erebion/libervia-backend
Watch
1
0
Fork
You've already forked libervia-backend
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

core (memory): avoid session locking if profileAuthenticate is called twice quickly

Browse source
This commit is contained in:
Goffi 2020-01-27 19:52:49 +01:00
commit f496dfc640
1 changed files with 9 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

19
sat/memory/memory.py
View file

@ -389,8 +389,7 @@ class Memory(object):
@return (D): a deferred None in case of success, a failure otherwise.
@raise exceptions.PasswordError: the password does not match
"""
session_data = self.auth_sessions.profileGetUnique(profile)
if not password and session_data:
if not password and self.auth_sessions.profileGetUnique(profile):
# XXX: this allows any frontend to connect with the empty password as soon as
# the profile has been authenticated at least once before. It is OK as long as
# submitting a form with empty passwords is restricted to local frontends.
@ -404,10 +403,7 @@ class Memory(object):
"The provided profile password doesn't match."
)
)
if (
not session_data
): # avoid to create two profile sessions when password if specified
return self.newAuthSession(password, profile)
return self.newAuthSession(password, profile)
d = self.asyncGetParamA(
C.PROFILE_PASS_PATH[1], C.PROFILE_PASS_PATH[0], profile_key=profile
@ -418,6 +414,7 @@ class Memory(object):
def newAuthSession(self, key, profile):
"""Start a new session for the authenticated profile.
If there is already an existing session, no new one is created
The personal key is loaded encrypted from a PersistentDict before being decrypted.
@param key: the key to decrypt the personal key
@ -427,10 +424,12 @@ class Memory(object):
def gotPersonalKey(personal_key):
"""Create the session for this profile and store the personal key"""
self.auth_sessions.newSession(
{C.MEMORY_CRYPTO_KEY: personal_key}, profile=profile
)
log.debug("auth session created for profile %s" % profile)
session_data = self.auth_sessions.profileGetUnique(profile)
if not session_data:
self.auth_sessions.newSession(
{C.MEMORY_CRYPTO_KEY: personal_key}, profile=profile
)
log.debug("auth session created for profile %s" % profile)
d = PersistentDict(C.MEMORY_CRYPTO_NAMESPACE, profile).load()
d.addCallback(lambda data: BlockCipher.decrypt(key, data[C.MEMORY_CRYPTO_KEY]))