Fix bugs and harden security for todo app

.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and perform LF normalization
+* text=auto

.gitignore

@@ -1,2 +1,75 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
 
-*.pyc
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+env/
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.coverage
+.tox/
+.nox/
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# Jupyter Notebook
+.venv/*
+__pycache__/app.cpython-311.pyc

.vscode/settings.json

@@ -0,0 +1,10 @@
+{
+    "cSpell.words": [
+        "bootswatch",
+        "jsonify",
+        "pytest",
+        "sqla",
+        "sqlalchemy",
+        "todos"
+    ]
+}

Code-assistant-sandbox.code-workspace

@@ -0,0 +1,13 @@
+{
+	"folders": [
+		{
+			"path": "."
+		}
+	],
+	"settings": {
+		"cSpell.words": [
+			"sqlalchemy",
+			"venv"
+		]
+	}
+}

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2023 Doğukan Mete Ürker
+Copyright (c) 2023 Hubert Nafalski
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,40 +1,36 @@
-# [flaskToDo✅](https://dogukanurker.com/flasktodo)
+# How to start
 
-Simple todo app built with Flask.
-<br/>
-[Contact](mailto:dogukanurker@icloud.com)<br/>
-[Dogukan Urker](https://dogukanurker.com)
-### [Demo Video 📺](https://youtu.be/GmPeXhBiihI)
-|              Desktop               |              Mobile               |
-| :--------------------------------: | :-------------------------------: |
-| ![appDesktop](/images/desktop.png) | ![appMobile](/images/mobile.jpeg) |
+## Windows
 
-## Requirements 📦
+```console
+REM initialization
+python -m venv .venv
+call .venv\Scripts\activate
 
-- Flask
-- Flaskwebgui <sub><sup>(if you run desktop.py)</sup></sub>
+pip install -r requirements.txt
 
-## Installation ⬇️
+REM change firewall settings to open port 5000 for incoming TCP trafic (run in powershell as Administrator):
+REM netsh advfirewall firewall add rule name="Open Port 5000 for Flask web server" dir=in action=allow protocol=TCP localport=5000
 
-download source code from Github 💾
-`git clone https://github.com/DogukanUrker/flaskToDo.git`
+set FLASK_APP=app.py
+set FLASK_ENV=development
+REM run in debug mode (auto reload on code change)
+set FLASK_DEBUG=1
+flask run --host=0.0.0.0
+```
 
-go to directory 📁
-`cd flaskToDo`
+## Linux/MacOS
 
-install requirements.txt 🔽
-`pip install -r requirements.txt`
+```console
+# initialization
+python -m venv .venv
+source .venv/bin/activate
 
-it's ready to run 🎉
-`python app.py`
-or
-`python desktop.py`
-for run flaskToDo as a desktop app 💯
+pip install -r requirements.txt
 
-### Contributors 💕
-
-<a href="https://github.com/dogukanurker"><img src="https://avatars.githubusercontent.com/u/62756402" title="ngryman" width="80" height="80"></a>
-
-### Support 💰
-
-<a href="https://dogukanurker.com/donate" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/arial-red.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>
+export FLASK_APP=app.py
+export FLASK_ENV=development
+# run in debug mode (auto reload on code change)
+export FLASK_DEBUG=1
+flask run --host=0.0.0.0
+```

app.py

@@ -1,88 +1,66 @@
-import socket
-import sqlite3
-import secrets
-import dbChecker
-from datetime import datetime
-from flask import Flask, render_template, redirect
+from flask import Flask, render_template, request, redirect, url_for, flash
+from flask_sqlalchemy import SQLAlchemy
+from flask_wtf.csrf import CSRFProtect
 
 app = Flask(__name__)
-app.secret_key = secrets.token_urlsafe(32)
+# /// = relative path, //// = absolute path
+app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///db.sqlite'
+app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
+app.config['SECRET_KEY'] = 'dev-secret-key-change-in-production'
 
+db = SQLAlchemy(app)
+csrf = CSRFProtect(app)
 
-def currentDate():
-    return datetime.now().strftime("%d.%m.%y")
+class Todo(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    title = db.Column(db.String(100))
+    complete = db.Column(db.Boolean)
 
+with app.app_context():
+    db.create_all()
 
-def currentTime():
-    return datetime.now().strftime("%H:%M")
-
-
-@app.route("/")
+@app.get("/")
 def index():
-    connection = sqlite3.connect("todos.db")
-    cursor = connection.cursor()
-    cursor.execute("select * from todos")
-    todos = cursor.fetchall()
-    return render_template("/index.html", todos=todos)
-
-
-@app.route("/add/<todo>")
-def add(todo):
-    connection = sqlite3.connect("todos.db")
-    cursor = connection.cursor()
-    cursor.execute(
-        f'insert into todos(todo,date,time) values("{todo}","{currentDate()}","{currentTime()}")'
-    )
-    connection.commit()
-    return redirect("/")
-
-
-@app.route("/check/<int:id>")
-def check(id):
-    connection = sqlite3.connect("todos.db")
-    cursor = connection.cursor()
-    cursor.execute(f'update todos set status = "True" where id = {id}')
-    cursor.execute(f'update todos set editDate = "{currentDate()}" where id = {id}')
-    cursor.execute(f'update todos set editTime = "{currentTime()}" where id = {id}')
-    connection.commit()
-    return redirect("/")
-
-
-@app.route("/uncheck/<int:id>")
-def uncheck(id):
-    connection = sqlite3.connect("todos.db")
-    cursor = connection.cursor()
-    cursor.execute(f'update todos set status = "False" where id = {id}')
-    connection.commit()
-    return redirect("/")
-
-
-@app.route("/edit/<int:id>/<todo>")
-def edit(id, todo):
-    connection = sqlite3.connect("todos.db")
-    cursor = connection.cursor()
-    cursor.execute(f'update todos set todo = "{todo}" where id = {id}')
-    connection.commit()
-    return redirect("/")
-
-
-@app.route("/delete/<int:id>")
-def delete(id):
-    connection = sqlite3.connect("todos.db")
-    cursor = connection.cursor()
-    cursor.execute(f"delete from todos where id = {id}")
-    cursor.execute(f"update sqlite_sequence set seq = seq-1")
-    connection.commit()
-    return redirect("/")
-
-
-@app.errorhandler(404)
-def page_not_found(e):
-    return render_template("404.html"), 404
-
-
-if __name__ == "__main__":
-    app.run(
-        debug=True,
-        host=socket.gethostbyname(socket.gethostname()),
-    )
+    return render_template("index.html")
+
+@app.get("/list")
+def list():    
+    todo_list = db.session.query(Todo).all()
+    return render_template("list.html", todo_list=todo_list)
+
+@app.get("/todo/<int:todo_id>")
+def todo(todo_id):    
+    todo = db.session.query(Todo).filter(Todo.id == todo_id).first()
+    if todo is None:
+        return f"No Todo item {todo_id} found.", 404
+    return render_template("todo.html", todo=todo)
+
+@app.post("/add")
+def add():
+    title = request.form.get("title", "").strip()
+    if not title:
+        flash("Title cannot be empty.", "error")
+        return redirect(url_for("list"))
+    if len(title) > 100:
+        flash("Title must be 100 characters or fewer.", "error")
+        return redirect(url_for("list"))
+    new_todo = Todo(title=title, complete=False)
+    db.session.add(new_todo)
+    db.session.commit()
+    return redirect(url_for("list"))
+
+
+@app.post("/update/<int:todo_id>")
+def update(todo_id):
+    todo = db.get_or_404(Todo, todo_id)
+    todo.complete = not todo.complete
+    db.session.commit()
+    return redirect(url_for("list"))
+
+
+@app.post("/delete/<int:todo_id>")
+def delete(todo_id):
+    todo = db.get_or_404(Todo, todo_id)
+    db.session.delete(todo)
+    db.session.commit()
+    return redirect(url_for("list"))