a
    [f#                     @   s  d dl mZ d dlmZ ddlmZmZmZmZ h dZ	h dZ
dZdZd	Zd
e de de dZedddZedddZedddZedddZedddZedddZeed ddZedddZedd dZed!d"dZed#d$dZed%d&dZed'd(d)ee
d*d+Zed,d(d)ee	d-d+Zeed.dZ d/d0 Z!d1d2 Z"eej#d3d4d5d6 Z$eej#d3d4d7d8 Z%eej#d3d4d9d: Z&eej#d3d4d;d< Z'eej#d3d4d=d> Z(eej#d3d4d?d@ Z)eej#d3d4dAdB Z*dCdD Z+eej#d3d4dEdF Z,eej#d3d4dGdH Z-eej#d3d4dIdJ Z.eej#d3d4dKdL Z/eej#d3d4dMdN Z0eej#d3d4dOdP Z1eej#d3d4dQdR Z2dSS )T    )settings)ImproperlyConfigured   )ErrorTagsWarningregister>   zunsafe-nonesame-originzsame-origin-allow-popups>   originzstrict-origin-when-cross-originzstrict-originzno-referrerzorigin-when-cross-originr	   z
unsafe-urlzno-referrer-when-downgradezdjango-insecure-2      zYour %s has less than z characters, less than z+ unique characters, or it's prefixed with 'z' indicating that it was generated automatically by Django. Please generate a long and random value, otherwise many of Django's security-critical features will be vulnerable to attack.zYou do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_REFERRER_POLICY, SECURE_CROSS_ORIGIN_OPENER_POLICY, and SECURE_SSL_REDIRECT settings will have no effect.zsecurity.W001ida3  You do not have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, so your pages will not be served with an 'x-frame-options' header. Unless there is a good reason for your site to be served in a frame, you should consider enabling this header to help prevent clickjacking attacks.zsecurity.W002a,  You have not set a value for the SECURE_HSTS_SECONDS setting. If your entire site is served only over SSL, you may want to consider setting a value and enabling HTTP Strict Transport Security. Be sure to read the documentation first; enabling HSTS carelessly can cause serious, irreversible problems.zsecurity.W004a  You have not set the SECURE_HSTS_INCLUDE_SUBDOMAINS setting to True. Without this, your site is potentially vulnerable to attack via an insecure connection to a subdomain. Only set this to True if you are certain that all subdomains of your domain should be served exclusively via SSL.zsecurity.W005zYour SECURE_CONTENT_TYPE_NOSNIFF setting is not set to True, so your pages will not be served with an 'X-Content-Type-Options: nosniff' header. You should consider enabling this header to prevent the browser from identifying content types incorrectly.zsecurity.W006a  Your SECURE_SSL_REDIRECT setting is not set to True. Unless your site should be available over both SSL and non-SSL connections, you may want to either set this setting True or configure a load balancer or reverse-proxy server to redirect all connections to HTTPS.zsecurity.W008
SECRET_KEYzsecurity.W009z4You should not have DEBUG set to True in deployment.zsecurity.W018zYou have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, but X_FRAME_OPTIONS is not set to 'DENY'. Unless there is a good reason for your site to serve other parts of itself in a frame, you should change it to 'DENY'.zsecurity.W019z.ALLOWED_HOSTS must not be empty in deployment.zsecurity.W020zYou have not set the SECURE_HSTS_PRELOAD setting to True. Without this, your site cannot be submitted to the browser preload list.zsecurity.W021zYou have not set the SECURE_REFERRER_POLICY setting. Without this, your site will not send a Referrer-Policy header. You should consider enabling this header to protect user privacy.zsecurity.W022zDYou have set the SECURE_REFERRER_POLICY setting to an invalid value.zValid values are: {}.z, zsecurity.E023)hintr   zOYou have set the SECURE_CROSS_ORIGIN_OPENER_POLICY setting to an invalid value.zsecurity.E024zsecurity.W025c                   C   s
   dt jv S )Nz-django.middleware.security.SecurityMiddlewarer   Z
MIDDLEWARE r   r   rC:\Users\91910\OneDrive\Desktop\vts_admin_rebuild-master\vts\Lib\site-packages\django/core/checks/security/base.py_security_middleware   s    r   c                   C   s
   dt jv S )Nz6django.middleware.clickjacking.XFrameOptionsMiddlewarer   r   r   r   r   _xframe_middleware   s    r   T)Zdeployc                 K   s   t  }|rg S tgS N)r   W001app_configskwargspassed_checkr   r   r   check_security_middleware   s    r   c                 K   s   t  }|rg S tgS r   )r   W002r   r   r   r   check_xframe_options_middleware   s    r   c                 K   s   t   ptj}|rg S tgS r   )r   r   SECURE_HSTS_SECONDSW004r   r   r   r   	check_sts   s    r!   c                 K   s(   t   ptj ptjdu }|r"g S tgS NT)r   r   r   ZSECURE_HSTS_INCLUDE_SUBDOMAINSW005r   r   r   r   check_sts_include_subdomains   s    r$   c                 K   s(   t   ptj ptjdu }|r"g S tgS r"   )r   r   r   ZSECURE_HSTS_PRELOADW021r   r   r   r   check_sts_preload   s    r&   c                 K   s    t   ptjdu }|rg S tgS r"   )r   r   ZSECURE_CONTENT_TYPE_NOSNIFFW006r   r   r   r   check_content_type_nosniff   s    r(   c                 K   s    t   ptjdu }|rg S tgS r"   )r   r   ZSECURE_SSL_REDIRECTW008r   r   r   r   check_ssl_redirect   s    r*   c                 C   s(   t t| tko&t | tko&| t S r   )lenset SECRET_KEY_MIN_UNIQUE_CHARACTERSSECRET_KEY_MIN_LENGTH
startswithSECRET_KEY_INSECURE_PREFIX)
secret_keyr   r   r   _check_secret_key   s
    

r2   c              	   K   s<   z
t j}W n ttfy$   d}Y n
0 t|}|r6g S tgS )NF)r   r   r   AttributeErrorr2   W009)r   r   r1   r   r   r   r   check_secret_key   s    

r5   c              	   K   s   g }z
t j}W n0 ttfy>   |ttjd tjd Y n>0 t	|D ]2\}}t
|sH|ttjd| d tjd qH|S )NSECRET_KEY_FALLBACKSr   zSECRET_KEY_FALLBACKS[])r   r6   r   r3   appendr   W025msgr   	enumerater2   )r   r   warningsZ	fallbacksindexkeyr   r   r   check_secret_key_fallbacks   s    
 r?   c                 K   s   t j }|rg S tgS r   )r   DEBUGW018r   r   r   r   check_debug   s    rB   c                 K   s    t   ptjdk}|rg S tgS )NZDENY)r   r   ZX_FRAME_OPTIONSW019r   r   r   r   check_xframe_deny   s    rD   c                 K   s   t jr
g S tgS r   )r   ZALLOWED_HOSTSW020r   r   r   r   r   check_allowed_hosts   s    rG   c                 K   sV   t  rRtjd u rtgS ttjtr:dd tjdD }n
ttj}|tksRt	gS g S )Nc                 S   s   h | ]}|  qS r   )strip).0vr   r   r   	<setcomp>
      z(check_referrer_policy.<locals>.<setcomp>,)
r   r   ZSECURE_REFERRER_POLICYW022
isinstancestrsplitr,   REFERRER_POLICY_VALUESE023)r   r   valuesr   r   r   check_referrer_policy  s    

rU   c                 K   s$   t  r tjd ur tjtvr tgS g S r   )r   r   Z!SECURE_CROSS_ORIGIN_OPENER_POLICY!CROSS_ORIGIN_OPENER_POLICY_VALUESE024rF   r   r   r    check_cross_origin_opener_policy  s    rX   N)3Zdjango.confr   Zdjango.core.exceptionsr    r   r   r   r   rV   rR   r0   r.   r-   ZSECRET_KEY_WARNING_MSGr   r   r    r#   r'   r)   r4   rA   rC   rE   r%   rN   formatjoinsortedrS   rW   r9   r   r   securityr   r   r!   r$   r&   r(   r*   r2   r5   r?   rB   rD   rG   rU   rX   r   r   r   r   <module>   s   		
						



	
	








