@@ -4,7 +4,7 @@ DROP TABLE IF EXISTS user_links;

 DROP TABLE IF EXISTS users;

 CREATE TABLE users (

   id SERIAL UNIQUE NOT NULL,

-  name TEXT UNIQUE NOT NULL,

+  name TEXT UNIQUE NOT NULL CHECK (name <> ''),

   password TEXT NOT NULL,

   email TEXT NOT NULL,

   PRIMARY KEY (id)

@@ -1,5 +1,6 @@

 Flask==0.10.1

-psycopg2==2.6

 Flask-Cors==1.10.3

+Flask-Limiter==0.7.6

+psycopg2==2.6

 psycopg2==2.6

 uWSGI==2.0.9

@@ -1,4 +1,5 @@

-from flask import Flask, g

+from flask import Flask, g, request

+from flask_limiter import Limiter

 import os

 import base64

@@ -20,6 +21,10 @@ except ImportError:

 app.secret_key = config.secret_key

 app.debug = config.debug

+limiter = Limiter(app)

+limiter.limit("60/hour 3/second", key_func=lambda: request.host)(user.user_blueprint)

+limiter.limit("dd")(user.user_blueprint)

+

 # Blueprints #

 user.get_users(app)

 app.register_blueprint(user.user_blueprint, url_prefix='/user')

@@ -1,8 +1,12 @@

+import json

+

 import flask

-from flask.ext.cors import cross_origin

 from flask import Blueprint, session, redirect, url_for, escape, request, abort, g

+from flask_limiter import Limiter

+from flask.ext.cors import cross_origin

+import psycopg2

+

 from . import database

-import json

 user_blueprint = Blueprint('user', __name__)

@@ -58,17 +62,32 @@ def subscribe(username):

 @user_blueprint.route('/add', methods=['POST'])

 def adduser():

     db = database.get_db()

+    result = {'status': False, 'message': ''}

     with db.cursor() as cur:

         obj = request.get_json();

-        username, password = obj['username'], obj['password']

-        username = username.strip().lower()

-        password = password.strip()

-        cur.execute('INSERT INTO users (name,password,email) VALUES (%s,%s,%s)',

-                    (username, password, 'abc@def.com'))

-        _get_users()

-        db.commit()

-        session['username'] = username

-        return json.dumps(True)

+        try:

+            username, password = obj['username'], obj['password']

+        except KeyError:

+            print obj

+            result['message'] = 'Username required' if 'username' not in obj else 'Password required'

+        else:

+            username = username.strip().lower()

+            password = password.strip()

+            try:

+                cur.execute('INSERT INTO users (name,password,email) VALUES (%s,%s,%s)',

+                            (username, password, 'abc@def.com'))

+                session['username'] = username

+                result['status'] = True

+                _get_users()

+            except psycopg2.IntegrityError as e:

+                db.rollback()

+                if e.pgcode == '23505': #username not unique

+                    result['message'] = 'Username in use'

+                elif e.pgcode == '23502': #username empty

+                    result['message'] = 'Username required'

+                else: raise

+            else: db.commit()

+    return json.dumps(result)

 @user_blueprint.route('/check')

 def checkuser():

@@ -82,7 +101,7 @@ def gen_ak(db):

 @cross_origin(allow_headers='Content-Type')

 def login():

     obj = request.get_json();

-    result = False

+    result = {'status': False, 'message': ''}

     username, password = obj['username'], obj['password']

     username = username.strip().lower()

     password = password.strip()

@@ -97,7 +116,9 @@ def login():

             result = {'success': True, 'ak': ak}

         else:

             session['username'] = username

-            result = True

+            result['status'] = True

+    else:

+        result['message'] = 'Wrong Username or Password'

     return json.dumps(result)

 @user_blueprint.route('/logout')

@@ -132,6 +132,13 @@ main form input[type="text"] {

 /* @group Login Module */

+#login_form div.message{

+  position: absolute;

+  background: red;

+  width: 100%;

+  text-align: center;

+}

+

 #login_form {

   position: absolute;

   z-index: 100;

@@ -222,6 +229,9 @@ body.is-logged-on #nav-main {

     left: -25%;

     top: 66px;

   }

+  #login_form div.message{

+    top: -33px;

+  }

   #login_form form {

     margin-top: 100px;

   }

@@ -311,6 +321,9 @@ body.is-logged-on #nav-main {

   #login_form form {

     margin-top: 20px;

   }

+  #login_form div.message{

+    margin-top 10px;

+  }

   form input[type="password"] {

   }

@@ -64,6 +64,8 @@ marrowApp.config(['$locationProvider',

 ]);

 marrowApp.controller('LoginCtrl', function ($scope,$http,$route,$location) {

+  $scope.message = '';

+

   check_login().success(

     function(is_loggedon) {

       is_loggedon = JSON.parse(is_loggedon);

@@ -77,8 +79,8 @@ marrowApp.controller('LoginCtrl', function ($scope,$http,$route,$location) {

     console.log(postObj);

     $http.post("/api/user/add", postObj)

     .success(function(added_user) {

-      added_user = JSON.parse(added_user);

-      if(added_user === true) {$location.url('/');}

+      if (added_user.status === true) {$location.url('/');}

+      else {$scope.message = added_user.message;}

     });

   };

@@ -89,10 +91,9 @@ marrowApp.controller('LoginCtrl', function ($scope,$http,$route,$location) {

     $http.post("/api/user/login", {"username":username, "password":password})

     .success(

       function (login_succeeded) {

-        login_succeeded = JSON.parse(login_succeeded);

         var el = angular.element(document.querySelector('#login_form'));

-        if (login_succeeded === true) {el.removeClass('is-hidden');}

-        $location.url('/');

+        if (login_succeeded.status === true) {$location.url('/');}

+        else {$scope.message = login_succeeded.message;}

     });

   };

 });

@@ -231,7 +232,9 @@ marrowApp.controller('SidebarCtrl', function ($scope,$http,$location,$route) {

   };

   $scope.logout = function() {

-    $http.get('/api/user/logout').finally(function() { $location.url('/login'); });

+    $http.get('/api/user/logout').success(function() {

+      $location.url('/login');

+    });

   };

 });

@@ -1,6 +1,6 @@

 <div id="login_form">

-  <div class="message"></div>

   <form>

+    <div class="message">{{message}}</div>

     <input type="text" ng-model="username" placeholder="Username" />

     <input type="password" ng-model="password" placeholder="Password" />

     <button ng-click="login()">Log In</button>