forked from dineshshetty/Android-InsecureBankv2
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathapp.py
More file actions
126 lines (114 loc) · 4.01 KB
/
Copy pathapp.py
File metadata and controls
126 lines (114 loc) · 4.01 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
import getopt
import sys
from cheroot import wsgi
from flask import Flask, request
from models import User, Account
from database import db_session
import json
makejson = json.dumps
app = Flask(__name__)
DEFAULT_PORT_NO = 8888
def usageguide():
print("InsecureBankv2 Backend-Server")
print("Options: ")
print(" --port p serve on port p (default 8888)")
print(" --help print this message")
@app.errorhandler(500)
def internal_servererror(error):
print("[!]", error)
return "Internal Server Error", 500
@app.route('/login', methods=['POST'])
def login():
Responsemsg = "fail"
user = request.form['username']
u = User.query.filter(User.username == request.form["username"]).first()
print("u=", u)
if u and u.password == request.form["password"]:
Responsemsg = "Correct Credentials"
elif u and u.password != request.form["password"]:
Responsemsg = "Wrong Password"
elif not u:
Responsemsg = "User Does not Exist"
else:
Responsemsg = "Some Error"
data = {"message": Responsemsg, "user": user}
print(makejson(data))
return makejson(data)
@app.route('/getaccounts', methods=['POST'])
def getaccounts():
Responsemsg = "fail"
acc1 = acc2 = from_acc = to_acc = 0
user = request.form['username']
u = User.query.filter(User.username == user).first()
if not u or u.password != request.form["password"]:
Responsemsg = "Wrong Credentials so trx fail"
else:
Responsemsg = "Correct Credentials so get accounts will continue"
a = Account.query.filter(Account.user == user)
for i in a:
if (i.type == 'from'):
from_acc = i.account_number
for j in a:
if (i.type == 'to'):
to_acc = i.account_number
data = {"message": Responsemsg, "from": from_acc, "to": to_acc}
print(makejson(data))
return makejson(data)
@app.route('/changepassword', methods=['POST'])
def changepassword():
Responsemsg = "fail"
newpassword = request.form['newpassword']
user = request.form['username']
print(newpassword)
u = User.query.filter(User.username == user).first()
if not u:
Responsemsg = "Error"
else:
Responsemsg = "Change Password Successful"
u.password = newpassword
db_session.commit()
data = {"message": Responsemsg}
print(makejson(data))
return makejson(data)
@app.route('/dotransfer', methods=['POST'])
def dotransfer():
Responsemsg = "fail"
user = request.form['username']
amount = request.form['amount']
u = User.query.filter(User.username == user).first()
if not u or u.password != request.form["password"]:
Responsemsg = "Wrong Credentials so trx fail"
else:
Responsemsg = "Success"
from_acc = request.form["from_acc"]
to_acc = request.form["to_acc"]
amount = request.form["amount"]
from_account = Account.query.filter(Account.account_number == from_acc).first()
to_account = Account.query.filter(Account.account_number == to_acc).first()
to_account.balance += int(request.form['amount'])
from_account.balance -= int(request.form['amount'])
db_session.commit()
data = {"message": Responsemsg, "from": from_acc, "to": to_acc, "amount": amount}
return makejson(data)
@app.route('/devlogin', methods=['POST'])
def devlogin():
user = request.form['username']
Responsemsg = "Correct Credentials"
data = {"message": Responsemsg, "user": user}
print(makejson(data))
return makejson(data)
if __name__ == '__main__':
port = DEFAULT_PORT_NO
options, args = getopt.getopt(sys.argv[1:], "", ["help", "port="])
for op, arg1 in options:
if op == "--help":
usageguide()
sys.exit(2)
elif op == "--port":
port = int(arg1)
server = wsgi.Server(("0.0.0.0", port), app, server_name='localhost')
print("The server is hosted on port:", port)
try:
server.start()
except KeyboardInterrupt:
server.stop()