From 21efdb4456c6f64d3b5cdc92167cc67378f7d473 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Fri, 18 Jul 2008 15:11:58 +0200 Subject: [PATCH] Improve security check from remarks of Hartmut Goebel --- trytond/security.py | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/trytond/security.py b/trytond/security.py index 76d247deb9..8b338805ad 100644 --- a/trytond/security.py +++ b/trytond/security.py @@ -39,20 +39,22 @@ def check_super(passwd): else: raise Exception('AccessDenied') -def check(dbname, user, session, reset_timeout=True): +def check(dbname, user, session, outdate_timeout=True): session = session.encode('utf-8') + result = False if _USER_CACHE.get(dbname, {}).has_key(user): to_del = [] - for i in range(len(_USER_CACHE[dbname][user])): - timestamp, real_session = _USER_CACHE[dbname][user][i] - if abs(timestamp - time.time()) < SESSION_TIMEOUT: - if real_session == session: - if reset_timeout: - _USER_CACHE[dbname][user][i] = (time.time(), real_session) - return True - else: - to_del.append(i) - to_del.reverse() + for i, (timestamp, real_session) \ + in enumerate(_USER_CACHE[dbname][user]): + if abs(timestamp - time.time()) < SESSION_TIMEOUT \ + and real_session == session: + if outdate_timeout: + _USER_CACHE[dbname][user][i] = (time.time(), real_session) + result = True + else: + to_del.insert(0, i) for i in to_del: - del USER_CACHE[dbname][user][i] + del _USER_CACHE[dbname][user][i] + if result: + return True raise Exception('NotLogged')