57 lines
1.8 KiB
Python
57 lines
1.8 KiB
Python
|
from flask import Blueprint, flash, redirect, render_template, request, session, url_for
|
||
|
|
from sqlalchemy import text
|
||
|
|
from werkzeug.security import check_password_hash
|
||
|
|
|
||
|
|
from app import db
|
||
|
|
|
||
|
|
auth_bp = Blueprint("auth", __name__)
|
||
|
|
|
||
|
|
|
||
|
|
@auth_bp.route("/", methods=["GET", "POST"])
|
||
|
|
def index():
|
||
|
|
if "user_id" in session:
|
||
|
|
return redirect(url_for("menu.menu"))
|
||
|
|
|
||
|
|
if "login_attempts" not in session:
|
||
|
|
session["login_attempts"] = 0
|
||
|
|
|
||
|
|
if request.method == "POST":
|
||
|
|
user_login = request.form.get("login")
|
||
|
|
user_pass = request.form.get("pass")
|
||
|
|
|
||
|
|
query = text(
|
||
|
|
"SELECT id, pass AS user_pass, nom, prenom FROM login "
|
||
|
|
"WHERE login = :login AND actif = 1"
|
||
|
|
)
|
||
|
|
result = db.session.execute(query, {"login": user_login}).fetchone()
|
||
|
|
|
||
|
|
if result and check_password_hash(result.user_pass, user_pass):
|
||
|
|
# Régénération de session : protection contre la fixation de session
|
||
|
|
session.clear()
|
||
|
|
session["user_id"] = result.id
|
||
|
|
session["user_name"] = f"{result.prenom} {result.nom}"
|
||
|
|
session["login_attempts"] = 0
|
||
|
|
return redirect(url_for("menu.menu"))
|
||
|
|
else:
|
||
|
|
session["login_attempts"] += 1
|
||
|
|
essais = session["login_attempts"]
|
||
|
|
if essais >= 3:
|
||
|
|
session["login_attempts"] = 0
|
||
|
|
flash(
|
||
|
|
"Trop de tentatives. Réessayez dans quelques instants.",
|
||
|
|
"danger",
|
||
|
|
)
|
||
|
|
else:
|
||
|
|
flash(
|
||
|
|
f"Identifiant ou mot de passe incorrect. "
|
||
|
|
f"Il vous reste {3 - essais} essai(s).",
|
||
|
|
"danger",
|
||
|
|
)
|
||
|
|
|
||
|
|
return render_template("index.html")
|
||
|
|
|
||
|
|
|
||
|
|
@auth_bp.route("/logout")
|
||
|
|
def logout():
|
||
|
|
session.clear()
|
||
|
|
return redirect(url_for("auth.index"))
|