
    wdf                     z    d Z ddlmZ ddlZddlZddlmZ ddlmZmZ ddl	m
Z
 dd	lmZ d
Z G d de          ZdS )a  
A provided CSRF implementation which puts CSRF data in a session.

This can be used fairly comfortably with many `request.session` type
objects, including the Werkzeug/Flask session store, Django sessions, and
potentially other similar objects which use a dict-like API for storing
session keys.

The basic concept is a randomly generated value is stored in the user's
session, and an hmac-sha1 of it (along with an optional expiration time,
for extra security) is used as the value of the csrf_token. If this token
validates with the hmac of the random value + expiration time, and the
expiration time is not passed, the CSRF validation will pass.
    )unicode_literalsN)sha1)datetime	timedelta   )ValidationError   )CSRF)SessionCSRFc                   `     e Zd ZdZ fdZd Zd Zd Zed             Z	ed             Z
 xZS )r   z%Y%m%d%H%M%Sc                 l    |j         | _        t          t          |                               |          S )N)meta	form_metasuperr   
setup_form)selfform	__class__s     Y/var/www/book.euthymeo.com/html/venv/lib/python3.11/site-packages/wtforms/csrf/session.pyr   zSessionCSRF.setup_form    s*    [$''224888    c                 (   | j         }|j        t          d          |j        t	          d          | j        }d|vr6t          t          j        d                    	                                |d<   | j
        rA|                                 | j
        z                       | j                  }|d         |}n
d}|d         }t          j        |j        |                    d          t                    }|d|	                                S )	Nz<must set `csrf_secret` on class Meta for SessionCSRF to workz2Must provide a session-like object as csrf contextcsrf@    utf8	digestmod##)r   csrf_secret	Exceptioncsrf_context	TypeErrorsessionr   osurandom	hexdigest
time_limitnowstrftimeTIME_FORMAThmacnewencode)r   csrf_token_fieldr   r#   expires
csrf_build	hmac_csrfs          r   generate_csrf_tokenzSessionCSRF.generate_csrf_token$   s   ~#Z[[[$PQQQ,  "2:b>>22<<>>GFO? 	)xxzzDO3==d>NOOG#*6??GG<JJG JHT-z/@/@/H/HTXYYY	"77I$7$7$9$9$9::r   c                 j   | j         }|j        r	d|j        vr"t          |                    d                    |j                            dd          \  }}| j        d         |z                       d          }t          j        |j	        |t                    }|                                |k    r"t          |                    d                    | j        rT|                                                     | j                  }||k    r$t          |                    d                    d S d S )	Nr   zCSRF token missingr	   r   r   r   zCSRF failedzCSRF token expired)r   datar   gettextsplitr#   r-   r+   r,   r   r   r&   r'   r(   r)   r*   )	r   r   fieldr   r/   r1   	check_valhmac_comparenow_formatteds	            r   validate_csrf_tokenzSessionCSRF.validate_csrf_token:   s!   ~z 	GT33!%--0D"E"EFFF"Z--dA66\&)G3;;FCC	x 0)tLLL!!##y00!%--">">???? 	K HHJJ//0@AAMw&&%emm4H&I&IJJJ	K 	K&&r   c                 (    t          j                    S )zP
        Get the current time. Used for test mocking/overriding mainly.
        )r   r(   r   s    r   r(   zSessionCSRF.nowL   s     |~~r   c                 J    t          | j        dt          d                    S )Ncsrf_time_limit   )minutes)getattrr   r   r=   s    r   r'   zSessionCSRF.time_limitR   s"    t~'8)B:O:O:OPPPr   c                 L    t          | j        j        d| j        j                  S )Nr#   )rB   r   r!   r=   s    r   r#   zSessionCSRF.sessionV   s    t~2It~?Z[[[r   )__name__
__module____qualname__r*   r   r2   r;   r(   propertyr'   r#   __classcell__)r   s   @r   r   r      s         K9 9 9 9 9; ; ;,K K K$   Q Q XQ \ \ X\ \ \ \ \r   r   )__doc__
__future__r   r+   r$   hashlibr   r   r   
validatorsr   corer
   __all__r    r   r   <module>rP      s     ( ' ' ' ' '  				       ( ( ( ( ( ( ( ( ( ( ( ( ( (      
;\ ;\ ;\ ;\ ;\$ ;\ ;\ ;\ ;\ ;\r   