dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed sessions for long keys

Browse Source
This commit is contained in:
mdipierro
2016-03-24 16:58:04 -05:00
parent c9e92fc686
commit 8f8ef4cca5
1 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gluon/utils.py
+4 -7
View File
@@ -163,11 +163,8 @@ def get_callable_argspec(fn):
def pad(s, n=32, padchar=' '):
if len(s)<n:
s += (32 - len(s)) * padchar
elif len(s)>n:
s = s[:n]
return s
return s + (32 - len(s) % 32) * padchar
def secure_dumps(data, encryption_key, hash_key=None, compression_level=None):
if not hash_key:
@@ -175,7 +172,7 @@ def secure_dumps(data, encryption_key, hash_key=None, compression_level=None):
dump = pickle.dumps(data, pickle.HIGHEST_PROTOCOL)
if compression_level:
dump = zlib.compress(dump, compression_level)
key = pad(encryption_key)
key = pad(encryption_key)[:32]
cipher, IV = AES_new(key)
encrypted_data = base64.urlsafe_b64encode(IV + cipher.encrypt(pad(dump)))
signature = hmac.new(hash_key, encrypted_data).hexdigest()
@@ -191,7 +188,7 @@ def secure_loads(data, encryption_key, hash_key=None, compression_level=None):
actual_signature = hmac.new(hash_key, encrypted_data).hexdigest()
if not compare(signature, actual_signature):
return None
key = pad(encryption_key[:32])
key = pad(encryption_key)[:32]
encrypted_data = base64.urlsafe_b64decode(encrypted_data)
IV, encrypted_data = encrypted_data[:16], encrypted_data[16:]
cipher, _ = AES_new(key, IV=IV)