Patched code sample

import os
from functools import wraps
from flask import Flask, session, Response, redirect, url_for

# --- Configuration and Setup ---

# In a real application, this would come from a secure configuration file.
SECRET_KEY = os.urandom(24)
LOG_FILE_PATH = "/tmp/sensitive_debug.log"

app = Flask(__name__)
app.secret_key = SECRET_KEY

# --- The Vulnerability Fix ---

def admin_required(f):
    """
    A decorator to ensure a user is logged in as an admin.
    This is the core of the fix, preventing unauthenticated access.
    """
    @wraps(f)
    def decorated_function(*args, **kwargs):
        # FIX: Check if a user is authenticated and authorized.
        # Here, we check for a specific flag in the user's session.
        if not session.get('is_admin'):
            # If the check fails, deny access.
            return "Forbidden: You do not have permission to access this resource.", 403
        
        # If the check passes, proceed to the original function.
        return f(*args, **kwargs)
    return decorated_function

# --- Route Definitions ---

@app.route('/message_log')
@admin_required  # <-- APPLYING THE FIX: This route is now protected.
def show_message_log():
    """
    Displays the content of the sensitive debug log file.
    Access is now restricted to authenticated admin users by the @admin_required
    decorator, which fixes the original vulnerability.
    """
    try:
        # This part of the code is now only reachable by authenticated admins.
        with open(LOG_FILE_PATH, 'r') as log_file:
            log_content = log_file.read()
        
        # Display the log content in a preformatted block for readability.
        return Response(f"<pre>{log_content}</pre>", mimetype='text/html')
    
    except FileNotFoundError:
        return "Log file not found.", 404
    except Exception as e:
        # Avoid leaking detailed exception info in a production environment.
        return "An internal error occurred.", 500

# --- Helper Routes for Demonstration ---

@app.route('/')
def index():
    """Provides instructions for demonstrating the fix."""
    instructions = """
    <h1>Demonstration of CVE-2020-36876 Fix</h1>
    <p>1. <a href="/message_log">Try to access the message_log (will be denied)</a></p>
    <p>2. <a href="/login_as_admin">Log in as an admin</a></p>
    <p>3. <a href="/message_log">Try to access the message_log again (will be allowed)</a></p>
    <p>4. <a href="/logout">Log out</a></p>
    """
    return instructions

@app.route('/login_as_admin')
def login_as_admin():
    """Simulates a user logging in and gaining admin privileges."""
    session['is_admin'] = True
    return 'You are now logged in as an administrator. <a href="/message_log">Access the log</a>.'

@app.route('/logout')
def logout():
    """Simulates a user logging out."""
    session.pop('is_admin', None)
    return 'You have been logged out. <a href="/">Back to home</a>.'

# --- Main Execution Block for Demonstration ---

if __name__ == '__main__':
    # Create a dummy sensitive log file for the demonstration.
    try:
        with open(LOG_FILE_PATH, 'w') as f:
            f.write("--- ReQuest F3 Media Server Python Debug Log ---\n")
            f.write("INFO: System boot process initiated.\n")
            f.write("DEBUG: DB_USER='admin'\n")
            f.write("DEBUG: DB_PASSWORD='HardcodedPassword123!'\n")
            f.write("DEBUG: Filesystem Path: /usr/local/app/media_server\n")
            f.write("INFO: Process started with args: ['--daemon', '--port', '80']\n")
            f.write("ERROR: Unauthenticated access attempt from IP 192.168.1.100\n")
        print(f"Dummy log file created at {LOG_FILE_PATH}")
    except IOError as e:
        print(f"Error: Could not create dummy log file. Please check permissions for {LOG_FILE_PATH}.")
        print(f"Details: {e}")

    print("\nStarting Flask server to demonstrate the fix...")
    print("Open http://127.0.0.1:5000 in your browser.")
    
    # Note: debug=True is for demonstration purposes only.
    # It should be False in a production environment.
    app.run(host='127.0.0.1', port=5000, debug=True)