def change_to_str(change_tuple):
        attr, newval, oldval = change_tuple

        if attr in ('StartDate', 'EndDate'):
            newval = date_from_adzerk(newval)
            oldval = date_from_adzerk(oldval)

        return '%s: %s -> %s' % (attr, _force_utf8(oldval), _force_utf8(newval))
Exemple #2
0
 def _key_from_url(cls, url):
     if not utils.domain(url) in g.case_sensitive_domains:
         keyurl = _force_utf8(UrlParser.base_url(url.lower()))
     else:
         # Convert only hostname to lowercase
         up = UrlParser(url)
         up.hostname = up.hostname.lower()
         keyurl = _force_utf8(UrlParser.base_url(up.unparse()))
     return keyurl
Exemple #3
0
 def _conv(s):
     if isinstance(s, str):
         return s
     elif isinstance(s, unicode):
         return _force_utf8(s)
     else:
         return str(s)
Exemple #4
0
def add_request_info(select):
    from pylons import request
    from r2.lib import filters

    def sanitize(txt):
        return (
            _spaces.sub(" ", txt)
            .replace("/", "|")
            .replace("-", "_")
            .replace(";", "")
            .replace("*", "")
            .replace(r"/", "")
        )

    s = StringIO.StringIO()
    traceback.print_stack(file=s)
    tb = s.getvalue()
    if tb:
        tb = tb.split("\n")[0::2]
        tb = [x.split("/")[-1] for x in tb if "/r2/" in x]
        tb = "\n".join(tb[-15:-2])
    try:
        if hasattr(request, "path") and hasattr(request, "ip") and hasattr(request, "user_agent"):
            comment = "/*\n%s\n%s\n%s\n*/" % (
                tb or "",
                filters._force_utf8(sanitize(request.fullpath)),
                sanitize(request.ip),
            )
            return select.prefix_with(comment)
    except UnicodeDecodeError:
        pass

    return select
Exemple #5
0
def add_request_info(select):
    from pylons import request
    from r2.lib import filters
    def sanitize(txt):
        return _spaces.sub(' ', txt).replace("/", "|").replace("-", "_").replace(';', "").replace("*", "").replace(r"/", "")
    s = StringIO.StringIO()
    traceback.print_stack( file = s)
    tb = s.getvalue()
    if tb:
        tb = tb.split('\n')[0::2]
        tb = [x.split('/')[-1] for x in tb if "/r2/" in x]
        tb = '\n'.join(tb[-15:-2])
    try:
        if (hasattr(request, 'path') and
            hasattr(request, 'ip') and
            hasattr(request, 'user_agent')):
            comment = '/*\n%s\n%s\n%s\n*/' % (
                tb or "", 
                filters._force_utf8(sanitize(request.fullpath)),
                sanitize(request.ip))
            return select.prefix_with(comment)
    except UnicodeDecodeError:
        pass

    return select
def send_html_email(to_addr, from_addr, subject, html, subtype="html", from_full='', session=None):
    from r2.lib.filters import _force_utf8

    # Open a session if we don't already have one.
    if not session:
        session = open_smtp_session()
        close_session = True
    else:
        close_session = False

    if from_full == '':
        from_full = from_addr

    # Compose the message headers.
    msg = MIMEText(_force_utf8(html), subtype)
    msg["Subject"] = subject
    msg["From"] = from_full
    msg["To"] = to_addr

    # Send the mail.
    session.sendmail(from_addr, to_addr, msg.as_string())

    # Close down the session if we opened it.
    if close_session:
        session.quit()
Exemple #7
0
    def process_response(self):
        data = request.POST

        transaction_id = 'RG%s' % data['transaction_id']
        pennies = int(data['pennies'])
        months = int(data['months'])
        status = 'succeeded'

        buyer_name = data['buyer']
        goldtype = data['goldtype']

        buyer = Account._by_name(buyer_name)

        blob = {
            'goldtype': goldtype,
            'account_id': buyer._id,
            'account_name': buyer.name,
            'status': 'initialized',
        }

        if goldtype == 'gift':
            blob['recipient'] = data['recipient']
            giftmessage = data.get('giftmessage', None)
            blob['giftmessage'] = _force_utf8(giftmessage)
            signed = data.get('signed')
            blob['signed'] = True if signed == 'True' else False

        passthrough = generate_blob(blob)

        return status, passthrough, transaction_id, pennies, months
Exemple #8
0
 def by_url_key(cls, url):
     maxlen = 250
     template = "byurl(%s,%s)"
     keyurl = _force_utf8(base_url(url.lower()))
     hexdigest = md5(keyurl).hexdigest()
     usable_len = maxlen - len(template) - len(hexdigest)
     return template % (hexdigest, keyurl[:usable_len])
Exemple #9
0
def send_html_email(to_addr, from_addr, subject, html,
        subtype="html", attachments=None):
    from r2.lib.filters import _force_utf8
    if not attachments:
        attachments = []

    msg = MIMEMultipart()
    msg.attach(MIMEText(_force_utf8(html), subtype))
    msg["Subject"] = subject
    msg["From"] = from_addr
    msg["To"] = to_addr

    for attachment in attachments:
        part = MIMEBase('application', "octet-stream")
        part.set_payload(attachment['contents'])
        encoders.encode_base64(part)
        part.add_header('Content-Disposition', 'attachment',
            filename=attachment['name'])
        msg.attach(part)

    session = smtplib.SMTP(g.smtp_server)
    if g.smtp_username and g.smtp_password:
        try:
            session.login(g.smtp_username, g.smtp_password)
        except (smtplib.SMTPHeloError, smtplib.SMTPAuthenticationError,
                smtplib.SMTPException):
            print "Failed to login smtp server"
            traceback.print_exc(file = sys.stdout)
            email.set_sent(rejected = True)
    session.sendmail(from_addr, to_addr, msg.as_string())
    session.quit()
Exemple #10
0
    def process_response(self):
        data = request.POST

        transaction_id = 'RG%s' % data['transaction_id']
        pennies = int(data['pennies'])
        months = int(data['months'])
        status = 'succeeded'

        goldtype = data['goldtype']
        buyer = Account._by_name(data['buyer'])

        if goldtype == 'gift':
            gift_kw = {
                'recipient': Account._by_name(data['recipient']),
                'giftmessage': _force_utf8(data.get('giftmessage', None)),
                'signed': data.get('signed') == 'True',
            }
        else:
            gift_kw = {}

        webhook = Webhook(
            transaction_id=transaction_id,
            pennies=pennies,
            months=months,
            goldtype=goldtype,
            buyer=buyer,
            **gift_kw)
        return status, webhook
Exemple #11
0
    def process_response(self):
        data = request.POST

        transaction_id = "RG%s" % data["transaction_id"]
        pennies = int(data["pennies"])
        months = int(data["months"])
        status = "succeeded"

        buyer_name = data["buyer"]
        goldtype = data["goldtype"]

        buyer = Account._by_name(buyer_name)

        blob = {"goldtype": goldtype, "account_id": buyer._id, "account_name": buyer.name, "status": "initialized"}

        if goldtype == "gift":
            blob["recipient"] = data["recipient"]
            giftmessage = data.get("giftmessage", None)
            blob["giftmessage"] = _force_utf8(giftmessage)
            signed = data.get("signed")
            blob["signed"] = True if signed == "True" else False

        passthrough = generate_blob(blob)

        return status, passthrough, transaction_id, pennies, months
Exemple #12
0
def log_text(classification, text=None, level="info"):
    """Send some log text to log_q for appearance in the streamlog.

    This is deprecated. All logging should be done through python's stdlib
    logging library.

    """

    from r2.lib import amqp
    from r2.lib.filters import _force_utf8

    if text is None:
        text = classification

    if level not in ("debug", "info", "warning", "error"):
        print "What kind of loglevel is %s supposed to be?" % level
        level = "error"

    d = _default_dict()
    d["type"] = "text"
    d["level"] = level
    d["text"] = _force_utf8(text)
    d["classification"] = classification

    amqp.add_item(QUEUE_NAME, cPickle.dumps(d))
Exemple #13
0
def valid_password(a, password):
    # bail out early if the account or password's invalid
    if not hasattr(a, 'name') or not hasattr(a, 'password') or not password:
        return False

    # standardize on utf-8 encoding
    password = filters._force_utf8(password)

    # this is really easy if it's a sexy bcrypt password
    if a.password.startswith('$2a$'):
        expected_hash = bcrypt.hashpw(password, a.password)
        if constant_time_compare(a.password, expected_hash):
            return a
        return False

    # alright, so it's not bcrypt. how old is it?
    # if the length of the stored hash is 43 bytes, the sha-1 hash has a salt
    # otherwise it's sha-1 with no salt.
    salt = ''
    if len(a.password) == 43:
        salt = a.password[:3]
    expected_hash = passhash(a.name, password, salt)

    if not constant_time_compare(a.password, expected_hash):
        return False

    # since we got this far, it's a valid password but in an old format
    # let's upgrade it
    a.password = bcrypt_password(password)
    a._commit()
    return a
Exemple #14
0
 def add(cls, link, text):
     name = c.user.name if c.user_is_loggedin else "<AUTOMATED>"
     now = datetime.now(g.tz).strftime("%Y-%m-%d %H:%M:%S")
     text = "[%s: %s] %s" % (name, now, text)
     rowkey = cls._rowkey(link)
     column = {uuid1(): filters._force_utf8(text)}
     cls._set_values(rowkey, column)
     return text
Exemple #15
0
def get_domain_links(domain, sort, time):
    from r2.lib.db import operators

    q = Link._query(operators.domain(Link.c.url) == filters._force_utf8(domain), sort=db_sort(sort), data=True)
    if time != "all":
        q._filter(db_times[time])

    return make_results(q)
Exemple #16
0
 def run(self, username):
     if username:
         try:
             name = _force_utf8(username)
             return Account._by_name(name)
         except (TypeError, UnicodeEncodeError, NotFound):
             return self.error(errors.USER_DOESNT_EXIST)
     self.error()
def _get_encrypted_user_slug():
    """Return an encrypted string containing context info."""
    data = [
        c.user._id36 if c.user_is_loggedin else "",
        get_srpath(),
        c.lang or "",
        c.cname,
    ]
    return encrypt("|".join(_force_utf8(s) for s in data))
Exemple #18
0
def add_trackers(items, sr, adserver_click_urls=None):
    """Add tracking names and hashes to a list of wrapped promoted links."""
    adserver_click_urls = adserver_click_urls or {}
    for item in items:
        if not item.promoted:
            continue

        if item.campaign is None:
            item.campaign = NO_CAMPAIGN

        tracking_name_fields = [item.fullname, item.campaign]
        if not isinstance(sr, FakeSubreddit):
            tracking_name_fields.append(sr.name)

        tracking_name = '-'.join(tracking_name_fields)

        # construct the impression pixel url
        pixel_mac = hmac.new(
            g.tracking_secret, tracking_name, hashlib.sha1).hexdigest()
        pixel_query = {
            "id": tracking_name,
            "hash": pixel_mac,
            "r": random.randint(0, 2147483647), # cachebuster
        }
        item.imp_pixel = update_query(g.adtracker_url, pixel_query)
        
        if item.third_party_tracking:
            item.third_party_tracking_url = item.third_party_tracking
        if item.third_party_tracking_2:
            item.third_party_tracking_url_2 = item.third_party_tracking_2

        # construct the click redirect url
        item_url = adserver_click_urls.get(item.campaign) or item.url
        url = _force_utf8(item_url)
        hashable = ''.join((url, tracking_name.encode("utf-8")))
        click_mac = hmac.new(
            g.tracking_secret, hashable, hashlib.sha1).hexdigest()
        click_query = {
            "id": tracking_name,
            "hash": click_mac,
            "url": url,
        }
        click_url = update_query(g.clicktracker_url, click_query)

        # overwrite the href_url with redirect click_url
        item.href_url = click_url

        # also overwrite the permalink url with redirect click_url for selfposts
        if item.is_self:
            item.permalink = click_url
        else:
            # add encrypted click url to the permalink for comments->click
            item.permalink = update_query(item.permalink, {
                "click_url": url,
                "click_hash": get_click_url_hmac(item, url),
            })
Exemple #19
0
def send_html_email(to_addr, from_addr, subject, html, subtype="html"):
    from r2.lib.filters import _force_utf8
    msg = MIMEText(_force_utf8(html), subtype)
    msg["Subject"] = subject
    msg["From"] = from_addr
    msg["To"] = to_addr

    session = smtplib.SMTP(g.smtp_server)
    session.sendmail(from_addr, to_addr, msg.as_string())
    session.quit()
Exemple #20
0
def get_pageview_pixel_url():
    """Return a URL to use for tracking pageviews for the current request."""
    data = [
        c.user.name if c.user_is_loggedin else "",
        get_srpath(),
        c.lang or "",
        c.cname,
    ]
    encrypted = encrypt("|".join(_force_utf8(s) for s in data))
    return g.tracker_url + "?v=" + encrypted
Exemple #21
0
def extract_urls_from_markdown(md):
    "Extract URLs that will be hot links from a piece of raw Markdown."

    html = snudown.markdown(_force_utf8(md))
    links = SoupStrainer("a")

    for link in BeautifulSoup(html, parseOnlyThese=links):
        url = link.get('href')
        if url:
            yield url
Exemple #22
0
def _get_encrypted_user_slug():
    """Return an encrypted string containing context info."""
    # The cname value (formerly c.cname) is expected by The traffic system.
    cname = False
    data = [
        c.user._id36 if c.user_is_loggedin else "",
        get_srpath(),
        c.lang or "",
        cname,
    ]
    return encrypt("|".join(_force_utf8(s) for s in data))
Exemple #23
0
def send_html_email(to_addr, from_addr, subject, html, subtype="html"):
    from r2.lib.filters import _force_utf8
    msg = MIMEText(_force_utf8(html), subtype)
    msg["Subject"] = subject
    msg["From"] = from_addr
    msg["To"] = to_addr

    session = smtplib.SMTP(g.smtp_server,g.smtp_port)
    if int(g.smtp_port)!=25 and g.smtp_user and g.smtp_pass:
        session.starttls()
        session.login(g.smtp_user,g.smtp_pass)
    session.sendmail(from_addr, to_addr, msg.as_string())
    session.quit()
Exemple #24
0
def c_markdown(text, nofollow=False, target=None):
    u8 = _force_utf8(text)
    size = c_int(len(u8))
    nofollow = 1 if nofollow else 0
    doc = c_void_p()
    html = c_void_p()

    libmd.reddit_discount_wrap(u8, nofollow, target,
                               byref(doc), byref(html), byref(size))
    r = string_at(html, size)
    libmd.reddit_discount_cleanup(doc)

    return r
Exemple #25
0
def send_html_email(to_addr, from_addr, subject, html, subtype="html"):
    from r2.lib.filters import _force_utf8
    msg = MIMEText(_force_utf8(html), subtype)
    msg["Subject"] = subject
    msg["From"] = g.gmail_username
    msg["To"] = to_addr

    session = smtplib.SMTP('smtp.gmail.com', 587)
    session.ehlo()
    session.starttls()
    session.ehlo
    session.login(g.gmail_username, g.gmail_password)
    session.sendmail(g.gmail_username, toaddr, msg.as_string())
    session.quit()
Exemple #26
0
def valid_password(a, password, compare_password=None):
    # bail out early if the account or password's invalid
    if not hasattr(a, 'name') or not hasattr(a, 'password') or not password:
        return False

    convert_password = False
    if compare_password is None:
        convert_password = True
        compare_password = a.password

    # standardize on utf-8 encoding
    password = filters._force_utf8(password)

    if compare_password.startswith('$2a$'):
        # it's bcrypt.

        try:
            expected_hash = bcrypt.hashpw(password, compare_password)
        except ValueError:
            # password is invalid because it contains null characters
            return False

        if not constant_time_compare(compare_password, expected_hash):
            return False

        # if it's using the current work factor, we're done, but if it's not
        # we'll have to rehash.
        # the format is $2a$workfactor$salt+hash
        work_factor = int(compare_password.split("$")[2])
        if work_factor == g.bcrypt_work_factor:
            return a
    else:
        # alright, so it's not bcrypt. how old is it?
        # if the length of the stored hash is 43 bytes, the sha-1 hash has a salt
        # otherwise it's sha-1 with no salt.
        salt = ''
        if len(compare_password) == 43:
            salt = compare_password[:3]
        expected_hash = passhash(a.name, password, salt)

        if not constant_time_compare(compare_password, expected_hash):
            return False

    # since we got this far, it's a valid password but in an old format
    # let's upgrade it
    if convert_password:
        a.password = bcrypt_password(password)
        a._commit()
    return a
Exemple #27
0
def set_content_type():
    e = request.environ
    c.render_style = e['render_style']
    response.content_type = e['content_type']

    if e.has_key('extension'):
        c.extension = ext = e['extension']
        if ext in ('embed', 'widget'):
            wrapper = request.params.get("callback", "document.write")
            wrapper = filters._force_utf8(wrapper)
            if not valid_jsonp_callback(wrapper):
                abort(BadRequestError(errors.BAD_JSONP_CALLBACK))

            # force logged-out state since these can be accessed cross-domain
            c.user = UnloggedUser(get_browser_langs())
            c.user_is_loggedin = False

            def to_js(content):
                return wrapper + "(" + utils.string2js(content) + ");"

            c.response_wrapper = to_js
        if ext in ("rss", "api", "json") and request.method.upper() == "GET":
            user = valid_feed(request.GET.get("user"),
                              request.GET.get("feed"),
                              request.path)
            if user and not g.read_only_mode:
                c.user = user
                c.user_is_loggedin = True
        if ext in ("mobile", "m") and not request.GET.get("keep_extension"):
            try:
                if request.cookies['reddit_mobility'] == "compact":
                    c.extension = "compact"
                    c.render_style = "compact"
            except (ValueError, KeyError):
                c.suggest_compact = True
        if ext in ("mobile", "m", "compact"):
            if request.GET.get("keep_extension"):
                c.cookies['reddit_mobility'] = Cookie(ext, expires=NEVER)
    # allow JSONP requests to generate callbacks, but do not allow
    # the user to be logged in for these 
    callback = request.GET.get("jsonp")
    if is_api() and request.method.upper() == "GET" and callback:
        if not valid_jsonp_callback(callback):
            abort(BadRequestError(errors.BAD_JSONP_CALLBACK))
        c.allowed_callback = callback
        c.user = UnloggedUser(get_browser_langs())
        c.user_is_loggedin = False
        response.content_type = "application/javascript"
Exemple #28
0
def log_text(classification, text=None, level="info"):
    from r2.lib.filters import _force_utf8
    if text is None:
        text = classification

    if level not in ('debug', 'info', 'warning', 'error'):
        print "What kind of loglevel is %s supposed to be?" % level
        level = 'error'

    d = _default_dict()
    d['type'] = 'text'
    d['level'] = level
    d['text'] = _force_utf8(text)
    d['classification'] = classification

    amqp.add_item(Q, pickle.dumps(d))
Exemple #29
0
    def __call__(self, environ, start_response):
        true_client_ip = environ.get('HTTP_TRUE_CLIENT_IP')
        ip_hash = environ.get('HTTP_TRUE_CLIENT_IP_HASH')
        forwarded_for = environ.get('HTTP_X_FORWARDED_FOR', ())
        remote_addr = environ.get('REMOTE_ADDR')
                
        if (g.ip_hash
            and true_client_ip
            and ip_hash
            and md5.new(true_client_ip + g.ip_hash).hexdigest() \
            == ip_hash.lower()):
            request.ip = true_client_ip
        elif remote_addr == g.proxy_addr and forwarded_for:
            request.ip = forwarded_for.split(',')[0]
        else:
            request.ip = environ['REMOTE_ADDR']

        #if x-dont-decode is set, pylons won't unicode all the paramters
        if environ.get('HTTP_X_DONT_DECODE'):
            request.charset = None

        request.get = storify(request.GET)
        request.post = storify(request.POST)
        request.referer = environ.get('HTTP_REFERER')
        request.path = _force_utf8(environ.get('PATH_INFO'))      # Enforce only valid utf8 chars in request path
        request.user_agent = environ.get('HTTP_USER_AGENT')
        request.fullpath = environ.get('FULLPATH', request.path)
        request.port = environ.get('request_port')
        
        if_modified_since = environ.get('HTTP_IF_MODIFIED_SINCE')
        if if_modified_since:
            request.if_modified_since = read_http_date(if_modified_since)
        else:
            request.if_modified_since = None

        #set the function to be called
        action = request.environ['pylons.routes_dict'].get('action')
        if action:
            meth = request.method.upper()
            if meth == 'HEAD':
                meth = 'GET'
            request.environ['pylons.routes_dict']['action'] = \
                    meth + '_' + action

        c.response = Response()
        res = WSGIController.__call__(self, environ, start_response)
        return res
Exemple #30
0
def add_trackers(items, sr):
    """Add tracking names and hashes to a list of wrapped promoted links."""
    for item in items:
        if not item.promoted:
            continue

        tracking_name_fields = [item.fullname, item.campaign]
        if not isinstance(sr, FakeSubreddit):
            tracking_name_fields.append(sr.name)

        tracking_name = '-'.join(tracking_name_fields)

        # construct the impression pixel url
        pixel_mac = hmac.new(
            g.tracking_secret, tracking_name, hashlib.sha1).hexdigest()
        pixel_query = {
            "id": tracking_name,
            "hash": pixel_mac,
            "r": random.randint(0, 2147483647), # cachebuster
        }
        item.imp_pixel = update_query(g.adtracker_url, pixel_query)
        
        if item.third_party_tracking:
            item.third_party_tracking_url = item.third_party_tracking
        if item.third_party_tracking_2:
            item.third_party_tracking_url_2 = item.third_party_tracking_2

        # construct the click redirect url
        url = urllib.unquote(_force_utf8(item.url))
        hashable = ''.join((url, tracking_name.encode("utf-8")))
        click_mac = hmac.new(
            g.tracking_secret, hashable, hashlib.sha1).hexdigest()
        click_query = {
            "id": tracking_name,
            "hash": click_mac,
            "url": url,
        }
        click_url = update_query(g.clicktracker_url, click_query)

        # overwrite the href_url with redirect click_url
        item.href_url = click_url

        # also overwrite the permalink url with redirect click_url for selfposts
        if item.is_self:
            item.permalink = click_url
Exemple #31
0
def add_request_info(select):
    def sanitize(txt):
        return _spaces.sub(' ',
                           txt).replace("/", "|").replace("-", "_").replace(
                               ';', "").replace("*", "").replace(r"/", "")

    tb = simple_traceback(limit=12)
    try:
        if (hasattr(request, 'path') and hasattr(request, 'ip')
                and hasattr(request, 'user_agent')):
            comment = '/*\n%s\n%s\n%s\n*/' % (
                tb or "", filters._force_utf8(sanitize(
                    request.fullpath)), sanitize(request.ip))
            return select.prefix_with(comment)
    except UnicodeDecodeError:
        pass

    return select
Exemple #32
0
def set_content_type():
    e = request.environ
    c.render_style = e['render_style']
    response.content_type = e['content_type']

    if e.has_key('extension'):
        c.extension = ext = e['extension']
        if ext in ('embed', 'wired', 'widget'):
            wrapper = request.params.get("callback", "document.write")
            wrapper = filters._force_utf8(wrapper)
            if not valid_jsonp_callback(wrapper):
                abort(BadRequestError(errors.BAD_JSONP_CALLBACK))

            def to_js(content):
                return wrapper + "(" + utils.string2js(content) + ");"

            c.response_wrapper = to_js
        if ext in ("rss", "api", "json") and request.method.upper() == "GET":
            user = valid_feed(request.GET.get("user"),
                              request.GET.get("feed"),
                              request.path)
            if user and not g.read_only_mode:
                c.user = user
                c.user_is_loggedin = True
        if ext in ("mobile", "m") and not request.GET.get("keep_extension"):
            try:
                if request.cookies['reddit_mobility'] == "compact":
                    c.extension = "compact"
                    c.render_style = "compact"
            except (ValueError, KeyError):
                c.suggest_compact = True
        if ext in ("mobile", "m", "compact"):
            if request.GET.get("keep_extension"):
                c.cookies['reddit_mobility'] = Cookie(ext, expires=NEVER)
    # allow JSONP requests to generate callbacks, but do not allow
    # the user to be logged in for these 
    callback = request.GET.get("jsonp")
    if is_api() and request.method.upper() == "GET" and callback:
        if not valid_jsonp_callback(callback):
            abort(BadRequestError(errors.BAD_JSONP_CALLBACK))
        c.allowed_callback = callback
        c.user = UnloggedUser(get_browser_langs())
        c.user_is_loggedin = False
Exemple #33
0
def valid_password(a, password, compare_password=None):
    # bail out early if the account or password's invalid
    if not hasattr(a, 'name') or not hasattr(a, 'password') or not password:
        return False

    convert_password = False
    if compare_password is None:
        convert_password = True
        compare_password = a.password

    # standardize on utf-8 encoding
    password = filters._force_utf8(password)

    if compare_password.startswith('$2a$'):
        # it's bcrypt.
        expected_hash = bcrypt.hashpw(password, compare_password)
        if not constant_time_compare(compare_password, expected_hash):
            return False

        # if it's using the current work factor, we're done, but if it's not
        # we'll have to rehash.
        # the format is $2a$workfactor$salt+hash
        work_factor = int(compare_password.split("$")[2])
        if work_factor == g.bcrypt_work_factor:
            return a
    else:
        # alright, so it's not bcrypt. how old is it?
        # if the length of the stored hash is 43 bytes, the sha-1 hash has a salt
        # otherwise it's sha-1 with no salt.
        salt = ''
        if len(compare_password) == 43:
            salt = compare_password[:3]
        expected_hash = passhash(a.name, password, salt)

        if not constant_time_compare(compare_password, expected_hash):
            return False

    # since we got this far, it's a valid password but in an old format
    # let's upgrade it
    if convert_password:
        a.password = bcrypt_password(password)
        a._commit()
    return a
Exemple #34
0
def send_html_email(to_addr, from_addr, subject, html,
        subtype="html", attachments=None):
    from r2.lib.filters import _force_utf8
    if not attachments:
        attachments = []

    msg = MIMEMultipart()
    msg.attach(MIMEText(_force_utf8(html), subtype))
    msg["Subject"] = subject
    msg["From"] = from_addr
    msg["To"] = to_addr

    for attachment in attachments:
        part = MIMEBase('application', "octet-stream")
        part.set_payload(attachment['contents'])
        encoders.encode_base64(part)
        part.add_header('Content-Disposition', 'attachment',
            filename=attachment['name'])
        msg.attach(part)

    session = smtplib.SMTP(g.smtp_server)
    session.sendmail(from_addr, to_addr, msg.as_string())
    session.quit()
Exemple #35
0
def canonicalize_email(email):
    """Return the given email address without various localpart manglings.

    [email protected] --> [email protected]

    This is not at all RFC-compliant or correct. It's only intended to be a
    quick heuristic to remove commonly used mangling techniques.

    """

    if not email:
        return ""

    email = _force_utf8(email.lower())

    localpart, at, domain = email.partition("@")
    if not at or "@" in domain:
        return ""

    localpart = localpart.replace(".", "")
    localpart = localpart.partition("+")[0]

    return localpart + "@" + domain
Exemple #36
0
def send_html_email(to_addr,
                    from_addr,
                    subject,
                    html,
                    subtype="html",
                    attachments=None):
    from r2.lib.filters import _force_utf8
    if not attachments:
        attachments = []

    msg = MIMEMultipart()
    msg.attach(MIMEText(_force_utf8(html), subtype))
    msg["Subject"] = subject
    msg["From"] = from_addr
    msg["To"] = to_addr

    for attachment in attachments:
        part = MIMEBase('application', "octet-stream")
        part.set_payload(attachment['contents'])
        encoders.encode_base64(part)
        part.add_header('Content-Disposition',
                        'attachment',
                        filename=attachment['name'])
        msg.attach(part)

    session = smtplib.SMTP(g.smtp_server)
    if g.smtp_username and g.smtp_password:
        try:
            session.login(g.smtp_username, g.smtp_password)
        except (smtplib.SMTPHeloError, smtplib.SMTPAuthenticationError,
                smtplib.SMTPException):
            print "Failed to login smtp server"
            traceback.print_exc(file=sys.stdout)
            email.set_sent(rejected=True)
    session.sendmail(from_addr, to_addr, msg.as_string())
    session.quit()
Exemple #37
0
    def process_response(self):
        data = request.POST

        transaction_id = 'RG%s' % data['transaction_id']
        pennies = int(data['pennies'])
        months = int(data['months'])
        status = 'succeeded'

        goldtype = data['goldtype']
        buyer = Account._by_name(data['buyer'])

        if goldtype == 'gift':
            gift_kw = {
                'recipient': Account._by_name(data['recipient']),
                'giftmessage': _force_utf8(data.get('giftmessage', None)),
                'signed': data.get('signed') == 'True',
            }
        else:
            gift_kw = {}

        webhook = Webhook(transaction_id=transaction_id, pennies=pennies,
                          months=months, goldtype=goldtype, buyer=buyer,
                          **gift_kw)
        return status, webhook
Exemple #38
0
from pylons.i18n import _
from pylons import c, request, g
from pylons.controllers.util import abort

from r2.lib.captcha import get_iden
from r2.lib.filters import spaceCompress, _force_unicode, _force_utf8
from r2.lib.db.queries import db_sort
from r2.lib.menus import NavButton, NamedButton, NavMenu, JsButton
from r2.lib.menus import SubredditButton, SubredditMenu, menu
from r2.lib.strings import plurals, rand_strings, strings
from r2.lib.utils import title_to_url, query_string, UrlParser
from r2.lib.template_helpers import add_sr, get_domain
from r2.lib.promote import promote_builder_wrapper
import sys

datefmt = _force_utf8(_('%d %b %Y'))

def get_captcha():
    if not c.user_is_loggedin or c.user.needs_captcha():
        return get_iden()

class Reddit(Wrapped):
    '''Base class for rendering a page on reddit.  Handles toolbar creation,
    content of the footers, and content of the corner buttons.

    Constructor arguments:

        space_compress -- run r2.lib.filters.spaceCompress on render
        loginbox -- enable/disable rendering of the small login box in the right margin
          (only if no user is logged in; login box will be disabled for a logged in user)
        show_sidebar -- enable/disable content in the right margin
Exemple #39
0
 def _key_from_url(cls, url):
     keyurl = _force_utf8(UrlParser.base_url(url.lower()))
     return keyurl
def sanitize_text(text):
    return _force_utf8(text).translate(None, DELCHARS)
Exemple #41
0
 def by_url_key(url, prefix=''):
     s = _force_utf8(base_url(url.lower()))
     return '%s%s' % (prefix, s)
Exemple #42
0
 def old_by_url_key(url):
     prefix = 'byurl_'
     s = _force_utf8(base_url(url.lower()))
     return '%s%s' % (prefix, s)
Exemple #43
0
def flatten_response(content):
    """Convert a content iterable to a string, properly handling unicode."""
    # TODO: it would be nice to replace this with response.body someday
    # once unicode issues are ironed out.
    return "".join(_force_utf8(x) for x in tup(content) if x)
Exemple #44
0
 def sanitize(txt):
     return "".join(x if x.isalnum() else "."
                    for x in filters._force_utf8(txt))