1 files changed, 10 insertions, 12 deletions

diff --git a/backend/python/src/clipperz.py b/backend/python/src/clipperz.py
index bd5d030..5476b4b 100644
--- a/backend/python/src/clipperz.py
+++ b/backend/python/src/clipperz.py
@@ -1,405 +1,403 @@
 #
-        #Copyright 2008-2011 Clipperz Srl
+        #Copyright 2008-2013 Clipperz Srl
         #
-        #This file is part of Clipperz Community Edition.
-        #Clipperz Community Edition is an online password manager.
+        #This file is part of Clipperz, the online password manager.
         #For further information about its features and functionalities please
         #refer to http://www.clipperz.com.
         #
-        #* Clipperz Community Edition is free software: you can redistribute
-        #  it and/or modify it under the terms of the GNU Affero General Public
-        #  License as published by the Free Software Foundation, either version
-        #  3 of the License, or (at your option) any later version.
+        #* Clipperz is free software: you can redistribute it and/or modify it 
+#     under the terms of the GNU Affero General Public License as published
+#     by the Free Software Foundation, either version 3 of the License, or 
+#     (at your option) any later version.
         #
-        #* Clipperz Community Edition is distributed in the hope that it will
-        #  be useful, but WITHOUT ANY WARRANTY; without even the implied
-        #  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+        #* Clipperz is distributed in the hope that it will be useful, but 
+#     WITHOUT ANY WARRANTY; without even the implied warranty of 
+#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
         #  See the GNU Affero General Public License for more details.
         #
         #* You should have received a copy of the GNU Affero General Public
-        #  License along with Clipperz Community Edition.  If not, see
-        #  <http://www.gnu.org/licenses/>.
+        #  License along with Clipperz. If not, see http://www.gnu.org/licenses/.
 #
 
 import os
 import cgi
 import wsgiref.handlers
 
 import datetime
 import uuid
 import random
 import hashlib
 
 import logging
 
 from google.appengine.api import users
 from google.appengine.ext import webapp
 from google.appengine.ext import db
 from google.appengine.ext.webapp import template
 
 from django.utils import simplejson
 
 #==============================================================================
 
 sessionTimeout = datetime.timedelta(minutes=-2)
 
 def randomSeed():
         return hex(random.getrandbits(32*8))[2:-1]
 
 def clipperzHash(aString):
         #logging.info(">>> string: " + aString)
         firstRound = hashlib.sha256()
         firstRound.update(aString)
         #logging.info("firstRound: " + firstRound.hexdigest() + " - " + firstRound.digest())
         result = hashlib.sha256()
         result.update(firstRound.digest())
         #logging.info("<<< finalResul: " + result.hexdigest())
 
         return result.hexdigest()
         
 #==============================================================================
 
 class User(db.Model):
                 username= db.StringProperty()
                 srp_s   = db.StringProperty()
                 srp_v   = db.StringProperty()
                 header  = db.TextProperty()
                 statistics= db.TextProperty()
         auth_version= db.StringProperty()
                 version         = db.StringProperty()
                 lock    = db.StringProperty()
         
         def updateCredentials(self, someCredentials):
                         self.username   = someCredentials['C']
                         self.srp_s              = someCredentials['s']
                         self.srp_v              = someCredentials['v']
                         self.auth_version= someCredentials['version']
 
         def update(self, someData):
                         self.header     = someData['header']
                         self.statistics= someData['statistics']
                         self.version= someData['version']
                         self.lock       = someData['lock']
 
 #------------------------------------------------------------------------------
 
 class Record(db.Model):
                 user            = db.ReferenceProperty(User)
                 reference       = db.StringProperty()
                 data            = db.TextProperty()
                 version                 = db.StringProperty()
                 creation_date= db.DateTimeProperty(auto_now_add=True)
                 update_date     = db.DateTimeProperty(auto_now_add=True)
                 access_date     = db.DateTimeProperty(auto_now_add=True)
 
 #------------------------------------------------------------------------------
 
 class RecordVersion(db.Model):
                 record                  = db.ReferenceProperty(Record)
                 reference               = db.StringProperty()
                 header                  = db.TextProperty()
                 data                    = db.TextProperty()
                 version                         = db.StringProperty()
                 previousVersionKey= db.StringProperty()
                 previousVersion         = db.SelfReferenceProperty()
                 creation_date   = db.DateTimeProperty(auto_now_add=True)
                 update_date             = db.DateTimeProperty(auto_now_add=True)
                 access_date             = db.DateTimeProperty(auto_now_add=True)
 
         def update(self, someData):
                 recordData = someData['record'];
                         self.parent().reference =recordData['reference']
                         self.parent().data =    recordData['data']
                         self.parent().version =         recordData['version']
                         self.parent().update_date =datetime.datetime.now()
 
                 recordVersionData = someData['currentRecordVersion'];
                         self.reference =                recordVersionData ['reference']
                         self.data =                             recordVersionData ['data']
                         self.version =                  recordVersionData ['version']
                         #self.previous_version  =#recordVersionData ['previousVersion']
                         self.previous_version_key =recordVersionData ['previousVersionKey']
                         self.update_date =              datetime.datetime.now()
 
 #------------------------------------------------------------------------------
 
 class OneTimePassword(db.Model):
                 user            = db.ReferenceProperty(User)
                 status          = db.StringProperty()
                 reference       = db.StringProperty()
                 keyValue        = db.StringProperty()
                 keyChecksum     = db.StringProperty()
                 data            = db.TextProperty()
                 version                 = db.StringProperty()
                 creation_date= db.DateTimeProperty(auto_now_add=True)
                 request_date= db.DateTimeProperty()
                 usage_date      = db.DateTimeProperty()
 
         def update(self, someParameters, aStatus):
                         self.reference =        someParameters['reference']
                         self.keyValue =                 someParameters['key']
                         self.keyChecksum =      someParameters['keyChecksum']
                         self.data =                     someParameters['data']
                         self.version =          someParameters['version']
                         self.status =           aStatus
 
         def reset(self, aStatus):
                         self.data =     ""
                         self.status =aStatus
 
                 return self
 
 #------------------------------------------------------------------------------
 
 class Session(db.Expando):
                 sessionId= db.StringProperty()
                 access_date= db.DateTimeProperty()
 
 #==============================================================================
 
 class MainPage(webapp.RequestHandler):
         def get(self):
                 path = os.path.join(os.path.dirname(__file__), 'static%s' % self.request.path)
                 self.response.out.write(template.render(path, {}))
 
 #==============================================================================
 
 class XHR(webapp.RequestHandler):
 
         #==========================================================================
 
         def get(self):
                 logging.info("self.request.path: " + self.request.path)
                 if self.request.path == "/dump":
                         session = self.getSession()
                         userData = {}
                         offline_data_placeholder = ""
                 
                         user = db.Query(User).filter('username =', session.C).get()
                 
                         userData['users'] = {
                                 'catchAllUser': {
                                         '__masterkey_test_value__': 'masterkey',
                                         's': '112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00',
                                         'v': '112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00'
                                 }
                         }
 
                         records = {}
                         for currentRecord in db.Query(Record).ancestor(user):
                                 versions = {}
                                 for currentVersion in db.Query(RecordVersion).ancestor(currentRecord):
                                         versions[currentVersion.reference] ={
                                                         'header':       currentVersion.header,
                                                         'data':                 currentVersion.data,
                                                         'version':      currentVersion.version,
                                                         'creationDate':str(currentVersion.creation_date),
                                                         'updateDate':str(currentVersion.update_date),
                                                         'accessDate':str(currentVersion.access_date)
                                         }
 
                                 records[currentRecord.reference] = {
                                                 'data':                         currentRecord.data,
                                                 'version':              currentRecord.version,
                                                 'creationDate':         str(currentRecord.creation_date),
                                                 'updateDate':   str(currentRecord.update_date),
                                                 'accessDate':   str(currentRecord.access_date),
                                                 'currentVersion':currentVersion.reference,
                                                 'versions':             versions
                                 }
 
                         userData['users'][user.username] = {
                                         's':                            user.srp_s,
                                         'v':                            user.srp_v,
                                         'version':                      user.auth_version,
                                         'maxNumberOfRecords':'100',
                                         'userDetails':          user.header,
                                         'statistics':           user.statistics,
                                         'userDetailsVersion':user.version,
                                         'records':                      records
                         }
 
                         offline_data_placeholder = offline_data_placeholder + "_clipperz_dump_data_ = " + simplejson.dumps(userData, indent=4) + "\n"
                         offline_data_placeholder = offline_data_placeholder + "Clipperz.PM.Proxy.defaultProxy = new Clipperz.PM.Proxy.Offline();" + "\n"
                         offline_data_placeholder = offline_data_placeholder + "Clipperz.Crypto.PRNG.defaultRandomGenerator().fastEntropyAccumulationForTestingPurpose();" + "\n"
 
                         path = os.path.join(os.path.dirname(__file__), 'static/dump.html')
 
                         self.response.headers.add_header('Content-Type', 'text/html')
                         self.response.headers.add_header('Content-Disposition', 'attachment', filename='Clipperz.html')
                         self.response.out.write(template.render(path, {'offline_data_placeholder': offline_data_placeholder}))
 
         #==========================================================================
 
         def post(self):
                 method = self.request.get('method')
                 parameters = simplejson.loads(self.request.get('parameters'))
                 session = self.getSession()
                 result = {};
 
                 #----------------------------------------------------------------------
 
                 if method == 'registration':
                         message = parameters['message'];
                         
                         if message == 'completeRegistration':
                                 user = User()
                         
                                 user.updateCredentials(parameters['credentials'])
                                 user.update(parameters['user'])
                                 user.put()
 
                                 result['lock'] = user.lock
                                 result['result'] = "done"
 
                 #----------------------------------------------------------------------
 
                 elif method == 'handshake':
                         srp_g = 2L
                         srp_n = long("0x%s" % "115b8b692e0e045692cf280b436735c77a5a9e8a9e7ed56c965f87db5b2a2ece3", 16)
 
                         message = parameters['message'];
 
                         #------------------------------------------------------------------
 
                         if message == 'connect':
                                 session.C = parameters['parameters']['C']
                                 session.A = parameters['parameters']['A']
 
                                 user = db.Query(User).filter('username =', session.C).get()
 
                                 if user != None:
                                         try:
                                                 optId = session.otpId
 
                                                 oneTimePassword = db.Query(OneTimePassword).filter('keyValue =', optId).get()
                                                 
                                                 if oneTimePassword.parent().username != user.username:
                                                         oneTimePassword.reset('DISABLED').put()
                                                         raise Exception, "User missmatch between the current session and 'One Time Password' user"
                                                 elif oneTimePassword.status != 'REQUESTED':
                                                         oneTimePassword.reset('DISABLED').put()
                                                         raise Exception, "Tring to use an 'One Time Password' in the wrong state"
 
                                                 oneTimePassword.reset("USED").put()
 
                                                 result['oneTimePassword'] = oneTimePassword.reference
 
                                         except Exception, detail:
                                                 logging.error("connect.optId: " + str(detail))
 
                                         session.s = user.srp_s
                                         session.v = user.srp_v
                                 else:
                                         session.s = "112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00"
                                         session.v = "112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00"
 
                                 session.b = randomSeed()
                                 session.B = hex(long("0x%s" % session.v, 16) + pow(srp_g, long("0x%s" %session.b, 16), srp_n))[2:-1]
 
                                 result['s'] = session.s
                                 result['B'] = session.B
 
                         #------------------------------------------------------------------
 
                         elif message == 'credentialCheck':
                                 B = long("0x%s" % session.B, 16)
                                 b = long("0x%s" % session.b, 16)
                                 A = long("0x%s" % session.A, 16)
                                 v = long("0x%s" % session.v, 16)
                                 u = long("0x%s" % clipperzHash(str(B)), 16)
                                 n = srp_n
 
                                 S  = pow((A * pow(v, u, n)), b, n)
                                 K  = clipperzHash(str(S))
                                 M1 = clipperzHash(str(A) + str(B) + K)
 
                                 if M1 == parameters['parameters']['M1']:
                                         session.K = K
                                         M2 = clipperzHash(str(A) + M1 + K)
 
                                         result['M2'] = M2
                                         result["connectionId"] = ""
                                         result["loginInfo"] = {}
                                         result["loginInfo"]["latest"] = {}
                                         result["loginInfo"]["current"] = {}
                                         result["offlineCopyNeeded"] = "false";
                                         result["lock"] = "----";
                                 else:
                                         result['error'] = "?"
 
                         #------------------------------------------------------------------
 
                         elif message == 'oneTimePassword':
                                 oneTimePassword = db.Query(OneTimePassword).filter("keyValue =", parameters["parameters"]["oneTimePasswordKey"]).get()
 
                                 if oneTimePassword != None:
                                         if oneTimePassword.status == 'ACTIVE':
                                                 if oneTimePassword.keyChecksum == parameters['parameters']['oneTimePasswordKeyChecksum']:
                                                                 #session.userId =str(oneTimePassword.parent().username)
                                                                 session.otpId =         str(oneTimePassword.keyValue)
                                                         
                                                         result['data'] = oneTimePassword.data
                                                         result['version'] = oneTimePassword.version
 
                                                         oneTimePassword.reset('REQUESTED').put()
 
                                                 else:
                                                         oneTimePassword.reset('DISABLED').put()
                                                         raise Exception, "The requested One Time Password has been disabled, due to a wrong keyChecksum"
                                         else:
                                                 raise Exception, "The requested One Time Password was not active"
                                 else:
                                         raise Exception, "The requested One Time Password has not been found"
 
                 #----------------------------------------------------------------------
 
                 elif method == 'message':
                         if parameters['srpSharedSecret'] == session.K:
                                 message = parameters['message']
 
                                 if message == 'getUserDetails':
                                                 #{"message":"getUserDetails", "srpSharedSecret":"f18e5cf7c3a83b67d4db9444af813ee48c13daf4f8f6635397d593e52ba89a08", "parameters":{}}
                                         user = db.Query(User).filter('username =', session.C).get()
                                         
                                                 result['header'] =      user.header;
                                                 result['statistics'] =user.statistics;
                                                 result['version'] =     user.version;
 
                                         elif message == "addNewRecords":
                                         user = db.Query(User).filter('username =', session.C).get()
                                         result = db.run_in_transaction(self.addNewRecords, session, user, parameters)
 
                                         """
                                         user = db.Query(User).filter('username =', session.C).get()
                                         user.update(parameters['parameters']['user'])
                                         
                                         for recordParameter in parameters['parameters']['records']:
                                                 record = Record(parent=user)
                                                 record.put()
                                                 recordVersion = RecordVersion(parent=record)
                                                 recordVersion.put()
                                                 
                                                 recordVersion.update(recordParameter)
 
                                                 record.put()
                                                 recordVersion.put()
 
                                         user.put();
 
                                         result['lock'] = user.lock
                                         result['result'] = 'done'
                                         """
                                         
                                 elif message == 'getRecordDetail':
                                         record = db.Query(Record).ancestor(db.Query(User).filter('username =', session.C).get()).filter('reference =', parameters["parameters"]["reference"]).get()
                                         recordVersion = db.Query(RecordVersion).ancestor(record).get()
 
                                         result['currentVersion'] = {}
                                                 result['currentVersion']['reference'] =         recordVersion.reference
                                                 result['currentVersion']['data'] =              recordVersion.data
                                                 result['currentVersion']['header'] =    recordVersion.header
                                                 result['currentVersion']['version'] =   recordVersion.version
                                                 result['currentVersion']['creationDate'] =str(recordVersion.creation_date)
                                                 result['currentVersion']['updateDate'] =str(recordVersion.update_date)
                                                 result['currentVersion']['accessDate'] =str(recordVersion.access_date)