File: //usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/__pycache__/csrf.cpython-310.pyc
o
�h M � @ s� d Z ddlZddlZddlmZ ddlmZ ddlmZ ddl m
Z
m Z ddl m
Z
mZ ddlmZ dd lmZ dd
lmZmZ dd lmZ dd lmZ dd
lmZ ddl m Z ddl m Z e� d�Z!e d�Z"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,d e, Z-ej.ej/ Z0d Z1d d � Z2d d!� Z3d"d#� Z4d$d%� Z5d&d'� Z6d(d)� Z7d*d+� Z8G d,d-� d-e9�Z:d.d/� Z;d0d1� Z<G d2d3� d3e9�Z=G d4d5� d5e�Z>dS )6z�
Cross Site Request Forgery Middleware.
This module provides a middleware that implements protection
against request forgeries from other sites.
� N)� defaultdict��urlparse)�settings)�DisallowedHost�ImproperlyConfigured)� HttpHeaders�UnreadablePostError)� get_callable)�patch_vary_headers)�constant_time_compare�get_random_string)�MiddlewareMixin)�cached_property��is_same_domain)� log_response)�_lazy_re_compilezdjango.security.csrfz [^a-zA-Z0-9]z?Origin checking failed - %s does not match any trusted origins.z%Referer checking failed - no Referer.z@Referer checking failed - %s does not match any trusted origins.zCSRF cookie not set.zCSRF token missing.z/Referer checking failed - Referer is malformed.zCReferer checking failed - Referer is insecure while host is secure.zhas incorrect lengthzhas invalid characters� � �
_csrftokenc C s
t tj�S )z/Return the view to be used for CSRF rejections.)r
r �CSRF_FAILURE_VIEW� r r �I/usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/csrf.py�_get_failure_view1 s
r c C s t ttd�S )N)�
allowed_chars)r
�CSRF_SECRET_LENGTH�CSRF_ALLOWED_CHARSr r r r �_get_new_csrf_string6 s r c sP t � }t� t� fdd�| D �� fdd�|D ��}d�� fdd�|D ��}|| S )z�
Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
token by adding a mask and applying it to the secret.
c 3 � � | ]}� � |�V qd S �N��index��.0�x��charsr r � <genexpr>A � � z&_mask_cipher_secret.<locals>.<genexpr>� c 3 s( � | ]\}}� || t � � V qd S r )�len�r$ r% �yr& r r r( B s �& )r r �zip�join)�secret�mask�pairs�cipherr r& r �_mask_cipher_secret: s
&r4 c sZ | dt � }| t d� } t� t� fdd�| D �� fdd�|D ��}d�� fdd�|D ��S )z�
Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt
the second half to produce the original secret.
Nc 3 r r r! r# r& r r r( O r) z'_unmask_cipher_token.<locals>.<genexpr>r* c 3 s � | ] \}}� || V qd S r r r, r& r r r( P s � )r r r. r/ )�tokenr1 r2 r r& r �_unmask_cipher_tokenF s
&r6 c C s* t � }| j�tjr
t|�n|dd�� |S )zDGenerate a new random CSRF_COOKIE value, and add it to request.META.T)� CSRF_COOKIE�CSRF_COOKIE_NEEDS_UPDATE)r �META�updater �CSRF_COOKIE_MASKEDr4 ��request� csrf_secretr r r �_add_new_csrf_cookieS s
��� r? c C s6 d| j v r| j d }d| j d< t|�S t| �}t|�S )a�
Return the CSRF token required for a POST form. The token is an
alphanumeric value. A new token is created if one is not already set.
A side effect of calling this function is to make the csrf_protect
decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
header to the outgoing response. For this reason, you may need to use this
function lazily, as is done by the csrf context processor.
r7 Tr8 )r9 r? r4 r< r r r � get_tokene s
�r@ c C s t | � dS )zi
Change the CSRF token in use for a request - should be done on login
for security purposes.
N)r? )r= r r r � rotate_tokenz s rA c @ � e Zd Zdd� ZdS )�InvalidTokenFormatc C �
|| _ d S r ��reason��selfrF r r r �__init__� �
zInvalidTokenFormat.__init__N��__name__�
__module__� __qualname__rI r r r r rC � � rC c C s. t | �ttfvr tt��t�| �rtt��dS )z�
Raise an InvalidTokenFormat error if the token has an invalid length or
characters that aren't allowed. The token argument can be a CSRF cookie
secret or non-cookie CSRF token, and either masked or unmasked.
N)r+ �CSRF_TOKEN_LENGTHr rC �REASON_INCORRECT_LENGTH�invalid_token_chars_re�search�REASON_INVALID_CHARACTERS)r5 r r r �_check_token_format� s
�rU c C s. t | �tkr
t| �} t | �tksJ �t| |�S )a�
Return whether the given CSRF token matches the given CSRF secret, after
unmasking the token if necessary.
This function assumes that the request_csrf_token argument has been
validated to have the correct length (CSRF_SECRET_LENGTH or
CSRF_TOKEN_LENGTH characters) and allowed characters, and that if it has
length CSRF_TOKEN_LENGTH, it is a masked secret.
)r+ rP r6 r r )�request_csrf_tokenr> r r r �_does_token_match� s
rW c @ rB )�
RejectRequestc C rD r rE rG r r r rI � rJ zRejectRequest.__init__NrK r r r r rX � rO rX c @ s� e Zd ZdZedd� �Zedd� �Zedd� �Zdd � Zd
d � Z d d
� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zdd� Zd d � Zd S ) �CsrfViewMiddlewarez�
Require a present and correct csrfmiddlewaretoken for POST requests that
have a CSRF cookie, and set an outgoing CSRF cookie.
This middleware should be used in conjunction with the {% csrf_token %}
template tag.
c C � dd� t jD �S )Nc S s g | ]
}t |�j�d ��qS ��*)r �netloc�lstrip�r$ �originr r r �
<listcomp>� s ��zACsrfViewMiddleware.csrf_trusted_origins_hosts.<locals>.<listcomp>�r �CSRF_TRUSTED_ORIGINS�rH r r r �csrf_trusted_origins_hosts� s �z-CsrfViewMiddleware.csrf_trusted_origins_hostsc C rZ )Nc S s h | ]}d |vr|�qS r[ r r_ r r r � <setcomp>� s z;CsrfViewMiddleware.allowed_origins_exact.<locals>.<setcomp>rb rd r r r �allowed_origins_exact� s z(CsrfViewMiddleware.allowed_origins_exactc C s: t t�}dd� tjD �D ]}||j �|j�d�� q |S )z�
A mapping of allowed schemes to list of allowed netlocs, where all
subdomains of the netloc are allowed.
c s s � | ] }d |v rt |�V qdS )r\ Nr r_ r r r r( � s � ��z?CsrfViewMiddleware.allowed_origin_subdomains.<locals>.<genexpr>r\ )r �listr rc �scheme�appendr] r^ )rH �allowed_origin_subdomains�parsedr r r rk � s
�z,CsrfViewMiddleware.allowed_origin_subdomainsc C s
d|_ d S )NT)�csrf_processing_done)rH r= r r r �_accept� s zCsrfViewMiddleware._acceptc C s( t � ||d�}td||j||td� |S )NrE zForbidden (%s): %s)�responser= �logger)r r �pathrp )rH r= rF ro r r r �_reject� s �zCsrfViewMiddleware._rejectc C s� t jrz|j�t�}W n# ty td��w z|jt j }W n t y* d}Y nw t
|� |du r5dS t |�t kr?t
|�}|S )a
Return the CSRF secret originally associated with the request, or None
if it didn't have one.
If the CSRF_USE_SESSIONS setting is false, raises InvalidTokenFormat if
the request's secret has invalid characters or an invalid length.
z�CSRF_USE_SESSIONS is enabled, but request.session is not set. SessionMiddleware must appear before CsrfViewMiddleware in MIDDLEWARE.N)r �CSRF_USE_SESSIONS�session�get�CSRF_SESSION_KEY�AttributeErrorr �COOKIES�CSRF_COOKIE_NAME�KeyErrorrU r+ rP r6 �rH r= r> r r r � _get_secret� s& �� � z CsrfViewMiddleware._get_secretc
C sp t jr|j�t�|jd kr|jd |jt< d S d S |jt j|jd t jt j t j
t j t j t j
d� t|d� d S )Nr7 )�max_age�domainrq �secure�httponly�samesite)�Cookie)r rs rt ru rv r9 �
set_cookiery �CSRF_COOKIE_AGE�CSRF_COOKIE_DOMAIN�CSRF_COOKIE_PATH�CSRF_COOKIE_SECURE�CSRF_COOKIE_HTTPONLY�CSRF_COOKIE_SAMESITEr �rH r= ro r r r �_set_csrf_cookie s �� z#CsrfViewMiddleware._set_csrf_cookiec s� |j d }z|�� }W n ty Y nw d|�� r dnd|f }||kr'dS || jv r.dS zt|�}W n
ty> Y dS w |j}|j� t � fdd�| j
� |d �D ��S )
N� HTTP_ORIGINz%s://%s�https�httpTFc 3 s � | ]}t � |�V qd S r r �r$ �host��request_netlocr r r( ) s
� �
�z6CsrfViewMiddleware._origin_verified.<locals>.<genexpr>r ) r9 �get_hostr � is_securerg r �
ValueErrorri r] �anyrk ru )rH r= �request_origin� good_host� good_origin�
parsed_origin�request_schemer r� r �_origin_verified s0
��
� �z#CsrfViewMiddleware._origin_verifiedc s |j �d�� � d u rtt��zt� �� W n ty tt��w d� j� jfv r,tt��� jdkr5tt ��t
� fdd�| j D ��rCd S t j
rIt jnt j}|d u rfz|�� }W n tye tt� �� ��w |�� }|dvrtd||f }t� j|�s�tt� �� ��d S )N� HTTP_REFERERr* r� c 3 s � | ] }t � j|�V qd S r )r r] r� ��refererr r r( @ s
�
�
�z4CsrfViewMiddleware._check_referer.<locals>.<genexpr>)�443�80z%s:%s)r9 ru rX �REASON_NO_REFERERr r� �REASON_MALFORMED_REFERERri r] �REASON_INSECURE_REFERERr� re r rs �SESSION_COOKIE_DOMAINr� r� r �REASON_BAD_REFERER�geturl�get_portr )rH r= � good_referer� server_portr r� r �_check_referer. s@ �
��� � �z!CsrfViewMiddleware._check_refererc C s0 |dkrt �|�}d|�d�}d|� d|� d�S )N�POSTzthe z HTTP headerzCSRF token from � �.)r �parse_header_name)rH rF � token_source� header_namer r r �_bad_token_message[ s
z%CsrfViewMiddleware._bad_token_messagec
C s z| � |�}W n ty } z td|j� d���d }~ww |d u r%tt��d}|jdkr?z |j�dd�}W n ty> Y nw |dkr[z|j t
j }W n t yV tt
��w t
j }nd}zt|� W n tyz } z | �|j|�}t|��d }~ww t||�s�| �d|�}t|��d S )Nz CSRF cookie r� r* r� �csrfmiddlewaretoken� incorrect)r| rC rX rF �REASON_NO_CSRF_COOKIE�methodr� ru r r9 r �CSRF_HEADER_NAMErz �REASON_CSRF_TOKEN_MISSINGrU r� rW )rH r= r> �excrV r� rF r r r � _check_tokenb sD ��
� � ��
�z CsrfViewMiddleware._check_tokenc C sF z| � |�}W n ty t|� Y d S w |d ur!||jd< d S d S )Nr7 )r| rC r? r9 r{ r r r �process_request� s ��z"CsrfViewMiddleware.process_requestc
C s t |dd�rd S t |dd�rd S |jdv r| �|�S t |dd�r%| �|�S d|jv r;| �|�s:| �|t|jd �S n%|�� r`z| �|� W n t y_ } z
| �||j
�W Y d }~S d }~ww z| � |� W n t y� } z
| �||j
�W Y d }~S d }~ww | �|�S )Nrm F� csrf_exempt)�GET�HEAD�OPTIONS�TRACE�_dont_enforce_csrf_checksr� ) �getattrr� rn r9 r� rr �REASON_BAD_ORIGINr� r� rX rF r� )rH r= �callback�
callback_args�callback_kwargsr� r r r � process_view� s8
������
z CsrfViewMiddleware.process_viewc C s& |j �d�r| �||� d|j d< |S )Nr8 F)r9 ru r� r� r r r �process_response� s
z#CsrfViewMiddleware.process_responseN)rL rM rN �__doc__r re rg rk rn rr r| r� r� r� r� r� r� r� r� r r r r rY � s&
-4
9rY )?r� �logging�string� collectionsr � urllib.parser � django.confr �django.core.exceptionsr r � django.httpr r � django.urlsr
�django.utils.cacher �django.utils.cryptor r
�django.utils.deprecationr �django.utils.functionalr �django.utils.httpr �django.utils.logr �django.utils.regex_helperr � getLoggerrp rR r� r� r� r� r� r� r� rQ rT r rP �
ascii_letters�digitsr rv r r r4 r6 r? r@ rA � ExceptionrC rU rW rX rY r r r r �<module> sX
�