Skip to content

fix(#261): safe session language access #268

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DogukanUrker merged 1 commit into from
Jun 27, 2026
Merged

fix(#261): safe session language access #268

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions app/routes/change_password.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ def change_password():
page="change_password",
message="login",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
return redirect("/login/redirect=change-password")

Expand All @@ -59,15 +59,15 @@ def change_password():
page="change_password",
message="same",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

if password != password_confirm:
flash_message(
page="change_password",
message="match",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

if old_password != password and password == password_confirm:
Expand All @@ -93,7 +93,7 @@ def change_password():
page="change_password",
message="old",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

return render_template(
Expand Down
2 changes: 1 addition & 1 deletion app/routes/change_profile_picture.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ def change_profile_picture():
page="change_profile_picture",
message="success",
category="success",
language=session["language"],
language=session.get("language", "en"),
)

return redirect("/account-settings")
Expand Down
4 changes: 2 additions & 2 deletions app/routes/change_username.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ def change_username():
page="change_username",
message="success",
category="success",
language=session["language"],
language=session.get("language", "en"),
)

return redirect("/account-settings")
Expand All @@ -83,7 +83,7 @@ def change_username():
page="change_username",
message="taken",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

return render_template(
Expand Down
4 changes: 2 additions & 2 deletions app/routes/create_post.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ def create_post():
page="create_post",
message="empty",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
Log.error(
f'User: "{session["username"]}" tried to create a post with '
Expand Down Expand Up @@ -87,7 +87,7 @@ def create_post():
page="create_post",
message="success",
category="success",
language=session["language"],
language=session.get("language", "en"),
)
return redirect("/")

Expand Down
6 changes: 3 additions & 3 deletions app/routes/edit_post.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ def edit_post(url_id):
page="edit_post",
message="empty",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
Log.error(
f'User: "{session["username"]}" tried to edit a post with empty content',
Expand All @@ -88,7 +88,7 @@ def edit_post(url_id):
page="edit_post",
message="success",
category="success",
language=session["language"],
language=session.get("language", "en"),
)
return redirect(f"/post/{post.url_id}")

Expand All @@ -105,7 +105,7 @@ def edit_post(url_id):
page="edit_post",
message="author",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
Log.error(
f'User: "{session["username"]}" tried to edit another authors post',
Expand Down
6 changes: 3 additions & 3 deletions app/routes/login.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ def login(direct):
page="login",
message="not_found",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
else:
if encryption.verify(password, user.password):
Expand All @@ -76,7 +76,7 @@ def login(direct):
page="login",
message="success",
category="success",
language=session["language"],
language=session.get("language", "en"),
)

return (
Expand All @@ -90,7 +90,7 @@ def login(direct):
page="login",
message="password",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

return render_template(
Expand Down
14 changes: 7 additions & 7 deletions app/routes/password_reset.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ def password_reset(code_sent):
page="password_reset",
message="not_found",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
else:
if password == password_confirm:
Expand All @@ -71,7 +71,7 @@ def password_reset(code_sent):
page="password_reset",
message="same",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
else:
password_reset_codes_storage.pop(username)
Expand All @@ -84,22 +84,22 @@ def password_reset(code_sent):
page="password_reset",
message="success",
category="success",
language=session["language"],
language=session.get("language", "en"),
)
return redirect("/login/redirect=&")
else:
flash_message(
page="password_reset",
message="match",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
else:
flash_message(
page="password_reset",
message="wrong",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

return render_template(
Expand Down Expand Up @@ -163,7 +163,7 @@ def password_reset(code_sent):
page="password_reset",
message="code",
category="success",
language=session["language"],
language=session.get("language", "en"),
)
return redirect("/password-reset/codesent=true")
else:
Expand All @@ -172,7 +172,7 @@ def password_reset(code_sent):
page="password_reset",
message="not_found",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

return render_template(
Expand Down
2 changes: 1 addition & 1 deletion app/routes/post.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ def post(url_id=None, slug=None):
page="post",
message="success",
category="success",
language=session["language"],
language=session.get("language", "en"),
)

return redirect(url_for("post.post", url_id=url_id)), 301
Expand Down
2 changes: 1 addition & 1 deletion app/routes/set_language.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ def set_language(language):
page="set_language",
message="success",
category="success",
language=session["language"],
language=session.get("language", "en"),
)
else:
Log.warning(f"Language not supported: {language}")
Expand Down
12 changes: 6 additions & 6 deletions app/routes/signup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ def signup():
page="signup",
message="success",
category="success",
language=session["language"],
language=session.get("language", "en"),
)

# Send welcome email (with error handling)
Expand Down Expand Up @@ -157,7 +157,7 @@ def signup():
page="signup",
message="ascii",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
else:
Log.error("Passwords do not match")
Expand All @@ -166,7 +166,7 @@ def signup():
page="signup",
message="password",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

if username_taken and email_taken:
Expand All @@ -175,7 +175,7 @@ def signup():
page="signup",
message="taken",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
if not username_taken and email_taken:
Log.error(f'This email "{email}" is unavailable')
Expand All @@ -184,7 +184,7 @@ def signup():
page="signup",
message="email",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

if username_taken and not email_taken:
Expand All @@ -194,7 +194,7 @@ def signup():
page="signup",
message="username",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

return render_template(
Expand Down
4 changes: 2 additions & 2 deletions app/routes/verify_user.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,15 +64,15 @@ def verify_user(code_sent):
page="verify_user",
message="success",
category="success",
language=session["language"],
language=session.get("language", "en"),
)
return redirect("/")
else:
flash_message(
page="verify_user",
message="wrong",
category="error",
language=session["language"],
language=session.get("language", "en"),
)

return render_template(
Expand Down
6 changes: 3 additions & 3 deletions app/utils/delete.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ def delete_post(post_id, username=None):
page="delete",
message="post",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
Log.success(f'Post: "{post_id}" deleted by "{username}"')
return True
Expand Down Expand Up @@ -89,7 +89,7 @@ def delete_user(username):
page="delete",
message="user",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
Log.success(f'User: "{username}" deleted')

Expand Down Expand Up @@ -134,7 +134,7 @@ def delete_comment(comment_id, username=None):
page="delete",
message="comment",
category="error",
language=session["language"],
language=session.get("language", "en"),
)
Log.success(f'Comment: "{comment_id}" deleted by "{username}"')
return True
Loading