瀏覽代碼

remove more traces of cPickle

nodes data was writen to DB with cPickle.dumps, hence
loading the data was done cPickle.loads. New node
are now saved as encrypted string without cPickle.
This makes Pwman3 a bit more secure.
oz123 11 年之前
父節點
當前提交
61591e5ac3
共有 1 個文件被更改,包括 16 次插入5 次删除
  1. 16 5
      pwman/util/crypto.py

+ 16 - 5
pwman/util/crypto.py

@@ -324,8 +324,12 @@ password")
         if not key:
             raise Exception("Wrong password entered %s times; giving up"
                             % max_tries)
-
-        self._cipher = self._getcipher_real(str(key).decode('base64'),
+        try:
+            key = str(key).decode('base64')
+        except Exception:
+            key = cPickle.loads(key)
+            key = str(key).decode('base64')
+        self._cipher = self._getcipher_real(key,
                                             self._algo)
 
         CryptoEngine._timeoutcount = time.time()
@@ -380,8 +384,8 @@ password")
         """
         prepare data before encrypting
         """
-        plaintext = cPickle.dumps(obj)
-        plaintext = _TAG + plaintext
+        #plaintext = cPickle.dumps(obj)
+        plaintext = _TAG + obj
         numblocks = (len(plaintext)/blocksize) + 1
         newdatasize = blocksize*numblocks
         return plaintext.ljust(newdatasize)
@@ -394,7 +398,14 @@ password")
             plaintext = plaintext[len(_TAG):]
         else:
             raise CryptoBadKeyException("Error decrypting, bad key")
-        return cPickle.loads(plaintext)
+        try:
+            # old db version used to write stuff to db with
+            # plaintext = cPickle.dumps(obj)
+            # TODO: completely remove this block, and convert
+            # the DB to a completely plain text ...
+            return cPickle.loads(plaintext)
+        except (TypeError, cPickle.UnpicklingError):
+            return plaintext
 
 
 class DummyCryptoEngine(CryptoEngine):