
    df#              
          d dl mZ d dlmZ ddlmZmZmZmZ h dZ	h dZ
dZdZd	Zd
e de de dZ edd          Z edd          Z edd          Z edd          Z edd          Z edd          Z eedz  d          Z edd          Z edd           Z ed!d"          Z ed#d$          Z ed%d&          Z ed'd(                    d)                     ee
                              d*+          Z ed,d(                    d)                     ee	                              d-+          Z eed.          Z d/ Z!d0 Z" eej#        d12          d3             Z$ eej#        d12          d4             Z% eej#        d12          d5             Z& eej#        d12          d6             Z' eej#        d12          d7             Z( eej#        d12          d8             Z) eej#        d12          d9             Z*d: Z+ eej#        d12          d;             Z, eej#        d12          d<             Z- eej#        d12          d=             Z. eej#        d12          d>             Z/ eej#        d12          d?             Z0 eej#        d12          d@             Z1 eej#        d12          dA             Z2dBS )C    )settings)ImproperlyConfigured   )ErrorTagsWarningregister>   unsafe-nonesame-origin-allow-popupssame-origin>   
unsafe-urlno-referrerstrict-originorigin-when-cross-originno-referrer-when-downgradestrict-origin-when-cross-originoriginr   zdjango-insecure-2      zYour %s has less than z characters, less than z+ unique characters, or it's prefixed with 'z' indicating that it was generated automatically by Django. Please generate a long and random value, otherwise many of Django's security-critical features will be vulnerable to attack.zYou do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_REFERRER_POLICY, SECURE_CROSS_ORIGIN_OPENER_POLICY, and SECURE_SSL_REDIRECT settings will have no effect.zsecurity.W001ida3  You do not have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, so your pages will not be served with an 'x-frame-options' header. Unless there is a good reason for your site to be served in a frame, you should consider enabling this header to help prevent clickjacking attacks.zsecurity.W002a,  You have not set a value for the SECURE_HSTS_SECONDS setting. If your entire site is served only over SSL, you may want to consider setting a value and enabling HTTP Strict Transport Security. Be sure to read the documentation first; enabling HSTS carelessly can cause serious, irreversible problems.zsecurity.W004a  You have not set the SECURE_HSTS_INCLUDE_SUBDOMAINS setting to True. Without this, your site is potentially vulnerable to attack via an insecure connection to a subdomain. Only set this to True if you are certain that all subdomains of your domain should be served exclusively via SSL.zsecurity.W005zYour SECURE_CONTENT_TYPE_NOSNIFF setting is not set to True, so your pages will not be served with an 'X-Content-Type-Options: nosniff' header. You should consider enabling this header to prevent the browser from identifying content types incorrectly.zsecurity.W006a  Your SECURE_SSL_REDIRECT setting is not set to True. Unless your site should be available over both SSL and non-SSL connections, you may want to either set this setting True or configure a load balancer or reverse-proxy server to redirect all connections to HTTPS.zsecurity.W008
SECRET_KEYzsecurity.W009z4You should not have DEBUG set to True in deployment.zsecurity.W018zYou have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, but X_FRAME_OPTIONS is not set to 'DENY'. Unless there is a good reason for your site to serve other parts of itself in a frame, you should change it to 'DENY'.zsecurity.W019z.ALLOWED_HOSTS must not be empty in deployment.zsecurity.W020zYou have not set the SECURE_HSTS_PRELOAD setting to True. Without this, your site cannot be submitted to the browser preload list.zsecurity.W021zYou have not set the SECURE_REFERRER_POLICY setting. Without this, your site will not send a Referrer-Policy header. You should consider enabling this header to protect user privacy.zsecurity.W022zDYou have set the SECURE_REFERRER_POLICY setting to an invalid value.zValid values are: {}.z, zsecurity.E023)hintr   zOYou have set the SECURE_CROSS_ORIGIN_OPENER_POLICY setting to an invalid value.zsecurity.E024zsecurity.W025c                      dt           j        v S )Nz-django.middleware.security.SecurityMiddlewarer   
MIDDLEWARE     \D:\Python Project\djangoTemplates\venv\Lib\site-packages\django/core/checks/security/base.py_security_middlewarer       s    :h>QQQr   c                      dt           j        v S )Nz6django.middleware.clickjacking.XFrameOptionsMiddlewarer   r   r   r   _xframe_middlewarer"      s    @HDWWr   T)deployc                 6    t                      }|rg nt          gS N)r    W001app_configskwargspassed_checks      r   check_security_middlewarer+      s    '))L)22D6)r   c                 6    t                      }|rg nt          gS r%   )r"   W002r'   s      r   check_xframe_options_middlewarer.      s    %''L)22D6)r   c                 P    t                       pt          j        }|rg nt          gS r%   )r    r   SECURE_HSTS_SECONDSW004r'   s      r   	check_stsr2      s)    +---M1ML)22D6)r   c                 n    t                       pt          j         pt          j        du }|rg nt          gS NT)r    r   r0   SECURE_HSTS_INCLUDE_SUBDOMAINSW005r'   s      r   check_sts_include_subdomainsr7      sF     !""" 	;++	;2d: 
 )22D6)r   c                 n    t                       pt          j         pt          j        du }|rg nt          gS r4   )r    r   r0   SECURE_HSTS_PRELOADW021r'   s      r   check_sts_preloadr;      sF     !""" 	0++	0'4/ 
 )22D6)r   c                 T    t                       pt          j        du }|rg nt          gS r4   )r    r   SECURE_CONTENT_TYPE_NOSNIFFW006r'   s      r   check_content_type_nosniffr?      s5     !"""Rh&Jd&R  )22D6)r   c                 T    t                       pt          j        du }|rg nt          gS r4   )r    r   SECURE_SSL_REDIRECTW008r'   s      r   check_ssl_redirectrC      s/    +---U1MQU1UL)22D6)r   c                     t          t          |                     t          k    o2t          |           t          k    o|                     t
                     S r%   )lenset SECRET_KEY_MIN_UNIQUE_CHARACTERSSECRET_KEY_MIN_LENGTH
startswithSECRET_KEY_INSECURE_PREFIX)
secret_keys    r   _check_secret_keyrL      sN    C
OO @@ 	B
OO44	B%%&@AAAr   c                     	 t           j        }t          |          }n# t          t          f$ r d}Y nw xY w|rg nt
          gS )NF)r   r   rL   r   AttributeErrorW009)r(   r)   rK   r*   s       r   check_secret_keyrP      s^    5(
 )44 !.1    )22D6)s    44c           	         g }	 t           j        }t          |          D ]S\  }}t          |          s?|                    t          t          j        d| dz  t          j                             TnR# t          t          f$ r> |                    t          t          j        dz  t          j                             Y nw xY w|S )NzSECRET_KEY_FALLBACKS[]r   SECRET_KEY_FALLBACKS)r   rS   	enumeraterL   appendr   W025msgr   r   rN   )r(   r)   warnings	fallbacksindexkeys         r   check_secret_key_fallbacksr\      s    H	1	 $I.. 	 	JE3$S)) DH'Gu'G'G'GGDGTTT  	 !.1 P P P+A AdgNNNOOOOOP Os   A4 4ACCc                 4    t           j         }|rg nt          gS r%   )r   DEBUGW018r'   s      r   check_debugr`      s    ~%L)22D6)r   c                 X    t                       pt          j        dk    }|rg nt          gS )NDENY)r"   r   X_FRAME_OPTIONSW019r'   s      r   check_xframe_denyre      s.    )+++Qx/G6/QL)22D6)r   c                 .    t           j        rg nt          gS r%   )r   ALLOWED_HOSTSW020r(   r)   s     r   check_allowed_hostsrj      s    '322dV3r   c                 4   t                      rt          j        t          gS t	          t          j        t
                    r*d t          j                            d          D             }nt          t          j                  }|t          k    st          gS g S )Nc                 6    h | ]}|                                 S r   )strip).0vs     r   	<setcomp>z(check_referrer_policy.<locals>.<setcomp>
  s     TTTAaggiiTTTr   ,)
r    r   SECURE_REFERRER_POLICYW022
isinstancestrsplitrF   REFERRER_POLICY_VALUESE023)r(   r)   valuess      r   check_referrer_policyrz     s     	*26Mh5s;; 	:TT)H)N)Ns)S)STTTFF899F///6MIr   c                 p    t                      r't          j        t          j        t          vrt          gS g S r%   )r    r   !SECURE_CROSS_ORIGIN_OPENER_POLICY!CROSS_ORIGIN_OPENER_POLICY_VALUESE024ri   s     r    check_cross_origin_opener_policyr     s<     	6B601 1 vIr   N)3django.confr   django.core.exceptionsr    r   r   r   r	   r}   rw   rJ   rH   rG   SECRET_KEY_WARNING_MSGr&   r-   r1   r6   r>   rB   rO   r_   rd   rh   r:   rs   formatjoinsortedrx   r~   rV   r    r"   securityr+   r.   r2   r7   r;   r?   rC   rL   rP   r\   r`   re   rj   rz   r   r   r   r   <module>r      s               7 7 7 7 7 7 - - - - - - - - - - - -% % % !
	 	 	  0  #$  2  ' '    w
    w3    w0
    w
    w:
    w,
    w\)  
 w:  
 w9
    w4  
 wA   w4 	   uJ	 	'	'		&&9O2P2P(Q(Q	R	R   u	 	'	'		&&:;;<<
 
    w%/:::R R R   
$-%%%* * &%*
 
$-%%%* * &%*
 
$-%%%* * &%*
 
$-%%%* * &%* 
$-%%%* * &%* 
$-%%%* * &%* 
$-%%%* * &%*
   
$-%%%* * &%* 
$-%%%  &% 
$-%%%* * &%*
 
$-%%%* * &%*
 
$-%%%4 4 &%4 
$-%%%  &% 
$-%%%  &%  r   