o
    ˜¨Êh=M  ã                   @   s’  d Z ddlZddlZddlmZ ddlmZ ddlmZ ddl	m
Z
mZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z  e !d¡Z"e dƒZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,dZ-de- Z.ej/ej0 Z1dZ2dd „ Z3d!d"„ Z4d#d$„ Z5d%d&„ Z6d'd(„ Z7d)d*„ Z8d+d,„ Z9G d-d.„ d.e:ƒZ;d/d0„ Z<d1d2„ Z=G d3d4„ d4e:ƒZ>G d5d6„ d6eƒZ?dS )7z’
Cross Site Request Forgery Middleware.

This module provides a middleware that implements protection
against request forgeries from other sites.
é    N)Údefaultdict©Úurlparse)Úsettings)ÚDisallowedHostÚImproperlyConfigured)ÚUnreadablePostError)ÚHttpHeaders)Úget_callable)Úpatch_vary_headers)Úconstant_time_compareÚget_random_string)ÚMiddlewareMixin)Úcached_property©Úis_same_domain)Úlog_response)Ú_lazy_re_compilezdjango.security.csrfz[^a-zA-Z0-9]z?Origin checking failed - %s does not match any trusted origins.z%Referer checking failed - no Referer.z@Referer checking failed - %s does not match any trusted origins.zCSRF cookie not set.zCSRF token missing.z/Referer checking failed - Referer is malformed.zCReferer checking failed - Referer is insecure while host is secure.zhas incorrect lengthzhas invalid charactersé    é   Ú
_csrftokenc                   C   s
   t tjƒS )z/Return the view to be used for CSRF rejections.)r
   r   ÚCSRF_FAILURE_VIEW© r   r   úH/var/www/html/env/lib/python3.10/site-packages/django/middleware/csrf.pyÚ_get_failure_view2   s   
r   c                   C   s   t ttd�S )N)Úallowed_chars)r   ÚCSRF_SECRET_LENGTHÚCSRF_ALLOWED_CHARSr   r   r   r   Ú_get_new_csrf_string7   s   r   c                    sP   t ƒ }t‰ t‡ fdd„| D ƒ‡ fdd„|D ƒƒ}d ‡ fdd„|D ƒ¡}|| S )z�
    Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
    token by adding a mask and applying it to the secret.
    c                 3   ó   � | ]}ˆ   |¡V  qd S ©N©Úindex©Ú.0Úx©Úcharsr   r   Ú	<genexpr>B   ó   € z&_mask_cipher_secret.<locals>.<genexpr>Ú c                 3   s(   � | ]\}}ˆ || t ˆ ƒ  V  qd S r    )Úlen©r$   r%   Úyr&   r   r   r(   C   s   €& )r   r   ÚzipÚjoin)ÚsecretÚmaskÚpairsÚcipherr   r&   r   Ú_mask_cipher_secret;   s
   &r4   c                    sZ   | dt … }| t d… } t‰ t‡ fdd„| D ƒ‡ fdd„|D ƒƒ}d ‡ fdd„|D ƒ¡S )zÑ
    Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
    CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt
    the second half to produce the original secret.
    Nc                 3   r   r    r!   r#   r&   r   r   r(   P   r)   z'_unmask_cipher_token.<locals>.<genexpr>r*   c                 3   s    � | ]\}}ˆ ||  V  qd S r    r   r,   r&   r   r   r(   Q   s   € )r   r   r.   r/   )Útokenr1   r2   r   r&   r   Ú_unmask_cipher_tokenG   s
   &r6   c                 C   s*   t ƒ }| j tjrt|ƒn|ddœ¡ |S )zDGenerate a new random CSRF_COOKIE value, and add it to request.META.T)ÚCSRF_COOKIEÚCSRF_COOKIE_NEEDS_UPDATE)r   ÚMETAÚupdater   ÚCSRF_COOKIE_MASKEDr4   ©ÚrequestÚcsrf_secretr   r   r   Ú_add_new_csrf_cookieT   s   
ÿøÿr?   c                 C   s6   d| j v r| j d }d| j d< t|ƒS t| ƒ}t|ƒS )aº  
    Return the CSRF token required for a POST form. The token is an
    alphanumeric value. A new token is created if one is not already set.

    A side effect of calling this function is to make the csrf_protect
    decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
    header to the outgoing response.  For this reason, you may need to use this
    function lazily, as is done by the csrf context processor.
    r7   Tr8   )r9   r?   r4   r<   r   r   r   Ú	get_tokenf   s   



ÿr@   c                 C   s   t | ƒ dS )zi
    Change the CSRF token in use for a request - should be done on login
    for security purposes.
    N)r?   )r=   r   r   r   Úrotate_token{   s   rA   c                   @   ó   e Zd Zdd„ ZdS )ÚInvalidTokenFormatc                 C   ó
   || _ d S r    ©Úreason©ÚselfrF   r   r   r   Ú__init__„   ó   
zInvalidTokenFormat.__init__N©Ú__name__Ú
__module__Ú__qualname__rI   r   r   r   r   rC   ƒ   ó    rC   c                 C   s.   t | ƒttfvrttƒ‚t | ¡rttƒ‚dS )zá
    Raise an InvalidTokenFormat error if the token has an invalid length or
    characters that aren't allowed. The token argument can be a CSRF cookie
    secret or non-cookie CSRF token, and either masked or unmasked.
    N)r+   ÚCSRF_TOKEN_LENGTHr   rC   ÚREASON_INCORRECT_LENGTHÚinvalid_token_chars_reÚsearchÚREASON_INVALID_CHARACTERS)r5   r   r   r   Ú_check_token_formatˆ   s
   
ÿrU   c                 C   s.   t | ƒtkr
t| ƒ} t | ƒtksJ ‚t| |ƒS )aƒ  
    Return whether the given CSRF token matches the given CSRF secret, after
    unmasking the token if necessary.

    This function assumes that the request_csrf_token argument has been
    validated to have the correct length (CSRF_SECRET_LENGTH or
    CSRF_TOKEN_LENGTH characters) and allowed characters, and that if it has
    length CSRF_TOKEN_LENGTH, it is a masked secret.
    )r+   rP   r6   r   r   )Úrequest_csrf_tokenr>   r   r   r   Ú_does_token_match•   s   
rW   c                   @   rB   )ÚRejectRequestc                 C   rD   r    rE   rG   r   r   r   rI   §   rJ   zRejectRequest.__init__NrK   r   r   r   r   rX   ¦   rO   rX   c                   @   sŒ   e Zd ZdZedd„ ƒZedd„ ƒZedd„ ƒZdd	„ Zd
d„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ ZdS )ÚCsrfViewMiddlewarezê
    Require a present and correct csrfmiddlewaretoken for POST requests that
    have a CSRF cookie, and set an outgoing CSRF cookie.

    This middleware should be used in conjunction with the {% csrf_token %}
    template tag.
    c                 C   ó   dd„ t jD ƒS )Nc                 S   s   g | ]
}t |ƒj d ¡‘qS ©Ú*)r   ÚnetlocÚlstrip©r$   Úoriginr   r   r   Ú
<listcomp>¶   s    ÿÿzACsrfViewMiddleware.csrf_trusted_origins_hosts.<locals>.<listcomp>©r   ÚCSRF_TRUSTED_ORIGINS©rH   r   r   r   Úcsrf_trusted_origins_hosts´   s   þz-CsrfViewMiddleware.csrf_trusted_origins_hostsc                 C   rZ   )Nc                 S   s   h | ]}d |vr|’qS r[   r   r_   r   r   r   Ú	<setcomp>½   s    z;CsrfViewMiddleware.allowed_origins_exact.<locals>.<setcomp>rb   rd   r   r   r   Úallowed_origins_exact»   s   z(CsrfViewMiddleware.allowed_origins_exactc                 C   s:   t tƒ}dd„ tjD ƒD ]}||j  |j d¡¡ q|S )z‚
        A mapping of allowed schemes to list of allowed netlocs, where all
        subdomains of the netloc are allowed.
        c                 s   s    � | ]}d |v rt |ƒV  qdS )r\   Nr   r_   r   r   r   r(   Æ   s   € þýz?CsrfViewMiddleware.allowed_origin_subdomains.<locals>.<genexpr>r\   )r   Úlistr   rc   ÚschemeÚappendr]   r^   )rH   Úallowed_origin_subdomainsÚparsedr   r   r   rk   ¿   s   
þz,CsrfViewMiddleware.allowed_origin_subdomainsc                 C   s
   d|_ d S )NT)Úcsrf_processing_done)rH   r=   r   r   r   Ú_acceptÐ   s   zCsrfViewMiddleware._acceptc                 C   s(   t ƒ ||d�}td||j||td� |S )NrE   zForbidden (%s): %s)Úresponser=   Úlogger)r   r   Úpathrp   )rH   r=   rF   ro   r   r   r   Ú_reject×   s   úzCsrfViewMiddleware._rejectc                 C   s‚   t jrz|j t¡}W n# ty   tdƒ‚w z|jt j }W n t	y*   d}Y nw t
|ƒ |du r5dS t|ƒtkr?t|ƒ}|S )a  
        Return the CSRF secret originally associated with the request, or None
        if it didn't have one.

        If the CSRF_USE_SESSIONS setting is false, raises InvalidTokenFormat if
        the request's secret has invalid characters or an invalid length.
        z„CSRF_USE_SESSIONS is enabled, but request.session is not set. SessionMiddleware must appear before CsrfViewMiddleware in MIDDLEWARE.N)r   ÚCSRF_USE_SESSIONSÚsessionÚgetÚCSRF_SESSION_KEYÚAttributeErrorr   ÚCOOKIESÚCSRF_COOKIE_NAMEÚKeyErrorrU   r+   rP   r6   ©rH   r=   r>   r   r   r   Ú_get_secretã   s&   ÿÿÿzCsrfViewMiddleware._get_secretc              
   C   sp   t jr|j t¡|jd kr|jd |jt< d S d S |jt j|jd t jt j	t j
t jt jt jd� t|dƒ d S )Nr7   )Úmax_ageÚdomainrq   ÚsecureÚhttponlyÚsamesite)ÚCookie)r   rs   rt   ru   rv   r9   Ú
set_cookiery   ÚCSRF_COOKIE_AGEÚCSRF_COOKIE_DOMAINÚCSRF_COOKIE_PATHÚCSRF_COOKIE_SECUREÚCSRF_COOKIE_HTTPONLYÚCSRF_COOKIE_SAMESITEr   ©rH   r=   ro   r   r   r   Ú_set_csrf_cookie  s   ÿøz#CsrfViewMiddleware._set_csrf_cookiec                    sª   |j d }z| ¡ }W n	 ty   Y nw d| ¡ rdnd|f }||kr'dS || jv r.dS zt|ƒ}W n
 ty>   Y dS w |j}|j‰ t	‡ fdd„| j
 |d	¡D ƒƒS )
NÚHTTP_ORIGINz%s://%sÚhttpsÚhttpTFc                 3   s   � | ]}t ˆ |ƒV  qd S r    r   ©r$   Úhost©Úrequest_netlocr   r   r(   *  s
   € ÿ
ÿz6CsrfViewMiddleware._origin_verified.<locals>.<genexpr>r   )r9   Úget_hostr   Ú	is_securerg   r   Ú
ValueErrorri   r]   Úanyrk   ru   )rH   r=   Úrequest_originÚ	good_hostÚgood_originÚparsed_originÚrequest_schemer   r‘   r   Ú_origin_verified  s0   
ÿþ
ÿþz#CsrfViewMiddleware._origin_verifiedc                    s  |j  d¡‰ ˆ d u rttƒ‚ztˆ ƒ‰ W n ty   ttƒ‚w dˆ jˆ jfv r,ttƒ‚ˆ jdkr5tt	ƒ‚t
‡ fdd„| jD ƒƒrCd S tjrItjntj}|d u rfz| ¡ }W n tye   ttˆ  ¡  ƒ‚w | ¡ }|dvrtd||f }tˆ j|ƒs‚ttˆ  ¡  ƒ‚d S )NÚHTTP_REFERERr*   r�   c                 3   s   � | ]	}t ˆ j|ƒV  qd S r    )r   r]   r�   ©Úrefererr   r   r(   A  s
   € 
ÿ
ÿz4CsrfViewMiddleware._check_referer.<locals>.<genexpr>)Ú443Ú80z%s:%s)r9   ru   rX   ÚREASON_NO_REFERERr   r•   ÚREASON_MALFORMED_REFERERri   r]   ÚREASON_INSECURE_REFERERr–   re   r   rs   ÚSESSION_COOKIE_DOMAINr…   r“   r   ÚREASON_BAD_REFERERÚgeturlÚget_portr   )rH   r=   Úgood_refererÚserver_portr   rž   r   Ú_check_referer/  s@   ÿ
þÿýÿÿz!CsrfViewMiddleware._check_refererc                 C   s0   |dkrt  |¡}d|›d�}d|› d|› d�S )NÚPOSTzthe z HTTP headerzCSRF token from ú Ú.)r	   Úparse_header_name)rH   rF   Útoken_sourceÚheader_namer   r   r   Ú_bad_token_message\  s   
z%CsrfViewMiddleware._bad_token_messagec              
   C   s  z|   |¡}W n ty } z	td|j› d�ƒ‚d }~ww |d u r%ttƒ‚d}|jdkr?z	|j dd¡}W n	 ty>   Y nw |dkr[z|j	t
j }W n tyV   ttƒ‚w t
j}nd}zt|ƒ W n tyz } z|  |j|¡}t|ƒ‚d }~ww t||ƒsŠ|  d|¡}t|ƒ‚d S )NzCSRF cookie r®   r*   r¬   ÚcsrfmiddlewaretokenÚ	incorrect)r|   rC   rX   rF   ÚREASON_NO_CSRF_COOKIEÚmethodr¬   ru   r   r9   r   ÚCSRF_HEADER_NAMErz   ÚREASON_CSRF_TOKEN_MISSINGrU   r²   rW   )rH   r=   r>   ÚexcrV   r°   rF   r   r   r   Ú_check_tokenc  sD   €ÿ
ûÿ€þ
þzCsrfViewMiddleware._check_tokenc                 C   sF   z|   |¡}W n ty   t|ƒ Y d S w |d ur!||jd< d S d S )Nr7   )r|   rC   r?   r9   r{   r   r   r   Úprocess_request—  s   ÿûz"CsrfViewMiddleware.process_requestc              
   C   s  t |ddƒrd S t |ddƒrd S |jdv r|  |¡S t |ddƒr%|  |¡S d|jv r;|  |¡s:|  |t|jd  ¡S n%| ¡ r`z|  |¡ W n t	y_ } z|  ||j
¡W  Y d }~S d }~ww z|  |¡ W n t	y€ } z|  ||j
¡W  Y d }~S d }~ww |  |¡S )Nrm   FÚcsrf_exempt)ÚGETÚHEADÚOPTIONSÚTRACEÚ_dont_enforce_csrf_checksrŒ   )Úgetattrr¶   rn   r9   rœ   rr   ÚREASON_BAD_ORIGINr”   r«   rX   rF   rº   )rH   r=   ÚcallbackÚcallback_argsÚcallback_kwargsr¹   r   r   r   Úprocess_view¤  s8   




ÿÿ€ÿ€ÿ
zCsrfViewMiddleware.process_viewc                 C   s&   |j  d¡r|  ||¡ d|j d< |S )Nr8   F)r9   ru   r‹   rŠ   r   r   r   Úprocess_responseÝ  s   
z#CsrfViewMiddleware.process_responseN)rL   rM   rN   Ú__doc__r   re   rg   rk   rn   rr   r|   r‹   rœ   r«   r²   rº   r»   rÇ   rÈ   r   r   r   r   rY   «   s&    


 -49rY   )@rÉ   ÚloggingÚstringÚcollectionsr   Úurllib.parser   Údjango.confr   Údjango.core.exceptionsr   r   Údjango.httpr   Údjango.http.requestr	   Údjango.urlsr
   Údjango.utils.cacher   Údjango.utils.cryptor   r   Údjango.utils.deprecationr   Údjango.utils.functionalr   Údjango.utils.httpr   Údjango.utils.logr   Údjango.utils.regex_helperr   Ú	getLoggerrp   rR   rÃ   r¢   r¦   rµ   r¸   r£   r¤   rQ   rT   r   rP   Úascii_lettersÚdigitsr   rv   r   r   r4   r6   r?   r@   rA   Ú	ExceptionrC   rU   rW   rX   rY   r   r   r   r   Ú<module>   sZ    
ÿ