Merge branch 'master' into Develop

# Conflicts:
#	cps/helper.py

cps/__init__.py

@@ -56,10 +56,17 @@ mimetypes.add_type('application/ogg', '.ogg')
 mimetypes.add_type('application/ogg', '.oga')
 
 app = Flask(__name__)
+app.config.update(
+    SESSION_COOKIE_HTTPONLY=True,
+    SESSION_COOKIE_SAMESITE='Lax',
+    REMEMBER_COOKIE_SAMESITE='Lax',  # will be available in flask-login 0.5.1 earliest
+)
+
 
 lm = LoginManager()
 lm.login_view = 'web.login'
 lm.anonymous_user = ub.Anonymous
+lm.session_protection = 'strong'
 
 ub.init_db(cli.settingspath)
 # pylint: disable=no-member

cps/db.py

@@ -104,11 +104,11 @@ class Identifiers(Base):
         if self.type == "amazon":
             return u"https://amzn.com/{0}".format(self.val)
         elif self.type == "isbn":
-            return u"http://www.worldcat.org/isbn/{0}".format(self.val)
+            return u"https://www.worldcat.org/isbn/{0}".format(self.val)
         elif self.type == "doi":
-            return u"http://dx.doi.org/{0}".format(self.val)
+            return u"https://dx.doi.org/{0}".format(self.val)
         elif self.type == "goodreads":
-            return u"http://www.goodreads.com/book/show/{0}".format(self.val)
+            return u"https://www.goodreads.com/book/show/{0}".format(self.val)
         elif self.type == "douban":
             return u"https://book.douban.com/subject/{0}".format(self.val)
         elif self.type == "google":
@@ -116,7 +116,7 @@ class Identifiers(Base):
         elif self.type == "kobo":
             return u"https://www.kobo.com/ebook/{0}".format(self.val)
         elif self.type == "lubimyczytac":
-            return u" http://lubimyczytac.pl/ksiazka/{0}".format(self.val)
+            return u" https://lubimyczytac.pl/ksiazka/{0}".format(self.val)
         elif self.type == "url":
             return u"{0}".format(self.val)
         else:

cps/helper.py

@@ -467,7 +467,7 @@ def reset_password(user_id):
 def generate_random_password():
     s = "abcdefghijklmnopqrstuvwxyz01234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%&*()?"
     passlen = 8
-    return "".join(random.sample(s, passlen))
+    return "".join(s[c % len(s)] for c in os.urandom(passlen))
 
 ################################## External interface
 
@@ -615,8 +615,9 @@ def do_download_file(book, book_format, client, data, headers):
             headers["Content-Disposition"] = headers["Content-Disposition"].replace(".kepub", ".kepub.epub")
 
         response = make_response(send_from_directory(filename, data.name + "." + book_format))
-
-        response.headers = headers
+        # ToDo Check headers parameter
+        for element in headers:
+            response.headers[element[0]] = element[1]
         return response
 
 ##################################

cps/kobo.py

@@ -979,7 +979,7 @@ def NATIVE_KOBO_RESOURCES():
         "blackstone_header": {"key": "x-amz-request-payer", "value": "requester"},
         "book": "https://storeapi.kobo.com/v1/products/books/{ProductId}",
         "book_detail_page": "https://store.kobobooks.com/{culture}/ebook/{slug}",
-        "book_detail_page_rakuten": "http://books.rakuten.co.jp/rk/{crossrevisionid}",
+        "book_detail_page_rakuten": "https://books.rakuten.co.jp/rk/{crossrevisionid}",
         "book_landing_page": "https://store.kobobooks.com/ebooks",
         "book_subscription": "https://storeapi.kobo.com/v1/products/books/subscriptions",
         "categories": "https://storeapi.kobo.com/v1/categories",
@@ -1017,7 +1017,7 @@ def NATIVE_KOBO_RESOURCES():
         "get_tests_request": "https://storeapi.kobo.com/v1/analytics/gettests",
         "giftcard_epd_redeem_url": "https://www.kobo.com/{storefront}/{language}/redeem-ereader",
         "giftcard_redeem_url": "https://www.kobo.com/{storefront}/{language}/redeem",
-        "help_page": "http://www.kobo.com/help",
+        "help_page": "https://www.kobo.com/help",
         "kobo_audiobooks_enabled": "False",
         "kobo_audiobooks_orange_deal_enabled": "False",
         "kobo_audiobooks_subscriptions_enabled": "False",

cps/oauth.py

@@ -40,7 +40,7 @@ try:
         Stores and retrieves OAuth tokens using a relational database through
         the `SQLAlchemy`_ ORM.
 
-        .. _SQLAlchemy: http://www.sqlalchemy.org/
+        .. _SQLAlchemy: https://www.sqlalchemy.org/
         """
         def __init__(self, model, session, provider_id,
                      user=None, user_id=None, user_required=None, anon_user=None,

cps/web.py

@@ -1526,7 +1526,7 @@ def profile():
             current_user.kindle_mail = to_save["kindle_mail"]
         if "allowed_tags" in to_save and to_save["allowed_tags"] != current_user.allowed_tags:
             current_user.allowed_tags = to_save["allowed_tags"].strip()
-        if to_save["email"] and to_save["email"] != current_user.email:
+        if "email" in to_save and to_save["email"] != current_user.email:
             if config.config_public_reg and not check_valid_domain(to_save["email"]):
                 flash(_(u"E-mail is not from valid domain"), category="error")
                 return render_title_template("user_edit.html", content=current_user, downloads=downloads,