Merge branch 'main' into feature/cyber-challenges-quiz-compiler-clean

Author: kri2tle

core/middleware.py

@@ -7,8 +7,12 @@
 from django.urls import reverse
 from django.conf import settings
 from django.middleware.locale import LocaleMiddleware
+from django.http import HttpResponseNotFound
 from django.utils import translation
+from django.shortcuts import render
+
 logger = logging.getLogger('admin_logout_logger')
+Honeypot_logger = logging.getLogger("honeypot_logger")
 
 class AutoLogoutMiddleware(MiddlewareMixin):
     """
@@ -26,10 +30,6 @@ def process_request(self, request):
                 elif is_admin_page:
                     request.session['admin_session'] = True
 
-
-
-
-
 class LogRequestMiddleware:
     """
     Middleware to log IP address and accessed URL.
@@ -98,17 +98,11 @@ def __call__(self, request):
 
         return response
 
-        # Continue processing the request
-        return self.get_response(request)
-    
-
-
     def log_request(self, request):
         ip = self.get_client_ip(request)
         path = request.path
-
-        # Log the information
         logger.info(f"IP: {ip} accessed {path}")
+
     def get_client_ip(self, request):
         """
         Extracts client IP address from request headers.
@@ -118,11 +112,8 @@ def get_client_ip(self, request):
             ip = x_forwarded_for.split(',')[0]
         else:
             ip = request.META.get('REMOTE_ADDR')
-        return ip   
-
-
+        return ip
 
-        
 try:
     from django.utils.translation import LANGUAGE_SESSION_KEY  # Django 4+
 except Exception:
@@ -148,44 +139,31 @@ def process_request(self, request):
         translation.activate(lang)
         request.LANGUAGE_CODE = translation.get_language()
 
-
 class SecurityHeadersMiddleware:
     """
     Middleware to add security headers that help mitigate vulnerabilities
     in third-party JavaScript libraries and prevent common attacks.
     """
-    
     def __init__(self, get_response):
         self.get_response = get_response
 
     def __call__(self, request):
         response = self.get_response(request)
-        
         # Content Security Policy to prevent XSS and code injection
         response['Content-Security-Policy'] = (
             "default-src 'self'; "
-            "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "  # unsafe-eval needed for some dev tools
+            "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
             "style-src 'self' 'unsafe-inline'; "
             "img-src 'self' data: https:; "
             "font-src 'self' https:; "
             "connect-src 'self'; "
             "frame-ancestors 'none'; "
             "base-uri 'self';"
         )
-        
-        # Prevent clickjacking
         response['X-Frame-Options'] = 'DENY'
-        
-        # Prevent MIME type sniffing
         response['X-Content-Type-Options'] = 'nosniff'
-        
-        # Enable XSS protection
         response['X-XSS-Protection'] = '1; mode=block'
-        
-        # Prevent referrer leakage
         response['Referrer-Policy'] = 'strict-origin-when-cross-origin'
-        
-        # Permissions policy
         response['Permissions-Policy'] = (
             'geolocation=(), '
             'microphone=(), '
@@ -196,5 +174,49 @@ def __call__(self, request):
             'accelerometer=(), '
             'gyroscope=()'
         )
-        
-        return response
+        return response
+
+class HoneypotMiddleware:
+    """
+    Middleware to detect and log requests to honeypot (fake) paths.
+    Normal users will never visit these paths.
+    If triggered, log the attempt and return a 404 page.
+    """
+    HONEYPOT_PATHS = [
+        "/admin-secret",
+        "/Main-admin",
+        "/superuser",
+        "/dashboard-old",
+        "/backup.sql",
+        "/db.dump",
+        "/config.php",
+        "/env.bak",
+        "/administration-login",
+        "/auth-test",
+        "/secure-login",
+        "/test-page",
+        "/debug/",
+        "/old-site/"
+    ]
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        path = request.path
+        if path in self.HONEYPOT_PATHS:
+            ip = self.get_client_ip(request)
+            ua = request.META.get("HTTP_USER_AGENT", "unknown")
+            Honeypot_logger.warning(
+                f"HONEYPOT TRIGGERED: Path={path}, IP={ip}, User-Agent={ua}"
+            )
+            return render(request, "404.html", status=404)
+        return self.get_response(request)
+
+    def get_client_ip(self, request):
+        x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
+        if x_forwarded_for:
+            ip = x_forwarded_for.split(",")[0]
+        else:
+            ip = request.META.get("REMOTE_ADDR", "")
+        return ip

core/settings.py

@@ -156,6 +156,7 @@
     # 'core.middleware.AutoLogoutMiddleware',  # TEMPORARILY DISABLED - causing OAuth redirect issues
 
     "django_user_agents.middleware.UserAgentMiddleware",
+    "core.middleware.HoneypotMiddleware",
     # "core.middleware.LogRequestMiddleware",  # TEMPORARILY DISABLED - causing OAuth redirect issues
     # "home.views.force_oauth_redirect_middleware", # DISABLED - causing redirect loops
 
@@ -529,6 +530,11 @@
             'level': 'INFO',
             'propagate': False,
         },
+        "honeypot_logger": {
+            "handlers": ["console"],
+            "level": "WARNING",
+            "propagate": False,
+        },
     },
 }
 

core/urls.py

@@ -13,6 +13,8 @@
     1. Import the include() function: from django.urls import include, path
     2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
 """
+from django.conf import settings
+from django.conf.urls.static import static
 from django.contrib import admin
 from django.conf.urls.i18n import i18n_patterns
 from django.urls import include, path
@@ -114,11 +116,16 @@
     path('', include('home.urls')),
     path("api/tip/today/", views.tip_today, name="tip_today"),
 
-
    ]
 
 
 
 urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT) + static(settings.STATIC_URL, document_root=settings.STATIC_ROOT) + static('/static/assets/', document_root=settings.BASE_DIR / 'custom_static/assets')
 
+] 
+
+# Static & media files (served by Django in dev)
+urlpatterns += static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)
+urlpatterns += static('/static/assets/', document_root=settings.BASE_DIR / 'custom_static/assets')
+urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)