
    LȂiD&              
          S SK Jr  S SKJr  SSKJrJrJrJr  1 Skr	1 Skr
SrSrS	rS
\ S\ S\ S3r\" SSS9r\" SSS9r\" SSS9r\" SSS9r\" SSS9r\" SSS9r\" \S-  SS9r\" SSS9r\" SS S9r\" S!S"S9r\" S#S$S9r\" S%S&S9r\" S'S(R7                  S)R9                  \" \
5      5      5      S*S+9r\" S,S(R7                  S)R9                  \" \	5      5      5      S-S+9r\" \S.S9r \" S/S0S9r!S1 r"S2 r#\" \RH                  S3S49S5 5       r%\" \RH                  S3S49S6 5       r&\" \RH                  S3S49S7 5       r'\" \RH                  S3S49S8 5       r(\" \RH                  S3S49S9 5       r)\" \RH                  S3S49S: 5       r*\" \RH                  S3S49S; 5       r+S< r,\" \RH                  S3S49S= 5       r-\" \RH                  S3S49S> 5       r.\" \RH                  S3S49S? 5       r/\" \RH                  S3S49S@ 5       r0\" \RH                  S3S49SA 5       r1\" \RH                  S3S49SB 5       r2\" \RH                  S3S49SC 5       r3\" \RH                  5      SD 5       r4gE)F    )settings)ImproperlyConfigured   )ErrorTagsWarningregister>   same-originunsafe-nonesame-origin-allow-popups>   origin
unsafe-urlno-referrerr
   strict-originorigin-when-cross-originno-referrer-when-downgradestrict-origin-when-cross-originzdjango-insecure-2      zYour %s has less than z characters, less than z+ unique characters, or it's prefixed with 'z' indicating that it was generated automatically by Django. Please generate a long and random value, otherwise many of Django's security-critical features will be vulnerable to attack.zYou do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_REFERRER_POLICY, SECURE_CROSS_ORIGIN_OPENER_POLICY, and SECURE_SSL_REDIRECT settings will have no effect.zsecurity.W001ida3  You do not have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, so your pages will not be served with an 'x-frame-options' header. Unless there is a good reason for your site to be served in a frame, you should consider enabling this header to help prevent clickjacking attacks.zsecurity.W002a,  You have not set a value for the SECURE_HSTS_SECONDS setting. If your entire site is served only over SSL, you may want to consider setting a value and enabling HTTP Strict Transport Security. Be sure to read the documentation first; enabling HSTS carelessly can cause serious, irreversible problems.zsecurity.W004a  You have not set the SECURE_HSTS_INCLUDE_SUBDOMAINS setting to True. Without this, your site is potentially vulnerable to attack via an insecure connection to a subdomain. Only set this to True if you are certain that all subdomains of your domain should be served exclusively via SSL.zsecurity.W005zYour SECURE_CONTENT_TYPE_NOSNIFF setting is not set to True, so your pages will not be served with an 'X-Content-Type-Options: nosniff' header. You should consider enabling this header to prevent the browser from identifying content types incorrectly.zsecurity.W006a  Your SECURE_SSL_REDIRECT setting is not set to True. Unless your site should be available over both SSL and non-SSL connections, you may want to either set this setting True or configure a load balancer or reverse-proxy server to redirect all connections to HTTPS.zsecurity.W008
SECRET_KEYzsecurity.W009z4You should not have DEBUG set to True in deployment.zsecurity.W018zYou have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE, but X_FRAME_OPTIONS is not set to 'DENY'. Unless there is a good reason for your site to serve other parts of itself in a frame, you should change it to 'DENY'.zsecurity.W019z.ALLOWED_HOSTS must not be empty in deployment.zsecurity.W020zYou have not set the SECURE_HSTS_PRELOAD setting to True. Without this, your site cannot be submitted to the browser preload list.zsecurity.W021zYou have not set the SECURE_REFERRER_POLICY setting. Without this, your site will not send a Referrer-Policy header. You should consider enabling this header to protect user privacy.zsecurity.W022zDYou have set the SECURE_REFERRER_POLICY setting to an invalid value.zValid values are: {}.z, zsecurity.E023)hintr   zOYou have set the SECURE_CROSS_ORIGIN_OPENER_POLICY setting to an invalid value.zsecurity.E024zsecurity.W025zOThe Content Security Policy setting '%s' must be a dictionary (got %r instead).zsecurity.E026c                  (    S[         R                  ;   $ )Nz-django.middleware.security.SecurityMiddlewarer   
MIDDLEWARE     QD:\sksbv-state-backend\venv\Lib\site-packages\django/core/checks/security/base.py_security_middlewarer       s    :h>Q>QQQr   c                  (    S[         R                  ;   $ )Nz6django.middleware.clickjacking.XFrameOptionsMiddlewarer   r   r   r   _xframe_middlewarer"      s    @HDWDWWr   T)deployc                 6    [        5       nU(       a  / $ [        /$ N)r    W001app_configskwargspassed_checks      r   check_security_middlewarer+      s    ')L2)D6)r   c                 6    [        5       nU(       a  / $ [        /$ r%   )r"   W002r'   s      r   check_xframe_options_middlewarer.      s    %'L2)D6)r   c                 n    [        5       (       + =(       d    [        R                  nU(       a  / $ [        /$ r%   )r    r   SECURE_HSTS_SECONDSW004r'   s      r   	check_stsr2      s'    +--M1M1ML2)D6)r   c                     [        5       (       + =(       d.    [        R                  (       + =(       d    [        R                  SL nU(       a  / $ [        /$ NT)r    r   r0   SECURE_HSTS_INCLUDE_SUBDOMAINSW005r'   s      r   check_sts_include_subdomainsr7      sG     !"" 	;+++	;22d: 
 2)D6)r   c                     [        5       (       + =(       d.    [        R                  (       + =(       d    [        R                  SL nU(       a  / $ [        /$ r4   )r    r   r0   SECURE_HSTS_PRELOADW021r'   s      r   check_sts_preloadr;      sG     !"" 	0+++	0''4/ 
 2)D6)r   c                 r    [        5       (       + =(       d    [        R                  SL nU(       a  / $ [        /$ r4   )r    r   SECURE_CONTENT_TYPE_NOSNIFFW006r'   s      r   check_content_type_nosniffr?      s3     !""Rh&J&Jd&R  2)D6)r   c                 r    [        5       (       + =(       d    [        R                  SL nU(       a  / $ [        /$ r4   )r    r   SECURE_SSL_REDIRECTW008r'   s      r   check_ssl_redirectrC      s-    +--U1M1MQU1UL2)D6)r   c                     [        [        U 5      5      [        :  =(       a3    [        U 5      [        :  =(       a    U R	                  [
        5      (       + $ r%   )lenset SECRET_KEY_MIN_UNIQUE_CHARACTERSSECRET_KEY_MIN_LENGTH
startswithSECRET_KEY_INSECURE_PREFIX)
secret_keys    r   _check_secret_keyrL      sD    C
O @@ 	B
O44	B%%&@AAr   c                      [         R                  n[        U5      nU(       a  / $ [
        /$ ! [        [        4 a    Sn N$f = f)NF)r   r   rL   r   AttributeErrorW009)r(   r)   rK   r*   s       r   check_secret_keyrP      sH    5((
 )42)D6)	 !.1 s   - AAc           	         / n [         R                  n[        U5       HS  u  pE[        U5      (       a  M  UR	                  [        [        R                  SU S3-  [        R                  S95        MU     U$ ! [        [        4 a<    UR	                  [        [        R                  S-  [        R                  S95         U$ f = f)NzSECRET_KEY_FALLBACKS[]r   SECRET_KEY_FALLBACKS)r   rS   	enumeraterL   appendr   W025msgr   r   rN   )r(   r)   warnings	fallbacksindexkeys         r   check_secret_key_fallbacksr\      s    H	11	 $I.JE$S))DHH)>ugQ'GGDGGT /
 O !.1 P+A AdggNO OPs   A8 8ACCc                 L    [         R                  (       + nU(       a  / $ [        /$ r%   )r   DEBUGW018r'   s      r   check_debugr`      s    ~~%L2)D6)r   c                 t    [        5       (       + =(       d    [        R                  S:H  nU(       a  / $ [        /$ )NDENY)r"   r   X_FRAME_OPTIONSW019r'   s      r   check_xframe_denyre      s,    )++Qx/G/G6/QL2)D6)r   c                 >    [         R                  (       a  / $ [        /$ r%   )r   ALLOWED_HOSTSW020r(   r)   s     r   check_allowed_hostsrj     s    ''23dV3r   c                 p   [        5       (       a  [        R                  c  [        /$ [	        [        R                  [
        5      (       a<  [        R                  R                  S5       Vs1 sH  o"R                  5       iM     nnO[        [        R                  5      nU[        ::  d  [        /$ / $ s  snf )N,)r    r   SECURE_REFERRER_POLICYW022
isinstancestrsplitstriprF   REFERRER_POLICY_VALUESE023)r(   r)   vvaluess       r   check_referrer_policyrw     s    **26M h55s;;)1)H)H)N)Ns)ST)SAggi)SFTF889F//6MI Us   ,B3c                     [        5       (       a0  [        R                  b  [        R                  [        ;  a  [        /$ / $ r%   )r    r   !SECURE_CROSS_ORIGIN_OPENER_POLICY!CROSS_ORIGIN_OPENER_POLICY_VALUESE024ri   s     r    check_cross_origin_opener_policyr|     s8     	66B6601 vIr   c                     S Vs/ sHZ  n[        [        US5      =nc  M  [        U[        5      (       a  M0  [	        [
        R                  X#4-  [
        R                  S9PM\     sn$ s  snf )z
Validate that CSP settings are properly configured when enabled.

Ensures both SECURE_CSP and SECURE_CSP_REPORT_ONLY are dictionaries.
)
SECURE_CSPSECURE_CSP_REPORT_ONLYNr   )getattrr   ro   dictr   E026rW   r   )r(   r)   namevalues       r   check_csp_settingsr   $  sc     =<DXtT22E 	4 5$' 	4dhh$&4773<  s   A(A(.A(N)5django.confr   django.core.exceptionsr    r   r   r   r	   rz   rs   rJ   rH   rG   SECRET_KEY_WARNING_MSGr&   r-   r1   r6   r>   rB   rO   r_   rd   rh   r:   rn   formatjoinsortedrt   r{   rV   r   r    r"   securityr+   r.   r2   r7   r;   r?   rC   rL   rP   r\   r`   re   rj   rw   r|   r   r   r   r   <module>r      s     7 - -% !
	  0  #$   233J'( )'( )  
  3  0
  
  :
  ,
  \)
 :
 9
  4
 A 4 	 J	 	'	'		&9O2P(Q	R 	 	'	'		&:;<
  %/:UR 
$--%* &*
 
$--%* &*
 
$--%* &*
 
$--%* &* 
$--%* &* 
$--%* &* 
$--%* &*
 
$--%* &* 
$--% & 
$--%* &*
 
$--%* &*
 
$--%4 &4 
$--% & 
$--% & 
$-- r   