@@ -22,10 +22,11 @@ if __name__ == '__main__':
2222 from os.path import realpath, dirname
2323 path.append(realpath(dirname(realpath(__file__)) + '/../'))
2424
25−import json
2625import cStringIO
27−import os
2826import hashlib
27+import hmac
28+import json
29+import os
2930import requests
3031
3132from searx import logger
@@ -250,8 +251,7 @@ def image_proxify(url):
250251 if not request.preferences.get_value('image_proxy'):
251252 return url
252253
253− hash_string = url + settings['server']['secret_key']
254− h = hashlib.sha256(hash_string.encode('utf-8')).hexdigest()
254+ h = hmac.new(settings['server']['secret_key'], url, hashlib.sha256).hexdigest()
255255
256256 return '{0}?{1}'.format(url_for('image_proxy'),
257257 urlencode(dict(url=url.encode('utf-8'), h=h)))
@@ -599,7 +599,7 @@ def image_proxy():
599599 if not url:
600600 return '', 400
601601
602− h = hashlib.sha256(url + settings['server']['secret_key'].encode('utf-8')).hexdigest()
602+ h = hmac.new(settings['server']['secret_key'], url, hashlib.sha256).hexdigest()
603603
604604 if h != request.args.get('h'):
605605 return '', 400