comparison roundup/cgi/templating.py @ 6823:fe0091279f50

Refactor session db logging and key generation for sessions/otks While I was working on the redis sessiondb stuff, I noticed that log_wanrning, get_logger ... was duplicated. Also there was code to generate a unique key for otks that was duplicated. Changes: creating new sessions_common.py and SessionsCommon class to provide methods: log_warning, log_info, log_debug, get_logger, getUniqueKey getUniqueKey method is closer to the method used to make session keys in client.py. sessions_common.py now report when random_.py chooses a weak random number generator. Removed same from rest.py. get_logger reconciles all logging under roundup.hyperdb.backends.<name of BasicDatabase class> some backends used to log to root logger. have BasicDatabase in other sessions_*.py modules inherit from SessionCommon. change logging to use log_* methods. In addition: remove unused imports reported by flake8 and other formatting changes modify actions.py, rest.py, templating.py to use getUniqueKey method. add tests for new methods test_redis_session.py swap out ModuleNotFoundError for ImportError to prevent crash in python2 when redis is not present. allow injection of username:password or just password into redis connection URL. set pytest_redis_pw envirnment variable to password or user:password when running test.
author John Rouillard <rouilj@ieee.org>
date Sun, 07 Aug 2022 01:51:11 -0400
parents 3f60a71b0812
children 234fefd7568a
comparison
equal deleted inserted replaced
6822:5053ee6c846b 6823:fe0091279f50
206 and the user id in the one time key database for use 206 and the user id in the one time key database for use
207 by the csrf validator that runs in the client::inner_main 207 by the csrf validator that runs in the client::inner_main
208 module/function. 208 module/function.
209 ''' 209 '''
210 otks=client.db.getOTKManager() 210 otks=client.db.getOTKManager()
211 key = b2s(base64.b32encode(random_.token_bytes(40))) 211 key = otks.getUniqueKey()
212
213 while otks.exists(key):
214 key = b2s(base64.b32encode(random_.token_bytes(40)))
215
216 # lifetime is in minutes. 212 # lifetime is in minutes.
217 if lifetime is None: 213 if lifetime is None:
218 lifetime = client.db.config['WEB_CSRF_TOKEN_LIFETIME'] 214 lifetime = client.db.config['WEB_CSRF_TOKEN_LIFETIME']
219 215
220 ts = otks.lifetime(lifetime * 60) 216 ts = otks.lifetime(lifetime * 60)

Roundup Issue Tracker: http://roundup-tracker.org/