← Back
Editing: tokens.cpython-311.pyc
� �|�e� � �p � d dl m Z mZ d dlmZ d dlmZmZ d dlmZm Z G d� d� � Z e � � Z dS )� )�datetime�time)�settings)�constant_time_compare� salted_hmac)� base36_to_int� int_to_base36c �J � e Zd ZdZdZdZdZd� Zd� Zd� Z d d�Z d � Z d � Z d � Z dS ) �PasswordResetTokenGeneratorza Strategy object used to generate and check tokens for the password reset mechanism. z6django.contrib.auth.tokens.PasswordResetTokenGeneratorNc �f � | j p t j | _ | j p t j | _ d S �N)�secretr � SECRET_KEY� algorithm�DEFAULT_HASHING_ALGORITHM��selfs �</usr/lib/python3/dist-packages/django/contrib/auth/tokens.py�__init__z$PasswordResetTokenGenerator.__init__ s* � ��k�8�X�%8�� � � �M�8�+M����� c �x � | � || � | � � � � � � � S )zi Return a token that can be used once to do a password reset for the given user. )�_make_token_with_timestamp� _num_seconds�_now)r �users r � make_tokenz&PasswordResetTokenGenerator.make_token s0 � � �.�.�t�T�5F�5F�t�y�y�{�{�5S�5S�T�T�Tr c � � |r|sdS |� d� � \ }}t |� � dk }n# t $ r Y dS w xY w t |� � }n# t $ r Y dS w xY wt | � ||� � |� � s(t | � ||d�� � |� � sdS | � � � }|r[|dz }|t |t j |� � � t j � � z � � � � � z }| � |� � |z t j k rdS dS )zP Check that a password reset token is correct for a given user. F�-� T)�legacyi�Q )�split�len� ValueErrorr r r r �intr �combine�dater �min� total_secondsr r �PASSWORD_RESET_TIMEOUT)r r �token�ts_b36�_� legacy_token�ts�nows r � check_tokenz'PasswordResetTokenGenerator.check_token s} � � � �� ��5� � � � �C�(�(�I�F�A� �v�;�;��?�L�L��� � � ��5�5� ���� � �v�&�&�B�B��� � � ��5�5� ���� %�T�%D�%D�T�2�%N�%N�PU�V�V� � )��/�/��b��/�F�F��� � � �u� �i�i�k�k�� � V� �,� �B� �#�s�X� -�c�h�h�j�j�$�(� C� C�C�R�R�T�T�U�U� U�B� � � �c� "� "�R� '�8�+J� J� J��5��ts! �+4 � A�A�A � A$�#A$Fc �� � t |� � }t | j | � ||� � | j |rdn| j �� � � � � d d d� }|�d|��S )N�sha1)r r � r )r r �key_salt�_make_hash_valuer r � hexdigest)r r � timestampr r+ � hash_strings r r z6PasswordResetTokenGenerator._make_token_with_timestampH s} � � �y�)�)��!� �M� � !� !�$� � 2� 2��;� !'�:�f�f�D�N� � � � �)�+�+�c�c��c�� � !�&�&�+�+�.�.r c �� � |j �dn|j � dd�� � }|� � � }t ||d� � pd}|j � |j � |� |� |� �S )a� Hash the user's primary key, email (if available), and some user state that's sure to change after a password reset to produce a token that is invalidated when it's used: 1. The password field will change upon a password reset (even if the same password is chosen, due to password salting). 2. The last_login field will usually be updated very shortly after a password reset. Failing those things, settings.PASSWORD_RESET_TIMEOUT eventually invalidates the token. Running this data through salted_hmac() prevents password cracking attempts using the reset token, provided the secret isn't compromised. N� r )� microsecond�tzinfo)� last_login�replace�get_email_field_name�getattr�pk�password)r r r7 �login_timestamp� email_field�emails r r5 z,PasswordResetTokenGenerator._make_hash_valueW sv � �" !%�� 7�"�"�T�_�=T�=T�ab�ko�=T�=p�=p���/�/�1�1� ���k�2�.�.�4�"���'�M�4�=�M�/�M�9�M�e�M�M�Mr c �h � t |t ddd� � z � � � � � S )Ni� � )r$ r r( )r �dts r r z(PasswordResetTokenGenerator._num_secondsm s- � ��B��$��1�-�-�-�<�<�>�>�?�?�?r c �( � t j � � S r )r r/ r s r r z PasswordResetTokenGenerator._nowp s � ��|�~�~� r )F)�__name__� __module__� __qualname__�__doc__r4 r r r r r0 r r5 r r � r r r r s� � � � � � �� � H�H��I� �F�N� N� N� U� U� U�(� (� (�T /� /� /� /� N� N� N�,@� @� @� � � � � r r N) r r � django.confr �django.utils.cryptor r �django.utils.httpr r r �default_token_generatorrN r r �<module>rS s� �� #� #� #� #� #� #� #� #� � � � � � � B� B� B� B� B� B� B� B� :� :� :� :� :� :� :� :�j � j � j � j � j � j � j � j �Z 6�5�7�7� � � r
Save File
Cancel