js测验

const express = require("express")
const cookieParser = require("cookie-parser")
const ejs = require("ejs")// 猜测漏洞是ejs模板的问题，然后flag再 env中
require("dotenv").config()

const app = express()
app.use(express.urlencoded({ extended: true }))
app.use(cookieParser())
app.set("view engine", "ejs")
app.use(express.static("public"))

const users = [//这里看着像定义用户信息之类的
    {
        userID: "972",
        username: "kupatergent",
        password: "gandal"
    },
    {
        userID: "****",
        username: "admin"
    }
]

app.get("/", (req, res) => {
    const admin = users.find(u => u.username === "admin")//这里获得的就是当前的对象
    //需要我们传一个userData名字的cookie
    if(req.cookies && req.cookies.userData && req.cookies.userData.userID) {//这是判断cookies中userData字段 继续userId
        const {userID, username} = req.cookies.userData//传送一个json

        if(req.cookies.userData.userID === admin.userID) //这里因为本来的userid就是不可见的
            res.render("home.ejs", {username: username, flag: process.env.FLAG})//这里如果满足才会出现flag
        else res.render("home.ejs", {username: username, flag: "no flag for you"})
    } else {
        res.render("unauth.ejs")
    }
})

app.route("/login")
.get((req, res) => {
    if(req.cookies.userData && req.cookies.userData.userID) {
        res.redirect("/")
    } else {
        res.render("login.ejs", {err: false})
    }
})
.post((req, res)=> {
    const request = {
        username: req.body.username,
        password: req.body.password
    }
    const user = users.find(u => (u.username === request.username && u.password === request.password))
    if(user) {
        res.cookie("userData", {userID: user.userID, username: user.username})
        res.redirect("/")
    } else {
        res.render("login", {err: true}) // didn't work!
    }
})

app.get("/logout", (req, res) => {
    res.clearCookie("userData")
    res.redirect("/login")
}) 

app.listen(3000, (err) => {
    if (err) console.log(err);
    else console.log("connected at 3000 :)");
})