"""Dispatches the request and on top of that performs request
pre and postprocessing as well as HTTP exception catching and
error handling.
File "/app/app.py", line 81, in login
return redirect(url_for('login'))
@app.route('/login', methods=['GET', 'POST'])
def login():
if request.method == 'POST':
user = verify_login(request.form['username'], request.form['password'])
if user:
# 只有这里才写有效 session
session['user_id'] = user[0]
session['username'] = user[1]
session['logged_in'] = True
File "/app/app.py", line 62, in verify_login
def verify_login(username: str, password: str):
conn = sqlite3.connect('database.db')
c = conn.cursor()
# 仍存在 SQL 注入（题目需要），可随意打
query = f"SELECT * FROM users WHERE username='{username}' AND password='{password}'"
c.execute(query)
user = c.fetchone()
conn.close()
return user
# -------------------- 全局拦截器 --------------------
sqlite3.OperationalError: no such table: information_schema.tables
The debugger caught an exception in your WSGI application. You can now look at the traceback which led to the error.
To switch between the interactive traceback and the plaintext one, you can click on the "Traceback" headline. From the text traceback you can also create a paste of it. For code execution mouse-over the frame you want to debug and click on the console icon on the right side.
You can execute arbitrary Python code in the stack frames and there are some extra helpers available for introspection:
dump() shows all variables in the frame dump(obj) dumps all that's known about the object
Brought to you by DON'T PANIC, your friendly Werkzeug powered traceback interpreter.
于是把整个数据库全端了
1 2 3 4 5 6 7
所有表：users,sqlite_autoindex_users_1,sqlite_sequence,files users表信息： id username password 1 admin adminajsnajdhashdn 2 user qwertyuioppoiuytrewq sqlite_autoindex_users_1,sqlite_sequence都是空的 files表没用，记录着上传的文件的名字和路径
