From 647abf8e3c9df8a5fb39bcf3d2a191cebe0d5961 Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Sun, 18 Nov 2012 16:43:07 -0800 Subject: [PATCH 1/7] send abbreviated URL for payments, not using session ID --- server-ca/chocolate.py | 3 ++- server-ca/payment.py | 29 +++++++++++++++++++++++++++++ server-ca/testchallenge-daemon.py | 15 +++++++++++++-- 3 files changed, 44 insertions(+), 3 deletions(-) diff --git a/server-ca/chocolate.py b/server-ca/chocolate.py index e29cc9221..55cf9e973 100755 --- a/server-ca/chocolate.py +++ b/server-ca/chocolate.py @@ -422,7 +422,8 @@ class session(object): chall.name = "payment" chall.succeeded = False # In payment, we send address of form to complete this payment - chall.data.append(str("%s/%s" % (payment_uri, self.id))) + abbreviation = sessions.hget(self.id, "shorturl") + chall.data.append(str("%s/%s" % (payment_uri, abbreviation))) def POST(self): web.header("Content-type", "application/x-protobuf+chocolate") diff --git a/server-ca/payment.py b/server-ca/payment.py index b0a09e20d..b5a888822 100755 --- a/server-ca/payment.py +++ b/server-ca/payment.py @@ -8,12 +8,41 @@ import web, redis urls = ( + '/([a-f0-9]{10})', 'shortform', '/([a-f0-9]{64})', 'form', '/submit=([a-f0-9]{64})', 'payment' ) r = redis.Redis() +class shortform(object): + def GET(self, what): + web.header("Content-type", "text/html") + expanded = r.get("shorturl-%s" % what) + if not expanded: + return "

Unknown session ID

" + return """ + +

Payment required

+ Due to certificate authority policy, issuing this certificate requires a payment. +

+

+

+ A payment of 17.00 simoleons is due now. +

+ In order to process this payment, please pretend to enter a 16-digit credit-card + number below, and then click the Submit Payment button. +

+

+ Credit Card Type
+ Credit Card Number
+ +
+ This payment will appear on your + credit card statement as TRUSTIFIABLE CERTIFICATE SERVICES. + + """ % expanded + class form(object): def GET(self, what): web.header("Content-type", "text/html") diff --git a/server-ca/testchallenge-daemon.py b/server-ca/testchallenge-daemon.py index a033b48db..81ceb26bf 100755 --- a/server-ca/testchallenge-daemon.py +++ b/server-ca/testchallenge-daemon.py @@ -92,12 +92,23 @@ def testchallenge(session): # also have implicitly guaranteed this). if policy.payment_required(session): if debug: print "\t** All challenges satisfied; request %s NEEDS PAYMENT" % short(session) + # Try to get a unique abbreviated ID (10 hex digits) + for i in xrange(20): + abbreviation = random()[:10] + if r.hget("shorturl-%s" % abbreviation) is None: + break + else: + # Mysteriously unable to get a unique abbreviated session ID! + r.hset(session, "live", "False") + return + r.set("shorturl-%s" % abbreviation, session) + r.expire("shorturl-%s" % abbreviation, 3600) + r.hset(session, "shorturl", abbreviation) r.hset(session, "state", "payment") # According to current practice, there is no pending-payment # queue because sessions can get out of payment state # instantaneously as soon as the payment system sends a "payments" - # pubsub message to - # the payments daemon. + # pubsub message to the payments daemon. else: if debug: print "\t** All challenges satisfied; request %s GRANTED" % short(session) r.hset(session, "state", "issue") From 8e4e2af1fa5ee07ef2869fd3f242dad8ae2cc04f Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Sun, 18 Nov 2012 16:47:58 -0800 Subject: [PATCH 2/7] this is a simple key, not a hash --- server-ca/testchallenge-daemon.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server-ca/testchallenge-daemon.py b/server-ca/testchallenge-daemon.py index 81ceb26bf..c8424622f 100755 --- a/server-ca/testchallenge-daemon.py +++ b/server-ca/testchallenge-daemon.py @@ -95,7 +95,7 @@ def testchallenge(session): # Try to get a unique abbreviated ID (10 hex digits) for i in xrange(20): abbreviation = random()[:10] - if r.hget("shorturl-%s" % abbreviation) is None: + if r.get("shorturl-%s" % abbreviation) is None: break else: # Mysteriously unable to get a unique abbreviated session ID! From 708677dd654a46d76cd689feb21d468bd55ea64f Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Sun, 18 Nov 2012 17:02:28 -0800 Subject: [PATCH 3/7] improved payment form --- server-ca/index.html | 79 ++++++++++++++++++++++++++++++++++++++++++++ server-ca/payment.py | 23 ++----------- 2 files changed, 81 insertions(+), 21 deletions(-) create mode 100644 server-ca/index.html diff --git a/server-ca/index.html b/server-ca/index.html new file mode 100644 index 000000000..998f0971e --- /dev/null +++ b/server-ca/index.html @@ -0,0 +1,79 @@ + + + + + + Project Chocolate + + + + + + + + + + +
+
+

Payment Required

+ +
+
+ +
+
+ +
+
+
+
+

Payment Form

+
+

:

+

+
+

+
+
+
+
+ + + +
+
+ +
+
+ +
+
+ + + + diff --git a/server-ca/payment.py b/server-ca/payment.py index b5a888822..6caa44aeb 100755 --- a/server-ca/payment.py +++ b/server-ca/payment.py @@ -21,27 +21,8 @@ class shortform(object): expanded = r.get("shorturl-%s" % what) if not expanded: return "

Unknown session ID

" - return """ - -

Payment required

- Due to certificate authority policy, issuing this certificate requires a payment. -

-

-

- A payment of 17.00 simoleons is due now. -

- In order to process this payment, please pretend to enter a 16-digit credit-card - number below, and then click the Submit Payment button. -

-

- Credit Card Type
- Credit Card Number
- -
- This payment will appear on your - credit card statement as TRUSTIFIABLE CERTIFICATE SERVICES. - - """ % expanded + with open("index.html","r") as f: + return f.read() % expanded class form(object): def GET(self, what): From 0d3e0bd72c98dcbe65025b1da281a965cf7be633 Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Sun, 18 Nov 2012 17:06:33 -0800 Subject: [PATCH 4/7] actually these references should be relative to the web root --- server-ca/index.html | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/server-ca/index.html b/server-ca/index.html index 998f0971e..4f6ee7dc9 100644 --- a/server-ca/index.html +++ b/server-ca/index.html @@ -7,12 +7,12 @@ - - + + @@ -74,6 +74,6 @@ - + From 5921f4878b8a28ff37f2de309db416624234c769 Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Sun, 18 Nov 2012 17:56:22 -0800 Subject: [PATCH 5/7] actually we assume this is a GET, not a POST! --- server-ca/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server-ca/index.html b/server-ca/index.html index 4f6ee7dc9..cc0bc912d 100644 --- a/server-ca/index.html +++ b/server-ca/index.html @@ -38,7 +38,7 @@

Payment Form

-
+

:

From 674adbf9afa7b5619ba3082d96105058a5af5e5b Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Sun, 18 Nov 2012 17:57:30 -0800 Subject: [PATCH 6/7] add credit card type selector --- server-ca/index.html | 1 + 1 file changed, 1 insertion(+) diff --git a/server-ca/index.html b/server-ca/index.html index cc0bc912d..2a1f7508f 100644 --- a/server-ca/index.html +++ b/server-ca/index.html @@ -39,6 +39,7 @@

Payment Form

+

:

From 98b4898c8f4e36a7415ce2d7605453fb0fc8b6d1 Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Sun, 18 Nov 2012 17:58:00 -0800 Subject: [PATCH 7/7] remove dead code --- server-ca/payment.py | 26 -------------------------- 1 file changed, 26 deletions(-) diff --git a/server-ca/payment.py b/server-ca/payment.py index 6caa44aeb..fd13f95af 100755 --- a/server-ca/payment.py +++ b/server-ca/payment.py @@ -9,7 +9,6 @@ import web, redis urls = ( '/([a-f0-9]{10})', 'shortform', - '/([a-f0-9]{64})', 'form', '/submit=([a-f0-9]{64})', 'payment' ) @@ -24,31 +23,6 @@ class shortform(object): with open("index.html","r") as f: return f.read() % expanded -class form(object): - def GET(self, what): - web.header("Content-type", "text/html") - return """ - -

Payment required

- Due to certificate authority policy, issuing this certificate requires a payment. -

-

-

- A payment of 17.00 simoleons is due now. -

- In order to process this payment, please pretend to enter a 16-digit credit-card - number below, and then click the Submit Payment button. -

-

- Credit Card Type
- Credit Card Number
- -
- This payment will appear on your - credit card statement as TRUSTIFIABLE CERTIFICATE SERVICES. - - """ % what - def hexdigit(s): return s in "0123456789abcdef"