ó
Ñ7ec           @  s¤  d  Z  d d l m Z d d l Z d d l Z d d l Z d d l m Z d d l m	 Z	 d d l
 m Z d d l m Z d d l m Z m Z d d	 l m Z d d
 l m Z d d l m Z d d l m Z d d l m Z e j d ƒ Z d Z d Z d Z d Z  d Z! d Z" d Z# d e# Z$ e j% e j& Z' d Z( d „  Z) d „  Z* d „  Z+ d „  Z, d „  Z- d „  Z. d „  Z/ d „  Z0 d  „  Z1 d! e f d" „  ƒ  YZ2 d S(#   u’   
Cross Site Request Forgery Middleware.

This module provides a middleware that implements protection
against request forgeries from other sites.
iÿÿÿÿ(   t   unicode_literalsN(   t   settings(   t   ImproperlyConfigured(   t   get_callable(   t   patch_vary_headers(   t   constant_time_comparet   get_random_string(   t   MiddlewareMixin(   t
   force_text(   t   is_same_domain(   t   zip(   t   urlparseu   django.security.csrfu%   Referer checking failed - no Referer.u@   Referer checking failed - %s does not match any trusted origins.u   CSRF cookie not set.u    CSRF token missing or incorrect.u/   Referer checking failed - Referer is malformed.uC   Referer checking failed - Referer is insecure while host is secure.i    i   u
   _csrftokenc           C  s   t  t j ƒ S(   u9   
    Returns the view to be used for CSRF rejections
    (   R   R   t   CSRF_FAILURE_VIEW(    (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   _get_failure_view'   s    c           C  s   t  t d t ƒS(   Nt   allowed_chars(   R   t   CSRF_SECRET_LENGTHt   CSRF_ALLOWED_CHARS(    (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   _get_new_csrf_string.   s    c           se   t  ƒ  } t ‰  t ‡  f d †  |  Dƒ ‡  f d †  | Dƒ ƒ } d j ‡  f d †  | Dƒ ƒ } | | S(   u’   
    Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
    token by adding a salt and using it to encrypt the secret.
    c         3  s   |  ] } ˆ  j  | ƒ Vq d  S(   N(   t   index(   t   .0t   x(   t   chars(    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pys	   <genexpr>9   s    u    c         3  s-   |  ]# \ } } ˆ  | | t  ˆ  ƒ Vq d  S(   N(   t   len(   R   R   t   y(   R   (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pys	   <genexpr>:   s    (   R   R   R
   t   join(   t   secrett   saltt   pairst   cipher(    (   R   s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   _salt_cipher_secret2   s
    	/c           sl   |  t   } |  t  }  t ‰  t ‡  f d †  |  Dƒ ‡  f d †  | Dƒ ƒ } d j ‡  f d †  | Dƒ ƒ } | S(   uÑ   
    Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
    CSRF_TOKEN_LENGTH, and that its first half is a salt), use it to decrypt
    the second half to produce the original secret.
    c         3  s   |  ] } ˆ  j  | ƒ Vq d  S(   N(   R   (   R   R   (   R   (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pys	   <genexpr>G   s    u    c         3  s#   |  ] \ } } ˆ  | | Vq d  S(   N(    (   R   R   R   (   R   (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pys	   <genexpr>H   s    (   R   R   R
   R   (   t   tokenR   R   R   (    (   R   s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   _unsalt_cipher_token>   s    

/c           C  s   t  t ƒ  ƒ S(   N(   R   R   (    (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   _get_new_csrf_tokenL   s    c         C  sX   d |  j  k r. t ƒ  } t | ƒ |  j  d <n t |  j  d ƒ } t |  j  d <t | ƒ S(   u»  
    Returns the CSRF token required for a POST form. The token is an
    alphanumeric value. A new token is created if one is not already set.

    A side effect of calling this function is to make the csrf_protect
    decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
    header to the outgoing response.  For this reason, you may need to use this
    function lazily, as is done by the csrf context processor.
    u   CSRF_COOKIEu   CSRF_COOKIE_USED(   t   METAR   R   R   t   True(   t   requestt   csrf_secret(    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt	   get_tokenP   s    
	c         C  s.   |  j  j i t d 6t ƒ  d 6ƒ t |  _ d S(   uj   
    Changes the CSRF token in use for a request - should be done on login
    for security purposes.
    u   CSRF_COOKIE_USEDu   CSRF_COOKIEN(   R!   t   updateR"   R    t   csrf_cookie_needs_reset(   R#   (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   rotate_tokenc   s    c         C  sX   t  j d t |  ƒ ƒ r t ƒ  St |  ƒ t k r5 |  St |  ƒ t k rQ t |  ƒ St ƒ  S(   Nu   [^a-zA-Z0-9](   t   ret   searchR   R    R   t   CSRF_TOKEN_LENGTHR   R   (   R   (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   _sanitize_tokeno   s    
c         C  s   t  t |  ƒ t | ƒ ƒ S(   N(   R   R   (   t   request_csrf_tokent
   csrf_token(    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   _compare_salted_tokens€   s    	t   CsrfViewMiddlewarec           B  sM   e  Z d  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z	 RS(   uú   
    Middleware that requires a present and correct csrfmiddlewaretoken
    for POST requests that have a CSRF cookie, and sets an outgoing
    CSRF cookie.

    This middleware should be used in conjunction with the csrf_token template
    tag.
    c         C  s   t  | _ d  S(   N(   R"   t   csrf_processing_donet   None(   t   selfR#   (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   _accept”   s    	c         C  s=   t  j d | | j d i d d 6| d 6ƒt ƒ  | d | ƒS(   Nu   Forbidden (%s): %st   extrai“  u   status_codeu   requestt   reason(   t   loggert   warningt   pathR   (   R3   R#   R6   (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   _reject›   s    c         C  s®   t  j rY y | j j t ƒ SWqª t k
 rU t d t  j d  k rH d n d ƒ ‚ qª XnQ y | j	 t  j
 } Wn t k
 r d  SXt | ƒ } | | k r¦ t | _ n  | Sd  S(   Nu†   CSRF_USE_SESSIONS is enabled, but request.session is not set. SessionMiddleware must appear before CsrfViewMiddleware in MIDDLEWARE%s.u   _CLASSESu    (   R   t   CSRF_USE_SESSIONSt   sessiont   gett   CSRF_SESSION_KEYt   AttributeErrorR   t
   MIDDLEWARER2   t   COOKIESt   CSRF_COOKIE_NAMEt   KeyErrorR,   R"   R'   (   R3   R#   t   cookie_tokenR.   (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt
   _get_token¥   s    	&c         C  sx   t  j r  | j d | j t <nT | j t  j | j d d t  j d t  j d t  j	 d t  j
 d t  j ƒt | d ƒ d  S(	   Nu   CSRF_COOKIEt   max_aget   domainR9   t   securet   httponlyu   Cookie(   u   Cookie(   R   R;   R!   R<   R>   t
   set_cookieRB   t   CSRF_COOKIE_AGEt   CSRF_COOKIE_DOMAINt   CSRF_COOKIE_PATHt   CSRF_COOKIE_SECUREt   CSRF_COOKIE_HTTPONLYR   (   R3   R#   t   response(    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt
   _set_token¼   s    					
c         C  s/   |  j  | ƒ } | d  k	 r+ | | j d <n  d  S(   Nu   CSRF_COOKIE(   RE   R2   R!   (   R3   R#   R.   (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   process_requestÌ   s    c           sŠ  t  | d t ƒ r d  St  | d t ƒ r, d  S| j d k r}t  | d t ƒ rZ |  j | ƒ S| j ƒ  rµt | j j d ƒ d	 t	 d
 d ƒ‰  ˆ  d  k r¦ |  j
 | t ƒ St ˆ  ƒ ‰  d ˆ  j ˆ  j f k rÚ |  j
 | t ƒ Sˆ  j d k rù |  j
 | t ƒ St j rt j n t j } | d  k	 rN| j ƒ  } | d k rZd | | f } qZn | j ƒ  } t t j ƒ } | j | ƒ t ‡  f d †  | Dƒ ƒ sµt ˆ  j ƒ  } |  j
 | | ƒ Sn  | j j d ƒ }	 |	 d  k rã|  j
 | t ƒ Sd }
 | j d k r(y | j j d d ƒ }
 Wq(t k
 r$q(Xn  |
 d k rO| j j t j  d ƒ }
 n  t! |
 ƒ }
 t" |
 |	 ƒ s}|  j
 | t# ƒ Sn  |  j | ƒ S(   Nu   csrf_processing_doneu   csrf_exemptu   GETu   HEADu   OPTIONSu   TRACEu   _dont_enforce_csrf_checksu   HTTP_REFERERt   strings_onlyt   errorsu   replaceu    u   httpsu   443u   80u   %s:%sc         3  s!   |  ] } t  ˆ  j | ƒ Vq d  S(   N(   R	   t   netloc(   R   t   host(   t   referer(    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pys	   <genexpr>  s    u   CSRF_COOKIEu   POSTu   csrfmiddlewaretoken(   u   GETu   HEADu   OPTIONSu   TRACE(   u   443u   80($   t   getattrt   FalseR2   t   methodR4   t	   is_secureR   R!   R=   R"   R:   t   REASON_NO_REFERERR   t   schemeRU   t   REASON_MALFORMED_REFERERt   REASON_INSECURE_REFERERR   R;   t   SESSION_COOKIE_DOMAINRL   t   get_portt   get_hostt   listt   CSRF_TRUSTED_ORIGINSt   appendt   anyt   REASON_BAD_REFERERt   geturlt   REASON_NO_CSRF_COOKIEt   POSTt   IOErrort   CSRF_HEADER_NAMER,   R/   t   REASON_BAD_TOKEN(   R3   R#   t   callbackt   callback_argst   callback_kwargst   good_referert   server_portt
   good_hostsR6   R.   R-   (    (   RW   s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   process_viewÒ   s\    		c         C  sa   t  | d t ƒ s+ t  | d t ƒ r+ | Sn  | j j d t ƒ sD | S|  j | | ƒ t | _ | S(   Nu   csrf_cookie_needs_resetu   csrf_cookie_setu   CSRF_COOKIE_USED(   RX   RY   R!   R=   RQ   R"   t   csrf_cookie_set(   R3   R#   RP   (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   process_response@  s    	(
   t   __name__t
   __module__t   __doc__R4   R:   RE   RQ   RR   Rt   Rv   (    (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyR0   ‰   s   		
				n(3   Ry   t
   __future__R    t   loggingR)   t   stringt   django.confR   t   django.core.exceptionsR   t   django.urlsR   t   django.utils.cacheR   t   django.utils.cryptoR   R   t   django.utils.deprecationR   t   django.utils.encodingR   t   django.utils.httpR	   t   django.utils.six.movesR
   t#   django.utils.six.moves.urllib.parseR   t	   getLoggerR7   R\   Rg   Ri   Rm   R^   R_   R   R+   t   ascii_letterst   digitsR   R>   R   R   R   R   R    R%   R(   R,   R/   R0   (    (    (    s@   /usr/local/lib/python2.7/dist-packages/django/middleware/csrf.pyt   <module>   sF   
										