04/28 Fixed some security issues

app.py

@@ -99,7 +99,45 @@ def create_app() -> Flask:
     from extensions import logger_handler as _lh
     create_location_logging_routes(app, db, _lh)
 
+    # ------------------------------------------------------------------
+    # Security: CSRF protection + rate-limiting via SecurityManager
+    # ------------------------------------------------------------------
+    from advanced_security_middleware import SecurityManager, generate_csrf_token
+    from extensions import logger_handler as _lh2
+    security_manager = SecurityManager()
+    security_manager.init_app(app, db, _lh2)
 
+    # Endpoints exempt from CSRF validation:
+    #   - login / register  (no session token exists yet)
+    #   - qr_checkin        (public, unauthenticated QR scan endpoint)
+    _CSRF_EXEMPT = {'auth.login', 'auth.register', 'qr_codes.qr_checkin', 'static'}
+
+    @app.before_request
+    def csrf_protect():
+        """Validate CSRF token on every state-mutating request."""
+        if request.method not in ('POST', 'PUT', 'PATCH', 'DELETE'):
+            return
+        if request.endpoint in _CSRF_EXEMPT:
+            return
+        token = (request.form.get('csrf_token')
+                 or request.headers.get('X-CSRF-Token'))
+        expected = session.get('csrf_token')
+        import hmac as _hmac
+        if not token or not expected or not _hmac.compare_digest(token, expected):
+            _lh2.logger.warning(
+                f"CSRF validation failed | endpoint={request.endpoint} "
+                f"| ip={request.remote_addr} | user={session.get('username','anon')}"
+            )
+            from flask import abort
+            abort(403)
+
+    # Make generate_csrf_token() available in every template as csrf_token()
+    @app.context_processor
+    def inject_csrf_token():
+        return {'csrf_token': generate_csrf_token}
+
+    # Expose security_manager to routes that need it (login rate-limiting)
+    app.security_manager = security_manager
 
     # ------------------------------------------------------------------
     # Template filters (global — must be on app, not blueprints)