HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/cherrypy/lib/__pycache__/sessions.cpython-310.pyc
o

�N�gy�@s
dZddlZddlZddlZddlZddlZddlZddlZddlZ	ddl
Z
ddlmZddlm
Z
ddlmZe�ZGdd�de�ZGdd	�d	e�ZGd
d�de�ZGdd
�d
e�Zdd�Zde_dd�Zde_de_			d dd�Z		d!dd�Zdd�Zdd�ZdS)"aNSession implementation for CherryPy.

You need to edit your config file to use sessions. Here's an example::

    [/]
    tools.sessions.on = True
    tools.sessions.storage_class = cherrypy.lib.sessions.FileSession
    tools.sessions.storage_path = "/home/site/sessions"
    tools.sessions.timeout = 60

This sets the session to be stored in files in the directory
/home/site/sessions, and the session timeout to 60 minutes. If you omit
``storage_class``, the sessions will be saved in RAM.
``tools.sessions.on`` is the only required line for working sessions,
the rest are optional.

By default, the session ID is passed in a cookie, so the client's browser must
have cookies enabled for your site.

To set data for the current session, use
``cherrypy.session['fieldname'] = 'fieldvalue'``;
to get data use ``cherrypy.session.get('fieldname')``.

================
Locking sessions
================

By default, the ``'locking'`` mode of sessions is ``'implicit'``, which means
the session is locked early and unlocked late. Be mindful of this default mode
for any requests that take a long time to process (streaming responses,
expensive calculations, database lookups, API calls, etc), as other concurrent
requests that also utilize sessions will hang until the session is unlocked.

If you want to control when the session data is locked and unlocked,
set ``tools.sessions.locking = 'explicit'``. Then call
``cherrypy.session.acquire_lock()`` and ``cherrypy.session.release_lock()``.
Regardless of which mode you use, the session is guaranteed to be unlocked when
the request is complete.

=================
Expiring Sessions
=================

You can force a session to expire with :func:`cherrypy.lib.sessions.expire`.
Simply call that function at the point you want the session to expire, and it
will cause the session cookie to expire client-side.

===========================
Session Fixation Protection
===========================

If CherryPy receives, via a request cookie, a session id that it does not
recognize, it will reject that id and create a new one to return in the
response cookie. This `helps prevent session fixation attacks
<http://en.wikipedia.org/wiki/Session_fixation#Regenerate_SID_on_each_request>`_.
However, CherryPy "recognizes" a session id by looking up the saved session
data for that id. Therefore, if you never save any session data,
**you will get a new session id for every request**.

A side effect of CherryPy overwriting unrecognised session ids is that if you
have multiple, separate CherryPy applications running on a single domain (e.g.
on different ports), each app will overwrite the other's session id because by
default they use the same cookie name (``"session_id"``) but do not recognise
each others sessions. It is therefore a good idea to use a different name for
each, for example::

    [/]
    ...
    tools.sessions.name = "my_app_session_id"

================
Sharing Sessions
================

If you run multiple instances of CherryPy (for example via mod_python behind
Apache prefork), you most likely cannot use the RAM session backend, since each
instance of CherryPy will have its own memory space. Use a different backend
instead, and verify that all instances are pointing at the same file or db
location. Alternately, you might try a load balancer which makes sessions
"sticky". Google is your friend, there.

================
Expiration Dates
================

The response cookie will possess an expiration date to inform the client at
which point to stop sending the cookie back in requests. If the server time
and client time differ, expect sessions to be unreliable. **Make sure the
system time of your server is accurate**.

CherryPy defaults to a 60-minute session timeout, which also applies to the
cookie which is sent to the client. Unfortunately, some versions of Safari
("4 public beta" on Windows XP at least) appear to have a bug in their parsing
of the GMT expiration date--they appear to interpret the date as one hour in
the past. Sixty minutes minus one hour is pretty close to zero, so you may
experience this bug as a new session id for every request, unless the requests
are less than one second apart. To fix, try increasing the session.timeout.

On the other extreme, some users report Firefox sending cookies after their
expiration date, although this was on a system with an inaccurate system time.
Maybe FF doesn't trust system time.
�N)�httputil)�locking)�is_iteratorc@seZdZdZdZdZ	edd��Zejdd��ZdZ		dZ
	dZ	dZ	dZ
	dZ	dZ	dZ	dZ	d3d	d
�Zdd�Zd
d�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd �Zefd!d"�Zd#d$�Zd3d%d&�Z d'd(�Z!d3d)d*�Z"d+d,�Z#d-d.�Z$d/d0�Z%d1d2�Z&dS)4�Sessionz6A CherryPy dict-like Session object (one per request).NcCs|jS)zReturn the current session id.)�_id��self�r	�I/opt/saltstack/salt/lib/python3.10/site-packages/cherrypy/lib/sessions.py�id�sz
Session.idcCs||_|jD]}||�qdS�N)r�id_observers)r�value�or	r	r
r�s

��<F�cKs�g|_i|_|��D]
\}}t|||�q
||_d|_|dur.|jr(t�dd�|�	�dS||_
|��rD|jrBt�d|d�dSdS|jrOt�d|d�d|_
d|_|�	�dS)NFzNo id given; making a new one�TOOLS.SESSIONSz
Set id to %s.z1Expired or malicious session %r; making a new oneT)r
�_data�items�setattr�
originalid�missing�debug�cherrypy�log�_regenerater�_exists)rr�kwargs�k�vr	r	r
�__init__�s0���zSession.__init__cCs
tj��S)z�Generate the session specific concept of 'now'.

        Other session providers can override this to use alternative,
        possibly timezone aware, versions of 'now'.
        )�datetime�nowrr	r	r
r"�s
zSession.nowcCsd|_|��dS)z,Replace the current session (with a new id).TN)�regeneratedrrr	r	r
�
regenerate�szSession.regeneratecCs�|jdur|jrt�d|jd�|��|j}|r'|��|jr't�dd�d|_|jdur@|��|_|��r;d|_|jdus/|jrLt�d|jd�|r]|�	�|jr_t�dd�dSdSdS)Nz5Deleting the existing session %r before regeneration.rzOld lock released.zSet id to generated %s.zRegenerated lock acquired.)
rrrr�delete�locked�release_lock�generate_idr�acquire_lock)rZold_session_was_lockedr	r	r
r�s<
��


���zSession._regeneratecCsdS)�Clean up expired sessions.Nr	rr	r	r
�clean_up��zSession.clean_upcCst�t�d���d�S)zReturn a new session id.��ascii)�binascii�hexlify�os�urandom�decoderr	r	r
r(�szSession.generate_idc
Cs�zI|jr'tj|jdd�}|��|}|jr!t�d|j|fd�|�	|�n|jr3t�d|jd�W|j
rF|��|jrHt�dd�dSdSdS|j
r[|��|jr\t�dd�www)zSave session data.r��secondsz Saving session %r with expiry %srz0Skipping save of session %r (no session loaded).zLock released after save.N)�loadedr!�	timedelta�timeoutr"rrrr�_saver&r')r�t�expiration_timer	r	r
�saves>��������zSession.savecCs�|��}|dus|d|��kr |jrt�d|jd�i|_n|jr,t�d|jd�|d|_d|_|j}|j	rc|j
setjjj
tj|j|j	dd	d
�}|��||_
|��|jrgt�dd�dSdSdSdS)z4Copy stored session data into this session instance.N�z"Expired session %r, flushing data.rzData loaded for session %r.rTrzSession cleanup��namezStarted cleanup thread.)�_loadr"rrrrrr6�	__class__�
clean_freq�clean_thread�processZpluginsZMonitorZenginer+Z	subscribe�start)r�data�clsr:r	r	r
�loads4��
��	zSession.loadcCs(|��|jrt�d|jd�dSdS)zDelete stored session data.zDeleted session %s.rN)�_deleterrrrrr	r	r
r%8s��zSession.deletecCs|js|��|j|Sr�r6rHr�r�keyr	r	r
�__getitem__A�
zSession.__getitem__cCs|js|��||j|<dSrrJ)rrLrr	r	r
�__setitem__FszSession.__setitem__cCs|js|��|j|=dSrrJrKr	r	r
�__delitem__KszSession.__delitem__cCs0|js|��|tur|j�|�S|j�||�S)z�Remove the specified key and return the corresponding value.
        If key is not found, default is returned if given,
        otherwise KeyError is raised.
        )r6rHrr�pop�rrL�defaultr	r	r
rQPs
zSession.popcCs|js|��||jvSrrJrKr	r	r
�__contains__\rNzSession.__contains__cC�|js|��|j�||�S)z<D.get(k[,d]) -> D[k] if k in D, else d.  d defaults to None.)r6rHr�getrRr	r	r
rVa�zSession.getcCs|js|��|j�|�dS)z?D.update(E) -> None.  Update D from E: for k in E: D[k] = E[k].N)r6rHr�update)r�dr	r	r
rXgszSession.updatecCrU)zAD.setdefault(k[,d]) -> D.get(k,d), also set D[k]=d if k not in D.)r6rHr�
setdefaultrRr	r	r
rZmrWzSession.setdefaultcCs|js|��|j��dS)z,D.clear() -> None.  Remove all items from D.N)r6rHr�clearrr	r	r
r[srWz
Session.clearcC�|js|��|j��S)zD.keys() -> list of D's keys.)r6rHr�keysrr	r	r
r]y�
zSession.keyscCr\)z9D.items() -> list of D's (key, value) pairs, as 2-tuples.)r6rHrrrr	r	r
rr^z
Session.itemscCr\)z!D.values() -> list of D's values.)r6rHr�valuesrr	r	r
r_�r^zSession.valuesr)'�__name__�
__module__�__qualname__�__doc__rr
�propertyr�setterr8r&r6rCrBrrr#rr r"r$rr+r(r<rHr%rMrOrPrQrTrVrXrZr[r]rr_r	r	r	r
rzs`


	

rc@sTeZdZiZiZdd�Zdd�Zdd�Zdd�Zd	d
�Z	dd�Z
d
d�Zdd�ZdS)�
RamSessionc	Cs�|��}|j����D]9\}\}}||krDz|j|=Wn	ty$Ynwz|j|jdd�r9|j�|�}|��WqtyCYqwqt	|j�D]}||jvoY|j|jdd�}|rf|j�|�}|��qJdS)r*F)�blockingN)
r"�cache�copyr�KeyError�locks�acquirerQ�release�list)rr"rrFr;�lockr&r	r	r
r+�s4����
���zRamSession.clean_upcCs|j|jvSr)rrhrr	r	r
r�szRamSession._existscCs|j�|j�Sr)rhrVrrr	r	r
r@�szRamSession._loadcCs|j|f|j|j<dSr)rrhr)rr;r	r	r
r9�szRamSession._savecCs|j�|jd�dSr)rhrQrrr	r	r
rI�szRamSession._deletecCs"d|_|j�|jt�����dS)�?Acquire an exclusive lock on the currently-loaded session data.TN)r&rkrZr�	threading�RLockrlrr	r	r
r)�szRamSession.acquire_lockcC�|j|j��d|_dS�z6Release the lock on the currently-loaded session data.FN�rkrrmr&rr	r	r
r'��
zRamSession.release_lockcCs
t|j�S��%Return the number of active sessions.)�lenrhrr	r	r
�__len__�s
zRamSession.__len__N)
r`rarbrhrkr+rr@r9rIr)r'rzr	r	r	r
rf�srfc@s�eZdZdZdZdZejZddd�Z	e
dd��Zd	d
�Zdd�Z
dd
d�Zdd�Zdd�Zddd�Zddd�Zdd�Zdd�ZdS)�FileSessiona�Implementation of the File backend for sessions

    storage_path
        The folder where session data will be saved. Each session
        will be saved as pickle.dump(data, expiration_time) in its own file;
        the filename will be self.SESSION_PREFIX + self.id.

    lock_timeout
        A timedelta or numeric seconds indicating how long
        to block acquiring a lock. If None (default), acquiring a lock
        will block indefinitely.
    zsession-z.lockNcKsxtj�|d�|d<|�dd�tj|fd|i|��t|jtt	f�r+t
j|jd�|_t|jt
jtd�f�s:t
d��dS)N�storage_path�lock_timeoutrr4z=Lock timeout must be numeric seconds or a timedelta instance.)r1�path�abspathrZrr �
isinstancer}�int�floatr!r7�type�
ValueError)rrrr	r	r
r �s��zFileSession.__init__cKs6tj�|d�|d<|��D]
\}}t|||�qdS)z�Set up the storage system for file-based sessions.

        This should only be called once per process; this will be done
        automatically when using sessions.init (as the built-in Tool does).
        r|N)r1r~rrr)rGrrrr	r	r
�setup�s�zFileSession.setupcCs<tj�|j|j|j�}tj�|��|j�st�	dd��|S)Ni�zInvalid session id in cookie.)
r1r~�joinr|�SESSION_PREFIXrr�
startswithr�	HTTPError)r�fr	r	r
�_get_file_path�szFileSession._get_file_pathcCs|��}tj�|�Sr)r�r1r~�exists�rr~r	r	r
r�szFileSession._existsc	Cs�|jsJd��|dur|��}zt|d�}zt�|�W|��WS|��wttfyBt�	�d}|j
r?t�d|d�YdSw)NzJThe session load without being locked.  Check your tools' priority levels.�rbr=z$Error loading the session pickle: %sr)
r&r��open�picklerH�close�IOError�EOFError�sys�exc_inforrr)rr~r��er	r	r
r@s$

���zFileSession._loadcCsL|jsJd��t|��d�}zt�|j|f||j�W|��dS|��w)NzOThe session was saved without being locked.  Check your tools' priority levels.�wb)r&r�r�r��dumpr�pickle_protocolr�)rr;r�r	r	r
r9s
zFileSession._savecCs8|jsJd��z
t�|���WdStyYdSw)NzNThe session deletion without being locked.  Check your tools' priority levels.)r&r1�unlinkr��OSErrorrr	r	r
rIs�zFileSession._deletecCs�|dur|��}||j7}t�|j|j�}|��s8z	tj�	|�|_
Wntjjy2t�
d�Ynwn|��rd|_|jrFt�dd�dSdS)rpNg�������?T�Lock acquired.r)r��LOCK_SUFFIXrZLockCheckerrr}Zexpired�zcZlockfileZLockFileroZ	LockError�time�sleepr&rrr)rr~Zcheckerr	r	r
r)$s 
���zFileSession.acquire_lockcCs|j��d|_dSrt)ror�r&r�r	r	r
r'5s

zFileSession.release_lockc
Cs�|��}t�|j�D]K}|�|j�o|�|j�}|rUtj�	|j|�}|�
|�|jr1t�
dd�z|�|�}|durH|\}}||krHt�|�W|�|�q
|�|�wq
dS)r*zCleanup lock acquired.rN)r"r1�listdirr|r�r��endswithr�r~r�r)rrrr@r�r')rr"�fnameZhave_sessionr~�contentsrFr;r	r	r
r+:s(�


���zFileSession.clean_upcst�fdd�t��j�D��S)rxcs(g|]}|��j�r|��j�s|�qSr	)r�r�r�r�)�.0r�rr	r
�
<listcomp>\s

�

�z'FileSession.__len__.<locals>.<listcomp>)ryr1r�r|rr	rr
rzZszFileSession.__len__r)r`rarbrcr�r�r�ZHIGHEST_PROTOCOLr�r �classmethodr�r�rr@r9rIr)r'r+rzr	r	r	r
r{�s"



	

 r{c@sbeZdZe��ZiZdgZedd��Z	dd�Z
dd�Zdd	�Zd
d�Z
dd
�Zdd�Zdd�ZdS)�MemcachedSessionzlocalhost:11211cKs8|��D]
\}}t|||�qddl}|�|j�|_dS)z�Set up the storage system for memcached-based sessions.

        This should only be called once per process; this will be done
        automatically when using sessions.init (as the built-in Tool does).
        rN)rr�memcacheZClient�serversrh)rGrrrr�r	r	r
r�lszMemcachedSession.setupcCs6|j��zt|j�|j��W|j��S|j��wr)�mc_lockrl�boolrhrVrrmrr	r	r
rys
zMemcachedSession._existscCs2|j��z
|j�|j�W|j��S|j��wr)r�rlrhrVrrmrr	r	r
r@�s
zMemcachedSession._loadcCs`tt�|����}|j��z|j�|j|j	|f|�s"t
d|j��W|j��dS|j��w)NzSession data for id %r not set.)r�r��mktime�	timetupler�rlrh�setrr�AssertionErrorrm)rr;�tdr	r	r
r9�s
��zMemcachedSession._savecCs|j�|j�dSr)rhr%rrr	r	r
rI�szMemcachedSession._deletecCs8d|_|j�|jt�����|jrt�	dd�dSdS)rpTr�rN)
r&rkrZrrqrrrlrrrrr	r	r
r)�s
�zMemcachedSession.acquire_lockcCrsrtrurr	r	r
r'�rvzMemcachedSession.release_lockcCst�rw)�NotImplementedErrorrr	r	r
rz�r,zMemcachedSession.__len__N)r`rarbrqrrr�rkr�r�r�rr@r9rIr)r'rzr	r	r	r
r�as
r�cCspttjd�sdStjj}tjj}t|d�rdSd|_|jr(|j�dtj	j
�dSt|j�r1|�
�tj	�
�dS)zSave any changed session data.�sessionN�
_sessionsavedTZon_end_request)�hasattrr�serving�request�responser��streamZhooks�attachr�r<r�bodyZ
collapse_body)r�r�r	r	r
r<�s

r<TcCs@ttjdd�}t|dd�r|��|jrt�dd�dSdSdS)z*Close the session object for this request.r�Nr&FzLock released on close.r)�getattrrr�r'rr)�sessr	r	r
r��s�r��Z�
session_idrFrc	s0|�dt�}tjj}
t|
d�rdSd|
_d}�|
jvr+|
j�j}|
r+t�	d|d�ttd�}|rG|r<d}t�	|�|�
�d	}t�|}|rVt|d
�rV|jdi|��||d<||d<||fi|��tj_
}|
|_�fd
d�}|j�|�ttd�s�t�d�t_
|r�|}nd}t||�||||	d�dS)a�Initialize session object (using cookies).

    storage_class
        The Session subclass to use. Defaults to RamSession.

    storage_type
        (deprecated)
        One of 'ram', 'file', memcached'. This will be
        used to look up the corresponding class in cherrypy.lib.sessions
        globals. For example, 'file' will use the FileSession class.

    path
        The 'path' value to stick in the response cookie metadata.

    path_header
        If 'path' is None (the default), then the response
        cookie 'path' will be pulled from request.headers[path_header].

    name
        The name of the cookie.

    timeout
        The expiration timeout (in minutes) for the stored session data.
        If 'persistent' is True (the default), this is also the timeout
        for the cookie.

    domain
        The cookie domain.

    secure
        If False (the default) the cookie 'secure' value will not
        be set. If True, the cookie 'secure' value will be set (to 1).

    clean_freq (minutes)
        The poll rate for expired session cleanup.

    persistent
        If True (the default), the 'timeout' argument will be used
        to expire the cookie. If False, the cookie will not have an expiry,
        and the cookie will be a "session cookie" which expires when the
        browser is closed.

    httponly
        If False (the default) the cookie 'httponly' value will not be set.
        If True, the cookie 'httponly' value will be set (to 1).

    Any additional kwargs will be bound to the new Session instance,
    and may be specific to the storage type. See the subclass of Session
    you're using for more information.
    �
storage_class�_session_init_flagNTz#ID obtained from request.cookie: %rrr�z8storage_type is deprecated. Supply storage_class insteadrr�r8rBcs|tjjj�<dS)z4Update the cookie every time the session id changes.N)rr�r��cookie)rr>r	r
�
update_cookie3szinit.<locals>.update_cookie)r~�path_headerr?r8�domain�secure�httponlyr	)rQrfrr�r�r�r�r�rr�title�globalsr�r�rr
�appendZ_ThreadLocalProxy�set_response_cookie)Zstorage_typer~r�r?r8r�r�rBZ
persistentr�rrr�r�rZ
first_time�msgr�r�Zcookie_timeoutr	r>r
�init�sJ:


�




�r�cCs�tjjj}tjjj||<|ptjjj�|�pd||d<|r-|d||d<t	|||�|dur7|||d<|r?d||d<|rT||�
d	�sLtd
��d||d	<dSdS)ajSet a response cookie for the client.

    path
        the 'path' value to stick in the response cookie metadata.

    path_header
        if 'path' is None (the default), then the response
        cookie 'path' will be pulled from request.headers[path_header].

    name
        the name of the cookie.

    timeout
        the expiration timeout for the cookie. If 0 or other boolean
        False, no 'expires' param will be set, and the cookie will be a
        "session cookie" which expires when the browser is closed.

    domain
        the cookie domain.

    secure
        if False (the default) the cookie 'secure' value will not
        be set. If True, the cookie 'secure' value will be set (to 1).

    httponly
        If False (the default) the cookie 'httponly' value will not be set.
        If True, the cookie 'httponly' value will be set (to 1).

    �/r~r�max-ageNr�r=r�r�z+The httponly cookie token is not supported.)rr�r�r�r�rr��headersrV�_add_MSIE_max_age_workaroundZ
isReservedKeyr�)r~r�r?r8r�r�r�r�r	r	r
r�Gs&
 �
��r�cCs"t��|d}t�|�|d<dS)z�
    We'd like to use the "max-age" param as indicated in
    http://www.faqs.org/rfcs/rfc2109.html but IE doesn't
    save it to disk and the session is lost if people close
    the browser. So we have to use the old "expires" ... sigh ...
    r�expiresN)r�r�HTTPDate)r�r8r�r	r	r
r�|sr�cCsTtjjj�dd�}d}t��|}t�|�tjjj	|d<tjjj	|�
dd�dS)z"Expire the current session cookie.ztools.sessions.namer�i�3�r�r�N)rr�r�ZconfigrVr�rr�r�r�rQ)r?Zone_yearr�r	r	r
�expire�s
�r�)NNNr�rNFrTFF)NNr�rNFF)rcr�r!r1r�rqr/r�Zzc.lockfiler�rZcherrypy.librrr�objectrrrfr{r�r<Zfailsafer��priorityr�r�r�r�r	r	r	r
�<module>sFf<G

�u
�5