
    +h                     n    d Z ddlZddlZddlmZ ddlmZ ddlmZ ddlmZ dd	l	m
Z
 d
Z G d de
      Zy)a  
A provided CSRF implementation which puts CSRF data in a session.

This can be used fairly comfortably with many `request.session` type
objects, including the Werkzeug/Flask session store, Django sessions, and
potentially other similar objects which use a dict-like API for storing
session keys.

The basic concept is a randomly generated value is stored in the user's
session, and an hmac-sha1 of it (along with an optional expiration time,
for extra security) is used as the value of the csrf_token. If this token
validates with the hmac of the random value + expiration time, and the
expiration time is not passed, the CSRF validation will pass.
    N)datetime)	timedelta)sha1   )ValidationError   )CSRF)SessionCSRFc                   T     e Zd ZdZ fdZd Zd Zd Zed        Z	ed        Z
 xZS )r
   z%Y%m%d%H%M%Sc                 D    |j                   | _        t        |   |      S )N)meta	form_metasuper
setup_form)selfform	__class__s     G/var/www/html/venv/lib/python3.12/site-packages/wtforms/csrf/session.pyr   zSessionCSRF.setup_form   s    w!$''    c                 F   | j                   }|j                  t        d      |j                  t	        d      | j
                  }d|vr/t        t        j                  d            j                         |d<   | j                  rL| j                         | j                  z   j                  | j                        }dj                  |d   |      }nd}|d   }t        j                   |j                  |j#                  d      t              }| d	|j                          S )
Nz<must set `csrf_secret` on class Meta for SessionCSRF to workz2Must provide a session-like object as csrf contextcsrf@   z{}{} utf8	digestmod##)r   csrf_secret	Exceptioncsrf_context	TypeErrorsessionr   osurandom	hexdigest
time_limitnowstrftimeTIME_FORMATformathmacnewencode)r   csrf_token_fieldr   r"   expires
csrf_build	hmac_csrfs          r   generate_csrf_tokenzSessionCSRF.generate_csrf_token"   s   ~~#N  $PQQ,, "2::b>2<<>GFO??xxzDOO3==d>N>NOGwv@JG JHHj//74
	 "Y002344r   c                 T   | j                   }|j                  rd|j                  vrt        |j                  d            |j                  j	                  dd      \  }}| j
                  d   |z   j                  d      }t        j                  |j                  |t              }|j                         |k7  rt        |j                  d            | j                  rI| j                         j                  | j                        }||kD  rt        |j                  d            y y )	Nr   zCSRF token missing.r   r   r   r   zCSRF failed.zCSRF token expired.)r   datar   gettextsplitr"   r-   r+   r,   r   r   r%   r&   r'   r(   r)   )	r   r   fieldr   r/   r1   	check_valhmac_comparenow_formatteds	            r   validate_csrf_tokenzSessionCSRF.validate_csrf_token<   s    ~~zzT3!%--0E"FGG"ZZ--dA6\\&)G3;;FC	xx 0 0)tL!!#y0!%--"?@@?? HHJ//0@0@AMw&%emm4I&JKK ' r   c                 *    t        j                         S )zP
        Get the current time. Used for test mocking/overriding mainly.
        )r   r'   r   s    r   r'   zSessionCSRF.nowN   s     ||~r   c                 D    t        | j                  dt        d            S )Ncsrf_time_limit   )minutes)getattrr   r   r=   s    r   r&   zSessionCSRF.time_limitT   s    t~~'8)B:OPPr   c                 l    t        | j                  j                  d| j                  j                        S )Nr"   )rB   r   r    r=   s    r   r"   zSessionCSRF.sessionX   s*    NN''DNN4O4O
 	
r   )__name__
__module____qualname__r)   r   r2   r;   r'   propertyr&   r"   __classcell__)r   s   @r   r
   r
      sG     K(54L$ Q Q 
 
r   r
   )__doc__r+   r#   r   r   hashlibr   
validatorsr   corer	   __all__r
    r   r   <module>rO      s4     	    ( 
A
$ A
r   