
    +h'                     <   d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dlm	Z	 d dlm
Z
 d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ dZ ej.                  e      ZddZddZ	 ddZ G d de      Z G d d      Z G d de      Zd Z y)    N)urlparse)	Blueprint)current_app)g)request)session)BadData)SignatureExpired)URLSafeTimedSerializer)
BadRequest)ValidationError)CSRF)generate_csrfvalidate_csrfCSRFProtectc                 T   t        | dt        j                  d      } t        |ddd      }|t        vr|t	        | d      }|t
        vr=t        j                  t        j                  d	            j                         t
        |<   	 |j                  t
        |         }t        t        ||       t        j                  |      S # t        $ rX t        j                  t        j                  d	            j                         t
        |<   |j                  t
        |         }Y w xY w)
a  Generate a CSRF token. The token is cached for a request, so multiple
    calls to this function will generate the same token.

    During testing, it might be useful to access the signed token in
    ``g.csrf_token`` and the raw token in ``session['csrf_token']``.

    :param secret_key: Used to securely sign the token. Default is
        ``WTF_CSRF_SECRET_KEY`` or ``SECRET_KEY``.
    :param token_key: Key where token is stored in session for comparison.
        Default is ``WTF_CSRF_FIELD_NAME`` or ``'csrf_token'``.
    WTF_CSRF_SECRET_KEY%A secret key is required to use CSRF.messageWTF_CSRF_FIELD_NAME
csrf_token%A field name is required to use CSRF.wtf-csrf-tokensalt@   )_get_configr   
secret_keyr   r   r   hashlibsha1osurandom	hexdigestdumps	TypeErrorsetattrget)r   	token_key
field_namestokens        A/var/www/html/venv/lib/python3.12/site-packages/flask_wtf/csrf.pyr   r      s     7	J 7	J ":4DEW$"),,rzz"~">"H"H"JGJ	1GGGJ/0E
 	:u%55  	1"),,rzz"~">"H"H"JGJGGGJ/0E	1s   C AD'&D'c                    t        |dt        j                  d      }t        |ddd      }t        |ddd	
      }| st        d      |t        vrt        d      t        |d      }	 |j                  | |      }t        j                  t        |   |      st        d      y# t        $ r}t        d      |d}~wt        $ r}t        d      |d}~ww xY w)a  Check if the given data is a valid CSRF token. This compares the given
    signed token to the one stored in the session.

    :param data: The signed CSRF token to be checked.
    :param secret_key: Used to securely sign the token. Default is
        ``WTF_CSRF_SECRET_KEY`` or ``SECRET_KEY``.
    :param time_limit: Number of seconds that the token is valid. Default is
        ``WTF_CSRF_TIME_LIMIT`` or 3600 seconds (60 minutes).
    :param token_key: Key where token is stored in session for comparison.
        Default is ``WTF_CSRF_FIELD_NAME`` or ``'csrf_token'``.

    :raises ValidationError: Contains the reason that validation failed.

    .. versionchanged:: 0.14
        Raises ``ValidationError`` with a specific error message rather than
        returning ``True`` or ``False``.
    r   r   r   r   r   r   WTF_CSRF_TIME_LIMIT  F)requiredzThe CSRF token is missing.z"The CSRF session token is missing.r   r   )max_agezThe CSRF token has expired.NzThe CSRF token is invalid.zThe CSRF tokens do not match.)r   r   r   r   r   r   loadsr
   r	   hmaccompare_digest)datar   
time_limitr)   r*   r+   r,   es           r-   r   r   B   s    & 7	J 7	J Z)>uUJ:;; BCCz0@AACj1 wz2E:=>> ;  D;<!C C:;BCs$   *B& &	C/B;;CCCc                 h    |  t         j                  j                  ||      } |r| t        |      | S )a  Find config value based on provided value, Flask config, and default
    value.

    :param value: already provided config value
    :param config_name: Flask ``config`` key
    :param default: default value if not provided or configured
    :param required: whether the value must not be ``None``
    :param message: error message if required config is not found
    :raises KeyError: if required config is not found
    )r   configr(   RuntimeError)valueconfig_namedefaultr1   r   s        r-   r   r   v   s8     }""&&{G<EM7##L    c                   *     e Zd Z fdZd Zd Z xZS )_FlaskFormCSRFc                 D    |j                   | _         t        | 	  |      S N)metasuper
setup_form)selfform	__class__s     r-   rF   z_FlaskFormCSRF.setup_form   s    II	w!$''r?   c                 l    t        | j                  j                  | j                  j                        S )N)r   r)   )r   rD   csrf_secretcsrf_field_name)rG   csrf_token_fields     r-   generate_csrf_tokenz"_FlaskFormCSRF.generate_csrf_token   s(    yy,,		8Q8Q
 	
r?   c                 D   t        j                  dd      ry 	 t        |j                  | j                  j
                  | j                  j                  | j                  j                         y # t        $ r(}t        j                  |j                  d           d }~ww xY w)N
csrf_validFr   )r   r(   r   r6   rD   rK   csrf_time_limitrL   r   loggerinfoargs)rG   rH   fieldr8   s       r-   validate_csrf_tokenz"_FlaskFormCSRF.validate_csrf_token   sw    55u%		

		%%		))		))	  	KKq	"	s   AA. .	B7#BB)__name__
__module____qualname__rF   rN   rV   __classcell__)rI   s   @r-   rA   rA      s    (

r?   rA   c                   6    e Zd ZdZd	dZd Zd Zd Zd Zd Z	y)
r   a[  Enable CSRF protection globally for a Flask app.

    ::

        app = Flask(__name__)
        csrf = CSRFProtect(app)

    Checks the ``csrf_token`` field sent with forms, or the ``X-CSRFToken``
    header sent with JavaScript requests. Render the token in templates using
    ``{{ csrf_token() }}``.

    See the :ref:`csrf` documentation.
    Nc                 h    t               | _        t               | _        |r| j                  |       y y rC   )set_exempt_views_exempt_blueprintsinit_app)rG   apps     r-   __init__zCSRFProtect.__init__   s*     U"%%MM# r?   c                 j     j                   d<   j                  j                  dd       j                  j                  dd       t        j                  j	                  dg d            j                  d<   j                  j                  dd       j                  j                  d	d
dg       j                  j                  dd       j                  j                  dd       t
        j                  j                  d<   j                  d        j                   fd       }y )NcsrfWTF_CSRF_ENABLEDTWTF_CSRF_CHECK_DEFAULTWTF_CSRF_METHODS)POSTPUTPATCHDELETEr   r   WTF_CSRF_HEADERSzX-CSRFTokenzX-CSRF-Tokenr/   r0   WTF_CSRF_SSL_STRICTc                      dt         iS )Nr   )r    r?   r-   <lambda>z&CSRFProtect.init_app.<locals>.<lambda>   s    |]&C r?   c                     j                   d   sy j                   d   sy t        j                  j                   d   vry t        j                  sy j                  j                  t        j                        j                  v ry j                  j                  t        j                        } | j                   d| j                   }|j                  v ry j                          y )Nre   rf   rg   .)r:   r   methodendpoint
blueprintsr(   	blueprintr_   view_functionsrX   rW   r^   protect)viewdestra   rG   s     r-   csrf_protectz*CSRFProtect.init_app.<locals>.csrf_protect   s    ::01::67~~SZZ0B%CC##~~!!'"3"348O8OO%%))'*:*:;Doo&a7Dt)))LLNr?   )

extensionsr:   
setdefaultr]   r(   r   	jinja_envglobalscontext_processorbefore_request)rG   ra   r{   s   `` r-   r`   zCSRFProtect.init_app   s    !%v

0$7

6=),JJNN-/QR*


%& 	

3\B

0=.2QR

3T:

3T:.;l+CD				 
	r?   c                 j   t         j                  d   }t        j                  j	                  |      }|r|S t        j                  D ]-  }|j                  |      st        j                  |   }|s+|c S  t         j                  d   D ]'  }t        j                  j	                  |      }|s%|c S  y )Nr   rl   )r   r:   r   rH   r(   endswithheaders)rG   r*   
base_tokenkeyr   header_names         r-   _get_csrf_tokenzCSRFProtect._get_csrf_token   s     ''(=>
\\%%j1
 << 	&C||J'$\\#.
%%	& '--.@A 	"K ,,[9J!!		" r?   c                 H   t         j                  t        j                  d   vry 	 t	        | j                                t         j                  rst        j                  d   r`t         j                  s| j                  d       dt         j                   d}t        t         j                  |      s| j                  d       dt        _        y # t        $ rJ}t        j                  |j                  d          | j                  |j                  d          Y d }~d }~ww xY w)	Nrg   r   rm   zThe referrer header is missing.zhttps:///z%The referrer does not match the host.T)r   rs   r   r:   r   r   r   rR   rS   rT   _error_response	is_securereferrerhostsame_originr   rP   )rG   r8   good_referrers      r-   rx   zCSRFProtect.protect   s    >>!3!34F!GG	,$..01
 !3!34I!J##$$%FG&w||nA6Mw//?$$%LM  	,KKq	"  ++	,s   C 	D!A DD!c                 
   t        |t              r| j                  j                  |       |S t        |t              r|}n'dj                  |j                  |j                  f      }| j                  j                  |       |S )a  Mark a view or blueprint to be excluded from CSRF protection.

        ::

            @app.route('/some-view', methods=['POST'])
            @csrf.exempt
            def some_view():
                ...

        ::

            bp = Blueprint(...)
            csrf.exempt(bp)

        rr   )	
isinstancer   r_   addstrjoinrX   rW   r^   )rG   ry   view_locations      r-   exemptzCSRFProtect.exempt  sj    " dI&##''-KdC  MHHdoot}}%EFM}-r?   c                     t        |      rC   )	CSRFError)rG   reasons     r-   r   zCSRFProtect._error_response2  s    r?   rC   )
rW   rX   rY   __doc__rb   r`   r   rx   r   r   ro   r?   r-   r   r      s&    'R2*: r?   r   c                       e Zd ZdZdZy)r   zRaise if the client sends invalid CSRF data with the request.

    Generates a 400 Bad Request response with the failure reason by default.
    Customize the response by registering a handler with
    :meth:`flask.Flask.errorhandler`.
    zCSRF validation failed.N)rW   rX   rY   r   descriptionro   r?   r-   r   r   6  s     ,Kr?   r   c                     t        |       }t        |      }|j                  |j                  k(  xr4 |j                  |j                  k(  xr |j                  |j                  k(  S rC   )r   schemehostnameport)current_uricompare_uricurrentcompares       r-   r   r   A  s[    {#G{#G 	'..( 	) 0 00	)LLGLL(r?   )NN)NNN)NTzCSRF is not configured.)!r    r4   loggingr"   urllib.parser   flaskr   r   r   r   r   itsdangerousr	   r
   r   werkzeug.exceptionsr   wtformsr   wtforms.csrf.corer   __all__	getLoggerrW   rR   r   r   r   rA   r   r   r   ro   r?   r-   <module>r      s       	 !        ) / * # "
;			8	$(V1?j >W.T 6K  K \,
 ,r?   