Mercurial > p > roundup > code
annotate tools/base64 @ 6375:c4371ec7d1c0
Call verifyPassword even if user does not exist.
Address timing attack caused by not doing the password check if the
user doesn't exist. Can expose valid usernames. Really only useful for
a tracker that doesn't allow anonymous access to issues. Issues
usually show usernames as part of the message display.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 06 Apr 2021 22:51:55 -0400 |
| parents | c75defc1c2f0 |
| children | 9c3ec0a5c7fc |
| rev | line source |
|---|---|
|
2181
740102dfad1d
favicon generation stuff
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
1 #!/usr/bin/env python |
|
5412
c75defc1c2f0
Python 3 preparation: miscellaneous Python scripts not named *.py.
Joseph Myers <jsm@polyomino.org.uk>
parents:
2181
diff
changeset
|
2 from __future__ import print_function |
|
2181
740102dfad1d
favicon generation stuff
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
3 import zlib, base64, sys |
|
5412
c75defc1c2f0
Python 3 preparation: miscellaneous Python scripts not named *.py.
Joseph Myers <jsm@polyomino.org.uk>
parents:
2181
diff
changeset
|
4 print(base64.encodestring(zlib.compress(sys.stdin.read()))) |