diff --git a/flask/helpers.py b/flask/helpers.py index c6c2cddc..cfc2d408 100644 --- a/flask/helpers.py +++ b/flask/helpers.py @@ -958,3 +958,25 @@ def total_seconds(td): :rtype: int """ return td.days * 60 * 60 * 24 + td.seconds + +def is_IP(string): + ipv4 = string.split('.') + ipv6 = string.split(':') + try: + for i,t in enumerate(ipv6): + if not t: + ipv6[i] = "0" + if(all(int(t,16) >= 0 and int(t,16) <= 65535 for t in ipv6)): + print("IPv6 address introduced in SESSION_COOKIE_DOMAIN!") + return True + except ValueError: + pass + + if len(ipv4) == 4: + try: + if(all(int(t) >= 0 and int(t) <= 255 for t in ipv4)): + print("IPv4 address introduced in SESSION_COOKIE_DOMAIN!") + except ValueError: + return False + else: + return False diff --git a/flask/sessions.py b/flask/sessions.py index 4d67658a..86283f25 100644 --- a/flask/sessions.py +++ b/flask/sessions.py @@ -17,7 +17,7 @@ from werkzeug.http import http_date, parse_date from werkzeug.datastructures import CallbackDict from . import Markup, json from ._compat import iteritems, text_type -from .helpers import total_seconds +from .helpers import total_seconds, is_IP from itsdangerous import URLSafeTimedSerializer, BadSignature @@ -332,6 +332,7 @@ class SecureCookieSessionInterface(SessionInterface): def save_session(self, app, session, response): domain = self.get_cookie_domain(app) + is_IP(domain) path = self.get_cookie_path(app) # Delete case. If there is no session we bail early.