prog1764
896c26bd57
- IDOR: отмена/редактирование брони только владельцем (проверка user_id) - пароль админа: убран дефолт admin123, обязателен из env; сравнение через hmac.compare_digest; TTL сессии 1ч - callback_data: безопасный парсинг int + .get() вместо прямого индексирования (KeyError/ValueError)
110 lines
3.3 KiB
Python
110 lines
3.3 KiB
Python
from aiogram import Router, F
|
|
from aiogram.types import Message, CallbackQuery
|
|
from aiogram.fsm.context import FSMContext
|
|
|
|
from app.db.memory import get_user_bookings, get_booking, cancel_booking, update_booking
|
|
from app.keyboards.menu import menu
|
|
from app.keyboards.my_booking import get_booking_actions
|
|
from app.logger import logger
|
|
|
|
router = Router()
|
|
|
|
|
|
@router.message(
|
|
F.text == "📄 Мои записи"
|
|
)
|
|
async def my_bookings(
|
|
message: Message
|
|
):
|
|
logger.info("User {uid} opened My Bookings", uid=message.from_user.id)
|
|
try:
|
|
bookings = get_user_bookings(
|
|
message.from_user.id
|
|
)
|
|
logger.debug("Found {n} bookings", n=len(bookings))
|
|
|
|
if not bookings:
|
|
await message.answer(
|
|
"У вас нет активных записей"
|
|
)
|
|
return
|
|
|
|
for booking in bookings:
|
|
svc = booking["service"]
|
|
mst = booking["master"]
|
|
dat = booking["date"]
|
|
tim = booking["time"]
|
|
text = "💆 " + svc + "\n"
|
|
text += "👤 " + mst + "\n"
|
|
text += "📅 " + dat + "\n"
|
|
text += "🕒 " + tim
|
|
await message.answer(
|
|
text,
|
|
reply_markup=get_booking_actions(
|
|
booking["id"]
|
|
)
|
|
)
|
|
except Exception as e:
|
|
logger.exception("Error in my_bookings: {error}", error=e)
|
|
await message.answer(
|
|
"Произошла ошибка. Попробуйте позже."
|
|
)
|
|
|
|
|
|
@router.callback_query(
|
|
F.data.startswith("cancel_booking_")
|
|
)
|
|
async def cancel_booking_handler(callback: CallbackQuery):
|
|
try:
|
|
booking_id = int(callback.data.split("_", 2)[2])
|
|
except (ValueError, IndexError):
|
|
await callback.answer("Некорректные данные")
|
|
return
|
|
|
|
booking = get_booking(booking_id)
|
|
if not booking or booking.get("user_id") != callback.from_user.id:
|
|
logger.warning("User {uid} tried to cancel foreign booking #{bid}", uid=callback.from_user.id, bid=booking_id)
|
|
await callback.answer("⛔ Это не ваша запись")
|
|
return
|
|
|
|
logger.info("User {uid} cancelled booking #{bid}", uid=callback.from_user.id, bid=booking_id)
|
|
cancel_booking(
|
|
booking_id
|
|
)
|
|
await callback.message.edit_text(
|
|
"Запись отменена"
|
|
)
|
|
await callback.answer()
|
|
|
|
|
|
@router.callback_query(
|
|
F.data.startswith("edit_booking_")
|
|
)
|
|
async def edit_booking_handler(
|
|
callback: CallbackQuery,
|
|
state: FSMContext
|
|
):
|
|
try:
|
|
booking_id = int(callback.data.split("_", 2)[2])
|
|
except (ValueError, IndexError):
|
|
await callback.answer("Некорректные данные")
|
|
return
|
|
|
|
booking = get_booking(booking_id)
|
|
if not booking or booking.get("user_id") != callback.from_user.id:
|
|
logger.warning("User {uid} tried to edit foreign booking #{bid}", uid=callback.from_user.id, bid=booking_id)
|
|
await callback.answer("⛔ Это не ваша запись")
|
|
return
|
|
|
|
update_booking(
|
|
booking_id=booking_id,
|
|
service="",
|
|
master="",
|
|
date="",
|
|
time=""
|
|
)
|
|
|
|
await callback.answer(
|
|
"Редактирование не поддерживается"
|
|
)
|