ó Xé?_c @sµdZddlZddlZddlZddlZddlZddlZddlZddlm Z m Z m Z m Z ddl mZddl mZddl mZddl mZeƒZdefd „ƒYZd efd „ƒYZd efd „ƒYZdefd„ƒYZdefd„ƒYZd„Zee_d„Zee_de_deeddeedeeed„ Z eeddeeed„Z!d„Z"dS(sTSession implementation for CherryPy. You need to edit your config file to use sessions. Here's an example:: [/] tools.sessions.on = True tools.sessions.storage_type = "file" tools.sessions.storage_path = "/home/site/sessions" tools.sessions.timeout = 60 This sets the session to be stored in files in the directory /home/site/sessions, and the session timeout to 60 minutes. If you omit ``storage_type`` the sessions will be saved in RAM. ``tools.sessions.on`` is the only required line for working sessions, the rest are optional. By default, the session ID is passed in a cookie, so the client's browser must have cookies enabled for your site. To set data for the current session, use ``cherrypy.session['fieldname'] = 'fieldvalue'``; to get data use ``cherrypy.session.get('fieldname')``. ================ Locking sessions ================ By default, the ``'locking'`` mode of sessions is ``'implicit'``, which means the session is locked early and unlocked late. Be mindful of this default mode for any requests that take a long time to process (streaming responses, expensive calculations, database lookups, API calls, etc), as other concurrent requests that also utilize sessions will hang until the session is unlocked. If you want to control when the session data is locked and unlocked, set ``tools.sessions.locking = 'explicit'``. Then call ``cherrypy.session.acquire_lock()`` and ``cherrypy.session.release_lock()``. Regardless of which mode you use, the session is guaranteed to be unlocked when the request is complete. ================= Expiring Sessions ================= You can force a session to expire with :func:`cherrypy.lib.sessions.expire`. Simply call that function at the point you want the session to expire, and it will cause the session cookie to expire client-side. =========================== Session Fixation Protection =========================== If CherryPy receives, via a request cookie, a session id that it does not recognize, it will reject that id and create a new one to return in the response cookie. This `helps prevent session fixation attacks `_. However, CherryPy "recognizes" a session id by looking up the saved session data for that id. Therefore, if you never save any session data, **you will get a new session id for every request**. ================ Sharing Sessions ================ If you run multiple instances of CherryPy (for example via mod_python behind Apache prefork), you most likely cannot use the RAM session backend, since each instance of CherryPy will have its own memory space. Use a different backend instead, and verify that all instances are pointing at the same file or db location. Alternately, you might try a load balancer which makes sessions "sticky". Google is your friend, there. ================ Expiration Dates ================ The response cookie will possess an expiration date to inform the client at which point to stop sending the cookie back in requests. If the server time and client time differ, expect sessions to be unreliable. **Make sure the system time of your server is accurate**. CherryPy defaults to a 60-minute session timeout, which also applies to the cookie which is sent to the client. Unfortunately, some versions of Safari ("4 public beta" on Windows XP at least) appear to have a bug in their parsing of the GMT expiration date--they appear to interpret the date as one hour in the past. Sixty minutes minus one hour is pretty close to zero, so you may experience this bug as a new session id for every request, unless the requests are less than one second apart. To fix, try increasing the session.timeout. On the other extreme, some users report Firefox sending cookies after their expiration date, although this was on a system with an inaccurate system time. Maybe FF doesn't trust system time. iÿÿÿÿN(t copyitemstpickletrandom20t unicodestr(thttputil(tlockfile(tlocking(t is_iteratortSessioncBs[eZdZdZdZd„Zd„ZeeeddƒZ dZ e Z e Z dZdZdZe Ze Ze Zdd„Zd„Zd „Zd „Zd „Zd „Zd „Zd„Zd„Zd„Zd„Zd„Zed„Z d„Z!e"idƒrd„Z#ndd„Z$d„Z%dd„Z&d„Z'd„Z(d„Z)d„Z*RS(s6A CherryPy dict-like Session object (one per request).cCs|jS(N(t_id(tself((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyt_get_idvscCs+||_x|jD]}||ƒqWdS(N(R t id_observers(R tvalueto((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyt_set_idys tdocsThe current session ID.i<icKsþg|_i|_x*|jƒD]\}}t|||ƒqW||_t|_|dkr†|jryt j ddƒn|j ƒnt||_ |j ƒr¾|jrút j d|dƒqún<|jrÞt j d|dƒnd|_ t|_|j ƒdS(NsNo id given; making a new onesTOOLS.SESSIONSs Set id to %s.s1Expired or malicious session %r; making a new one(R t_datatitemstsetattrt originalidtFalsetmissingtNonetdebugtcherrypytlogt _regeneratetidt_existstTrue(R Rtkwargstktv((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyt__init__¢s(              cCs tjjƒS(s³Generate the session specific concept of 'now'. Other session providers can override this to use alternative, possibly timezone aware, versions of 'now'. (tdatetimetnow(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR$¾scCst|_|jƒdS(s,Replace the current session (with a new id).N(Rt regeneratedR(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyt regenerateÆs cCs|jdk r?|jr2tjd|jdƒn|jƒn|j}|rw|jƒ|jrwtjddƒqwnd|_x:|jdkr¼|jƒ|_|j ƒrƒd|_qƒqƒW|jràtjd|jdƒn|r|j ƒ|jrtjddƒqndS(Ns5Deleting the existing session %r before regeneration.sTOOLS.SESSIONSsOld lock released.sSet id to generated %s.sRegenerated lock acquired.( RRRRRtdeletetlockedt release_lockt generate_idRt acquire_lock(R told_session_was_locked((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRËs0            cCsdS(sClean up expired sessions.N((R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pytclean_upéscCstƒS(sReturn a new session id.(R(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR*íscCsÌz’|jrntjd|jdƒ}|jƒ|}|jr^tjd|j|fdƒn|j |ƒn#|jr‘tjd|jdƒnWd|j rÇ|j ƒ|jrÇtjddƒqÇnXdS(sSave session data.tsecondsi<s Saving session %r with expiry %ssTOOLS.SESSIONSs0Skipping save of session %r (no session loaded).NsLock released after save.( tloadedR#t timedeltattimeoutR$RRRRt_saveR(R)(R tttexpiration_time((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pytsaveñs"         cCs |jƒ}|d ks.|d|jƒkr]|jrQtjd|jdƒni|_n0|jr€tjd|jdƒn|d|_t|_ |j }|j r|j rtj jjtj|j|j dddƒ}|jƒ||_ |jƒ|jrtjd dƒqnd S( s4Copy stored session data into this session instance.is"Expired session %r, flushing data.sTOOLS.SESSIONSsData loaded for session %r.ii<tnamesSession cleanupsStarted cleanup thread.N(t_loadRR$RRRRRRR/t __class__t clean_freqt clean_threadtprocesstpluginstMonitortengineR-t subscribetstart(R tdatatclsR3((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pytload s* "              cCs1|jƒ|jr-tjd|jdƒndS(sDelete stored session data.sDeleted session %s.sTOOLS.SESSIONSN(t_deleteRRRR(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR')s  cCs!|js|jƒn|j|S(N(R/RCR(R tkey((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyt __getitem__2s  cCs'|js|jƒn||j| True if D has a key k, else False.(R/RCR(R RE((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRLSs  cCs)|js|jƒn|jj||ƒS(s<D.get(k[,d]) -> D[k] if k in D, else d. d defaults to None.(R/RCRtget(R RERJ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRMYs  cCs*|js|jƒn|jj|ƒdS(s?D.update(E) -> None. Update D from E: for k in E: D[k] = E[k].N(R/RCRtupdate(R td((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRN_s  cCs)|js|jƒn|jj||ƒS(sAD.setdefault(k[,d]) -> D.get(k,d), also set D[k]=d if k not in D.(R/RCRt setdefault(R RERJ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRPes  cCs'|js|jƒn|jjƒdS(s,D.clear() -> None. Remove all items from D.N(R/RCRtclear(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRQks  cCs#|js|jƒn|jjƒS(sD.keys() -> list of D's keys.(R/RCRtkeys(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRRqs  cCs#|js|jƒn|jjƒS(s9D.items() -> list of D's (key, value) pairs, as 2-tuples.(R/RCRR(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRws  cCs#|js|jƒn|jjƒS(s!D.values() -> list of D's values.(R/RCRtvalues(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRS}s  N(+t__name__t __module__t__doc__RR R R RtpropertyRR1RR(R/R:R9RRR%RR"R$R&RR-R*R5RCR'RFRGRHRIRKthasattrRLRMRNRPRQRRRRS(((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRmsL                     t RamSessioncBs\eZiZiZd„Zd„Zd„Zd„Zd„Zd„Z d„Z d„Z RS(cCs|jƒ}x¤t|jƒD]“\}\}}||kry|j|=Wntk r[nXy<|j|jdtƒr—|jj|ƒ}|jƒnWq¯tk r«q¯XqqWx^t |jƒD]M}||jkrÃ|j|jdtƒrÃ|jj|ƒ}|jƒqÃqÃWdS(sClean up expired sessions.tblockingN( R$RtcachetKeyErrortlockstacquireRRItreleasetlist(R R$R RAR4tlock((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR-Šs" "    (cCs|j|jkS(N(RR[(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR¡scCs|jj|jƒS(N(R[RMR(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR7¤scCs|j|f|j|jtjddƒndS(s?Acquire an exclusive lock on the currently-loaded session data.s-select id from session where id=%s for updatesLock acquired.sTOOLS.SESSIONSN(RR(R˜RœRRRR(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR+“s     cCs|jjƒt|_dS(s6Release the lock on the currently-loaded session data.N(R˜R|RR((R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR)œs cCs |jjd|jƒfƒdS(sClean up expired sessions.s.delete from session where expiration_time < %sN(R˜RœR$(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR-£s N(RTRURVRR”R„RR"RqR•R›RR7R2RDR+R)R-(((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR–Rs         tMemcachedSessioncBsžeZejƒZiZdgZd„ZeeƒZd„Z d„Z e e e ddƒZ d„Z d„Zd„Zd „Zd „Zd „Zd „ZRS( s127.0.0.1:11211cKsRx*|jƒD]\}}t|||ƒq Wddl}|j|jƒ|_dS(sÔSet up the storage system for memcached-based sessions. This should only be called once per process; this will be done automatically when using sessions.init (as the built-in Tool does). iÿÿÿÿN(RRtmemcachetClienttserversR[(RBRR R!R¤((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRq´s cCs|jS(N(R (R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR ÁscCsLt|tƒr!|jdƒ}n||_x|jD]}||ƒq4WdS(Nsutf-8(RlRtencodeR R (R R R((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRÄs  RsThe current session ID.cCs?|jjƒzt|jj|jƒƒSWd|jjƒXdS(N(tmc_lockR^RžR[RMRR_(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRÏs cCs9|jjƒz|jj|jƒSWd|jjƒXdS(N(R¨R^R[RMRR_(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR7Ös cCs{ttj|jƒƒƒ}|jjƒz>|jj|j|j |f|ƒset d|jƒ‚nWd|jj ƒXdS(NsSession data for id %r not set.( RmRŒtmktimet timetupleR¨R^R[tsetRRRzR_(R R4ttd((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR2Ýs $cCs|jj|jƒdS(N(R[R'R(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRDèscCsKt|_|jj|jtjƒƒjƒ|jrGt j ddƒndS(s?Acquire an exclusive lock on the currently-loaded session data.sLock acquired.sTOOLS.SESSIONSN( RR(R]RPRRbRcR^RRR(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR+ës " cCs!|j|jjƒt|_dS(s6Release the lock on the currently-loaded session data.N(R]RR_RR((R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR)òscCs t‚dS(s%Return the number of active sessions.N(tNotImplementedError(R ((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyRe÷s(RTRURbRcR¨R]R¦RqR•R RRWRRR7R2RDR+R)Re(((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR£©s          cCsœttjdƒsdStjj}tjj}t|dƒrAdSt|_|jro|jj dtj j ƒn)t |j ƒr‹|jƒntj j ƒdS(sSave any changed session data.tsessionNt _sessionsavedton_end_request(RXRtservingtrequesttresponseRR¯tstreamthookstattachR®R5Rtbodyt collapse_body(R²R³((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR5þs     cCsTttjddƒ}t|dtƒrP|jƒ|jrPtjddƒqPndS(s*Close the session object for this request.R®R(sLock released on close.sTOOLS.SESSIONSN(tgetattrRR±RRR)RR(tsess((s|/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/sessions.pyR|s   iZtramt session_idi<ic  s~tjj} t| dƒrdSt| _d} ˆ| jkrm| jˆj} | rmtj d| dƒqmn|j ƒd}t ƒ|}ttdƒs»t|dƒr»|j | q»n|| d<|| d <|| | tj_ }| |_‡fd †}|jj|ƒttdƒs4tjdƒt_ n|rC|}nd}td |d |d ˆd|d|d|d| ƒdS(s3Initialize session object (using cookies). storage_type One of 'ram', 'file', 'postgresql', 'memcached'. This will be used to look up the corresponding class in cherrypy.lib.sessions globals. For example, 'file' will use the FileSession class. path The 'path' value to stick in the response cookie metadata. path_header If 'path' is None (the default), then the response cookie 'path' will be pulled from request.headers[path_header]. name The name of the cookie. timeout The expiration timeout (in minutes) for the stored session data. If 'persistent' is True (the default), this is also the timeout for the cookie. domain The cookie domain. secure If False (the default) the cookie 'secure' value will not be set. If True, the cookie 'secure' value will be set (to 1). clean_freq (minutes) The poll rate for expired session cleanup. persistent If True (the default), the 'timeout' argument will be used to expire the cookie. If False, the cookie will not have an expiry, and the cookie will be a "session cookie" which expires when the browser is closed. httponly If False (the default) the cookie 'httponly' value will not be set. If True, the cookie 'httponly' value will be set (to 1). Any additional kwargs will be bound to the new Session instance, and may be specific to the storage type. See the subclass of Session you're using for more information. t_session_init_flagNs#ID obtained from request.cookie: %rsTOOLS.SESSIONSRR®RqR1R9cs|tjjjˆ[s<       " ÿ8–WU       b 9