
    wdfC
                     z    d Z ddlmZ ddlZddlZddlmZ ddlmZmZ ddl	m
Z
 dd	lmZ d
Z G d de          ZdS )a  
A provided CSRF implementation which puts CSRF data in a session.

This can be used fairly comfortably with many `request.session` type
objects, including the Werkzeug/Flask session store, Django sessions, and
potentially other similar objects which use a dict-like API for storing
session keys.

The basic concept is a randomly generated value is stored in the user's
session, and an hmac-sha1 of it (along with an optional expiration time,
for extra security) is used as the value of the csrf_token. If this token
validates with the hmac of the random value + expiration time, and the
expiration time is not passed, the CSRF validation will pass.
    )unicode_literalsN)sha1)datetime	timedelta   )ValidationError   )
SecureForm)SessionSecureFormc                   :    e Zd ZdZ ed          ZdZd Zd ZdS )r   z%Y%m%d%H%M%S   )minutesNc                 F   | j         t          d          |t          d          t          |d|          }d|vr6t	          t          j        d                                                    |d<   |d         | j        _	        | j
        r@t          j                    | j
        z                       | j                  }|d         |}n
d}|d         }t          j        | j         |                    d          t                    }|d	|                                S )
Nz=must set SECRET_KEY in a subclass of this form for it to workz2Must provide a session-like object as csrf contextsessioncsrf@    utf8	digestmod##)
SECRET_KEY	Exception	TypeErrorgetattrr   osurandom	hexdigest
csrf_tokencsrf_key
TIME_LIMITr   nowstrftimeTIME_FORMAThmacnewencode)selfcsrf_contextr   expires
csrf_build	hmac_csrfs         ]/var/www/book.euthymeo.com/html/venv/lib/python3.11/site-packages/wtforms/ext/csrf/session.pygenerate_csrf_tokenz%SessionSecureForm.generate_csrf_token"   s   ?"[\\\PQQQ,	<@@  "2:b>>22<<>>GFO#*6? ? 	)|~~7AA$BRSSG#*6??GG<JJG JHT_j.?.?.G.GSWXXX	"77I$7$7$9$9$9::    c                 L   |j         r	d|j         vr"t          |                    d                    |j                             d          \  }}|j        |z                       d          }t          j        | j        |t                    }|
                                |k    r"t          |                    d                    | j        rSt          j                                        | j                  }||k    r$t          |                    d                    d S d S )Nr   zCSRF token missingr   r   zCSRF failedzCSRF token expired)datar   gettextsplitr    r'   r%   r&   r   r   r   r!   r   r"   r#   r$   )r(   fieldr*   r,   	check_valhmac_comparenow_formatteds          r-   validate_csrf_tokenz%SessionSecureForm.validate_csrf_token8   s   z 	GT33!%--0D"E"EFFF"Z--d33^g-55f==	xdKKK!!##y00!%--">">???? 	K$LNN33D4DEEMw&&%emm4H&I&IJJJ	K 	K&&r/   )	__name__
__module____qualname__r$   r   r!   r   r.   r8    r/   r-   r   r      sS         K2&&&JJ; ; ;,K K K K Kr/   r   )__doc__
__future__r   r%   r   hashlibr   r   r   
validatorsr   formr
   __all__r   r<   r/   r-   <module>rC      s     ( ' ' ' ' '  				       ( ( ( ( ( ( ( ( ) ) ) ) ) )      
!*K *K *K *K *K
 *K *K *K *K *Kr/   