| # (c) 2005 Ian Bicking and contributors; written for Paste (http://pythonpaste.org) |
| # Licensed under the MIT license: http://www.opensource.org/licenses/mit-license.php |
| |
| """ |
| Creates a session object in your WSGI environment. |
| |
| Use like: |
| |
| ..code-block:: Python |
| |
| environ['paste.session.factory']() |
| |
| This will return a dictionary. The contents of this dictionary will |
| be saved to disk when the request is completed. The session will be |
| created when you first fetch the session dictionary, and a cookie will |
| be sent in that case. There's current no way to use sessions without |
| cookies, and there's no way to delete a session except to clear its |
| data. |
| |
| @@: This doesn't do any locking, and may cause problems when a single |
| session is accessed concurrently. Also, it loads and saves the |
| session for each request, with no caching. Also, sessions aren't |
| expired. |
| """ |
| |
| try: |
| # Python 3 |
| from http.cookies import SimpleCookie |
| except ImportError: |
| # Python 2 |
| from Cookie import SimpleCookie |
| import time |
| import random |
| import os |
| import datetime |
| import six |
| import threading |
| import tempfile |
| |
| try: |
| import cPickle |
| except ImportError: |
| import pickle as cPickle |
| try: |
| from hashlib import md5 |
| except ImportError: |
| from md5 import md5 |
| from paste import wsgilib |
| from paste import request |
| |
| class SessionMiddleware(object): |
| |
| def __init__(self, application, global_conf=None, **factory_kw): |
| self.application = application |
| self.factory_kw = factory_kw |
| |
| def __call__(self, environ, start_response): |
| session_factory = SessionFactory(environ, **self.factory_kw) |
| environ['paste.session.factory'] = session_factory |
| remember_headers = [] |
| |
| def session_start_response(status, headers, exc_info=None): |
| if not session_factory.created: |
| remember_headers[:] = [status, headers] |
| return start_response(status, headers) |
| headers.append(session_factory.set_cookie_header()) |
| return start_response(status, headers, exc_info) |
| |
| app_iter = self.application(environ, session_start_response) |
| def start(): |
| if session_factory.created and remember_headers: |
| # Tricky bastard used the session after start_response |
| status, headers = remember_headers |
| headers.append(session_factory.set_cookie_header()) |
| exc = ValueError( |
| "You cannot get the session after content from the " |
| "app_iter has been returned") |
| start_response(status, headers, (exc.__class__, exc, None)) |
| def close(): |
| if session_factory.used: |
| session_factory.close() |
| return wsgilib.add_start_close(app_iter, start, close) |
| |
| |
| class SessionFactory(object): |
| |
| |
| def __init__(self, environ, cookie_name='_SID_', |
| session_class=None, |
| session_expiration=60*12, # in minutes |
| **session_class_kw): |
| |
| self.created = False |
| self.used = False |
| self.environ = environ |
| self.cookie_name = cookie_name |
| self.session = None |
| self.session_class = session_class or FileSession |
| self.session_class_kw = session_class_kw |
| |
| self.expiration = session_expiration |
| |
| def __call__(self): |
| self.used = True |
| if self.session is not None: |
| return self.session.data() |
| cookies = request.get_cookies(self.environ) |
| session = None |
| if self.cookie_name in cookies: |
| self.sid = cookies[self.cookie_name].value |
| try: |
| session = self.session_class(self.sid, create=False, |
| **self.session_class_kw) |
| except KeyError: |
| # Invalid SID |
| pass |
| if session is None: |
| self.created = True |
| self.sid = self.make_sid() |
| session = self.session_class(self.sid, create=True, |
| **self.session_class_kw) |
| session.clean_up() |
| self.session = session |
| return session.data() |
| |
| def has_session(self): |
| if self.session is not None: |
| return True |
| cookies = request.get_cookies(self.environ) |
| if cookies.has_key(self.cookie_name): |
| return True |
| return False |
| |
| def make_sid(self): |
| # @@: need better algorithm |
| return (''.join(['%02d' % x for x in time.localtime(time.time())[:6]]) |
| + '-' + self.unique_id()) |
| |
| def unique_id(self, for_object=None): |
| """ |
| Generates an opaque, identifier string that is practically |
| guaranteed to be unique. If an object is passed, then its |
| id() is incorporated into the generation. Relies on md5 and |
| returns a 32 character long string. |
| """ |
| r = [time.time(), random.random()] |
| if hasattr(os, 'times'): |
| r.append(os.times()) |
| if for_object is not None: |
| r.append(id(for_object)) |
| content = str(r) |
| if six.PY3: |
| content = content.encode('utf8') |
| md5_hash = md5(content) |
| try: |
| return md5_hash.hexdigest() |
| except AttributeError: |
| # Older versions of Python didn't have hexdigest, so we'll |
| # do it manually |
| hexdigest = [] |
| for char in md5_hash.digest(): |
| hexdigest.append('%02x' % ord(char)) |
| return ''.join(hexdigest) |
| |
| def set_cookie_header(self): |
| c = SimpleCookie() |
| c[self.cookie_name] = self.sid |
| c[self.cookie_name]['path'] = '/' |
| |
| gmt_expiration_time = time.gmtime(time.time() + (self.expiration * 60)) |
| c[self.cookie_name]['expires'] = time.strftime("%a, %d-%b-%Y %H:%M:%S GMT", gmt_expiration_time) |
| |
| name, value = str(c).split(': ', 1) |
| return (name, value) |
| |
| def close(self): |
| if self.session is not None: |
| self.session.close() |
| |
| |
| last_cleanup = None |
| cleaning_up = False |
| cleanup_cycle = datetime.timedelta(seconds=15*60) #15 min |
| |
| class FileSession(object): |
| |
| def __init__(self, sid, create=False, session_file_path=tempfile.gettempdir(), |
| chmod=None, |
| expiration=2880, # in minutes: 48 hours |
| ): |
| if chmod and isinstance(chmod, (six.binary_type, six.text_type)): |
| chmod = int(chmod, 8) |
| self.chmod = chmod |
| if not sid: |
| # Invalid... |
| raise KeyError |
| self.session_file_path = session_file_path |
| self.sid = sid |
| if not create: |
| if not os.path.exists(self.filename()): |
| raise KeyError |
| self._data = None |
| |
| self.expiration = expiration |
| |
| |
| def filename(self): |
| return os.path.join(self.session_file_path, self.sid) |
| |
| def data(self): |
| if self._data is not None: |
| return self._data |
| if os.path.exists(self.filename()): |
| f = open(self.filename(), 'rb') |
| self._data = cPickle.load(f) |
| f.close() |
| else: |
| self._data = {} |
| return self._data |
| |
| def close(self): |
| if self._data is not None: |
| filename = self.filename() |
| exists = os.path.exists(filename) |
| if not self._data: |
| if exists: |
| os.unlink(filename) |
| else: |
| f = open(filename, 'wb') |
| cPickle.dump(self._data, f) |
| f.close() |
| if not exists and self.chmod: |
| os.chmod(filename, self.chmod) |
| |
| def _clean_up(self): |
| global cleaning_up |
| try: |
| exp_time = datetime.timedelta(seconds=self.expiration*60) |
| now = datetime.datetime.now() |
| |
| #Open every session and check that it isn't too old |
| for root, dirs, files in os.walk(self.session_file_path): |
| for f in files: |
| self._clean_up_file(f, exp_time=exp_time, now=now) |
| finally: |
| cleaning_up = False |
| |
| def _clean_up_file(self, f, exp_time, now): |
| t = f.split("-") |
| if len(t) != 2: |
| return |
| t = t[0] |
| try: |
| sess_time = datetime.datetime( |
| int(t[0:4]), |
| int(t[4:6]), |
| int(t[6:8]), |
| int(t[8:10]), |
| int(t[10:12]), |
| int(t[12:14])) |
| except ValueError: |
| # Probably not a session file at all |
| return |
| |
| if sess_time + exp_time < now: |
| os.remove(os.path.join(self.session_file_path, f)) |
| |
| def clean_up(self): |
| global last_cleanup, cleanup_cycle, cleaning_up |
| now = datetime.datetime.now() |
| |
| if cleaning_up: |
| return |
| |
| if not last_cleanup or last_cleanup + cleanup_cycle < now: |
| if not cleaning_up: |
| cleaning_up = True |
| try: |
| last_cleanup = now |
| t = threading.Thread(target=self._clean_up) |
| t.start() |
| except: |
| # Normally _clean_up should set cleaning_up |
| # to false, but if something goes wrong starting |
| # it... |
| cleaning_up = False |
| raise |
| |
| class _NoDefault(object): |
| def __repr__(self): |
| return '<dynamic default>' |
| NoDefault = _NoDefault() |
| |
| def make_session_middleware( |
| app, global_conf, |
| session_expiration=NoDefault, |
| expiration=NoDefault, |
| cookie_name=NoDefault, |
| session_file_path=NoDefault, |
| chmod=NoDefault): |
| """ |
| Adds a middleware that handles sessions for your applications. |
| The session is a peristent dictionary. To get this dictionary |
| in your application, use ``environ['paste.session.factory']()`` |
| which returns this persistent dictionary. |
| |
| Configuration: |
| |
| session_expiration: |
| The time each session lives, in minutes. This controls |
| the cookie expiration. Default 12 hours. |
| |
| expiration: |
| The time each session lives on disk. Old sessions are |
| culled from disk based on this. Default 48 hours. |
| |
| cookie_name: |
| The cookie name used to track the session. Use different |
| names to avoid session clashes. |
| |
| session_file_path: |
| Sessions are put in this location, default /tmp. |
| |
| chmod: |
| The octal chmod you want to apply to new sessions (e.g., 660 |
| to make the sessions group readable/writable) |
| |
| Each of these also takes from the global configuration. cookie_name |
| and chmod take from session_cookie_name and session_chmod |
| """ |
| if session_expiration is NoDefault: |
| session_expiration = global_conf.get('session_expiration', 60*12) |
| session_expiration = int(session_expiration) |
| if expiration is NoDefault: |
| expiration = global_conf.get('expiration', 60*48) |
| expiration = int(expiration) |
| if cookie_name is NoDefault: |
| cookie_name = global_conf.get('session_cookie_name', '_SID_') |
| if session_file_path is NoDefault: |
| session_file_path = global_conf.get('session_file_path', '/tmp') |
| if chmod is NoDefault: |
| chmod = global_conf.get('session_chmod', None) |
| return SessionMiddleware( |
| app, session_expiration=session_expiration, |
| expiration=expiration, cookie_name=cookie_name, |
| session_file_path=session_file_path, chmod=chmod) |
