Fixed #19356 -- Increased session key entropy.

    from django.utils.six.moves import cPickle as pickle

except ImportError:

    import pickle

import string

from django.conf import settings

from django.core.exceptions import SuspiciousOperation

from django.utils import timezone

from django.utils.encoding import force_bytes

# session_key should not be case sensitive because some backends can store it

# on case insensitive file systems.

VALID_KEY_CHARS = string.ascii_lowercase + string.digits

class CreateError(Exception):

    """

    Used internally as a consistent exception type to catch from save (see the

    def _get_new_session_key(self):

        "Returns session key that isn't being used."

        # Todo: move to 0-9a-z charset in 1.5

        hex_chars = '1234567890abcdef'

        # session_key should not be case sensitive because some backends

        # can store it on case insensitive file systems.

        while True:

            session_key = get_random_string(32, hex_chars)

            session_key = get_random_string(32, VALID_KEY_CHARS)

            if not self.exists(session_key):

                break

        return session_key

import tempfile

from django.conf import settings

from django.contrib.sessions.backends.base import SessionBase, CreateError

from django.contrib.sessions.backends.base import SessionBase, CreateError, VALID_KEY_CHARS

from django.core.exceptions import SuspiciousOperation, ImproperlyConfigured

from django.utils import timezone

            cls._storage_path = storage_path

            return storage_path

    VALID_KEY_CHARS = set("abcdef0123456789")

    def _key_to_file(self, session_key=None):

        """

        Get the file associated with this session key.

        # Make sure we're not vulnerable to directory traversal. Session keys

        # should always be md5s, so they should never contain directory

        # components.

        if not set(session_key).issubset(self.VALID_KEY_CHARS):

        if not set(session_key).issubset(set(VALID_KEY_CHARS)):

            raise SuspiciousOperation(

                "Invalid characters in session key")