whahn1983 / pycashflow Goto Github PK

Add a skip table with the opposite transaction at the same date and value of the skipped transaction to cancel out the transaction in the cash flow projection.

I just installed this in a docker container on my synology NAS. I created a login, and upon signing in, got a 500 server error to screen.

Error stack is as follows:

ERROR:app:Exception on / [GET]
Traceback (most recent call last):
File "/usr/local/lib/python3.12/site-packages/flask/app.py", line 1463, in wsgi_app
response = self.full_dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/site-packages/flask/app.py", line 872, in full_dispatch_request
rv = self.handle_user_exception(e)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/site-packages/flask/app.py", line 870, in full_dispatch_request
rv = self.dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/site-packages/flask/app.py", line 855, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args) # type: ignore[no-any-return]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/site-packages/flask_login/utils.py", line 290, in decorated_view
return current_app.ensure_sync(func)(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/app/main.py", line 35, in index
return render_template('index.html', title='Index', todaydate=todaydate, balance=balance.amount,
^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'amount'

When calculating the next date for the schedule, if the end of the month is shorter it shifts the schedule back permanently.

Hi there, I cloned your app while doing some searching for a personal project of mine and noticed it is affected by a few security issues. Fortunately the affected functionality requires admin privileges. I know it is not a commercial app or anything, yet there seems to be a small user base hence I guessed you would like to know about it in order to fix them.

The affected endpoints are the following: /signups, /create_user, /update_user, where HTTP POST parameters whose value is controlled by the end-users are passed directly into python's eval() function in order to convert them into type bool. Flask form parameters are always strings and in order to use them as boolean types I would recommend something like the following snippet (True/False values are mapped to 1/0).

if int(request.form['signupvalue']) == 1:
    signupvalue = True
else:
    signupvalue = False
settings = Settings(name="signup", value=signupvalue)

In case you want to test this yourself send the following request to the server (change sleep+5 with any bash command you like :)):

POST /signups HTTP/1.1
Host: 127.0.0.1:5000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
Origin: http://127.0.0.1:5000
...
Connection: close
Cookie: <cookie>

signupvalue=__import__('os').system('sleep+5')

Add error handling.

Add manual refresh to non-admin user

Add pop up message confirming a hold has been added.

Flask-Login is not compatible with Werkzeug 3.0.0 which is required by Flask 3.0.0. Will update requirements when Flask-Login update is available.

Add user management capability to add/remove users.

It isn't working on my install. Is there a DOS version?