From b1f525c714723331390532a3ead442b387b67cab Mon Sep 17 00:00:00 2001
From: Erik Thiele <erik.thiele@cancom.de>
Date: Tue, 30 Jun 2026 19:11:44 +0200
Subject: [PATCH] proxyfix

---
 app.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/app.py b/app.py
index 79078cf..88d6b1f 100755
--- a/app.py
+++ b/app.py
@@ -25,6 +25,8 @@ from functools import wraps
 from datetime import datetime
 from pathlib import Path
 
+from werkzeug.middleware.proxy_fix import ProxyFix
+
 from flask import (
     Flask, jsonify, render_template,
     send_from_directory, redirect,
@@ -53,6 +55,7 @@ UPLOAD_EXTENSIONS = {".jpg", ".jpeg", ".png", ".mp4"}
 
 app = Flask(__name__)
 app.secret_key = "CHANGE_THIS_SECRET!!!"
+app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1)
 
 @app.context_processor
 def inject_globals():
@@ -769,6 +772,7 @@ def add_customer():
 
 
 @app.route("/api/customer", methods=["POST"])
+@login_required
 def api_add_customer():
     """
     API-Endpunkt für die Willkommensseite (JSON).
@@ -792,6 +796,9 @@ def api_add_customer():
         if not site:
             return jsonify({"error": "No site configured"}), 400
 
+        if not current_user.can_access_site(site):
+            return jsonify({"error": "Access denied"}), 403
+
         logo_url = generate_welcome_page.search_customer_logo(customer_name)
 
         if not logo_url: