?j- l d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dlm Z d dlm
Z
d dlm Z d dl m
Z
d d l mZ d d
l mZ d d lmZ d d lmZ d d
lmZ d dlmZ d dlmZ dZ ej e Z d dZ d dZ d dZ d dZ G d de Z! G d d Z" G d d e Z#d Z$dS )! N)urlparse) Blueprint) current_app)g)request)session)BadData)SignatureExpired)URLSafeTimedSerializer)escape)Markup)
BadRequest)ValidationError)CSRF)
generate_csrf
validate_csrf
csrf_meta_tag CSRFProtectc t | dt j d } t |ddd }|t vrt | d }|t
vr@t
j t j d
t
|< | t
| }np# t $ rc t
j t j d
t
|< | t
| }Y nw xY wt t || t j | S )
a Generate a CSRF token. The token is cached for a request, so multiple
calls to this function will generate the same token.
During testing, it might be useful to access the signed token in
``g.csrf_token`` and the raw token in ``session['csrf_token']``.
:param secret_key: Used to securely sign the token. Default is
``WTF_CSRF_SECRET_KEY`` or ``SECRET_KEY``.
:param token_key: Key where token is stored in session for comparison.
Default is ``WTF_CSRF_FIELD_NAME`` or ``'csrf_token'``.
WTF_CSRF_SECRET_KEY%A secret key is required to use CSRF.messageWTF_CSRF_FIELD_NAME
csrf_token%A field name is required to use CSRF.wtf-csrf-tokensalt@ ) _get_configr
secret_keyr r r hashlibsha1osurandom hexdigestdumps TypeErrorsetattrget)r" token_key
field_namestokens U/var/www/stessy.org/copro_gestion/venv/lib/python3.11/site-packages/flask_wtf/csrf.pyr r s: 7 J 7 J ":4D E E E W $ $"),rz"~~">">"H"H"J"JGJ 1GGGJ /00EE 1 1 1"),rz"~~">">"H"H"J"JGJ GGGJ /00EEE 1 :u%%% 5 s B7 7A*D$#D$c t |dt j d }t |ddd }t |ddd
}| st d |t vrt d t |d
} | | | }n?# t $ r}t d |d}~wt $ r}t d |d}~ww xY wt j
t | | st d dS )a Check if the given data is a valid CSRF token. This compares the given
signed token to the one stored in the session.
:param data: The signed CSRF token to be checked.
:param secret_key: Used to securely sign the token. Default is
``WTF_CSRF_SECRET_KEY`` or ``SECRET_KEY``.
:param time_limit: Number of seconds that the token is valid. Default is
``WTF_CSRF_TIME_LIMIT`` or 3600 seconds (60 minutes).
:param token_key: Key where token is stored in session for comparison.
Default is ``WTF_CSRF_FIELD_NAME`` or ``'csrf_token'``.
:raises ValidationError: Contains the reason that validation failed.
.. versionchanged:: 0.14
Raises ``ValidationError`` with a specific error message rather than
returning ``True`` or ``False``.
r r r r r r WTF_CSRF_TIME_LIMIT F)requiredzThe CSRF token is missing.z"The CSRF session token is missing.r r )max_agezThe CSRF token has expired.NzThe CSRF token is invalid.z The CSRF tokens do not match.) r! r r" r r r loadsr
r hmaccompare_digest)datar"
time_limitr, r- r. r/ es r0 r r D sV & 7 J 7 J Z)>uUUUJ < :;;; BCCC z0@AAAACj11 D D D ;<>>? ?s$ ?B
C!B11
C>CCc t | dd } t || }t dt | dt | d S )a? Render an HTML ```` tag carrying the CSRF token, following the
convention used by Rails and recommended by OWASP for SPA and AJAX clients.
Extract the token client-side with
``document.querySelector('meta[name="csrf-token"]').content`` and send it
in the ``X-CSRFToken`` header of state-changing requests.
:param name: Value of the meta tag's ``name`` attribute. Default is
``WTF_CSRF_META_NAME`` or ``'csrf-token'``.
:param secret_key: Forwarded to :func:`generate_csrf`.
:param token_key: Forwarded to :func:`generate_csrf`.
WTF_CSRF_META_NAME
csrf-tokenr" r, z )r! r r
r )namer" r, r/ s r0 r r x sV t 1< @ @D Z9 E E EE K KK&--KKK L LL TCSRF is not configured.c p | t j || } |r| t | | S )a Find config value based on provided value, Flask config, and default
value.
:param value: already provided config value
:param config_name: Flask ``config`` key
:param default: default value if not provided or configured
:param required: whether the value must not be ``None``
:param message: error message if required config is not found
:raises KeyError: if required config is not found
)r configr+ RuntimeError)value config_namedefaultr4 r s r0 r! r! s@
}"&&{G<< $EM7### LrA c * e Zd Z fdZd Zd Z xZS )_FlaskFormCSRFc ^ |j | _ t | S N)metasuper
setup_form)selfform __class__s r0 rO z_FlaskFormCSRF.setup_form s$ I ww!!$'''rA c L t | j j | j j S )Nr? )r rM csrf_secretcsrf_field_name)rP csrf_token_fields r0 generate_csrf_tokenz"_FlaskFormCSRF.generate_csrf_token s( y, 8Q
rA c t j dd rd S t |j | j j | j j | j j d S # t $ r+}t
|j d d }~ww xY w)N
csrf_validFr ) r r+ r r9 rM rT csrf_time_limitrU r loggerinfoargs)rP rQ fieldr; s r0 validate_csrf_tokenz"_FlaskFormCSRF.validate_csrf_token s 5 u % % F
% ) )
KKq " " " s 5A
B&B B)__name__
__module__ __qualname__rO rW r_
__classcell__)rR s @r0 rJ rJ sV ( ( ( ( (
rA rJ c @ e Zd ZdZd dZd Zd Zd dZd Zd Z d
Z
dS )
r a[ Enable CSRF protection globally for a Flask app.
::
app = Flask(__name__)
csrf = CSRFProtect(app)
Checks the ``csrf_token`` field sent with forms, or the ``X-CSRFToken``
header sent with JavaScript requests. Render the token in templates using
``{{ csrf_token() }}``.
See the :ref:`csrf` documentation.
Nc t | _ t | _ |r| | d S d S rL )set
_exempt_views_exempt_blueprintsinit_app)rP apps r0 __init__zCSRFProtect.__init__ sD UU"%%% MM# rA c j d< j dd j dd t j dg d j d< j dd j d d
d g j d d
j dd j dd t
j j d< t j j d< d j
fd }d S )NcsrfWTF_CSRF_ENABLEDTWTF_CSRF_CHECK_DEFAULTWTF_CSRF_METHODS)POSTPUTPATCHDELETEr r WTF_CSRF_HEADERSz X-CSRFTokenz X-CSRF-Tokenr= r> r2 r3 WTF_CSRF_SSL_STRICTr c t t dS )N)r r )r r rA r0 z&CSRFProtect.init_app.. s ==QQ rA c p j d sd S j d sd S d d S )Nrn ro T)apply_exemptions)rD protect)rj rP s r0 csrf_protectz*CSRFProtect.init_app..csrf_protect sG : 01
: 67
LL$L / / / / /rA )
extensionsrD
setdefaultrf r+ r jinja_envglobalsr context_processorbefore_request)rP rj r} s `` r0 ri zCSRFProtect.init_app sl !%v
0$777
6===), JNN-/Q/Q/Q R R*
*
%&
3\BBB
0=.2QRRR
2LAAA
3T:::
3T:::.;
l+1>
o. Q Q
0 0 0 0 0
0 0 0rA c \ t j d }t j | }|r|S t j D ]/}| | rt j | }|r|c S 0t j d D ]'}t j | }|r|c S (d S )Nr ru )r rD r rQ r+ endswithheaders)rP r-
base_tokenkeyr header_names r0 _get_csrf_tokenzCSRFProtect._get_csrf_token s '(=>
\%%j11
< & &C||J''
& $\# .
&%%%% '-.@A " "K ,,[99J
"!!!!
" trA Fc |r$t j sdS | rdS t j t j d vrdS t
| n\# t $ rO}t
|j d | |j d Y d}~nd}~ww xY wt j
rrt j d r`t j s| d dt j d}t! t j | s| d d t" _ dS )
a0 Validate CSRF on the current request.
When ``apply_exemptions`` is ``True``, views and blueprints marked with
:meth:`exempt` are skipped. This lets you combine a custom
``before_request`` hook (or any manual call) with the declarative
``@csrf.exempt`` decorator.
Nrp r rv z The referrer header is missing.zhttps:///z%The referrer does not match the host.T)r endpoint
_is_exemptmethodr rD r r r r[ r\ r] _error_response is_securereferrerhost same_originr rY )rP r{ r;
good_referrers r0 r| zCSRFProtect.protect
sX #
>!34F!G G G F , $..00 1 1 1 1 , , , KKq " " " + + + + + + + + , N!34I!J N#
H$$%FGGG 6w| 6 6 6M w / ??
N$$%LMMM s !A* *
C4AB>>Cc t j t j | j v rdS t j t j }|dS |j d|j }|| j
v S )NTF.) r
blueprintsr+ r blueprintrh view_functionsr ra r` rg )rP viewdests r0 r zCSRFProtect._is_exempt. sq ! % %g&7 8 8D?? <5/33DM33t)))rA c t |t r | j | |S t |t r|}n!d |j |j f }| j | |S )a Mark a view or blueprint to be excluded from CSRF protection.
::
@app.route('/some-view', methods=['POST'])
@csrf.exempt
def some_view():
...
::
bp = Blueprint(...)
csrf.exempt(bp)
r )
isinstancer rh addstrjoinra r` rg )rP r
view_locations r0 exemptzCSRFProtect.exempt9 s " dI & & # ' ' - - -K dC G MM HHdot}%E F FM }--- rA c t | rL ) CSRFError)rP reasons r0 r zCSRFProtect._error_responseV s rA rL )F) r` ra rb __doc__rk ri r r| r r r rx rA r0 r r s 0 0 0< 2" " " " H * * * : rA r c e Zd ZdZdZdS )r zRaise if the client sends invalid CSRF data with the request.
Generates a 400 Bad Request response with the failure reason by default.
Customize the response by registering a handler with
:meth:`flask.Flask.errorhandler`.
zCSRF validation failed.N)r` ra rb r descriptionrx rA r0 r r Z s ,KKKrA r c t | }t | }|j |j k o |j |j k o|j |j k S rL )r schemehostnameport) current_uri compare_uricurrentcompares r0 r r e sS {##G{##G '.( ) 0 0 ) LGL (rA )NN)NNN)NTrB )%r# r7 loggingr% urllib.parser flaskr r r r r itsdangerousr r
r
markupsafer r
werkzeug.exceptionsr wtformsr wtforms.csrf.corer __all__ getLoggerr` r[ r r r r! rJ r r r rx rA r0 r s6 ! ! ! ! ! ! ) ) ) ) ) ) / / / / / / * * * * * * # # # # # # " " " " " "
L 8 $ $( ( ( ( V1? 1? 1? 1?hM M M M( >W . T 6Z Z Z Z Z Z Z Z z, , , , ,
, , , rA