o k`7H@s<ddlmZmZddlmZmZddlmZmZddl Z ddl Z ddl Z ddl Z ddlZ ddlmZmZmZddlTddlmZmZddlmZmZdd lmZmZdd lmZdd lm Z dd l!m"Z"dd l#m$Z$ddl%m&Z&m'Z'Gddde(Z)Gddde*edZ+Gddde+Z,Gddde,Z-Gddde,Z.dS))ABCMetaabstractmethod) b64decode b64encode)md5sha1N) BoolOption IntOptionOption)*)IAuthenticatorIRequestHandler)ChromeINavigationContributor) hex_entropymd5crypt)crypt) threading)time_now)tag)_tag_c@seZdZdZeeeedZe ddddZ e ddddZ e dd d d Z edd d dZe ddd dZddZddZddZddZddZddZddZdd Zd!d"Zd#d$Zd%d&Zd'd(Zd)S)* LoginModuleaUser authentication manager. This component implements user authentication based on HTTP authentication provided by the web-server, combined with cookies for communicating the login information across the whole site. This mechanism expects that the web-server is setup so that a request to the path '/login' requires authentication (such as Basic or Digest). The login name is then stored in the database and associated with a unique key that gets passed back to the user agent using the 'trac_auth' cookie. This cookie is used to identify the user in subsequent requests to non-protected resources. Ftrac check_auth_ipfalsezQWhether the IP address of the user should be checked for authentication.ignore_auth_casez6Whether login names should be converted to lower case.auth_cookie_domainzAuth cookie domain attribute. The auth cookie can be shared among multiple subdomains by setting the value to the domain. (//since 1.2//) auth_cookie_lifetimeraLLifetime of the authentication cookie, in seconds. This value determines how long the browser will cache authentication information, and therefore, after how much inactivity a user will have to log in again. The value of 0 makes the cookie expire at the end of the browsing session. auth_cookie_pathzPath for the authentication cookie. Set this to the common base path of several Trac instances if you want them to share the cookie. cCsHd}|jr |j}nd|jvr|||jd}|sdS|jr"|}|S)N trac_auth) remote_userincookie_get_name_for_cookie ignore_caselower)selfreqauthnamer*//usr/lib/python3/dist-packages/trac/web/auth.py authenticateZs zLoginModule.authenticatecCsdS)Nloginr*r'r(r*r*r+get_active_navigation_itemlsz&LoginModule.get_active_navigation_itemc cs|jr   =  rc@seZdZeddZdS)HTTPAuthenticationcCsdSrtr*)r'environstart_responser*r*r+do_auth#szHTTPAuthentication.do_authN)rrrrrr*r*r*r+r!sr) metaclassc@seZdZddZddZdS)PasswordFileAuthenticationcCs.||_t|j|_||jt|_dSrt) filenameosstatst_mtimemtimeloadrLock_lock)r'rr*r*r+__init__)s z#PasswordFileAuthentication.__init__cCsf|j&t|jj}||jkr!||_||jWddSWddS1s,wYdSrt)rrrrrrr)r'rr*r*r+ check_reload/s "z'PasswordFileAuthentication.check_reloadN)rrrrrr*r*r*r+r(s rc@s,eZdZddZddZddZddZd S) BasicAuthenticationcCs"||_t|_i|_t||dSrt)realmrhashrr)r'htpasswdrr*r*r+r9zBasicAuthentication.__init__c Csi|_t|ddV}|D]K}|dd}|sq z |ddd\}}Wnty;td||ftjdYq wd |vsH|d sH|j rN||j|<q td |tjdq Wdn1sbwY|jikrvtd |tjddSdS) Nutf-8encoding#rrvruz(Warning: invalid password line in %s: %sfile${SHA}znWarning: cannot parse password for user "%s" without the "crypt" module. Install the passlib package from PyPIz Warning: found no users in file:) ropensplitstrip ValueErrorprintsysstderrrPr)r'rfdlineuhr*r*r+r@s<    zBasicAuthentication.loadcCs||j|}|durdS|dr)ttt|dd|ddkSd|vr9| ||dd|kS|dd ddd\}}d|d}t ||||kS) NFrrasciirru) rrrcrPstrrrencodedigestrrr)r'r2passwordthe_hashmagicsaltr*r*r+testYs    zBasicAuthentication.testc Cs|d}|r,|dr,tt|dddd}t|dkr,|\}}|||r,|Sdd|jfd g}|d |}|d dS) NHTTP_AUTHORIZATIONBasicrrvruWWW-AuthenticatezBasic realm="%s"zContent-Length0401 Unauthorized)rcrPrrrlenrr) r'rrheaderauthr2rheaderswriter*r*r+rjs      zBasicAuthentication.do_authN)rrrrrrrr*r*r*r+r7s  rc@s>eZdZdZdZddZddZddZdd d Zd d Z dS)DigestAuthenticationzEA simple HTTP digest authentication implementation (:rfc:`2617`).dcCs"g|_||_i|_t||dSrt) active_noncesrrrr)r'htdigestrr*r*r+rrzDigestAuthentication.__init__c Csi|_t|ddF}|D];}|dd}|sq z|ddd\}}}Wnty<td||ftjd Yq w||jkrG||j|<q Wdn1sRwY|jikrgtd |jtjd dSdS) zxLoad account information from apache style htdigest files, only users from the specified realm are used rrrrrvNz&Warning: invalid digest line in %s: %srz!Warning: found no users in realm:) rrrrrrrrr)r'rrrrra1r*r*r+rs4     zDigestAuthentication.loadcCs\i}tj|D]#}|dd\}}|ddkr'|ddkr'|dd||<q|||<q|S)N=rr")rxrequestparse_http_listr)r' authorizationvaluesr:nvr*r*r+parse_auth_headers z&DigestAuthentication.parse_auth_headerrcCsdt}|j|t|j|jkr|j|j d|_dd|j||ffdg}|d|}|ddS)zdSend a digest challange to the browser. Record used nonces to avoid replay attacks. Nrz5Digest realm="%s", nonce="%s", qop="auth", stale="%s"rrr)rrappendr MAX_NONCESr)r'rrstalenoncerrr*r*r+send_auth_requests    z&DigestAuthentication.send_auth_requestc Cs0|d}|r |ds|||dS||dd}gd}|D]}||vr2|||dSq#||d|jvrF|||dSdd}|j|d}||d|d g} |||d |d |d |d | g} |d| kr{|||dS|d |jvr|j||dddS|j|d |dS)NrDigest)usernamerruriresponsenccnoncercSstddd|DS)N:css|]}|dVqdS)rN)r).0rr*r*r+ szADigestAuthentication.do_auth....)rjoin hexdigest)xr*r*r+sz.DigestAuthentication.do_auth..REQUEST_METHODrrrrqoprtrue)r)rcrPrrrrrremove) r'rrrr required_keyskeykdra2correctr*r*r+rs:      zDigestAuthentication.do_authN)r) rrrrrrrrrrr*r*r*r+rys r)/abcrrbase64rrhashlibrrrrLr urllib.parserxurllib.request trac.configrr r trac.core trac.web.apir r trac.web.chromerr trac.utilrrtrac.util.compatrtrac.util.concurrencyrtrac.util.datefmtrtrac.util.htmlrtrac.util.translationrr Componentrobjectrrrrr*r*r*r+s0    |B