File: //home/arjun/projects/env/lib/python3.10/site-packages/flask_wtf/__pycache__/csrf.cpython-310.pyc
o
+we�' � @ s d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dlm Z d dlm
Z
d dlm Z d dl m
Z
d d l mZ d d
l mZ d d lmZ d d lmZ d d
lmZ dZe�e�Zd dd�Zd dd�Z d!dd�Z G dd� de�Z G dd� d�Z G dd � d e�Z d d � Z dS )"� N)�urlparse)� Blueprint)� current_app)�g)�request)�session)�BadData)�SignatureExpired)�URLSafeTimedSerializer)�
BadRequest)�ValidationError)�CSRF)�
generate_csrf�
validate_csrf� CSRFProtectc C s� t | dtjdd�} t |dddd�}|tvrWt| dd�}|tvr+t�t� d ���
� t|< z |� t| �}W n t yP t�t� d ���
� t|< |� t| �}Y nw t
t||� t�|�S )
a Generate a CSRF token. The token is cached for a request, so multiple
calls to this function will generate the same token.
During testing, it might be useful to access the signed token in
``g.csrf_token`` and the raw token in ``session['csrf_token']``.
:param secret_key: Used to securely sign the token. Default is
``WTF_CSRF_SECRET_KEY`` or ``SECRET_KEY``.
:param token_key: Key where token is stored in session for comparison.
Default is ``WTF_CSRF_FIELD_NAME`` or ``'csrf_token'``.
�WTF_CSRF_SECRET_KEY�%A secret key is required to use CSRF.��message�WTF_CSRF_FIELD_NAME�
csrf_token�%A field name is required to use CSRF.�wtf-csrf-token��salt�@ )� _get_configr �
secret_keyr r
r �hashlib�sha1�os�urandom� hexdigest�dumps� TypeError�setattr�get)r � token_key�
field_name�s�token� r+ �G/home/arjun/projects/env/lib/python3.10/site-packages/flask_wtf/csrf.pyr s0
�� �
r c
C s� t |dtjdd�}t |dddd�}t |ddd d
�}| s td ��|tvr'td ��t|d
d�}z |j| |d�}W n! tyG } ztd�|�d}~w tyW } ztd�|�d}~ww t �
t| |�sdtd��dS )a Check if the given data is a valid CSRF token. This compares the given
signed token to the one stored in the session.
:param data: The signed CSRF token to be checked.
:param secret_key: Used to securely sign the token. Default is
``WTF_CSRF_SECRET_KEY`` or ``SECRET_KEY``.
:param time_limit: Number of seconds that the token is valid. Default is
``WTF_CSRF_TIME_LIMIT`` or 3600 seconds (60 minutes).
:param token_key: Key where token is stored in session for comparison.
Default is ``WTF_CSRF_FIELD_NAME`` or ``'csrf_token'``.
:raises ValidationError: Contains the reason that validation failed.
.. versionchanged:: 0.14
Raises ``ValidationError`` with a specific error message rather than
returning ``True`` or ``False``.
r r r r r r �WTF_CSRF_TIME_LIMIT� F)�requiredzThe CSRF token is missing.z"The CSRF session token is missing.r r )�max_agezThe CSRF token has expired.NzThe CSRF token is invalid.z The CSRF tokens do not match.) r r r r r r
�loadsr r �hmac�compare_digest)�datar �
time_limitr' r( r) r* �er+ r+ r, r B s< ��
�
���r T�CSRF is not configured.c C s. | du r t j�||�} |r| du rt|��| S )a� Find config value based on provided value, Flask config, and default
value.
:param value: already provided config value
:param config_name: Flask ``config`` key
:param default: default value if not provided or configured
:param required: whether the value must not be ``None``
:param message: error message if required config is not found
:raises KeyError: if required config is not found
N)r �configr& � RuntimeError)�value� config_name�defaultr/ r r+ r+ r, r v s
r c s, e Zd Z� fdd�Zdd� Zdd� Z� ZS )�_FlaskFormCSRFc s |j | _ t� �|�S �N)�meta�super�
setup_form)�self�form�� __class__r+ r, rA � s z_FlaskFormCSRF.setup_formc C s t | jj| jjd�S )N)r r' )r r? � csrf_secret�csrf_field_name)rB �csrf_token_fieldr+ r+ r, �generate_csrf_token� s �z"_FlaskFormCSRF.generate_csrf_tokenc
C s^ t �dd�rd S zt|j| jj| jj| jj� W d S ty. } z t �
|j d � � d }~ww )N�
csrf_validFr ) r r& r r4 r? rF �csrf_time_limitrG r �logger�info�args)rB rC �fieldr6 r+ r+ r, �validate_csrf_token� s
���z"_FlaskFormCSRF.validate_csrf_token)�__name__�
__module__� __qualname__rA rI rP �
__classcell__r+ r+ rD r, r= � s r= c @ sB e Zd ZdZddd�Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dS )r a[ Enable CSRF protection globally for a Flask app.
::
app = Flask(__name__)
csrf = CSRFProtect(app)
Checks the ``csrf_token`` field sent with forms, or the ``X-CSRFToken``
header sent with JavaScript requests. Render the token in templates using
``{{ csrf_token() }}``.
See the :ref:`csrf` documentation.
Nc C s& t � | _t � | _|r| �|� d S d S r> )�set�
_exempt_views�_exempt_blueprints�init_app)rB �appr+ r+ r, �__init__� s
�zCSRFProtect.__init__c s� �� j d< � j�dd� � j�dd� t� j�dg d���� jd< � j�dd� � j�d d
d g� � j�d d
� � j�dd� t� jjd< � �dd� � � j � �fdd��}d S )N�csrf�WTF_CSRF_ENABLEDT�WTF_CSRF_CHECK_DEFAULT�WTF_CSRF_METHODS)�POST�PUT�PATCH�DELETEr r �WTF_CSRF_HEADERSz X-CSRFTokenz X-CSRF-Tokenr- r. �WTF_CSRF_SSL_STRICTc S s dt iS )Nr )r r+ r+ r+ r, �<lambda>� s z&CSRFProtect.init_app.<locals>.<lambda>c s� � j d sd S � j d sd S tj� j d vrd S tjs d S � j�tj��jv r)d S � j�tj�} | j � d| j
� �}|�j v r@d S �� � d S )Nr\ r] r^ �.)
r8 r �method�endpoint�
blueprintsr& � blueprintrW �view_functionsrR rQ rV �protect)�view�dest�rY rB r+ r, � csrf_protect� s
z*CSRFProtect.init_app.<locals>.csrf_protect)
�
extensionsr8 �
setdefaultrU r& r � jinja_env�globals�context_processor�before_request)rB rY rp r+ ro r, rX � s
� zCSRFProtect.init_appc C sv t jd }tj�|�}|r|S tjD ]}|�|�r$tj| }|r$| S qt jd D ]}tj�|�}|r8| S q*d S )Nr rc )r r8 r rC r& �endswith�headers)rB r( �
base_token�keyr � header_namer+ r+ r, �_get_csrf_token� s
� �zCSRFProtect._get_csrf_tokenc
C s� t jtjd vr
d S zt| �� � W n" ty4 } zt�|j d � | �
|j d � W Y d }~nd }~ww t j rWtjd rWt j sE| �
d� dt j
� d�}tt j |�sW| �
d� dt_d S ) Nr^ r rd z The referrer header is missing.zhttps://�/z%The referrer does not match the host.T)r rg r r8 r r| r rL rM rN �_error_response� is_secure�referrer�host� same_originr rJ )rB r6 �
good_referrerr+ r+ r, rl s ��
zCSRFProtect.protectc C sL t |t�r
| j�|� |S t |t�r|}n d�|j|jf�}| j�|� |S )a Mark a view or blueprint to be excluded from CSRF protection.
::
@app.route('/some-view', methods=['POST'])
@csrf.exempt
def some_view():
...
::
bp = Blueprint(...)
csrf.exempt(bp)
rf ) �
isinstancer rW �add�str�joinrR rQ rV )rB rm �
view_locationr+ r+ r, �exempt s
zCSRFProtect.exemptc C s t |��r> )� CSRFError)rB �reasonr+ r+ r, r~ 2 s zCSRFProtect._error_responser> )
rQ rR rS �__doc__rZ rX r| rl r� r~ r+ r+ r+ r, r � s
) r c @ s e Zd ZdZdZdS )r� z�Raise if the client sends invalid CSRF data with the request.
Generates a 400 Bad Request response with the failure reason by default.
Customize the response by registering a handler with
:meth:`flask.Flask.errorhandler`.
zCSRF validation failed.N)rQ rR rS r� � descriptionr+ r+ r+ r, r� 6 s r� c C s4 t | �}t |�}|j|jko|j|jko|j|jkS r> )r �scheme�hostname�port)� current_uri� compare_uri�current�comparer+ r+ r, r� A s
�
�r� )NN)NNN)NTr7 )!r r2 �loggingr � urllib.parser �flaskr r r r r � itsdangerousr r r
�werkzeug.exceptionsr �wtformsr �wtforms.csrf.corer
�__all__� getLoggerrQ rL r r r r= r r� r� r+ r+ r+ r, �<module> s6
+5
�