a
    ¥Q•hM  ã                   @   sŠ  d Z ddlZddlZddlmZ ddlmZ ddlmZ ddl	m
Z
mZ ddlmZmZ ddlmZ dd	lmZ dd
lmZmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ e  d¡Z!edƒZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,de, Z-ej.ej/ Z0dZ1dd„ Z2d d!„ Z3d"d#„ Z4d$d%„ Z5d&d'„ Z6d(d)„ Z7d*d+„ Z8G d,d-„ d-e9ƒZ:d.d/„ Z;d0d1„ Z<G d2d3„ d3e9ƒZ=G d4d5„ d5eƒZ>dS )6z’
Cross Site Request Forgery Middleware.

This module provides a middleware that implements protection
against request forgeries from other sites.
é    N)Údefaultdict©Úurlparse)Úsettings)ÚDisallowedHostÚImproperlyConfigured)ÚHttpHeadersÚUnreadablePostError)Úget_callable)Úpatch_vary_headers)Úconstant_time_compareÚget_random_string)ÚMiddlewareMixin)Úcached_property©Úis_same_domain)Úlog_response)Ú_lazy_re_compilezdjango.security.csrfz[^a-zA-Z0-9]z?Origin checking failed - %s does not match any trusted origins.z%Referer checking failed - no Referer.z@Referer checking failed - %s does not match any trusted origins.zCSRF cookie not set.zCSRF token missing.z/Referer checking failed - Referer is malformed.zCReferer checking failed - Referer is insecure while host is secure.zhas incorrect lengthzhas invalid charactersé    é   Z
_csrftokenc                   C   s
   t tjƒS )z/Return the view to be used for CSRF rejections.)r
   r   ÚCSRF_FAILURE_VIEW© r   r   úO/var/www/sistema_ama/venv/lib/python3.9/site-packages/django/middleware/csrf.pyÚ_get_failure_view1   s    r   c                   C   s   t ttd�S )N)Úallowed_chars)r   ÚCSRF_SECRET_LENGTHÚCSRF_ALLOWED_CHARSr   r   r   r   Ú_get_new_csrf_string6   s    r   c                    sP   t ƒ }t‰ t‡ fdd„| D ƒ‡ fdd„|D ƒƒ}d ‡ fdd„|D ƒ¡}|| S )z�
    Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
    token by adding a mask and applying it to the secret.
    c                 3   s   | ]}ˆ   |¡V  qd S ©N©Úindex©Ú.0Úx©Úcharsr   r   Ú	<genexpr>A   ó    z&_mask_cipher_secret.<locals>.<genexpr>Ú c                 3   s&   | ]\}}ˆ || t ˆ ƒ  V  qd S r   )Úlen©r"   r#   Úyr$   r   r   r&   B   r'   )r   r   ÚzipÚjoin)ÚsecretÚmaskÚpairsÚcipherr   r$   r   Ú_mask_cipher_secret:   s
    &r2   c                    sZ   | dt … }| t d… } t‰ t‡ fdd„| D ƒ‡ fdd„|D ƒƒ}d ‡ fdd„|D ƒ¡S )zÑ
    Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
    CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt
    the second half to produce the original secret.
    Nc                 3   s   | ]}ˆ   |¡V  qd S r   r   r!   r$   r   r   r&   O   r'   z'_unmask_cipher_token.<locals>.<genexpr>r(   c                 3   s   | ]\}}ˆ ||  V  qd S r   r   r*   r$   r   r   r&   P   r'   )r   r   r,   r-   )Útokenr/   r0   r   r$   r   Ú_unmask_cipher_tokenF   s
    &r4   c                 C   s*   t ƒ }| j tjrt|ƒn|ddœ¡ |S )zDGenerate a new random CSRF_COOKIE value, and add it to request.META.T)ÚCSRF_COOKIEÚCSRF_COOKIE_NEEDS_UPDATE)r   ÚMETAÚupdater   ÚCSRF_COOKIE_MASKEDr2   ©ÚrequestÚcsrf_secretr   r   r   Ú_add_new_csrf_cookieS   s    ÿ
øÿr=   c                 C   s0   d| j v r | j d }d| j d< nt| ƒ}t|ƒS )aº  
    Return the CSRF token required for a POST form. The token is an
    alphanumeric value. A new token is created if one is not already set.

    A side effect of calling this function is to make the csrf_protect
    decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
    header to the outgoing response.  For this reason, you may need to use this
    function lazily, as is done by the csrf context processor.
    r5   Tr6   )r7   r=   r2   r:   r   r   r   Ú	get_tokene   s
    


r>   c                 C   s   t | ƒ dS )zi
    Change the CSRF token in use for a request - should be done on login
    for security purposes.
    N)r=   )r;   r   r   r   Úrotate_tokenz   s    r?   c                   @   s   e Zd Zdd„ ZdS )ÚInvalidTokenFormatc                 C   s
   || _ d S r   ©Úreason©ÚselfrB   r   r   r   Ú__init__ƒ   s    zInvalidTokenFormat.__init__N©Ú__name__Ú
__module__Ú__qualname__rE   r   r   r   r   r@   ‚   s   r@   c                 C   s.   t | ƒttfvrttƒ‚t | ¡r*ttƒ‚dS )zá
    Raise an InvalidTokenFormat error if the token has an invalid length or
    characters that aren't allowed. The token argument can be a CSRF cookie
    secret or non-cookie CSRF token, and either masked or unmasked.
    N)r)   ÚCSRF_TOKEN_LENGTHr   r@   ÚREASON_INCORRECT_LENGTHÚinvalid_token_chars_reÚsearchÚREASON_INVALID_CHARACTERS)r3   r   r   r   Ú_check_token_format‡   s    
rO   c                 C   s.   t | ƒtkrt| ƒ} t | ƒtks$J ‚t| |ƒS )aƒ  
    Return whether the given CSRF token matches the given CSRF secret, after
    unmasking the token if necessary.

    This function assumes that the request_csrf_token argument has been
    validated to have the correct length (CSRF_SECRET_LENGTH or
    CSRF_TOKEN_LENGTH characters) and allowed characters, and that if it has
    length CSRF_TOKEN_LENGTH, it is a masked secret.
    )r)   rJ   r4   r   r   )Úrequest_csrf_tokenr<   r   r   r   Ú_does_token_match”   s    rQ   c                   @   s   e Zd Zdd„ ZdS )ÚRejectRequestc                 C   s
   || _ d S r   rA   rC   r   r   r   rE   ¦   s    zRejectRequest.__init__NrF   r   r   r   r   rR   ¥   s   rR   c                   @   sŒ   e Zd ZdZedd„ ƒZedd„ ƒZedd„ ƒZdd	„ Zd
d„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ ZdS )ÚCsrfViewMiddlewarezê
    Require a present and correct csrfmiddlewaretoken for POST requests that
    have a CSRF cookie, and set an outgoing CSRF cookie.

    This middleware should be used in conjunction with the {% csrf_token %}
    template tag.
    c                 C   s   dd„ t jD ƒS )Nc                 S   s   g | ]}t |ƒj d ¡‘qS ©Ú*)r   ÚnetlocÚlstrip©r"   Úoriginr   r   r   Ú
<listcomp>µ   s   ÿzACsrfViewMiddleware.csrf_trusted_origins_hosts.<locals>.<listcomp>©r   ÚCSRF_TRUSTED_ORIGINS©rD   r   r   r   Úcsrf_trusted_origins_hosts³   s    þz-CsrfViewMiddleware.csrf_trusted_origins_hostsc                 C   s   dd„ t jD ƒS )Nc                 S   s   h | ]}d |vr|’qS rT   r   rX   r   r   r   Ú	<setcomp>¼   r'   z;CsrfViewMiddleware.allowed_origins_exact.<locals>.<setcomp>r[   r]   r   r   r   Úallowed_origins_exactº   s    z(CsrfViewMiddleware.allowed_origins_exactc                 C   s:   t tƒ}dd„ tjD ƒD ]}||j  |j d¡¡ q|S )z‚
        A mapping of allowed schemes to list of allowed netlocs, where all
        subdomains of the netloc are allowed.
        c                 s   s   | ]}d |v rt |ƒV  qdS )rU   Nr   rX   r   r   r   r&   Å   s   þz?CsrfViewMiddleware.allowed_origin_subdomains.<locals>.<genexpr>rU   )r   Úlistr   r\   ÚschemeÚappendrV   rW   )rD   Úallowed_origin_subdomainsÚparsedr   r   r   rd   ¾   s    þ
z,CsrfViewMiddleware.allowed_origin_subdomainsc                 C   s
   d|_ d S )NT)Úcsrf_processing_done)rD   r;   r   r   r   Ú_acceptÏ   s    zCsrfViewMiddleware._acceptc                 C   s(   t ƒ ||d�}td||j||td� |S )NrA   zForbidden (%s): %s)Úresponser;   Úlogger)r   r   Úpathri   )rD   r;   rB   rh   r   r   r   Ú_rejectÖ   s    úzCsrfViewMiddleware._rejectc                 C   sˆ   t jr4z|j t¡}W qd ty0   tdƒ‚Y qd0 n0z|jt j }W n t	yZ   d}Y n
0 t
|ƒ |du rpdS t|ƒtkr„t|ƒ}|S )a  
        Return the CSRF secret originally associated with the request, or None
        if it didn't have one.

        If the CSRF_USE_SESSIONS setting is false, raises InvalidTokenFormat if
        the request's secret has invalid characters or an invalid length.
        z„CSRF_USE_SESSIONS is enabled, but request.session is not set. SessionMiddleware must appear before CsrfViewMiddleware in MIDDLEWARE.N)r   ÚCSRF_USE_SESSIONSÚsessionÚgetÚCSRF_SESSION_KEYÚAttributeErrorr   ÚCOOKIESÚCSRF_COOKIE_NAMEÚKeyErrorrO   r)   rJ   r4   ©rD   r;   r<   r   r   r   Ú_get_secretâ   s"    ÿ
zCsrfViewMiddleware._get_secretc              
   C   sj   t jr.|j t¡|jd krf|jd |jt< n8|jt j|jd t jt j	t j
t jt jt jd� t|dƒ d S )Nr5   )Úmax_ageÚdomainrj   ÚsecureÚhttponlyÚsamesite)ÚCookie)r   rl   rm   rn   ro   r7   Ú
set_cookierr   ÚCSRF_COOKIE_AGEÚCSRF_COOKIE_DOMAINÚCSRF_COOKIE_PATHÚCSRF_COOKIE_SECUREÚCSRF_COOKIE_HTTPONLYÚCSRF_COOKIE_SAMESITEr   ©rD   r;   rh   r   r   r   Ú_set_csrf_cookie  s    øz#CsrfViewMiddleware._set_csrf_cookiec                    sª   |j d }z| ¡ }W n ty(   Y n&0 d| ¡ r8dnd|f }||krNdS || jv r\dS zt|ƒ}W n ty|   Y dS 0 |j}|j‰ t	‡ fdd„| j
 |d	¡D ƒƒS )
NÚHTTP_ORIGINz%s://%sÚhttpsÚhttpTFc                 3   s   | ]}t ˆ |ƒV  qd S r   r   ©r"   Úhost©Zrequest_netlocr   r   r&   )  s   ÿz6CsrfViewMiddleware._origin_verified.<locals>.<genexpr>r   )r7   Úget_hostr   Ú	is_securer`   r   Ú
ValueErrorrb   rV   Úanyrd   rn   )rD   r;   Zrequest_originZ	good_hostZgood_originZparsed_originZrequest_schemer   rŠ   r   Ú_origin_verified  s,    
þ
þz#CsrfViewMiddleware._origin_verifiedc                    s  |j  d¡‰ ˆ d u rttƒ‚ztˆ ƒ‰ W n tyB   ttƒ‚Y n0 dˆ jˆ jfv r\ttƒ‚ˆ jdkrntt	ƒ‚t
‡ fdd„| jD ƒƒrŠd S tjr–tjntj}|d u rÖz| ¡ }W qò tyÒ   ttˆ  ¡  ƒ‚Y qò0 n| ¡ }|dvròd||f }tˆ j|ƒ�sttˆ  ¡  ƒ‚d S )NZHTTP_REFERERr(   r†   c                 3   s   | ]}t ˆ j|ƒV  qd S r   )r   rV   rˆ   ©Zrefererr   r   r&   @  s   ÿz4CsrfViewMiddleware._check_referer.<locals>.<genexpr>)Ú443Ú80z%s:%s)r7   rn   rR   ÚREASON_NO_REFERERr   r�   ÚREASON_MALFORMED_REFERERrb   rV   ÚREASON_INSECURE_REFERERrŽ   r^   r   rl   ÚSESSION_COOKIE_DOMAINr~   r‹   r   ÚREASON_BAD_REFERERÚgeturlÚget_portr   )rD   r;   Zgood_refererÚserver_portr   r�   r   Ú_check_referer.  s:    
þÿýz!CsrfViewMiddleware._check_refererc                 C   s0   |dkrt  |¡}d|›d�}d|› d|› d�S )NÚPOSTzthe z HTTP headerzCSRF token from ú Ú.)r   Úparse_header_name)rD   rB   Útoken_sourceÚheader_namer   r   r   Ú_bad_token_message[  s    
z%CsrfViewMiddleware._bad_token_messagec              
   C   s8  z|   |¡}W n6 tyD } ztd|j› d�ƒ‚W Y d }~n
d }~0 0 |d u rVttƒ‚d}|jdkrŠz|j dd¡}W n tyˆ   Y n0 |dkrÆz|j	t
j }W n ty¼   ttƒ‚Y n0 t
j}nd}zt|ƒ W n< t�y } z"|  |j|¡}t|ƒ‚W Y d }~n
d }~0 0 t||ƒ�s4|  d|¡}t|ƒ‚d S )NzCSRF cookie rž   r(   rœ   ZcsrfmiddlewaretokenZ	incorrect)ru   r@   rR   rB   ÚREASON_NO_CSRF_COOKIEÚmethodrœ   rn   r	   r7   r   ÚCSRF_HEADER_NAMErs   ÚREASON_CSRF_TOKEN_MISSINGrO   r¢   rQ   )rD   r;   r<   ÚexcrP   r    rB   r   r   r   Ú_check_tokenb  s6    (
zCsrfViewMiddleware._check_tokenc                 C   s@   z|   |¡}W n ty(   t|ƒ Y n0 |d ur<||jd< d S )Nr5   )ru   r@   r=   r7   rt   r   r   r   Úprocess_request–  s    z"CsrfViewMiddleware.process_requestc              
   C   s  t |ddƒrd S t |ddƒr d S |jdv r4|  |¡S t |ddƒrJ|  |¡S d|jv rv|  |¡sÀ|  |t|jd  ¡S nJ| ¡ rÀz|  |¡ W n2 t	y¾ } z|  ||j
¡W  Y d }~S d }~0 0 z|  |¡ W n4 t	�y } z|  ||j
¡W  Y d }~S d }~0 0 |  |¡S )Nrf   FZcsrf_exempt)ÚGETÚHEADÚOPTIONSZTRACEZ_dont_enforce_csrf_checksr…   )Úgetattrr¤   rg   r7   r�   rk   ÚREASON_BAD_ORIGINrŒ   r›   rR   rB   r¨   )rD   r;   ÚcallbackZcallback_argsZcallback_kwargsr§   r   r   r   Úprocess_view£  s.    




ÿ$$zCsrfViewMiddleware.process_viewc                 C   s&   |j  d¡r"|  ||¡ d|j d< |S )Nr6   F)r7   rn   r„   rƒ   r   r   r   Úprocess_responseÜ  s    
z#CsrfViewMiddleware.process_responseN)rG   rH   rI   Ú__doc__r   r^   r`   rd   rg   rk   ru   r„   r�   r›   r¢   r¨   r©   r°   r±   r   r   r   r   rS   ª   s$   


 -49rS   )?r²   ÚloggingÚstringÚcollectionsr   Úurllib.parser   Údjango.confr   Údjango.core.exceptionsr   r   Údjango.httpr   r	   Údjango.urlsr
   Zdjango.utils.cacher   Údjango.utils.cryptor   r   Údjango.utils.deprecationr   Údjango.utils.functionalr   Údjango.utils.httpr   Údjango.utils.logr   Údjango.utils.regex_helperr   Ú	getLoggerri   rL   r®   r“   r—   r£   r¦   r”   r•   rK   rN   r   rJ   Úascii_lettersÚdigitsr   ro   r   r   r2   r4   r=   r>   r?   Ú	Exceptionr@   rO   rQ   rR   rS   r   r   r   r   Ú<module>   sV   
ÿ