änderung1

2019-10-29 14:29:36 +01:00
1 parent cc1d096bc3
commit cbdda613b7
@@ -0,0 +1,81 @@
+from django.conf import settings
+from django.contrib.sessions.backends.base import (
+    CreateError, SessionBase, UpdateError,
+)
+from django.core.cache import caches
+
+KEY_PREFIX = "django.contrib.sessions.cache"
+
+
+class SessionStore(SessionBase):
+    """
+    A cache-based session store.
+    """
+    cache_key_prefix = KEY_PREFIX
+
+    def __init__(self, session_key=None):
+        self._cache = caches[settings.SESSION_CACHE_ALIAS]
+        super().__init__(session_key)
+
+    @property
+    def cache_key(self):
+        return self.cache_key_prefix + self._get_or_create_session_key()
+
+    def load(self):
+        try:
+            session_data = self._cache.get(self.cache_key)
+        except Exception:
+            # Some backends (e.g. memcache) raise an exception on invalid
+            # cache keys. If this happens, reset the session. See #17810.
+            session_data = None
+        if session_data is not None:
+            return session_data
+        self._session_key = None
+        return {}
+
+    def create(self):
+        # Because a cache can fail silently (e.g. memcache), we don't know if
+        # we are failing to create a new session because of a key collision or
+        # because the cache is missing. So we try for a (large) number of times
+        # and then raise an exception. That's the risk you shoulder if using
+        # cache backing.
+        for i in range(10000):
+            self._session_key = self._get_new_session_key()
+            try:
+                self.save(must_create=True)
+            except CreateError:
+                continue
+            self.modified = True
+            return
+        raise RuntimeError(
+            "Unable to create a new session key. "
+            "It is likely that the cache is unavailable.")
+
+    def save(self, must_create=False):
+        if self.session_key is None:
+            return self.create()
+        if must_create:
+            func = self._cache.add
+        elif self._cache.get(self.cache_key) is not None:
+            func = self._cache.set
+        else:
+            raise UpdateError
+        result = func(self.cache_key,
+                      self._get_session(no_load=must_create),
+                      self.get_expiry_age())
+        if must_create and not result:
+            raise CreateError
+
+    def exists(self, session_key):
+        return bool(session_key) and (self.cache_key_prefix + session_key) in self._cache
+
+    def delete(self, session_key=None):
+        if session_key is None:
+            if self.session_key is None:
+                return
+            session_key = self.session_key
+        self._cache.delete(self.cache_key_prefix + session_key)
+
+    @classmethod
+    def clear_expired(cls):
+        pass
@@ -0,0 +1,109 @@
+import logging
+
+from django.contrib.sessions.backends.base import (
+    CreateError, SessionBase, UpdateError,
+)
+from django.core.exceptions import SuspiciousOperation
+from django.db import DatabaseError, IntegrityError, router, transaction
+from django.utils import timezone
+from django.utils.functional import cached_property
+
+
+class SessionStore(SessionBase):
+    """
+    Implement database session store.
+    """
+    def __init__(self, session_key=None):
+        super().__init__(session_key)
+
+    @classmethod
+    def get_model_class(cls):
+        # Avoids a circular import and allows importing SessionStore when
+        # django.contrib.sessions is not in INSTALLED_APPS.
+        from django.contrib.sessions.models import Session
+        return Session
+
+    @cached_property
+    def model(self):
+        return self.get_model_class()
+
+    def _get_session_from_db(self):
+        try:
+            return self.model.objects.get(
+                session_key=self.session_key,
+                expire_date__gt=timezone.now()
+            )
+        except (self.model.DoesNotExist, SuspiciousOperation) as e:
+            if isinstance(e, SuspiciousOperation):
+                logger = logging.getLogger('django.security.%s' % e.__class__.__name__)
+                logger.warning(str(e))
+            self._session_key = None
+
+    def load(self):
+        s = self._get_session_from_db()
+        return self.decode(s.session_data) if s else {}
+
+    def exists(self, session_key):
+        return self.model.objects.filter(session_key=session_key).exists()
+
+    def create(self):
+        while True:
+            self._session_key = self._get_new_session_key()
+            try:
+                # Save immediately to ensure we have a unique entry in the
+                # database.
+                self.save(must_create=True)
+            except CreateError:
+                # Key wasn't unique. Try again.
+                continue
+            self.modified = True
+            return
+
+    def create_model_instance(self, data):
+        """
+        Return a new instance of the session model object, which represents the
+        current session state. Intended to be used for saving the session data
+        to the database.
+        """
+        return self.model(
+            session_key=self._get_or_create_session_key(),
+            session_data=self.encode(data),
+            expire_date=self.get_expiry_date(),
+        )
+
+    def save(self, must_create=False):
+        """
+        Save the current session data to the database. If 'must_create' is
+        True, raise a database error if the saving operation doesn't create a
+        new entry (as opposed to possibly updating an existing entry).
+        """
+        if self.session_key is None:
+            return self.create()
+        data = self._get_session(no_load=must_create)
+        obj = self.create_model_instance(data)
+        using = router.db_for_write(self.model, instance=obj)
+        try:
+            with transaction.atomic(using=using):
+                obj.save(force_insert=must_create, force_update=not must_create, using=using)
+        except IntegrityError:
+            if must_create:
+                raise CreateError
+            raise
+        except DatabaseError:
+            if not must_create:
+                raise UpdateError
+            raise
+
+    def delete(self, session_key=None):
+        if session_key is None:
+            if self.session_key is None:
+                return
+            session_key = self.session_key
+        try:
+            self.model.objects.get(session_key=session_key).delete()
+        except self.model.DoesNotExist:
+            pass
+
+    @classmethod
+    def clear_expired(cls):
+        cls.get_model_class().objects.filter(expire_date__lt=timezone.now()).delete()
@@ -0,0 +1,82 @@
+from django.conf import settings
+from django.contrib.sessions.backends.base import SessionBase
+from django.core import signing
+
+
+class SessionStore(SessionBase):
+
+    def load(self):
+        """
+        Load the data from the key itself instead of fetching from some
+        external data store. Opposite of _get_session_key(), raise BadSignature
+        if signature fails.
+        """
+        try:
+            return signing.loads(
+                self.session_key,
+                serializer=self.serializer,
+                # This doesn't handle non-default expiry dates, see #19201
+                max_age=settings.SESSION_COOKIE_AGE,
+                salt='django.contrib.sessions.backends.signed_cookies',
+            )
+        except Exception:
+            # BadSignature, ValueError, or unpickling exceptions. If any of
+            # these happen, reset the session.
+            self.create()
+        return {}
+
+    def create(self):
+        """
+        To create a new key, set the modified flag so that the cookie is set
+        on the client for the current request.
+        """
+        self.modified = True
+
+    def save(self, must_create=False):
+        """
+        To save, get the session key as a securely signed string and then set
+        the modified flag so that the cookie is set on the client for the
+        current request.
+        """
+        self._session_key = self._get_session_key()
+        self.modified = True
+
+    def exists(self, session_key=None):
+        """
+        This method makes sense when you're talking to a shared resource, but
+        it doesn't matter when you're storing the information in the client's
+        cookie.
+        """
+        return False
+
+    def delete(self, session_key=None):
+        """
+        To delete, clear the session key and the underlying data structure
+        and set the modified flag so that the cookie is set on the client for
+        the current request.
+        """
+        self._session_key = ''
+        self._session_cache = {}
+        self.modified = True
+
+    def cycle_key(self):
+        """
+        Keep the same data but with a new key. Call save() and it will
+        automatically save a cookie with a new key at the end of the request.
+        """
+        self.save()
+
+    def _get_session_key(self):
+        """
+        Instead of generating a random string, generate a secure url-safe
+        base64-encoded string of data as our session key.
+        """
+        return signing.dumps(
+            self._session, compress=True,
+            salt='django.contrib.sessions.backends.signed_cookies',
+            serializer=self.serializer,
+        )
+
+    @classmethod
+    def clear_expired(cls):
+        pass