aa2c704bfb
Security Features:
- Added User model with bcrypt password hashing
- Implemented Flask-Login for session management
- Protected all API write operations with @login_required decorator
- Added authentication routes (login/logout)
Admin Dashboard:
- Created comprehensive admin dashboard with statistics
- Profile management interface
- Skills management (add/edit/delete)
- Projects management with full CRUD operations
- Social links management
- Modern responsive UI with Bootstrap 5
New Files:
- models.py: Added User model with bcrypt
- routes/auth.py: Login/logout functionality
- routes/admin.py: Complete admin dashboard with CRUD operations
- templates/auth/login.html: Login page
- templates/admin/base.html: Admin base template
- templates/admin/dashboard.html: Main dashboard
- templates/admin/profile.html: Profile editor
- templates/admin/skills.html: Skills manager
- templates/admin/projects.html: Projects list
- templates/admin/project_form.html: Project editor
- templates/admin/social_links.html: Social links manager
Modified Files:
- app.py: Integrated Flask-Login and bcrypt, registered new blueprints
- requirements.txt: Added Flask-Login, Flask-Bcrypt, bcrypt
- init_db.py: Creates default admin user (admin/admin123)
- routes/api.py: Protected all write operations with authentication
Default Credentials:
- Username: admin
- Password: admin123
- ⚠️ MUST be changed after first login!
Benefits:
- Secure API access with session-based authentication
- User-friendly admin interface for content management
- No need to edit code or database directly
- Bcrypt password hashing for security
- Protected against unauthorized access
63 lines
2.0 KiB
Python
63 lines
2.0 KiB
Python
#!/usr/bin/env python
|
|
# -*- coding: utf-8 -*-
|
|
|
|
# Copyright Hersel Giannella
|
|
|
|
"""
|
|
Authentication routes for login/logout
|
|
"""
|
|
|
|
from flask import Blueprint, render_template, request, redirect, url_for, flash
|
|
from flask_login import login_user, logout_user, current_user
|
|
from models import User, db
|
|
from datetime import datetime
|
|
|
|
route_auth = Blueprint('auth', __name__, url_prefix='/auth')
|
|
|
|
|
|
@route_auth.route('/login', methods=['GET', 'POST'])
|
|
def login():
|
|
"""Login page"""
|
|
# Se l'utente è già autenticato, reindirizza alla dashboard
|
|
if current_user.is_authenticated:
|
|
return redirect(url_for('admin.dashboard'))
|
|
|
|
if request.method == 'POST':
|
|
username = request.form.get('username')
|
|
password = request.form.get('password')
|
|
remember = request.form.get('remember', False)
|
|
|
|
if not username or not password:
|
|
flash('Per favore inserisci username e password.', 'danger')
|
|
return render_template('auth/login.html')
|
|
|
|
user = User.query.filter_by(username=username).first()
|
|
|
|
if user and user.check_password(password):
|
|
if not user.is_active:
|
|
flash('Il tuo account è stato disabilitato.', 'danger')
|
|
return render_template('auth/login.html')
|
|
|
|
# Aggiorna last_login
|
|
user.last_login = datetime.utcnow()
|
|
db.session.commit()
|
|
|
|
login_user(user, remember=remember)
|
|
flash(f'Benvenuto {user.username}!', 'success')
|
|
|
|
# Redirect alla pagina richiesta o alla dashboard
|
|
next_page = request.args.get('next')
|
|
return redirect(next_page) if next_page else redirect(url_for('admin.dashboard'))
|
|
else:
|
|
flash('Username o password non corretti.', 'danger')
|
|
|
|
return render_template('auth/login.html')
|
|
|
|
|
|
@route_auth.route('/logout')
|
|
def logout():
|
|
"""Logout user"""
|
|
logout_user()
|
|
flash('Logout effettuato con successo.', 'info')
|
|
return redirect(url_for('route_home.home'))
|