added path traversal

Author: vlussenburg

src/main.py

@@ -1,6 +1,7 @@
-from fastapi import FastAPI, Request, Response
+from fastapi import FastAPI, Request, Response, HTTPException
 import os
 import sqlite3
+from os.path import isfile
 
 app = FastAPI()
 con = sqlite3.connect(':memory:')
@@ -36,12 +37,22 @@ async def root():
     return {"message": "Hello World"}
 
 
-@app.get("/login")
+@app.post("/login")
 async def login(email: str, password: str):
     cur = con.cursor()
     cur.execute("SELECT * FROM users WHERE email = '%s' and password = '%s'" % (email, password))
-    return cur.fetchone() is not None
+    if  cur.fetchone():
+        return email;
 
 @app.get("/logout")
-async def root(email: str):
+async def logout(email: str):
     return {"message": "Logged out %s!" % email}
+
+@app.get("/attachment")
+async def attachment(attachment_name: str):
+    attachment_path = 'attachments/' + attachment_name
+    if not isfile(attachment_path):
+        raise HTTPException(status_code=404, detail="Attachment not found")
+
+    with open(attachment_path) as f:
+        return f.readlines()