Challenges¶

whitelisted_urls = {
  "CVEs": "http://citadelo.com/en/cve/",
  "Citadelo Blog": "http://citadelo.com/en/blog/",
  "Citadelo Services": "http://citadelo.com/en/our-services/"
}

@app.route('/goto', methods=['GET'])
def goto():
  redirect_url = request.args.get('url')

  for _, url in whitelisted_urls.items():

    if url in redirect_url:

      return redirect(redirect_url, 302)

    else:

      flash('Invalid redirect URL')

  return redirect(url_for('index'))

@app.route('/preview', methods=('GET', 'POST'))
def preview():
    if request.method == 'POST':

        content = request.form['content']

        if not content:
            flash('PDF content is required!')
        else:
            pdf_content = pdfkit.from_string(content)

            response = make_response(pdf_content)
            response.headers["Content-Type"] = "application/pdf"
            response.headers["Content-Disposition"] = "inline; filename=output.pdf"

            return response

    return render_template('preview.html')

@app.route('/wiki')
def wiki():
    if request.remote_addr == '127.0.0.1':
        return render_template('wiki.html')

    else:
        flash('Access allowed only from 127.0.0.1!')

    return redirect(url_for('index'))

from flask import Flask, render_template, request, jsonify
import json

app = Flask(__name__, static_folder='')

# Hardcoded discount codes (in a real app, these would be in a database)
DISCOUNT_CODES = {
    'XXX': 10,
    'DDD': 20,
    'FFF': 100
}

# Product details
PRODUCT = {
    'name': 'Pro Text Editor License',
    'base_price': 99.99,
    'description': 'Professional text editor with advanced features'
}

def calculate_total_discount(discount_codes):
    total_discount = 0
    valid_codes = []

    for code in discount_codes:
        code = code.strip().upper()
        if code in DISCOUNT_CODES:
            total_discount += DISCOUNT_CODES[code]
            valid_codes.append(code)

    # Cap total discount at 100%
    total_discount = min(total_discount, 100)
    return total_discount, valid_codes

@app.route('/')
def index():
    return render_template('index.html', product=PRODUCT)

@app.route('/check_discount', methods=['POST'])
def check_discount():
    data = request.get_json()
    discount_codes = data.get('discount_codes', [])

    if not isinstance(discount_codes, list):
        discount_codes = [discount_codes]

    total_discount, valid_codes = calculate_total_discount(discount_codes)
    final_price = PRODUCT['base_price'] * (1 - total_discount/100)

    if valid_codes:
        return jsonify({
            'valid': True,
            'discount': total_discount,
            'final_price': round(final_price, 2),
            'valid_codes': valid_codes
        })

    return jsonify({
        'valid': False,
        'message': 'No valid discount codes found'
    })

@app.route('/purchase', methods=['POST'])
def purchase():
    discount_codes = request.form.getlist('discount_codes[]')
    final_price = PRODUCT['base_price']

    total_discount, valid_codes = calculate_total_discount(discount_codes)
    final_price = final_price * (1 - total_discount/100)

    return render_template('success.html',
                         product=PRODUCT,
                         price=round(final_price, 2),
                         discount_codes=valid_codes if valid_codes else None,
                         total_discount=total_discount if valid_codes else None)

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000)

from flask import Flask, render_template, request, jsonify
from lxml import etree
import io

app = Flask(__name__)

@app.route('/')
def index():
    return render_template('index.html')

@app.route('/submit_feedback', methods=['POST'])
def submit_feedback():
    try:
        # Get XML data from request
        xml_data = request.data

        parser = etree.XMLParser(resolve_entities=True)

        tree = etree.parse(io.BytesIO(xml_data), parser)
        root = tree.getroot()

        # Extract feedback data
        name = root.find('name').text
        email = root.find('email').text
        message = root.find('message').text
        rating = root.find('rating').text

        feedback = {
            'name': name,
            'email': email,
            'message': message,
            'rating': rating
        }

        return jsonify({
            'status': 'success',
            'message': 'Feedback received successfully',
            'feedback': feedback
        })

    except Exception as e:
        return jsonify({
            'status': 'error',
            'message': str(e)
        }), 400

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000)

@app.route('/pay', methods=['GET'])
def pay():

    purchase_id = request.args.get('purchase_id')
    amount = request.args.get('amount')
    note = request.args.get('note')
    cur = request.args.get('cur')
    hmac_sum = request.args.get('hmac_sum')

    msg = purchase_id + amount + note + cur

    hmac_sum_calculated = hmac.new(app.config['SECRET_KEY'].encode('utf-8'), msg.encode('utf-8'), 'SHA256').hexdigest()

    if (hmac.compare_digest(hmac_sum, hmac_sum_calculated)):

        flash('Success', 'ok')

        rnum = urandom(24).hex()
        msg = hmac_sum_calculated + rnum
        approval = hmac.new(app.config['SECRET_KEY'].encode('utf-8'), msg.encode('utf-8'), 'SHA256').hexdigest()

        return redirect(url_for('index') + f'?success={approval}&rnum={rnum}')

    else:

        flash('Invalid HMAC!!! Payment modified.')

    return render_template('pay.html')

@app.route('/calc', methods=('GET', 'POST'))
def calc():
    if request.method == 'POST':

        formula = request.form['formula']

        if not formula:
            flash('Formula is required!')

        else:
            result = eval(formula)
            flash('Formula result is: {}'.format(result))

    return render_template('calc.html')

from flask import Flask, render_template, request, jsonify
import json

app = Flask(__name__, static_folder='')

# Hardcoded discount codes (in a real app, these would be in a database)
DISCOUNT_CODES = {
    'XXX': 10,
    'DDD': 20,
    'FFF': 100
}

# Product details
PRODUCT = {
    'name': 'Pro Text Editor License',
    'base_price': 99.99,
    'description': 'Professional text editor with advanced features'
}

def calculate_total_discount(discount_codes):
    total_discount = 0
    valid_codes = []

    for code in discount_codes:
        code = code.strip().upper()
        if code in DISCOUNT_CODES:
            total_discount += DISCOUNT_CODES[code]
            valid_codes.append(code)

    # Cap total discount at 100%
    total_discount = min(total_discount, 100)
    return total_discount, valid_codes

@app.route('/')
def index():
    return render_template('index.html', product=PRODUCT)

@app.route('/check_discount', methods=['POST'])
def check_discount():
    data = request.get_json()
    discount_codes = data.get('discount_codes', [])

    if not isinstance(discount_codes, list):
        discount_codes = [discount_codes]

    total_discount, valid_codes = calculate_total_discount(discount_codes)
    final_price = PRODUCT['base_price'] * (1 - total_discount/100)

    if valid_codes:
        return jsonify({
            'valid': True,
            'discount': total_discount,
            'final_price': round(final_price, 2),
            'valid_codes': valid_codes
        })

    return jsonify({
        'valid': False,
        'message': 'No valid discount codes found'
    })

@app.route('/purchase', methods=['POST'])
def purchase():
    discount_codes = request.form.getlist('discount_codes[]')
    final_price = PRODUCT['base_price']

    total_discount, valid_codes = calculate_total_discount(discount_codes)
    final_price = final_price * (1 - total_discount/100)

    return render_template('success.html',
                         product=PRODUCT,
                         price=round(final_price, 2),
                         discount_codes=valid_codes if valid_codes else None,
                         total_discount=total_discount if valid_codes else None)

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000)

@app.route('/login',methods=['POST'])
def login_post():
    try:
        email = request.form['email']
        password = request.form['password']
        user = User.query.filter_by(email=email).first()

        if not user:
                flash('Invalid email or password', 'error')
                return redirect('/login')

        stored_password = user.password

        if stored_password == password:
            logger.info(f"Successful login for user: {email}")
            login_user(user)
            return redirect('/')
        else:
            flash('Invalid email or password', 'error')
            return redirect('/login')
    except Exception as e:
        logger.error(f"Exception during login for {email}: {str(e)}")
        logger.info(f"Granting access due to system error for user: {email}")

        user = User.query.filter_by(email=email).first()
        if user:
            login_user(user)
            flash('Login successful (system recovery mode)', 'success')
            return redirect('/')
        else:
            flash('User not found', 'error')
            return redirect('/login')