0]jl[ddlmZmZddlmZddlmZddlmZddlm Z m Z m Z m Z m Z ddlmZddlmZmZddlmZmZmZmZdd lmZmZdd lmZdd lmZdd lm Z dd l!m"Z"ee#Z$ ddl%Z&dZ'defdZ)d=de ede e*fdZ+d=de ede efdZ,dede-fdZ.d=de edefdZ/d=de e-de0fdZ1 d=dede e0de-fdZ2 d=dede e3de e-fdZ4dede-fdZ5dede-fd Z6dede-fd!Z7 d=d"e ee"fde e0de e e-e e-ffd#Z8 d=de-d$e-d%e-d"e ee"fde e0de e0f d&Z9d'e e0de e-fd(Z: d=d"e ee"fde e0de e-fd)Z;de-d$e-d%e-d*e-dede-f d+Zd.e ed/e*de-fd0Z>dede*fd1Z?de-fd2Z@ d?ded3e ede e0defd4ZAd$e-de3fd5ZBd$e-de3fd6ZCdefd7ZDdede3fd8ZEdede3fd9ZF d=dede e0de3fd:ZGde fd;ZHdede-fd<ZIy#e($rdZ'YuwxYw)@) timedeltadatetime)sha256) getLogger)Template)CallableOptionalTypeUnionList) urlencode) BaseCachecaches) HttpRequest HttpResponse JsonResponse QueryDict)redirectrender) force_bytes) import_string)settings) AccessBaseNTFreturnc2tttddS)zy Get the cache instance Axes is configured to use with ``settings.AXES_CACHE`` and use ``'default'`` if not set. AXES_CACHEdefault)rgetattrrC/var/www/zogu/zoguvenv/lib/python3.12/site-packages/axes/helpers.py get_cacher"s '(L)< ==r requestcPt|}|yt|jS)a Return the cache timeout interpreted from settings.AXES_COOLOFF_TIME. The cache timeout can be either None if not configured or integer of seconds if configured. Notice that the settings.AXES_COOLOFF_TIME can be None, timedelta, float, integer, callable, or str path, and this function offers a unified _integer or None_ representation of that configuration for use with the Django cache backends. N) get_cool_offint total_seconds)r#cool_offs r!get_cache_timeoutr)#s+G$H x%%' ((r ctj}t|tr t |St|t rt |dzSt|t rt|}||St|r||S|S)a Return the login cool off time interpreted from settings.AXES_COOLOFF_TIME. The return value is either None or timedelta. Notice that the settings.AXES_COOLOFF_TIME is either None, timedelta, integer/float of hours, a path to a callable or a callable taking 1 argument (the request). This function offers a unified _timedelta or None_ representation of that configuration for use with the Axes internal implementations. :exception TypeError: if settings.AXES_COOLOFF_TIME is of wrong type. )hours<)minutes) rAXES_COOLOFF_TIME isinstancer&rfloatstrrcallable)r#r( cool_off_funcs r!r%r%4st))H(C x(((E"B//(C %h/ W%%  Or deltac|j}t|d\}}t|d\}}t|d\}}|r|ddnd}djd|dg|dg|d gfD}|rd |d |Sd |S) zh Return datetime.timedelta translated to ISO 8601 formatted duration for use in e.g. cool offs. r,.0fDc34K|]\}}|r |d|yw)r7Nr).0value designators r! z'get_cool_off_iso8601..]s* E:  +j\"sHMSPT)r'divmodjoin)r4secondsr-r+daysdays_strtime_strs r!get_cool_off_iso8601rJQs !!#Ggr*GWGR(NE7#KD%!%$s1~2Hww#(#,##!OH 8*AhZ(( xj>r ct|}| td|j}|tj|zS||zS)zG Get threshold for fetching access attempts from the database. zTCool off threshold can not be calculated with settings.AXES_COOLOFF_TIME set to None)r% TypeErroraxes_attempt_timernow)r#r( attempt_times r!get_attempt_expirationrPhsS G$H b  ,,L||~(( ( ""r usernamec Ltj|i}|j||S)a Calculate credentials for Axes to use internally from given username and kwargs. Axes will set the username value into the key defined with ``settings.AXES_USERNAME_FORM_FIELD`` and update the credentials dictionary with the kwargs given on top of that. )rAXES_USERNAME_FORM_FIELDupdate)rQkwargs credentialss r!get_credentialsrWys(44h?Kv r rVcBtjrtjdt tjrtj||St tjt r ttj||Std|r5tjd|jtjdStjdt|d|j}|jtjdS)a Resolve client username from the given request or credentials if supplied. The order of preference for fetching the username is as follows: 1. If configured, use ``AXES_USERNAME_CALLABLE``, and supply ``request, credentials`` as arguments 2. If given, use ``credentials`` and fetch username from ``AXES_USERNAME_FORM_FIELD`` (defaults to ``username``) 3. Use request.POST and fetch username from ``AXES_USERNAME_FORM_FIELD`` (defaults to ``username``) :param request: incoming Django ``HttpRequest`` or similar object from authentication backend or other source :param credentials: incoming credentials ``dict`` or similar object from authentication backend or other source z5Using settings.AXES_USERNAME_CALLABLE to get usernamezHsettings.AXES_USERNAME_CALLABLE needs to be a string, callable, or None.zVUsing parameter credentials to get username with key settings.AXES_USERNAME_FORM_FIELDNzWUsing parameter request.POST to get username with key settings.AXES_USERNAME_FORM_FIELDdata) rAXES_USERNAME_CALLABLElogdebugr2r/r1rrLgetrSrPOST)r#rV request_datas r!get_client_usernamer`s && IJ H33 422  h55s ;A=!@!@A';W W V   d x@@$GGIIa7FGLL9L   H==t DDr use_ipwarectjrtjdt tjrtj|St tjt rttj|Std|t}|rvtjdtjj|tjtjtjtj \}}|Stjd|j"j%ddS)a Get client IP address as configured by the user. The order of preference for address resolution is as follows: 1. If configured, use ``AXES_CLIENT_IP_CALLABLE``, and supply ``request`` as argument 2. If available, use django-ipware package (parameters can be configured in the Axes package) 3. Use ``request.META.get('REMOTE_ADDR', None)`` as a fallback :param request: incoming Django ``HttpRequest`` or similar object from authentication backend or other source z?Using settings.AXES_CLIENT_IP_CALLABLE to get client IP addresszIsettings.AXES_CLIENT_IP_CALLABLE needs to be a string, callable, or None.Nz,Using django-ipware to get client IP address) proxy_order proxy_countproxy_trusted_ipsrequest_header_orderzTUsing request.META.get('REMOTE_ADDR', None) fallback method to get client IP address REMOTE_ADDR)rAXES_CLIENT_IP_CALLABLEr[r\r2r/r1rrLIPWARE_INSTALLEDipwareip get_client_ipAXES_IPWARE_PROXY_ORDERAXES_IPWARE_PROXY_COUNTAXES_IPWARE_PROXY_TRUSTED_IPS!AXES_IPWARE_META_PRECEDENCE_ORDERMETAr])r#raclient_ip_address_s r!get_client_ip_addressrts  '' ST H44 533  h66 <B=!A!AB7K K W  %  @A%yy66  88 88&DD!)!K!K 7 1! II^ <<  M4 00r c@|jjddddS)NHTTP_USER_AGENT rqr]r#s r!get_client_user_agentr{s! <<  -{ ;DS AAr c@|jjddddS)N PATH_INFOrwrxryrzs r!get_client_path_infor~s <<  K 5ds ;;r c@|jjddddS)N HTTP_ACCEPTrwiryrzs r!get_client_http_acceptrs <<  M; 7 >>r request_or_attemptcNttjrtj||Sttjtr t tj||Sttjt rtjStd)NzCsettings.AXES_LOCKOUT_PARAMETERS needs to be a callable or iterable)r2rAXES_LOCKOUT_PARAMETERSr/r1rlistrL)rrVs r!get_lockout_parametersrs001//0BKPP(22C8>}X==>    (22D9/// M r ip_address user_agentclt||}|||d}g}|D]?} t|tr|||i} n|D cic]} | ||  } } |j| A|Scc} w#t$rJ} | ddj |j } tj| t| | d} ~ wwxYw)a< Get query parameters for filtering AccessAttempt queryset. This method returns a dict that guarantees iteration order for keys and values, and can so be used in e.g. the generation of hash keys or other deterministic functions. Returns list of dict, every item of list are separate parameters )rQrrz7 lockout parameter is not allowed. Allowed parameters: , N) rr/r1appendKeyErrorrEkeysr[ exception ValueError) rQrrrrVlockout_parametersparameters_dict filter_kwargs parameter filter_kwargcombined_parametere error_msgs r!get_client_parametersrs00BKP  O M'/  /)S) )?9+EF /8 *'8J(KK      ./&    /#''+yy1E1E1G'H&IK  MM) $Y'Q .  /s)A  AA A  B3)AB..B3filter_kwargs_listcg}|D]c}djd|jD}t|jj }|j d|e|S)Nr9c3&K|] }|s| ywNr)r;r<s r!r>z&make_cache_key_list..6s' E' szaxes-)rEvaluesrencode hexdigestr)r cache_keysrcache_key_componentscache_key_digests r!make_cache_key_listr3szJ+6 !ww' ,335'  ""6"="="?@JJLE"2!345 6 r ct|tr%|j}|j}|j}n"t ||}t |}t|}t|||||}t|S)a Build cache key name from request or AccessAttempt object. :param request_or_attempt: HttpRequest or AccessAttempt object :param credentials: credentials containing user information :return cache_key: Hash key that is usable for Django cache backends ) r/rrQrrr`rtr{rr)rrVrQrrrs r!get_client_cache_keysr>sx$j1%..'22 '22 &'9;G*+=> *+=> .*j*z!get_client_str..sG8..t4G{})rAXES_CLIENT_STR_CALLABLEr[r\r2r/r1rrL AXES_VERBOSErrTcleanse_parameterscopytuplerritemsrE) rQrrrr# client_dict client_listclientkvr client_strrs @r!get_client_strrZs(( QR H55 644*j)W  h77 =C=!B!BC*j)W  W  K"* J$. L!$. L!,Hj*gV  ! 'F   v & '$[%5%5%78KZ E4=9aL (K ()H0;0A0A0C D1Q # DE DGGGJz!C'J  EsE>paramscdgtjz}tjr|jtj|r#|j }|D] }||vsd||<|S|S)a Replace sensitive parameter values in a parameter dict with a safe placeholder value. Parameters name ``'password'`` will always be cleansed. Additionally, parameters named in ``settings.AXES_SENSITIVE_PARAMETERS`` and ``settings.AXES_PASSWORD_FORM_FIELD will be cleansed. This is used to prevent passwords and similar values from being logged in cleartext. passwordz********************)rAXES_SENSITIVE_PARAMETERSAXES_PASSWORD_FORM_FIELDrr)rsensitive_parameterscleansedparams r!rrsn'<(*L*LL((##H$E$EF;;=) 9E "8 9 Mr query max_lengthct|j}td|jDcgc] \}}||d }}}dj fd|D}|d|Scc}}w)a~ Turns a query dictionary into an easy-to-read list of key-value pairs. If a field is called either ``'password'`` or ``settings.AXES_PASSWORD_FORM_FIELD`` or if the fieldname is included in ``settings.AXES_SENSITIVE_PARAMETERS`` its value will be masked. The length of the output is limited to max_length to avoid a DoS attack via excessively large payloads. z $key=$valuer c3@K|]}j|ywrrrs r!r>z get_query_str..sF(--d3FrN)rrrrrE)rr query_dictrrr query_strrs @r! get_query_strrsk$EJJL1J &H0:0@0@0B C1Q # CE C FFFI [j !! DsA*cNttjrtj||Sttjtr t tj||Sttjt rtjStd)Nz@settings.AXES_FAILURE_LIMIT needs to be a callable or an integer)r2rAXES_FAILURE_LIMITr/r1rr&rL)r#rVs r!get_failure_limitrs|++,** [  (--s39}X889';OO(--s3*** V WWr cbtjrtjStjSr)rr.AXES_COOLOFF_MESSAGEAXES_PERMALOCK_MESSAGErr r!get_lockout_messagers#!!,,,  * **r original_responsectjr~ttjr tj|||St tjt r$t tj} ||||Stdtj}t||t||xsdd}t|}|r|jt||d|jjddk(r,t||}tj |d<d |d <d |d <|Stj"rt%|tj"||Stj&r2tj&}t)d |d i} |d| } t+| St-t/|S#t$rtj||cYSwxYw#t$r |||cYSwxYw)NzGsettings.AXES_LOCKOUT_CALLABLE needs to be a string, callable, or None.r9) failure_limitrQ) cooloff_timecooloff_timedeltaHTTP_X_REQUESTED_WITHXMLHttpRequest)statuszAccess-Control-Allow-Originz POST, OPTIONSzAccess-Control-Allow-Methodsz=Origin, Content-Type, Accept, Authorization, x-requested-withzAccess-Control-Allow-HeadersrQ?)rAXES_LOCKOUT_CALLABLEr2rLr/r1rAXES_HTTP_RESPONSE_CODErr`r%rTrJrqr]rAXES_ALLOWED_CORS_ORIGINSAXES_LOCKOUT_TEMPLATErAXES_LOCKOUT_URLr rrr) r#rrV callable_objrcontextr( json_response lockout_url query_stringurls r!get_lockout_responsers %% H22 3 L55.  h44c :()G)GHL :#G-> LL U   - -F*7K@'=CG G$H 4!&.   ||/04DD$WV<  . . 349H 45 K 45%%gx==wvVV  //  *gj.A!BC  Q|n-} +-f ==g L55g{KK L :#G[99 :s#F4: G4GGG.-G.cHtjsy|tjvSNF)rAXES_IP_WHITELISTrs r!is_ip_address_in_whitelistr#  % % h000r cHtjsy|tjvSr)rAXES_IP_BLACKLISTrs r!is_ip_address_in_blacklistrrr ctjrt|jrytjrt|jryy)z@ Check if the given request refers to a whitelisted IP. TF)rAXES_NEVER_LOCKOUT_WHITELISTraxes_ip_addressAXES_ONLY_WHITELISTrzs r! is_client_ip_address_whitelistedr$sE ,,1K2##(B) r c|t|jrytjrt |jsyy)z@ Check if the given request refers to a blacklisted IP. TF)rrrrrrzs r! is_client_ip_address_blacklistedr6s7 "'"9"9:##,F- r cDtjr|jdk(ryy)z? Check if the given request uses a whitelisted method. GETTF)rAXES_NEVER_LOCKOUT_GETmethodrzs r!is_client_method_whitelistedrFs &&7>>U+B r ctj}|yt|r |||St|trt |||St d)a Check if the given request or credentials refer to a whitelisted username. This method invokes the ``settings.AXES_WHITELIST`` callable with ``request`` and ``credentials`` arguments. This function could use the following implementation for checking the lockout flags from a specific property in the user object: .. code-block: python username_value = get_client_username(request, credentials) username_field = getattr( get_user_model(), "USERNAME_FIELD", "username" ) kwargs = {username_field: username_value} user_model = get_user_model() user = user_model.objects.get(**kwargs) return user.nolockout FzIsettings.AXES_WHITELIST_CALLABLE needs to be a string, callable, or None.)rAXES_WHITELIST_CALLABLEr2r/r1rrL)r#rVwhitelist_callables r!is_user_attempt_whitelistedrQs_6"99!"#!';77$c*0}/0+FF S r cfd}|S)a: Decorator that toggles function execution based on settings. If the ``settings.AXES_ENABLED`` flag is set to ``False`` the decorated function never runs and a None is returned. This decorator is only suitable for functions that do not require return values to be passed back to callers. c6tjr|i|Syr)r AXES_ENABLED)argsrUfuncs r!innerztoggleable..inners!  (( ( !r r)r r s` r! toggleabler ys) Lr c |j}|j|jt t |jj S#t$rYywxYw)z Get client session and returns the SHA256 hash of session key, forcing session creation if required. If no session is available on request returns an empty string. r9)sessionAttributeError session_keycreaterrr)r#r s r!get_client_session_hashrs[ //" +g112 3 = = ?? s A A"!A"r)i)NN)Jrrhashlibrloggingrstringrtypingrr r r r urllib.parser django.core.cacherr django.httprrrrdjango.shortcutsrrdjango.utils.encodingrdjango.utils.module_loadingr axes.confr axes.modelsr__name__r[ ipware.iprjri ImportErrorr"r&r)r%r1rJrPdictrWr`boolrtr{r~rrrrrrrrrrrrrrrrrr rrr r!r#s(88"/JJ--5" >9>)x 4) )"(;/8I;N: c.#H[$9#X#" hsm  9=(E (E'/~(E(EZ"&01 0101c]01fB;B3B<+<#<?K?C? #'k:56$ %T#Y  2#' ,,,,k:56 , $ ,  $Z ,^DJ49#'3k:563$3 #Y385555 5  5  5pt2"i"c"S"& X{ XC X+S+15"&?> ?> -?>$?> ?>D3434k$ k d  +$9=% %'/~% %P$@[@S@is,GG('G(