Flaschengeist/flaschengeist
Flaschengeist
/
flaschengeist
7
0
Fork 0
Code Issues 20 Pull Requests Packages Projects Releases 2 Wiki Activity

Fixed guessing of accesstoken, using python.secrets library. Fixes #399

This commit is contained in:
Ferdinand Thiessen 2020-08-25 21:17:36 +02:00
parent 6581dfd50e
commit 07a0d266a6
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
geruecht/controller/accesTokenController.py
View File

@ -4,7 +4,7 @@ import geruecht.controller.mainController as mc
import geruecht.controller.databaseController as dc import geruecht.controller.databaseController as dc
from geruecht.model import BAR from geruecht.model import BAR
from datetime import datetime, timedelta from datetime import datetime, timedelta
import hashlib import secrets
from . import Singleton from . import Singleton
from geruecht.logger import getDebugLogger from geruecht.logger import getDebugLogger
@ -95,7 +95,7 @@ class AccesTokenController(metaclass=Singleton):
""" """
debug.info("creat accesstoken") debug.info("creat accesstoken")
now = datetime.ctime(datetime.now()) now = datetime.ctime(datetime.now())
token = hashlib.md5((now + user.dn).encode('utf-8')).hexdigest() token = secrets.token_hex(16)
self.checkBar(user) self.checkBar(user)
accToken = db.createAccessToken(user, token, self.lifetime, datetime.now(), lock_bar=False, user_agent=user_agent) accToken = db.createAccessToken(user, token, self.lifetime, datetime.now(), lock_bar=False, user_agent=user_agent)
debug.debug("accesstoken is {{ {} }}".format(accToken)) debug.debug("accesstoken is {{ {} }}".format(accToken))

3
geruecht/model/accessToken.py
View File

@ -1,4 +1,5 @@
from datetime import datetime from datetime import datetime
from secrets import compare_digest
from geruecht.logger import getDebugLogger from geruecht.logger import getDebugLogger
debug = getDebugLogger() debug = getDebugLogger()
@ -67,7 +68,7 @@ class AccessToken():
return dic return dic
def __eq__(self, token): def __eq__(self, token):
return True if self.token == token else False return compare_digest(self.token, token)
def __sub__(self, other): def __sub__(self, other):
return other - self.timestamp return other - self.timestamp