U najjQ@s dZddlmZddlZddlZddlmZmZddlm Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlZddlmZddlZddlZddlZddlZddlmZddlmZmZmZee j!d Z"d Z#d Z$d Z%d Z&dZ'dZ(dZ)dZ*e+dZ,dddddZ-dddddZ.e'dddddddZ/e dd Gd!d"d"Z0Gd#d$d$Z1Gd%d&d&Z2d'ddd(d)Z3d*d+dd,dd-d.d/Z4Gd0d1d1ej5j6Z7e(dd2d3d"dd,d4d5d6d7Z8dddd8d9d:Z9d;d<d=d>Z:d;d<d?d@Z;exsz.SessionStore._purge_locked..)rFitemsrW)r;rTZexpiredrPrr[rrMwszSessionStore._purge_lockedN) r=r>r?SESSION_TTL_SECONDSrJrQrVrXrMrrrrrB[s  rBc@sheZdZeedddddddZddd d d Zddd d d Zddd ddZddddddZ dS)LoginRateLimiter) max_failureswindow_secondsrrC)r`rarcCs$||_||_tt|_t|_dSrE)r`rarr _failuresrGrHrI)r;r`rarrrrJ~s zLoginRateLimiter.__init__rr9) client_idrc Cs<|j,||t}t||jkW5QRSQRXdSrE)rI_active_failures_lockedrNrr`r;rcfailuresrrr is_limitedszLoginRateLimiter.is_limitedc Cs4|j$||t}|tW5QRXdSrE)rIrdrNappendrerrrrecord_failureszLoginRateLimiter.record_failurec Cs$|j|j|dW5QRXdSrE)rIrbrW)r;rcrrrclearszLoginRateLimiter.clearrYz Deque[float])rcrTrcCsf|j|}||j}|r.|d|kr.|q|sbt|jD]$}||kr<|j|s<|j|dq<|S)Nr)rbrapopleftlistrW)r;rcrTrfcutoffkeyrrrrds   z(LoginRateLimiter._active_failures_lockedN) r=r>r?MAX_FAILURES_PER_WINDOWFAILURE_WINDOW_SECONDSrJrgrirjrdrrrrr_}s r_rRcCsV|stSt|}|js4|js4|jdr4|jdr8tS|j}|jrR|d|j7}|S)z>Allow only same-origin absolute paths in post-login redirects./z//?)DEFAULT_TARGETr r6Znetlocpath startswithquery)rpartsresultrrr safe_nexts$ryF show_errorr9)next_urlr{rcCs:tjt|dd}|rdnd}d|d|d}|dS) NT)r uLuN V3 Face — Review Access

V3 Face Review

GoodGangLabs 사내 검토용 페이지입니다.
공유받은 비밀번호를 입력해 주세요.

z]
r$)htmlescaperyr*)r|r{Z escaped_nexterrorZdocumentrrr_login_documents')3rcs~eZdZUdZded<ded<ded<ded <d Zd ed <d dfdd Zd dfdd Zd dddZd dddZ d dddZ d d dddZ d dddZ d dddZ d d!d d"d#d$d d d d%d&d'Zd$d(d#d d d)d*d+Zd(d#d d d,d-d.Zd#d d/d0d1Zd d dfd2d3 Zed#d$d4d5d6d7Zd#d$d$d d8d9d:Zd dd;d<Zd=dd>d?Zd#dd@dAZZS)BFaceViewerHandlerz FaceViewer/2r/password_verifierrBsessionsr_ rate_limiterrrootTr9 trust_proxyrCrKcs tj|dt|ji|dS)NZ directory)superrJrr)r;argskwargs __class__rrrJszFaceViewerHandler.__init__csJ|dd|dd|dd|dd|d d tdS) Nz Cache-Controlzprivate, no-store, max-age=0ZPragmazno-cachezX-Content-Type-OptionsZnosniffzReferrer-Policyz same-originzX-Frame-OptionsZDENY) send_headerr end_headersr;rrrrs      zFaceViewerHandler.end_headerscCs|jdddS)NT send_body_route_get_or_headrrrrdo_GETszFaceViewerHandler.do_GETcCs|jdddS)NFrrrrrrdo_HEADszFaceViewerHandler.do_HEADcCs>t|jj}|dkr|n|dkr0|n |ddS)Nz /auth/loginz /auth/logout)r rt _handle_login_handle_logout send_error)r;rtrrrdo_POST s    zFaceViewerHandler.do_POST)rrcCst|j}|j}|dkr.|jddd|ddS|dkrxtt|jdtgd}|rf| |n|j ||ddS| d r| d dS|s||jrd |jnd }| d t t|d ddS|j|ddS)Nz/healthzsok ztext/plain; charset=utf-8r/loginnextrz/auth/irrr}z /login?next=)Zsafe)r rt _send_bytesryrrvrSrs_is_authenticated _redirect _send_loginrurr _serve_static)r;rrwrtr|Z requestedrrrrs&    z$FaceViewerHandler._route_get_or_headc Cs|}|j|rF|d|dtt|dd|dS|j dd}z t |}Wn"t k r| ddYdSX|dks|t kr| d dS|j d dd d d}|d kr| ddSzt|j|ddd}Wn"tk r| dYdSX| ddgddd}t| dtgd}|j|sz|j||j|ddddS|j||j}|d|d||dtd|d|jj d|dd|dS)Niz Retry-AfterContent-Length0r}izInvalid Content-Lengthri Content-Type;r z!application/x-www-form-urlencodedir$T)Zkeep_blank_valuesr ri)statusr{/Location Set-Cookierz; Path=/; Max-Age=z ; Secure; HttpOnly; SameSite=Lax)! _client_idrrg send_responserrrprheadersrSrr&rMAX_FORM_BYTESr3striplowerrZrfilereadrUnicodeDecodeErrorryrsrr<rirrjrrQ COOKIE_NAMErD) r;rcZ raw_lengthlength content_typeZfieldsr r|rPrrrr*sR      "        zFaceViewerHandler._handle_logincCsP|j||d|dd|dtd|dd|dS)Nrrrrz4=; Path=/; Max-Age=0; Secure; HttpOnly; SameSite=Laxrr)rrX_session_tokenrrrrrrrrrVs   z FaceViewerHandler._handle_logoutrF)rr{rrr)r|rr{rrcCs6t||d}|||dd|j|d|ddS)NrzzContent-Security-Policyzjdefault-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'ztext/html; charset=utf-8r)rrr _finish_bytes)r;r|rr{rbodyrrrras   zFaceViewerHandler._send_loginr )rrrrrcCs|||j|||ddS)Nr)rr)r;rrrrrrrrns zFaceViewerHandler._send_bytes)rrrrcCs<|d||dtt|||r8|j|dS)Nrr)rrrrwfilewrite)r;rrrrrrrrs  zFaceViewerHandler._finish_bytes)locationrcCs.|d|d||dd|dS)Nrrrr)rrr)r;rrrrrys   zFaceViewerHandler._redirectc s||j}tj|r6|r(tn tdStj|sP|ddStj |}|j d}|s| d| d||| dd| dt|||r||d|dS|||}|dkr | d | d d || dd |dS|\}}||d }| d| d||| dd| d d|d|d|| dt|||r||||dS)NrZRangerrz Accept-Rangesr rriz Content-Rangezbytes */rr zbytes -rq)Ztranslate_pathrtosisdirrrrisfilergetsizerrSrrZ guess_typerr_copy_file_range _parse_range) r;rrtsizeZ range_headerZ byte_rangestartendrrrrrsJ                 zFaceViewerHandler._serve_staticztuple[int, int] | None)rrrcCst|}|r|dkrdS|\}}|s6|s6dS|sdt|}|dkrNdStd|||dfSt|}|rxt|n|d}t||d}||ks||krdS||fS)Nrr )RANGE_RE fullmatchrgroupsrmaxmin)rrmatchZ raw_startZraw_endZ suffix_lengthrrrrrrs"  zFaceViewerHandler._parse_range)rtrrrc Cszz\t|dH}|||}|rP|td|}|s6qP|j||t|8}qW5QRXWnttfk rtYnXdS)Nrbi) openseekrrrrrBrokenPipeErrorConnectionResetError)r;rtrrsourceZ remainingchunkrrrrs   z"FaceViewerHandler._copy_file_rangecCs|j|SrE)rrVrrrrrrsz#FaceViewerHandler._is_authenticatedrRcCs`|jd}|sdStj}z||Wntjjk rFYdSX|t}|r\|jSdS)NZCookie) rrShttpZcookiesZ SimpleCookieloadZ CookieErrorrr)r;Z raw_cookieZcookieZmorselrrrrs   z FaceViewerHandler._session_tokencCsH|jr>|jdd}ztt|WStk r<YnX|jdS)NzCF-Connecting-IPr}r) rrrSrr ipaddressZ ip_addressr&Zclient_address)r;Z forwardedrrrrszFaceViewerHandler._client_id)r=r>r?Zserver_versionr@rrJrrrrrrrrrrrr staticmethodrrrrr __classcell__rrrrrs8    , ( r session_ttlrrztype[FaceViewerHandler])rverifierrrrcCs<Gdddt}||_||_t||_t|_||_|S)Nc@s eZdZdS)z2build_handler..ConfiguredFaceViewerHandlerN)r=r>r?rrrrConfiguredFaceViewerHandlersr) rresolverrrBrr_rr)rrrrrrrr build_handlers  r) raw_valuenamerc CsZz t|}Wn2tk r>}zt|d|W5d}~XYnX|dkrVt|d|S)Nz must be an integerrz must be positive)rr&)rrrr7rrr _positive_ints "rrCrKc Cstjdd}|stdz:t|}ttjddd}ttjdttd}Wn0t k r}ztt||W5d}~XYnXt tjdtt  }| std|tjd d d k}t||||d }tjd |f|}d|_td|d|dd|dS)NZFACE_VIEWER_PASSWORD_HASHr}zAFACE_VIEWER_PASSWORD_HASH is required; refusing to start unlockedZFACE_VIEWER_PORTZ8095ZFACE_VIEWER_SESSION_TTLZFACE_VIEWER_ROOTz%FACE_VIEWER_ROOT is not a directory: ZFACE_VIEWER_TRUST_PROXY1>falserFalserz 127.0.0.1Tzserving password-protected z on 127.0.0.1:)flush)renvironrS SystemExitr/r8rrr^r&r DEFAULT_ROOTris_dirrrserverZThreadingHTTPServerZdaemon_threadsprintZ serve_forever) Z encoded_hashrZportrr7rrZhandlerrrrrserves*  rc Cstjtd}|jdddd|}|jrtd}td}||krNtdztt |Wn0t k r}ztt ||W5d}~XYnXdSt dS) N)Z descriptionz--hash-password store_truez8prompt for a password and print a salted hash, then exit)actionhelpz Password: zConfirm password: zpasswords do not match) argparseArgumentParser__doc__ add_argument parse_argsZ hash_passwordgetpassrrr-r&rr)parserrr Z confirmationr7rrrmains$    r__main__)=rZ __future__rrr collectionsrrZ dataclassesrrr(r:r~Z http.cookiesrZ http.serverrrpathlibrrer'rGrNtypingrZ urllib.parserr r __file__rparentsrrsrrr+ZPASSWORD_HASH_ITERATIONSr^rprocompilerrrr-r/rBr_ryrrZSimpleHTTPRequestHandlerrrrrrr=rrrrsb      "( =x