Matej Cepl
3bd00a4f52
Fix for CVE-2023-49438 (bsc#1218412). OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=41
38 lines
1.3 KiB
Diff
38 lines
1.3 KiB
Diff
---
|
|
flask_security/core.py | 2 +-
|
|
flask_security/totp.py | 10 +++-------
|
|
2 files changed, 4 insertions(+), 8 deletions(-)
|
|
|
|
--- a/flask_security/core.py
|
|
+++ b/flask_security/core.py
|
|
@@ -1607,7 +1607,7 @@ class Security:
|
|
and "authenticator" in cv("TWO_FACTOR_ENABLED_METHODS", app=app)
|
|
)
|
|
if need_qrcode:
|
|
- self._check_modules("qrcode", "TWO_FACTOR or UNIFIED_SIGNIN")
|
|
+ self._check_modules("pyqrcodeng", "TWO_FACTOR or UNIFIED_SIGNIN")
|
|
|
|
need_sms = (
|
|
cv("UNIFIED_SIGNIN", app=app)
|
|
--- a/flask_security/totp.py
|
|
+++ b/flask_security/totp.py
|
|
@@ -140,15 +140,11 @@ class Totp:
|
|
.. versionadded:: 4.0.0
|
|
"""
|
|
try:
|
|
- import qrcode
|
|
- import qrcode.image.svg
|
|
+ import pyqrcodeng
|
|
|
|
- image = qrcode.make(
|
|
- self.get_totp_uri(username, totp),
|
|
- image_factory=qrcode.image.svg.SvgImage,
|
|
- )
|
|
+ image = pyqrcodeng.create(self.get_totp_uri(username, totp))
|
|
with io.BytesIO() as virtual_file:
|
|
- image.save(virtual_file)
|
|
+ image.svg(virtual_file, scale=1)
|
|
image_as_str = base64.b64encode(virtual_file.getvalue()).decode("ascii")
|
|
|
|
return f"data:image/svg+xml;base64,{image_as_str}"
|