3 ­©Þ[š.ã@sÂddlZddlZddlZddlmZmZddlmZddlmZddl m Z ddl m Z ddl mZmZmZddlmZdd lmZejejZGd d „d eƒZGd d „d eƒZGdd„dƒZdS)éN)ÚdatetimeÚ timedelta)Úsettings)ÚSuspiciousSession)ÚSuspiciousOperation)Útimezone)Úconstant_time_compareÚget_random_stringÚ salted_hmac)Ú force_bytes)Ú import_stringc@seZdZdZdS)Ú CreateErrorz‡ Used internally as a consistent exception type to catch from save (see the docstring for SessionBase.save() for details). N)Ú__name__Ú __module__Ú __qualname__Ú__doc__©rrúI/tmp/pip-install-j7i95hgp/django/django/contrib/sessions/backends/base.pyr sr c@seZdZdZdS)Ú UpdateErrorzF Occurs if Django tries to update a session that was deleted. N)rrrrrrrrrsrc@s‚eZdZdZdZdZeƒZdTdd„Zdd„Z d d „Z d d „Z d d„Z dUdd„Z efdd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd „Zd!d"„Zd#d$„Zd%d&„Zd'd(„Zd)d*„Zd+d,„Zd-d.„Zd/d0„Zd1d2„Zd3d4„Zd5d6„Z d7d8„Z!e"e ƒZ#e"e e!ƒZ$dVd:d;„Z%e"e%ƒZ&dd?„Z(d@dA„Z)dBdC„Z*dDdE„Z+dFdG„Z,dHdI„Z-dJdK„Z.dWdLdM„Z/dXdNdO„Z0dPdQ„Z1e2dRdS„ƒZ3dS)YÚ SessionBasez- Base class for all Session classes. Z testcookieZworkedNcCs"||_d|_d|_ttjƒ|_dS)NF)Ú _session_keyÚaccessedÚmodifiedr rZSESSION_SERIALIZERÚ serializer)ÚselfÚ session_keyrrrÚ__init__-szSessionBase.__init__cCs ||jkS)N)Ú_session)rÚkeyrrrÚ __contains__3szSessionBase.__contains__cCs |j|S)N)r)rrrrrÚ __getitem__6szSessionBase.__getitem__cCs||j|<d|_dS)NT)rr)rrÚvaluerrrÚ __setitem__9s zSessionBase.__setitem__cCs|j|=d|_dS)NT)rr)rrrrrÚ __delitem__=szSessionBase.__delitem__cCs|jj||ƒS)N)rÚget)rrÚdefaultrrrr$AszSessionBase.getcCs8|jp||jk|_||jkr fn|f}|jj|f|žŽS)N)rrÚ_SessionBase__not_givenÚpop)rrr%Úargsrrrr'DszSessionBase.popcCs,||jkr|j|Sd|_||j|<|SdS)NT)rr)rrr!rrrÚ setdefaultIs    zSessionBase.setdefaultcCs|j||j<dS)N)ÚTEST_COOKIE_VALUEÚTEST_COOKIE_NAME)rrrrÚset_test_cookieQszSessionBase.set_test_cookiecCs|j|jƒ|jkS)N)r$r+r*)rrrrÚtest_cookie_workedTszSessionBase.test_cookie_workedcCs ||j=dS)N)r+)rrrrÚdelete_test_cookieWszSessionBase.delete_test_cookiecCsd|jj}t||ƒjƒS)Nzdjango.contrib.sessions)Ú __class__rr Ú hexdigest)rr!Zkey_saltrrrÚ_hashZs zSessionBase._hashcCs4|jƒj|ƒ}|j|ƒ}tj|jƒd|ƒjdƒS)zGReturn the given session dictionary serialized and encoded as a string.ó:Úascii)rÚdumpsr1Úbase64Ú b64encodeÚencodeÚdecode)rZ session_dictÚ serializedÚhashrrrr7^s zSessionBase.encodecCs¢tjt|ƒƒ}yD|jddƒ\}}|j|ƒ}t|jƒ|ƒsBtdƒ‚n|jƒj |ƒSWnJt k rœ}z.t |t ƒrŽt jd|jjƒ}|jt|ƒƒiSd}~XnXdS)Nr2ézSession data corruptedzdjango.security.%s)r5Ú b64decoder Úsplitr1rr8rrÚloadsÚ ExceptionÚ isinstancerÚloggingÚ getLoggerr/rÚwarningÚstr)rZ session_dataZ encoded_datar:r9Z expected_hashÚeÚloggerrrrr8ds   zSessionBase.decodecCs|jj|ƒd|_dS)NT)rÚupdater)rZdict_rrrrGvs zSessionBase.updatecCs ||jkS)N)r)rrrrrÚhas_keyzszSessionBase.has_keycCs |jjƒS)N)rÚkeys)rrrrrI}szSessionBase.keyscCs |jjƒS)N)rÚvalues)rrrrrJ€szSessionBase.valuescCs |jjƒS)N)rÚitems)rrrrrKƒszSessionBase.itemscCsi|_d|_d|_dS)NT)Ú_session_cacherr)rrrrÚclear†szSessionBase.clearc Cs*y|j o|j Stk r$dSXdS)zBReturn True when there is no session_key and the session is empty.TN)rrLÚAttributeError)rrrrÚis_emptyŽszSessionBase.is_emptycCs"xtdtƒ}|j|ƒs|SqWdS)z)Return session key that isn't being used.é N)r ÚVALID_KEY_CHARSÚexists)rrrrrÚ_get_new_session_key•s  z SessionBase._get_new_session_keycCs|jdkr|jƒ|_|jS)N)rrS)rrrrÚ_get_or_create_session_keyœs  z&SessionBase._get_or_create_session_keycCs|ot|ƒdkS)z” Key must be truthy and at least 8 characters long. 8 characters is an arbitrary lower bound for some minimal key security. é)Úlen)rrrrrÚ_validate_session_key¡sz!SessionBase._validate_session_keycCs|jS)N)Ú_SessionBase__session_key)rrrrÚ_get_session_key¨szSessionBase._get_session_keycCs|j|ƒr||_nd|_dS)zV Validate session key on assignment. Invalid values will set to None. N)rWrX)rr!rrrÚ_set_session_key«s zSessionBase._set_session_keyFc CsHd|_y|jStk r@|jdks*|r2i|_n |jƒ|_YnX|jS)zž Lazily load session from storage (unless "no_load" is True, when only an empty dict is stored) and store it in the current instance. TN)rrLrNrÚload)rZno_loadrrrÚ _get_session·szSessionBase._get_sessioncKs†y |d}Wntk r(tjƒ}YnXy |d}Wntk rT|jdƒ}YnX|s`tjSt|tƒsn|S||}|jd|j S)zÕGet the number of seconds until the session expires. Optionally, this function accepts `modification` and `expiry` keyword arguments specifying the modification and expiry of the session. Ú modificationÚexpiryÚ_session_expiryi€Q) ÚKeyErrorrÚnowr$rÚSESSION_COOKIE_AGEr@rÚdaysÚseconds)rÚkwargsr]r^ÚdeltarrrÚget_expiry_ageÈs   zSessionBase.get_expiry_agecKs|y |d}Wntk r(tjƒ}YnXy |d}Wntk rT|jdƒ}YnXt|tƒrd|S|pltj}|t|dS)zÔGet session the expiry date (as a datetime object). Optionally, this function accepts `modification` and `expiry` keyword arguments specifying the modification and expiry of the session. r]r^r_)rd) r`rrar$r@rrrbr)rrer]r^rrrÚget_expiry_dateás    zSessionBase.get_expiry_datec CsN|dkr,y |d=Wntk r&YnXdSt|tƒrBtjƒ|}||d<dS)a* Set a custom expiration for the session. ``value`` can be an integer, a Python ``datetime`` or ``timedelta`` object or ``None``. If ``value`` is an integer, the session will expire after that many seconds of inactivity. If set to ``0`` then the session will expire on browser close. If ``value`` is a ``datetime`` or ``timedelta`` object, the session will expire at that specific future time. If ``value`` is ``None``, the session uses the global session expiry policy. Nr_)r`r@rrra)rr!rrrÚ set_expiryös   zSessionBase.set_expirycCs"|jdƒdkrtjS|jdƒdkS)a Return ``True`` if the session is set to expire when the browser closes, and ``False`` if there's an expiry date. Use ``get_expiry_date()`` or ``get_expiry_age()`` to find the actual expiry date/age, if there is one. r_Nr)r$rZSESSION_EXPIRE_AT_BROWSER_CLOSE)rrrrÚget_expire_at_browser_closesz'SessionBase.get_expire_at_browser_closecCs|jƒ|jƒd|_dS)zc Remove the current session data from the database and regenerate the key. N)rMÚdeleter)rrrrÚflushszSessionBase.flushcCs,|j}|j}|jƒ||_|r(|j|ƒdS)zU Create a new session key, while retaining the current session data. N)rrÚcreaterLrk)rÚdatarrrrÚ cycle_key$s zSessionBase.cycle_keycCs tdƒ‚dS)zF Return True if the given session_key already exists. z9subclasses of SessionBase must provide an exists() methodN)ÚNotImplementedError)rrrrrrR1szSessionBase.existscCs tdƒ‚dS)zÅ Create a new session instance. Guaranteed to create a new object with a unique key and will have saved the result once (with empty data) before the method returns. z8subclasses of SessionBase must provide a create() methodN)rp)rrrrrm7szSessionBase.createcCs tdƒ‚dS)zä Save the session data. If 'must_create' is True, create a new session object (or raise CreateError). Otherwise, only update an existing object and don't create one (raise UpdateError if needed). z6subclasses of SessionBase must provide a save() methodN)rp)rZ must_createrrrÚsave?szSessionBase.savecCs tdƒ‚dS)zx Delete the session data under this key. If the key is None, use the current session key value. z8subclasses of SessionBase must provide a delete() methodN)rp)rrrrrrkGszSessionBase.deletecCs tdƒ‚dS)z@ Load the session data and return a dictionary. z6subclasses of SessionBase must provide a load() methodN)rp)rrrrr[NszSessionBase.loadcCs tdƒ‚dS)a Remove expired sessions from the session store. If this operation isn't possible on a given backend, it should raise NotImplementedError. If it isn't necessary, because the backend has a built-in expiration mechanism, it should be a no-op. z.This backend does not support clear_expired().N)rp)ÚclsrrrÚ clear_expiredTs zSessionBase.clear_expired)N)N)F)F)N)4rrrrr+r*Úobjectr&rrr r"r#r$r'r)r,r-r.r1r7r8rGrHrIrJrKrMrOrSrTrWrYrZÚpropertyrrr\rrgrhrirjrlrorRrmrqrkr[Ú classmethodrsrrrrr$s\           r)r5rAÚstringrrZ django.confrZ"django.contrib.sessions.exceptionsrZdjango.core.exceptionsrZ django.utilsrZdjango.utils.cryptorr r Zdjango.utils.encodingr Zdjango.utils.module_loadingr Úascii_lowercaseÚdigitsrQr?r rrrrrrÚs