This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch db/8607 in repository https://gitbox.apache.org/repos/asf/allura.git
commit f02a89b9d66d37817fc32055c28a894335727d83 Author: Dave Brondsema <[email protected]> AuthorDate: Fri May 15 18:36:31 2026 -0400 [#8607] replace random with secrets in some places --- Allura/allura/lib/helpers.py | 4 ++-- Allura/allura/lib/multifactor.py | 2 +- Allura/allura/lib/plugin.py | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Allura/allura/lib/helpers.py b/Allura/allura/lib/helpers.py index ecb6d063c..33d180790 100644 --- a/Allura/allura/lib/helpers.py +++ b/Allura/allura/lib/helpers.py @@ -30,7 +30,7 @@ import json import logging import string -import random +import secrets from collections.abc import Iterable from hashlib import sha1 from datetime import datetime, timedelta @@ -489,7 +489,7 @@ def cryptographic_nonce(length=40): def random_password(length=20, chars=string.ascii_uppercase + string.digits): - return ''.join(random.choice(chars) for x in range(length)) + return ''.join(secrets.choice(chars) for x in range(length)) def ago(start_time, show_date_after=7): diff --git a/Allura/allura/lib/multifactor.py b/Allura/allura/lib/multifactor.py index 1a46fe05f..5a7c4dedd 100644 --- a/Allura/allura/lib/multifactor.py +++ b/Allura/allura/lib/multifactor.py @@ -360,7 +360,7 @@ def get(cls): def generate_one_code(self): # for compatibility with Google PAM file, we only do digits length = asint(config.get('auth.multifactor.recovery_code.length', 8)) - return ''.join([random.choice(string.digits) for i in range(length)]) + return ''.join([secrets.choice(string.digits) for i in range(length)]) def regenerate_codes(self, user): ''' diff --git a/Allura/allura/lib/plugin.py b/Allura/allura/lib/plugin.py index 9ad183eec..cd8291ff8 100644 --- a/Allura/allura/lib/plugin.py +++ b/Allura/allura/lib/plugin.py @@ -28,7 +28,7 @@ from contextlib import contextmanager from urllib.parse import urlparse from io import BytesIO -from random import randint +import secrets from hashlib import sha256 from base64 import b64encode from datetime import datetime, timedelta @@ -601,7 +601,7 @@ def _encode_password_legacy_sha256(self, password: str, salt: str) -> str: from allura import model as M if salt is None: - salt = ''.join(chr(randint(1, 0x7f)) + salt = ''.join(secrets.choice(string.printable[:94]) for i in range(M.User.SALT_LEN)) hashpass = sha256((salt + password).encode('utf-8')).digest() return 'sha256' + salt + six.ensure_text(b64encode(hashpass))
