a Lcf#@sddlmZddlmZddlmZmZmZmZhdZ hdZ dZ dZ d Z d e d e d e d ZedddZedddZedddZedddZedddZedddZeedddZedddZedd dZed!d"dZed#d$dZed%d&dZed'd(d)ee d*d+Zed,d(d)ee d-d+Zeed.dZ d/d0Z!d1d2Z"eej#d3d4d5d6Z$eej#d3d4d7d8Z%eej#d3d4d9d:Z&eej#d3d4d;d<Z'eej#d3d4d=d>Z(eej#d3d4d?d@Z)eej#d3d4dAdBZ*dCdDZ+eej#d3d4dEdFZ,eej#d3d4dGdHZ-eej#d3d4dIdJZ.eej#d3d4dKdLZ/eej#d3d4dMdNZ0eej#d3d4dOdPZ1eej#d3d4dQdRZ2dSS)T)settings)ImproperlyConfigured)ErrorTagsWarningregister> same-originz unsafe-nonezsame-origin-allow-popups>zorigin-when-cross-originz unsafe-urloriginz strict-originzno-referrer-when-downgradezstrict-origin-when-cross-originz no-referrerr zdjango-insecure-2zYour %s has less than z characters, less than z+ unique characters, or it's prefixed with 'z' indicating that it was generated automatically by Django. Please generate a long and random value, otherwise many of Django's security-critical features will be vulnerable to attack.zYou do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_REFERRER_POLICY, SECURE_CROSS_ORIGIN_OPENER_POLICY, and SECURE_SSL_REDIRECT settings will have no effect.z security.W001ida3You do not have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, so your pages will not be served with an 'x-frame-options' header. Unless there is a good reason for your site to be served in a frame, you should consider enabling this header to help prevent clickjacking attacks.z security.W002a,You have not set a value for the SECURE_HSTS_SECONDS setting. If your entire site is served only over SSL, you may want to consider setting a value and enabling HTTP Strict Transport Security. Be sure to read the documentation first; enabling HSTS carelessly can cause serious, irreversible problems.z security.W004aYou have not set the SECURE_HSTS_INCLUDE_SUBDOMAINS setting to True. Without this, your site is potentially vulnerable to attack via an insecure connection to a subdomain. Only set this to True if you are certain that all subdomains of your domain should be served exclusively via SSL.z security.W005zYour SECURE_CONTENT_TYPE_NOSNIFF setting is not set to True, so your pages will not be served with an 'X-Content-Type-Options: nosniff' header. You should consider enabling this header to prevent the browser from identifying content types incorrectly.z security.W006aYour SECURE_SSL_REDIRECT setting is not set to True. Unless your site should be available over both SSL and non-SSL connections, you may want to either set this setting True or configure a load balancer or reverse-proxy server to redirect all connections to HTTPS.z security.W008 SECRET_KEYz security.W009z4You should not have DEBUG set to True in deployment.z security.W018zYou have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, but X_FRAME_OPTIONS is not set to 'DENY'. Unless there is a good reason for your site to serve other parts of itself in a frame, you should change it to 'DENY'.z security.W019z.ALLOWED_HOSTS must not be empty in deployment.z security.W020zYou have not set the SECURE_HSTS_PRELOAD setting to True. Without this, your site cannot be submitted to the browser preload list.z security.W021zYou have not set the SECURE_REFERRER_POLICY setting. Without this, your site will not send a Referrer-Policy header. You should consider enabling this header to protect user privacy.z security.W022zDYou have set the SECURE_REFERRER_POLICY setting to an invalid value.zValid values are: {}.z, z security.E023)hintrzOYou have set the SECURE_CROSS_ORIGIN_OPENER_POLICY setting to an invalid value.z security.E024z security.W025cCs dtjvS)Nz-django.middleware.security.SecurityMiddlewarerZ MIDDLEWARErr]/home/httpd/docs/test/DocsMgr/lib/python3.9/site-packages/django/core/checks/security/base.py_security_middlewaresrcCs dtjvS)Nz6django.middleware.clickjacking.XFrameOptionsMiddlewarerrrrr_xframe_middlewaresrT)ZdeploycKst}|rgStgSN)rW001 app_configskwargs passed_checkrrrcheck_security_middlewaresrcKst}|rgStgSr)rW002rrrrcheck_xframe_options_middlewaresrcKst p tj}|rgStgSr)rrSECURE_HSTS_SECONDSW004rrrr check_stssr!cKs(t ptj ptjdu}|r"gStgSNT)rrrZSECURE_HSTS_INCLUDE_SUBDOMAINSW005rrrrcheck_sts_include_subdomainss r$cKs(t ptj ptjdu}|r"gStgSr")rrrZSECURE_HSTS_PRELOADW021rrrrcheck_sts_preloads r&cKs t ptjdu}|rgStgSr")rrZSECURE_CONTENT_TYPE_NOSNIFFW006rrrrcheck_content_type_nosniffsr(cKs t ptjdu}|rgStgSr")rrZSECURE_SSL_REDIRECTW008rrrrcheck_ssl_redirectsr*cCs(tt|tko&t|tko&|t Sr)lenset SECRET_KEY_MIN_UNIQUE_CHARACTERSSECRET_KEY_MIN_LENGTH startswithSECRET_KEY_INSECURE_PREFIX) secret_keyrrr_check_secret_keys   r2c Ks<z tj}Wnttfy$d}Yn 0t|}|r6gStgS)NF)rrrAttributeErrorr2W009)rrr1rrrrcheck_secret_keys   r5c Ksg}z tj}Wn0ttfy>|ttjdtjdYn>0t |D]2\}}t |sH|ttjd|dtjdqH|S)NSECRET_KEY_FALLBACKSr zSECRET_KEY_FALLBACKS[]) rr6rr3appendrW025msgr enumerater2)rrwarningsZ fallbacksindexkeyrrrcheck_secret_key_fallbackss  r?cKstj }|rgStgSr)rDEBUGW018rrrr check_debugsrBcKs t ptjdk}|rgStgS)NZDENY)rrZX_FRAME_OPTIONSW019rrrrcheck_xframe_denysrDcKstjr gStgSr)rZ ALLOWED_HOSTSW020rrrrrcheck_allowed_hostssrGcKsVtrRtjdurtgSttjtr:ddtjdD}n ttj}|tksRt gSgS)NcSsh|] }|qSr)strip).0vrrr z(check_referrer_policy..,) rrZSECURE_REFERRER_POLICYW022 isinstancestrsplitr,REFERRER_POLICY_VALUESE023)rrvaluesrrrcheck_referrer_policys   rUcKs$tr tjdur tjtvr tgSgSr)rrZ!SECURE_CROSS_ORIGIN_OPENER_POLICY!CROSS_ORIGIN_OPENER_POLICY_VALUESE024rFrrr check_cross_origin_opener_policysrXN)3Z django.confrZdjango.core.exceptionsrrrrrrVrRr0r.r-ZSECRET_KEY_WARNING_MSGrrr r#r'r)r4rArCrEr%rNformatjoinsortedrSrWr9rrsecurityrrr!r$r&r(r*r2r5r?rBrDrGrUrXrrrrs