我们从Python开源项目中，提取了以下50个代码示例，用于说明如何使用django.utils.crypto.salted_hmac()。
def _make_token_with_timestamp(self, user, timestamp): # timestamp is number of days since 2001-1-1. Converted to # base 36, this gives us a 3 digit string until about 2121 ts_b36 = int_to_base36(timestamp) # By hashing on the internal state of the user and using state # that is sure to change (the password salt will change as soon as # the password is set, at least for current Django auth, and # last_login will also change), we produce a hash that will be # invalid as soon as it is used. # We limit the hash to 20 chars to keep URL short hash = salted_hmac( self.key_salt, self._make_hash_value(user, timestamp), ).hexdigest()[::2] return "%s-%s" % (ts_b36, hash)
def send_sender_confirmation(self, use_https, domain): stripped_email = strip_email(self.sender_email) if BlacklistedEmail.objects.filter(stripped_email=stripped_email).count(): return blacklist_digest = salted_hmac(BLACKLIST_HMAC_SALT, self.sender_email).hexdigest() blacklist_url = reverse('messaging:blacklist_email', kwargs={'email': self.sender_email, 'digest': blacklist_digest}) self.sender_email_token = readable_random_token(alphanumeric=True) context = { 'message': self, 'protocol': 'https' if use_https else 'http', 'domain': domain, 'recipient': self.sender_email, 'blacklist_url': blacklist_url, } subject = render_to_string('messaging/sender_confirmation_subject.txt', context) subject = ' '.join(subject.splitlines()) body_txt = render_to_string('messaging/sender_confirmation_mail.txt', context) body_html = render_to_string('messaging/sender_confirmation_mail.html', context) send_html_mail(subject, body_txt, body_html, self.sender_email) self.save()
def send_to_recipient(self, use_https, domain): stripped_email = strip_email(self.recipient_email) if BlacklistedEmail.objects.filter(stripped_email=stripped_email).count(): return blacklist_digest = salted_hmac(BLACKLIST_HMAC_SALT, self.recipient_email).hexdigest() blacklist_url = reverse('messaging:blacklist_email', kwargs={'email': self.recipient_email, 'digest': blacklist_digest}) self.recipient_email_token = readable_random_token(alphanumeric=True) self.status = Message.STATUS.sent context = { 'message': self, 'protocol': 'https' if use_https else 'http', 'domain': domain, 'recipient': self.recipient_email, 'blacklist_url': blacklist_url, } subject = render_to_string('messaging/recipient_subject.txt', context) subject = ' '.join(subject.splitlines()) body_txt = render_to_string('messaging/recipient_mail.txt', context) body_html = render_to_string('messaging/recipient_mail.html', context) send_html_mail(subject, body_txt, body_html, self.recipient_email) self.save()
def form_hmac(form): """ Calculates a security hash for the given Form instance. """ data = [] for bf in form: # Get the value from the form data. If the form allows empty or hasn't # changed then don't call clean() to avoid trigger validation errors. if form.empty_permitted and not form.has_changed(): value = bf.data or '' else: value = bf.field.clean(bf.data) or '' if isinstance(value, six.string_types): value = value.strip() data.append((bf.name, value)) pickled = pickle.dumps(data, pickle.HIGHEST_PROTOCOL) key_salt = 'django.contrib.formtools' return salted_hmac(key_salt, pickled).hexdigest()
def _make_token_with_timestamp(self, user, timestamp): # timestamp is number of days since 2001-1-1. Converted to # base 36, this gives us a 3 digit string until about 2121 ts_b36 = int_to_base36(timestamp) # By hashing on the internal state of the user and using state # that is sure to change (the password salt will change as soon as # the password is set, at least for current Django auth, and # last_login will also change), we produce a hash that will be # invalid as soon as it is used. # We limit the hash to 20 chars to keep URL short key_salt = "django.contrib.auth.tokens.PasswordResetTokenGenerator" # Ensure results are consistent across DB backends login_timestamp = '' if user.last_login is None else user.last_login.replace(microsecond=0, tzinfo=None) value = (six.text_type(user.pk) + user.password + six.text_type(login_timestamp) + six.text_type(timestamp)) hash = salted_hmac(key_salt, value).hexdigest()[::2] return "%s-%s" % (ts_b36, hash)
def _make_token_with_timestamp(self, user, timestamp): """ Generate a token that cannot be used twice and that last some time. """ # IMPORTANT: user is the API param name, but in our context it is a Client model client = user # timestamp is number of days since 2001-1-1. Converted to # base 36, this gives us a 3 digit string until about 2121 ts_b36 = int_to_base36(timestamp) # By hashing on the internal state of the client and using state # that is sure to change (the cert_public_download_on will change as soon as # the certificate is downloaded), we produce a hash that will be # invalid as soon as it is used. # We limit the hash to 20 chars to keep URL short hash = salted_hmac( self.key_salt, self._make_hash_value(client, timestamp)).hexdigest()[::2] return "%s-%s" % (ts_b36, hash)
def _make_token_with_timestamp(self, user, timestamp): # timestamp is number of days since 2001-1-1. Converted to # base 36, this gives us a 3 digit string until about 2121 ts_b36 = int_to_base36(timestamp) # By hashing on the internal state of the user and using state # that is sure to change (the password salt will change as soon as # the password is set, at least for current Django auth, and # last_login will also change), we produce a hash that will be # invalid as soon as it is used. # We limit the hash to 20 chars to keep URL short key_salt = "django.contrib.auth.tokens.PasswordResetTokenGenerator" # Ensure results are consistent across DB backends login_timestamp = user.last_login.replace(microsecond=0, tzinfo=None) value = (six.text_type(user.pk) + user.password + six.text_type(login_timestamp) + six.text_type(timestamp)) hash = salted_hmac(key_salt, value).hexdigest()[::2] return "%s-%s" % (ts_b36, hash)
def _make_token_with_timestamp(self, user, timestamp): # timestamp is number of days since 2001-1-1. Converted to # base 36, this gives us a 3 digit string until about 2121 ts_b36 = int_to_base36(timestamp) # By hashing on the internal state of the user and using state # that is sure to change (the password salt will change as soon as # the password is set, at least for current Django auth, and # last_login will also change), we produce a hash that will be # invalid as soon as it is used. # We limit the hash to 20 chars to keep URL short key_salt = "django.contrib.auth.tokens.PasswordResetTokenGenerator" # Ensure results are consistent across DB backends if user.date_updated: login_timestamp = user.date_updated.replace(microsecond=0, tzinfo=None) elif user.last_login: login_timestamp = user.last_login.replace(microsecond=0, tzinfo=None) else: login_timestamp = user.date_joined.replace(microsecond=0, tzinfo=None) value = (six.text_type(user.pk) + user.password + six.text_type(login_timestamp) + six.text_type(timestamp)) hash = salted_hmac(key_salt, value).hexdigest()[::2] return "%s-%s" % (ts_b36, hash)
def base64_hmac(salt, value, key): return b64_encode(salted_hmac(salt, value, key).digest())
def get_session_auth_hash(self): """ Return an HMAC of the password field. """ key_salt = "django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash" return salted_hmac(key_salt, self.password).hexdigest()
def _hash(self, value): """ Creates an HMAC/SHA1 hash based on the value and the project setting's SECRET_KEY, modified to make it unique for the present purpose. """ key_salt = 'django.contrib.messages' return salted_hmac(key_salt, value).hexdigest()
def test_make_token(self): token = token_generator.make_token(self.project) id_b36 = int_to_base36(self.project.pk) expected = salted_hmac( token_generator.key_salt, token_generator._make_hash_value(self.project), secret=token_generator.secret, ).hexdigest() self.assertEqual(token, '-'.join([id_b36, expected]))
def make_token(self, project): """ Return a token that can be used to upload archives throug the API. After hash is calculated, we concat the project id in order to simplify the token check, otherwise we would have to go through all the objects in the database. """ project_b36 = int_to_base36(project.pk) digest = salted_hmac( self.key_salt, self._make_hash_value(project), secret=self.secret, ).hexdigest() return "{project}-{digest}".format( project=project_b36, digest=digest)
def get_session_auth_hash(self): """ Return an HMAC of the password field. """ key_salt = "kev_django.kev_auth.models.User.get_session_auth_hash" return salted_hmac(key_salt, self.password).hexdigest()
def get_email(self): expected_digest = salted_hmac(BLACKLIST_HMAC_SALT, self.kwargs['email']) if not constant_time_compare(expected_digest.hexdigest(), self.kwargs['digest']): raise Http404 return self.kwargs['email']
