27 lines
1.5 KiB
Python
27 lines
1.5 KiB
Python
#!/usr/bin/env python3
|
|
"""unlock.py [--wrong] — the recovery page's „Mentések feloldása": the same form POST (/recovery/unlock, recovery_code)
|
|
with the session and CSRF token. The code comes from env REHEARSAL_2026_10_20_RECOVERY_CODE (under `sec run`); with
|
|
--wrong its last word is replaced (a household's typo). Prints the status, the redirect and the visible message only."""
|
|
import html, os, re, sys, urllib.parse
|
|
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
|
|
import ctl
|
|
code = os.environ["REHEARSAL_2026_10_20_RECOVERY_CODE"].strip()
|
|
if "--wrong" in sys.argv:
|
|
w = code.split()
|
|
w[-1] = "alma" if w[-1] != "alma" else "korte"
|
|
code = " ".join(w)
|
|
ctl.login()
|
|
page = ctl._curl(["-H", "Cookie: " + ctl._SESS, ctl.BASE + "/recovery"])
|
|
m = re.search(r'name="_csrf" value="([^"]+)"', page) or re.search(r'name="csrf_token" value="([^"]+)"', page)
|
|
fields = {"recovery_code": code}
|
|
if m:
|
|
fields[m.group(0).split('"')[1]] = m.group(1)
|
|
hdr = os.path.join(ctl._T, "uh")
|
|
body = ctl._curl(["-D", hdr, "-H", "Cookie: " + ctl._SESS, "-H", "X-CSRF-Token: " + ctl._CSRF, "-X", "POST",
|
|
"-H", "Content-Type: application/x-www-form-urlencoded", "--data-binary", "@-", ctl.BASE + "/recovery/unlock"],
|
|
inp=urllib.parse.urlencode(fields), timeout=900)
|
|
h = open(hdr).read()
|
|
print("status:", [l for l in h.splitlines() if l.lower().startswith(("http/", "location"))])
|
|
body = re.sub(r"<(script|style)[^>]*>.*?</\1>", "", body, flags=re.S)
|
|
print("page:", re.sub(r"\s+", " ", html.unescape(re.sub(r"<[^>]+>", " ", body))).strip()[:1500])
|