File: //usr/lib/python3/dist-packages/django/core/checks/security/__pycache__/base.cpython-310.pyc
o
3�a� � @ s8 d dl mZ d dlmZ ddlmZmZmZmZ h d�Z dZ
dZ dZ ed d
d �Z
ed d
d �Zeddd �Zeddd �Zeddd �Zeddd �Zede e e
d� dd �Zeddd �Zedd d �Zed d d �Zed d d �Zed!d"d �Zed#d$�d%�ee ���d&d'�Z ed(d)d �Z d*d+� Z d,d-� Z eej d.d/�d0d1� �Z!eej d.d/�d2d3� �Z"eej d.d/�d4d5� �Z#eej d.d/�d6d7� �Z$eej d.d/�d8d9� �Z%eej d.d/�d:d;� �Z&eej d.d/�d<d=� �Z'eej d.d/�d>d?� �Z(eej d.d/�d@dA� �Z)eej d.d/�dBdC� �Z*eej d.d/�dDdE� �Z+eej d.d/�dFdG� �Z,eej �dHdI� �Z-dJS )K� )�settings)�ImproperlyConfigured� )�Error�Tags�Warning�register> �
unsafe-url� no-referrer� same-origin�
strict-origin�origin-when-cross-origin�no-referrer-when-downgrade� strict-origin-when-cross-origin�originzdjango-insecure-�2 � z�You do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_BROWSER_XSS_FILTER, SECURE_REFERRER_POLICY, and SECURE_SSL_REDIRECT settings will have no effect.z
security.W001)�ida3 You do not have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, so your pages will not be served with an 'x-frame-options' header. Unless there is a good reason for your site to be served in a frame, you should consider enabling this header to help prevent clickjacking attacks.z
security.W002a, You have not set a value for the SECURE_HSTS_SECONDS setting. If your entire site is served only over SSL, you may want to consider setting a value and enabling HTTP Strict Transport Security. Be sure to read the documentation first; enabling HSTS carelessly can cause serious, irreversible problems.z
security.W004a You have not set the SECURE_HSTS_INCLUDE_SUBDOMAINS setting to True. Without this, your site is potentially vulnerable to attack via an insecure connection to a subdomain. Only set this to True if you are certain that all subdomains of your domain should be served exclusively via SSL.z
security.W005z�Your SECURE_CONTENT_TYPE_NOSNIFF setting is not set to True, so your pages will not be served with an 'X-Content-Type-Options: nosniff' header. You should consider enabling this header to prevent the browser from identifying content types incorrectly.z
security.W006a Your SECURE_SSL_REDIRECT setting is not set to True. Unless your site should be available over both SSL and non-SSL connections, you may want to either set this setting True or configure a load balancer or reverse-proxy server to redirect all connections to HTTPS.z
security.W008aR Your SECRET_KEY has less than %(min_length)s characters, less than %(min_unique_chars)s unique characters, or it's prefixed with '%(insecure_prefix)s' indicating that it was generated automatically by Django. Please generate a long and random SECRET_KEY, otherwise many of Django's security-critical features will be vulnerable to attack.)�
min_length�min_unique_chars�insecure_prefixz
security.W009z4You should not have DEBUG set to True in deployment.z
security.W018z�You have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, but X_FRAME_OPTIONS is not set to 'DENY'. Unless there is a good reason for your site to serve other parts of itself in a frame, you should change it to 'DENY'.z
security.W019z.ALLOWED_HOSTS must not be empty in deployment.z
security.W020z�You have not set the SECURE_HSTS_PRELOAD setting to True. Without this, your site cannot be submitted to the browser preload list.z
security.W021z�You have not set the SECURE_REFERRER_POLICY setting. Without this, your site will not send a Referrer-Policy header. You should consider enabling this header to protect user privacy.z
security.W022zDYou have set the SECURE_REFERRER_POLICY setting to an invalid value.zValid values are: {}.z, z
security.E023)�hintr z5DEFAULT_HASHING_ALGORITHM must be 'sha1' or 'sha256'.z
security.E100c C �
dt jv S )Nz-django.middleware.security.SecurityMiddleware�r �
MIDDLEWARE� r r �B/usr/lib/python3/dist-packages/django/core/checks/security/base.py�_security_middleware� �
r c C r )Nz6django.middleware.clickjacking.XFrameOptionsMiddlewarer r r r r �_xframe_middleware� r r T)�deployc K � t � }|rg S tgS �N)r �W001�� app_configs�kwargs� passed_checkr r r �check_security_middleware� � r( c K r! r" )r �W002r$ r r r � check_xframe_options_middleware� r) r+ c K s t � ptj}|r g S tgS r" )r r �SECURE_HSTS_SECONDS�W004r$ r r r � check_sts� s r. c K �( t � p tj p tjdu }|rg S tgS �NT)r r r, � SECURE_HSTS_INCLUDE_SUBDOMAINS�W005r$ r r r � check_sts_include_subdomains� � ��r3 c K r/ r0 )r r r, �SECURE_HSTS_PRELOAD�W021r$ r r r �check_sts_preload� r4 r7 c K � t � ptjdu }|r
g S tgS r0 )r r �SECURE_CONTENT_TYPE_NOSNIFF�W006r$ r r r �check_content_type_nosniff� � �r; c K r8 r0 )r r �SECURE_SSL_REDIRECT�W008r$ r r r �check_ssl_redirect� r< r? c K s\ zt j}W n
ttfy d}Y nw tt|��tko&t|�tko&|�t � }|r+g S t
gS )NF) r �
SECRET_KEYr �AttributeError�len�set� SECRET_KEY_MIN_UNIQUE_CHARACTERS�SECRET_KEY_MIN_LENGTH�
startswith�SECRET_KEY_INSECURE_PREFIX�W009)r% r& �
secret_keyr' r r r �check_secret_key� s
�
�
�rJ c K s t j }|rg S tgS r" )r �DEBUG�W018r$ r r r � check_debug� s rM c K s t � ptjdk}|r
g S tgS )N�DENY)r r �X_FRAME_OPTIONS�W019r$ r r r �check_xframe_deny� r< rQ c K s t jrg S tgS r" )r �
ALLOWED_HOSTS�W020�r% r& r r r �check_allowed_hosts� s rU c K sV t � r)tjd u r tgS ttjt�r dd� tj�d�D �}nttj�}|tks)t gS g S )Nc S s h | ]}|� � �qS r )�strip)�.0�vr r r � <setcomp>� s z(check_referrer_policy.<locals>.<setcomp>�,)
r r �SECURE_REFERRER_POLICY�W022�
isinstance�str�splitrC �REFERRER_POLICY_VALUES�E023)r% r& �valuesr r r �check_referrer_policy� s
rc c K s t jdvrtgS g S )N> �sha1�sha256)r �DEFAULT_HASHING_ALGORITHM�E100rT r r r � check_default_hashing_algorithm� s
rh N).� django.confr �django.core.exceptionsr � r r r r r` rG rE rD r# r* r- r2 r: r> rH rL rP rS r6 r\ �format�join�sortedra rg r r �securityr( r+ r. r3 r7 r; r? rJ rM rQ rU rc rh r r r r �<module> s� � �
� � � � �� �
�� �����