RunasSudo/society-self-service
1
Fork 0
Code Issues 1 Pull Requests Activity

Use Python 3.6 compatible HMAC code

Browse Source
This commit is contained in:
Yingtong Li 2019-01-17 23:42:05 +11:00
parent 2fc2fb43e1
commit 05c3440a33
Signed by: RunasSudo
GPG Key ID: 7234E476BF21C61A
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ssmembership/views.py
View File

@ -80,8 +80,8 @@ def import_signed(request):
if 'sig' not in request.GET: if 'sig' not in request.GET:
return HttpResponse('Expected a signature parameter', status=400) return HttpResponse('Expected a signature parameter', status=400)
sig_expected = hmac.digest(settings.SECRET_KEY_MEMBERSIG.encode('utf-8'), request.GET['email'].encode('utf-8'), 'sha256').hex() sig_expected = hmac.new(settings.SECRET_KEY_MEMBERSIG.encode('utf-8'), request.GET['email'].encode('utf-8'), 'sha256').hexdigest()
if sig_expected != request.GET['sig']: if not hmac.compare_digest(sig_expected, request.GET['sig']):
return HttpResponse('Invalid signature', status=403) return HttpResponse('Invalid signature', status=403)
member = mimport.by_email(request.GET['email']) member = mimport.by_email(request.GET['email'])
@ -108,15 +108,15 @@ def import_search(request):
'member': member, 'member': member,
'years': models.Member.YEARS, 'years': models.Member.YEARS,
'email_orig': member.email if member else None, 'email_orig': member.email if member else None,
'sig': hmac.digest(settings.SECRET_KEY_MEMBERSIG.encode('utf-8'), member.email.encode('utf-8'), 'sha256').hex() if member else None 'sig': hmac.new(settings.SECRET_KEY_MEMBERSIG.encode('utf-8'), member.email.encode('utf-8'), 'sha256').hexdigest() if member else None
}) })
def import_save(request): def import_save(request):
if request.method != 'POST': if request.method != 'POST':
return redirect(reverse('import_index')) return redirect(reverse('import_index'))
sig_expected = hmac.digest(settings.SECRET_KEY_MEMBERSIG.encode('utf-8'), request.POST['email_orig'].encode('utf-8'), 'sha256').hex() sig_expected = hmac.new(settings.SECRET_KEY_MEMBERSIG.encode('utf-8'), request.POST['email_orig'].encode('utf-8'), 'sha256').hexdigest()
if sig_expected != request.POST['sig']: if not hmac.compare_digest(sig_expected, request.POST['sig']):
return HttpResponse('Invalid signature', status=403) return HttpResponse('Invalid signature', status=403)
member = mimport.by_email(request.POST['email_orig']) member = mimport.by_email(request.POST['email_orig'])