def newUserProfile(self, email):
user_data = OrderedDict.fromkeys(self.default_keys)
user_data[Message(b'email')] = Message(email, 'ascii')
user_data[Message(b'uid')] = Message(str(randint(uid_min, uid_max)), 'ascii')
user_data[Message(b'role')] = Message(b'user')
token = Token(user_data, self.sep_field, self.sep_key)
encr_token = self.oracle.encryptECB(token.msg)
return encr_token
def isAdminCookie(self, msg):
decr_msg = self.oracle.decryptCTR(msg)
try:
token = Token.fromMsg(decr_msg, Message(b';'), Message(b'='))
except IndexError:
raise InvalidToken
try:
return token.data[Message(b'admin')] == Message(b'true')
except KeyError:
return False
def isAdminAuthCookie(self, mac_pair):
(cookie, mac) = mac_pair
if not self.oracle.checkMACMD4(cookie, mac):
raise BadMAC
try:
token = Token.fromMsg(cookie, Message(b';'), Message(b'='))
except IndexError:
raise InvalidToken
try:
return token.data[Message(b'admin')] == Message(b'true')
except KeyError:
return False
def validateProfile(self, msg):
decr_msg = self.oracle.decryptECB(msg).stripPad()
token = Token.fromMsg(decr_msg, Message(b';'), Message(b'='))
is_admin = False
try:
email = token.data[Message(b'email')]
uid = token.data[Message(b'uid')]
role = token.data[Message(b'role')]
if role == Message(b'admin'):
is_admin = True
print("Logging in as %s with email %s and UID %s..." % (role.ascii(), email.ascii(), uid.ascii()))
return is_admin
except KeyError:
raise InvalidToken
def checkQuery(self, query):
query = unquote(query)
print(query)
query_msg = Message(query, 'ascii')
try:
token = Token.fromMsg(query_msg,
sep_field=Message(b'&'),
sep_key=Message(b'='))
filename = token.data[Message(b'file')].ascii()
with open(filename, 'r') as infile:
file_contents = Message(infile.read(), 'ascii')
mac = token.data[Message(b'signature')].ascii()
return self.oracle.checkHMACSHA1_insecure(file_contents, mac)
except (IndexError, KeyError):
raise InvalidToken