Merge branch 'main' into feature/cyber-challenges-quiz-compiler-clean

Author: kri2tle

core/middleware.py

@@ -7,8 +7,12 @@
 from django.urls import reverse
 from django.conf import settings
 from django.middleware.locale import LocaleMiddleware
+from django.http import HttpResponseNotFound
 from django.utils import translation
+from django.shortcuts import render
+
 logger = logging.getLogger('admin_logout_logger')
+Honeypot_logger = logging.getLogger("honeypot_logger")
 
 class AutoLogoutMiddleware(MiddlewareMixin):
     """
@@ -27,9 +31,6 @@ def process_request(self, request):
                     request.session['admin_session'] = True
 
 
-
-
-
 class LogRequestMiddleware:
     """
     Middleware to log IP address and accessed URL.
@@ -39,18 +40,15 @@ def __init__(self, get_response):
         self.get_response = get_response
 
     def __call__(self, request):
-        # Process the request
         response = self.get_response(request)
 
-        # Log the IP and page accessed
         if request.user.is_authenticated:
             session_ip = request.session.get('ip_address')
             session_ua = request.session.get('user_agent')
             session_token = request.session.get('session_token')
             current_ip = self.get_client_ip(request)
             current_ua = request.META.get('HTTP_USER_AGENT')
 
-            # Skip hijacking checks for OAuth authentication paths to prevent redirect loops
             is_oauth_path = (
                 request.path.startswith('/complete/') or 
                 request.path.startswith('/oauth/') or
@@ -59,60 +57,38 @@ def __call__(self, request):
                 'complete' in request.path or
                 'azuread' in request.path
             )
-            
-            # Check if user was authenticated via OAuth
             is_oauth_user = request.session.get('oauth_authenticated', False)
-            
-            # Check if this is a social auth completion
             is_social_auth = 'social' in request.path or 'complete' in request.path
-            
-            # If this is an OAuth path, dashboard, OAuth user, or social auth, set session data instead of checking
+
             if is_oauth_path or is_oauth_user or is_social_auth:
-                # Set session data for OAuth users to prevent future hijacking checks
                 request.session['ip_address'] = current_ip
                 request.session['user_agent'] = current_ua
                 request.session['session_token'] = request.session.session_key
                 logger.info(f"OAuth/social auth path/user detected - setting session data for user {request.user.email}")
             else:
-                # Only perform hijacking checks for non-OAuth paths
-                # Check for IP address mismatch
                 if session_ip and session_ip != current_ip:
                     logger.warning(f"Session IP mismatch! Session IP: {session_ip}, Current IP: {current_ip}")
                     request.session.flush()
-                    return redirect('login')  # Redirect to login
+                    return redirect('login')
 
-                # Check for User-Agent mismatch
                 if session_ua and session_ua != current_ua:
                     logger.warning(f"Session UA mismatch! Session UA: {session_ua}, Current UA: {current_ua}")
                     request.session.flush()
                     return redirect('login')
 
-                # Check for session token mismatch
                 if session_token and session_token != request.session.session_key:
                     logger.warning(f"Session token mismatch! Session token: {session_token}, Current session ID: {request.session.session_key}")
                     request.session.flush()
                     return redirect('login')
-
-        # Log the IP and accessed URL if no hijacking is detected
         self.log_request(request)
-
         return response
 
-        # Continue processing the request
-        return self.get_response(request)
-    
-
-
     def log_request(self, request):
         ip = self.get_client_ip(request)
         path = request.path
-
-        # Log the information
         logger.info(f"IP: {ip} accessed {path}")
+
     def get_client_ip(self, request):
-        """
-        Extracts client IP address from request headers.
-        """
         x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
         if x_forwarded_for:
             ip = x_forwarded_for.split(',')[0]
@@ -121,8 +97,6 @@ def get_client_ip(self, request):
         return ip   
 
 
-
-        
 try:
     from django.utils.translation import LANGUAGE_SESSION_KEY  # Django 4+
 except Exception:
@@ -134,15 +108,13 @@ class LocaleMiddlewareDefaultEnglish(LocaleMiddleware):
     2) If neither exists => Ignore the browser's Accept-Language setting and force settings.LANGUAGE_CODE (English)
     """
     def process_request(self, request):
-        # check cookie/session
         cookie_name = getattr(settings, "LANGUAGE_COOKIE_NAME", "django_language")
         lang = request.COOKIES.get(cookie_name)
 
         if not lang and hasattr(request, "session"):
             lang = request.session.get(LANGUAGE_SESSION_KEY)
 
         if not lang:
-            # No user selection => Force default to English, ignore Accept-Language
             lang = settings.LANGUAGE_CODE
 
         translation.activate(lang)
@@ -154,38 +126,25 @@ class SecurityHeadersMiddleware:
     Middleware to add security headers that help mitigate vulnerabilities
     in third-party JavaScript libraries and prevent common attacks.
     """
-    
     def __init__(self, get_response):
         self.get_response = get_response
 
     def __call__(self, request):
         response = self.get_response(request)
-        
-        # Content Security Policy to prevent XSS and code injection
         response['Content-Security-Policy'] = (
             "default-src 'self'; "
-            "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "  # unsafe-eval needed for some dev tools
+            "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
             "style-src 'self' 'unsafe-inline'; "
             "img-src 'self' data: https:; "
             "font-src 'self' https:; "
             "connect-src 'self'; "
             "frame-ancestors 'none'; "
             "base-uri 'self';"
         )
-        
-        # Prevent clickjacking
         response['X-Frame-Options'] = 'DENY'
-        
-        # Prevent MIME type sniffing
         response['X-Content-Type-Options'] = 'nosniff'
-        
-        # Enable XSS protection
         response['X-XSS-Protection'] = '1; mode=block'
-        
-        # Prevent referrer leakage
         response['Referrer-Policy'] = 'strict-origin-when-cross-origin'
-        
-        # Permissions policy
         response['Permissions-Policy'] = (
             'geolocation=(), '
             'microphone=(), '
@@ -196,5 +155,51 @@ def __call__(self, request):
             'accelerometer=(), '
             'gyroscope=()'
         )
-        
-        return response
+        return response
+
+class HoneypotMiddleware:
+    """
+    Middleware to detect and log requests to honeypot (fake) paths.
+    Normal users will never visit these paths.
+    If triggered, log the attempt and return a 404 page.
+    """
+    HONEYPOT_PATHS = [
+        "/admin-secret",
+        "/Main-admin",
+        "/superuser",
+        "/dashboard-old",
+        "/backup.sql",
+        "/db.dump",
+        "/config.php",
+        "/env.bak",
+        "/administration-login",
+        "/auth-test",
+        "/secure-login",
+        "/test-page",
+        "/debug/",
+        "/old-site/"
+    ]
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        path = request.path
+
+        if path in self.HONEYPOT_PATHS:
+            ip = self.get_client_ip(request)
+            ua = request.META.get("HTTP_USER_AGENT", "unknown")
+            Honeypot_logger.warning(
+                f"HONEYPOT TRIGGERED: Path={path}, IP={ip}, User-Agent={ua}"
+            )
+            return render(request, "404.html", status=404)
+
+        return self.get_response(request)
+
+    def get_client_ip(self, request):
+        x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
+        if x_forwarded_for:
+            ip = x_forwarded_for.split(",")[0]
+        else:
+            ip = request.META.get("REMOTE_ADDR", "")
+        return ip

core/settings.py

@@ -156,6 +156,7 @@
     # 'core.middleware.AutoLogoutMiddleware',  # TEMPORARILY DISABLED - causing OAuth redirect issues
 
     "django_user_agents.middleware.UserAgentMiddleware",
+    "core.middleware.HoneypotMiddleware",
     # "core.middleware.LogRequestMiddleware",  # TEMPORARILY DISABLED - causing OAuth redirect issues
     # "home.views.force_oauth_redirect_middleware", # DISABLED - causing redirect loops
 
@@ -529,6 +530,11 @@
             'level': 'INFO',
             'propagate': False,
         },
+        "honeypot_logger": {
+            "handlers": ["console"],
+            "level": "WARNING",
+            "propagate": False,
+        },
     },
 }
 

core/urls.py

@@ -13,26 +13,20 @@
     1. Import the include() function: from django.urls import include, path
     2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
 """
+from django.conf import settings
+from django.conf.urls.static import static
 from django.contrib import admin
 from django.conf.urls.i18n import i18n_patterns
-from django.urls import include, path
-from django.conf.urls.static import static
-from django.conf import settings
+from django.urls import include, path, re_path
 from django.contrib.auth import views as auth_views
-from django.conf import settings
-from django.conf.urls.static import static
 from home import views
 from rest_framework import permissions
 from home.views_securitytxt import security_txt
 from drf_yasg.views import get_schema_view
 from drf_yasg import openapi
-from django.urls import path, re_path
-from .admin import admin_statistics_view
-from home.views_securitytxt import security_txt
+from .admin import admin_statistics_view, admin_dashboard
 from home.views_robotstxt import robots_txt
 
-from .admin import admin_dashboard
-
 handler404 = 'home.views.error_404_view'
 schema_view = get_schema_view(
     openapi.Info(
@@ -69,15 +63,15 @@
     # blog
     path('blog/', views.blog, name='blog'),
     path('tinymce/', include('tinymce.urls')),
-# Custom Microsoft OAuth login and callback
-path('oauth/login/', views.microsoft_oauth_login, name='microsoft_oauth_login'),
-path('oauth/callback/', views.microsoft_oauth_callback, name='microsoft_oauth_callback'),
-# Override the social_django complete URL to use our custom handler (MUST be before social_django URLs)
-path('complete/azuread-tenant-oauth2/', views.microsoft_oauth_callback, name='microsoft_oauth_callback_override'),
-# Custom OAuth completion view for other backends
-path('complete/<str:backend>/', views.oauth_complete_redirect, name='oauth_complete_redirect'),
-# Python Social Auth URLs (Microsoft OAuth implementation)
-path('', include(('social_django.urls', 'social_django'), namespace='social')),
+    # Custom Microsoft OAuth login and callback
+    path('oauth/login/', views.microsoft_oauth_login, name='microsoft_oauth_login'),
+    path('oauth/callback/', views.microsoft_oauth_callback, name='microsoft_oauth_callback'),
+    # Override the social_django complete URL to use our custom handler (MUST be before social_django URLs)
+    path('complete/azuread-tenant-oauth2/', views.microsoft_oauth_callback, name='microsoft_oauth_callback_override'),
+    # Custom OAuth completion view for other backends
+    path('complete/<str:backend>/', views.oauth_complete_redirect, name='oauth_complete_redirect'),
+    # Python Social Auth URLs (Microsoft OAuth implementation)
+    path('', include(('social_django.urls', 'social_django'), namespace='social')),
 
     path("verifyEmail/", views.VerifyOTP, name="verifyEmail"),
     path("test-login/", views.test_login, name="test_login"),
@@ -88,37 +82,5 @@
     path('accounts/logout/', views.logout_view, name='logout'),
     path('accounts/register/', views.register, name='register'),
     path('accounts/registerclient/', views.register_client, name='register_client'),
-    path('accounts/password-gen/', views.password_gen, name='password_gen'),
-    path('accounts/password-change/', views.UserPasswordChangeView.as_view(), name='password_change'),
-    path('accounts/password-change-done/', auth_views.PasswordChangeDoneView.as_view(
-        template_name = 'accounts/password_change_done.html'
-    ), name='password_change_done'),
-    path('accounts/password-reset/', views.UserPasswordResetView.as_view(), name='password_reset'),
-    path('accounts/password-reset-done/', auth_views.PasswordResetDoneView.as_view(
-        template_name='accounts/password_reset_done.html'
-    ), name='password_reset_done'),
-    path('accounts/password-reset-confirm/<uidb64>/<token>/', 
-       views.UserPasswordResetConfirmView.as_view(), name='password_reset_confirm'),
-    path('accounts/password-reset-complete/', auth_views.PasswordResetCompleteView.as_view(
-        template_name='accounts/password_reset_complete.html'
-    ), name='password_reset_complete'),
-    path('comphrensive-report', views.comphrehensive_reports, name='comphrehensive_report'),
-    path('pen-testing', views.pen_testing, name='pen-testing'),
-    path('secure-code-review', views.secure_code_review, name='secure-code-review'),
-    path('dashboard/', views.dashboard, name='dashboard'),
-    path('update_progress/<int:progress_id>/', views.update_progress, name='update_progress'),
-    re_path(r'^swagger(?P<format>\.json|\.yaml)$', schema_view.without_ui(cache_timeout=0), name='schema-json'),
-    path('swagger/', schema_view.with_ui('swagger', cache_timeout=0), name='schema-swagger-ui'),
-    path('redoc/', schema_view.with_ui('redoc', cache_timeout=0), name='schema-redoc'),
-    path('i18n/', include('django.conf.urls.i18n')),
-    path('', include('home.urls')),
-    path("api/tip/today/", views.tip_today, name="tip_today"),
-
-
-   ]
-
-   
-
-urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT) + static(settings.STATIC_URL, document_root=settings.STATIC_ROOT) + static('/static/assets/', document_root=settings.BASE_DIR / 'custom_static/assets')
-
-
+    path('accounts/password-gen/', views.password_gen, name](#)
+