patched blogpost, update cdn dist

services/blogpost/chall/app.py

@@ -207,19 +207,29 @@ def create_post():
 
 @app.route('/uploads/<path:filename>')
 def uploaded_file(filename):
+    if "user_id" not in session:
+        return redirect(url_for("login"))
+    if ".." in filename or filename.startswith("/"):
+        abort(404)
+    db = get_db()
+    cur = db.execute("SELECT id FROM posts WHERE image_filename = ? AND author_id = ?", (filename, session["user_id"]))
+    row = cur.fetchone()
+    if not row:
+        abort(404)
     return send_from_directory(app.config['UPLOAD_FOLDER'], filename)
 
 @app.route("/post/<int:pid>")
 def view_post(pid):
+    if "user_id" not in session:
+        return redirect(url_for("login"))
     db = get_db()
     cur = db.execute(
-        "SELECT p.*, u.username as author FROM posts p LEFT JOIN users u ON p.author_id = u.id WHERE p.id = ?",
+        "SELECT p.*, u.username as author FROM posts p LEFT JOIN users u ON p.author_id = u.id WHERE p.id = ? AND p.author_id = ?",
-        (pid,)
+        (pid, session["user_id"])
     )
     post = cur.fetchone()
     if not post:
         abort(404)
-
     return render_template("view_post.html", post=post)
 
 @app.route("/profile")