Mercurial > p > roundup > code
diff roundup/password.py @ 5356:91954be46a66
A real fix for the problem where:
import random
would result in every call to random() returning the same value
in the web interface.
While cgi/client.py:Client::__init.py__ was calling random.seed(),
on most systems random was SystemRandom and not the default random.
As a result the random as you would get from:
import random
was never being seeded. I added a function to access and seed the
random bound instance of random.Random that is called during init.
This fixes all three places where I saw the broken randomness.
It should also fix:
http://psf.upfronthosting.co.za/roundup/meta/issue644
I also removed the prior code that would bail if systemRandom was not
available.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Sun, 08 Jul 2018 11:34:42 -0400 |
| parents | 66a17c80e035 |
| children | 35ea9b1efc14 |
line wrap: on
line diff
--- a/roundup/password.py Sat Jul 07 22:39:16 2018 -0400 +++ b/roundup/password.py Sun Jul 08 11:34:42 2018 -0400 @@ -19,20 +19,11 @@ """ __docformat__ = 'restructuredtext' -import re, string +import re, string, random import os from base64 import b64encode, b64decode from hashlib import md5, sha1 -try: - # Use the cryptographic source of randomness if available - from random import SystemRandom - random=SystemRandom() -except ImportError: - raise - from random import Random - random=Random() - try: import crypt except ImportError: @@ -372,13 +363,6 @@ assert 'sekrit' == p assert 'not sekrit' != p - - print random.randrange(36, 52) - # this seems to return the save password every time - # when run inside a roundup daemon. - # but it tests out ok. I don't know why. -- rouilj - print generatePassword() - if __name__ == '__main__': test()