OwlCyberSecurity - MANAGER
Edit File: hashers.cpython-39.pyc
a ���e�q � @ s� d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m Z d dl m Z d dl mZ d dlmZmZmZmZmZ d dlmZmZ d dlmZ d d lmZ d Z d Z d d � Z d;dd�Z d<dd�Z!ej"dd� �Z#ej"dd� �Z$ee �dd� �Z%d=dd�Z&dd � Z'd>d d �Z(d!d"� Z)G d#d$� d$�Z*G d%d&� d&e*�Z+G d'd(� d(e+�Z,G d)d*� d*e*�Z-G d+d,� d,e*�Z.G d-d.� d.e.�Z/G d/d0� d0e*�Z0G d1d2� d2e*�Z1G d3d4� d4e*�Z2G d5d6� d6e*�Z3G d7d8� d8e*�Z4G d9d:� d:e*�Z5dS )?� N)�settings)�ImproperlyConfigured)�setting_changed)�receiver)�RANDOM_STRING_CHARS�constant_time_compare�get_random_string�md5�pbkdf2)�RemovedInDjango50Warning�RemovedInDjango51Warning)� import_string)� gettext_noop�!�( c C s | du p| � t� S )zv Return True if this password wasn't generated by User.set_unusable_password(), i.e. make_password(None). N)� startswith�UNUSABLE_PASSWORD_PREFIX)�encoded� r �\/home/gouroczh/virtualenv/pat/3.9/lib/python3.9/site-packages/django/contrib/auth/hashers.py�is_password_usable s r �defaultc C s� | du st |�sdS t|�}z t|�}W n ty< Y dS 0 |j|jk}|pV|�|�}|�| |�}|s||s||r||�| |� |r�|r�|r�|| � |S )z� Return a boolean of whether the raw password matches the three part encoded digest. If setter is specified, it'll be called when you need to regenerate the password. NF)r � get_hasher�identify_hasher� ValueError� algorithm� must_update�verify�harden_runtime)�passwordr �setter� preferred�hasherZhasher_changedr Z is_correctr r r �check_password& s r# c C sT | du rt tt� S t| ttf�s4tdt| �j ��t |�}|pF|� � }|� | |�S )a| Turn a plain-text password into a hash for database storage Same as encode() but generate a new random salt. If password is None then return a concatenation of UNUSABLE_PASSWORD_PREFIX and a random string, which disallows logins. Additional random string reduces chances of gaining access to staff or superuser accounts. See ticket #20079 for more info. Nz+Password must be a string or bytes, got %s.) r r � UNUSABLE_PASSWORD_SUFFIX_LENGTH� isinstance�bytes�str� TypeError�type� __qualname__r �salt�encode)r r+ r" r r r � make_passwordH s � � r- c C sB g } t jD ]2}t|�}|� }t|d�s2td| ��| �|� q | S )Nr z,hasher doesn't specify an algorithm name: %s)r �PASSWORD_HASHERSr �getattrr �append)�hashersZ hasher_pathZ hasher_clsr" r r r � get_hashers^ s � r2 c C s dd� t � D �S )Nc S s i | ] }|j |�qS r �r )�.0r" r r r � <dictcomp>n � z,get_hashers_by_algorithm.<locals>.<dictcomp>)r2 r r r r �get_hashers_by_algorithml s r7 c K s | dkrt �� t�� d S )Nr. )r2 � cache_clearr7 )Zsetting�kwargsr r r � reset_hashersq s r: c C sT t | d�r| S | dkr t� d S t� }z || W S tyN td| ��Y n0 dS )z� Return an instance of a loaded password hasher. If algorithm is 'default', return the default hasher. Lazily import hashers specified in the project's settings file if needed. r r r z\Unknown password hashing algorithm '%s'. Did you specify it in the PASSWORD_HASHERS setting?N)�hasattrr2 r7 �KeyErrorr )r r1 r r r r x s ��r c C sd t | �dkrd| vs*t | �dkr0| �d�r0d}n,t | �dkrL| �d�rLd}n| �dd �d }t|�S ) z� Return an instance of a loaded password hasher. Identify hasher algorithm by examining encoded hash, and call get_hasher() to return hasher. Raise ValueError if algorithm cannot be identified, or if hasher is not loaded. � �$�% �md5$$� unsalted_md5�. �sha1$$� unsalted_sha1� r )�lenr �splitr )r r r r r r � s ��r � �*c C s( | d|� }||t | |d� � 7 }|S )z� Return the given hash, with only the first ``show`` number shown. The rest are masked with ``char`` for security reasons. N)rF )�hash�show�charZmaskedr r r � mask_hash� s rM c C s t | �t�t t�� |k S �N)rF �math�log2r )r+ Zexpected_entropyr r r �must_update_salt� s rQ c @ sd e Zd ZdZdZdZdZdd� Zdd� Zdd � Z d d � Z d d � Z dd� Z dd� Z dd� Zdd� ZdS )�BasePasswordHasherz� Abstract base class for password hashers When creating your own hasher, you need to override algorithm, verify(), encode() and safe_summary(). PasswordHasher objects are immutable. N� c C s� | j d urxt| j ttf�r&| j \}}n| j }zt�|�}W n8 tyr } z td| jj |f ��W Y d }~n d }~0 0 |S td| jj ��d S )Nz&Couldn't load %r algorithm library: %sz-Hasher %r doesn't specify a library attribute) �libraryr% �tuple�list� importlib� import_module� ImportErrorr � __class__�__name__)�self�nameZmod_path�module�er r r � _load_library� s �� �z BasePasswordHasher._load_libraryc C s& t �| jt �tt�� �}t|td�S )z� Generate a cryptographically secure nonce salt in ASCII with an entropy of at least `salt_entropy` bits. )� allowed_chars)rO �ceil� salt_entropyrP rF r r )r\ Z char_countr r r r+ � s zBasePasswordHasher.saltc C s t d��dS )z'Check if the given password is correct.z?subclasses of BasePasswordHasher must provide a verify() methodN��NotImplementedError�r\ r r r r r r � s �zBasePasswordHasher.verifyc C s( |d u rt d��|r d|v r$td��d S )Nzpassword must be provided.r> z+salt must be provided and cannot contain $.)r( r �r\ r r+ r r r �_check_encode_args� s z%BasePasswordHasher._check_encode_argsc C s t d��dS )z� Create an encoded database value. The result is normally formatted as "algorithm$salt$hash" and must be fewer than 128 characters. z@subclasses of BasePasswordHasher must provide an encode() methodNrd rg r r r r, � s �zBasePasswordHasher.encodec C s t d��dS )z� Return a decoded database value. The result is a dictionary and should contain `algorithm`, `hash`, and `salt`. Extra keys can be algorithm specific like `iterations` or `work_factor`. z@subclasses of BasePasswordHasher must provide a decode() method.Nrd �r\ r r r r �decode� s �zBasePasswordHasher.decodec C s t d��dS )z� Return a summary of safe values. The result is a dictionary and will be used where the password field must be displayed to construct a safe representation of the password. zEsubclasses of BasePasswordHasher must provide a safe_summary() methodNrd ri r r r � safe_summary s �z BasePasswordHasher.safe_summaryc C s dS )NFr ri r r r r s z BasePasswordHasher.must_updatec C s t �d� dS )a� Bridge the runtime gap between the work factor supplied in `encoded` and the work factor suggested by this hasher. Taking PBKDF2 as an example, if `encoded` contains 20000 iterations and `self.iterations` is 30000, this method should run password through another 10000 iterations of PBKDF2. Similar approaches should exist for any hasher that has a work factor. If not, this method should be defined as a no-op to silence the warning. zIsubclasses of BasePasswordHasher should provide a harden_runtime() methodN)�warnings�warnrf r r r r s �z!BasePasswordHasher.harden_runtime)r[ � __module__r* �__doc__r rT rc r` r+ r rh r, rj rk r r r r r r rR � s rR c @ sP e Zd ZdZdZdZejZddd�Z dd� Z d d � Z d d � Z d d� Z dd� ZdS )�PBKDF2PasswordHashera Secure password hashing using the PBKDF2 algorithm (recommended) Configured to use PBKDF2 + HMAC + SHA256. The result is a 64 byte binary string. Iterations may be changed safely but you must rename the algorithm if you change SHA256. Z pbkdf2_sha256i�' Nc C sN | � ||� |p| j}t|||| jd�}t�|��d��� }d| j|||f S )N)�digest�asciiz %s$%d$%s$%s) rh � iterationsr rq �base64� b64encoderj �stripr )r\ r r+ rs rJ r r r r, . s zPBKDF2PasswordHasher.encodec C s4 |� dd�\}}}}|| jks"J �||t|�|d�S )Nr> � )r rJ rs r+ �rG r �int)r\ r r rs r+ rJ r r r rj 5 s �zPBKDF2PasswordHasher.decodec C s* | � |�}| �||d |d �}t||�S �Nr+ rs �rj r, r �r\ r r �decoded� encoded_2r r r r ? s zPBKDF2PasswordHasher.verifyc C sF | � |�}td�|d td�|d td�t|d �td�t|d �iS )Nr rs r+ rJ �rj �_rM �r\ r r} r r r rk D s �z!PBKDF2PasswordHasher.safe_summaryc C s, | � |�}t|d | j�}|d | jkp*|S rz )rj rQ rc rs )r\ r r} � update_saltr r r r M s z PBKDF2PasswordHasher.must_updatec C s6 | � |�}| j|d }|dkr2| �||d |� d S )Nrs r r+ )rj rs r, )r\ r r r} Zextra_iterationsr r r r R s z#PBKDF2PasswordHasher.harden_runtime)N)r[ rn r* ro r rs �hashlib�sha256rq r, rj r rk r r r r r r rp ! s rp c @ s e Zd ZdZdZejZdS )�PBKDF2SHA1PasswordHasherz� Alternate PBKDF2 hasher which uses SHA1, the default PRF recommended by PKCS #5. This is compatible with other implementations of PBKDF2, such as openssl's PKCS5_PBKDF2_HMAC_SHA1(). Z pbkdf2_sha1N)r[ rn r* ro r r� �sha1rq r r r r r� Y s r� c @ s\ e Zd ZdZdZdZdZdZdZdd� Z dd � Z d d � Z d d � Z dd� Z dd� Zdd� ZdS )�Argon2PasswordHashera Secure password hashing using the argon2 algorithm. This is the winner of the Password Hashing Competition 2013-2015 (https://password-hashing.net). It requires the argon2-cffi library which depends on native C code and might cause portability issues. �argon2� i � � c C sL | � � }| �� }|jj|�� |�� |j|j|j|j|j d�}| j |� d� S )N)� time_cost� memory_cost� parallelism�hash_lenr) rr ) r` �params� low_levelZ hash_secretr, r� r� r� r� r) r rj )r\ r r+ r� r� �datar r r r, u s � zArgon2PasswordHasher.encodec C s� | � � }|�dd�\}}|| jks&J �|�d| �}|�d��^}}}} |dt|� d 7 }t�|��d�} || |j|j | |j ||j |d� S )Nr> rE �=� �latin1) r rJ r� r� r+ r� �variety�versionr� ) r` rG r Zextract_parametersrF rt � b64decoderj r� r� r� r� ) r\ r r� r �restr� r� r� Zb64saltrJ r+ r r r rj � s" �zArgon2PasswordHasher.decodec C sZ | � � }|�dd�\}}|| jks&J �z|�� �d| |�W S |jjyT Y dS 0 d S )Nr> rE F)r` rG r ZPasswordHasherr � exceptionsZVerificationError)r\ r r r� r r� r r r r � s zArgon2PasswordHasher.verifyc C sv | � |�}td�|d td�|d td�|d td�|d td�|d td�|d td �t|d �td �t|d �iS ) Nr r� r� z memory costr� z time costr� r� r+ rJ r r� r r r rk � s �z!Argon2PasswordHasher.safe_summaryc C s> | � |�}|d }| �� }|j|_t|d | j�}||kp<|S )Nr� r+ )rj r� �salt_lenrQ rc )r\ r r} Zcurrent_params� new_paramsr� r r r r � s z Argon2PasswordHasher.must_updatec C s d S rN r rf r r r r � s z#Argon2PasswordHasher.harden_runtimec C s4 | � � }|j|jjj|jj|j|j| j| j | j d�S )N)r) r� r� r� r� r� r� ) r` Z Parametersr� �TypeZIDZARGON2_VERSIONZDEFAULT_RANDOM_SALT_LENGTHZDEFAULT_HASH_LENGTHr� r� r� )r\ r� r r r r� � s �zArgon2PasswordHasher.paramsN)r[ rn r* ro r rT r� r� r� r, rj r rk r r r� r r r r r� e s r� c @ sZ e Zd ZdZdZejZdZdZ dd� Z dd� Z d d � Z d d � Z d d� Zdd� Zdd� ZdS )�BCryptSHA256PasswordHashera& Secure password hashing using the bcrypt algorithm (recommended) This is considered by many to be the most secure algorithm but you must first install the bcrypt library. Please be warned that this library depends on native C code and might cause portability issues. Z bcrypt_sha256)�bcryptr� � c C s | � � }|�| j�S rN )r` Zgensalt�rounds)r\ r� r r r r+ � s z BCryptSHA256PasswordHasher.saltc C sN | � � }|�� }| jd ur.t�| �|��� �}|�||�}d| j|�d�f S )Nz%s$%srr )r` r, rq �binascii�hexlifyZhashpwr rj )r\ r r+ r� r� r r r r, � s z!BCryptSHA256PasswordHasher.encodec C sH |� dd�\}}}}}|| jks$J �|||dd � |d d� t|�d�S )Nr> r� � )r �algostr�checksumr+ � work_factorrx )r\ r r �emptyr� r� r� r r r rj � s �z!BCryptSHA256PasswordHasher.decodec C s: |� dd�\}}|| jks J �| �||�d��}t||�S )Nr> rE rr )rG r r, r )r\ r r r r� r~ r r r r � s z!BCryptSHA256PasswordHasher.verifyc C sF | � |�}td�|d td�|d td�t|d �td�t|d �iS )Nr � work factorr� r+ r� r r� r r r rk � s �z'BCryptSHA256PasswordHasher.safe_summaryc C s | � |�}|d | jkS )Nr� )rj r� r� r r r r s z&BCryptSHA256PasswordHasher.must_updatec C sh |� dd�\}}|d d� }|� d�d }d| jt|� d }|dkrd| �||�d�� |d8 }q@d S )Nr> rE � r� r rr )rG r� ry r, )r\ r r r� r� r+ r� �diffr r r r s z)BCryptSHA256PasswordHasher.harden_runtimeN)r[ rn r* ro r r� r� rq rT r� r+ r, rj r rk r r r r r r r� � s r� c @ s e Zd ZdZdZdZdS )�BCryptPasswordHashera� Secure password hashing using the bcrypt algorithm This is considered by many to be the most secure algorithm but you must first install the bcrypt library. Please be warned that this library depends on native C code and might cause portability issues. This hasher does not first hash the password which means it is subject to bcrypt's 72 bytes password truncation. Most use cases should prefer the BCryptSHA256PasswordHasher. r� N)r[ rn r* ro r rq r r r r r� s r� c @ sV e Zd ZdZdZdZdZdZdZddd �Z d d � Z d d � Z dd� Z dd� Z dd� ZdS )�ScryptPasswordHasherz= Secure password hashing using the Scrypt algorithm. �scryptr� r rE i @ Nc C sv | � ||� |p| j}|p | j}|p(| j}tj|�� |�� |||| jdd�}t� |�� d�� � }d| j |||||f S )N�@ )r+ �n�r�p�maxmemZdklenrr z%s$%d$%s$%d$%d$%s) rh r� � block_sizer� r� r� r, r� rt ru rj rv r )r\ r r+ r� r� r� �hash_r r r r, 0 s � zScryptPasswordHasher.encodec C sD |� dd�\}}}}}}|| jks&J �|t|�|t|�t|�|d�S )Nr> rH )r r� r+ r� r� rJ rx )r\ r r r� r+ r� r� r� r r r rj A s ��zScryptPasswordHasher.decodec C s6 | � |�}| �||d |d |d |d �}t||�S )Nr+ r� r� r� r{ r| r r r r O s �zScryptPasswordHasher.verifyc C s^ | � |�}td�|d td�|d td�|d td�|d td�t|d �td�t|d �iS ) Nr r� r� z block sizer� r� r+ rJ r r� r r r rk Z s �z!ScryptPasswordHasher.safe_summaryc C s4 | � |�}|d | jkp2|d | jkp2|d | jkS )Nr� r� r� )rj r� r� r� r� r r r r e s � �z ScryptPasswordHasher.must_updatec C s d S rN r rf r r r r m s z#ScryptPasswordHasher.harden_runtime)NNN)r[ rn r* ro r r� r� r� r� r, rj r rk r r r r r r r� % s r� c sT e Zd ZdZdZ� fdd�Zdd� Zdd� Zd d � Zd d � Z d d� Z dd� Z � Z S )�SHA1PasswordHasherz? The SHA1 password hashing algorithm (not recommended) r� c s& t jdtdd� t� j|i |�� d S )Nz=django.contrib.auth.hashers.SHA1PasswordHasher is deprecated.r� �� stacklevel�rl rm r �super�__init__�r\ �argsr9 �rZ r r r� { s �zSHA1PasswordHasher.__init__c C s2 | � ||� t�|| �� ��� }d| j||f S �N�%s$%s$%s)rh r� r� r, � hexdigestr �r\ r r+ rJ r r r r, � s zSHA1PasswordHasher.encodec C s, |� dd�\}}}|| jks J �|||d�S �Nr> r� �r rJ r+ �rG r �r\ r r r+ rJ r r r rj � s �zSHA1PasswordHasher.decodec C s$ | � |�}| �||d �}t||�S �Nr+ r{ r| r r r r � s zSHA1PasswordHasher.verifyc C s> | � |�}td�|d td�t|d dd�td�t|d �iS �Nr r+ r� �rK rJ r r� r r r rk � s �z SHA1PasswordHasher.safe_summaryc C s | � |�}t|d | j�S r� �rj rQ rc r� r r r r � s z SHA1PasswordHasher.must_updatec C s d S rN r rf r r r r � s z!SHA1PasswordHasher.harden_runtime) r[ rn r* ro r r� r, rj r rk r r � __classcell__r r r� r r� t s r� c @ sD e Zd ZdZdZdd� Zdd� Zdd� Zd d � Zd d � Z d d� Z dS )�MD5PasswordHasherzE The Salted MD5 password hashing algorithm (not recommended) r c C s0 | � ||� t|| �� ��� }d| j||f S r� )rh r r, r� r r� r r r r, � s zMD5PasswordHasher.encodec C s, |� dd�\}}}|| jks J �|||d�S r� r� r� r r r rj � s �zMD5PasswordHasher.decodec C s$ | � |�}| �||d �}t||�S r� r{ r| r r r r � s zMD5PasswordHasher.verifyc C s> | � |�}td�|d td�t|d dd�td�t|d �iS r� r r� r r r rk � s �z MD5PasswordHasher.safe_summaryc C s | � |�}t|d | j�S r� r� r� r r r r � s z MD5PasswordHasher.must_updatec C s d S rN r rf r r r r � s z MD5PasswordHasher.harden_runtimeN) r[ rn r* ro r r, rj r rk r r r r r r r� � s r� c sT e Zd ZdZdZ� fdd�Zdd� Zdd� Zd d � Zd d � Z d d� Z dd� Z � Z S )�UnsaltedSHA1PasswordHashera7 Very insecure algorithm that you should *never* use; store SHA1 hashes with an empty salt. This class is implemented because Django used to accept such password hashes. Some older Django installs still have these values lingering around so we need to handle and upgrade them properly. rD c s& t jdtdd� t� j|i |�� d S )NzEdjango.contrib.auth.hashers.UnsaltedSHA1PasswordHasher is deprecated.r� r� r� r� r� r r r� � s �z#UnsaltedSHA1PasswordHasher.__init__c C s dS �N� r �r\ r r r r+ � s z UnsaltedSHA1PasswordHasher.saltc C s* |dkrt d��t�|�� ��� }d| S )Nr� �salt must be empty.zsha1$$%s)r r� r� r, r� r� r r r r, � s z!UnsaltedSHA1PasswordHasher.encodec C s$ |� d�sJ �| j|dd � d d�S )NrC rH r� )r r ri r r r rj � s �z!UnsaltedSHA1PasswordHasher.decodec C s | � |d�}t||�S r� )r, r �r\ r r r~ r r r r � s z!UnsaltedSHA1PasswordHasher.verifyc C s* | � |�}td�|d td�t|d �iS )Nr rJ r r� r r r rk � s �z'UnsaltedSHA1PasswordHasher.safe_summaryc C s d S rN r rf r r r r s z)UnsaltedSHA1PasswordHasher.harden_runtime� r[ rn r* ro r r� r+ r, rj r rk r r� r r r� r r� � s r� c sT e Zd ZdZdZ� fdd�Zdd� Zdd� Zd d � Zd d � Z d d� Z dd� Z � Z S )�UnsaltedMD5PasswordHashera� Incredibly insecure algorithm that you should *never* use; stores unsalted MD5 hashes without the algorithm prefix, also accepts MD5 hashes with an empty salt. This class is implemented because Django used to store passwords this way and to accept such password hashes. Some older Django installs still have these values lingering around so we need to handle and upgrade them properly. rA c s& t jdtdd� t� j|i |�� d S )NzDdjango.contrib.auth.hashers.UnsaltedMD5PasswordHasher is deprecated.r� r� r� r� r� r r r� s �z"UnsaltedMD5PasswordHasher.__init__c C s dS r� r r� r r r r+ s z UnsaltedMD5PasswordHasher.saltc C s |dkrt d��t|�� ��� S )Nr� r� )r r r, r� rg r r r r, s z UnsaltedMD5PasswordHasher.encodec C s | j |d d�S )Nr� r3 ri r r r rj $ s �z UnsaltedMD5PasswordHasher.decodec C s8 t |�dkr"|�d�r"|dd � }| �|d�}t||�S )Nr? r@ � r� )rF r r, r r� r r r r + s z UnsaltedMD5PasswordHasher.verifyc C s. | � |�}td�|d td�t|d dd�iS )Nr rJ rw r� r r� r r r rk 1 s �z&UnsaltedMD5PasswordHasher.safe_summaryc C s d S rN r rf r r r r 8 s z(UnsaltedMD5PasswordHasher.harden_runtimer� r r r� r r� s r� c sX e Zd ZdZdZdZ� fdd�Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z � Z S )�CryptPasswordHasherzv Password hashing using UNIX crypt (not recommended) The crypt module is not supported on all platforms. �cryptc s& t jdtdd� t� j|i |�� d S )Nz>django.contrib.auth.hashers.CryptPasswordHasher is deprecated.r� r� )rl rm r r� r� r� r� r r r� G s �z CryptPasswordHasher.__init__c C s t d�S )Nr� )r r� r r r r+ O s zCryptPasswordHasher.saltc C sH | � � }t|�dkr td��|�||�}|d u r8td��d| jd|f S )Nr� zsalt must be of length 2.zhash must be provided.r� r� )r` rF r r� r( r )r\ r r+ r� rJ r r r r, R s zCryptPasswordHasher.encodec C s, |� dd�\}}}|| jks J �|||d�S r� r� r� r r r rj \ s �zCryptPasswordHasher.decodec C s0 | � � }| �|�}|�||d �}t|d |�S )NrJ )r` rj r� r )r\ r r r� r} r� r r r r e s zCryptPasswordHasher.verifyc C s: | � |�}td�|d td�|d td�t|d dd�iS )Nr r+ rJ rw r� r r� r r r rk k s �z CryptPasswordHasher.safe_summaryc C s d S rN r rf r r r r s s z"CryptPasswordHasher.harden_runtime)r[ rn r* ro r rT r� r+ r, rj r rk r r� r r r� r r� = s r� )Nr )Nr )r )rH rI )6rt r� � functoolsr� rW rO rl Z django.confr Zdjango.core.exceptionsr Zdjango.core.signalsr Zdjango.dispatchr Zdjango.utils.cryptor r r r r Zdjango.utils.deprecationr r Zdjango.utils.module_loadingr Zdjango.utils.translationr r� r r$ r r# r- � lru_cacher2 r7 r: r r rM rQ rR rp r� r� r� r� r� r� r� r� r� r� r r r r �<module> sT � " k8 fHO2+57