arno/isso
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

use SHA1 instead of MD5 to verify comment owner

Browse Source
This commit is contained in:
Martin Zimmermann 2013-12-18 10:57:12 +01:00
parent 29a825b575
commit f81b955aa5
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
isso/views/comments.py
View File

@ -21,8 +21,8 @@ from isso.utils.crypto import pbkdf2
from isso.views import requires from isso.views import requires
def md5(text): def sha1(text):
return hashlib.md5(text.encode('utf-8')).hexdigest() return hashlib.sha1(text.encode('utf-8')).hexdigest()
class JSON(Response): class JSON(Response):
@ -166,7 +166,7 @@ class API(object):
self.signal("comments.new:after-save", thread, rv) self.signal("comments.new:after-save", thread, rv)
cookie = functools.partial(dump_cookie, cookie = functools.partial(dump_cookie,
value=self.isso.sign([rv["id"], md5(rv["text"])]), value=self.isso.sign([rv["id"], sha1(rv["text"])]),
max_age=self.conf.getint('max-age')) max_age=self.conf.getint('max-age'))
rv["text"] = markdown(rv["text"]) rv["text"] = markdown(rv["text"])
@ -211,7 +211,7 @@ class API(object):
raise Forbidden raise Forbidden
# verify checksum, mallory might skip cookie deletion when he deletes a comment # verify checksum, mallory might skip cookie deletion when he deletes a comment
if rv[1] != md5(self.comments.get(id)["text"]): if rv[1] != sha1(self.comments.get(id)["text"]):
raise Forbidden raise Forbidden
data = request.get_json() data = request.get_json()
@ -233,7 +233,7 @@ class API(object):
self.signal("comments.edit", rv) self.signal("comments.edit", rv)
cookie = functools.partial(dump_cookie, cookie = functools.partial(dump_cookie,
value=self.isso.sign([rv["id"], md5(rv["text"])]), value=self.isso.sign([rv["id"], sha1(rv["text"])]),
max_age=self.conf.getint('max-age')) max_age=self.conf.getint('max-age'))
rv["text"] = markdown(rv["text"]) rv["text"] = markdown(rv["text"])
@ -255,7 +255,7 @@ class API(object):
raise Forbidden raise Forbidden
# verify checksum, mallory might skip cookie deletion when he deletes a comment # verify checksum, mallory might skip cookie deletion when he deletes a comment
if rv[1] != md5(self.comments.get(id)["text"]): if rv[1] != sha1(self.comments.get(id)["text"]):
raise Forbidden raise Forbidden
item = self.comments.get(id) item = self.comments.get(id)