Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Cleanup to use get_random_string consistently.

Removes several ad hoc implementations of get_random_string()
and removes an innapropriate use of settings.SECRET_KEY.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@17580 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit 239e41f7c551308cea64561eed43ef2e81b60370 1 parent f2de5f4
@PaulMcMillan PaulMcMillan authored
View
29 django/contrib/sessions/backends/base.py
@@ -1,7 +1,4 @@
import base64
-import hashlib
-import os
-import random
import time
from datetime import datetime, timedelta
try:
@@ -11,16 +8,11 @@
from django.conf import settings
from django.core.exceptions import SuspiciousOperation
-from django.utils.crypto import constant_time_compare, salted_hmac
+from django.utils.crypto import constant_time_compare
+from django.utils.crypto import get_random_string
+from django.utils.crypto import salted_hmac
from django.utils import timezone
-# Use the system (hardware-based) random number generator if it exists.
-if hasattr(random, 'SystemRandom'):
- randrange = random.SystemRandom().randrange
-else:
- randrange = random.randrange
-MAX_SESSION_KEY = 18446744073709551616L # 2 << 63
-
class CreateError(Exception):
"""
Used internally as a consistent exception type to catch from save (see the
@@ -138,17 +130,12 @@ def clear(self):
def _get_new_session_key(self):
"Returns session key that isn't being used."
- # The random module is seeded when this Apache child is created.
- # Use settings.SECRET_KEY as added salt.
- try:
- pid = os.getpid()
- except AttributeError:
- # No getpid() in Jython, for example
- pid = 1
+ # Todo: move to 0-9a-z charset in 1.5
+ hex_chars = '1234567890abcdef'
+ # session_key should not be case sensitive because some backends
+ # can store it on case insensitive file systems.
while True:
- session_key = hashlib.md5("%s%s%s%s"
- % (randrange(0, MAX_SESSION_KEY), pid, time.time(),
- settings.SECRET_KEY)).hexdigest()
+ session_key = get_random_string(32, hex_chars)
if not self.exists(session_key):
break
return session_key
View
5 django/core/management/commands/startproject.py
@@ -1,7 +1,6 @@
-from random import choice
-
from django.core.management.base import CommandError
from django.core.management.templates import TemplateCommand
+from django.utils.crypto import get_random_string
from django.utils.importlib import import_module
@@ -27,6 +26,6 @@ def handle(self, project_name=None, target=None, *args, **options):
# Create a random SECRET_KEY hash to put it in the main settings.
chars = 'abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*(-_=+)'
- options['secret_key'] = ''.join([choice(chars) for i in range(50)])
+ options['secret_key'] = get_random_string(50, chars)
super(Command, self).handle('project', project_name, target, **options)
View
14 django/utils/crypto.py
@@ -7,6 +7,13 @@
import hashlib
import binascii
import operator
+
+import random
+try:
+ random = random.SystemRandom()
+except NotImplementedError:
+ pass
+
from django.conf import settings
@@ -43,13 +50,8 @@ def get_random_string(length=12,
Returns a random string of length characters from the set of a-z, A-Z, 0-9.
The default length of 12 with the a-z, A-Z, 0-9 character set returns
- a 71-bit salt. log_2((26+26+10)^12) =~ 71 bits
+ a 71-bit value. log_2((26+26+10)^12) =~ 71 bits
"""
- import random
- try:
- random = random.SystemRandom()
- except NotImplementedError:
- pass
return ''.join([random.choice(allowed_chars) for i in range(length)])
Please sign in to comment.
Something went wrong with that request. Please try again.