0]jeEddlmZddlmZmZddlmZmZddlm Z m Z m Z m Z m Z ddlmZddlmZddlmZddlmZdd lmZdd lmZmZdd lmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$dd l%m&Z&m'Z'm(Z(m)Z)dd l*m+Z+ee,Z-GddeeZ.y)) getLogger)ListOptional)router transaction)FQQuerySetSumValue)Concat) HttpRequest)timezone)get_cool_off_threshold)settings)AbstractAxesHandlerAxesBaseHandler) get_client_parametersget_client_session_hashget_client_strget_client_usernameget_credentialsget_failure_limitget_lockout_parameters get_query_strget_attempt_expiration) AccessAttemptAccessAttemptExpirationAccessFailureLog AccessLog)user_locked_outc teZdZdZdddddeedeededefd Zdd d eedefd Z dd d eedefd Z e jddedeedefdZ ddeedefdZddefdZdZdZ ddedeedeefdZ ddedeedeefdZ ddeedeedefdZ ddedeedefdZdZdZy)AxesDatabaseHandlera Signal handler implementation that records user login attempts to database and locks users out if necessary. .. note:: The get_user_attempts function is called several time during the authentication and lockout process, caching its output can be dangerous. NF) ip_addressusernameip_or_usernamer$r%r&returnc:tjj}|r)|jt |t |z}n(|r|j|}|r|j|}|j \}}t jd||S)N)r$r%z-AXES: Reset %d access attempts from database.)robjectsallfilterr deleteloginfo)selfr$r%r&attemptscount_s M/var/www/zogu/zoguvenv/lib/python3.12/site-packages/axes/handlers/database.pyreset_attemptsz"AxesDatabaseHandler.reset_attempts+s!((,,. qJ'?!XBV'VWH#??j?A#??H?=??$q @%H )age_daysr7c~|Gtjjj\}}tj d||St jt j|z }tjj|j\}}tj d|||S)Nz-AXES: Reset all %d access logs from database.daysattempt_time__ltezr,r?s r4reset_failure_logsz&AxesDatabaseHandler.reset_failure_logsPs  '//335<<>HE1 HHLe T LLNX%7%7X%FFE'//666OVVXHE1 HHV   r6)r@r@cd}tjj|}|j|z }|dkDr|d|D]}|j |dz }|S)Nrr))rr*r,r2r-)r0r%r@r2failuresout_of_limit_failures_logsfailures r4 remove_out_of_limit_failure_logsz4AxesDatabaseHandler.remove_out_of_limit_failure_logs_sn #++22H2E%-^^%5%=" % )#$?%?@     r6 credentialscN|j||}td|D}|S)Nc3^K|]%}|jtddxsd'yw)failures_since_startfailures_since_start__sumrN) aggregater ).0r1s r4 z3AxesDatabaseHandler.get_failures..psB  ""3'=#>?/ s+-)get_user_attemptsmax)r0requestrJ attempts_list attempt_counts r4 get_failuresz AxesDatabaseHandler.get_failuresns5..w D  *  r6c tjd|tjdy|j||t ||}t ||j |j|j|}tjs7|jr+||_ tjd|||j yt|j j#dd}t|j$j#dd}|j'||rtjd|yt)||} | d gk(r|tj+d n$t-j.t1j2t4 5t4j6j9j;||j |j|||j<|jd |j>d \} } | rtj+d|nd} tAdtC| |z| _"tAdtC| |z| _#|j<| _$|j| _%tMdd z| _'|j>| _(| jStj+d|tjTrtW| dr | jXFtj[d|t\j6j_| ta|| _,nRtcta|| jXjd| jX_2| jXjSddd|jg||} | |_4tjjrV| tm||k\rGtj+d|d|_ ||_ tjd|||j tjnrt-j.t1j2tp 5tpj6j_||j |j|j<|j|j>|j|js|dddyy#1swYExYw#1swYyxYw)z When user login fails, save AccessFailureLog record in database, save AccessAttempt record in database, mark request with lockout attribute and emit lockout signal. z>AXES: User login failed, running database handler for failure.NzPAXES: AxesDatabaseHandler.user_login_failed does not function without a request.axes)rTr%r$0x00z.AXES: Login failed from whitelisted client %s.r%zfAXES: Username is None and username is the only one lockout parameter, new record will NOT be created.)usingrE)get_data post_data http_accept path_inforM attempt_time)r%r$ user_agentdefaultszBAXES: New login failure by %s. Created new record in the database.z --------- r]r^rMzLAXES: Repeated login failure by %s. Updated existing record in the database. expirationz1AXES: Creating new AccessAttemptExpiration for %s)access_attempt expires_atz3AXES: Locking out %s after repeated login failures.T)r%r$rbr_r`ra locked_outr)):r.r/errorclean_expired_user_attemptsrraxes_ip_addressaxes_user_agentaxes_path_infor-AXES_RESET_COOL_OFF_ON_FAILURE_DURING_LOCKOUTaxes_locked_outaxes_credentialsr!sendrGETreplacePOSTis_whitelistedrwarningratomicr db_for_writerr*select_for_update get_or_createaxes_http_acceptaxes_attempt_timer r r]r^r_r`rrMrasaveAXES_USE_ATTEMPT_EXPIRATIONhasattrrddebugrcreaterrSrfrWaxes_failures_since_startAXES_LOCK_OUT_AT_FAILURErAXES_ENABLE_ACCESS_FAILURE_LOGrrI)r0senderrJrTkwargsr% client_strr]r^lockout_parametersattemptcreated separatorrMs r4user_login_failedz%AxesDatabaseHandler.user_login_failed{sV QR ? IIb   ((+>&w <#   # #  # #  " "   FF'''2G $  !"22   !-55dFC!',,/77fE   w 4 HHEz R 4G[I * -(2B KKx ##&*=*=m*LM@ 2"));;=KK%&66&66$,%.'.'?'?%,%;%;01(/(A(A  L $KK\"!0I'-j% H@T:U'VG$(.#U9y+@%A)G%+2*B*BG'(/(>(>G%345K3Lq3PG0+2+D+DG(LLNKKf" 77"7L9W=O=O=W O&.E-L-L-S-S+2'=g'F.T.* 9<27;#..999**5 **//1A@ 2F $00+F,@)  - -$(9';(OO KKEz '+G #'2G $  !"22    2 2##&*=*=>N*OP I ((//%&66&66 ' 8 8%44!(!:!:&66055x5H I I 3q@ 2@ 2r I Is G/R=>A5S =S Sc :|j}t|}t||j|j|j |}t jd||j||tjsatjj||j|j|j|j |jt!|tj"r*|j%||}t jd||yy)zN When user logs in, update the AccessLog related to the user. zAXES: Successful login by %s.)r%r$rbr_r`ra session_hashz;AXES: Deleted %d failed login attempts by %s from database.N) get_usernamerrrjrkrlr.r/rirAXES_DISABLE_ACCESS_LOGr r*rrzr{rAXES_RESET_ON_SUCCESSreset_user_attempts) r0rrTuserrr%rJrr2s r4user_logged_inz"AxesDatabaseHandler.user_logged_ins $$&%h/ #   # #  # #  " "    0*= ((+>//    $ $!"22"22#44!00$665W= %   ) ),,WkBE HHM  *r6c |r|jnd}|r t|nd}t||j|j|j |}|j ||tjd||rWtjsFtjj|dt|j|j yyy)zO When user logs out, update the AccessLog related to the user. NzAXES: Successful logout by %s.T)r%logout_time__isnullr) logout_time)rrrrjrkrlrir.r/rrr r*r,rupdater{)r0rrTrrr%rJrs r4user_logged_outz#AxesDatabaseHandler.user_logged_outCs +/4$$&D3;oh/ #   # #  # #  " "    ((+> 1:> H<<    $ $!$(4W= %  f!:!:f;=8r6rTct||}t||j|j||}|Dcgc]!}t j j di|#}}|Scc}w)zi Return a list querysets of AccessAttempts that match the given request and credentials. )rrrjrkrr*r,)r0rTrJr%filter_kwargs_list filter_kwargsrUs r4filter_user_attemptsz(AxesDatabaseHandler.filter_user_attempts`sv'w <2   # #  # #    "4   ! ! ( ( 9= 9    s&Ac|j||}tjtj d|St |}tj d||Dcgc]}|j |c}Scc}w)zn Get list of querysets with valid user attempts that match the given request and credentials. zZAXES: Getting all access attempts from database because no AXES_COOLOFF_TIME is configuredz4AXES: Getting access attempts that are newer than %s)attempt_time__gte)rrAXES_COOLOFF_TIMEr.rrr,)r0rTrJrU thresholdr1s r4rRz%AxesDatabaseHandler.get_user_attemptsvsz11';G  % % - IIl ! *73  H)TIV =EHOOiO 8   sA;ctjtjdytjr^t j }tjj|j\}}tjd|||St|}tjj|j\}}tjd|||S)z@ Clean expired user attempts from the database. z[AXES: Skipping clean for expired access attempts because no AXES_COOLOFF_TIME is configuredr)expiration__expires_at__ltezXAXES: Cleaned up %s expired access attempts from database that expiry were older than %sr;zQAXES: Cleaned up %s expired access attempts from database that were older than %s) rrr.rr}rr=rr*r,r-r/r)r0rTrJrr2r3s r4riz/AxesDatabaseHandler.clean_expired_user_attemptss  % % - IIm   / / I$,,33,54fh E1 HHj  /w7I$,,33"+4fh E1 HHc   r6c|j||}d}|D]}|j\}}||z }tjd||S)zW Reset all user attempts that match the given request and credentials. rz-AXES: Reset %s access attempts from database.)rr-r.r/)r0rTrJrUr2r1_countr3s r4rz'AxesDatabaseHandler.reset_user_attemptssY11';G % H )IFA VOE  @%H r6c y)z Handles the ``axes.models.AccessAttempt`` object post save signal. When needed, all post_save actions for this backend should be located here. Nrr0instancers r4post_save_access_attemptz,AxesDatabaseHandler.post_save_access_attemptr6c y)z Handles the ``axes.models.AccessAttempt`` object post delete signal. When needed, all post_delete actions for this backend should be located here. Nrrs r4post_delete_access_attemptz.AxesDatabaseHandler.post_delete_access_attemptrr6)N)NN)__name__ __module__ __qualname____doc__rstrboolintr5rArCr&AXES_ACCESS_FAILURE_LOG_PER_USER_LIMITrIdictrWrrrrrr rrRrirrrrr6r4r#r##s%)"&$ SM3-    ,7; hsm s ?C hsm s & (NN  }   $ 3 [IT[Iz)V<<CG"19$ h.CG " 19$ h .*.&*#+&#d^# #LCG"19$ "  r6r#N)/loggingrtypingrr django.dbrrdjango.db.modelsrr r r r django.db.models.functionsr django.httpr django.utilsr axes.attemptsr axes.confraxes.handlers.baserr axes.helpersrrrrrrrrr axes.modelsrrrr axes.signalsr!rr.r#rr6r4rs_!)77-#!0C    )l -l r6