.0.0.1:5000' + + class Development_Config(BaseConfig): - """development config for me and souheil""" DEBUG = True BCRYPT_LOG_ROUNDS=4 diff --git a/core/models/Usermodel.py b/core/models/Usermodel.py index 88f4e84..1b2b590 100644 --- a/core/models/Usermodel.py +++ b/core/models/Usermodel.py @@ -5,13 +5,10 @@ import bcrypt from models.ReportModel import Report class User(object): - def __init__(self,username,email,password,firstpartner,secondpartner,thirdpartner,_id=None,registeredOn=None,admin=False,banned=False): + def __init__(self,username,email,password,_id=None,registeredOn=None,admin=False,banned=False): self.username = username self.email = email self.password = bcrypt.hashpw(password.encode('utf-8'),bcrypt.gensalt()) - self.firstpartner = firstpartner - self.secondpartner = secondpartner - self.thirdpartner = thirdpartner self._id = uuid.uuid4().hex if _id is None else _id self.registeredOn=datetime.datetime.now() self.banned=banned @@ -59,10 +56,10 @@ def valid_login(cls,email,password): return bcrypt.checkpw(password.encode("utf-8"),user["password"]) return False @classmethod - def register(cls,username,email,password,firstpartner,secondpartner,thirdpartner): + def register(cls,username,email,password): user = cls.get_only_email(email) if user is None: - guest = cls (username,email,password,firstpartner,secondpartner,thirdpartner) + guest = cls (username,email,password) guest.savemongo() dataSaved = cls.get_by_email(email) cls.init_login(dataSaved["_id"]) @@ -108,10 +105,7 @@ def json(self): "password":self.password, "admin":self.admin, "banned":self.banned, - "registeredOn":self.registeredOn, - "firstpartner" : self.firstpartner, - "secondpartner" : self.secondpartner, - "thirdpartner" : self.thirdpartner + "registeredOn":self.registeredOn } def savemongo(self): Database.insert("users",self.json()) diff --git a/core/templates/admin/admin.html b/core/templates/admin/admin.html index b26102b..1bcd4aa 100644 --- a/core/templates/admin/admin.html +++ b/core/templates/admin/admin.html @@ -37,7 +37,7 @@

Dashboard - PenParty Control panel + BugBountyTN Control panel

@@ -333,7 +333,7 @@

Chat (feature not fully implemented)

{{ post['reportName'] }} - {{ post['reportDescription'] }} + {{ post['reportDescription'] }} {{post['AttackVector']}} {{post['reportType']}} {% if post['reportFile'] == None %} diff --git a/core/templates/admin_report.html b/core/templates/admin_report.html index 3d8855c..2b8edec 100644 --- a/core/templates/admin_report.html +++ b/core/templates/admin_report.html @@ -1,8 +1,6 @@ {% extends "layout.html" %} {% block body %} -
-

Evaluate Report

@@ -17,15 +15,13 @@

Evaluate Report

-
+
- - - - - - + + + +
@@ -36,39 +32,36 @@

Evaluate Report

- + + - + {% if report['reportFile'] != None %} - + {% else %} - + + {% endif %}
Username Bug name: Bug type: Report Level Reporter Name Bug name Bug type Threat Level Description: PriviligesRequired(PR):FileFilename
{{usernames}} {{report['reportName']}} {{report['reportType']}} {{report['reportLevel']}}{{report['reportDescription']}}{{report['reportDescription']}} {{report['AttackVector']}} {{report['AttackComplexity']}} {{report['getprivilege']}}{{report['reportFile']}}
{{report['reportFile']}}No File
No File
+

- -
-
+ -

-
-
-
{% endblock %} \ No newline at end of file diff --git a/core/templates/home.html b/core/templates/home.html index 53daebd..451c391 100644 --- a/core/templates/home.html +++ b/core/templates/home.html @@ -21,10 +21,8 @@

Welcome to PenParty Platform

PenParty is a pentest contest organized by Engineer Spark Community in colloboration with the ministry of information and technology , in which teams compete to find bugs infrastructure, and report them for the purpose of gaining points. This event is in it first edition, it's unique of kind like no other hacking contest. Similar to the real world, players are required to exploit and report under 24h.So best of luck Hackers! -Made with ♥ by Cheesus and harloNzz & hosted by Spark Engineer Community +


- -

diff --git a/core/templates/layout.html b/core/templates/layout.html index 51e3466..c5953fe 100644 --- a/core/templates/layout.html +++ b/core/templates/layout.html @@ -43,7 +43,9 @@
  • Admin area
    • {% endif%}
  • My Space
    • + {% if admin == False %}
  • Reports
    • + {% endif %}
  • Sign out
    • diff --git a/core/templates/register.html b/core/templates/register.html index 20d9228..6c3a6b1 100644 --- a/core/templates/register.html +++ b/core/templates/register.html @@ -7,7 +7,7 @@
    -

    Team registration

     +

    User registration
    @@ -15,23 +15,12 @@
    - +
    -
    -
    - - -
    -
    - - -
    -
    - - + Password Settings, min 7,max 20 etc.