#!/usr/bin/env python3 from flask import Flask, request, Response, redirect from flask_limiter import Limiter from flask_limiter.util import get_remote_address from uuid import NAMESPACE_OID, uuid5 as uuid4 app = Flask(__name__) limiter = Limiter( app, key_func=get_remote_address, default_limits=["50000 per hour"], storage_uri="memory://", ) user_db = {} usernames = set() class User: def __init__(self, username, text): if username in usernames: self.secret_uid = None return usernames.add(username) self.username = username self.text = text self.secret_uid = str(uuid4(NAMESPACE_OID, username)) user_db[self.secret_uid] = self @app.route('/') @limiter.limit("5/second") def index(): return Response(open(__file__).read(), mimetype='text/plain') @app.route('/new', methods=['GET']) @limiter.limit("5/second") def new_get(): return open("new.html").read() @app.route('/new', methods=['POST']) @limiter.limit("5/second") def new_push(): text = request.form['text'] user = request.form["user"] new_user = User(user, text) return redirect(f"/user/{new_user.secret_uid}") @app.route('/user/', methods=['GET']) @limiter.limit("5/second") def user_get(user_id): if user_id == "None": return "That user doesn't exist!" user = user_db[user_id] return f"Current user: {user.username}

{user.text}" User("puzzler7", open("flag.txt").read()) app.run('0.0.0.0', 8000)