| import base64 |
| import os |
| import random |
| import sys |
| import time |
| from datetime import datetime, timedelta |
| try: |
| import cPickle as pickle |
| except ImportError: |
| import pickle |
| |
| from django.conf import settings |
| from django.core.exceptions import SuspiciousOperation |
| from django.utils.hashcompat import md5_constructor |
| |
| # Use the system (hardware-based) random number generator if it exists. |
| if hasattr(random, 'SystemRandom'): |
| randrange = random.SystemRandom().randrange |
| else: |
| randrange = random.randrange |
| MAX_SESSION_KEY = 18446744073709551616L # 2 << 63 |
| |
| class CreateError(Exception): |
| """ |
| Used internally as a consistent exception type to catch from save (see the |
| docstring for SessionBase.save() for details). |
| """ |
| pass |
| |
| class SessionBase(object): |
| """ |
| Base class for all Session classes. |
| """ |
| TEST_COOKIE_NAME = 'testcookie' |
| TEST_COOKIE_VALUE = 'worked' |
| |
| def __init__(self, session_key=None): |
| self._session_key = session_key |
| self.accessed = False |
| self.modified = False |
| |
| def __contains__(self, key): |
| return key in self._session |
| |
| def __getitem__(self, key): |
| return self._session[key] |
| |
| def __setitem__(self, key, value): |
| self._session[key] = value |
| self.modified = True |
| |
| def __delitem__(self, key): |
| del self._session[key] |
| self.modified = True |
| |
| def keys(self): |
| return self._session.keys() |
| |
| def items(self): |
| return self._session.items() |
| |
| def get(self, key, default=None): |
| return self._session.get(key, default) |
| |
| def pop(self, key, *args): |
| self.modified = self.modified or key in self._session |
| return self._session.pop(key, *args) |
| |
| def setdefault(self, key, value): |
| if key in self._session: |
| return self._session[key] |
| else: |
| self.modified = True |
| self._session[key] = value |
| return value |
| |
| def set_test_cookie(self): |
| self[self.TEST_COOKIE_NAME] = self.TEST_COOKIE_VALUE |
| |
| def test_cookie_worked(self): |
| return self.get(self.TEST_COOKIE_NAME) == self.TEST_COOKIE_VALUE |
| |
| def delete_test_cookie(self): |
| del self[self.TEST_COOKIE_NAME] |
| |
| def encode(self, session_dict): |
| "Returns the given session dictionary pickled and encoded as a string." |
| pickled = pickle.dumps(session_dict, pickle.HIGHEST_PROTOCOL) |
| pickled_md5 = md5_constructor(pickled + settings.SECRET_KEY).hexdigest() |
| return base64.encodestring(pickled + pickled_md5) |
| |
| def decode(self, session_data): |
| encoded_data = base64.decodestring(session_data) |
| pickled, tamper_check = encoded_data[:-32], encoded_data[-32:] |
| if md5_constructor(pickled + settings.SECRET_KEY).hexdigest() != tamper_check: |
| raise SuspiciousOperation("User tampered with session cookie.") |
| try: |
| return pickle.loads(pickled) |
| # Unpickling can cause a variety of exceptions. If something happens, |
| # just return an empty dictionary (an empty session). |
| except: |
| return {} |
| |
| def update(self, dict_): |
| self._session.update(dict_) |
| self.modified = True |
| |
| def has_key(self, key): |
| return self._session.has_key(key) |
| |
| def values(self): |
| return self._session.values() |
| |
| def iterkeys(self): |
| return self._session.iterkeys() |
| |
| def itervalues(self): |
| return self._session.itervalues() |
| |
| def iteritems(self): |
| return self._session.iteritems() |
| |
| def clear(self): |
| # To avoid unnecessary persistent storage accesses, we set up the |
| # internals directly (loading data wastes time, since we are going to |
| # set it to an empty dict anyway). |
| self._session_cache = {} |
| self.accessed = True |
| self.modified = True |
| |
| def _get_new_session_key(self): |
| "Returns session key that isn't being used." |
| # The random module is seeded when this Apache child is created. |
| # Use settings.SECRET_KEY as added salt. |
| try: |
| pid = os.getpid() |
| except AttributeError: |
| # No getpid() in Jython, for example |
| pid = 1 |
| while 1: |
| session_key = md5_constructor("%s%s%s%s" |
| % (randrange(0, MAX_SESSION_KEY), pid, time.time(), |
| settings.SECRET_KEY)).hexdigest() |
| if not self.exists(session_key): |
| break |
| return session_key |
| |
| def _get_session_key(self): |
| if self._session_key: |
| return self._session_key |
| else: |
| self._session_key = self._get_new_session_key() |
| return self._session_key |
| |
| def _set_session_key(self, session_key): |
| self._session_key = session_key |
| |
| session_key = property(_get_session_key, _set_session_key) |
| |
| def _get_session(self, no_load=False): |
| """ |
| Lazily loads session from storage (unless "no_load" is True, when only |
| an empty dict is stored) and stores it in the current instance. |
| """ |
| self.accessed = True |
| try: |
| return self._session_cache |
| except AttributeError: |
| if self._session_key is None or no_load: |
| self._session_cache = {} |
| else: |
| self._session_cache = self.load() |
| return self._session_cache |
| |
| _session = property(_get_session) |
| |
| def get_expiry_age(self): |
| """Get the number of seconds until the session expires.""" |
| expiry = self.get('_session_expiry') |
| if not expiry: # Checks both None and 0 cases |
| return settings.SESSION_COOKIE_AGE |
| if not isinstance(expiry, datetime): |
| return expiry |
| delta = expiry - datetime.now() |
| return delta.days * 86400 + delta.seconds |
| |
| def get_expiry_date(self): |
| """Get session the expiry date (as a datetime object).""" |
| expiry = self.get('_session_expiry') |
| if isinstance(expiry, datetime): |
| return expiry |
| if not expiry: # Checks both None and 0 cases |
| expiry = settings.SESSION_COOKIE_AGE |
| return datetime.now() + timedelta(seconds=expiry) |
| |
| def set_expiry(self, value): |
| """ |
| Sets a custom expiration for the session. ``value`` can be an integer, |
| a Python ``datetime`` or ``timedelta`` object or ``None``. |
| |
| If ``value`` is an integer, the session will expire after that many |
| seconds of inactivity. If set to ``0`` then the session will expire on |
| browser close. |
| |
| If ``value`` is a ``datetime`` or ``timedelta`` object, the session |
| will expire at that specific future time. |
| |
| If ``value`` is ``None``, the session uses the global session expiry |
| policy. |
| """ |
| if value is None: |
| # Remove any custom expiration for this session. |
| try: |
| del self['_session_expiry'] |
| except KeyError: |
| pass |
| return |
| if isinstance(value, timedelta): |
| value = datetime.now() + value |
| self['_session_expiry'] = value |
| |
| def get_expire_at_browser_close(self): |
| """ |
| Returns ``True`` if the session is set to expire when the browser |
| closes, and ``False`` if there's an expiry date. Use |
| ``get_expiry_date()`` or ``get_expiry_age()`` to find the actual expiry |
| date/age, if there is one. |
| """ |
| if self.get('_session_expiry') is None: |
| return settings.SESSION_EXPIRE_AT_BROWSER_CLOSE |
| return self.get('_session_expiry') == 0 |
| |
| def flush(self): |
| """ |
| Removes the current session data from the database and regenerates the |
| key. |
| """ |
| self.clear() |
| self.delete() |
| self.create() |
| |
| def cycle_key(self): |
| """ |
| Creates a new session key, whilst retaining the current session data. |
| """ |
| data = self._session_cache |
| key = self.session_key |
| self.create() |
| self._session_cache = data |
| self.delete(key) |
| |
| # Methods that child classes must implement. |
| |
| def exists(self, session_key): |
| """ |
| Returns True if the given session_key already exists. |
| """ |
| raise NotImplementedError |
| |
| def create(self): |
| """ |
| Creates a new session instance. Guaranteed to create a new object with |
| a unique key and will have saved the result once (with empty data) |
| before the method returns. |
| """ |
| raise NotImplementedError |
| |
| def save(self, must_create=False): |
| """ |
| Saves the session data. If 'must_create' is True, a new session object |
| is created (otherwise a CreateError exception is raised). Otherwise, |
| save() can update an existing object with the same key. |
| """ |
| raise NotImplementedError |
| |
| def delete(self, session_key=None): |
| """ |
| Deletes the session data under this key. If the key is None, the |
| current session key value is used. |
| """ |
| raise NotImplementedError |
| |
| def load(self): |
| """ |
| Loads the session data and returns a dictionary. |
| """ |
| raise NotImplementedError |
