dziegler / django-urlcrypt Goto Github PK

Using the session_key as as part of they cache key in rate_limit sometimes generates a key that is too long for memcached (255 characters) causing an exception to be raised that can not be handled by our application.

Shortening the key will risk duplicate cache keys. My simple proposal is to able to disable rate limiting or using a different key.

I've noticed that this project has not been maintained for a while. Let me know if oyu don't expect to fix this. Thanks :)

At least in python 2.6 under linux, the key passed to hmac.new(key, msg, digestmod) must be of type str, not unicode. However, as the key is constructed using User's passwords, if that field is unicode (as it is in recent Djangos), the key is cast to unicode. This results in the following very confusing error:

TemplateSyntaxError at ...
Caught TypeError while rendering: character mapping must return integer, None or unicode

This can be fixed by simply coercing the key to string; though if the key had un-decodable unicode chars it would be another problem.

Patch:

--- a/urlcrypt/lib.py
+++ b/urlcrypt/lib.py
@@ -52,7 +52,7 @@ deobfuscate = obfuscate

 def encode_token(strings, secret_key_f):
     secret_key = secret_key_f(*strings)
-    signature = hmac.new(secret_key, pack(*strings), sha_hmac).hexdigest()
+    signature = hmac.new(str(secret_key), pack(*strings), sha_hmac).hexdigest()
     packed_string = pack(signature, *strings)
     return obfuscate(packed_string)

The documentation in the README for "advanced lib usage" is out of date. The interface for encode_token now wants a function as the second argument, but the README uses a string.

While the encoded_url template tag parser properly parses the "as varname" syntax, the node renderer doesn't use it properly. Currently, the node renderer prints the encrypted URL, and sets the unencrypted URL to the context varname.

A forthcoming pull requests fixes this issue and the previous unicode issue, and adds tests for both.

Crypto is used in the code but not present in the requires section off the setup.py file.