
^Q\n5                 @   s  d  Z  d d l m Z d d l Z d d l Z d d l Z d d l m Z d d l m	 Z	 d d l
 m Z d d l m Z d d l m Z m Z d d	 l m Z d d
 l m Z d d l m Z d d l m Z d d l m Z e j d  Z d Z d Z d Z d Z  d Z! d Z" d Z# d e# Z$ e j% e j& Z' d Z( d d   Z) d d   Z* d d   Z+ d d   Z, d  d!   Z- d" d#   Z. d$ d%   Z/ d& d'   Z0 d( d)   Z1 Gd* d+   d+ e  Z2 d S),z
Cross Site Request Forgery Middleware.

This module provides a middleware that implements protection
against request forgeries from other sites.
    )unicode_literalsN)settings)ImproperlyConfigured)get_callable)patch_vary_headers)constant_time_compareget_random_string)MiddlewareMixin)
force_text)is_same_domain)zip)urlparsezdjango.security.csrfz%Referer checking failed - no Referer.z@Referer checking failed - %s does not match any trusted origins.zCSRF cookie not set.z CSRF token missing or incorrect.z/Referer checking failed - Referer is malformed.zCReferer checking failed - Referer is insecure while host is secure.       Z
_csrftokenc               C   s   t  t j  S)z9
    Returns the view to be used for CSRF rejections
    )r   r   ZCSRF_FAILURE_VIEW r   r   </var/www/dbchiro/venv/build/Django/django/middleware/csrf.py_get_failure_view'   s    r   c               C   s   t  t d t S)Nallowed_chars)r   CSRF_SECRET_LENGTHCSRF_ALLOWED_CHARSr   r   r   r   _get_new_csrf_string.   s    r   c                sn   t    } t   t   f d d   |  D   f d d   | D  } d j   f d d   | D  } | | S)z
    Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
    token by adding a salt and using it to encrypt the secret.
    c             3   s   |  ] }   j  |  Vq d  S)N)index).0x)charsr   r   	<genexpr>9   s    z&_salt_cipher_secret.<locals>.<genexpr> c             3   s-   |  ]# \ } }   | | t     Vq d  S)N)len)r   r   y)r   r   r   r   :   s    )r   r   r   join)secretsaltpairscipherr   )r   r   _salt_cipher_secret2   s
    	5"r$   c                s   |  d t   } |  t  d  }  t   t   f d d   |  D   f d d   | D  } d j   f d d   | D  } | S)z
    Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
    CSRF_TOKEN_LENGTH, and that its first half is a salt), use it to decrypt
    the second half to produce the original secret.
    Nc             3   s   |  ] }   j  |  Vq d  S)N)r   )r   r   )r   r   r   r   G   s    z'_unsalt_cipher_token.<locals>.<genexpr>r   c             3   s#   |  ] \ } }   | | Vq d  S)Nr   )r   r   r   )r   r   r   r   H   s    )r   r   r   r   )tokenr!   r"   r    r   )r   r   _unsalt_cipher_token>   s    5"r&   c               C   s   t  t    S)N)r$   r   r   r   r   r   _get_new_csrf_tokenL   s    r'   c             C   sX   d |  j  k r. t   } t |  |  j  d <n t |  j  d  } d |  j  d <t |  S)a  
    Returns the CSRF token required for a POST form. The token is an
    alphanumeric value. A new token is created if one is not already set.

    A side effect of calling this function is to make the csrf_protect
    decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
    header to the outgoing response.  For this reason, you may need to use this
    function lazily, as is done by the csrf context processor.
    CSRF_COOKIETCSRF_COOKIE_USED)METAr   r$   r&   )requestZcsrf_secretr   r   r   	get_tokenP   s    
	r,   c             C   s.   |  j  j i d d 6t   d 6 d |  _ d S)zj
    Changes the CSRF token in use for a request - should be done on login
    for security purposes.
    Tr)   r(   N)r*   updater'   csrf_cookie_needs_reset)r+   r   r   r   rotate_tokenc   s    r/   c             C   sX   t  j d t |    r t   St |   t k r5 |  St |   t k rQ t |   St   S)Nz[^a-zA-Z0-9])researchr
   r'   r   CSRF_TOKEN_LENGTHr   r$   )r%   r   r   r   _sanitize_tokeno   s    
r3   c             C   s   t  t |   t |   S)N)r   r&   )request_csrf_token
csrf_tokenr   r   r   _compare_salted_tokens   s    	r6   c               @   sj   e  Z d  Z d Z d d   Z d d   Z d d   Z d d	   Z d
 d   Z d d   Z	 d d   Z
 d S)CsrfViewMiddlewarez
    Middleware that requires a present and correct csrfmiddlewaretoken
    for POST requests that have a CSRF cookie, and sets an outgoing
    CSRF cookie.

    This middleware should be used in conjunction with the csrf_token template
    tag.
    c             C   s   d | _  d  S)NT)csrf_processing_done)selfr+   r   r   r   _accept   s    	zCsrfViewMiddleware._acceptc             C   s=   t  j d | | j d i d d 6| d 6t   | d | S)NzForbidden (%s): %sextrai  status_coder+   reason)loggerwarningpathr   )r9   r+   r=   r   r   r   _reject   s    zCsrfViewMiddleware._rejectc             C   s   t  j rZ y | j j t  SWq t k
 rV t d t  j d  k rH d n d   Yq XnU y | j t  j	 } Wn t
 k
 r d  SYn Xt |  } | | k r d | _ n  | Sd  S)NzCSRF_USE_SESSIONS is enabled, but request.session is not set. SessionMiddleware must appear before CsrfViewMiddleware in MIDDLEWARE%s.Z_CLASSESr   T)r   CSRF_USE_SESSIONSsessiongetCSRF_SESSION_KEYAttributeErrorr   Z
MIDDLEWAREZCOOKIESCSRF_COOKIE_NAMEKeyErrorr3   r.   )r9   r+   Zcookie_tokenr5   r   r   r   
_get_token   s    	'	zCsrfViewMiddleware._get_tokenc             C   sx   t  j r  | j d | j t <nT | j t  j | j d d t  j d t  j d t  j	 d t  j
 d t  j t | d  d  S)	Nr(   Zmax_agedomainr@   securehttponlyCookie)zCookie)r   rB   r*   rC   rE   
set_cookierG   ZCSRF_COOKIE_AGECSRF_COOKIE_DOMAINZCSRF_COOKIE_PATHZCSRF_COOKIE_SECUREZCSRF_COOKIE_HTTPONLYr   )r9   r+   responser   r   r   
_set_token   s    					
zCsrfViewMiddleware._set_tokenc             C   s/   |  j  |  } | d  k	 r+ | | j d <n  d  S)Nr(   )rI   r*   )r9   r+   r5   r   r   r   process_request   s    z"CsrfViewMiddleware.process_requestc                s  t  | d d  r d  St  | d d  r, d  S| j d k rt  | d d  rZ |  j |  S| j   rt | j j d	  d
 d d d     d  k r |  j | t  St	      d   j
   j f k r |  j | t  S  j
 d k r |  j | t  St j rt j n t j } | d  k	 rN| j   } | d k rZd | | f } qZn | j   } t t j  } | j |  t   f d d   | D  st   j   } |  j | |  Sn  | j j d  }	 |	 d  k r|  j | t  Sd }
 | j d k r,y | j j d d  }
 Wq,t k
 r(Yq,Xn  |
 d k rS| j j t j d  }
 n  t |
  }
 t |
 |	  s|  j | t   Sn  |  j |  S)Nr8   FZcsrf_exemptGETHEADOPTIONSTRACEZ_dont_enforce_csrf_checksHTTP_REFERERZstrings_onlyTerrorsreplacer   https44380z%s:%sc             3   s!   |  ] } t    j |  Vq d  S)N)r   netloc)r   host)refererr   r   r     s    z2CsrfViewMiddleware.process_view.<locals>.<genexpr>r(   POSTZcsrfmiddlewaretoken)zGETzHEADzOPTIONSrV   )r[   z80)!getattrmethodr:   Z	is_securer
   r*   rD   rA   REASON_NO_REFERERr   schemer]   REASON_MALFORMED_REFERERREASON_INSECURE_REFERERr   rB   ZSESSION_COOKIE_DOMAINrO   Zget_portget_hostlistZCSRF_TRUSTED_ORIGINSappendanyREASON_BAD_REFERERgeturlREASON_NO_CSRF_COOKIEr`   IOErrorZCSRF_HEADER_NAMEr3   r6   REASON_BAD_TOKEN)r9   r+   callbackcallback_argscallback_kwargsZgood_refererserver_portZ
good_hostsr=   r5   r4   r   )r_   r   process_view   s\    		zCsrfViewMiddleware.process_viewc             C   sa   t  | d d  s+ t  | d d  r+ | Sn  | j j d d  sD | S|  j | |  d | _ | S)Nr.   Fcsrf_cookie_setr)   T)ra   r*   rD   rQ   ru   )r9   r+   rP   r   r   r   process_response@  s    	z#CsrfViewMiddleware.process_responseN)__name__
__module____qualname____doc__r:   rA   rI   rQ   rR   rt   rv   r   r   r   r   r7      s   
nr7   )3rz   
__future__r   loggingr0   stringZdjango.confr   Zdjango.core.exceptionsr   Zdjango.urlsr   Zdjango.utils.cacher   Zdjango.utils.cryptor   r   Zdjango.utils.deprecationr	   Zdjango.utils.encodingr
   Zdjango.utils.httpr   Zdjango.utils.six.movesr   Z#django.utils.six.moves.urllib.parser   	getLoggerr>   rc   rk   rm   ro   re   rf   r   r2   ascii_lettersdigitsr   rE   r   r   r$   r&   r'   r,   r/   r3   r6   r7   r   r   r   r   <module>   sF   
	