Homec4science
Diffusion InfoSec (master) Browse

infosec/hw4/ex3/site.py
289576b02ed8master

Last Change
Raw File

site.py
View Options

#!/usr/bin/env python3
import os
import sys
import populate
from flask import g
from flask import Flask, current_app
from flask import render_template, request, jsonify
import pymysql
app = Flask(__name__)
username = "root"
password = "root"
database = "hw4_ex3"
def get_sql_answer(cursor,name):
#get all messages for specified name
sql = "SELECT name, message FROM messages WHERE name = %s;"
cursor.execute(sql, (name, ))
return cursor.fetchall()
def send_json_messages(answer):
#create a json list with all messages from the answer obtained from cursor
json_answer = []
for message in answer:
json_answer.append({"name": message[0], "message": message[1]})
return jsonify(json_answer),200
def send_json_users(answer):
#create json list with users
json_answer = {"users": []}
for user in answer:
json_answer["users"].append(user[0])
return jsonify(json_answer),200
## This method returns a list of messages in a json format such as
## [
## { "name": <name>, "message": <message> },
## { "name": <name>, "message": <message> },
## ...
## ]
## If this is a POST request and there is a parameter "name" given, then only
## messages of the given name should be returned.
## If the POST parameter is invalid, then the response code must be 500.
@app.route("/messages",methods=["GET","POST"])
def messages():
with db.cursor() as cursor:
## your code here
#when post, check for given parameter
if request.method == 'POST':
#check both parameters for name
form_param = request.form['name']
input_param = request.args.get('name')
name=None
if input_param:
split = input_param.split()
#check if name right format
if len(split)>1:
return jsonify({}),500
else:
name = split[0]
elif form_param:
name = form_param
#send answer with the messages if name was given, else send 500 answer
if name:
return send_json_messages(get_sql_answer(cursor,name))
else:
return jsonify({}), 500
#if get, just send all
elif request.method == 'GET':
cursor.execute("SELECT name, message FROM messages;")
answer = cursor.fetchall()
return send_json_messages(answer)
## This method returns the list of users in a json format such as
## { "users": [ <user1>, <user2>, ... ] }
## This methods should limit the number of users if a GET URL parameter is given
## named limit. For example, /users?limit=4 should only return the first four
## users.
## If the paramer given is invalid, then the response code must be 500.
@app.route("/users",methods=["GET"])
def contact():
with db.cursor() as cursor:
## your code here
input_param = request.args.get('limit')
if input_param:
split = input_param.split()
if len(split)>1:
return jsonify({}),500
else:
limit = int(split[0])
sql = "SELECT name FROM users limit %s;"
#execute sql with limit, to get users
cursor.execute(sql, (limit, ))
else:
#get alls users
cursor.execute("SELECT name FROM users;")
#get answer of sql command
answer = cursor.fetchall()
#send answer as json
return send_json_users(answer)
if __name__ == "__main__":
seed = "randomseed"
if len(sys.argv) == 2:
seed = sys.argv[1]
db = pymysql.connect("localhost",
username,
password,
database)
with db.cursor() as cursor:
populate.populate_db(seed,cursor)
db.commit()
print("[+] database populated")
app.run(host='0.0.0.0',port=80)
c4science · Help