1ae3dc85c2
* fix 401-302-401-302-429 loop * don't logout users on bad form key, just treat the request as unauthenticated * Handle None/empty case in validate_formkey. A supplied empty formkey, or the lack of a supplied formkey (None) is not a valid formkey. Handle this inside the function rather than at the call-site. * Validate as false if no hashstr or string Co-authored-by: Snakes <104547575+TLSM@users.noreply.github.com>
23 lines
493 B
Python
23 lines
493 B
Python
from werkzeug.security import *
|
|
from os import environ
|
|
|
|
|
|
def generate_hash(string):
|
|
|
|
msg = bytes(string, "utf-16")
|
|
|
|
return hmac.new(key=bytes(environ.get("MASTER_KEY"), "utf-16"),
|
|
msg=msg,
|
|
digestmod='md5'
|
|
).hexdigest()
|
|
|
|
|
|
def validate_hash(string, hashstr):
|
|
if not string or not hashstr: return False
|
|
return hmac.compare_digest(hashstr, generate_hash(string))
|
|
|
|
|
|
def hash_password(password):
|
|
|
|
return generate_password_hash(
|
|
password, method='pbkdf2:sha512', salt_length=8)
|