#################### # # file is replaced by SecretServices.py # 1= # intentional python syntax error # #################### from Crypto.Cipher import AES from Crypto.Hash import MD5 import base64 import os, time, re, sys from Log import Log from Config import * import json import pymysql as mdb import datetime import hashlib #encryption stuff SECRET='HSPh1O5vc6YY2Xt8jUxlTpd*DZsjMMAH' BLOCK_SIZE = 32 PADDING='_' # one-liner to sufficiently pad the text to be encrypted pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * PADDING # one-liners to encrypt/encode and decrypt/decode a string # encrypt with AES, encode with base64 CIPHER = AES.new(SECRET) EncodeAES = lambda s: str(base64.b64encode(CIPHER.encrypt(pad(s))).decode("utf-8")) DecodeAES = lambda e: str(CIPHER.decrypt(base64.b64decode(e)).decode("utf-8")).rstrip(PADDING) def md5(message): hash = MD5.new() hash.update(message.encode('utf-8')) return hash.hexdigest() class Flower(): def __init__(self, user, pwd): self.database = 'Flowers' self.table = user self.username = user self.password = md5(pwd) def add(self, organization, myname, myid, secret): ''' POST a new flower ''' if len(organization)>MINFIELDLEN and len(myid)>MINFIELDLEN and len(secret)>MINFIELDLEN: sql = "INSERT INTO {} (organization ,myID ,myName ,mySecret, deleted) VALUES ('{}', '{}', '{}', '{}', 0)".format(self.table, organization, myid, myname, EncodeAES(secret)) result, data = self.do_db_commit(sql) Log.debug(result) if result==1: return {'organization': organization, 'dateCreated': 'STORED', 'myID': myid, 'myName': myname,'mySecret': secret} return {'organization': organization, 'dateCreated': 'FAILED', 'myID': myid, 'myName': myname,'mySecret': secret} def all(self, isdeleted=0): ''' GET flowers list ''' #sql = "SELECT organization, myID, myName, dateCreated FROM %s " % (self.table) sql = """ select uniqueflowers.organization, uniqueflowers.myID, uniqueflowers.dateCreated from {0} as uniqueflowers inner join ( select organization, max(dateCreated) as lastCreated from {0} group by organization order by dateCreated DESC) allflowers on allflowers.organization=uniqueflowers.organization and lastCreated=uniqueflowers.dateCreated where uniqueflowers.deleted={1} """.format(self.table, isdeleted) result, data = self.do_db_allrows(sql) #Log.debug(sql_result) all_flowers=[] if result==1: for row in data: all_flowers.append({'organization': str(row[0]), 'myID': str(row[1]), 'dateCreated': str(row[2])}) return all_flowers def one(self, organization, datetimestamp ): ''' flower for user, org and datetime ''' result = -1 secret = ':-(' sql = "SELECT mySecret, myID, myName FROM %s where organization='%s' and dateCreated='%s' order by dateCreated DESC limit 1" % (self.table, organization, datetimestamp) result, data = self.do_db_1row(sql) if result == 1: secret = DecodeAES(data[0]) return {'organization': organization, 'dateCreated': datetimestamp, 'myID': data[1], 'myName': data[2],'mySecret': secret} def deactivate(self, organization, datetimestamp ): ''' flower for user, org and datetime ''' result = -1 secret = ':-(' sql = "update %s set deleted=1 where organization='%s' and dateCreated='%s' " % (self.table, organization, datetimestamp) result, data = self.do_db_commit(sql) if result == 1: secret = '- DELETED -' return {'organization': organization, 'dateCreated': datetimestamp, 'myID': '', 'myName': '','mySecret': secret} def empty(self): ''' empty flower ''' return {'organization': '', 'dateCreated': '', 'myID': '', 'myName': '','mySecret': ''} def numberOfEntries(self): ''' GET login info, check if its valid ''' sql = "SELECT count(*) FROM {};".format(self.table) result, data = self.do_db_1row(sql) if result == 1: return(data[0]) return -1 def do_db_commit(self, sql): Log.debug('INSc: '+sql) result = 0 data = '' con = None try: con = mdb.connect(host='localhost', passwd=self.password, user=self.username, db=self.database); cur = con.cursor() cur.execute(sql) con.commit() cur.close() result = 1 except mdb.Error as e: m = "Error %d: %s" % (e.args[0],e.args[1]) data = {'message': m} Log.debug(m) result = -1 finally: if con: con.close() return result, data def do_db_1row(self, sql): Log.debug('1row sql: '+sql) result = 0 con = None try: con = mdb.connect(host='localhost', passwd=self.password, user=self.username, db=self.database); cur = con.cursor() cur.execute(sql) data = cur.fetchone() if data: result = 1 except mdb.Error as e: m = "Error %d: %s" % (e.args[0],e.args[1]) data = {'message': m} Log.debug(m) result = -1 finally: if con: con.close() return result, data def do_db_allrows(self, sql): Log.debug('all rows sql: '+sql) result = 0 con = None try: con = mdb.connect(host='localhost', passwd=self.password, user=self.username, db=self.database); cur = con.cursor() cur.execute(sql) data = cur.fetchall() if data: result = 1 except mdb.Error as e: m = "Error %d: %s" % (e.args[0],e.args[1]) data = {'message': m} Log.debug(m) result = -1 finally: if con: con.close() return result, data class SuperFlower(Flower): def __init__(self, user, pwd): self.database = 'Flowers' self.table = user self.table_hush = pwd self.username = 'flower' self.password = md5('flower') def createNewTable(self): # create new table and user sql = """ CREATE TABLE `{0}` ( `organization` varchar(50) NOT NULL, `myID` varchar(50) NOT NULL, `myName` varchar(50) NOT NULL, `mySecret` varchar(50) NOT NULL, `dateCreated` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP, `deleted` int(11) DEFAULT '0', PRIMARY KEY (`organization`,`dateCreated`) ) ENGINE=InnoDB DEFAULT CHARSET=latin1;""".format(self.table) result, data = self.do_db_1row(sql) if result < 0: Log.info("SQL ERROR:") Log.info(data) return 0 sql = """create user {0}@localhost identified by '{1}';""".format(self.table, md5(self.table_hush)) result, data = self.do_db_1row(sql) if result < 0: Log.info("SQL ERROR:") Log.info(data) return 0 sql = """grant select,update,insert on Flowers.{0} to {0}@localhost;""".format(self.table) result, data = self.do_db_1row(sql) if result < 0: Log.info("SQL ERROR:") Log.info(data) return 0 sql = """flush privileges;""" result, data = self.do_db_1row(sql) if result < 0: Log.info("SQL ERROR:") Log.info(data) return 0 return 1 def re_hush(self, new_hush): end_result = "Starting Rehush\n" sql = """ select mySecret, organization, dateCreated from {0}""".format(self.table) result, data = self.do_db_allrows(sql) # Log.debug(sql_result) if result == 1: # convert all hushes sql = "" for row in data: old_hush = DecodeAES(row[0]) sql += "update {} set mySecret='{}' where organization='{}' and dateCreated='{}';\n".format(self.table, md5(old_hush), row[1], row[2]) result, data = self.do_db_commit(sql) if result == 1: end_result = "Finished Rehush\n" end_result = "Starting update user password\n" # update the password of the user sql = "SET PASSWORD FOR '{}'@'localhost' = PASSWORD(md5(secret));\n".format(self.table) sql += "flush privileges;" result, data = self.do_db_commit(sql) if result == 1: end_result = "Finished update user password\n" if __name__ == '__main__': print("this is a library, sorry dude")