diff --git a/app/routes/auth.py b/app/routes/auth.py index 9aeee6a..0ee5f7d 100644 --- a/app/routes/auth.py +++ b/app/routes/auth.py @@ -205,21 +205,26 @@ def register(): return redirect(url_for('main.dashboard')) if request.method == 'POST': + # Build form data from request to preserve state across re-renders + form_data = dict(request.form) + form_data['games'] = request.form.getlist('games') + # Validate CAPTCHA first captcha_answer = request.form.get('captcha_answer', '') if not verify_captcha(captcha_answer): flash('Incorrect CAPTCHA answer. Please try again.', 'danger') - captcha = generate_captcha() # Generate new captcha + captcha = generate_captcha() + # Clear password fields only on CAPTCHA failure + form_data.pop('password', None) + form_data.pop('confirm_password', None) return render_template( 'pages/register.html', esport_games=ESPORT_GAMES, - captcha=captcha + captcha=captcha, + form_data=form_data, ) # Validate input with marshmallow schema - # Convert MultiDict to dict with proper lists for checkbox fields - form_data = dict(request.form) - form_data['games'] = request.form.getlist('games') register_schema = RegisterSchema() try: validated = register_schema.load(form_data) @@ -228,10 +233,14 @@ def register(): for msg in messages: flash(f'{field}: {msg}', 'danger') captcha = generate_captcha() + # Clear password fields on validation failure + form_data.pop('password', None) + form_data.pop('confirm_password', None) return render_template( 'pages/register.html', esport_games=ESPORT_GAMES, - captcha=captcha + captcha=captcha, + form_data=form_data, ) username = validated['username'] @@ -242,25 +251,30 @@ def register(): selected_games = validated.get('games', []) discord_username = validated.get('discord_username') discord_user_id = validated.get('discord_user_id') - trn_username = request.form.get('trn_username', '').strip() or None league_os_profile = validated.get('league_os_profile') if User.query.filter_by(username=username).first(): flash('Username already exists.', 'danger') captcha = generate_captcha() + form_data.pop('password', None) + form_data.pop('confirm_password', None) return render_template( 'pages/register.html', esport_games=ESPORT_GAMES, - captcha=captcha + captcha=captcha, + form_data=form_data, ) if User.query.filter_by(email=email).first(): flash('Email already registered.', 'danger') captcha = generate_captcha() + form_data.pop('password', None) + form_data.pop('confirm_password', None) return render_template( 'pages/register.html', esport_games=ESPORT_GAMES, - captcha=captcha + captcha=captcha, + form_data=form_data, ) hashed_password = hash_password(password) @@ -299,9 +313,14 @@ def register(): flash('Your account has been created! You can now log in.', 'success') return redirect(url_for('auth.login')) - # Generate CAPTCHA only for GET requests + # GET request — render empty form captcha = generate_captcha() - return render_template('pages/register.html', esport_games=ESPORT_GAMES, captcha=captcha) + return render_template( + 'pages/register.html', + esport_games=ESPORT_GAMES, + captcha=captcha, + form_data={}, + ) @auth_bp.route('/discord/login') diff --git a/app/templates/pages/register.html b/app/templates/pages/register.html index 0f2c032..9110ec4 100644 --- a/app/templates/pages/register.html +++ b/app/templates/pages/register.html @@ -3,71 +3,39 @@ {% block auth_content %}