CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-05-06 15:24:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Generate email confirmation secret from tagged_secret (#4480)

Browse Source
This commit is contained in:
Raphael Michel
2024-10-07 13:58:08 +02:00
committed by GitHub
parent 7a66aea2cb
commit 1334a570e4
5 changed files with 25 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/pretix/base/models/orders.py
View File

@@ -381,8 +381,23 @@ class Order(LockModel, LoggedModel):
self.event.cache.delete('complain_testmode_orders')
self.delete()
def email_confirm_hash(self):
return hashlib.sha256(settings.SECRET_KEY.encode() + self.secret.encode()).hexdigest()[:9]
def email_confirm_secret(self):
return self.tagged_secret("email_confirm", 9)
def check_email_confirm_secret(self, received_secret):
return (
hmac.compare_digest(
self.tagged_secret("email_confirm", 9),
received_secret[:9].lower()
) or any(
# TODO: remove this clause after a while (compatibility with old secrets currently in flight)
hmac.compare_digest(
hashlib.sha256(sk.encode() + self.secret.encode()).hexdigest()[:9],
received_secret
)
for sk in [settings.SECRET_KEY, *settings.SECRET_KEY_FALLBACKS]
)
)
def get_extended_status_display(self):
# Changes in this method should to be replicated in pretixcontrol/orders/fragment_order_status.html