0001-encrypt-user-credentials-9534.patch

Josué Kouka, 07 janvier 2016 17:48

Voir les différences: en ligne côte à côte

Subject: [PATCH] encrypt user credentials (#9534)

 debian/control              |  1 +
 mandayejs/mandaye/models.py | 35 +++++++++++++++++++++++++++++++++--
 mandayejs/mandaye/utils.py  |  8 ++++++++
 mandayejs/mandaye/views.py  |  1 +
 mandayejs/settings.py       |  2 +-
 5 files changed, 44 insertions(+), 3 deletions(-)

debian/control
13	13	python-gadjo,
14	14	python-django-jsonfield,
15	15	python-ldap,
	16	python-cryptography
16	17	Recommends: python-django-mellon
17	18	Description: Authentication Reverse Proxy
18	19

     from django.db import models
     from jsonfield import JSONField
     from django.conf import settings
     from django.utils.translation import ugettext_lazy as _
     from jsonfield import JSONField
     from cryptography.fernet import Fernet
     from mandayejs.mandaye.utils import get_password_field
     class UserCredentials(models.Model):
         user = models.ForeignKey('auth.User')
         locators = JSONField(_('locators'), default={}, blank=True)
         linked = models.BooleanField(_('associated'), default=False, blank=True)
         #token = models.CharField(_('encryption token', max_length=128, blank=True))
         class Meta:
             unique_together = ('user',)
-...
                 or self.user.email \
                 or self.user.username
         def to_login_info(self):
         def save(self, *args, **kwargs):
             self.encrypt()
             super(UserCredentials, self).save(*args, **kwargs)
         def encrypt(self,):
             """Encrypt password
             """
             secret_key = settings.SECRET_KEY
             password_field_name = get_password_field()
             f = Fernet(secret_key)
             self.locators[password_field_name] = \
                 f.encrypt(self.locators.get(password_field_name,'').encode('ascii'))
             return self.locators
         def decrypt(self,):
             """Decrypt password
             """
             secret_key = settings.SECRET_KEY
             password_field_name = get_password_field()
             f = Fernet(secret_key)
             self.locators[password_field_name] = \
                 f.decrypt(self.locators.get(password_field_name, '').encode('ascii'))
             return self.locators
         def to_login_info(self, decrypt=False):
             if decrypt:
                 self.decrypt()
             return {'#'+k : v for k,v in self.locators.items() }

         url = url._replace(netloc=settings.SITE_DOMAIN)
         return url.path
     def get_password_field():
         """Return name of the password field
         """
         try:
             field_name = [ field.get('name') for field in settings.SITE_LOCATORS if field.get('kind') == 'password' ]
             return field_name[0]
         except (IndexError,):
             return None

mandayejs/mandaye/views.py
153	153	'auth_checker': os.path.join(site_static_root, site_auth_checker)
154	154	}
155	155	logger.debug(login_info)
	156	login_info['locators'] = [ credentials.to_login_info(decrypt=True)]
156	157	result = exec_phantom(login_info)
157	158	logger.debug(result)
158	159

     # See https://docs.djangoproject.com/en/1.7/howto/deployment/checklist/
     # SECURITY WARNING: keep the secret key used in production secret!
     SECRET_KEY = 'xlf$@r5j*6p5-l#q=bg&t$mlhf=v@fq9^xfs#%712zndtu2#2@'
     SECRET_KEY = 'QJCOqbVnL4jj37b9wd9YQo-2wSvOoGw6OwPu-ErT5QA='
     # SECURITY WARNING: don't run with debug turned on in production!
     DEBUG = True
+    -

Projet

Général

Profil

Produits Entr'ouvert » Mandaye

0001-encrypt-user-credentials-9534.patch