Several changes which will hopefully fix the cookie re-authentication

problem.  Specifically,

WebAuthenticate(): Coding style changes.

MakeCookie(): Create the cookie value in such a way as to guarantee
that only the characters [0-9][a-f] are used.  This should eliminate
the need for the ugly quote-hack in CheckCookie(), and eliminate the
possibility that wacky characters like semicolon, comma, and space
(not to mention binary data) can confuse the browsers.  Specifically,
we marshal the tuple ourselves and hexlify the results, setting the
key to a string.  That way we avoid the Cookie module pickling the
data and creating a binary string.

Also, coerce both `issued' and `expires' to integers.  Use sha
module and hexdigest() instead of md5 and digest() to hash
password+now+expires.

CheckCookie(): Remove the crufty cookie data quote-hack.  Decode the
cookie value by unhexlifying and unmarshaling the string value
ourselves.  Use sha module hexdigest() instead of md5's digest().

0 files changed, 0 insertions, 0 deletions