| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Import StringIO so it can be used.stringio | matt | 2013-01-28 | 1 | -0/+1 |
| | | |||||
| * | Merged in mitchellrj/paste/double_slash_at_start_of_path_fix (pull request #10) | Ian Bicking | 2012-08-17 | 3 | -23/+77 |
| |\ | |||||
| | * | auth/auth_tkt.py: enable overriding digest algorithms | Jan Pokorn? | 2012-03-05 | 1 | -8/+22 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, mod_auth_tkt supports also SHA256 and SHA 512 [1], not just plain MD5. Quoting: ----v---- The default is MD5, which is faster, but has now been shown to be vulnerable to collision attacks. Such attacks are not directly applicable to mod_auth_tkt, which primarily relies on the security of the shared secret rather than the strength of the hashing scheme. More paranoid users will probably prefer to use one of the SHA digest types, however. The default is likely to change in a future version, so setting the digest type explicitly is encouraged. ----^---- Thus, enable it also in this implementation so one can optionally switch to a stronger secure hash. Backward compatibility should be untouched as ``md5`` is being passed as a default kwarg. The only change affecting external world is a new parameter required at ``calculate_digest`` (specifying the digest to use), but as it has probably no use outside the module, this is a non-issue. Alternatively: another optional kwarg. Update (based Ian's comments): The algorithm can also be specified as a string referring to the algorithm known to hashlib (otherwise AttributeError will be raised). Example session I used to check it works as expected (longish): >>> import sys; sys.path.append('../..') >>> from hashlib import sha256, sha512 >>> execfile('auth_tkt.py') >>> AuthTicket('secret', 'me', '0.0.0.0').cookie_value() '39fecb1395af5285232be390eba0eed34f5518c8me!' >>> AuthTicket('secret', 'me', '0.0.0.0', "md5").cookie_value() 'c3b8eacbbbf76a9c993c7dcb99975d504f5518cfme!m,d,5!' >>> AuthTicket('secret', 'me', '0.0.0.0', digest_algo="md5") \ ... .cookie_value() 'db3b04de3c44b5bd0e2b47019e903c064f5518dbme!' >>> AuthTicket('secret', 'me', '0.0.0.0', digest_algo="sha1") \ ... .cookie_value() 'dddaadc2be960b6e89263ae7fb8c39591554103d4f5518edme!' >>> AuthTicket('secret', 'me', '0.0.0.0', digest_algo=sha256) \ ... .cookie_value() 'bf5c9a32e49920f2ca517ec19a9d55e10a83849e5d532e8997891b8ccdbf0e634f551902me!' >>> AuthTicket('secret', 'me', '0.0.0.0', digest_algo="sha256") \ ... .cookie_value() '9cb12df90fd86b868c98353115df4da3b8f9fa83bebecdf0b7918fea5d06b0744f551908me!' >>> AuthTicket('secret', 'me', '0.0.0.0', digest_algo='foo') \ ... .cookie_value() Traceback (most recent call last): File "<stdin>", line 1, in <module> File "auth_tkt.py", line 107, in __init__ self.digest_algo = getattr(hashlib, digest_algo) AttributeError: 'module' object has no attribute 'foo' >>> >>> parse_ticket('secret', \ ... AuthTicket('secret', 'me', '0.0.0.0').cookie_value(),'0.0.0.0') (1330977060, 'me', [''], '') >>> parse_ticket('secret', \ ... AuthTicket('secret', 'me', '0.0.0.0', digest_algo='md5') \ ... .cookie_value(),'0.0.0.0', digest_algo='md5') (1330977096, 'me', [''], '') >>> parse_ticket('secret', \ ... AuthTicket('secret', 'me', '0.0.0.0', digest_algo=sha256) \ ... .cookie_value(),'0.0.0.0', digest_algo=sha256) (1330977115, 'me', [''], '') >>> parse_ticket('secret', \ ... AuthTicket('secret', 'me', '0.0.0.0', digest_algo=sha512) \ ... .cookie_value(),'0.0.0.0', digest_algo=sha512) (1330977125, 'me', [''], '') >>> parse_ticket('secret', \ ... AuthTicket('secret', 'me', '0.0.0.0', digest_algo=sha512) \ ... .cookie_value(),'0.0.0.0') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "auth_tkt.py", line 179, in parse_ticket expected=(expected, digest)) __main__.BadTicket: Digest signature is not correct [1] http://linux.die.net/man/3/mod_auth_tkt | ||||
| | * | auth/auth_tkt.py: enable overriding digest algorithms | Jan Pokorn? | 2012-03-01 | 1 | -14/+27 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, mod_auth_tkt supports also SHA256 and SHA 512 [1], not just plain MD5. Quoting: ----v---- The default is MD5, which is faster, but has now been shown to be vulnerable to collision attacks. Such attacks are not directly applicable to mod_auth_tkt, which primarily relies on the security of the shared secret rather than the strength of the hashing scheme. More paranoid users will probably prefer to use one of the SHA digest types, however. The default is likely to change in a future version, so setting the digest type explicitly is encouraged. ----^---- Thus, enable it also in this implementation so one can optionally switch to a stronger secure hash. Backward compatibility should be untouched as ``md`` is being passed as a default kwarg. The only change affecting external world is a new parameter required at ``calculate digest`` (specifying the digest to use), but as it has probably no use outside the module, this is a non-issue. Alternatively: another optional kwarg. [1] http://linux.die.net/man/3/mod_auth_tkt | ||||
| | * | Fix digest authentication (it was picking up commas inside of the digest ↵ | Toshio Kuratomi | 2011-12-21 | 1 | -4/+29 |
| | | | | | | | | | auth values) | ||||
| | * | Add files that should be included in the tarball | Toshio Kuratomi | 2011-12-21 | 1 | -3/+5 |
| | | | |||||
| * | | Fixed parsing of URL paths starting with multiple slashes.double_slash_at_start_of_path_fix | Richard Mitchell | 2012-08-02 | 2 | -1/+4 |
| | | | |||||
| * | | New branch for double-slash fix. | Richard Mitchell | 2012-08-02 | 0 | -0/+0 |
| |/ | |||||
| * | add news for last commit | Ian Bicking | 2011-08-17 | 1 | -0/+7 |
| | | |||||
| * | Automated merge with ssh://bitbucket.org/ianb/paste | Ian Bicking | 2011-08-17 | 1 | -2/+1 |
| |\ | |||||
| | * | update link to official dev repo | Joshua Bronson | 2011-07-19 | 1 | -2/+1 |
| | | | |||||
| * | | Always wrap wsgi.input with LimitedLengthFile, even when using the ↵ | Ian Bicking | 2011-08-17 | 1 | -9/+8 |
| |/ | | | | ContinueHook. Also always use ContinueHook when there is Expect: 100-Continue, even if the server is supposed to be HTTP/1.0 (because the client wouldn't know the server version when it sends the request; curl notable stalls waiting for a continue) | ||||
| * | Automated merge with https://bitbucket.org/milinnovations_andreas/paste/ | Ian Bicking | 2010-11-29 | 1 | -2/+2 |
| |\ | |||||
| | * | Add fix to make digest auth with internet explorer 8 (and possibly other ↵ | milinnovations_andreas | 2010-09-29 | 1 | -2/+2 |
| | | | | | | | | | versions) | ||||
| * | | remove old setup.cfg stuff | Ian Bicking | 2010-10-28 | 1 | -8/+0 |
| |/ | |||||
| * | Fix #444, egg:Paste#cgi should work now | Ian Bicking | 2010-09-28 | 2 | -0/+6 |
| | | |||||
| * | Added tag 1.7.5.1 for changeset 53a9cdc44dc0 | Ian Bicking | 2010-09-20 | 0 | -0/+0 |
| | | |||||
| * | update versions for release1.7.5.1 | Ian Bicking | 2010-09-20 | 3 | -4/+4 |
| | | |||||
| * | Fix #443: url_unquote undefined | Ian Bicking | 2010-09-16 | 2 | -1/+19 |
| | | |||||
| * | Added tag 1.7.5 for changeset 3b337deabee1 | Ian Bicking | 2010-09-14 | 0 | -0/+0 |
| | | |||||
| * | versions for release1.7.5 | Ian Bicking | 2010-09-14 | 3 | -4/+4 |
| | | |||||
| * | Automated merge with ssh://bitbucket.org/ianb/paste | Ian Bicking | 2010-09-14 | 8 | -18/+37 |
| |\ | |||||
| | * | Just a bit more paranoia in quoting comments, though I wasn't able to ↵ | Ian Bicking | 2010-09-14 | 4 | -3/+13 |
| | | | | | | | | | reproduce any actual issue | ||||
| | * | Allow server_address tuples that are longer (specifically for IPv6 support: ↵ | Ian Bicking | 2010-09-02 | 1 | -5/+4 |
| | | | | | | | | | http://trac.pythonpaste.org/pythonpaste/ticket/275) | ||||
| | * | Catch cookie errors when parsing cookies ↵ | Ian Bicking | 2010-09-02 | 2 | -3/+11 |
| | | | | | | | | | (http://trac.pythonpaste.org/pythonpaste/ticket/189) | ||||
| | * | note return value of form.submit | Ian Bicking | 2010-09-02 | 1 | -7/+9 |
| | | | |||||
| * | | Fix test broken by 27a36b3e1843 (for ↵ | Taavi Burns | 2010-09-09 | 1 | -1/+1 |
| |/ | | | | http://trac.pythonpaste.org/pythonpaste/ticket/328) | ||||
| * | avoid deprecation warnings when using wdg_validate | Ian Bicking | 2010-09-02 | 1 | -6/+6 |
| | | |||||
| * | fixes for cgiapp on Windows (http://trac.pythonpaste.org/pythonpaste/ticket/382) | Ian Bicking | 2010-09-02 | 1 | -2/+3 |
| | | |||||
| * | Coerce thread id to a long, might fix problems in Ubuntu: ↵ | Ian Bicking | 2010-09-02 | 1 | -3/+3 |
| | | | | | http://trac.pythonpaste.org/pythonpaste/ticket/416 | ||||
| * | Do not set Content-Encoding to 'None' ↵ | Ian Bicking | 2010-09-02 | 1 | -2/+7 |
| | | | | | (http://trac.pythonpaste.org/pythonpaste/ticket/427) | ||||
| * | A probably incomplete fix for ↵ | Ian Bicking | 2010-09-02 | 1 | -2/+3 |
| | | | | | http://trac.pythonpaste.org/pythonpaste/ticket/328 -- quote the path before checking the digest. May not recreate the original quoting, but at least it is more correct than simply appending SCRIPT_NAME and PATH_INFO, which are definitely not quoted. | ||||
| * | Always return something from start_response, even if we don't plan to ↵ | Ian Bicking | 2010-09-02 | 1 | -3/+7 |
| | | | | | actually use the written response (because it will be forwarded). Might fix: http://trac.pythonpaste.org/pythonpaste/ticket/166 | ||||
| * | Get rid of misused .remote() method (should have been .delete()): ↵ | Ian Bicking | 2010-09-02 | 1 | -2/+2 |
| | | | | | http://trac.pythonpaste.org/pythonpaste/ticket/310 | ||||
| * | Improve errors when fetching an error page: ↵ | Ian Bicking | 2010-09-02 | 4 | -48/+71 |
| | | | | | http://trac.pythonpaste.org/pythonpaste/ticket/123 | ||||
| * | Add default argument to paste.response.HeaderDict.pop (to make it more like ↵ | Ian Bicking | 2010-09-01 | 1 | -6/+6 |
| | | | | | a normal dict): http://trac.pythonpaste.org/pythonpaste/ticket/279 | ||||
| * | Catch a case where .objects doesn't exist ↵ | Ian Bicking | 2010-09-01 | 1 | -57/+61 |
| | | | | | (http://trac.pythonpaste.org/pythonpaste/ticket/408) | ||||
| * | Quote usernames in auth_tkt tickets ↵ | Ian Bicking | 2010-09-01 | 2 | -16/+22 |
| | | | | | (http://trac.pythonpaste.org/pythonpaste/ticket/380) | ||||
| * | Use X-Forwarded-For in translogger: ↵ | Ian Bicking | 2010-09-01 | 2 | -1/+13 |
| | | | | | http://trac.pythonpaste.org/pythonpaste/ticket/412 -- also news for last commits | ||||
| * | Fix http://trac.pythonpaste.org/pythonpaste/ticket/318 -- handle zero-length ↵ | Ian Bicking | 2010-09-01 | 1 | -1/+1 |
| | | | | | responses in gzip middleware | ||||
| * | Avoid installing the tests | Ian Bicking | 2010-09-01 | 1 | -1/+2 |
| | | |||||
| * | Fix http://trac.pythonpaste.org/pythonpaste/ticket/398 -- properly reject ↵ | Ian Bicking | 2010-09-01 | 2 | -1/+11 |
| | | | | | dates that have out-of-range values | ||||
| * | news for last couple commits | Ian Bicking | 2010-08-20 | 1 | -0/+7 |
| | | |||||
| * | Automated merge with ssh://bitbucket.org/ianb/paste | Ian Bicking | 2010-08-20 | 1 | -6/+10 |
| |\ | |||||
| | * | Fix problem with CGI apps that don't give a status message, and which mix \n ↵ | Ian Bicking | 2010-08-20 | 1 | -6/+10 |
| | | | | | | | | | and \r\n in their headers | ||||
| * | | Typo | Christoph Zwerschke | 2010-08-19 | 1 | -1/+1 |
| | | | |||||
| * | | Added some more test cases to test_mimeparse that I have found here: | Christoph Zwerschke | 2010-08-19 | 2 | -8/+66 |
| | | | | | | | | | | | http://code.google.com/p/mimeparse/source/browse/trunk/testdata.json Also added a link to the project upstream. | ||||
| * | | Minor simplification. | Christoph Zwerschke | 2010-08-19 | 1 | -8/+4 |
| | | | |||||
| * | | Added unittests for util.mimeparse and made the module more robust and ↵ | Christoph Zwerschke | 2010-08-19 | 3 | -51/+256 |
| | | | | | | | | | | | | | somewhat faster. This also closes tickets #290, #330, #370 and #381. | ||||
| * | | The reporter test never created the necessary output directory. | Christoph Zwerschke | 2010-08-19 | 1 | -5/+9 |
| |/ | |||||
 |
index : delta/python-packages/paste.git | |
| bitbucket.org: Obsolete (use python-packages/paste-git) |
| summaryrefslogtreecommitdiff |