innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity
15,675 Commits 25 Branches 361 Tags 501 MiB
Commit Graph

16 Commits

Author SHA1 Message Date
Claude Paroz 0df0cf70d4 Reverted pickle-json replacement form_hmac calculation 
This reverts commit b109ff8062 and
complement test cases. The change was too hasty, as some form
values cannot be json-serialized as is.
 2012-08-14 09:51:39 +02:00
Claude Paroz b109ff8062 Replaced pickle by json in form_hmac calculation 
Refs #18340
 2012-08-13 21:02:18 +02:00
Aymeric Augustin 3cb2457f46 [py3] Replaced basestring by six.string_types. 2012-07-22 09:29:54 +02:00
Claude Paroz 1a66f53f94 Fixed #18340 -- Fixed formtools form_hmac with Unicode input 
Using cPickle, two apparently identical Unicode strings could
generate different pickled results depending on previous operations
on those strings.
 2012-05-19 12:10:22 +02:00
Aymeric Augustin dec21a1d4b Removed deprecated and undocumented function django.contrib.formtools.utils.security_hash(). 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17841 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2012-03-31 12:26:46 +00:00
Jannis Leidel 24f4764a48 Fixed #16225 -- Removed unused imports. Many thanks to Aymeric Augustin for the work on the patch and Alex for reviewing. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16539 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-07-13 09:35:51 +00:00
Russell Keith-Magee c1df35b0fa Advanced deprecations in contrib.formtools. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15972 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-04-02 08:34:15 +00:00
Adrian Holovaty a89ee065a1 Removed no-longer-valid comment about Python 2.3 and 2.4 in formtools/utils.py 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15931 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-03-28 02:26:15 +00:00
Adrian Holovaty a87be3554f Removed a bunch of Python 2.4 workarounds now that we don't support it. Refs #15702 -- thanks to jonash for the patch. Splitting this over muliple commits to make it more manageable. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15926 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-03-28 01:40:43 +00:00
Luke Plant 45c7f427ce Fixed #14445 - Use HMAC and constant-time comparison functions where needed. 
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.

In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.

All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.

There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-10-14 20:54:30 +00:00
Russell Keith-Magee 5211f48ae3 Fixed #12164 -- Removed the Python 2.3 compatibility imports and workarounds. Thanks to timo and claudep for the patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13094 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-05-04 14:00:30 +00:00
Jacob Kaplan-Moss 96b5b6b34c Fixed #10643: fixed the formtools security hash to handle allowed empty forms or forms without changed data. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10753 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-05-12 22:02:38 +00:00
Jacob Kaplan-Moss fce800f3fd Fixed #10034: the formtools security hash function is now friendlier to browsers that submit leading/trailing whitespace in form fields. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10752 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-05-12 21:54:58 +00:00
Russell Keith-Magee 24d3129edd Fixed #8570: Corrected some code that was using 8-space tabs for some reason. Thanks to Manuel Saelices for the report. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9019 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2008-09-14 07:04:40 +00:00
Jacob Kaplan-Moss 2ca8cf3628 Fixed #8653: make formtools' security hash more rubust. Silly that I didn't think of this before; thanks to bthomas for providing the obvious fix. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8715 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2008-08-29 19:15:34 +00:00
Jacob Kaplan-Moss 6056ab1bee Fixed #6209: handle `BooleanField`s in `FormPreview` and `FormWizard`. In the process, broke the the security hash calculation out to a helper function. Thanks to mcroydon and rajeshdhawan. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8597 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2008-08-26 20:19:12 +00:00