From 6e512c0dae7df7303cfeaabc0044ecc523311de6 Mon Sep 17 00:00:00 2001 From: Guillaume Subiron Date: Wed, 30 May 2012 10:53:17 +0200 Subject: [PATCH] Password are encrypted --- main.py | 17 ++++++++--------- schema.sql | 2 +- 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/main.py b/main.py index 9556f96..d9488c9 100755 --- a/main.py +++ b/main.py @@ -8,6 +8,7 @@ from datetime import date, timedelta from contextlib import closing import locale locale.setlocale(locale.LC_ALL, '') +import hashlib DATABASE = '/tmp/cavote.db' SECRET_KEY = '{J@uRKO,xO-PK7B,jF?>iHbxLasF9s#zjOoy=+:' @@ -47,20 +48,19 @@ def init_db(): # Login / Logout def valid_login(username, password): - return query_db('select * from users where email = ? and password = ?', [username, password], one=True) + return query_db('select * from users where email = ? and password = ?', [username, crypt(password)], one=True) def connect_user(user): session['user'] = user # :KLUDGE:maethor:120528: Stoquer toute la ligne de la table users dans la session, c'est un peu crade - #session['user']['id'] = user['id'] - #session['user']['name'] = user['name'] - #session['user']['email'] = user['email'] - #session['user']['organization'] = user['organization'] - #if user['is_admin'] == 1: - # session['user']['is_admin'] = True + del session['user']['password'] + del session['user']['key'] def disconnect_user(): session.pop('user', None) +def crypt(passwd): + return hashlib.sha1(passwd).hexdigest() + @app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'POST': @@ -144,8 +144,7 @@ def user_password(userid): abort(401) if request.method == 'POST': if request.form['password'] == request.form['password2']: - # :TODO:maethor:120528: Chiffrer le mot de passe ! - g.db.execute('update users set password = ? where id = ?', [request.form['password'], session['user']['id']]) + g.db.execute('update users set password = ? where id = ?', [crypt(request.form['password']), session['user']['id']]) g.db.commit() flash(u'Votre mot de passe a été mis à jour.', 'success') else: diff --git a/schema.sql b/schema.sql index c1805c4..7a35e9e 100644 --- a/schema.sql +++ b/schema.sql @@ -62,7 +62,7 @@ create table choices ( -- Test data -insert into users (email, password, name, organization, is_admin, key) values ("admin@admin.fr", "admin", "Toto (admin) Tata", "World corp", 1, "test"); +insert into users (email, password, name, organization, is_admin, key) values ("admin@admin.fr", "d033e22ae348aeb5660fc2140aec35850c4da997", "Toto (admin) Tata", "World corp", 1, "test"); -- mdp = admin insert into roles (id, name, system) values (1, "Tous", 1); insert into roles (name) values ("CA"); insert into roles (name) values ("Members"); -- 2.20.1