__author__ = 'zifnab'

import string
from passlib.hash import sha512_crypt
import database
from flask_login import login_user

def random_string(size=10, chars=string.ascii_letters + string.digits):
    import random
    return ''.join(random.choice(chars) for x in range(size))

def create_user(**kwargs):
    username = kwargs.get('username')
    password = kwargs.get('password')
    email = kwargs.get('email')
    hash = sha512_crypt.encrypt(password)
    user = database.User(username=username,
                hash=hash,
                email=email)
    if database.User.objects().count() == 0:
        user.admin = True
    user.save()
    login_user(user)

def authenticate_user(username, password):
    user = database.User.objects(username__iexact=username).first()
    if user is None:
        return None
    if (sha512_crypt.verify(password, user.hash)):
        return user
    else:
        return None


def lookup_user(username):
    user = database.User.objects(username__iexact=username).first()
    return user
__author__ = 'zifnab'

import string
from passlib.hash import sha512_crypt
from random import SystemRandom
import database
from flask_login import login_user

_random = SystemRandom()

def random_string(size=10, chars=string.ascii_letters + string.digits):
    return ''.join(_random.choice(chars) for x in range(size))

def create_user(**kwargs):
    username = kwargs.get('username')
    password = kwargs.get('password')
    email = kwargs.get('email')
    hash = sha512_crypt.encrypt(password)
    user = database.User(username=username,
                hash=hash,
                email=email)
    if database.User.objects().count() == 0:
        user.admin = True
    user.save()
    login_user(user)

def authenticate_user(username, password):
    user = database.User.objects(username__iexact=username).first()
    if user is None:
        return None
    if (sha512_crypt.verify(password, user.hash)):
        return user
    else:
        return None


def lookup_user(username):
    user = database.User.objects(username__iexact=username).first()
    return user
Use a cryptographically secure PRNG in random_string().
Use a cryptographically secure PRNG in random_string().

By default python uses a non-CS PRNG, so with some analysis, "random_string"s could be predicted.

  __author__ = 'zifnab'
  
  import string
  from passlib.hash import sha512_crypt
+ from random import SystemRandom
  import database
  from flask_login import login_user
  
+ _random = SystemRandom()
+ 
  def random_string(size=10, chars=string.ascii_letters + string.digits):
-     import random
-     return ''.join(random.choice(chars) for x in range(size))
+     return ''.join(_random.choice(chars) for x in range(size))
  
  def create_user(**kwargs):
      username = kwargs.get('username')
      password = kwargs.get('password')
      email = kwargs.get('email')
      hash = sha512_crypt.encrypt(password)
      user = database.User(username=username,
                  hash=hash,
                  email=email)
      if database.User.objects().count() == 0:
          user.admin = True
      user.save()
      login_user(user)
  
  def authenticate_user(username, password):
      user = database.User.objects(username__iexact=username).first()
      if user is None:
          return None
      if (sha512_crypt.verify(password, user.hash)):
          return user
      else:
          return None
  
  
  def lookup_user(username):
      user = database.User.objects(username__iexact=username).first()
      return user
Use a cryptographically secure PRNG in random_string().
## Code Before:
__author__ = 'zifnab'

import string
from passlib.hash import sha512_crypt
import database
from flask_login import login_user

def random_string(size=10, chars=string.ascii_letters + string.digits):
    import random
    return ''.join(random.choice(chars) for x in range(size))

def create_user(**kwargs):
    username = kwargs.get('username')
    password = kwargs.get('password')
    email = kwargs.get('email')
    hash = sha512_crypt.encrypt(password)
    user = database.User(username=username,
                hash=hash,
                email=email)
    if database.User.objects().count() == 0:
        user.admin = True
    user.save()
    login_user(user)

def authenticate_user(username, password):
    user = database.User.objects(username__iexact=username).first()
    if user is None:
        return None
    if (sha512_crypt.verify(password, user.hash)):
        return user
    else:
        return None


def lookup_user(username):
    user = database.User.objects(username__iexact=username).first()
    return user
## Instruction:
Use a cryptographically secure PRNG in random_string().
## Code After:
__author__ = 'zifnab'

import string
from passlib.hash import sha512_crypt
from random import SystemRandom
import database
from flask_login import login_user

_random = SystemRandom()

def random_string(size=10, chars=string.ascii_letters + string.digits):
    return ''.join(_random.choice(chars) for x in range(size))

def create_user(**kwargs):
    username = kwargs.get('username')
    password = kwargs.get('password')
    email = kwargs.get('email')
    hash = sha512_crypt.encrypt(password)
    user = database.User(username=username,
                hash=hash,
                email=email)
    if database.User.objects().count() == 0:
        user.admin = True
    user.save()
    login_user(user)

def authenticate_user(username, password):
    user = database.User.objects(username__iexact=username).first()
    if user is None:
        return None
    if (sha512_crypt.verify(password, user.hash)):
        return user
    else:
        return None


def lookup_user(username):
    user = database.User.objects(username__iexact=username).first()
    return user