Bladeren bron

remove more traces of cPickle

nodes data was writen to DB with cPickle.dumps, hence
loading the data was done cPickle.loads. New node
are now saved as encrypted string without cPickle.
This makes Pwman3 a bit more secure.
oz123 11 jaren geleden
bovenliggende
commit
61591e5ac3
1 gewijzigde bestanden met toevoegingen van 16 en 5 verwijderingen
  1. 16 5
      pwman/util/crypto.py

+ 16 - 5
pwman/util/crypto.py

@@ -324,8 +324,12 @@ password")
         if not key:
             raise Exception("Wrong password entered %s times; giving up"
                             % max_tries)
-
-        self._cipher = self._getcipher_real(str(key).decode('base64'),
+        try:
+            key = str(key).decode('base64')
+        except Exception:
+            key = cPickle.loads(key)
+            key = str(key).decode('base64')
+        self._cipher = self._getcipher_real(key,
                                             self._algo)
 
         CryptoEngine._timeoutcount = time.time()
@@ -380,8 +384,8 @@ password")
         """
         prepare data before encrypting
         """
-        plaintext = cPickle.dumps(obj)
-        plaintext = _TAG + plaintext
+        #plaintext = cPickle.dumps(obj)
+        plaintext = _TAG + obj
         numblocks = (len(plaintext)/blocksize) + 1
         newdatasize = blocksize*numblocks
         return plaintext.ljust(newdatasize)
@@ -394,7 +398,14 @@ password")
             plaintext = plaintext[len(_TAG):]
         else:
             raise CryptoBadKeyException("Error decrypting, bad key")
-        return cPickle.loads(plaintext)
+        try:
+            # old db version used to write stuff to db with
+            # plaintext = cPickle.dumps(obj)
+            # TODO: completely remove this block, and convert
+            # the DB to a completely plain text ...
+            return cPickle.loads(plaintext)
+        except (TypeError, cPickle.UnpicklingError):
+            return plaintext
 
 
 class DummyCryptoEngine(CryptoEngine):