from flask import Flask, render_template, request, redirect, session

app = Flask(__name__)
app.secret_key = 'dev-key-2025'

USERS = {
    'admin': {
        'password': 'admin123',
        'role': 'admin',
        'email': 'admin@example.com',
        'phone': '13800138000',
        'balance': 99999
    },
    'alice': {
        'password': 'alice2025',
        'role': 'user',
        'email': 'alice@example.com',
        'phone': '13900139001',
        'balance': 100
    }
}


@app.route('/')
def index():
    return render_template('index.html')


# ════════════════════════════════════════════
# 实验一：硬编码凭据
# ════════════════════════════════════════════
@app.route('/vuln1', methods=['GET', 'POST'])
def vuln1():
    error = None
    logged_in = False
    user_info = None
    if request.method == 'POST':
        u = request.form.get('username', '')
        p = request.form.get('password', '')
        if u in USERS and USERS[u]['password'] == p:
            logged_in = True
            uinfo = dict(USERS[u])
            uinfo['username'] = u
            user_info = uinfo
        else:
            error = '用户名或密码错误'
    return render_template('vuln1.html', error=error, logged_in=logged_in, user_info=user_info)


# ════════════════════════════════════════════
# 实验二：明文存储
# ════════════════════════════════════════════
@app.route('/vuln2', methods=['GET', 'POST'])
def vuln2():
    message = None
    if request.method == 'POST':
        u = request.form.get('username', '')
        p = request.form.get('password', '')
        e = request.form.get('email', '')
        if not u or not p:
            message = '用户名和密码不能为空'
        elif u in USERS:
            message = '用户名已存在'
        else:
            USERS[u] = {'password': p, 'role': 'user', 'email': e, 'phone': '', 'balance': 0}
            message = f'注册成功！用户 {u} 已创建。'
    return render_template('vuln2.html', users=USERS, message=message)


# ════════════════════════════════════════════
# 实验三：登录响应泄露密码
# ════════════════════════════════════════════
@app.route('/vuln3', methods=['GET', 'POST'])
def vuln3():
    error = None
    result = None
    if request.method == 'POST':
        u = request.form.get('username', '')
        p = request.form.get('password', '')
        if u in USERS and USERS[u]['password'] == p:
            result = {
                'username': u,
                'password': USERS[u]['password'],
                'role': USERS[u]['role'],
                'email': USERS[u]['email'],
                'phone': USERS[u]['phone'],
                'balance': USERS[u]['balance']
            }
        else:
            error = '用户名或密码错误'
    return render_template('vuln3.html', error=error, result=result)


# ════════════════════════════════════════════
# 实验四：HTML 注释泄露
# ════════════════════════════════════════════
@app.route('/vuln4', methods=['GET', 'POST'])
def vuln4():
    error = None
    logged_in = False
    user_info = None
    if request.method == 'POST':
        u = request.form.get('username', '')
        p = request.form.get('password', '')
        if u in USERS and USERS[u]['password'] == p:
            logged_in = True
            uinfo = dict(USERS[u])
            uinfo['username'] = u
            user_info = uinfo
        else:
            error = '用户名或密码错误'
    return render_template('vuln4.html', error=error, logged_in=logged_in, user_info=user_info)


if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=True)