def compare_passwd(plain_passwd, hashed_passwd):
"""Return True if hashed_passwd is plain_passwd hashed, False othervise."""
(method, salt, _) = hashed_passwd.split('$')
if sec.compare(hashed(plain_passwd, method=method, salt=salt), hashed_passwd):
return True
else:
return False
def compare_passwd(plain_passwd, hashed_passwd):
"""Return True if hashed_passwd is plain_passwd hashed, False othervise."""
(method, salt, _) = hashed_passwd.split('$')
if sec.compare(hashed(plain_passwd, method=method, salt=salt),
hashed_passwd):
return True
else:
return False
def decrypt_and_mac(key, message):
# This works because hmac is hex-encoded, thus the '$' preceeding it is always
# the last '$' in message
encrypted, hmac = message.rsplit("$", 1)
if not sec.compare(hmac, hmac_sha512(key, encrypted)):
# Usually this means the key is wrong
raise ValueError("Invalid HMAC")
ciphertext, nonce, iv = message.split("$")[:3]
plain = aes_decrypt(key, ciphertext, nonce, iv)
return plain
def decrypt_and_mac(key, message):
# This works because hmac is hex-encoded, thus the '$' preceeding it is always
# the last '$' in message
encrypted, hmac = message.rsplit("$", 1)
if not sec.compare(hmac, hmac_sha512(key, encrypted)):
# Usually this means the key is wrong
raise ValueError("Invalid HMAC")
ciphertext, nonce, iv = message.split("$")[:3]
plain = aes_decrypt(key, ciphertext, nonce, iv)
return plain
def dalpay():
# Since deciding to create lokun-billing, this got a
# bit.. hacky.
try:
passwd = request.forms["SilentPostPassword"]
if not sec.compare(passwd, config.dalpay_passwd):
log("DalPay: Invalid SilentPostPassword")
abort(401, "Unauthorized")
message = request.forms["user1"]
dalpay = DalPay.read(message, key=config.dalpay_key)
cardtype = request.forms["pay_type"]
fees = calculate_fees(cardtype, dalpay.amount)
model.Deposit.new(dalpay.username, dalpay.amount, cardtype,
vsk=25.5, fees=fees, deposit=True)
logger.email("DalPay: {0},{1}".format(dalpay.username, dalpay.amount))
return config.dalpay_return
except ValueError as ve:
logger.email("DalPay: " + str(ve))
# Do i need to log something more? BK 22.03.2014
return "<!-- error: {0} -->".format(str(ve))