diff --git a/README.md b/README.md index a7e2686..7efbb87 100644 --- a/README.md +++ b/README.md @@ -16,6 +16,14 @@ Less than 30 lines of Python + 40 lines HTML template. As you started the flask app in development mode, any source changes should apply immediately so you can just refresh the page. If you want to clear the database, just delete the `database.db` file that is (re-)created on first use. +If you are running flask directly and want to run it on all your IP addresses so that others on your LAN can access it (e.g., for a classroom demo -- please do not use this for production on the Internet!), you can do: + +``` +$ flask run --host=0.0.0.0 +``` + +Again, this should only be used temporarily and in a relatively safe environment. + # Making it vulnerable To demonstrate XSS flaws you can change diff --git a/app.py b/app.py index 58cf737..a44d86b 100644 --- a/app.py +++ b/app.py @@ -6,6 +6,11 @@ @app.route('/', methods=['GET', 'POST']) def index(): + + name = '' + if request.method == 'GET': + name = request.args.get('name','') + if request.method == 'POST': db.add_comment(request.form['comment']) @@ -14,5 +19,6 @@ def index(): comments = db.get_comments(search_query) return render_template('index.html', + name=name, comments=comments, search_query=search_query) diff --git a/templates/index.html b/templates/index.html index abf6262..558edd5 100644 --- a/templates/index.html +++ b/templates/index.html @@ -12,6 +12,9 @@

XSS Demo

+ {% if name %} +

Welcome, {{ name }}!

+ {% endif %}

Read, search and post comments