Mercurial > p > roundup > code

annotate roundup/cgi/timestamp.py @ 7809:be6cb2e0d471

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
feat: add support for rotating jwt keys This allows jwt_secret to have multiple ',' separated secrets. The first/leftmost should be used to sign new JWTs. All of them are used (starting from left/newest) to try to verify a JWT. If the first secret is < 32 chars in length JWTs are disabled. If any of the other secrets are < 32 chars, the configuration code causes the software to exit. This prevents insecure (too short) secrets from being used. Updated doc examples and tests.
author John Rouillard <rouilj@ieee.org>
date Thu, 14 Mar 2024 19:04:19 -0400
parents 216662fbaaee
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
5975
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
1 '''Set of functions of adding/checking timestamp to be used to limit
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
2 form submission for cgi actions.
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
3 '''
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
4
7228
07ce4e4110f5 flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents: 6045
diff changeset
5 import base64
07ce4e4110f5 flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents: 6045
diff changeset
6 import binascii
07ce4e4110f5 flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents: 6045
diff changeset
7 import struct
07ce4e4110f5 flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents: 6045
diff changeset
8 import time
07ce4e4110f5 flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents: 6045
diff changeset
9
5975
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
10 from roundup.cgi.exceptions import FormError
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
11 from roundup.i18n import _
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
12 from roundup.anypy.strings import b2s, s2b
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
13
6045
5ec3171580a6 flake whitespace changes.
John Rouillard <rouilj@ieee.org>
parents: 5975
diff changeset
14
5975
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
15 def pack_timestamp():
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
16 return b2s(base64.b64encode(struct.pack("i", int(time.time()))).strip())
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
17
6045
5ec3171580a6 flake whitespace changes.
John Rouillard <rouilj@ieee.org>
parents: 5975
diff changeset
18
5975
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
19 def unpack_timestamp(s):
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
20 try:
6045
5ec3171580a6 flake whitespace changes.
John Rouillard <rouilj@ieee.org>
parents: 5975
diff changeset
21 timestamp = struct.unpack("i", base64.b64decode(s2b(s)))[0]
5ec3171580a6 flake whitespace changes.
John Rouillard <rouilj@ieee.org>
parents: 5975
diff changeset
22 except (struct.error, binascii.Error, TypeError):
5975
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
23 raise FormError(_("Form is corrupted."))
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
24 return timestamp
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
25
6045
5ec3171580a6 flake whitespace changes.
John Rouillard <rouilj@ieee.org>
parents: 5975
diff changeset
26
5975
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
27 class Timestamped:
6045
5ec3171580a6 flake whitespace changes.
John Rouillard <rouilj@ieee.org>
parents: 5975
diff changeset
28 def timecheck(self, field, delay):
5975
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
29 try:
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
30 created = unpack_timestamp(self.form[field].value)
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
31 except KeyError:
7750
216662fbaaee fix(i18n): fix incorrect lookup of some translations
John Rouillard <rouilj@ieee.org>
parents: 7228
diff changeset
32 raise FormError(_("Form is corrupted, missing: %s.") % field)
5975
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
33 if time.time() - created < delay:
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
34 raise FormError(_("Responding to form too quickly."))
59842a3e8108 issue2550919 - Anti-bot signup using 4 second delay
John Rouillard <rouilj@ieee.org>
parents:
diff changeset
35 return True
Roundup Issue Tracker: http://roundup-tracker.org/