dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

more options with hmac and salt in auth, thanks Dave

Browse Source
This commit is contained in:
mdipierro
2012-07-10 20:40:47 -05:00
parent 6313a83f83
commit b01f7645c8
2 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VERSION
+1 -1
View File
@@ -1 +1 @@
Version 2.00.0 (2012-07-10 00:22:32) dev Version 2.00.0 (2012-07-10 20:40:42) dev
gluon/validators.py
+16 -4
View File
@@ -2546,10 +2546,14 @@ class LazyCrypt(object):
else: else:
salt = self.crypt.salt salt = self.crypt.salt
if ':' in self.crypt.key: if ':' in self.crypt.key:
alg = self.crypt.key.split(':')[0] (alg, hash_key) = self.crypt.key.split(':')
else: else:
alg = self.crypt.digest_alg (alg, hash_key) = self.crypt.digest_alg, None
self.crypted = '%s$%s$%s' % (alg, salt, hmac_hash(self.password+salt, self.crypt.key, alg)) if hash_key:
h = hmac_hash(self.password+salt, self.crypt.key, alg)
else:
h = imple_hash(self.password+salt, alg)
self.crypted = '%s$%s$%s' % (alg, salt, h)
elif self.crypt.key: elif self.crypt.key:
self.crypted = hmac_hash(self.password, self.crypt.key, self.crypt.digest_alg) self.crypted = hmac_hash(self.password, self.crypt.key, self.crypt.digest_alg)
else: else:
@@ -2560,8 +2564,16 @@ class LazyCrypt(object):
compares the current lazy crypted password with a stored password compares the current lazy crypted password with a stored password
""" """
if self.crypt.salt and stored_password.count('$')==2: if self.crypt.salt and stored_password.count('$')==2:
if ':' in self.crypt.key:
hash_key = self.crypt.key.split(':')[1]
else:
hash_key = None
(algorithm, salt, hash) = stored_password.split('$') (algorithm, salt, hash) = stored_password.split('$')
temp_pass = '%s$%s$%s' % (algorithm, salt, hmac_hash(self.password+salt, self.crypt.key, algorithm)) if hash_key:
h = hmac_hash(self.password+salt, self.crypt.key, algorithm)
else:
h = simple_hash(self.password+salt, algorithm)
temp_pass = '%s$%s$%s' % (algorithm, salt, h)
else: else:
temp_pass = str(self) temp_pass = str(self)
return temp_pass == stored_password return temp_pass == stored_password