beautify, hashed passwords and session ids

raincloud.py

@@ -1,7 +1,11 @@
 #!/usr/bin/env python
 
+import crypt
 import toml
+import uuid
 import werkzeug
+from datetime import datetime, timedelta
+from hmac import compare_digest as compare_hash
 from flask import (
     Flask,
     render_template,
@@ -16,14 +20,46 @@ from werkzeug.utils import secure_filename
 
 base_path = Path("public")
 cloud_name = "raincloud"
+sessions = []
+
+# mkpass = "$6$7lTWfEYgx.nZdM.C$jb2cQt30FzpnEibp2sN2juGL0sGT2Y9dGlVTQvqxBB579Yy5lfbt3tIHjKYnt/MIcff6I6AFp8Q5k1xjN9C8a0"
+# print(compare_hash(mkpass, crypt.crypt("test", mkpass)))
+# exit(1)
 
 
-class MincloudIOException(Exception):
+class RaincloudIOException(Exception):
     pass
 
 
+def clean_sessions():
+    global sessions
+    sessions = [s for s in sessions if s[0] > datetime.now() - timedelta(days=1)]
+
+
+def validate_session(directory, id_):
+    global sessions
+    valid_dates = [s[0] for s in sessions if s[1] == directory and s[2] == id_]
+    if len(valid_dates) > 0 and valid_dates[0] > datetime.now() - timedelta(days=1):
+        return True
+    return False
+
+
+def delete_session(id_):
+    global sessions
+    sessions = [s for s in sessions if s[2] != id_]
+
+
+def get_session_id():
+    global sessions
+    ids = [s[2] for s in sessions]
+    id_ = uuid.uuid4()
+    while id_ in ids:
+        id_ = uuid.uuid4()
+    return id_
+
+
 def get_config(directory):
-    """Load a 'mincloud.conf' file from given directory.
+    """Load a 'rc.toml' file from given directory.
 
     Parameters:
         directory - basepath of 'mincloud.conf'
@@ -37,8 +73,10 @@ def get_config(directory):
         config["directory"] = directory
 
         parsed_config = toml.load(path)
-        config["password"] = (
-            parsed_config["password"] if "password" in parsed_config else None
+        config["hashed_password"] = (
+            parsed_config["hashed_password"]
+            if "hashed_password" in parsed_config
+            else None
         )
         config["download"] = (
             parsed_config["download"] if "download" in parsed_config else False
@@ -49,7 +87,7 @@ def get_config(directory):
         return config
 
     else:
-        raise MincloudIOException("No raincloud directory")
+        raise RaincloudIOException("No raincloud directory")
 
 
 def get_files(directory):
@@ -68,16 +106,37 @@ app = Flask(__name__)
 @app.route("/<directory>", methods=["GET", "POST"])
 @app.route("/<directory>/<path:filename>", methods=["GET"])
 def directory(directory, filename=None):
-
+    global sessions
     try:
+
+        # Clean sessions
+        clean_sessions()
+
+        # Logout
+        if request.method == "POST" and "logout" in request.form:
+            delete_session(session[directory])
+            return redirect(url_for("directory", directory=directory))
+
         config = get_config(directory)
-        if config["password"]:
-            authenticated = True if directory in session and session[directory] == config["password"] else False
+        if config["hashed_password"]:
+            authenticated = (
+                True
+                if directory in session
+                and validate_session(directory, session[directory])
+                else False
+            )
 
             if not authenticated:
                 if request.method == "POST":
-                    if request.form["password"] == config["password"]:
-                        session[directory] = config["password"]
+                    if compare_hash(
+                        config["hashed_password"],
+                        crypt.crypt(
+                            request.form["password"], config["hashed_password"]
+                        ),
+                    ):
+                        id_ = get_session_id()
+                        session[directory] = id_
+                        sessions.append((datetime.now(), directory, id_))
                     return redirect(url_for("directory", directory=directory))
                 else:
                     return render_template(
@@ -112,7 +171,7 @@ def directory(directory, filename=None):
             else:
                 return "No upload allowed"
 
-    except MincloudIOException as e:
+    except RaincloudIOException as e:
         print(e)
         return "No 404 file"