U 8T_@sPddlmZddlmZddlmZmZddlmZmZGdddZ e Z dS))datetime)settings)constant_time_compare salted_hmac) base36_to_int int_to_base36c@sXeZdZdZdZdZejZddZ ddZ dd Z dd d Z d dZ ddZddZdS)PasswordResetTokenGeneratorza Strategy object used to generate and check tokens for the password reset mechanism. z6django.contrib.auth.tokens.PasswordResetTokenGeneratorNcCs|jp tj|_dSN) algorithmrZDEFAULT_HASHING_ALGORITHMselfr >/tmp/pip-unpacked-wheel-dv63caxw/django/contrib/auth/tokens.py__init__sz$PasswordResetTokenGenerator.__init__cCs||||S)zi Return a token that can be used once to do a password reset for the given user. )_make_token_with_timestamp _num_seconds_now)r userr r r make_tokensz&PasswordResetTokenGenerator.make_tokencCs|r|s dSz|d\}}Wntk r4YdSXz t|}Wntk rXYdSXt||||st|j||dd|sdS|||tjkrdSdS)zP Check that a password reset token is correct for a given user. F-T)legacy) split ValueErrorrrrrrrZPASSWORD_RESET_TIMEOUT)r rtokents_b36_tsr r r check_tokens& z'PasswordResetTokenGenerator.check_tokenFcCsHt|}t|j||||j|r$dn|jdddd}d||fS)Nsha1)secretr z%s-%s)rrkey_salt_make_hash_valuerr hexdigest)r r timestamprrZ hash_stringr r rr?s   z6PasswordResetTokenGenerator._make_token_with_timestampcCs>|jdkrdn|jjddd}t|j|jt|t|S)a Hash the user's primary key and some user state that's sure to change after a password reset to produce a token that invalidated when it's used: 1. The password field will change upon a password reset (even if the same password is chosen, due to password salting). 2. The last_login field will usually be updated very shortly after a password reset. Failing those things, settings.PASSWORD_RESET_TIMEOUT eventually invalidates the token. Running this data through salted_hmac() prevents password cracking attempts using the reset token, provided the secret isn't compromised. Nr) microsecondtzinfo)Z last_loginreplacestrpkpassword)r rr$Zlogin_timestampr r rr"Nsz,PasswordResetTokenGenerator._make_hash_valuecCst|tdddS)Ni)intr total_seconds)r dtr r rrbsz(PasswordResetTokenGenerator._num_secondscCstSr )rnowr r r rresz PasswordResetTokenGenerator._now)F)__name__ __module__ __qualname____doc__r!r rZ SECRET_KEYrrrrrr"rrr r r rrs" rN) rZ django.confrZdjango.utils.cryptorrZdjango.utils.httprrrZdefault_token_generatorr r r rs  b