Method put

web/pgadmin/utils/session.py:401–434

Store a managed session

(self, session)

        )

    def put(self, session):
        """Store a managed session"""
        current_time = time.time()
        if not session.hmac_digest:
            session.sign(self.secret)
        elif not session.force_write and session.last_write is not None and \
            (current_time - float(session.last_write)) < \
                self.disk_write_delay:
            return

        session.last_write = current_time
        session.force_write = False

        # Do not store the session if skip paths
        for sp in self.skip_paths:
            if request.path.startswith(sp):
                return

        fname = safe_join(self.path, session.sid)

        if fname is None:
            raise InternalServerError('Failed to update the session')

        plaintext = pickle.dumps(
            (session.randval, session.hmac_digest, dict(session)), -1
        )
        # Encrypt-then-MAC: Fernet wrap first, then HMAC over the
        # ciphertext. pickle.loads on a tampered or unauthenticated body
        # is therefore unreachable on the read path.
        body = _derive_session_fernet(self.secret).encrypt(plaintext)
        header = _compute_file_hmac(self.secret, body)
        with _open_session_file(fname) as f:
            f.write(header)
            f.write(body)


class ManagedSessionInterface(SessionInterface):