diff options
Diffstat (limited to 'lib/python2.7/site-packages/django/contrib/auth/tokens.py')
-rw-r--r-- | lib/python2.7/site-packages/django/contrib/auth/tokens.py | 73 |
1 files changed, 0 insertions, 73 deletions
diff --git a/lib/python2.7/site-packages/django/contrib/auth/tokens.py b/lib/python2.7/site-packages/django/contrib/auth/tokens.py deleted file mode 100644 index 6e5bfe7..0000000 --- a/lib/python2.7/site-packages/django/contrib/auth/tokens.py +++ /dev/null @@ -1,73 +0,0 @@ -from datetime import date -from django.conf import settings -from django.utils.http import int_to_base36, base36_to_int -from django.utils.crypto import constant_time_compare, salted_hmac -from django.utils import six - - -class PasswordResetTokenGenerator(object): - """ - Strategy object used to generate and check tokens for the password - reset mechanism. - """ - def make_token(self, user): - """ - Returns a token that can be used once to do a password reset - for the given user. - """ - return self._make_token_with_timestamp(user, self._num_days(self._today())) - - def check_token(self, user, token): - """ - Check that a password reset token is correct for a given user. - """ - # Parse the token - try: - ts_b36, hash = token.split("-") - except ValueError: - return False - - try: - ts = base36_to_int(ts_b36) - except ValueError: - return False - - # Check that the timestamp/uid has not been tampered with - if not constant_time_compare(self._make_token_with_timestamp(user, ts), token): - return False - - # Check the timestamp is within limit - if (self._num_days(self._today()) - ts) > settings.PASSWORD_RESET_TIMEOUT_DAYS: - return False - - return True - - def _make_token_with_timestamp(self, user, timestamp): - # timestamp is number of days since 2001-1-1. Converted to - # base 36, this gives us a 3 digit string until about 2121 - ts_b36 = int_to_base36(timestamp) - - # By hashing on the internal state of the user and using state - # that is sure to change (the password salt will change as soon as - # the password is set, at least for current Django auth, and - # last_login will also change), we produce a hash that will be - # invalid as soon as it is used. - # We limit the hash to 20 chars to keep URL short - key_salt = "django.contrib.auth.tokens.PasswordResetTokenGenerator" - - # Ensure results are consistent across DB backends - login_timestamp = user.last_login.replace(microsecond=0, tzinfo=None) - - value = (six.text_type(user.pk) + user.password + - six.text_type(login_timestamp) + six.text_type(timestamp)) - hash = salted_hmac(key_salt, value).hexdigest()[::2] - return "%s-%s" % (ts_b36, hash) - - def _num_days(self, dt): - return (dt - date(2001, 1, 1)).days - - def _today(self): - # Used for mocking in tests - return date.today() - -default_token_generator = PasswordResetTokenGenerator() |