

_V&                 @   s3  d  Z  d d l m Z d d l Z d d l Z d d l m Z d d l m Z d d l	 m
 Z
 d d l m Z m Z d d l m Z d d	 l m Z d d
 l m Z e j d  Z d Z d Z d Z d Z d Z d Z d Z d d   Z d d   Z d d   Z d d   Z  d d   Z! Gd d   d e"  Z# d S)z
Cross Site Request Forgery Middleware.

This module provides a middleware that implements protection
against request forgeries from other sites.
    )unicode_literalsN)settings)get_callable)patch_vary_headers)constant_time_compareget_random_string)
force_text)is_same_domain)urlparsezdjango.requestz%Referer checking failed - no Referer.z@Referer checking failed - %s does not match any trusted origins.zCSRF cookie not set.z CSRF token missing or incorrect.z/Referer checking failed - Referer is malformed.zCReferer checking failed - Referer is insecure while host is secure.    c               C   s   t  t j  S)z9
    Returns the view to be used for CSRF rejections
    )r   r   ZCSRF_FAILURE_VIEW r   r   8/tmp/pip-build-ghmbqnp_/Django/django/middleware/csrf.py_get_failure_view    s    r   c               C   s
   t  t  S)N)r   CSRF_KEY_LENGTHr   r   r   r   _get_new_csrf_key'   s    r   c             C   s:   d |  j  k r" t   |  j  d <n  d |  j  d <|  j  d S)a  
    Returns the CSRF token required for a POST form. The token is an
    alphanumeric value. A new token is created if one is not already set.

    A side effect of calling this function is to make the csrf_protect
    decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
    header to the outgoing response.  For this reason, you may need to use this
    function lazily, as is done by the csrf context processor.
    CSRF_COOKIETCSRF_COOKIE_USED)METAr   )requestr   r   r   	get_token+   s    
r   c             C   s%   |  j  j i d d 6t   d 6 d S)zj
    Changes the CSRF token in use for a request - should be done on login
    for security purposes.
    Tr   r   N)r   updater   )r   r   r   r   rotate_token;   s    r   c             C   sK   t  |   t k r t   St j d d t |    }  |  d k rG t   S|  S)Nz[^a-zA-Z0-9]+ )lenr   r   resubr   )tokenr   r   r   _sanitize_tokenF   s    r   c               @   sF   e  Z d  Z d Z d d   Z d d   Z d d   Z d d	   Z d
 S)CsrfViewMiddlewarez
    Middleware that requires a present and correct csrfmiddlewaretoken
    for POST requests that have a CSRF cookie, and sets an outgoing
    CSRF cookie.

    This middleware should be used in conjunction with the csrf_token template
    tag.
    c             C   s   d | _  d  S)NT)csrf_processing_done)selfr   r   r   r   _accept\   s    	zCsrfViewMiddleware._acceptc             C   s=   t  j d | | j d i d d 6| d 6t   | d | S)NzForbidden (%s): %sextrai  status_coder   reason)loggerwarningpathr   )r    r   r$   r   r   r   _rejectc   s
    zCsrfViewMiddleware._rejectc                s  t  | d d  r d  Sy' t | j t j  } | | j d <Wn t k
 rW d  } Yn Xt  | d d  rn d  S| j d k rt  | d	 d  r |  j |  S| j	   rt
 | j j d
  d d d d     d  k r |  j | t  St      d   j   j f k r|  j | t  S  j d k r;|  j | t  St j d  k rY| j   } n4 t j } | j   } | d k rd | | f } n  t t j  } | j |  t   f d d   | D  st   j   }	 |  j | |	  Sn  | d  k r|  j | t  Sd }
 | j d k rMy | j j d d  }
 WqMt k
 rIYqMXn  |
 d k rt| j j t j d  }
 n  t  |
 |  s|  j | t!  Sn  |  j |  S)Nr   Fr   Zcsrf_exemptGETHEADOPTIONSTRACEZ_dont_enforce_csrf_checksZHTTP_REFERERZstrings_onlyTerrorsreplacer   https44380z%s:%sc             3   s!   |  ] } t    j |  Vq d  S)N)r	   netloc).0host)refererr   r   	<genexpr>   s    z2CsrfViewMiddleware.process_view.<locals>.<genexpr>POSTZcsrfmiddlewaretoken)zGETzHEADzOPTIONSzTRACE)r0   z80)"getattrr   ZCOOKIESr   CSRF_COOKIE_NAMEr   KeyErrormethodr!   Z	is_securer   getr(   REASON_NO_REFERERr
   schemer2   REASON_MALFORMED_REFERERREASON_INSECURE_REFERERCSRF_COOKIE_DOMAINget_hostZget_portlistZCSRF_TRUSTED_ORIGINSappendanyREASON_BAD_REFERERgeturlREASON_NO_CSRF_COOKIEr7   IOErrorZCSRF_HEADER_NAMEr   REASON_BAD_TOKEN)r    r   callbackcallback_argscallback_kwargsZ
csrf_tokenZgood_refererZserver_portZ
good_hostsr$   Zrequest_csrf_tokenr   )r5   r   process_viewl   sb    		zCsrfViewMiddleware.process_viewc             C   s   t  | d d  r | S| j j d d  s/ | S| j t j | j d d t j d t j d t j d t j	 d	 t j
 t | d  d | _ | S)Nr   Fr   r   Zmax_agedomainr'   securehttponlyCookieT)zCookie)r8   r   r<   
set_cookier   r9   ZCSRF_COOKIE_AGErA   ZCSRF_COOKIE_PATHZCSRF_COOKIE_SECUREZCSRF_COOKIE_HTTPONLYr   r   )r    r   responser   r   r   process_response   s    				
	z#CsrfViewMiddleware.process_responseN)__name__
__module____qualname____doc__r!   r(   rN   rU   r   r   r   r   r   Q   s
   	pr   )$rY   
__future__r   loggingr   Zdjango.confr   Zdjango.core.urlresolversr   Zdjango.utils.cacher   Zdjango.utils.cryptor   r   Zdjango.utils.encodingr   Zdjango.utils.httpr	   Z#django.utils.six.moves.urllib.parser
   	getLoggerr%   r=   rF   rH   rJ   r?   r@   r   r   r   r   r   r   objectr   r   r   r   r   <module>   s0   