File manager - Edit - /home/newsbmcs.com/public_html/static/img/logo/middleware.tar
Back
__pycache__/locale.cpython-310.pyc 0000644 00000004501 15030465023 0012712 0 ustar 00 o �hr � @ sl d dl mZ d dlmZ d dlmZ d dlmZmZ d dl m Z d dl m Z d dl mZ G dd � d e�Zd S ) � )�settings)� is_language_prefix_patterns_used)�HttpResponseRedirect)�get_script_prefix� is_valid_path)� translation)�patch_vary_headers)�MiddlewareMixinc @ s$ e Zd ZdZeZdd� Zdd� ZdS )�LocaleMiddlewarez� Parse a request and decide what translation object to install in the current thread context. This allows pages to be dynamically translated to the language the user desires (if the language is available). c C s^ t |dtj�}t|�\}}tj||d�}t�|j�}|s#|r#|s#tj}t� |� t� � |_d S )N�urlconf)� check_path) �getattrr � ROOT_URLCONFr r �get_language_from_request�get_language_from_path� path_info� LANGUAGE_CODE�activate� get_language)�self�requestr �i18n_patterns_used�prefixed_default_language�language�language_from_path� r �K/usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/locale.py�process_request s$ �� ��� z LocaleMiddleware.process_requestc C s� t �� }t �|j�}t|dtj�}t|�\}}|jdkrc|sc|rc|rcd||jf }t ||�} | o@tj o@|� d� o@t d| |�} | sE| rct � } |j | d��| d| |f d�} | �| �} t| d � | S |rg|slt|d � |j�d |� |S ) Nr i� z/%s%s�/z%s/)�force_append_slashz%s%s/� )�Accept-Language�Cookie)r! zContent-Language)r r r r r r r r � status_coder � APPEND_SLASH�endswithr � get_full_path�replace�response_redirect_classr �headers� setdefault)r r �responser r r r r � language_path� path_valid�path_needs_slash� script_prefix� language_url�redirectr r r �process_response& sH � ��� � ��� z!LocaleMiddleware.process_responseN)�__name__� __module__� __qualname__�__doc__r r( r r2 r r r r r s r N)� django.confr �django.conf.urls.i18nr � django.httpr � django.urlsr r � django.utilsr �django.utils.cacher �django.utils.deprecationr r r r r r �<module> s __pycache__/__init__.cpython-310.pyc 0000644 00000000252 15030465023 0013211 0 ustar 00 o �h � @ s d S )N� r r r �M/usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/__init__.py�<module> s __pycache__/security.cpython-310.pyc 0000644 00000005231 15030465023 0013323 0 ustar 00 o �h' � @ s@ d dl Z d dlmZ d dlmZ d dlmZ G dd� de�ZdS )� N)�settings)� HttpResponsePermanentRedirect)�MiddlewareMixinc s, e Zd Z� fdd�Zdd� Zdd� Z� ZS )�SecurityMiddlewarec sb t � �|� tj| _tj| _tj| _tj | _ tj | _ tj | _dd� tjD �| _tj| _tj| _d S )Nc S s g | ]}t �|��qS � )�re�compile)�.0�rr r �M/usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/security.py� <listcomp> s z/SecurityMiddleware.__init__.<locals>.<listcomp>)�super�__init__r �SECURE_HSTS_SECONDS� sts_seconds� SECURE_HSTS_INCLUDE_SUBDOMAINS�sts_include_subdomains�SECURE_HSTS_PRELOAD� sts_preload�SECURE_CONTENT_TYPE_NOSNIFF�content_type_nosniff�SECURE_SSL_REDIRECT�redirect�SECURE_SSL_HOST� redirect_host�SECURE_REDIRECT_EXEMPT�redirect_exempt�SECURE_REFERRER_POLICY�referrer_policy�!SECURE_CROSS_ORIGIN_OPENER_POLICY�cross_origin_opener_policy)�self� get_response�� __class__r r r s zSecurityMiddleware.__init__c s` |j �d�� | jr*|�� s,t� fdd�| jD ��s.| jp |�� }td||� � f �S d S d S d S )N�/c 3 s � | ]}|� � �V qd S )N)�search)r �pattern��pathr r � <genexpr> s � z5SecurityMiddleware.process_request.<locals>.<genexpr>z https://%s%s) r) �lstripr � is_secure�anyr r �get_hostr � get_full_path)r! �request�hostr r( r �process_request s ���� �z"SecurityMiddleware.process_requestc C s� | j r#|�� r#d|vr#d| j }| jr|d7 }| jr |d7 }||jd< | jr-|j�dd� | jrL|j�dd�t | jt �rGd d � | j� d�D �n| j�� | j rV|�d | j � |S ) NzStrict-Transport-Securityz max-age=%sz; includeSubDomainsz ; preloadzX-Content-Type-Options�nosniffzReferrer-Policy�,c S s g | ]}|� � �qS r )�strip)r �vr r r r 7 s z7SecurityMiddleware.process_response.<locals>.<listcomp>zCross-Origin-Opener-Policy) r r, r r �headersr � setdefaultr �join� isinstance�str�splitr )r! r0 �response� sts_headerr r r �process_response! s8 �� ��� �z#SecurityMiddleware.process_response)�__name__� __module__� __qualname__r r2 r? � __classcell__r r r# r r s r )r � django.confr � django.httpr �django.utils.deprecationr r r r r r �<module> s __pycache__/csrf.cpython-310.pyc 0000644 00000032654 15030465023 0012422 0 ustar 00 o �h M � @ s� d Z ddlZddlZddlmZ ddlmZ ddlmZ ddl m Z m Z ddl m Z mZ ddlmZ dd lmZ dd lmZmZ dd lmZ dd lmZ dd lmZ ddl m Z ddl m Z e� d�Z!e d�Z"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,d e, Z-ej.ej/ Z0d Z1d d � Z2d d!� Z3d"d#� Z4d$d%� Z5d&d'� Z6d(d)� Z7d*d+� Z8G d,d-� d-e9�Z:d.d/� Z;d0d1� Z<G d2d3� d3e9�Z=G d4d5� d5e�Z>dS )6z� Cross Site Request Forgery Middleware. This module provides a middleware that implements protection against request forgeries from other sites. � N)� defaultdict��urlparse)�settings)�DisallowedHost�ImproperlyConfigured)� HttpHeaders�UnreadablePostError)� get_callable)�patch_vary_headers)�constant_time_compare�get_random_string)�MiddlewareMixin)�cached_property��is_same_domain)� log_response)�_lazy_re_compilezdjango.security.csrfz [^a-zA-Z0-9]z?Origin checking failed - %s does not match any trusted origins.z%Referer checking failed - no Referer.z@Referer checking failed - %s does not match any trusted origins.zCSRF cookie not set.zCSRF token missing.z/Referer checking failed - Referer is malformed.zCReferer checking failed - Referer is insecure while host is secure.zhas incorrect lengthzhas invalid characters� � � _csrftokenc C s t tj�S )z/Return the view to be used for CSRF rejections.)r r �CSRF_FAILURE_VIEW� r r �I/usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/csrf.py�_get_failure_view1 s r c C s t ttd�S )N)� allowed_chars)r �CSRF_SECRET_LENGTH�CSRF_ALLOWED_CHARSr r r r �_get_new_csrf_string6 s r c sP t � }t� t� fdd�| D �� fdd�|D ��}d�� fdd�|D ��}|| S )z� Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a token by adding a mask and applying it to the secret. c 3 � � | ]}� � |�V qd S �N��index��.0�x��charsr r � <genexpr>A � � z&_mask_cipher_secret.<locals>.<genexpr>� c 3 s( � | ]\}}� || t � � V qd S r )�len�r$ r% �yr& r r r( B s �& )r r �zip�join)�secret�mask�pairs�cipherr r& r �_mask_cipher_secret: s &r4 c sZ | dt � }| t d� } t� t� fdd�| D �� fdd�|D ��}d�� fdd�|D ��S )z� Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt the second half to produce the original secret. Nc 3 r r r! r# r& r r r( O r) z'_unmask_cipher_token.<locals>.<genexpr>r* c 3 s � | ] \}}� || V qd S r r r, r& r r r( P s � )r r r. r/ )�tokenr1 r2 r r& r �_unmask_cipher_tokenF s &r6 c C s* t � }| j�tjr t|�n|dd�� |S )zDGenerate a new random CSRF_COOKIE value, and add it to request.META.T)� CSRF_COOKIE�CSRF_COOKIE_NEEDS_UPDATE)r �META�updater �CSRF_COOKIE_MASKEDr4 ��request� csrf_secretr r r �_add_new_csrf_cookieS s ��� r? c C s6 d| j v r| j d }d| j d< t|�S t| �}t|�S )a� Return the CSRF token required for a POST form. The token is an alphanumeric value. A new token is created if one is not already set. A side effect of calling this function is to make the csrf_protect decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie' header to the outgoing response. For this reason, you may need to use this function lazily, as is done by the csrf context processor. r7 Tr8 )r9 r? r4 r< r r r � get_tokene s �r@ c C s t | � dS )zi Change the CSRF token in use for a request - should be done on login for security purposes. N)r? )r= r r r � rotate_tokenz s rA c @ � e Zd Zdd� ZdS )�InvalidTokenFormatc C � || _ d S r ��reason��selfrF r r r �__init__� � zInvalidTokenFormat.__init__N��__name__� __module__� __qualname__rI r r r r rC � � rC c C s. t | �ttfvr tt��t�| �rtt��dS )z� Raise an InvalidTokenFormat error if the token has an invalid length or characters that aren't allowed. The token argument can be a CSRF cookie secret or non-cookie CSRF token, and either masked or unmasked. N)r+ �CSRF_TOKEN_LENGTHr rC �REASON_INCORRECT_LENGTH�invalid_token_chars_re�search�REASON_INVALID_CHARACTERS)r5 r r r �_check_token_format� s �rU c C s. t | �tkr t| �} t | �tksJ �t| |�S )a� Return whether the given CSRF token matches the given CSRF secret, after unmasking the token if necessary. This function assumes that the request_csrf_token argument has been validated to have the correct length (CSRF_SECRET_LENGTH or CSRF_TOKEN_LENGTH characters) and allowed characters, and that if it has length CSRF_TOKEN_LENGTH, it is a masked secret. )r+ rP r6 r r )�request_csrf_tokenr> r r r �_does_token_match� s rW c @ rB )� RejectRequestc C rD r rE rG r r r rI � rJ zRejectRequest.__init__NrK r r r r rX � rO rX c @ s� e Zd ZdZedd� �Zedd� �Zedd� �Zdd � Zd d � Z d d � Z dd� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zd d � Zd S ) �CsrfViewMiddlewarez� Require a present and correct csrfmiddlewaretoken for POST requests that have a CSRF cookie, and set an outgoing CSRF cookie. This middleware should be used in conjunction with the {% csrf_token %} template tag. c C � dd� t jD �S )Nc S s g | ] }t |�j�d ��qS ��*)r �netloc�lstrip�r$ �originr r r � <listcomp>� s ��zACsrfViewMiddleware.csrf_trusted_origins_hosts.<locals>.<listcomp>�r �CSRF_TRUSTED_ORIGINS�rH r r r �csrf_trusted_origins_hosts� s �z-CsrfViewMiddleware.csrf_trusted_origins_hostsc C rZ )Nc S s h | ]}d |vr|�qS r[ r r_ r r r � <setcomp>� s z;CsrfViewMiddleware.allowed_origins_exact.<locals>.<setcomp>rb rd r r r �allowed_origins_exact� s z(CsrfViewMiddleware.allowed_origins_exactc C s: t t�}dd� tjD �D ]}||j �|j�d�� q |S )z� A mapping of allowed schemes to list of allowed netlocs, where all subdomains of the netloc are allowed. c s s � | ] }d |v rt |�V qdS )r\ Nr r_ r r r r( � s � ��z?CsrfViewMiddleware.allowed_origin_subdomains.<locals>.<genexpr>r\ )r �listr rc �scheme�appendr] r^ )rH �allowed_origin_subdomains�parsedr r r rk � s �z,CsrfViewMiddleware.allowed_origin_subdomainsc C s d|_ d S )NT)�csrf_processing_done)rH r= r r r �_accept� s zCsrfViewMiddleware._acceptc C s( t � ||d�}td||j||td� |S )NrE zForbidden (%s): %s)�responser= �logger)r r �pathrp )rH r= rF ro r r r �_reject� s �zCsrfViewMiddleware._rejectc C s� t jrz|j�t�}W n# ty td��w z|jt j }W n t y* d}Y nw t |� |du r5dS t |�t kr?t |�}|S )a Return the CSRF secret originally associated with the request, or None if it didn't have one. If the CSRF_USE_SESSIONS setting is false, raises InvalidTokenFormat if the request's secret has invalid characters or an invalid length. z�CSRF_USE_SESSIONS is enabled, but request.session is not set. SessionMiddleware must appear before CsrfViewMiddleware in MIDDLEWARE.N)r �CSRF_USE_SESSIONS�session�get�CSRF_SESSION_KEY�AttributeErrorr �COOKIES�CSRF_COOKIE_NAME�KeyErrorrU r+ rP r6 �rH r= r> r r r � _get_secret� s& �� � z CsrfViewMiddleware._get_secretc C sp t jr|j�t�|jd kr|jd |jt< d S d S |jt j|jd t jt j t j t j t j t j d� t|d� d S )Nr7 )�max_age�domainrq �secure�httponly�samesite)�Cookie)r rs rt ru rv r9 � set_cookiery �CSRF_COOKIE_AGE�CSRF_COOKIE_DOMAIN�CSRF_COOKIE_PATH�CSRF_COOKIE_SECURE�CSRF_COOKIE_HTTPONLY�CSRF_COOKIE_SAMESITEr �rH r= ro r r r �_set_csrf_cookie s �� z#CsrfViewMiddleware._set_csrf_cookiec s� |j d }z|�� }W n ty Y nw d|�� r dnd|f }||kr'dS || jv r.dS zt|�}W n ty> Y dS w |j}|j� t � fdd�| j � |d �D ��S ) N� HTTP_ORIGINz%s://%s�https�httpTFc 3 s � | ]}t � |�V qd S r r �r$ �host��request_netlocr r r( ) s � � �z6CsrfViewMiddleware._origin_verified.<locals>.<genexpr>r ) r9 �get_hostr � is_securerg r � ValueErrorri r] �anyrk ru )rH r= �request_origin� good_host� good_origin� parsed_origin�request_schemer r� r �_origin_verified s0 �� � �z#CsrfViewMiddleware._origin_verifiedc s |j �d�� � d u rtt��zt� �� W n ty tt��w d� j� jfv r,tt��� jdkr5tt ��t � fdd�| j D ��rCd S t j rIt jnt j}|d u rfz|�� }W n tye tt� �� ��w |�� }|dvrtd||f }t� j|�s�tt� �� ��d S )N� HTTP_REFERERr* r� c 3 s � | ] }t � j|�V qd S r )r r] r� ��refererr r r( @ s � � �z4CsrfViewMiddleware._check_referer.<locals>.<genexpr>)�443�80z%s:%s)r9 ru rX �REASON_NO_REFERERr r� �REASON_MALFORMED_REFERERri r] �REASON_INSECURE_REFERERr� re r rs �SESSION_COOKIE_DOMAINr� r� r �REASON_BAD_REFERER�geturl�get_portr )rH r= � good_referer� server_portr r� r �_check_referer. s@ � ��� � �z!CsrfViewMiddleware._check_refererc C s0 |dkrt �|�}d|�d�}d|� d|� d�S )N�POSTzthe z HTTP headerzCSRF token from � �.)r �parse_header_name)rH rF � token_source� header_namer r r �_bad_token_message[ s z%CsrfViewMiddleware._bad_token_messagec C s z| � |�}W n ty } z td|j� d���d }~ww |d u r%tt��d}|jdkr?z |j�dd�}W n ty> Y nw |dkr[z|j t j }W n t yV tt ��w t j }nd}zt|� W n tyz } z | �|j|�}t|��d }~ww t||�s�| �d|�}t|��d S )Nz CSRF cookie r� r* r� �csrfmiddlewaretoken� incorrect)r| rC rX rF �REASON_NO_CSRF_COOKIE�methodr� ru r r9 r �CSRF_HEADER_NAMErz �REASON_CSRF_TOKEN_MISSINGrU r� rW )rH r= r> �excrV r� rF r r r � _check_tokenb sD �� � � �� �z CsrfViewMiddleware._check_tokenc C sF z| � |�}W n ty t|� Y d S w |d ur!||jd< d S d S )Nr7 )r| rC r? r9 r{ r r r �process_request� s ��z"CsrfViewMiddleware.process_requestc C s t |dd�rd S t |dd�rd S |jdv r| �|�S t |dd�r%| �|�S d|jv r;| �|�s:| �|t|jd �S n%|�� r`z| �|� W n t y_ } z | �||j �W Y d }~S d }~ww z| � |� W n t y� } z | �||j �W Y d }~S d }~ww | �|�S )Nrm F� csrf_exempt)�GET�HEAD�OPTIONS�TRACE�_dont_enforce_csrf_checksr� ) �getattrr� rn r9 r� rr �REASON_BAD_ORIGINr� r� rX rF r� )rH r= �callback� callback_args�callback_kwargsr� r r r � process_view� s8 ������ z CsrfViewMiddleware.process_viewc C s& |j �d�r| �||� d|j d< |S )Nr8 F)r9 ru r� r� r r r �process_response� s z#CsrfViewMiddleware.process_responseN)rL rM rN �__doc__r re rg rk rn rr r| r� r� r� r� r� r� r� r� r r r r rY � s& -4 9rY )?r� �logging�string� collectionsr � urllib.parser � django.confr �django.core.exceptionsr r � django.httpr r � django.urlsr �django.utils.cacher �django.utils.cryptor r �django.utils.deprecationr �django.utils.functionalr �django.utils.httpr �django.utils.logr �django.utils.regex_helperr � getLoggerrp rR r� r� r� r� r� r� r� rQ rT r rP � ascii_letters�digitsr rv r r r4 r6 r? r@ rA � ExceptionrC rU rW rX rY r r r r �<module> sX � __pycache__/gzip.cpython-310.pyc 0000644 00000003470 15030465023 0012430 0 ustar 00 o �h� � @ sP d dl mZ d dlmZ d dlmZ d dlmZmZ ed�Z G dd� de�Z dS ) � )�patch_vary_headers)�MiddlewareMixin)�_lazy_re_compile)�compress_sequence�compress_stringz\bgzip\bc @ s e Zd ZdZdZdd� ZdS )�GZipMiddlewarez� Compress content if the browser allows gzip compression. Set the Vary header accordingly, so that caches will base their storage on the Accept-Encoding header. �d c s |j s t|j�dk r |S |�d�r|S t|d� |j�dd�}t�|�s&|S |j rI|j r;|j � � �fdd�}|� |_ n t |j �j d�|_ |j d = n t|j�j d�}t|�t|j�kr\|S ||_tt|j��|j d < |�d �}|r||�d �r|d | |j d < d |j d< |S )N�� zContent-Encoding)zAccept-Encoding�HTTP_ACCEPT_ENCODING� c s* �� 2 z3 d H W } t | �jd�V q6 d S )N��max_random_bytes)r r )�chunk��orignal_iterator�self� �I/usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/gzip.py� gzip_wrapper' s � ��z5GZipMiddleware.process_response.<locals>.gzip_wrapperr zContent-Length�ETag�"zW/�gzip)� streaming�len�content� has_headerr �META�get�re_accepts_gzip�search�is_async�streaming_contentr r �headersr �str� startswith)r �request�response�aer �compressed_content�etagr r r �process_response s> � � z GZipMiddleware.process_responseN)�__name__� __module__� __qualname__�__doc__r r* r r r r r s r N) �django.utils.cacher �django.utils.deprecationr �django.utils.regex_helperr �django.utils.textr r r r r r r r �<module> s __pycache__/clickjacking.cpython-310.pyc 0000644 00000003622 15030465023 0014072 0 ustar 00 o �h� � @ s0 d Z ddlmZ ddlmZ G dd� de�ZdS )z� Clickjacking Protection Middleware. This module provides a middleware that implements protection against a malicious site loading resources from your site in a hidden frame. � )�settings)�MiddlewareMixinc @ s e Zd ZdZdd� Zdd� ZdS )�XFrameOptionsMiddlewarea� Set the X-Frame-Options HTTP header in HTTP responses. Do not set the header if it's already set or if the response contains a xframe_options_exempt value set to True. By default, set the X-Frame-Options header to 'DENY', meaning the response cannot be displayed in a frame, regardless of the site attempting to do so. To enable the response to be loaded on a frame within the same site, set X_FRAME_OPTIONS in your project's Django settings to 'SAMEORIGIN'. c C s8 |� d�d ur |S t|dd�r|S | �||�|jd< |S )NzX-Frame-Options�xframe_options_exemptF)�get�getattr�get_xframe_options_value�headers��self�request�response� r �Q/usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/clickjacking.py�process_response s �z(XFrameOptionsMiddleware.process_responsec C s t tdd��� S )a Get the value to set for the X_FRAME_OPTIONS header. Use the value from the X_FRAME_OPTIONS setting, or 'DENY' if not set. This method can be overridden if needed, allowing it to vary based on the request or response. �X_FRAME_OPTIONS�DENY)r r �upperr r r r r ( s z0XFrameOptionsMiddleware.get_xframe_options_valueN)�__name__� __module__� __qualname__�__doc__r r r r r r r s r N)r � django.confr �django.utils.deprecationr r r r r r �<module> s __pycache__/cache.cpython-310.pyc 0000644 00000014514 15030465023 0012523 0 ustar 00 o �h � @ s~ d Z ddlmZ ddlmZmZ ddlmZmZm Z m Z m Z ddl m Z G dd� de �ZG dd � d e �ZG d d � d ee�Zd S ) a� Cache middleware. If enabled, each Django-powered page will be cached based on URL. The canonical way to enable cache middleware is to set ``UpdateCacheMiddleware`` as your first piece of middleware, and ``FetchFromCacheMiddleware`` as the last:: MIDDLEWARE = [ 'django.middleware.cache.UpdateCacheMiddleware', ... 'django.middleware.cache.FetchFromCacheMiddleware' ] This is counter-intuitive, but correct: ``UpdateCacheMiddleware`` needs to run last during the response phase, which processes middleware bottom-up; ``FetchFromCacheMiddleware`` needs to run last during the request phase, which processes middleware top-down. The single-class ``CacheMiddleware`` can be used for some simple sites. However, if any other piece of middleware needs to affect the cache key, you'll need to use the two-part ``UpdateCacheMiddleware`` and ``FetchFromCacheMiddleware``. This'll most often happen when you're using Django's ``LocaleMiddleware``. More details about how the caching works: * Only GET or HEAD-requests with status code 200 are cached. * The number of seconds each page is stored for is set by the "max-age" section of the response's "Cache-Control" header, falling back to the CACHE_MIDDLEWARE_SECONDS setting if the section was not found. * This middleware expects that a HEAD request is answered with the same response headers exactly like the corresponding GET request. * When a hit occurs, a shallow copy of the original response object is returned from process_request. * Pages will be cached based on the contents of the request headers listed in the response's "Vary" header. * This middleware also sets ETag, Last-Modified, Expires and Cache-Control headers on the response object. � )�settings)�DEFAULT_CACHE_ALIAS�caches)� get_cache_key� get_max_age�has_vary_header�learn_cache_key�patch_response_headers)�MiddlewareMixinc s< e Zd ZdZ� fdd�Zedd� �Zdd� Zdd � Z� Z S ) �UpdateCacheMiddlewarea6 Response-phase cache middleware that updates the cache if the response is cacheable. Must be used as part of the two-part update/fetch cache middleware. UpdateCacheMiddleware must be the first piece of middleware in MIDDLEWARE so that it'll get called last during the response phase. c s. t � �|� tj| _d | _tj| _tj| _ d S �N) �super�__init__r �CACHE_MIDDLEWARE_SECONDS� cache_timeout� page_timeout�CACHE_MIDDLEWARE_KEY_PREFIX� key_prefix�CACHE_MIDDLEWARE_ALIAS� cache_alias��self� get_response�� __class__� �J/usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/cache.pyr D s z UpdateCacheMiddleware.__init__c C � t | j S r �r r �r r r r �cacheK � zUpdateCacheMiddleware.cachec C s t |d�o|jS )N�_cache_update_cache)�hasattrr" �r �request�responser r r �_should_update_cacheO s z*UpdateCacheMiddleware._should_update_cachec s� �� ||�s|S |js|jdvr|S |js |jr t|d�r |S d|�dd�v r)|S �j��du rBt|���du r<�j �n�dkrB|S t |�� �rx|jdkrxt ||��j �j d �� t|d �rpt|j�rp|�� ��fd d �� |S �j �� |�� |S ) zSet the cache, if needed.)�� i0 �Cookie�privatez Cache-Controlr Nr r( �r �renderc s �j �� | ��S r )r �set)�r�� cache_keyr �timeoutr r �<lambda>{ s z8UpdateCacheMiddleware.process_response.<locals>.<lambda>)r' � streaming� status_code�COOKIES�cookiesr �getr r r r r r r r# �callabler, �add_post_render_callbackr- r$ r r/ r �process_responseR s@ ��� ���z&UpdateCacheMiddleware.process_response) �__name__� __module__� __qualname__�__doc__r �propertyr r' r: � __classcell__r r r r r : s r c s4 e Zd ZdZ� fdd�Zedd� �Zdd� Z� ZS )�FetchFromCacheMiddlewarea! Request-phase cache middleware that fetches a page from the cache. Must be used as part of the two-part update/fetch cache middleware. FetchFromCacheMiddleware must be the last piece of middleware in MIDDLEWARE so that it'll get called last during the request phase. c s t � �|� tj| _tj| _d S r )r r r r r r r r r r r r � s z!FetchFromCacheMiddleware.__init__c C r r r r r r r r � r! z FetchFromCacheMiddleware.cachec C s� |j dvr d|_dS t|| jd| jd�}|du r d|_dS | j�|�}|du r<|j dkr<t|| jd| jd�}| j�|�}|du rEd|_dS d|_|S )zn Check whether the page is already cached and return the cached version if available. )�GET�HEADFNrB r+ TrC )�methodr" r r r r7 )r r% r0 r& r r r �process_request� s$ � z(FetchFromCacheMiddleware.process_request) r; r< r= r> r r? r rE r@ r r r r rA � s rA c s" e Zd ZdZd� fdd� Z� ZS )�CacheMiddlewarez� Cache middleware that provides basic behavior for many simple sites. Also used as the hook point for the cache decorator, which is generated using the decorator-from-middleware utility. Nc s� t � �|� z|d }|d u rd}|| _W n ty Y nw z|d }|d u r*t}|| _W n ty7 Y nw |d ur?|| _|| _d S )Nr � r )r r r �KeyErrorr r r r )r r r r �kwargsr r r r r r � s( � � zCacheMiddleware.__init__)NN)r; r< r= r> r r@ r r r r rF � s rF N)r> � django.confr �django.core.cacher r �django.utils.cacher r r r r �django.utils.deprecationr r rA rF r r r r �<module> s - H1 __pycache__/http.cpython-310.pyc 0000644 00000003270 15030465023 0012434 0 ustar 00 o �hP � @ s@ d dl mZmZmZ d dlmZ d dlmZ G dd� de�ZdS )� )� cc_delim_re�get_conditional_response�set_response_etag)�MiddlewareMixin)�parse_http_date_safec @ s e Zd ZdZdd� Zdd� ZdS )�ConditionalGetMiddlewarez� Handle conditional GET operations. If the response has an ETag or Last-Modified header and the request has If-None-Match or If-Modified-Since, replace the response with HttpNotModified. Add an ETag header if needed. c C sf |j dkr|S | �|�r|�d�st|� |�d�}|�d�}|o$t|�}|s)|r1t||||d�S |S )N�GET�ETagz Last-Modified)�etag� last_modified�response)�method� needs_etag� has_headerr �getr r )�self�requestr r r � r �I/usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/http.py�process_response s �z)ConditionalGetMiddleware.process_responsec C s$ t �|�dd��}tdd� |D ��S )z:Return True if an ETag header should be added to response.z Cache-Control� c s s � | ] }|� � d kV qdS )zno-storeN)�lower)�.0�headerr r r � <genexpr>( s � z6ConditionalGetMiddleware.needs_etag.<locals>.<genexpr>)r �splitr �all)r r �cache_control_headersr r r r % s z#ConditionalGetMiddleware.needs_etagN)�__name__� __module__� __qualname__�__doc__r r r r r r r s r N) �django.utils.cacher r r �django.utils.deprecationr �django.utils.httpr r r r r r �<module> s __pycache__/common.cpython-310.pyc 0000644 00000013702 15030465023 0012746 0 ustar 00 o �h� � @ s� d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m Z d dl m Z d dl mZ d d lmZ G d d � d e�ZG d d � d e�ZdS )� N)�urlparse)�settings)�PermissionDenied)� mail_managers)� HttpResponsePermanentRedirect)� is_valid_path)�MiddlewareMixin)�escape_leading_slashesc @ s4 e Zd ZdZeZdd� Zdd� Zdd� Zdd � Z d S ) �CommonMiddlewarea "Common" middleware for taking care of some basic operations: - Forbid access to User-Agents in settings.DISALLOWED_USER_AGENTS - URL rewriting: Based on the APPEND_SLASH and PREPEND_WWW settings, append missing slashes and/or prepends missing "www."s. - If APPEND_SLASH is set and the initial URL doesn't end with a slash, and it is not found in urlpatterns, form a new URL by appending a slash at the end. If this new URL is found in urlpatterns, return an HTTP redirect to this new URL; otherwise process the initial URL as usual. This behavior can be customized by subclassing CommonMiddleware and overriding the response_redirect_class attribute. c C s� |j �d�}|durtjD ] }|�|�rtd��q |�� }tjrC|rE|�d�sG| � |�r2| � |�}n|� � }| � |j � d|� |� ��S dS dS dS )z� Check for denied User-Agents and rewrite the URL based on settings.APPEND_SLASH and settings.PREPEND_WWW �HTTP_USER_AGENTNzForbidden user agentzwww.z://www.)�META�getr �DISALLOWED_USER_AGENTS�searchr �get_host� PREPEND_WWW� startswith�should_redirect_with_slash�get_full_path_with_slash� get_full_path�response_redirect_class�scheme)�self�request� user_agent�user_agent_regex�host�path� r �K/usr/local/CyberCP/lib/python3.10/site-packages/django/middleware/common.py�process_request" s � �z CommonMiddleware.process_requestc C sT t jr(|j�d�s(t|dd�}t|j|�s(td|j |�}|r(|j}t|dd�S dS )z� Return True if settings.APPEND_SLASH is True and appending a slash to the request path turns an invalid path into a valid one. �/�urlconfNz%s/�should_append_slashTF)r � APPEND_SLASH� path_info�endswith�getattrr �func)r r r" �match�viewr r r r > s z+CommonMiddleware.should_redirect_with_slashc C sD |j dd�}t|�}tjr |jdv r td|j|�� | d� ��|S )z� Return the full path of the request with a trailing slash appended. Raise a RuntimeError if settings.DEBUG is True and request.method is POST, PUT, or PATCH. T)�force_append_slash)�POST�PUT�PATCHa" You called this URL via %(method)s, but the URL doesn't end in a slash and you have APPEND_SLASH set. Django can't redirect to the slash URL while maintaining %(method)s data. Change your form to point to %(url)s (note the trailing slash), or set APPEND_SLASH=False in your Django settings.)�method�url)r r r �DEBUGr/ � RuntimeErrorr )r r �new_pathr r r r L s ��� z)CommonMiddleware.get_full_path_with_slashc C sL |j dkr| �|�r| �| �|��S |js$|�d�s$tt|j��|j d< |S )z� When the status code of the response is 404, it may redirect to a path with an appended slash if should_redirect_with_slash() returns True. � zContent-Length) � status_coder r r � streaming� has_header�str�len�content�headers)r r �responser r r �process_responsed s z!CommonMiddleware.process_responseN) �__name__� __module__� __qualname__�__doc__r r r r r r= r r r r r s r c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�BrokenLinkEmailsMiddlewarec C s� |j dkrFtjsF|�� }|�� }|j�dd�}| �||||�sF|j�dd�}|j�dd�}td| � ||�r7dnd|f d ||||f d d � |S ) z=Send broken link emails for relevant 404 NOT FOUND responses.r4 � HTTP_REFERER� r z<none>� REMOTE_ADDRzBroken %slink on %sz INTERNAL z=Referrer: %s Requested URL: %s User agent: %s IP address: %s T)� fail_silently) r5 r r1 r r r r �is_ignorable_requestr �is_internal_request)r r r< �domainr �referer�ua�ipr r r r= w s* ��� ��z+BrokenLinkEmailsMiddleware.process_responsec C s t t�dt�|� |��S )ze Return True if the referring URL is the same domain as the current request. z ^https?://%s/)�bool�rer) �escape)r rI rJ r r r rH � s z.BrokenLinkEmailsMiddleware.is_internal_requestc s� |sdS t jr� �d�r|� dd� krdS | �||�s"d|v r"dS t|�}|jd|fv r4|j� kr4dS t� fdd�t jD ��S ) z� Return True if the given request *shouldn't* notify the site managers according to project settings or in situations outlined by the inline comments. Tr! N����?rD c 3 s � | ]}|� � �V qd S )N)r )�.0�pattern��urir r � <genexpr>� s � zBBrokenLinkEmailsMiddleware.is_ignorable_request.<locals>.<genexpr>) r r$ r& rH r �netlocr �any�IGNORABLE_404_URLS)r r rU rI rJ �parsed_refererr rT r rG � s z/BrokenLinkEmailsMiddleware.is_ignorable_requestN)r> r? r@ r= rH rG r r r r rB v s rB )rN � urllib.parser � django.confr �django.core.exceptionsr �django.core.mailr � django.httpr � django.urlsr �django.utils.deprecationr �django.utils.httpr r rB r r r r �<module> s i gzip.py 0000644 00000005601 15030465023 0006067 0 ustar 00 from django.utils.cache import patch_vary_headers from django.utils.deprecation import MiddlewareMixin from django.utils.regex_helper import _lazy_re_compile from django.utils.text import compress_sequence, compress_string re_accepts_gzip = _lazy_re_compile(r"\bgzip\b") class GZipMiddleware(MiddlewareMixin): """ Compress content if the browser allows gzip compression. Set the Vary header accordingly, so that caches will base their storage on the Accept-Encoding header. """ max_random_bytes = 100 def process_response(self, request, response): # It's not worth attempting to compress really short responses. if not response.streaming and len(response.content) < 200: return response # Avoid gzipping if we've already got a content-encoding. if response.has_header("Content-Encoding"): return response patch_vary_headers(response, ("Accept-Encoding",)) ae = request.META.get("HTTP_ACCEPT_ENCODING", "") if not re_accepts_gzip.search(ae): return response if response.streaming: if response.is_async: # pull to lexical scope to capture fixed reference in case # streaming_content is set again later. orignal_iterator = response.streaming_content async def gzip_wrapper(): async for chunk in orignal_iterator: yield compress_string( chunk, max_random_bytes=self.max_random_bytes, ) response.streaming_content = gzip_wrapper() else: response.streaming_content = compress_sequence( response.streaming_content, max_random_bytes=self.max_random_bytes, ) # Delete the `Content-Length` header for streaming content, because # we won't know the compressed size until we stream it. del response.headers["Content-Length"] else: # Return the compressed content only if it's actually shorter. compressed_content = compress_string( response.content, max_random_bytes=self.max_random_bytes, ) if len(compressed_content) >= len(response.content): return response response.content = compressed_content response.headers["Content-Length"] = str(len(response.content)) # If there is a strong ETag, make it weak to fulfill the requirements # of RFC 9110 Section 8.8.1 while also allowing conditional request # matches on ETags. etag = response.get("ETag") if etag and etag.startswith('"'): response.headers["ETag"] = "W/" + etag response.headers["Content-Encoding"] = "gzip" return response security.py 0000644 00000005047 15030465023 0006771 0 ustar 00 import re from django.conf import settings from django.http import HttpResponsePermanentRedirect from django.utils.deprecation import MiddlewareMixin class SecurityMiddleware(MiddlewareMixin): def __init__(self, get_response): super().__init__(get_response) self.sts_seconds = settings.SECURE_HSTS_SECONDS self.sts_include_subdomains = settings.SECURE_HSTS_INCLUDE_SUBDOMAINS self.sts_preload = settings.SECURE_HSTS_PRELOAD self.content_type_nosniff = settings.SECURE_CONTENT_TYPE_NOSNIFF self.redirect = settings.SECURE_SSL_REDIRECT self.redirect_host = settings.SECURE_SSL_HOST self.redirect_exempt = [re.compile(r) for r in settings.SECURE_REDIRECT_EXEMPT] self.referrer_policy = settings.SECURE_REFERRER_POLICY self.cross_origin_opener_policy = settings.SECURE_CROSS_ORIGIN_OPENER_POLICY def process_request(self, request): path = request.path.lstrip("/") if ( self.redirect and not request.is_secure() and not any(pattern.search(path) for pattern in self.redirect_exempt) ): host = self.redirect_host or request.get_host() return HttpResponsePermanentRedirect( "https://%s%s" % (host, request.get_full_path()) ) def process_response(self, request, response): if ( self.sts_seconds and request.is_secure() and "Strict-Transport-Security" not in response ): sts_header = "max-age=%s" % self.sts_seconds if self.sts_include_subdomains: sts_header += "; includeSubDomains" if self.sts_preload: sts_header += "; preload" response.headers["Strict-Transport-Security"] = sts_header if self.content_type_nosniff: response.headers.setdefault("X-Content-Type-Options", "nosniff") if self.referrer_policy: # Support a comma-separated string or iterable of values to allow # fallback. response.headers.setdefault( "Referrer-Policy", ",".join( [v.strip() for v in self.referrer_policy.split(",")] if isinstance(self.referrer_policy, str) else self.referrer_policy ), ) if self.cross_origin_opener_policy: response.setdefault( "Cross-Origin-Opener-Policy", self.cross_origin_opener_policy, ) return response cache.py 0000644 00000017417 15030465023 0006171 0 ustar 00 """ Cache middleware. If enabled, each Django-powered page will be cached based on URL. The canonical way to enable cache middleware is to set ``UpdateCacheMiddleware`` as your first piece of middleware, and ``FetchFromCacheMiddleware`` as the last:: MIDDLEWARE = [ 'django.middleware.cache.UpdateCacheMiddleware', ... 'django.middleware.cache.FetchFromCacheMiddleware' ] This is counter-intuitive, but correct: ``UpdateCacheMiddleware`` needs to run last during the response phase, which processes middleware bottom-up; ``FetchFromCacheMiddleware`` needs to run last during the request phase, which processes middleware top-down. The single-class ``CacheMiddleware`` can be used for some simple sites. However, if any other piece of middleware needs to affect the cache key, you'll need to use the two-part ``UpdateCacheMiddleware`` and ``FetchFromCacheMiddleware``. This'll most often happen when you're using Django's ``LocaleMiddleware``. More details about how the caching works: * Only GET or HEAD-requests with status code 200 are cached. * The number of seconds each page is stored for is set by the "max-age" section of the response's "Cache-Control" header, falling back to the CACHE_MIDDLEWARE_SECONDS setting if the section was not found. * This middleware expects that a HEAD request is answered with the same response headers exactly like the corresponding GET request. * When a hit occurs, a shallow copy of the original response object is returned from process_request. * Pages will be cached based on the contents of the request headers listed in the response's "Vary" header. * This middleware also sets ETag, Last-Modified, Expires and Cache-Control headers on the response object. """ from django.conf import settings from django.core.cache import DEFAULT_CACHE_ALIAS, caches from django.utils.cache import ( get_cache_key, get_max_age, has_vary_header, learn_cache_key, patch_response_headers, ) from django.utils.deprecation import MiddlewareMixin class UpdateCacheMiddleware(MiddlewareMixin): """ Response-phase cache middleware that updates the cache if the response is cacheable. Must be used as part of the two-part update/fetch cache middleware. UpdateCacheMiddleware must be the first piece of middleware in MIDDLEWARE so that it'll get called last during the response phase. """ def __init__(self, get_response): super().__init__(get_response) self.cache_timeout = settings.CACHE_MIDDLEWARE_SECONDS self.page_timeout = None self.key_prefix = settings.CACHE_MIDDLEWARE_KEY_PREFIX self.cache_alias = settings.CACHE_MIDDLEWARE_ALIAS @property def cache(self): return caches[self.cache_alias] def _should_update_cache(self, request, response): return hasattr(request, "_cache_update_cache") and request._cache_update_cache def process_response(self, request, response): """Set the cache, if needed.""" if not self._should_update_cache(request, response): # We don't need to update the cache, just return. return response if response.streaming or response.status_code not in (200, 304): return response # Don't cache responses that set a user-specific (and maybe security # sensitive) cookie in response to a cookie-less request. if ( not request.COOKIES and response.cookies and has_vary_header(response, "Cookie") ): return response # Don't cache a response with 'Cache-Control: private' if "private" in response.get("Cache-Control", ()): return response # Page timeout takes precedence over the "max-age" and the default # cache timeout. timeout = self.page_timeout if timeout is None: # The timeout from the "max-age" section of the "Cache-Control" # header takes precedence over the default cache timeout. timeout = get_max_age(response) if timeout is None: timeout = self.cache_timeout elif timeout == 0: # max-age was set to 0, don't cache. return response patch_response_headers(response, timeout) if timeout and response.status_code == 200: cache_key = learn_cache_key( request, response, timeout, self.key_prefix, cache=self.cache ) if hasattr(response, "render") and callable(response.render): response.add_post_render_callback( lambda r: self.cache.set(cache_key, r, timeout) ) else: self.cache.set(cache_key, response, timeout) return response class FetchFromCacheMiddleware(MiddlewareMixin): """ Request-phase cache middleware that fetches a page from the cache. Must be used as part of the two-part update/fetch cache middleware. FetchFromCacheMiddleware must be the last piece of middleware in MIDDLEWARE so that it'll get called last during the request phase. """ def __init__(self, get_response): super().__init__(get_response) self.key_prefix = settings.CACHE_MIDDLEWARE_KEY_PREFIX self.cache_alias = settings.CACHE_MIDDLEWARE_ALIAS @property def cache(self): return caches[self.cache_alias] def process_request(self, request): """ Check whether the page is already cached and return the cached version if available. """ if request.method not in ("GET", "HEAD"): request._cache_update_cache = False return None # Don't bother checking the cache. # try and get the cached GET response cache_key = get_cache_key(request, self.key_prefix, "GET", cache=self.cache) if cache_key is None: request._cache_update_cache = True return None # No cache information available, need to rebuild. response = self.cache.get(cache_key) # if it wasn't found and we are looking for a HEAD, try looking just for that if response is None and request.method == "HEAD": cache_key = get_cache_key( request, self.key_prefix, "HEAD", cache=self.cache ) response = self.cache.get(cache_key) if response is None: request._cache_update_cache = True return None # No cache information available, need to rebuild. # hit, return cached response request._cache_update_cache = False return response class CacheMiddleware(UpdateCacheMiddleware, FetchFromCacheMiddleware): """ Cache middleware that provides basic behavior for many simple sites. Also used as the hook point for the cache decorator, which is generated using the decorator-from-middleware utility. """ def __init__(self, get_response, cache_timeout=None, page_timeout=None, **kwargs): super().__init__(get_response) # We need to differentiate between "provided, but using default value", # and "not provided". If the value is provided using a default, then # we fall back to system defaults. If it is not provided at all, # we need to use middleware defaults. try: key_prefix = kwargs["key_prefix"] if key_prefix is None: key_prefix = "" self.key_prefix = key_prefix except KeyError: pass try: cache_alias = kwargs["cache_alias"] if cache_alias is None: cache_alias = DEFAULT_CACHE_ALIAS self.cache_alias = cache_alias except KeyError: pass if cache_timeout is not None: self.cache_timeout = cache_timeout self.page_timeout = page_timeout locale.py 0000644 00000006562 15030465023 0006364 0 ustar 00 from django.conf import settings from django.conf.urls.i18n import is_language_prefix_patterns_used from django.http import HttpResponseRedirect from django.urls import get_script_prefix, is_valid_path from django.utils import translation from django.utils.cache import patch_vary_headers from django.utils.deprecation import MiddlewareMixin class LocaleMiddleware(MiddlewareMixin): """ Parse a request and decide what translation object to install in the current thread context. This allows pages to be dynamically translated to the language the user desires (if the language is available). """ response_redirect_class = HttpResponseRedirect def process_request(self, request): urlconf = getattr(request, "urlconf", settings.ROOT_URLCONF) ( i18n_patterns_used, prefixed_default_language, ) = is_language_prefix_patterns_used(urlconf) language = translation.get_language_from_request( request, check_path=i18n_patterns_used ) language_from_path = translation.get_language_from_path(request.path_info) if ( not language_from_path and i18n_patterns_used and not prefixed_default_language ): language = settings.LANGUAGE_CODE translation.activate(language) request.LANGUAGE_CODE = translation.get_language() def process_response(self, request, response): language = translation.get_language() language_from_path = translation.get_language_from_path(request.path_info) urlconf = getattr(request, "urlconf", settings.ROOT_URLCONF) ( i18n_patterns_used, prefixed_default_language, ) = is_language_prefix_patterns_used(urlconf) if ( response.status_code == 404 and not language_from_path and i18n_patterns_used and prefixed_default_language ): # Maybe the language code is missing in the URL? Try adding the # language prefix and redirecting to that URL. language_path = "/%s%s" % (language, request.path_info) path_valid = is_valid_path(language_path, urlconf) path_needs_slash = not path_valid and ( settings.APPEND_SLASH and not language_path.endswith("/") and is_valid_path("%s/" % language_path, urlconf) ) if path_valid or path_needs_slash: script_prefix = get_script_prefix() # Insert language after the script prefix and before the # rest of the URL language_url = request.get_full_path( force_append_slash=path_needs_slash ).replace(script_prefix, "%s%s/" % (script_prefix, language), 1) # Redirect to the language-specific URL as detected by # get_language_from_request(). HTTP caches may cache this # redirect, so add the Vary header. redirect = self.response_redirect_class(language_url) patch_vary_headers(redirect, ("Accept-Language", "Cookie")) return redirect if not (i18n_patterns_used and language_from_path): patch_vary_headers(response, ("Accept-Language",)) response.headers.setdefault("Content-Language", language) return response csrf.py 0000644 00000046437 15030465023 0006067 0 ustar 00 """ Cross Site Request Forgery Middleware. This module provides a middleware that implements protection against request forgeries from other sites. """ import logging import string from collections import defaultdict from urllib.parse import urlparse from django.conf import settings from django.core.exceptions import DisallowedHost, ImproperlyConfigured from django.http import HttpHeaders, UnreadablePostError from django.urls import get_callable from django.utils.cache import patch_vary_headers from django.utils.crypto import constant_time_compare, get_random_string from django.utils.deprecation import MiddlewareMixin from django.utils.functional import cached_property from django.utils.http import is_same_domain from django.utils.log import log_response from django.utils.regex_helper import _lazy_re_compile logger = logging.getLogger("django.security.csrf") # This matches if any character is not in CSRF_ALLOWED_CHARS. invalid_token_chars_re = _lazy_re_compile("[^a-zA-Z0-9]") REASON_BAD_ORIGIN = "Origin checking failed - %s does not match any trusted origins." REASON_NO_REFERER = "Referer checking failed - no Referer." REASON_BAD_REFERER = "Referer checking failed - %s does not match any trusted origins." REASON_NO_CSRF_COOKIE = "CSRF cookie not set." REASON_CSRF_TOKEN_MISSING = "CSRF token missing." REASON_MALFORMED_REFERER = "Referer checking failed - Referer is malformed." REASON_INSECURE_REFERER = ( "Referer checking failed - Referer is insecure while host is secure." ) # The reason strings below are for passing to InvalidTokenFormat. They are # phrases without a subject because they can be in reference to either the CSRF # cookie or non-cookie token. REASON_INCORRECT_LENGTH = "has incorrect length" REASON_INVALID_CHARACTERS = "has invalid characters" CSRF_SECRET_LENGTH = 32 CSRF_TOKEN_LENGTH = 2 * CSRF_SECRET_LENGTH CSRF_ALLOWED_CHARS = string.ascii_letters + string.digits CSRF_SESSION_KEY = "_csrftoken" def _get_failure_view(): """Return the view to be used for CSRF rejections.""" return get_callable(settings.CSRF_FAILURE_VIEW) def _get_new_csrf_string(): return get_random_string(CSRF_SECRET_LENGTH, allowed_chars=CSRF_ALLOWED_CHARS) def _mask_cipher_secret(secret): """ Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a token by adding a mask and applying it to the secret. """ mask = _get_new_csrf_string() chars = CSRF_ALLOWED_CHARS pairs = zip((chars.index(x) for x in secret), (chars.index(x) for x in mask)) cipher = "".join(chars[(x + y) % len(chars)] for x, y in pairs) return mask + cipher def _unmask_cipher_token(token): """ Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt the second half to produce the original secret. """ mask = token[:CSRF_SECRET_LENGTH] token = token[CSRF_SECRET_LENGTH:] chars = CSRF_ALLOWED_CHARS pairs = zip((chars.index(x) for x in token), (chars.index(x) for x in mask)) return "".join(chars[x - y] for x, y in pairs) # Note negative values are ok def _add_new_csrf_cookie(request): """Generate a new random CSRF_COOKIE value, and add it to request.META.""" csrf_secret = _get_new_csrf_string() request.META.update( { # RemovedInDjango50Warning: when the deprecation ends, replace # with: 'CSRF_COOKIE': csrf_secret "CSRF_COOKIE": ( _mask_cipher_secret(csrf_secret) if settings.CSRF_COOKIE_MASKED else csrf_secret ), "CSRF_COOKIE_NEEDS_UPDATE": True, } ) return csrf_secret def get_token(request): """ Return the CSRF token required for a POST form. The token is an alphanumeric value. A new token is created if one is not already set. A side effect of calling this function is to make the csrf_protect decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie' header to the outgoing response. For this reason, you may need to use this function lazily, as is done by the csrf context processor. """ if "CSRF_COOKIE" in request.META: csrf_secret = request.META["CSRF_COOKIE"] # Since the cookie is being used, flag to send the cookie in # process_response() (even if the client already has it) in order to # renew the expiry timer. request.META["CSRF_COOKIE_NEEDS_UPDATE"] = True else: csrf_secret = _add_new_csrf_cookie(request) return _mask_cipher_secret(csrf_secret) def rotate_token(request): """ Change the CSRF token in use for a request - should be done on login for security purposes. """ _add_new_csrf_cookie(request) class InvalidTokenFormat(Exception): def __init__(self, reason): self.reason = reason def _check_token_format(token): """ Raise an InvalidTokenFormat error if the token has an invalid length or characters that aren't allowed. The token argument can be a CSRF cookie secret or non-cookie CSRF token, and either masked or unmasked. """ if len(token) not in (CSRF_TOKEN_LENGTH, CSRF_SECRET_LENGTH): raise InvalidTokenFormat(REASON_INCORRECT_LENGTH) # Make sure all characters are in CSRF_ALLOWED_CHARS. if invalid_token_chars_re.search(token): raise InvalidTokenFormat(REASON_INVALID_CHARACTERS) def _does_token_match(request_csrf_token, csrf_secret): """ Return whether the given CSRF token matches the given CSRF secret, after unmasking the token if necessary. This function assumes that the request_csrf_token argument has been validated to have the correct length (CSRF_SECRET_LENGTH or CSRF_TOKEN_LENGTH characters) and allowed characters, and that if it has length CSRF_TOKEN_LENGTH, it is a masked secret. """ # Only unmask tokens that are exactly CSRF_TOKEN_LENGTH characters long. if len(request_csrf_token) == CSRF_TOKEN_LENGTH: request_csrf_token = _unmask_cipher_token(request_csrf_token) assert len(request_csrf_token) == CSRF_SECRET_LENGTH return constant_time_compare(request_csrf_token, csrf_secret) class RejectRequest(Exception): def __init__(self, reason): self.reason = reason class CsrfViewMiddleware(MiddlewareMixin): """ Require a present and correct csrfmiddlewaretoken for POST requests that have a CSRF cookie, and set an outgoing CSRF cookie. This middleware should be used in conjunction with the {% csrf_token %} template tag. """ @cached_property def csrf_trusted_origins_hosts(self): return [ urlparse(origin).netloc.lstrip("*") for origin in settings.CSRF_TRUSTED_ORIGINS ] @cached_property def allowed_origins_exact(self): return {origin for origin in settings.CSRF_TRUSTED_ORIGINS if "*" not in origin} @cached_property def allowed_origin_subdomains(self): """ A mapping of allowed schemes to list of allowed netlocs, where all subdomains of the netloc are allowed. """ allowed_origin_subdomains = defaultdict(list) for parsed in ( urlparse(origin) for origin in settings.CSRF_TRUSTED_ORIGINS if "*" in origin ): allowed_origin_subdomains[parsed.scheme].append(parsed.netloc.lstrip("*")) return allowed_origin_subdomains # The _accept and _reject methods currently only exist for the sake of the # requires_csrf_token decorator. def _accept(self, request): # Avoid checking the request twice by adding a custom attribute to # request. This will be relevant when both decorator and middleware # are used. request.csrf_processing_done = True return None def _reject(self, request, reason): response = _get_failure_view()(request, reason=reason) log_response( "Forbidden (%s): %s", reason, request.path, response=response, request=request, logger=logger, ) return response def _get_secret(self, request): """ Return the CSRF secret originally associated with the request, or None if it didn't have one. If the CSRF_USE_SESSIONS setting is false, raises InvalidTokenFormat if the request's secret has invalid characters or an invalid length. """ if settings.CSRF_USE_SESSIONS: try: csrf_secret = request.session.get(CSRF_SESSION_KEY) except AttributeError: raise ImproperlyConfigured( "CSRF_USE_SESSIONS is enabled, but request.session is not " "set. SessionMiddleware must appear before CsrfViewMiddleware " "in MIDDLEWARE." ) else: try: csrf_secret = request.COOKIES[settings.CSRF_COOKIE_NAME] except KeyError: csrf_secret = None else: # This can raise InvalidTokenFormat. _check_token_format(csrf_secret) if csrf_secret is None: return None # Django versions before 4.0 masked the secret before storing. if len(csrf_secret) == CSRF_TOKEN_LENGTH: csrf_secret = _unmask_cipher_token(csrf_secret) return csrf_secret def _set_csrf_cookie(self, request, response): if settings.CSRF_USE_SESSIONS: if request.session.get(CSRF_SESSION_KEY) != request.META["CSRF_COOKIE"]: request.session[CSRF_SESSION_KEY] = request.META["CSRF_COOKIE"] else: response.set_cookie( settings.CSRF_COOKIE_NAME, request.META["CSRF_COOKIE"], max_age=settings.CSRF_COOKIE_AGE, domain=settings.CSRF_COOKIE_DOMAIN, path=settings.CSRF_COOKIE_PATH, secure=settings.CSRF_COOKIE_SECURE, httponly=settings.CSRF_COOKIE_HTTPONLY, samesite=settings.CSRF_COOKIE_SAMESITE, ) # Set the Vary header since content varies with the CSRF cookie. patch_vary_headers(response, ("Cookie",)) def _origin_verified(self, request): request_origin = request.META["HTTP_ORIGIN"] try: good_host = request.get_host() except DisallowedHost: pass else: good_origin = "%s://%s" % ( "https" if request.is_secure() else "http", good_host, ) if request_origin == good_origin: return True if request_origin in self.allowed_origins_exact: return True try: parsed_origin = urlparse(request_origin) except ValueError: return False request_scheme = parsed_origin.scheme request_netloc = parsed_origin.netloc return any( is_same_domain(request_netloc, host) for host in self.allowed_origin_subdomains.get(request_scheme, ()) ) def _check_referer(self, request): referer = request.META.get("HTTP_REFERER") if referer is None: raise RejectRequest(REASON_NO_REFERER) try: referer = urlparse(referer) except ValueError: raise RejectRequest(REASON_MALFORMED_REFERER) # Make sure we have a valid URL for Referer. if "" in (referer.scheme, referer.netloc): raise RejectRequest(REASON_MALFORMED_REFERER) # Ensure that our Referer is also secure. if referer.scheme != "https": raise RejectRequest(REASON_INSECURE_REFERER) if any( is_same_domain(referer.netloc, host) for host in self.csrf_trusted_origins_hosts ): return # Allow matching the configured cookie domain. good_referer = ( settings.SESSION_COOKIE_DOMAIN if settings.CSRF_USE_SESSIONS else settings.CSRF_COOKIE_DOMAIN ) if good_referer is None: # If no cookie domain is configured, allow matching the current # host:port exactly if it's permitted by ALLOWED_HOSTS. try: # request.get_host() includes the port. good_referer = request.get_host() except DisallowedHost: raise RejectRequest(REASON_BAD_REFERER % referer.geturl()) else: server_port = request.get_port() if server_port not in ("443", "80"): good_referer = "%s:%s" % (good_referer, server_port) if not is_same_domain(referer.netloc, good_referer): raise RejectRequest(REASON_BAD_REFERER % referer.geturl()) def _bad_token_message(self, reason, token_source): if token_source != "POST": # Assume it is a settings.CSRF_HEADER_NAME value. header_name = HttpHeaders.parse_header_name(token_source) token_source = f"the {header_name!r} HTTP header" return f"CSRF token from {token_source} {reason}." def _check_token(self, request): # Access csrf_secret via self._get_secret() as rotate_token() may have # been called by an authentication middleware during the # process_request() phase. try: csrf_secret = self._get_secret(request) except InvalidTokenFormat as exc: raise RejectRequest(f"CSRF cookie {exc.reason}.") if csrf_secret is None: # No CSRF cookie. For POST requests, we insist on a CSRF cookie, # and in this way we can avoid all CSRF attacks, including login # CSRF. raise RejectRequest(REASON_NO_CSRF_COOKIE) # Check non-cookie token for match. request_csrf_token = "" if request.method == "POST": try: request_csrf_token = request.POST.get("csrfmiddlewaretoken", "") except UnreadablePostError: # Handle a broken connection before we've completed reading the # POST data. process_view shouldn't raise any exceptions, so # we'll ignore and serve the user a 403 (assuming they're still # listening, which they probably aren't because of the error). pass if request_csrf_token == "": # Fall back to X-CSRFToken, to make things easier for AJAX, and # possible for PUT/DELETE. try: # This can have length CSRF_SECRET_LENGTH or CSRF_TOKEN_LENGTH, # depending on whether the client obtained the token from # the DOM or the cookie (and if the cookie, whether the cookie # was masked or unmasked). request_csrf_token = request.META[settings.CSRF_HEADER_NAME] except KeyError: raise RejectRequest(REASON_CSRF_TOKEN_MISSING) token_source = settings.CSRF_HEADER_NAME else: token_source = "POST" try: _check_token_format(request_csrf_token) except InvalidTokenFormat as exc: reason = self._bad_token_message(exc.reason, token_source) raise RejectRequest(reason) if not _does_token_match(request_csrf_token, csrf_secret): reason = self._bad_token_message("incorrect", token_source) raise RejectRequest(reason) def process_request(self, request): try: csrf_secret = self._get_secret(request) except InvalidTokenFormat: _add_new_csrf_cookie(request) else: if csrf_secret is not None: # Use the same secret next time. If the secret was originally # masked, this also causes it to be replaced with the unmasked # form, but only in cases where the secret is already getting # saved anyways. request.META["CSRF_COOKIE"] = csrf_secret def process_view(self, request, callback, callback_args, callback_kwargs): if getattr(request, "csrf_processing_done", False): return None # Wait until request.META["CSRF_COOKIE"] has been manipulated before # bailing out, so that get_token still works if getattr(callback, "csrf_exempt", False): return None # Assume that anything not defined as 'safe' by RFC 9110 needs protection if request.method in ("GET", "HEAD", "OPTIONS", "TRACE"): return self._accept(request) if getattr(request, "_dont_enforce_csrf_checks", False): # Mechanism to turn off CSRF checks for test suite. It comes after # the creation of CSRF cookies, so that everything else continues # to work exactly the same (e.g. cookies are sent, etc.), but # before any branches that call the _reject method. return self._accept(request) # Reject the request if the Origin header doesn't match an allowed # value. if "HTTP_ORIGIN" in request.META: if not self._origin_verified(request): return self._reject( request, REASON_BAD_ORIGIN % request.META["HTTP_ORIGIN"] ) elif request.is_secure(): # If the Origin header wasn't provided, reject HTTPS requests if # the Referer header doesn't match an allowed value. # # Suppose user visits http://example.com/ # An active network attacker (man-in-the-middle, MITM) sends a # POST form that targets https://example.com/detonate-bomb/ and # submits it via JavaScript. # # The attacker will need to provide a CSRF cookie and token, but # that's no problem for a MITM and the session-independent secret # we're using. So the MITM can circumvent the CSRF protection. This # is true for any HTTP connection, but anyone using HTTPS expects # better! For this reason, for https://example.com/ we need # additional protection that treats http://example.com/ as # completely untrusted. Under HTTPS, Barth et al. found that the # Referer header is missing for same-domain requests in only about # 0.2% of cases or less, so we can use strict Referer checking. try: self._check_referer(request) except RejectRequest as exc: return self._reject(request, exc.reason) try: self._check_token(request) except RejectRequest as exc: return self._reject(request, exc.reason) return self._accept(request) def process_response(self, request, response): if request.META.get("CSRF_COOKIE_NEEDS_UPDATE"): self._set_csrf_cookie(request, response) # Unset the flag to prevent _set_csrf_cookie() from being # unnecessarily called again in process_response() by other # instances of CsrfViewMiddleware. This can happen e.g. when both a # decorator and middleware are used. However, # CSRF_COOKIE_NEEDS_UPDATE is still respected in subsequent calls # e.g. in case rotate_token() is called in process_response() later # by custom middleware but before those subsequent calls. request.META["CSRF_COOKIE_NEEDS_UPDATE"] = False return response common.py 0000644 00000016740 15030465023 0006414 0 ustar 00 import re from urllib.parse import urlparse from django.conf import settings from django.core.exceptions import PermissionDenied from django.core.mail import mail_managers from django.http import HttpResponsePermanentRedirect from django.urls import is_valid_path from django.utils.deprecation import MiddlewareMixin from django.utils.http import escape_leading_slashes class CommonMiddleware(MiddlewareMixin): """ "Common" middleware for taking care of some basic operations: - Forbid access to User-Agents in settings.DISALLOWED_USER_AGENTS - URL rewriting: Based on the APPEND_SLASH and PREPEND_WWW settings, append missing slashes and/or prepends missing "www."s. - If APPEND_SLASH is set and the initial URL doesn't end with a slash, and it is not found in urlpatterns, form a new URL by appending a slash at the end. If this new URL is found in urlpatterns, return an HTTP redirect to this new URL; otherwise process the initial URL as usual. This behavior can be customized by subclassing CommonMiddleware and overriding the response_redirect_class attribute. """ response_redirect_class = HttpResponsePermanentRedirect def process_request(self, request): """ Check for denied User-Agents and rewrite the URL based on settings.APPEND_SLASH and settings.PREPEND_WWW """ # Check for denied User-Agents user_agent = request.META.get("HTTP_USER_AGENT") if user_agent is not None: for user_agent_regex in settings.DISALLOWED_USER_AGENTS: if user_agent_regex.search(user_agent): raise PermissionDenied("Forbidden user agent") # Check for a redirect based on settings.PREPEND_WWW host = request.get_host() if settings.PREPEND_WWW and host and not host.startswith("www."): # Check if we also need to append a slash so we can do it all # with a single redirect. (This check may be somewhat expensive, # so we only do it if we already know we're sending a redirect, # or in process_response if we get a 404.) if self.should_redirect_with_slash(request): path = self.get_full_path_with_slash(request) else: path = request.get_full_path() return self.response_redirect_class(f"{request.scheme}://www.{host}{path}") def should_redirect_with_slash(self, request): """ Return True if settings.APPEND_SLASH is True and appending a slash to the request path turns an invalid path into a valid one. """ if settings.APPEND_SLASH and not request.path_info.endswith("/"): urlconf = getattr(request, "urlconf", None) if not is_valid_path(request.path_info, urlconf): match = is_valid_path("%s/" % request.path_info, urlconf) if match: view = match.func return getattr(view, "should_append_slash", True) return False def get_full_path_with_slash(self, request): """ Return the full path of the request with a trailing slash appended. Raise a RuntimeError if settings.DEBUG is True and request.method is POST, PUT, or PATCH. """ new_path = request.get_full_path(force_append_slash=True) # Prevent construction of scheme relative urls. new_path = escape_leading_slashes(new_path) if settings.DEBUG and request.method in ("POST", "PUT", "PATCH"): raise RuntimeError( "You called this URL via %(method)s, but the URL doesn't end " "in a slash and you have APPEND_SLASH set. Django can't " "redirect to the slash URL while maintaining %(method)s data. " "Change your form to point to %(url)s (note the trailing " "slash), or set APPEND_SLASH=False in your Django settings." % { "method": request.method, "url": request.get_host() + new_path, } ) return new_path def process_response(self, request, response): """ When the status code of the response is 404, it may redirect to a path with an appended slash if should_redirect_with_slash() returns True. """ # If the given URL is "Not Found", then check if we should redirect to # a path with a slash appended. if response.status_code == 404 and self.should_redirect_with_slash(request): return self.response_redirect_class(self.get_full_path_with_slash(request)) # Add the Content-Length header to non-streaming responses if not # already set. if not response.streaming and not response.has_header("Content-Length"): response.headers["Content-Length"] = str(len(response.content)) return response class BrokenLinkEmailsMiddleware(MiddlewareMixin): def process_response(self, request, response): """Send broken link emails for relevant 404 NOT FOUND responses.""" if response.status_code == 404 and not settings.DEBUG: domain = request.get_host() path = request.get_full_path() referer = request.META.get("HTTP_REFERER", "") if not self.is_ignorable_request(request, path, domain, referer): ua = request.META.get("HTTP_USER_AGENT", "<none>") ip = request.META.get("REMOTE_ADDR", "<none>") mail_managers( "Broken %slink on %s" % ( ( "INTERNAL " if self.is_internal_request(domain, referer) else "" ), domain, ), "Referrer: %s\nRequested URL: %s\nUser agent: %s\n" "IP address: %s\n" % (referer, path, ua, ip), fail_silently=True, ) return response def is_internal_request(self, domain, referer): """ Return True if the referring URL is the same domain as the current request. """ # Different subdomains are treated as different domains. return bool(re.match("^https?://%s/" % re.escape(domain), referer)) def is_ignorable_request(self, request, uri, domain, referer): """ Return True if the given request *shouldn't* notify the site managers according to project settings or in situations outlined by the inline comments. """ # The referer is empty. if not referer: return True # APPEND_SLASH is enabled and the referer is equal to the current URL # without a trailing slash indicating an internal redirect. if settings.APPEND_SLASH and uri.endswith("/") and referer == uri[:-1]: return True # A '?' in referer is identified as a search engine source. if not self.is_internal_request(domain, referer) and "?" in referer: return True # The referer is equal to the current URL, ignoring the scheme (assumed # to be a poorly implemented bot). parsed_referer = urlparse(referer) if parsed_referer.netloc in ["", domain] and parsed_referer.path == uri: return True return any(pattern.search(uri) for pattern in settings.IGNORABLE_404_URLS) clickjacking.py 0000644 00000003274 15030465023 0007536 0 ustar 00 """ Clickjacking Protection Middleware. This module provides a middleware that implements protection against a malicious site loading resources from your site in a hidden frame. """ from django.conf import settings from django.utils.deprecation import MiddlewareMixin class XFrameOptionsMiddleware(MiddlewareMixin): """ Set the X-Frame-Options HTTP header in HTTP responses. Do not set the header if it's already set or if the response contains a xframe_options_exempt value set to True. By default, set the X-Frame-Options header to 'DENY', meaning the response cannot be displayed in a frame, regardless of the site attempting to do so. To enable the response to be loaded on a frame within the same site, set X_FRAME_OPTIONS in your project's Django settings to 'SAMEORIGIN'. """ def process_response(self, request, response): # Don't set it if it's already in the response if response.get("X-Frame-Options") is not None: return response # Don't set it if they used @xframe_options_exempt if getattr(response, "xframe_options_exempt", False): return response response.headers["X-Frame-Options"] = self.get_xframe_options_value( request, response, ) return response def get_xframe_options_value(self, request, response): """ Get the value to set for the X_FRAME_OPTIONS header. Use the value from the X_FRAME_OPTIONS setting, or 'DENY' if not set. This method can be overridden if needed, allowing it to vary based on the request or response. """ return getattr(settings, "X_FRAME_OPTIONS", "DENY").upper() __init__.py 0000644 00000000000 15030465023 0006641 0 ustar 00 http.py 0000644 00000003120 15030465023 0006067 0 ustar 00 from django.utils.cache import cc_delim_re, get_conditional_response, set_response_etag from django.utils.deprecation import MiddlewareMixin from django.utils.http import parse_http_date_safe class ConditionalGetMiddleware(MiddlewareMixin): """ Handle conditional GET operations. If the response has an ETag or Last-Modified header and the request has If-None-Match or If-Modified-Since, replace the response with HttpNotModified. Add an ETag header if needed. """ def process_response(self, request, response): # It's too late to prevent an unsafe request with a 412 response, and # for a HEAD request, the response body is always empty so computing # an accurate ETag isn't possible. if request.method != "GET": return response if self.needs_etag(response) and not response.has_header("ETag"): set_response_etag(response) etag = response.get("ETag") last_modified = response.get("Last-Modified") last_modified = last_modified and parse_http_date_safe(last_modified) if etag or last_modified: return get_conditional_response( request, etag=etag, last_modified=last_modified, response=response, ) return response def needs_etag(self, response): """Return True if an ETag header should be added to response.""" cache_control_headers = cc_delim_re.split(response.get("Cache-Control", "")) return all(header.lower() != "no-store" for header in cache_control_headers)
| ver. 1.4 |
Github
|
.
| PHP 8.2.28 | Generation time: 0.02 |
proxy
|
phpinfo
|
Settings