summaryrefslogtreecommitdiff
path: root/lib/python2.7/site-packages/django/contrib/auth/tokens.py
diff options
context:
space:
mode:
Diffstat (limited to 'lib/python2.7/site-packages/django/contrib/auth/tokens.py')
-rw-r--r--lib/python2.7/site-packages/django/contrib/auth/tokens.py73
1 files changed, 0 insertions, 73 deletions
diff --git a/lib/python2.7/site-packages/django/contrib/auth/tokens.py b/lib/python2.7/site-packages/django/contrib/auth/tokens.py
deleted file mode 100644
index 6e5bfe7..0000000
--- a/lib/python2.7/site-packages/django/contrib/auth/tokens.py
+++ /dev/null
@@ -1,73 +0,0 @@
-from datetime import date
-from django.conf import settings
-from django.utils.http import int_to_base36, base36_to_int
-from django.utils.crypto import constant_time_compare, salted_hmac
-from django.utils import six
-
-
-class PasswordResetTokenGenerator(object):
- """
- Strategy object used to generate and check tokens for the password
- reset mechanism.
- """
- def make_token(self, user):
- """
- Returns a token that can be used once to do a password reset
- for the given user.
- """
- return self._make_token_with_timestamp(user, self._num_days(self._today()))
-
- def check_token(self, user, token):
- """
- Check that a password reset token is correct for a given user.
- """
- # Parse the token
- try:
- ts_b36, hash = token.split("-")
- except ValueError:
- return False
-
- try:
- ts = base36_to_int(ts_b36)
- except ValueError:
- return False
-
- # Check that the timestamp/uid has not been tampered with
- if not constant_time_compare(self._make_token_with_timestamp(user, ts), token):
- return False
-
- # Check the timestamp is within limit
- if (self._num_days(self._today()) - ts) > settings.PASSWORD_RESET_TIMEOUT_DAYS:
- return False
-
- return True
-
- def _make_token_with_timestamp(self, user, timestamp):
- # timestamp is number of days since 2001-1-1. Converted to
- # base 36, this gives us a 3 digit string until about 2121
- ts_b36 = int_to_base36(timestamp)
-
- # By hashing on the internal state of the user and using state
- # that is sure to change (the password salt will change as soon as
- # the password is set, at least for current Django auth, and
- # last_login will also change), we produce a hash that will be
- # invalid as soon as it is used.
- # We limit the hash to 20 chars to keep URL short
- key_salt = "django.contrib.auth.tokens.PasswordResetTokenGenerator"
-
- # Ensure results are consistent across DB backends
- login_timestamp = user.last_login.replace(microsecond=0, tzinfo=None)
-
- value = (six.text_type(user.pk) + user.password +
- six.text_type(login_timestamp) + six.text_type(timestamp))
- hash = salted_hmac(key_salt, value).hexdigest()[::2]
- return "%s-%s" % (ts_b36, hash)
-
- def _num_days(self, dt):
- return (dt - date(2001, 1, 1)).days
-
- def _today(self):
- # Used for mocking in tests
- return date.today()
-
-default_token_generator = PasswordResetTokenGenerator()