IntenseWebs/pgadmin4
3
0
Fork 0
mirror of https://github.com/pgadmin-org/pgadmin4.git synced 2025-02-25 18:55:31 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fixed some security hotspots.

Browse Source
This commit is contained in:
Akshay Joshi
2022-08-26 18:58:16 +05:30
parent fe0577be5f
commit af1e9210b9
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
web/pgadmin/utils/session.py
View File

@@ -20,7 +20,7 @@ import datetime
import hmac
import hashlib
import os
import random
import secrets
import string
import time
import config
@@ -41,7 +41,7 @@ from pgadmin.utils.ajax import make_json_response
def _calc_hmac(body, secret):
return base64.b64encode(
hmac.new(
secret.encode(), body.encode(), hashlib.sha1
secret.encode(), body.encode(), hashlib.sha256
).digest()
).decode()
@@ -70,7 +70,8 @@ class ManagedSession(CallbackDict, SessionMixin):
if not self.hmac_digest:
population = string.ascii_lowercase + string.digits
self.randval = ''.join(random.sample(population, 20))
self.randval = ''.join(
secrets.choice(population) for i in range(20))
self.hmac_digest = _calc_hmac(
'%s:%s' % (self.sid, self.randval), secret)