From 8f8ef4cca59c9a72f4c104427726ff2bae5314b7 Mon Sep 17 00:00:00 2001 From: mdipierro Date: Thu, 24 Mar 2016 16:58:04 -0500 Subject: [PATCH] fixed sessions for long keys --- gluon/utils.py | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/gluon/utils.py b/gluon/utils.py index 4bcdcc19..472bf31a 100644 --- a/gluon/utils.py +++ b/gluon/utils.py @@ -163,11 +163,8 @@ def get_callable_argspec(fn): def pad(s, n=32, padchar=' '): - if len(s)n: - s = s[:n] - return s + return s + (32 - len(s) % 32) * padchar + def secure_dumps(data, encryption_key, hash_key=None, compression_level=None): if not hash_key: @@ -175,7 +172,7 @@ def secure_dumps(data, encryption_key, hash_key=None, compression_level=None): dump = pickle.dumps(data, pickle.HIGHEST_PROTOCOL) if compression_level: dump = zlib.compress(dump, compression_level) - key = pad(encryption_key) + key = pad(encryption_key)[:32] cipher, IV = AES_new(key) encrypted_data = base64.urlsafe_b64encode(IV + cipher.encrypt(pad(dump))) signature = hmac.new(hash_key, encrypted_data).hexdigest() @@ -191,7 +188,7 @@ def secure_loads(data, encryption_key, hash_key=None, compression_level=None): actual_signature = hmac.new(hash_key, encrypted_data).hexdigest() if not compare(signature, actual_signature): return None - key = pad(encryption_key[:32]) + key = pad(encryption_key)[:32] encrypted_data = base64.urlsafe_b64decode(encrypted_data) IV, encrypted_data = encrypted_data[:16], encrypted_data[16:] cipher, _ = AES_new(key, IV=IV)