B
    ª0H[34  ã               @   s  d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZ ddlmZ ddlmZmZ dd	lmZ dd
lmZ e d¡ZdZdZdZdZdZdZdZde Zejej  Z!dZ"dd„ Z#dd„ Z$dd„ Z%dd„ Z&dd„ Z'dd „ Z(d!d"„ Z)d#d$„ Z*d%d&„ Z+G d'd(„ d(eƒZ,dS ))z’
Cross Site Request Forgery Middleware.

This module provides a middleware that implements protection
against request forgeries from other sites.
é    N)Úurlparse)Úsettings)ÚImproperlyConfigured)Úget_callable)Úpatch_vary_headers)Úconstant_time_compareÚget_random_string)ÚMiddlewareMixin)Úis_same_domainzdjango.security.csrfz%Referer checking failed - no Referer.z@Referer checking failed - %s does not match any trusted origins.zCSRF cookie not set.z CSRF token missing or incorrect.z/Referer checking failed - Referer is malformed.zCReferer checking failed - Referer is insecure while host is secure.é    é   Z
_csrftokenc               C   s
   t tjƒS )z/Return the view to be used for CSRF rejections.)r   r   ZCSRF_FAILURE_VIEW© r   r   úZC:\Users\HIRONO~1\AppData\Local\Temp\pip-install-6bm3nxem\django\django\middleware\csrf.pyÚ_get_failure_view#   s    r   c               C   s   t ttd�S )N)Úallowed_chars)r   ÚCSRF_SECRET_LENGTHÚCSRF_ALLOWED_CHARSr   r   r   r   Ú_get_new_csrf_string(   s    r   c                sP   t ƒ }t‰ t‡ fdd„| D ƒ‡ fdd„|D ƒƒ}d ‡ fdd„|D ƒ¡}|| S )z’
    Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
    token by adding a salt and using it to encrypt the secret.
    c             3   s   | ]}ˆ   |¡V  qd S )N)Úindex)Ú.0Úx)Úcharsr   r   ú	<genexpr>3   s    z&_salt_cipher_secret.<locals>.<genexpr>Ú c             3   s&   | ]\}}ˆ || t ˆ ƒ  V  qd S )N)Úlen)r   r   Úy)r   r   r   r   4   s    )r   r   ÚzipÚjoin)ÚsecretÚsaltÚpairsÚcipherr   )r   r   Ú_salt_cipher_secret,   s
    &r"   c                s^   | dt … }| t d… } t‰ t‡ fdd„| D ƒ‡ fdd„|D ƒƒ}d ‡ fdd„|D ƒ¡}|S )zÑ
    Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
    CSRF_TOKEN_LENGTH, and that its first half is a salt), use it to decrypt
    the second half to produce the original secret.
    Nc             3   s   | ]}ˆ   |¡V  qd S )N)r   )r   r   )r   r   r   r   A   s    z'_unsalt_cipher_token.<locals>.<genexpr>r   c             3   s   | ]\}}ˆ ||  V  qd S )Nr   )r   r   r   )r   r   r   r   B   s    )r   r   r   r   )Útokenr   r    r   r   )r   r   Ú_unsalt_cipher_token8   s    &r$   c               C   s
   t tƒ ƒS )N)r"   r   r   r   r   r   Ú_get_new_csrf_tokenF   s    r%   c             C   s@   d| j kr tƒ }t|ƒ| j d< nt| j d ƒ}d| j d< t|ƒS )aº  
    Return the CSRF token required for a POST form. The token is an
    alphanumeric value. A new token is created if one is not already set.

    A side effect of calling this function is to make the csrf_protect
    decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
    header to the outgoing response.  For this reason, you may need to use this
    function lazily, as is done by the csrf context processor.
    ÚCSRF_COOKIETÚCSRF_COOKIE_USED)ÚMETAr   r"   r$   )ÚrequestZcsrf_secretr   r   r   Ú	get_tokenJ   s    


r*   c             C   s   | j  dtƒ dœ¡ d| _dS )zi
    Change the CSRF token in use for a request - should be done on login
    for security purposes.
    T)r'   r&   N)r(   Úupdater%   Úcsrf_cookie_needs_reset)r)   r   r   r   Úrotate_token]   s    r-   c             C   s<   t  d| ¡rtƒ S t| ƒtkr"| S t| ƒtkr6t| ƒS tƒ S )Nz[^a-zA-Z0-9])ÚreÚsearchr%   r   ÚCSRF_TOKEN_LENGTHr   r"   )r#   r   r   r   Ú_sanitize_tokeni   s    r1   c             C   s   t t| ƒt|ƒƒS )N)r   r$   )Úrequest_csrf_tokenÚ
csrf_tokenr   r   r   Ú_compare_salted_tokensz   s    r4   c               @   sH   e Zd ZdZdd„ Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Z	dd„ Z
dS )ÚCsrfViewMiddlewarezê
    Require a present and correct csrfmiddlewaretoken for POST requests that
    have a CSRF cookie, and set an outgoing CSRF cookie.

    This middleware should be used in conjunction with the {% csrf_token %}
    template tag.
    c             C   s
   d|_ d S )NT)Úcsrf_processing_done)Úselfr)   r   r   r   Ú_accept�   s    zCsrfViewMiddleware._acceptc             C   s(   t jd||jd|dœd� tƒ ||d�S )NzForbidden (%s): %si“  )Ústatus_coder)   )Úextra)Úreason)ÚloggerÚwarningÚpathr   )r7   r)   r;   r   r   r   Ú_reject”   s
    zCsrfViewMiddleware._rejectc             C   sˆ   t jrDy|j t¡S  tk
r@   tdt jd kr4dnd ƒ‚Y q„X n@y|jt j	 }W n t
k
rh   d S X t|ƒ}||kr€d|_|S d S )Nz†CSRF_USE_SESSIONS is enabled, but request.session is not set. SessionMiddleware must appear before CsrfViewMiddleware in MIDDLEWARE%s.Z_CLASSESr   T)r   ÚCSRF_USE_SESSIONSÚsessionÚgetÚCSRF_SESSION_KEYÚAttributeErrorr   Z
MIDDLEWAREZCOOKIESÚCSRF_COOKIE_NAMEÚKeyErrorr1   r,   )r7   r)   Zcookie_tokenr3   r   r   r   Ú
_get_tokenž   s    zCsrfViewMiddleware._get_tokenc          	   C   sP   t jr|jd |jt< n4|jt j|jd t jt jt j	t j
t jd� t|dƒ d S )Nr&   )Zmax_ageÚdomainr>   ÚsecureÚhttponly)ÚCookie)r   r@   r(   rA   rC   Ú
set_cookierE   ZCSRF_COOKIE_AGEÚCSRF_COOKIE_DOMAINZCSRF_COOKIE_PATHZCSRF_COOKIE_SECUREZCSRF_COOKIE_HTTPONLYr   )r7   r)   Úresponser   r   r   Ú
_set_tokenµ   s    
zCsrfViewMiddleware._set_tokenc             C   s    |   |¡}|d k	r||jd< d S )Nr&   )rG   r(   )r7   r)   r3   r   r   r   Úprocess_requestÅ   s    
z"CsrfViewMiddleware.process_requestc                sÊ  t |ddƒrd S t |ddƒr d S |jdk�rÀt |ddƒrB|  |¡S | ¡ �r*|j d¡‰ ˆ d krl|  |t¡S tˆ ƒ‰ dˆ j	ˆ j
fkr�|  |t¡S ˆ j	dkr¦|  |t¡S tjr²tjntj}|d k	rÞ| ¡ }|d	kræd
||f }n| ¡ }ttjƒ}| |¡ t‡ fdd„|D ƒƒ�s*tˆ  ¡  }|  ||¡S |j d¡}	|	d k�rL|  |t¡S d}
|jdk�r†y|j dd¡}
W n tk
�r„   Y nX |
dk�r |j tjd¡}
t|
ƒ}
t|
|	ƒ�sÀ|  |t¡S |  |¡S )Nr6   FZcsrf_exempt)ÚGETÚHEADÚOPTIONSÚTRACEZ_dont_enforce_csrf_checksZHTTP_REFERERr   Úhttps)Z443Ú80z%s:%sc             3   s   | ]}t ˆ j|ƒV  qd S )N)r
   Únetloc)r   Úhost)Úrefererr   r   r     s    z2CsrfViewMiddleware.process_view.<locals>.<genexpr>r&   ÚPOSTZcsrfmiddlewaretoken) ÚgetattrÚmethodr8   Z	is_securer(   rB   r?   ÚREASON_NO_REFERERr   ÚschemerW   ÚREASON_MALFORMED_REFERERÚREASON_INSECURE_REFERERr   r@   ZSESSION_COOKIE_DOMAINrM   Zget_portÚget_hostÚlistZCSRF_TRUSTED_ORIGINSÚappendÚanyÚREASON_BAD_REFERERÚgeturlÚREASON_NO_CSRF_COOKIErZ   ÚIOErrorZCSRF_HEADER_NAMEr1   r4   ÚREASON_BAD_TOKEN)r7   r)   ÚcallbackÚcallback_argsÚcallback_kwargsZgood_refererZserver_portZ
good_hostsr;   r3   r2   r   )rY   r   Úprocess_viewË   sV    






zCsrfViewMiddleware.process_viewc             C   sD   t |ddƒst |ddƒr|S |j dd¡s.|S |  ||¡ d|_|S )Nr,   FÚcsrf_cookie_setr'   T)r[   r(   rB   rO   rn   )r7   r)   rN   r   r   r   Úprocess_response5  s    z#CsrfViewMiddleware.process_responseN)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r8   r?   rG   rO   rP   rm   ro   r   r   r   r   r5   ƒ   s   
jr5   )-rs   Úloggingr.   ÚstringÚurllib.parser   Zdjango.confr   Zdjango.core.exceptionsr   Zdjango.urlsr   Zdjango.utils.cacher   Zdjango.utils.cryptor   r   Zdjango.utils.deprecationr	   Zdjango.utils.httpr
   Ú	getLoggerr<   r]   re   rg   ri   r_   r`   r   r0   Úascii_lettersÚdigitsr   rC   r   r   r"   r$   r%   r*   r-   r1   r4   r5   r   r   r   r   Ú<module>   s@   
	