
    h5                     `   d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	m
Z
 ddlmZ ddlmZ ddlmZmZ dd	lmZ dd
lmZ ddlmZ  ej0                  d      ZdZdZdZdZdZdZdZ de z  Z!ejD                  ejF                  z   Z$dZ%d Z&d Z'd Z(d Z)d Z*d Z+d Z,d Z-d Z. G d d e      Z/y)!z
Cross Site Request Forgery Middleware.

This module provides a middleware that implements protection
against request forgeries from other sites.
    N)urlparse)settings)DisallowedHostImproperlyConfigured)get_callable)patch_vary_headers)constant_time_compareget_random_string)MiddlewareMixin)is_same_domain)log_responsezdjango.security.csrfz%Referer checking failed - no Referer.z@Referer checking failed - %s does not match any trusted origins.zCSRF cookie not set.z CSRF token missing or incorrect.z/Referer checking failed - Referer is malformed.zCReferer checking failed - Referer is insecure while host is secure.       
_csrftokenc                  4    t        t        j                        S )z/Return the view to be used for CSRF rejections.)r   r   CSRF_FAILURE_VIEW     Y/var/www/html/ranktracker/api/venv/lib/python3.12/site-packages/django/middleware/csrf.py_get_failure_viewr   $   s    2233r   c                  ,    t        t        t              S )N)allowed_chars)r
   CSRF_SECRET_LENGTHCSRF_ALLOWED_CHARSr   r   r   _get_new_csrf_stringr   )   s    /?QRRr   c                     t               }t        t        fd| D        fd|D              }dj                  fd|D              }||z   S )z
    Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
    token by adding a mask and applying it to the secret.
    c              3   @   K   | ]  }j                  |        y wNindex.0xcharss     r   	<genexpr>z&_mask_cipher_secret.<locals>.<genexpr>4   s     0AQ0   c              3   @   K   | ]  }j                  |        y wr   r   r!   s     r   r%   z&_mask_cipher_secret.<locals>.<genexpr>4   s     2Pa5;;q>2Pr&    c              3   L   K   | ]  \  }}||z   t              z       y wr   )lenr"   r#   yr$   s      r   r%   z&_mask_cipher_secret.<locals>.<genexpr>5   s'     CTQUAESZ/0Cs   !$)r   r   zipjoin)secretmaskpairscipherr$   s       @r   _mask_cipher_secretr3   -   sH    
  !DE002P42PQEWWCUCCF&=r   c                     | dt          }| t         d } t        t        fd| D        fd|D              }dj                  fd|D              S )z
    Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
    CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt
    the second half to produce the original secret.
    Nc              3   @   K   | ]  }j                  |        y wr   r   r!   s     r   r%   z'_unmask_cipher_token.<locals>.<genexpr>B   s     /AQ/r&   c              3   @   K   | ]  }j                  |        y wr   r   r!   s     r   r%   z'_unmask_cipher_token.<locals>.<genexpr>B   s     1OQ%++a.1Or&   r(   c              3   4   K   | ]  \  }}||z
       y wr   r   r+   s      r   r%   z'_unmask_cipher_token.<locals>.<genexpr>C   s     2DAq5Q<2s   )r   r   r-   r.   )tokenr0   r1   r$   s      @r   _unmask_cipher_tokenr9   9   sS     $$%D$%&EE//1O$1OPE772E222r   c                  (    t        t                     S r   )r3   r   r   r   r   _get_new_csrf_tokenr;   F   s    3566r   c                     d| j                   vr#t               }t        |      | j                   d<   nt        | j                   d         }d| j                   d<   t        |      S )a  
    Return the CSRF token required for a POST form. The token is an
    alphanumeric value. A new token is created if one is not already set.

    A side effect of calling this function is to make the csrf_protect
    decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
    header to the outgoing response.  For this reason, you may need to use this
    function lazily, as is done by the csrf context processor.
    CSRF_COOKIETCSRF_COOKIE_USED)METAr   r3   r9   )requestcsrf_secrets     r   	get_tokenrB   J   sX     GLL(*,&9+&F]#*7<<+FG'+GLL#${++r   c                 ^    | j                   j                  dt               d       d| _        y)zi
    Change the CSRF token in use for a request - should be done on login
    for security purposes.
    T)r>   r=   N)r?   updater;   csrf_cookie_needs_reset)r@   s    r   rotate_tokenrF   ]   s.    
 LL *,  '+G#r   c                     t        j                  d|       r
t               S t        |       t        k(  r| S t        |       t
        k(  rt        |       S t               S )Nz[^a-zA-Z0-9])researchr;   r*   CSRF_TOKEN_LENGTHr   r3   )r8   s    r   _sanitize_tokenrK   i   sN    	yy'"$$	U(	(	U)	) #5))  r   c                 >    t        t        |       t        |            S r   )r	   r9   )request_csrf_token
csrf_tokens     r   _compare_masked_tokensrO   z   s"     !/0Z( r   c                   :    e Zd ZdZd Zd Zd Zd Zd Zd Z	d Z
y	)
CsrfViewMiddlewarez
    Require a present and correct csrfmiddlewaretoken for POST requests that
    have a CSRF cookie, and set an outgoing CSRF cookie.

    This middleware should be used in conjunction with the {% csrf_token %}
    template tag.
    c                     d|_         y )NT)csrf_processing_done)selfr@   s     r   _acceptzCsrfViewMiddleware._accept   s     (,$r   c                 h     t               ||      }t        d||j                  ||t               |S )N)reasonzForbidden (%s): %s)responser@   logger)r   r   pathrY   )rT   r@   rW   rX   s       r   _rejectzCsrfViewMiddleware._reject   s7    &$&wv> &',,		
 r   c                    t         j                  r 	 |j                  j                  t              S 	 |j                  t         j                     }t        |      }||k7  rd|_        |S # t
        $ r t        d      w xY w# t        $ r Y y w xY w)NzCSRF_USE_SESSIONS is enabled, but request.session is not set. SessionMiddleware must appear before CsrfViewMiddleware in MIDDLEWARE.T)r   CSRF_USE_SESSIONSsessiongetCSRF_SESSION_KEYAttributeErrorr   COOKIESCSRF_COOKIE_NAMEKeyErrorrK   rE   )rT   r@   cookie_tokenrN   s       r   
_get_tokenzCsrfViewMiddleware._get_token   s    %%**+;<<&x/H/HI )6J\) 37/# " *%   s   A( B  (A= 	BBc           
         t         j                  rQ|j                  j                  t              |j
                  d   k7  r!|j
                  d   |j                  t        <   y y |j                  t         j                  |j
                  d   t         j                  t         j                  t         j                  t         j                  t         j                  t         j                         t        |d       y )Nr=   )max_agedomainrZ   securehttponlysamesite)Cookie)r   r]   r^   r_   r`   r?   
set_cookierc   CSRF_COOKIE_AGECSRF_COOKIE_DOMAINCSRF_COOKIE_PATHCSRF_COOKIE_SECURECSRF_COOKIE_HTTPONLYCSRF_COOKIE_SAMESITEr   rT   r@   rX   s      r   
_set_tokenzCsrfViewMiddleware._set_token   s    %%""#34]8SS4;LL4O 01 T ))]+ 0022..22!66!66   	 x5r   c                 J    | j                  |      }|||j                  d<   y y )Nr=   )rf   r?   )rT   r@   rN   s      r   process_requestz"CsrfViewMiddleware.process_request   s)    __W-
!*4GLL' "r   c                 4   t        |dd      ry t        |dd      ry |j                  dvr=t        |dd      r| j                  |      S |j                         r[|j                  j                  d      | j                  |t              S t              dj                  j                  fv r| j                  |t              S j                  dk7  r| j                  |t              S t        j                  rt        j                  nt        j                   }||j#                         }|d	vr|d
|}n	 |j%                         }t)        t        j*                        }||j-                  |       t/        fd|D              s)t0        j3                         z  }| j                  ||      S | j5                  |      }	|	| j                  |t6              S d}
|j                  dk(  r	 |j8                  j                  dd      }
|
dk(  r*|j                  j                  t        j<                  d      }
t?        |
      }
tA        |
|	      s| j                  |tB              S | j                  |      S # t&        $ r Y 9w xY w# t:        $ r Y w xY w)NrS   Fcsrf_exempt)GETHEADOPTIONSTRACE_dont_enforce_csrf_checksHTTP_REFERERr(   https)44380:c              3   J   K   | ]  }t        j                  |        y wr   )r   netloc)r"   hostreferers     r   r%   z2CsrfViewMiddleware.process_view.<locals>.<genexpr>  s     WD>'..$?Ws    #POSTcsrfmiddlewaretoken)"getattrmethodrU   	is_securer?   r_   r[   REASON_NO_REFERERr   schemer   REASON_MALFORMED_REFERERREASON_INSECURE_REFERERr   r]   SESSION_COOKIE_DOMAINrp   get_portget_hostr   listCSRF_TRUSTED_ORIGINSappendanyREASON_BAD_REFERERgeturlrf   REASON_NO_CSRF_COOKIEr   OSErrorCSRF_HEADER_NAMErK   rO   REASON_BAD_TOKEN)rT   r@   callbackcallback_argscallback_kwargsgood_refererserver_port
good_hostsrW   rN   rM   r   s              @r   process_viewzCsrfViewMiddleware.process_view   sz   72E: 8]E2 >>!DDw ;UC ||G,,  "  ",,**>:?<<1BCC"7+ '..'..99<<1IJJ >>W,<<1HII  11 22!44 
  +")"2"2"4K"-72>'L'.'7'7'9 "("?"?@
+%%l3WJWW/'..2BBF<<88
 1J! ||G-BCC "$~~')0)9)9:OQS)T& "R' &-\\%5%5h6O6OQS%T"!01C!D)*<jI||G-=>>||G$$[ * 8   s$   >I; 2J ;	JJ	JJc                     t        |dd      st        |dd      r|S |j                  j                  dd      s|S | j                  ||       d|_        |S )NrE   Fcsrf_cookie_setr>   T)r   r?   r_   rv   r   ru   s      r   process_responsez#CsrfViewMiddleware.process_response=  sX    w 95Ax!2E:|| 2E:O 	*#' r   N)__name__
__module____qualname____doc__rU   r[   rf   rv   rx   r   r   r   r   r   rQ   rQ      s,    .6$5n%`r   rQ   )0r   loggingrH   stringurllib.parser   django.confr   django.core.exceptionsr   r   django.urlsr   django.utils.cacher   django.utils.cryptor	   r
   django.utils.deprecationr   django.utils.httpr   django.utils.logr   	getLoggerrY   r   r   r   r   r   r   r   rJ   ascii_lettersdigitsr   r`   r   r   r3   r9   r;   rB   rF   rK   rO   rQ   r   r   r   <module>r      s     	  !   G $ 1 H 4 , )			1	2; W . 5 L _  ** ))FMM9  4
S	
37,&	+!"F Fr   