273 lines
8.8 KiB
Python
273 lines
8.8 KiB
Python
|
####################
|
||
|
|
#
|
||
|
|
# file is replaced by SecretServices.py
|
||
|
|
#
|
||
|
|
1= # intentional python syntax error
|
||
|
|
#
|
||
|
|
####################
|
||
|
|
|
||
|
|
|
||
|
|
from Crypto.Cipher import AES
|
||
|
|
from Crypto.Hash import MD5
|
||
|
|
import base64
|
||
|
|
import os, time, re, sys
|
||
|
|
from Log import Log
|
||
|
|
from Config import *
|
||
|
|
import json
|
||
|
|
import pymysql as mdb
|
||
|
|
import datetime
|
||
|
|
import hashlib
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
#encryption stuff
|
||
|
|
SECRET='HSPh1O5vc6YY2Xt8jUxlTpd*DZsjMMAH'
|
||
|
|
BLOCK_SIZE = 32
|
||
|
|
PADDING='_'
|
||
|
|
# one-liner to sufficiently pad the text to be encrypted
|
||
|
|
pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * PADDING
|
||
|
|
# one-liners to encrypt/encode and decrypt/decode a string
|
||
|
|
# encrypt with AES, encode with base64
|
||
|
|
CIPHER = AES.new(SECRET)
|
||
|
|
EncodeAES = lambda s: str(base64.b64encode(CIPHER.encrypt(pad(s))).decode("utf-8"))
|
||
|
|
DecodeAES = lambda e: str(CIPHER.decrypt(base64.b64decode(e)).decode("utf-8")).rstrip(PADDING)
|
||
|
|
|
||
|
|
def md5(message):
|
||
|
|
hash = MD5.new()
|
||
|
|
hash.update(message.encode('utf-8'))
|
||
|
|
return hash.hexdigest()
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
class Flower():
|
||
|
|
|
||
|
|
def __init__(self, user, pwd):
|
||
|
|
self.database = 'Flowers'
|
||
|
|
self.table = user
|
||
|
|
self.username = user
|
||
|
|
self.password = md5(pwd)
|
||
|
|
|
||
|
|
|
||
|
|
def add(self, organization, myname, myid, secret):
|
||
|
|
''' POST a new flower
|
||
|
|
'''
|
||
|
|
if len(organization)>MINFIELDLEN and len(myid)>MINFIELDLEN and len(secret)>MINFIELDLEN:
|
||
|
|
sql = "INSERT INTO {} (organization ,myID ,myName ,mySecret, deleted) VALUES ('{}', '{}', '{}', '{}', 0)".format(self.table, organization, myid, myname, EncodeAES(secret))
|
||
|
|
result, data = self.do_db_commit(sql)
|
||
|
|
Log.debug(result)
|
||
|
|
if result==1:
|
||
|
|
return {'organization': organization, 'dateCreated': 'STORED', 'myID': myid, 'myName': myname,'mySecret': secret}
|
||
|
|
return {'organization': organization, 'dateCreated': 'FAILED', 'myID': myid, 'myName': myname,'mySecret': secret}
|
||
|
|
|
||
|
|
|
||
|
|
def all(self, isdeleted=0):
|
||
|
|
''' GET flowers list
|
||
|
|
'''
|
||
|
|
#sql = "SELECT organization, myID, myName, dateCreated FROM %s " % (self.table)
|
||
|
|
sql = """
|
||
|
|
select uniqueflowers.organization, uniqueflowers.myID, uniqueflowers.dateCreated from {0} as uniqueflowers
|
||
|
|
inner join (
|
||
|
|
select organization, max(dateCreated) as lastCreated from {0} group by organization order by dateCreated DESC) allflowers
|
||
|
|
on allflowers.organization=uniqueflowers.organization and lastCreated=uniqueflowers.dateCreated where uniqueflowers.deleted={1}
|
||
|
|
""".format(self.table, isdeleted)
|
||
|
|
result, data = self.do_db_allrows(sql)
|
||
|
|
#Log.debug(sql_result)
|
||
|
|
all_flowers=[]
|
||
|
|
if result==1:
|
||
|
|
for row in data:
|
||
|
|
all_flowers.append({'organization': str(row[0]), 'myID': str(row[1]), 'dateCreated': str(row[2])})
|
||
|
|
return all_flowers
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
def one(self, organization, datetimestamp ):
|
||
|
|
''' flower for user, org and datetime
|
||
|
|
'''
|
||
|
|
result = -1
|
||
|
|
secret = ':-('
|
||
|
|
sql = "SELECT mySecret, myID, myName FROM %s where organization='%s' and dateCreated='%s' order by dateCreated DESC limit 1" % (self.table, organization, datetimestamp)
|
||
|
|
result, data = self.do_db_1row(sql)
|
||
|
|
if result == 1:
|
||
|
|
secret = DecodeAES(data[0])
|
||
|
|
return {'organization': organization, 'dateCreated': datetimestamp, 'myID': data[1], 'myName': data[2],'mySecret': secret}
|
||
|
|
|
||
|
|
def deactivate(self, organization, datetimestamp ):
|
||
|
|
''' flower for user, org and datetime
|
||
|
|
'''
|
||
|
|
result = -1
|
||
|
|
secret = ':-('
|
||
|
|
sql = "update %s set deleted=1 where organization='%s' and dateCreated='%s' " % (self.table, organization, datetimestamp)
|
||
|
|
result, data = self.do_db_commit(sql)
|
||
|
|
if result == 1:
|
||
|
|
secret = '- DELETED -'
|
||
|
|
return {'organization': organization, 'dateCreated': datetimestamp, 'myID': '', 'myName': '','mySecret': secret}
|
||
|
|
|
||
|
|
def empty(self):
|
||
|
|
''' empty flower
|
||
|
|
'''
|
||
|
|
return {'organization': '', 'dateCreated': '', 'myID': '', 'myName': '','mySecret': ''}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
def numberOfEntries(self):
|
||
|
|
''' GET login info, check if its valid
|
||
|
|
'''
|
||
|
|
sql = "SELECT count(*) FROM {};".format(self.table)
|
||
|
|
result, data = self.do_db_1row(sql)
|
||
|
|
if result == 1:
|
||
|
|
return(data[0])
|
||
|
|
return -1
|
||
|
|
|
||
|
|
def do_db_commit(self, sql):
|
||
|
|
Log.debug('INSc: '+sql)
|
||
|
|
result = 0
|
||
|
|
data = ''
|
||
|
|
con = None
|
||
|
|
try:
|
||
|
|
con = mdb.connect(host='localhost', passwd=self.password, user=self.username, db=self.database);
|
||
|
|
cur = con.cursor()
|
||
|
|
cur.execute(sql)
|
||
|
|
con.commit()
|
||
|
|
cur.close()
|
||
|
|
result = 1
|
||
|
|
except mdb.Error as e:
|
||
|
|
m = "Error %d: %s" % (e.args[0],e.args[1])
|
||
|
|
data = {'message': m}
|
||
|
|
Log.debug(m)
|
||
|
|
result = -1
|
||
|
|
finally:
|
||
|
|
if con:
|
||
|
|
con.close()
|
||
|
|
return result, data
|
||
|
|
|
||
|
|
|
||
|
|
def do_db_1row(self, sql):
|
||
|
|
Log.debug('1row sql: '+sql)
|
||
|
|
result = 0
|
||
|
|
con = None
|
||
|
|
try:
|
||
|
|
con = mdb.connect(host='localhost', passwd=self.password, user=self.username, db=self.database);
|
||
|
|
cur = con.cursor()
|
||
|
|
cur.execute(sql)
|
||
|
|
data = cur.fetchone()
|
||
|
|
if data:
|
||
|
|
result = 1
|
||
|
|
except mdb.Error as e:
|
||
|
|
m = "Error %d: %s" % (e.args[0],e.args[1])
|
||
|
|
data = {'message': m}
|
||
|
|
Log.debug(m)
|
||
|
|
result = -1
|
||
|
|
finally:
|
||
|
|
if con:
|
||
|
|
con.close()
|
||
|
|
return result, data
|
||
|
|
|
||
|
|
def do_db_allrows(self, sql):
|
||
|
|
Log.debug('all rows sql: '+sql)
|
||
|
|
result = 0
|
||
|
|
con = None
|
||
|
|
try:
|
||
|
|
con = mdb.connect(host='localhost', passwd=self.password, user=self.username, db=self.database);
|
||
|
|
cur = con.cursor()
|
||
|
|
cur.execute(sql)
|
||
|
|
data = cur.fetchall()
|
||
|
|
if data:
|
||
|
|
result = 1
|
||
|
|
except mdb.Error as e:
|
||
|
|
m = "Error %d: %s" % (e.args[0],e.args[1])
|
||
|
|
data = {'message': m}
|
||
|
|
Log.debug(m)
|
||
|
|
result = -1
|
||
|
|
finally:
|
||
|
|
if con:
|
||
|
|
con.close()
|
||
|
|
return result, data
|
||
|
|
|
||
|
|
|
||
|
|
class SuperFlower(Flower):
|
||
|
|
|
||
|
|
def __init__(self, user, pwd):
|
||
|
|
self.database = 'Flowers'
|
||
|
|
self.table = user
|
||
|
|
self.table_hush = pwd
|
||
|
|
self.username = 'flower'
|
||
|
|
self.password = md5('flower')
|
||
|
|
|
||
|
|
def createNewTable(self):
|
||
|
|
# create new table and user
|
||
|
|
sql = """
|
||
|
|
CREATE TABLE `{0}` (
|
||
|
|
`organization` varchar(50) NOT NULL,
|
||
|
|
`myID` varchar(50) NOT NULL,
|
||
|
|
`myName` varchar(50) NOT NULL,
|
||
|
|
`mySecret` varchar(50) NOT NULL,
|
||
|
|
`dateCreated` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||
|
|
`deleted` int(11) DEFAULT '0',
|
||
|
|
PRIMARY KEY (`organization`,`dateCreated`)
|
||
|
|
) ENGINE=InnoDB DEFAULT CHARSET=latin1;""".format(self.table)
|
||
|
|
result, data = self.do_db_1row(sql)
|
||
|
|
if result < 0:
|
||
|
|
Log.info("SQL ERROR:")
|
||
|
|
Log.info(data)
|
||
|
|
return 0
|
||
|
|
|
||
|
|
sql = """create user {0}@localhost identified by '{1}';""".format(self.table, md5(self.table_hush))
|
||
|
|
result, data = self.do_db_1row(sql)
|
||
|
|
if result < 0:
|
||
|
|
Log.info("SQL ERROR:")
|
||
|
|
Log.info(data)
|
||
|
|
return 0
|
||
|
|
|
||
|
|
sql = """grant select,update,insert on Flowers.{0} to {0}@localhost;""".format(self.table)
|
||
|
|
result, data = self.do_db_1row(sql)
|
||
|
|
if result < 0:
|
||
|
|
Log.info("SQL ERROR:")
|
||
|
|
Log.info(data)
|
||
|
|
return 0
|
||
|
|
|
||
|
|
sql = """flush privileges;"""
|
||
|
|
result, data = self.do_db_1row(sql)
|
||
|
|
if result < 0:
|
||
|
|
Log.info("SQL ERROR:")
|
||
|
|
Log.info(data)
|
||
|
|
return 0
|
||
|
|
|
||
|
|
return 1
|
||
|
|
|
||
|
|
|
||
|
|
def re_hush(self, new_hush):
|
||
|
|
|
||
|
|
|
||
|
|
end_result = "Starting Rehush\n"
|
||
|
|
sql = """
|
||
|
|
select mySecret, organization, dateCreated from {0}""".format(self.table)
|
||
|
|
result, data = self.do_db_allrows(sql)
|
||
|
|
# Log.debug(sql_result)
|
||
|
|
if result == 1:
|
||
|
|
# convert all hushes
|
||
|
|
sql = ""
|
||
|
|
for row in data:
|
||
|
|
old_hush = DecodeAES(row[0])
|
||
|
|
sql += "update {} set mySecret='{}' where organization='{}' and dateCreated='{}';\n".format(self.table, md5(old_hush), row[1], row[2])
|
||
|
|
result, data = self.do_db_commit(sql)
|
||
|
|
if result == 1:
|
||
|
|
end_result = "Finished Rehush\n"
|
||
|
|
end_result = "Starting update user password\n"
|
||
|
|
# update the password of the user
|
||
|
|
sql = "SET PASSWORD FOR '{}'@'localhost' = PASSWORD(md5(secret));\n".format(self.table)
|
||
|
|
sql += "flush privileges;"
|
||
|
|
result, data = self.do_db_commit(sql)
|
||
|
|
if result == 1:
|
||
|
|
end_result = "Finished update user password\n"
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == '__main__':
|
||
|
|
print("this is a library, sorry dude")
|