From b1ead76963ab5659e580c58ba3b0cb03222c880e Mon Sep 17 00:00:00 2001
From: Aaron Lee <longyklee@gmail.com>
Date: Mon, 4 Oct 2021 22:01:32 +0800
Subject: [PATCH] Prevent web crawlers

---
 app.py                             | 11 ++++++-----
 templates/forgotPassword.html      |  1 +
 templates/login.html               |  1 +
 templates/verifiedChgPassword.html |  2 +-
 4 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/app.py b/app.py
index 7c7fc22..f3a2ab8 100644
--- a/app.py
+++ b/app.py
@@ -222,14 +222,15 @@ def forgotPassword():
 
 @app.route('/resetPassword', methods=['GET', 'POST'])
 def resetPassword():
+    if request.args.get('oobCode') is None:
+        return abort(404)
     if request.method == 'GET':
-        session['oobCode'] = request.args.get('oobCode')
-        return render_template('verifiedChgPassword.html')
+        return render_template('verifiedChgPassword.html', oobCode=request.args.get('oobCode'))
     else:
         try:
             if (verify_recaptcha("")):
                 auth.verify_password_reset_code(
-                    session['oobCode'], request.form['password'])
+                    request.args.get('oobCode'), request.form['password'])
                 print("resetPassword success:", flush=True)
                 session.clear()
                 flash('重置密碼成功，請重新登入<br>Password reset success. Please login again.')
@@ -240,11 +241,11 @@ def resetPassword():
                     'reCAPTCHA 錯誤，請稍後再試一次<br>reCAPTCHA Failed. Please try again later.')
                 return redirect('/resetPassword')
         except Exception as e:
-            print("Error*resetPassword:", session['oobCode'], str(json.loads(e.args[1])[
+            print("Error*resetPassword:", request.args.get('oobCode'), str(json.loads(e.args[1])[
                   'error']['message']), flush=True)
             flash(str(json.loads(e.args[1])[
                   'error']['message']))
-            return redirect('/resetPassword')
+            return redirect('/resetPassword?mode=resetPassword&oobCode=' + request.args.get('oobCode'))
 
 
 @ app.route('/logout', methods=['GET'])
diff --git a/templates/forgotPassword.html b/templates/forgotPassword.html
index 01d56d8..d86a6b1 100644
--- a/templates/forgotPassword.html
+++ b/templates/forgotPassword.html
@@ -4,6 +4,7 @@
     <meta charset="utf-8">
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
     <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="robots" content="noindex" />
     <title>Attendance 點名系統 (β)</title>
     <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.1/dist/css/bootstrap.min.css" rel="stylesheet"
         integrity="sha384-F3w7mX95PdgyTmZZMECAngseQB83DfGTowi0iMjiWaeVhAn4FJkqJByhZMI3AhiU" crossorigin="anonymous">
diff --git a/templates/login.html b/templates/login.html
index 329b0ce..76e049d 100644
--- a/templates/login.html
+++ b/templates/login.html
@@ -4,6 +4,7 @@
     <meta charset="utf-8">
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
     <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="robots" content="noindex" />
     <title>Attendance 點名系統 (β)</title>
     <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.1/dist/css/bootstrap.min.css" rel="stylesheet"
         integrity="sha384-F3w7mX95PdgyTmZZMECAngseQB83DfGTowi0iMjiWaeVhAn4FJkqJByhZMI3AhiU" crossorigin="anonymous">
diff --git a/templates/verifiedChgPassword.html b/templates/verifiedChgPassword.html
index 7591dcc..b4914d0 100644
--- a/templates/verifiedChgPassword.html
+++ b/templates/verifiedChgPassword.html
@@ -30,7 +30,7 @@
         <div class="row">
             <div class="col"></div>
             <div class="col-md-5">
-                <form action="/resetPassword" id="password_form" method="post">
+                <form action="/resetPassword?mode=resetPassword&oobCode={{oobCode}}" id="password_form" method="post">
                     <div class="form-group row" style="margin-bottom: 10px;">
                         <label for="password">New Password 新密碼:</label><br>
                         <div class="input-group mb-3 hasSmall">