search

google-code-export / django-simple-captcha

Automatically exported from code.google.com/p/django-simple-captcha
MIT License
0 stars 0 forks source link

different user may get same challenge. #21

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 

if 2 or more users get the same challenge, the first user will remove it
from DB when clean() is invoked. so the second user will get an error when
clean() is invoked.

Original issue reported on code.google.com by zhanglia...@gmail.com on 23 Jan 2010 at 12:12

GoogleCodeExporter commented 9 years ago 
Do you have a testcase to reproduce this? Because as of 0.1.3 the hashkey is 
unique, so 
even if the two users have the same challenge, they will get a different DB 
object and 
tow distinct delete() calls.

Or am I missing something here?

Original comment by mbonetti on 23 Jan 2010 at 12:35

GoogleCodeExporter commented 9 years ago 
I ran the following code in python 2.5
>>> import hashlib
>>> str='abc'
>>> hashlib.new('sha', str).hexdigest()
'0164b8a914cd2a5e74c4f7ff082c4d97f1edf880'
>>> hashlib.new('sha', str).hexdigest()
'0164b8a914cd2a5e74c4f7ff082c4d97f1edf880'

the hash value is always the same. 

so i suppose, in CaptchaStore(models.Model), self.hashkey = hashlib.new('sha',
str(self.challenge) + str(self.response)).hexdigest() will produce same hashkey 
if 2
different user will get the same challenge.

Is my understanding right?

Original comment by zhanglia...@gmail.com on 23 Jan 2010 at 12:49

GoogleCodeExporter commented 9 years ago 
True, but as of v0.1.3 we introduce a random element when we compute the hash, 
see:

/trunk/captcha/models.py#22

There is another bug, though. Fixing and writing a testcase right now...

Original comment by mbonetti on 23 Jan 2010 at 1:04

GoogleCodeExporter commented 9 years ago 
oh man!
there it is in /trunk/captcha/models.py
but not in django-simple-captcha-0.1.3.zip!

pls close the defect and thank you for you instant response!
sorry for the inconvenience.

Original comment by zhanglia...@gmail.com on 23 Jan 2010 at 1:13

GoogleCodeExporter commented 9 years ago 
Uh? I just checked and it is in django-simple-captcha-0.1.3.zip

Anyway, the field constructor was reusing old CaptchaStore objects 
(get_or_create() 
instead of a plain create()) which makes your remark actually true :)

This is fixed as of 0.1.4, cheers.

Original comment by mbonetti on 23 Jan 2010 at 1:18