Nirodan
98bb34f094
- Fix AttributeError crash on empty request body in md5, hasher, textdiff,
jwtdecoder, timestamp, passwordgen (get_json without silent=True / or {})
- Fix memory exhaustion in ipcalc: replace list(network.hosts()) with direct
arithmetic — safe for /8 and larger networks
- Fix O(1M) loop in cronexplainer.get_next_runs: rewrite to skip by
month/day/hour instead of iterating every minute
- Fix connection leak in notes.ensure_table: add try/finally around conn.close
- Fix admin._ensure_tables / notes._ensure_table running DDL on every request:
guard with module-level flags (_tables_initialized, _table_ready)
- Fix update_website returning 200 when no row matched; delete_website returning
success when nothing was deleted; add rowcount checks for both
- Add role validation in admin create_user / update_user (_VALID_ROLES guard)
- Add delimiter length guard in csvviewer (csv.reader requires single char)
- Fix loremipsum: wrap int(count) in try/except ValueError → 400 response
- Fix auth/token: use auth_header[7:] instead of fragile .replace()
- Fix app.py: remove duplicate import sys; cache DB liveness check with 30s TTL
to avoid a new TCP connection on every frontend page load; move api/setup
path guard before DB check
- Replace FileHandler with RotatingFileHandler (5 MB / 3 backups) in logger;
fix relative log paths to absolute paths anchored to __file__
- Wrap all DB connections in try/finally conn.close() throughout admin and notes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
31 lines
936 B
Python
31 lines
936 B
Python
import os
|
||
from flask import request
|
||
from jwt import decode, ExpiredSignatureError, InvalidTokenError
|
||
from util.logger import logger
|
||
|
||
# SECRET_KEY must be provided via environment for production safety
|
||
SECRET_KEY = os.environ.get("SECRET_KEY")
|
||
if not SECRET_KEY:
|
||
logger.error("SECRET_KEY environment variable is not set – authentication disabled until configured.")
|
||
|
||
|
||
def verify_token():
|
||
if not SECRET_KEY:
|
||
return None
|
||
|
||
auth_header = request.headers.get("Authorization", "")
|
||
if not auth_header.startswith("Bearer "):
|
||
logger.warning("🔐 Invalid Bearer header")
|
||
return None
|
||
|
||
token = auth_header[7:]
|
||
try:
|
||
decoded = decode(token, SECRET_KEY, algorithms=["HS256"])
|
||
return decoded
|
||
except ExpiredSignatureError:
|
||
logger.warning("🔐 Token expired")
|
||
return None
|
||
except InvalidTokenError:
|
||
logger.warning("🔐 Invalid token")
|
||
return None
|