From 0fd7d0dedb7cb5118f3de6de7b504b1d677eb290 Mon Sep 17 00:00:00 2001 From: Jun Date: Thu, 10 Jul 2025 18:40:31 +0800 Subject: [PATCH] Added support for setting a custom SESSION_DIGEST_METHOD in pgAdmin 4 to facilitate FIPS compliance. #7979 --- web/config.py | 3 +++ web/pgadmin/utils/session.py | 3 +++ 2 files changed, 6 insertions(+) diff --git a/web/config.py b/web/config.py index 8cde71f2e..9cd24cbfa 100644 --- a/web/config.py +++ b/web/config.py @@ -365,6 +365,9 @@ SESSION_DB_PATH = os.path.join(DATA_DIR, 'sessions') SESSION_COOKIE_NAME = 'pga4_session' +# Session digest method +SESSION_DIGEST_METHOD = 'hashlib.sha1' + ########################################################################## # Mail server settings ########################################################################## diff --git a/web/pgadmin/utils/session.py b/web/pgadmin/utils/session.py index 650f6b8e6..02090ebd2 100644 --- a/web/pgadmin/utils/session.py +++ b/web/pgadmin/utils/session.py @@ -31,6 +31,7 @@ from flask_login import login_url from pickle import dump, load from collections import OrderedDict +from itsdangerous import signer from flask.sessions import SessionInterface, SessionMixin from werkzeug.datastructures import CallbackDict @@ -286,6 +287,8 @@ class FileBackedSessionManager(SessionManager): class ManagedSessionInterface(SessionInterface): def __init__(self, manager): self.manager = manager + signer.Signer.default_digest_method = \ + eval(config.SESSION_DIGEST_METHOD) def open_session(self, app, request): cookie_val = request.cookies.get(app.config['SESSION_COOKIE_NAME'])