OwlCyberSecurity - MANAGER
Edit File: tokens.cpython-39.pyc
a iH�f� � @ sP d dl m Z d dlmZ d dlmZmZ d dlmZmZ G dd� d�Z e � Z dS )� )�datetime)�settings)�constant_time_compare� salted_hmac)� base36_to_int� int_to_base36c @ s� e Zd ZdZdZdZdZdZdd� Zdd� Z dd � Z e e e �Z d d � Z d d � Ze e e�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� ZdS )�PasswordResetTokenGeneratorza Strategy object used to generate and check tokens for the password reset mechanism. z6django.contrib.auth.tokens.PasswordResetTokenGeneratorNc C s | j pd| _ d S )N�sha256)� algorithm��self� r �\/home/gouroczh/virtualenv/test/3.9/lib/python3.9/site-packages/django/contrib/auth/tokens.py�__init__ s z$PasswordResetTokenGenerator.__init__c C s | j p tjS �N)�_secretr Z SECRET_KEYr r r r � _get_secret s z'PasswordResetTokenGenerator._get_secretc C s || _ d S r )r )r �secretr r r � _set_secret s z'PasswordResetTokenGenerator._set_secretc C s | j d u rtjS | j S r )�_secret_fallbacksr ZSECRET_KEY_FALLBACKSr r r r �_get_fallbacks s z*PasswordResetTokenGenerator._get_fallbacksc C s || _ d S r )r )r Z fallbacksr r r �_set_fallbacks# s z*PasswordResetTokenGenerator._set_fallbacksc C s | � || �| �� �| j�S )zi Return a token that can be used once to do a password reset for the given user. )�_make_token_with_timestamp� _num_seconds�_nowr )r �userr r r � make_token( s �z&PasswordResetTokenGenerator.make_tokenc C s� |r|s dS z|� d�\}}W n ty2 Y dS 0 z t|�}W n tyT Y dS 0 | jg| j�D ] }t| �|||�|�rd q�qddS | �| �� �| t j kr�dS dS )zP Check that a password reset token is correct for a given user. F�-T) �split� ValueErrorr r �secret_fallbacksr r r r r ZPASSWORD_RESET_TIMEOUT)r r �token�ts_b36�_�tsr r r r � check_token3 s( �z'PasswordResetTokenGenerator.check_tokenc C s> t |�}t| j| �||�|| jd��� d d d� }d||f S )N)r r � z%s-%s)r r �key_salt�_make_hash_valuer � hexdigest)r r � timestampr r" Z hash_stringr r r r T s ��z6PasswordResetTokenGenerator._make_token_with_timestampc C sR |j du rdn|j jddd�}|�� }t||d�p4d}|j� |j� |� |� |� �S )a� Hash the user's primary key, email (if available), and some user state that's sure to change after a password reset to produce a token that is invalidated when it's used: 1. The password field will change upon a password reset (even if the same password is chosen, due to password salting). 2. The last_login field will usually be updated very shortly after a password reset. Failing those things, settings.PASSWORD_RESET_TIMEOUT eventually invalidates the token. Running this data through salted_hmac() prevents password cracking attempts using the reset token, provided the secret isn't compromised. N� r )� microsecond�tzinfo)Z last_login�replaceZget_email_field_name�getattr�pk�password)r r r* Zlogin_timestampZ email_field�emailr r r r( b s ��z,PasswordResetTokenGenerator._make_hash_valuec C s t |tddd� �� �S )Ni� � )�intr � total_seconds)r �dtr r r r | s z(PasswordResetTokenGenerator._num_secondsc C s t �� S r )r �nowr r r r r s z PasswordResetTokenGenerator._now)�__name__� __module__� __qualname__�__doc__r' r r r r r r �propertyr r r r r r% r r( r r r r r r r s$ !r N) r Z django.confr Zdjango.utils.cryptor r Zdjango.utils.httpr r r Zdefault_token_generatorr r r r �<module> s |