File: //usr/lib/python3/dist-packages/trac/web/__pycache__/auth.cpython-310.pyc
o
�k�`7H � @ s< d dl mZmZ d dlmZmZ d dlmZmZ d dl Z d dl
Z
d dl Z d dl Z
d dlZ
d dlmZmZmZ d dlT d dlmZmZ d dlmZmZ d d lmZm Z d d
l m Z d d l m Z d d l!m"Z" d d
l#m$Z$ d dl%m&Z&m'Z' G dd� de(�Z)G dd� de*ed�Z+G dd� de+�Z,G dd� de,�Z-G dd� de,�Z.dS )� )�ABCMeta�abstractmethod)� b64decode� b64encode)�md5�sha1N)�
BoolOption� IntOption�Option)�*)�IAuthenticator�IRequestHandler)�Chrome�INavigationContributor)� hex_entropy�md5crypt)�crypt)� threading)�time_now)�tag)�_�tag_c @ s� e Zd ZdZeeee� dZe dddd�Z
e dddd�Z e dd d
d �Z
edd d
d�Ze ddd
d�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Z d)S )*� LoginModulea� User authentication manager.
This component implements user authentication based on HTTP
authentication provided by the web-server, combined with cookies
for communicating the login information across the whole site.
This mechanism expects that the web-server is setup so that a
request to the path '/login' requires authentication (such as
Basic or Digest). The login name is then stored in the database
and associated with a unique key that gets passed back to the user
agent using the 'trac_auth' cookie. This cookie is used to
identify the user in subsequent requests to non-protected
resources.
F�trac�
check_auth_ip�falsezQWhether the IP address of the user should be checked for
authentication.�ignore_auth_casez6Whether login names should be converted to lower case.�auth_cookie_domain� z�Auth cookie domain attribute.
The auth cookie can be shared among multiple subdomains
by setting the value to the domain. (//since 1.2//)
�auth_cookie_lifetimer aL Lifetime of the authentication cookie, in seconds.
This value determines how long the browser will cache
authentication information, and therefore, after how much
inactivity a user will have to log in again. The value
of 0 makes the cookie expire at the end of the browsing
session.
�auth_cookie_pathz�Path for the authentication cookie. Set this to the common
base path of several Trac instances if you want them to share
the cookie.
c C sH d }|j r |j }nd|jv r| �||jd �}|sd S | jr"|�� }|S )N� trac_auth)� remote_user�incookie�_get_name_for_cookie� ignore_case�lower)�self�req�authname� r* �//usr/lib/python3/dist-packages/trac/web/auth.py� authenticateZ s
�zLoginModule.authenticatec C s dS )N�loginr* �r' r( r* r* r+ �get_active_navigation_iteml s z&LoginModule.get_active_navigation_itemc c s� � |j r<ddtdt| j��||j�d�fV ddtjt�tj t
d�ddd�tj d d
|j d ��|j
�� d dd
d�fV d S ddtjt
d�|j
�� d�fV d S )N�metanavr- zlogged in as %(user)s��user�logout�Logout�submit)�name�type�hidden� __FORM_TOKEN)r7 r6 �value�postz trac-logout)�action�method�id�class_�Login)�href)�is_authenticatedr r �env�
authorinfor) r �form�div�buttonr �input�
form_tokenrA r3 �ar- r. r* r* r+ �get_navigation_itemso s0 ��� ���
�
�
�z LoginModule.get_navigation_itemsc C s t �d|j�S )Nz/(login|logout)/?$)�re�match� path_infor. r* r* r+ �
match_request� s zLoginModule.match_requestc C s< |j �d�r | �|� n |j �d�r| �|� | �|� d S )Nz/loginz/logout)rN �
startswith� _do_login�
_do_logout�_redirect_backr. r* r* r+ �process_request� s
zLoginModule.process_requestc C s� |j s tjtd�td�|j�d�d d�}ttd|d���|j }| jr'|� � }|j
d|fvr7ttd |j
d
���| j j �B}|d t
t� �d f� d
}|j�d�}|d
urb| �||�}||kr`|jnd
}|d
u rvt� }|d|||jt
t� �f� W d
� n1 s�w Y ||_
||jd< | jr�| j|jd d< | jp�|jp�d|jd d< | j jr�d|jd d< d|jd d< | jdkr�| j|jd d< d
S d
S )a� Log the remote user in.
This function expects to be called when the remote user name
is available. The user name is inserted into the `auth_cookie`
table and a cookie identifying the user on subsequent requests
is sent back to the client.
If the Authenticator was created with `ignore_case` set to
true, then the authentication name passed from the web server
in req.remote_user will be converted to lower case before
being used. This is to avoid problems on installations
authenticating against Windows which is not case sensitive
regarding user names and domain names
zinstallation documentationzConfiguring Authentication� TracInstallz#ConfiguringAuthentication)�titlerA zKAuthentication information not available. Please refer to the %(inst_doc)s.)�inst_doc� anonymousz Already logged in as %(user)s.r1 z'DELETE FROM auth_cookie WHERE time < %si /
Nr! z�
INSERT INTO auth_cookie (cookie, name, ipnr, time)
VALUES (%s, %s, %s, %s)
�domain�/�pathT�secure�httponlyr �expires)r" r rJ r rA �wiki� TracErrorr r% r& r) rC �db_transaction�intr r# �get�_cookie_to_namer: r � remote_addr� outcookier r � base_path�secure_cookiesr )r' r( rW r" �db�cookier! r6 r* r* r+ rQ � sd
����
� ��� �
� �
�zLoginModule._do_loginc C s� |j dks|js
dS d|jv r | j�d|jd jf� n | j�d|jf� | �|� | jd � d�}|rFt
� d|�s?|� |�}|�
|� dS dS ) zoLog the user out.
Simply deletes the corresponding record from the auth_cookie
table.
�POSTNr! z'DELETE FROM auth_cookie WHERE cookie=%sz%DELETE FROM auth_cookie WHERE name=%sr0 zlogout.redirectz https?:|/)r= rB r# rC ra r: r) �_expire_cookie�configrc rL rM rA �redirect)r' r( �custom_redirectr* r* r+ rR � s
��
�zLoginModule._do_logoutc C sp d|j d< | jr| j|j d d< | jp|jpd|j d d< d|j d d< | jjr/d|j d d < d|j d d
< d S ) zyInstruct the user agent to drop the auth cookie by setting
the "expires" property to a date in the past.
r r! rY rZ r[ i���r^ Tr\ r] N)rf r r rg rC rh r. r* r* r+ rl � s
� �zLoginModule._expire_cookiec C sD | j r d}|j|jf}nd}|jf}| j�||�D ]\}| S d S )Nz8SELECT name FROM auth_cookie WHERE cookie=%s AND ipnr=%sz,SELECT name FROM auth_cookie WHERE cookie=%s)�check_ipr: re rC �db_query)r' r( rj �sql�argsr6 r* r* r+ rd � s �zLoginModule._cookie_to_namec C s" | � ||�}|d u r| �|� |S �N)rd rl )r' r( rj r6 r* r* r+ r$ � s
z LoginModule._get_name_for_cookiec
C s� | � |�}|rf|�d�s%tj�|j�dd� \}}tj�|||dddf�}|j�d�}|jd|� }|j|d� }|�d�}||�d�d� } | |ksR| �|d �rf| �d�||j �d� krf|�
|| � |�
|� � � dS )z0Redirect the user back to the URL she came from.)zhttp://zhttps://N� �:rZ ) �_refererrP �urllib�parse�urlparse�base_url�
urlunparse�find�rstriprN rn �abs_href)
r' r( �referer�scheme�host�pos� base_scheme�
base_noscheme�base_noscheme_norm�referer_noschemer* r* r+ rS s(
�
��zLoginModule._redirect_backc C s |j �d�p
|�d�S )Nr� �Referer)rs rc �
get_headerr. r* r* r+ rw s zLoginModule._refererN) �__name__�
__module__� __qualname__�__doc__�
implementsr r r
�is_valid_default_handlerr rp r% r
r r r r r, r/ rK rO rT rQ rR rl rd r$ rS rw r* r* r* r+ r & s> ����
� = r c @ s e Zd Zedd� �ZdS )�HTTPAuthenticationc C s d S rt r* )r' �environ�start_responser* r* r+ �do_auth# s zHTTPAuthentication.do_authN)r� r� r� r r� r* r* r* r+ r� ! s r� )� metaclassc @ s e Zd Zdd� Zdd� ZdS )�PasswordFileAuthenticationc C s. || _ t�|�j| _| �| j � t�� | _d S rt ) �filename�os�stat�st_mtime�mtime�loadr �Lock�_lock)r' r� r* r* r+ �__init__) s z#PasswordFileAuthentication.__init__c C sf | j �& t�| j�j}|| jkr!|| _| �| j� W d � d S W d � d S 1 s,w Y d S rt )r� r� r� r� r� r� r� )r' r� r* r* r+ � check_reload/ s
�"�z'PasswordFileAuthentication.check_reloadN)r� r� r� r� r� r* r* r* r+ r� ( s r� c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S )
�BasicAuthenticationc C s" || _ t| _i | _t�| |� d S rt )�realmr �hashr� r� )r' �htpasswdr� r* r* r+ r� 9 � z BasicAuthentication.__init__c
C s� i | _ t|dd��V}|D ]K}|�d�d �� }|sq z
|�d�d d� \}}W n ty; td||f tjd� Y q w d |v sH|�d
�sH| j rN|| j |< q td | tjd� q W d � n1 sbw Y | j i krvtd |tjd� d S d S )
N�utf-8��encoding�#r rv ru z(Warning: invalid password line in %s: %s��file�$�{SHA}znWarning: cannot parse password for user "%s" without the "crypt" module. Install the passlib package from PyPIz Warning: found no users in file:)
r� �open�split�strip�
ValueError�print�sys�stderrrP r )r' r� �fd�line�u�hr* r* r+ r� @ s< ��� ��� �
��zBasicAuthentication.loadc C s� | � � | j�|�}|d u rdS |�d�r)ttt|�d���� �d�|dd � kS d|vr9| � ||d d� �|kS |dd � �
d�d d� \}}d| d }t |||�|kS ) NFr� r� �ascii� r� ru � ) r� r� rc rP �strr r �encode�digestr r� r )r' r2 �password�the_hash�magic�saltr* r* r+ �testY s
�
� zBasicAuthentication.testc C s� |� d�}|r,|�d�r,tt|dd � �d��d�}t|�dkr,|\}}| �||�r,|S dd| j fd g}|d
|�}|d � d S ) N�HTTP_AUTHORIZATION�Basic� r� rv ru �WWW-AuthenticatezBasic realm="%s"�zContent-Length�0�401 Unauthorized� )rc rP r� r r� �lenr� r� ) r' r� r� �header�authr2 r� �headers�writer* r* r+ r� j s
�
zBasicAuthentication.do_authN)r� r� r� r� r� r� r� r* r* r* r+ r� 7 s
r� c @ s> e Zd ZdZdZdd� Zdd� Zdd� Zdd
d �Zd d
� Z dS )�DigestAuthenticationzEA simple HTTP digest authentication implementation
(:rfc:`2617`).�d c C s" g | _ || _i | _t�| |� d S rt )�
active_noncesr� r� r� r� )r' �htdigestr� r* r* r+ r� r� z DigestAuthentication.__init__c
C s� i | _ t|dd��F}|D ];}|�d�d �� }|sq z|�d�dd� \}}}W n ty< td||f tjd � Y q w || jkrG|| j |< q W d � n1 sRw Y | j i krgtd
| jtjd � dS dS ) zxLoad account information from apache style htdigest files,
only users from the specified realm are used
r� r� r� r rv N� z&Warning: invalid digest line in %s: %sr� z!Warning: found no users in realm:) r� r� r� r� r� r� r� r� r� )r' r� r� r� r� �r�a1r* r* r+ r� � s4 ���
�� �
��zDigestAuthentication.loadc C s\ i }t j�|�D ]#}|�dd�\}}|d dkr'|d dkr'|dd� ||< q|||< q|S )N�=r� r �"���)rx �request�parse_http_listr� )r' �
authorization�valuesr: �n�vr* r* r+ �parse_auth_header� s
z&DigestAuthentication.parse_auth_headerr c C sd t � }| j�|� t| j�| jkr| j| j d� | _dd| j||f fdg}|d|�}|d� dS )zdSend a digest challange to the browser. Record used nonces
to avoid replay attacks.
Nr� z5Digest realm="%s", nonce="%s", qop="auth", stale="%s"r� r� r� )r r� �appendr� �
MAX_NONCESr� )r' r� r� �stale�noncer� r� r* r* r+ �send_auth_request� s
���
z&DigestAuthentication.send_auth_requestc C s0 |� d�}|r |�d�s| �||� d S | �|dd � �}g d�}|D ]}||vr2| �||� d S q#| �� |d | jvrF| �||� d S dd� }| j|d }||d |d g�} |||d
|d |d |d
| g�}
|d |
kr{| �||� d S |d
| jvr�| j||dd� d S | j�|d
� |d S )Nr� �Digest� )�usernamer� r� �uri�response�nc�cnoncer� c S s t d�dd� | D ����� S )N� :c s s � | ]}|� d �V qdS )r� N)r� )�.0r� r* r* r+ � <genexpr>� s � zADigestAuthentication.do_auth.<locals>.<lambda>.<locals>.<genexpr>)r �join� hexdigest)�xr* r* r+ �<lambda>� s z.DigestAuthentication.do_auth.<locals>.<lambda>�REQUEST_METHODr� r� r� r� �qopr� �true)r� )rc rP r� r� r� r� r� �remove) r' r� r� r� r� �
required_keys�key�kdr� �a2�correctr* r* r+ r� � s:
� � z DigestAuthentication.do_authN)r )
r� r� r� r� r� r� r� r� r� r� r* r* r* r+ r� y s
r� )/�abcr r �base64r r �hashlibr r r� rL r� � urllib.parserx �urllib.request� trac.configr r r
� trac.core� trac.web.apir r
�trac.web.chromer r � trac.utilr r �trac.util.compatr �trac.util.concurrencyr �trac.util.datefmtr �trac.util.htmlr �trac.util.translationr r � Componentr �objectr� r� r� r� r* r* r* r+ �<module> s0 |B