
    h!L                        S r SSKrSSKrSSKJr  SSKJr  SSKJr  SSK	J
r
Jr  SSKJrJr  SSKJr  SS	KJr  SS
KJrJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  \R@                  " S5      r!\" S5      r"Sr#Sr$Sr%Sr&Sr'Sr(Sr)Sr*Sr+Sr,S\,-  r-\R\                  \R^                  -   r0Sr1S r2S r3S  r4S! r5S" r6S# r7S$ r8 " S% S&\95      r:S' r;S( r< " S) S*\95      r= " S+ S,\5      r>g)-z
Cross Site Request Forgery Middleware.

This module provides a middleware that implements protection
against request forgeries from other sites.
    N)defaultdicturlparse)settings)DisallowedHostImproperlyConfigured)HttpHeadersUnreadablePostError)get_callable)patch_vary_headers)constant_time_compareget_random_string)MiddlewareMixin)cached_propertyis_same_domain)log_response)_lazy_re_compilezdjango.security.csrfz[^a-zA-Z0-9]z?Origin checking failed - %s does not match any trusted origins.z%Referer checking failed - no Referer.z@Referer checking failed - %s does not match any trusted origins.zCSRF cookie not set.zCSRF token missing.z/Referer checking failed - Referer is malformed.zCReferer checking failed - Referer is insecure while host is secure.zhas incorrect lengthzhas invalid characters       
_csrftokenc                  4    [        [        R                  5      $ )z/Return the view to be used for CSRF rejections.)r   r   CSRF_FAILURE_VIEW     H/var/www/html/env/lib/python3.13/site-packages/django/middleware/csrf.py_get_failure_viewr   2   s    2233r   c                  &    [        [        [        S9$ )N)allowed_chars)r   CSRF_SECRET_LENGTHCSRF_ALLOWED_CHARSr   r   r   _get_new_csrf_stringr"   7   s    /?QRRr   c                    ^ [        5       n[        m[        U4S jU  5       U4S jU 5       5      nSR                  U4S jU 5       5      nX-   $ )z
Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
token by adding a mask and applying it to the secret.
c              3   F   >#    U  H  nTR                  U5      v   M     g 7fNindex.0xcharss     r   	<genexpr>&_mask_cipher_secret.<locals>.<genexpr>B   s     0AQ   !c              3   F   >#    U  H  nTR                  U5      v   M     g 7fr%   r&   r(   s     r   r,   r-   B   s     2P4a5;;q>>4r.    c              3   N   >#    U  H  u  pTX-   [        T5      -     v   M     g 7fr%   )lenr)   r*   yr+   s      r   r,   r-   C   s#     CUTQUAESZ/0Us   "%)r"   r!   zipjoin)secretmaskpairscipherr+   s       @r   _mask_cipher_secretr;   ;   sF    
  !DE002P42PQEWWCUCCF=r   c                    ^ U S[          nU [         S n [        m[        U4S jU  5       U4S jU 5       5      nSR                  U4S jU 5       5      $ )z
Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt
the second half to produce the original secret.
Nc              3   F   >#    U  H  nTR                  U5      v   M     g 7fr%   r&   r(   s     r   r,   '_unmask_cipher_token.<locals>.<genexpr>P   s     /AQr.   c              3   F   >#    U  H  nTR                  U5      v   M     g 7fr%   r&   r(   s     r   r,   r>   P   s     1O$Q%++a..$r.   r0   c              3   6   >#    U  H  u  pTX-
     v   M     g 7fr%   r   r3   s      r   r,   r>   Q   s     2EDA5<Es   )r    r!   r5   r6   )tokenr8   r9   r+   s      @r   _unmask_cipher_tokenrB   G   sS     $$%D$%&EE//1O$1OPE772E222r   c                 V    [        5       nU R                  R                  USS.5        U$ )zDGenerate a new random CSRF_COOKIE value, and add it to request.META.T)CSRF_COOKIECSRF_COOKIE_NEEDS_UPDATE)r"   METAupdaterequestcsrf_secrets     r   _add_new_csrf_cookierK   T   s/    &(KLL&(,	
 r   c                     SU R                   ;   a  U R                   S   nSU R                   S'   O[        U 5      n[        U5      $ )a  
Return the CSRF token required for a POST form. The token is an
alphanumeric value. A new token is created if one is not already set.

A side effect of calling this function is to make the csrf_protect
decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
header to the outgoing response.  For this reason, you may need to use this
function lazily, as is done by the csrf context processor.
rD   TrE   )rF   rK   r;   rH   s     r   	get_tokenrM   `   sD     $ll=1 48/0*73{++r   c                     [        U 5        g)z]
Change the CSRF token in use for a request - should be done on login
for security purposes.
N)rK   )rI   s    r   rotate_tokenrO   u   s    
 !r   c                       \ rS rSrS rSrg)InvalidTokenFormat}   c                     Xl         g r%   reasonselfrU   s     r   __init__InvalidTokenFormat.__init__~       r   rT   N__name__
__module____qualname____firstlineno__rX   __static_attributes__r   r   r   rQ   rQ   }       r   rQ   c                     [        U 5      [        [        4;  a  [        [        5      e[
        R                  U 5      (       a  [        [        5      eg)z
Raise an InvalidTokenFormat error if the token has an invalid length or
characters that aren't allowed. The token argument can be a CSRF cookie
secret or non-cookie CSRF token, and either masked or unmasked.
N)r2   CSRF_TOKEN_LENGTHr    rQ   REASON_INCORRECT_LENGTHinvalid_token_chars_researchREASON_INVALID_CHARACTERS)rA   s    r   _check_token_formatrh      sE     5z+-?@@ !899$$U++ !:;; ,r   c                 ~    [        U 5      [        :X  a  [        U 5      n [        U 5      [        :X  d   e[	        X5      $ )ag  
Return whether the given CSRF token matches the given CSRF secret, after
unmasking the token if necessary.

This function assumes that the request_csrf_token argument has been
validated to have the correct length (CSRF_SECRET_LENGTH or
CSRF_TOKEN_LENGTH characters) and allowed characters, and that if it has
length CSRF_TOKEN_LENGTH, it is a masked secret.
)r2   rc   rB   r    r   )request_csrf_tokenrJ   s     r   _does_token_matchrk      s@     "3312DE!"&8888 !3AAr   c                       \ rS rSrS rSrg)RejectRequest   c                     Xl         g r%   rT   rV   s     r   rX   RejectRequest.__init__   rZ   r   rT   Nr[   r   r   r   rm   rm      ra   r   rm   c                       \ rS rSrSr\S 5       r\S 5       r\S 5       rS r	S r
S rS	 rS
 rS rS rS rS rS rS rSrg)CsrfViewMiddleware   z
Require a present and correct csrfmiddlewaretoken for POST requests that
have a CSRF cookie, and set an outgoing CSRF cookie.

This middleware should be used in conjunction with the {% csrf_token %}
template tag.
c                     [         R                   Vs/ s H'  n[        U5      R                  R	                  S5      PM)     sn$ s  snf N*)r   CSRF_TRUSTED_ORIGINSr   netloclstriprW   origins     r   csrf_trusted_origins_hosts-CsrfViewMiddleware.csrf_trusted_origins_hosts   sE     #77
7 V##**3/7
 	
 
s   .Ac                 ^    [         R                   Vs1 s H  nSU;  d  M  UiM     sn$ s  snf ru   )r   rw   rz   s     r   allowed_origins_exact(CsrfViewMiddleware.allowed_origins_exact   s*    %-%B%BX%B6cQWFW%BXXXs   
**c                     [        [        5      nS [        R                   5        H9  nXR                     R                  UR                  R                  S5      5        M;     U$ )zj
A mapping of allowed schemes to list of allowed netlocs, where all
subdomains of the netloc are allowed.
c              3   H   #    U  H  nS U;   d  M  [        U5      v   M     g7f)rv   Nr   )r)   r{   s     r   r,   ?CsrfViewMiddleware.allowed_origin_subdomains.<locals>.<genexpr>   s(      
7f} HV7s   
""rv   )r   listr   rw   schemeappendrx   ry   )rW   allowed_origin_subdomainsparseds      r   r   ,CsrfViewMiddleware.allowed_origin_subdomains   sX     %0$5!
"77
F
 &mm4;;FMM<P<PQT<UV
 )(r   c                     SUl         g )NT)csrf_processing_done)rW   rI   s     r   _acceptCsrfViewMiddleware._accept   s     (,$r   c           	      Z    [        5       " XS9n[        SUUR                  UU[        S9  U$ )NrT   zForbidden (%s): %s)responserI   logger)r   r   pathr   )rW   rI   rU   r   s       r   _rejectCsrfViewMiddleware._reject   s4    $&w> LL	
 r   c                 ^   [         R                  (       a!   UR                  R                  [        5      nO) UR                  [         R                     n[        U5        Uc  g[        U5      [        :X  a  [        U5      nU$ ! [
         a    [        S5      ef = f! [         a    Sn NKf = f)z
Return the CSRF secret originally associated with the request, or None
if it didn't have one.

If the CSRF_USE_SESSIONS setting is false, raises InvalidTokenFormat if
the request's secret has invalid characters or an invalid length.
zCSRF_USE_SESSIONS is enabled, but request.session is not set. SessionMiddleware must appear before CsrfViewMiddleware in MIDDLEWARE.N)r   CSRF_USE_SESSIONSsessiongetCSRF_SESSION_KEYAttributeErrorr   COOKIESCSRF_COOKIE_NAMErh   KeyErrorr2   rc   rB   rW   rI   rJ   s      r   _get_secretCsrfViewMiddleware._get_secret   s     %%%oo112BC1%ooh.G.GH
 $K0{00.{;K' " *%   #"#s   B B BB,+B,c                    [         R                  (       aR  UR                  R                  [        5      UR
                  S   :w  a!  UR
                  S   UR                  [        '   g g UR                  [         R                  UR
                  S   [         R                  [         R                  [         R                  [         R                  [         R                  [         R                  S9  [        US5        g )NrD   )max_agedomainr   securehttponlysamesite)Cookie)r   r   r   r   r   rF   
set_cookier   CSRF_COOKIE_AGECSRF_COOKIE_DOMAINCSRF_COOKIE_PATHCSRF_COOKIE_SECURECSRF_COOKIE_HTTPONLYCSRF_COOKIE_SAMESITEr   rW   rI   r   s      r   _set_csrf_cookie#CsrfViewMiddleware._set_csrf_cookie   s    %%""#34]8SS4;LL4O 01 T ))]+ 0022..22!66!66   	 x5r   c                   ^ UR                   S   n UR                  5       nUR                  5       (       a  SOS< SU< 3nX$:X  a  g X R                  ;   a  g [        U5      nUR                  nUR                  m[        U4S jU R                  R                  US5       5       5      $ ! [         a     Nof = f! [         a     gf = f)	NHTTP_ORIGINhttpshttpz://TFc              3   <   >#    U  H  n[        TU5      v   M     g 7fr%   r   )r)   hostrequest_netlocs     r   r,   6CsrfViewMiddleware._origin_verified.<locals>.<genexpr>$  s"      
N >400Ns   r   )rF   get_host	is_securer   r   r   
ValueErrorr   rx   anyr   r   )rW   rI   request_origin	good_hostgood_originparsed_originrequest_schemer   s          @r   _origin_verified#CsrfViewMiddleware._origin_verified  s     m4
	((*I
 #,,..F:K , -777	$^4M '--&-- 
66::>2N
 
 	
#  		  		s#   B, B< ,
B98B9<
C	C	c                 4  ^ UR                   R                  S5      mTc  [        [        5      e [	        T5      mSTR                  TR                  4;   a  [        [        5      eTR                  S:w  a  [        [        5      e[        U4S jU R                   5       5      (       a  g [        R                  (       a  [        R                  O[        R                  nUc   UR!                  5       nOUR)                  5       nUS;  a	  U< SU< 3n[+        TR                  U5      (       d   [        [$        TR'                  5       -  5      eg ! [
         a    [        [        5      ef = f! ["         a!    [        [$        TR'                  5       -  5      ef = f)NHTTP_REFERERr0   r   c              3   P   >#    U  H  n[        TR                  U5      v   M     g 7fr%   )r   rx   )r)   r   referers     r   r,   4CsrfViewMiddleware._check_referer.<locals>.<genexpr>;  s&      
7 7>>4007s   #&)44380:)rF   r   rm   REASON_NO_REFERERr   r   REASON_MALFORMED_REFERERr   rx   REASON_INSECURE_REFERERr   r|   r   r   SESSION_COOKIE_DOMAINr   r   r   REASON_BAD_REFERERgeturlget_portr   )rW   rI   good_refererserver_portr   s       @r   _check_referer!CsrfViewMiddleware._check_referer)  sq   ,,"">2? 122	:w'G
 '..'..11 899 >>W$ 788 
77
 
 
  )) **,, 	
 K&//1 "**,K-/*6Dgnnl;; 2W^^5E EFF <G  	: 899	:8 " K#$69I$IJJKs   E #E, E),+Fc                 Z    US:w  a  [         R                  " U5      nSU< S3nSU SU S3$ )NPOSTzthe z HTTP headerzCSRF token from  .)r	   parse_header_name)rW   rU   token_sourceheader_names       r   _bad_token_message%CsrfViewMiddleware._bad_token_messageV  s=    6!%77EK!+=L!,q::r   c                     U R                  U5      nUc  [        [        5      eSnUR
                  S:X  a   UR                  R                  SS5      nUS:X  a/   UR                  [        R                     n[        R                  nOSn [        U5        [!        XB5      (       d  U R                  SU5      n[        U5      eg ! [         a  n[        SUR                   S35      eS nAff = f! [         a     Nf = f! [         a    [        [        5      ef = f! [         a,  nU R                  UR                  U5      n[        U5      eS nAff = f)NzCSRF cookie r   r0   r   csrfmiddlewaretoken	incorrect)r   rQ   rm   rU   REASON_NO_CSRF_COOKIEmethodr   r   r
   rF   r   CSRF_HEADER_NAMEr   REASON_CSRF_TOKEN_MISSINGrh   r   rk   )rW   rI   rJ   excrj   r   rU   s          r   _check_tokenCsrfViewMiddleware._check_token]  sc   	>**73K    566  >>V#%,\\%5%56KR%P" #?
 &-\\(2K2K%L" $44L!L	( 23
 !!3AA,,[,GF'' BU " 	>,szzl! <==	> ' 
    ?#$=>>? " 	(,,SZZFF''	(sL   C C0 D  D 
C-C((C-0
C=<C= D
E''EEc                      U R                  U5      nUb  X!R                  S'   g g ! [         a    [        U5         g f = f)NrD   )r   rF   rQ   rK   r   s      r   process_request"CsrfViewMiddleware.process_request  sK    
	:**73K &
 /:]+ ' " 	* )	*s   & >>c                    [        USS5      (       a  g [        USS5      (       a  g UR                  S;   a  U R                  U5      $ [        USS5      (       a  U R                  U5      $ SUR                  ;   a=  U R	                  U5      (       d&  U R                  U[        UR                  S   -  5      $ O'UR                  5       (       a   U R                  U5         U R                  U5        U R                  U5      $ ! [         a%  nU R                  XR                  5      s S nA$ S nAff = f! [         a%  nU R                  XR                  5      s S nA$ S nAff = f)Nr   Fcsrf_exempt)GETHEADOPTIONSTRACE_dont_enforce_csrf_checksr   )getattrr   r   rF   r   r   REASON_BAD_ORIGINr   r   rm   rU   r   )rW   rI   callbackcallback_argscallback_kwargsr   s         r   process_viewCsrfViewMiddleware.process_view  sB   72E:: 8]E22 >>@@<<((77??
 <<(( GLL(((11||.m1LL  2   $9##G,	5g& ||G$$ ! 9||GZZ889
  	5<<44	5s<   D  D4 
D1D,&D1,D14
E#>EE#E#c                     UR                   R                  S5      (       a   U R                  X5        SUR                   S'   U$ )NrE   F)rF   r   r   r   s      r   process_response#CsrfViewMiddleware.process_response  s<    <<677!!'4 8=GLL34r   r   N)r\   r]   r^   r_   __doc__r   r|   r   r   r   r   r   r   r   r   r   r   r   r   r   r`   r   r   r   rr   rr      s     
 
 Y Y ) ) 
@6$
4+GZ;2(h:7%rr   rr   )?r   loggingstringcollectionsr   urllib.parser   django.confr   django.core.exceptionsr   r   django.httpr	   r
   django.urlsr   django.utils.cacher   django.utils.cryptor   r   django.utils.deprecationr   django.utils.functionalr   django.utils.httpr   django.utils.logr   django.utils.regex_helperr   	getLoggerr   re   r   r   r   r   r   r   r   rd   rg   r    rc   ascii_lettersdigitsr!   r   r   r"   r;   rB   rK   rM   rO   	ExceptionrQ   rh   rk   rm   rr   r   r   r   <module>r     s     # !   G 8 $ 1 H 4 3 , ) 6			1	2).9 U ; W . 1 L I  1 4  ** ))FMM9  4
S	
3	,*" 

<B"I 
~ ~r   