U }ag[4@sddlmZddlmZddlmZmZddlmZm Z m Z m Z ddl m Z ddlmZddlmZmZmZddlmZdd lmZmZdd lmZmZmZmZmZmZm Z dd l!m"Z"m#Z#m$Z$dd l%m&Z&ee'Z(Gd ddeeZ)dS)) getLogger)Optional)router transaction)FQSumValue)Concat)timezone)clean_expired_user_attemptsget_user_attemptsreset_user_attempts)settings)AxesBaseHandlerAbstractAxesHandler)get_client_session_hashget_client_strget_client_usernameget_credentialsget_failure_limitget_lockout_parameters get_query_str) AccessLog AccessAttemptAccessFailureLog)user_locked_outc@seZdZdZddddeeeeeedddZddeeed d d Z ddeeed d d Z e j deeeedddZ d eeedddZd!edddZddZddZddZddZdS)"AxesDatabaseHandlera Signal handler implementation that records user login attempts to database and locks users out if necessary. .. note:: The get_user_attempts function is called several time during the authentication and lockout process, caching its output can be dangerous. NF) ip_addressusernameip_or_username)rrr returncCsftj}|r*|t|dt|dB}n |r:|j|d}|rJ|j|d}|\}}td||S)N)rrz-AXES: Reset %d access attempts from database.)robjectsallfilterrdeleteloginfo)selfrrr attemptscount_r-N/var/www/html/publicvenv/lib/python3.8/site-packages/axes/handlers/database.pyreset_attempts's     z"AxesDatabaseHandler.reset_attempts)age_days)r0r!cCsd|dkr(tj\}}td|n8ttj|d}tjj |d\}}td|||S)Nz-AXES: Reset all %d access logs from database.daysZattempt_time__ltezls  z3AxesDatabaseHandler.get_failures..)r max)r)requestr<Z attempts_listZ attempt_countr-r-r. get_failuresjs   z AxesDatabaseHandler.get_failures)r<c KsXtd|dkr tddSt|t||}t||j|j|j|}t j sr|j rr||_ t jd|||jddSt|jdd}t|jdd}|||rtd|dSt||} | d gkr|dkrtd ntjttd tjj||j|j|||j|jd |jd d\} } | r6td|nfd} t dt!| || _"t dt!| || _#|j| _$|j| _%t&dd | _'|j| _(| )td|W5QRX|*||} | |_+t j,r| t-||krtd|d|_ ||_ t jd|||jdt j.rTtjtt/d 8t/jj0||j|j|j|j|j|j d|j1|dW5QRXdS)zWhen user login fails, save AccessFailureLog record in database, save AccessAttempt record in database, mark request with lockout attribute and emit lockout signal. z>AXES: User login failed, running database handler for failure.NzPAXES: AxesDatabaseHandler.user_login_failed does not function without a request.Zaxes)rArrZ0x00z.AXES: Login failed from whitelisted client %s.rzfAXES: Username is None and username is the only one lockout parameter, new record will NOT be created.)usingr:)get_data post_data http_accept path_infor= attempt_time)rr user_agentdefaultszBAXES: New login failure by %s. Created new record in the database.z --------- rErFr=zLAXES: Repeated login failure by %s. Updated existing record in the database.z3AXES: Locking out %s after repeated login failures.T)rrrJrGrHrIZ locked_outr")2r'r(errorr rraxes_ip_addressaxes_user_agentaxes_path_inforZ-AXES_RESET_COOL_OFF_ON_FAILURE_DURING_LOCKOUTZaxes_locked_outZaxes_credentialsrsendrGETreplacePOSTZis_whitelistedrwarningrZatomicrZ db_for_writerr#Zselect_for_updateZ get_or_createaxes_http_acceptaxes_attempt_timer r rErFrGrHrr=rIsaverBZaxes_failures_since_startZAXES_LOCK_OUT_AT_FAILURErZAXES_ENABLE_ACCESS_FAILURE_LOGrcreater;)r)senderr<rAkwargsr client_strrErFZlockout_parametersattemptcreated separatorr=r-r-r.user_login_failedws            z%AxesDatabaseHandler.user_login_failedc Kst||}t|}t||j|j|j|}td|t j sht j j ||j|j|j|j|jt|dt jrt||}td||dS)zN When user logs in, update the AccessLog related to the user. zAXES: Successful login by %s.)rrrJrGrHrI session_hashz;AXES: Deleted %d failed login attempts by %s from database.N)r get_usernamerrrMrNrOr'r(rAXES_DISABLE_ACCESS_LOGrr#rXrUrVrZAXES_RESET_ON_SUCCESSr) r)rYrAuserrZrr<r[r+r-r-r.user_logged_ins8   z"AxesDatabaseHandler.user_logged_incKsht||r|nd}t||j|j|j|}td||rdtj sdt j j |dt |dj|jddS)zO When user logs out, update the AccessLog related to the user. NzAXES: Successful logout by %s.T)rZlogout_time__isnullr`)Z logout_time)r rarrMrNrOr'r(rrbrr#r%rupdaterV)r)rYrArcrZrr[r-r-r.user_logged_out.s$  z#AxesDatabaseHandler.user_logged_outcKsdS)z Handles the ``axes.models.AccessAttempt`` object post save signal. When needed, all post_save actions for this backend should be located here. Nr-r)instancerZr-r-r.post_save_access_attemptJsz,AxesDatabaseHandler.post_save_access_attemptcKsdS)z Handles the ``axes.models.AccessAttempt`` object post delete signal. When needed, all post_delete actions for this backend should be located here. Nr-rgr-r-r.post_delete_access_attemptRsz.AxesDatabaseHandler.post_delete_access_attempt)N)N)__name__ __module__ __qualname____doc__rstrboolintr/r8r9rZ&AXES_ACCESS_FAILURE_LOG_PER_USER_LIMITr;dictrBr_rdrfrirjr-r-r-r.rs2     +rN)*loggingrtypingrZ django.dbrrZdjango.db.modelsrrrr Zdjango.db.models.functionsr Z django.utilsr Z axes.attemptsr r rZ axes.confrZaxes.handlers.baserrZ axes.helpersrrrrrrrZ axes.modelsrrrZ axes.signalsrrkr'rr-r-r-r.s     $