g7RdZddlZddlZddlmZmZddlmZddlmZm Z ddl m Z ddl m Z mZdd lmZmZdd lmZdd lmZmZGd d eZdZGddeZeZGdde eZGddeZGddeZGddeZdS)z flask.sessions ~~~~~~~~~~~~~~ Implements cookie based sessions based on itsdangerous. :copyright: (c) 2015 by Armin Ronacher. :license: BSD, see LICENSE for more details. N) b64encode b64decode)datetime) http_date parse_date) CallbackDict)Markupjson) iteritems text_type) total_seconds)URLSafeTimedSerializer BadSignaturecBeZdZdZdZdZeeeZ[[dZdZ dS) SessionMixinzvExpands a basic dictionary with an accessors that are expected by Flask extensions and users for the session. c.|ddS)N _permanentF)getselfs D/granary/edev/quantum/lib/python3.11/site-packages/flask/sessions.py_get_permanentzSessionMixin._get_permanentsxx e,,,c*t||d<dS)Nr)boolrvalues r_set_permanentzSessionMixin._set_permanent!s!%[[\rFTN) __name__ __module__ __qualname____doc__rrproperty permanentnewmodifiedrrrrs\---)))88I C HHHrrct|trdd|DiSt|tjr d|jiSt|t r$dt |diStt|ddr#dt| iSt|tr d|DSt|trd t|iSt|tr&td t!|DSt|t"r2 t|S#t$$rd d lm}|d |zwxYw|S)N tc,g|]}t|Sr(_tag.0xs r z_tag..6s...1tAww...r u bascii__html__ mc,g|]}t|Sr(r,r.s rr1z_tag..>s'''AQ'''r dc3>K|]\}}|t|fVdSNr,)r/kvs r z_tag..Bs0>>TQQQL>>>>>>rr)UnexpectedUnicodeErrorzA byte string with non-ASCII data was passed to the session system which can only store unicode strings. Consider base64 encoding your string (String was %r)) isinstancetupleuuidUUIDhexbytesrdecodecallablegetattrr r5listrrdictr str UnicodeErrorflask.debughelpersr>)rr>s rr-r-4s%H.....// E49 % %Hei  E5 ! !Hi&&--g6677 '%T22 3 3Hi 0 01122 E4 H'''''' E8 $ $ Hi&&'' E4 H>>Yu-=-=>>>>>> E3  H HU## # H H H A A A A A A((*?BG*GHH H H Ls E((FceZdZdZdZdZdS)TaggedJSONSerializerzA customized JSON serializer that supports a few extra types that we take for granted when serializing (tuples, markup objects, datetime). cHtjt|dS)N),:) separators)r dumpsr-rs rrSzTaggedJSONSerializer.dumpsTsz$u++*====rc4d}tj||S)NcJt|dkr|Stt|\}}|dkrt|S|dkrt j|S|dkrt |S|dkrt|S|dkrt|S|S)Nr r*r2r3r6r8) lennextr r@rArBrr r)objthe_key the_values r object_hookz/TaggedJSONSerializer.loads..object_hookXs3xx1}} !%inn!5!5 GY$Y'''Dy+++D +++Di(((D!),,,Jr)r[)r loads)rrr[s rr\zTaggedJSONSerializer.loadsWs(   z%[9999rN)r r!r"r#rSr\r(rrrNrNOs<>>>:::::rrNceZdZdZddZdS)SecureCookieSessionz0Base class for sessions based on signed cookies.NcFd}tj|||d|_dS)Ncd|_dS)NT)r'rs r on_updatez/SecureCookieSession.__init__..on_updateqs  DMMMrF)r__init__r')rinitialras rrbzSecureCookieSession.__init__ps1 ! ! !dGY777 rr:)r r!r"r#rbr(rrr^r^ms.::rr^c6eZdZdZdZexZxZxZxZxZ xZ Z [dS) NullSessionzClass used to generate nicer error messages if sessions are not available. Will still allow read-only access to the empty session but fail on setting. c td)NzThe session is unavailable because no secret key was set. Set the secret_key on the application to something unique and secret.) RuntimeError)rargskwargss r_failzNullSession._fail}sIJJ JrN) r r!r"r#rj __setitem__ __delitem__clearpoppopitemupdate setdefaultr(rrrerews_ JJJ $$K$+$$$g$ rrecVeZdZdZeZdZdZdZdZ dZ dZ dZ d Z d Zd Zd Zd S)SessionInterfaceaThe basic interface you have to implement in order to replace the default session interface which uses werkzeug's securecookie implementation. The only methods you have to implement are :meth:`open_session` and :meth:`save_session`, the others have useful defaults which you don't need to change. The session object returned by the :meth:`open_session` method has to provide a dictionary like interface plus the properties and methods from the :class:`SessionMixin`. We recommend just subclassing a dict and adding that mixin:: class Session(dict, SessionMixin): pass If :meth:`open_session` returns ``None`` Flask will call into :meth:`make_null_session` to create a session that acts as replacement if the session support cannot work because some requirement is not fulfilled. The default :class:`NullSession` class that is created will complain that the secret key was not set. To replace the session interface on an application all you have to do is to assign :attr:`flask.Flask.session_interface`:: app = Flask(__name__) app.session_interface = MySessionInterface() .. versionadded:: 0.8 Fc*|S)aCreates a null session which acts as a replacement object if the real session support could not be loaded due to a configuration error. This mainly aids the user experience because the job of the null session is to still support lookup without complaining but modifications are answered with a helpful error message of what failed. This creates an instance of :attr:`null_session_class` by default. )null_session_classrapps rmake_null_sessionz"SessionInterface.make_null_sessions&&(((rc,t||jS)zChecks if a given object is a null session. Null sessions are not asked to be saved. This checks if the object is an instance of :attr:`null_session_class` by default. )r?ru)rrXs ris_null_sessionz SessionInterface.is_null_sessions#t6777rc |jd |jdS|jdfd|jddddz}|dkrd}|0||}|d kr|d}|SdS) zHelpful helper method that returns the cookie domain that should be used for the session cookie if session cookies are used. SESSION_COOKIE_DOMAINN SERVER_NAME.rQr rz .localhost/)configrsplitget_cookie_pathlstrip)rrwrvpaths rget_cookie_domainz"SessionInterface.get_cookie_domains :- . ::56 6 :m $ 0sz-077Q??BBB \!! ~++C003;;3BI% 1 0rc:|jdp|jdpdS)aReturns the path for which the cookie should be valid. The default implementation uses the value from the ``SESSION_COOKIE_PATH`` config var if it's set, and falls back to ``APPLICATION_ROOT`` or uses ``/`` if it's ``None``. SESSION_COOKIE_PATHAPPLICATION_ROOTrrrvs rrz SessionInterface.get_cookie_paths, z/05z,-514 5rc|jdS)zReturns True if the session cookie should be httponly. This currently just returns the value of the ``SESSION_COOKIE_HTTPONLY`` config var. SESSION_COOKIE_HTTPONLYrrvs rget_cookie_httponlyz$SessionInterface.get_cookie_httponlys z344rc|jdS)zReturns True if the cookie should be secure. This currently just returns the value of the ``SESSION_COOKIE_SECURE`` setting. SESSION_COOKIE_SECURErrvs rget_cookie_securez"SessionInterface.get_cookie_securesz122rcJ|jrtj|jzSdS)aA helper method that returns an expiration date for the session or ``None`` if the session is linked to the browser session. The default implementation returns now + the permanent session lifetime configured on the application. N)r%rutcnowpermanent_session_lifetime)rrwsessions rget_expiration_timez$SessionInterface.get_expiration_times2   F?$$s'EE E F Frc@|jrdS|jd}|o|jS)aIndicates whether a cookie should be set now or not. This is used by session backends to figure out if they should emit a set-cookie header or not. The default behavior is controlled by the ``SESSION_REFRESH_EACH_REQUEST`` config variable. If it's set to ``False`` then a cookie is only set if the session is modified, if set to ``True`` it's always set if the session is permanent. This check is usually skipped if sessions get deleted. .. versionadded:: 0.11 TSESSION_REFRESH_EACH_REQUEST)r'rr%)rrwr save_eachs rshould_set_cookiez"SessionInterface.should_set_cookies/   4J=> .W..rct)a%This method has to be implemented and must either return ``None`` in case the loading failed because of a configuration error or an instance of a session object which implements a dictionary like interface + the methods and attributes on :class:`SessionMixin`. NotImplementedError)rrwrequests r open_sessionzSessionInterface.open_session "###rct)zThis is called for actual sessions returned by :meth:`open_session` at the end of the request. This is still called during a request context so if you absolutely need access to the request you can do that. r)rrwrresponses r save_sessionzSessionInterface.save_sessionrrN)r r!r"r#reru pickle_basedrxrzrrrrrrrrr(rrrsrssB%L ) ) )8884555555333 FFF///$$$$$$$$$rrscTeZdZdZdZeejZdZ e Z e Z dZdZdZdS)SecureCookieSessionInterfacezuThe default session interface that stores sessions in signed cookies through the :mod:`itsdangerous` module. zcookie-sessionhmacc|jsdSt|j|j}t |j|j|j|S)N)key_derivation digest_method)salt serializer signer_kwargs) secret_keyrIrrrrr)rrwrs rget_signing_serializerz3SecureCookieSessionInterface.get_signing_serializer4s^~ 4.,   &cn49154ACCC Crch||}|dS|j|j}|s|St |j} |||}||S#t$r|cYSwxYw)N)max_age) rcookiesrsession_cookie_name session_classrrr\r)rrwrsvalrdatas rrz)SecureCookieSessionInterface.open_session?s  ' ' , , 94o!!#"9:: (%%'' ' >?? (773700D%%d++ + ( ( (%%'' ' ' ' (s$+BB10B1c ||}||}|s&|jr||j||dS|||sdS||}||}|||}| | t|} | |j| |||||dS)N)domainr)expireshttponlyrrsecure) rrr' delete_cookierrrrrrrSrI set_cookie) rrwrrrrrrrrs rrz)SecureCookieSessionInterface.save_sessionMs-'',,##C((   A&&s'>.44'AAA F%%c733  F++C00'',,**388))#..44T']]CCC3S$+h#)V  E E E E ErN)r r!r"r#r staticmethodhashlibsha1rrsession_json_serializerrr^rrrrr(rrrr"s~ D L..MN)J'M C C C ( ( (EEEEErr) r#rArbase64rrr werkzeug.httprrwerkzeug.datastructuresrr r _compatr r helpersr itsdangerousrrobjectrr-rNrr^rersrr(rrrs ''''''''////////000000))))))))""""""========666:::::6:::6/.00,      %   Y$Y$Y$Y$Y$vY$Y$Y$xHEHEHEHEHE#3HEHEHEHEHEr