B 0H[W@sddlmZddlmZmZmZdZdZedddZed d dZ ed d dZ ed ddZ edddZ edddZ edddZedeedddZedddZedddZedddZedddZd d!Zd"d#Zeejd$d%d&d'Zeejd$d%d(d)Zeejd$d%d*d+Zeejd$d%d,d-Zeejd$d%d.d/Zeejd$d%d0d1Zeejd$d%d2d3Zeejd$d%d4d5Zeejd$d%d6d7Zeejd$d%d8d9Z eejd$d%d:d;Z!eejd$d%dS)?)settings)TagsWarningregister2zYou do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_BROWSER_XSS_FILTER, and SECURE_SSL_REDIRECT settings will have no effect.z security.W001)ida3You do not have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, so your pages will not be served with an 'x-frame-options' header. Unless there is a good reason for your site to be served in a frame, you should consider enabling this header to help prevent clickjacking attacks.z security.W002a,You have not set a value for the SECURE_HSTS_SECONDS setting. If your entire site is served only over SSL, you may want to consider setting a value and enabling HTTP Strict Transport Security. Be sure to read the documentation first; enabling HSTS carelessly can cause serious, irreversible problems.z security.W004aYou have not set the SECURE_HSTS_INCLUDE_SUBDOMAINS setting to True. Without this, your site is potentially vulnerable to attack via an insecure connection to a subdomain. Only set this to True if you are certain that all subdomains of your domain should be served exclusively via SSL.z security.W005zYour SECURE_CONTENT_TYPE_NOSNIFF setting is not set to True, so your pages will not be served with an 'x-content-type-options: nosniff' header. You should consider enabling this header to prevent the browser from identifying content types incorrectly.z security.W006zYour SECURE_BROWSER_XSS_FILTER setting is not set to True, so your pages will not be served with an 'x-xss-protection: 1; mode=block' header. You should consider enabling this header to activate the browser's XSS filtering and help prevent XSS attacks.z security.W007aYour SECURE_SSL_REDIRECT setting is not set to True. Unless your site should be available over both SSL and non-SSL connections, you may want to either set this setting True or configure a load balancer or reverse-proxy server to redirect all connections to HTTPS.z security.W008zYour SECRET_KEY has less than %(min_length)s characters or less than %(min_unique_chars)s unique characters. Please generate a long and random SECRET_KEY, otherwise many of Django's security-critical features will be vulnerable to attack.)Z min_lengthZmin_unique_charsz security.W009z4You should not have DEBUG set to True in deployment.z security.W018aYou have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, but X_FRAME_OPTIONS is not set to 'DENY'. The default is 'SAMEORIGIN', but unless there is a good reason for your site to serve other parts of itself in a frame, you should change it to 'DENY'.z security.W019z.ALLOWED_HOSTS must not be empty in deployment.z security.W020zYou have not set the SECURE_HSTS_PRELOAD setting to True. Without this, your site cannot be submitted to the browser preload list.z security.W021cCs dtjkS)Nz-django.middleware.security.SecurityMiddleware)r MIDDLEWAREr r dC:\Users\HIRONO~1\AppData\Local\Temp\pip-install-6bm3nxem\django\django\core\checks\security\base.py_security_middlewarensr cCs dtjkS)Nz6django.middleware.clickjacking.XFrameOptionsMiddleware)rr r r r r _xframe_middlewarersrT)ZdeploycKst}|rgStgS)N)r W001) app_configskwargs passed_checkr r r check_security_middlewarevsrcKst}|rgStgS)N)rW002)rrrr r r check_xframe_options_middleware|srcKst p tj}|rgStgS)N)r rSECURE_HSTS_SECONDSW004)rrrr r r check_stssrcKs(t ptj ptjdk}|r"gStgS)NT)r rrZSECURE_HSTS_INCLUDE_SUBDOMAINSW005)rrrr r r check_sts_include_subdomainss rcKs(t ptj ptjdk}|r"gStgS)NT)r rrZSECURE_HSTS_PRELOADW021)rrrr r r check_sts_preloads rcKs t ptjdk}|rgStgS)NT)r rZSECURE_CONTENT_TYPE_NOSNIFFW006)rrrr r r check_content_type_nosniffs rcKs t ptjdk}|rgStgS)NT)r rZSECURE_BROWSER_XSS_FILTERW007)rrrr r r check_xss_filters r cKs t ptjdk}|rgStgS)NT)r rZSECURE_SSL_REDIRECTW008)rrrr r r check_ssl_redirects r"cKs:ttddo*tttjtko*ttjtk}|r4gStgS)N SECRET_KEY)getattrrlensetr# SECRET_KEY_MIN_UNIQUE_CHARACTERSSECRET_KEY_MIN_LENGTHW009)rrrr r r check_secret_keys r*cKstj }|rgStgS)N)rDEBUGW018)rrrr r r check_debugsr-cKs t ptjdk}|rgStgS)NZDENY)rrZX_FRAME_OPTIONSW019)rrrr r r check_xframe_denys r/cKstjr gStgS)N)rZ ALLOWED_HOSTSW020)rrr r r check_allowed_hostssr1N)#Z django.confrrrrr(r'rrrrrrr!r)r,r.r0rr rsecurityrrrrrrr r"r*r-r/r1r r r r sn