From d08554296fd821e71ae53a5eb88cc3f876128128 Mon Sep 17 00:00:00 2001 From: Stavros Korokithakis Date: Sat, 27 Aug 2016 14:33:30 +0300 Subject: [PATCH 1/3] Add proof-of-concept for encryption --- controllers/service.py | 4 +++- database.sql | 1 + models/service.py | 11 ++++++++++- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/controllers/service.py b/controllers/service.py index 096bc9a..7b0a31e 100644 --- a/controllers/service.py +++ b/controllers/service.py @@ -12,9 +12,10 @@ def service_create(): name = request.form.get('name', '').strip() icon = request.form.get('icon', '').strip() + encrypted = True if request.form.get('encrypted', '').strip().lower() not in ("0", "false") else False if not name: return jsonify(Error.ARGUMENT_MISSING('name')) - srv = Service(name, icon) + srv = Service(name, icon, encrypted=encrypted) db.session.add(srv) db.session.commit() return jsonify({"service": srv.as_dict(True)}) @@ -24,6 +25,7 @@ def service_create(): def service_info(): secret = request.form.get('secret', '') or request.args.get('secret', '') service_ = request.form.get('service', '') or request.args.get('service', '') + print service_ if service_: if not is_service(service_): diff --git a/database.sql b/database.sql index 2488c12..938e7e5 100644 --- a/database.sql +++ b/database.sql @@ -55,6 +55,7 @@ DROP TABLE IF EXISTS `service`; CREATE TABLE IF NOT EXISTS `pushjet_api`.`service` ( `id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT, `secret` VARCHAR(32) NOT NULL, + `encryption_key` VARCHAR(512) NOT NULL, `public` VARCHAR(40) NOT NULL, `name` VARCHAR(255) NOT NULL, `icon` TEXT NULL, diff --git a/models/service.py b/models/service.py index 64c3cc3..9ec0c68 100644 --- a/models/service.py +++ b/models/service.py @@ -10,13 +10,18 @@ class Service(db.Model): id = db.Column(INTEGER(unsigned=True), primary_key=True) secret = db.Column(db.VARCHAR(32), nullable=False) + encryption_key = db.Column(db.VARCHAR(512), nullable=False) public = db.Column(db.VARCHAR(40), nullable=False) name = db.Column(db.VARCHAR(255), nullable=False) icon = db.Column(db.TEXT, nullable=False, default='') timestamp_created = db.Column(db.TIMESTAMP, default=datetime.utcnow) - def __init__(self, name, icon=''): + def __init__(self, name, icon='', encrypted=False): self.secret = hashlib.sha1(urandom(100)).hexdigest()[:32] + if encrypted: + self.encryption_key = hashlib.sha1(urandom(100)).hexdigest()[:32] + else: + self.encryption_key = "" self.name = name self.icon = icon pub = list(hashlib.new('ripemd160', self.secret).hexdigest())[:40] @@ -51,7 +56,11 @@ def as_dict(self, secret=False): "name": self.name, "created": int(self.timestamp_created.strftime("%s")), "icon": self.icon, + "encrypted": True if self.encryption_key else False, } + if secret: data["secret"] = self.secret + data["encryption_key"] = self.encryption_key + return data From 7294d2addb1585383145fff3be8b647520953f3b Mon Sep 17 00:00:00 2001 From: Stavros Korokithakis Date: Sat, 27 Aug 2016 15:20:04 +0300 Subject: [PATCH 2/3] Remove redundancy and double negative --- controllers/service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/controllers/service.py b/controllers/service.py index 7b0a31e..e89437b 100644 --- a/controllers/service.py +++ b/controllers/service.py @@ -12,7 +12,7 @@ def service_create(): name = request.form.get('name', '').strip() icon = request.form.get('icon', '').strip() - encrypted = True if request.form.get('encrypted', '').strip().lower() not in ("0", "false") else False + encrypted = request.form.get('encrypted', '').strip().lower() in ("1", "true", "yes") if not name: return jsonify(Error.ARGUMENT_MISSING('name')) srv = Service(name, icon, encrypted=encrypted) From 78f56a73aabded5921ec501278c7431f5fd468e2 Mon Sep 17 00:00:00 2001 From: Stavros Korokithakis Date: Sat, 27 Aug 2016 15:21:41 +0300 Subject: [PATCH 3/3] Remove forgotten print statement. --- controllers/service.py | 1 - 1 file changed, 1 deletion(-) diff --git a/controllers/service.py b/controllers/service.py index e89437b..0823f40 100644 --- a/controllers/service.py +++ b/controllers/service.py @@ -25,7 +25,6 @@ def service_create(): def service_info(): secret = request.form.get('secret', '') or request.args.get('secret', '') service_ = request.form.get('service', '') or request.args.get('service', '') - print service_ if service_: if not is_service(service_):