From c72520481c8808f3e0ebadffe1e857c03f85ccb7 Mon Sep 17 00:00:00 2001 From: sandro Date: Sun, 11 Oct 2026 23:18:54 +0200 Subject: [PATCH] Loginverhalten weiter verbessert --- app.py | 119 +++++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 98 insertions(+), 21 deletions(-) diff --git a/app.py b/app.py index 2dd1cd3..5ab1945 100644 --- a/app.py +++ b/app.py @@ -9,6 +9,7 @@ from flask import Flask, render_template_string, request, session, redirect, url from flask_cors import CORS from playwright.async_api import async_playwright import requests +from urllib.parse import urlencode import mutagen from mutagen.mp3 import MP3 from mutagen.oggvorbis import OggVorbis @@ -395,7 +396,16 @@ TEMPLATE = """ 📚 Gesamte Bibliothek laden {% else %} - 🦊 Tonie-Login + + {% if tonie_logged_in %} +
+ 🟢 TonieCloud: + {{ tonie_email or 'Verbunden' }} + ✕ +
+ {% else %} + 🦊 Tonie-Login + {% endif %} {% endif %} @@ -812,26 +822,78 @@ TONIE_LOGIN_TEMPLATE = """ Tonie-Login - Tonieflix

🦊 Tonies Account

Gib deine Zugangsdaten für my.tonies.com ein:

+
- - - + + +
+ {% if error %} -

{{ error }}

+

{{ error }}

{% endif %} + +
+ +
+ +
+ + """ @@ -841,7 +903,7 @@ TONIE_LOGIN_TEMPLATE = """ # --------------------------------------------------------- @app.before_request def require_login(): - # CORS Preflight oder öffentliche API-Routen ignorieren + # CORS Preflight oder API-Routen ignorieren if request.method == 'OPTIONS' or request.path.startswith('/api/books'): return None @@ -849,12 +911,16 @@ def require_login(): url_pw = request.args.get('pw') or request.args.get('password') if url_pw and url_pw == PASSWORD: session['logged_in'] = True - - # Sauberer Redirect ohne Passwort-Parameter in der URL-Historie: - args = request.args.copy() - args.pop('pw', None) - args.pop('password', None) - clean_url = request.path + ('?' + args.to_encoded_string() if args else '') + + # WICHTIG: Wenn wir auf /tonie-login sind, KEINEN Redirect machen, + # damit die Route die Tonie-Zugangsdaten direkt im selben Request verarbeiten kann! + if request.endpoint == 'tonie_login': + return None + + # Für alle anderen Seiten: Saubere Weiterleitung ohne 'pw' in der Adresszeile + clean_args = {k: v for k, v in request.args.items() if k not in ('pw', 'password')} + query_string = urlencode(clean_args) + clean_url = request.path + (f"?{query_string}" if query_string else '') return redirect(clean_url) # Prüfen, ob eingeloggt oder auf Login/Statics unterwegs @@ -883,10 +949,12 @@ def login(): @app.route('/tonie-login', methods=['GET', 'POST']) def tonie_login(): error = None - if request.method == 'POST': - email = request.form.get('tonie_email') - pwd = request.form.get('tonie_password') - + + # Werte aus Formular (POST) oder Query-String (GET) holen + email = request.form.get('tonie_email') or request.args.get('tonie_email') + pwd = request.form.get('tonie_password') or request.args.get('tonie_password') + + if email and pwd: token = get_tonie_api_token(email, pwd) if token: session['tonie_token'] = token @@ -898,8 +966,15 @@ def tonie_login(): logger.warning(f"Toniecloud-Login fehlgeschlagen für E-Mail: {email} (IP: {request.remote_addr})") log_to_db("WARNUNG", f"Toniecloud-Login fehlgeschlagen für E-Mail: {email} (IP: {request.remote_addr})") error = "Login fehlgeschlagen. Bitte Zugangsdaten prüfen." - return render_template_string(TONIE_LOGIN_TEMPLATE, error=error) + return render_template_string(TONIE_LOGIN_TEMPLATE, error=error, app_password=PASSWORD) + +@app.route('/tonie-logout') +def tonie_logout(): + session.pop('tonie_token', None) + session.pop('tonie_email', None) + return redirect(url_for('index')) + @app.route('/logout') def logout(): session.clear() @@ -925,7 +1000,9 @@ def index(): single_mode=False, all_genres=sorted(list(all_genres)), all_formats=sorted(list(all_formats)), - all_agegroups=sorted(list(all_agegroups)) + all_agegroups=sorted(list(all_agegroups)), + tonie_logged_in=bool(session.get('tonie_token')), + tonie_email=session.get('tonie_email', '') ) @app.route('/play/')