Merge branch 'main' into feature/cyber-challenges-quiz-compiler-clean

Author: kri2tle

core/middleware.py

@@ -7,8 +7,12 @@
 from django.urls import reverse
 from django.conf import settings
 from django.middleware.locale import LocaleMiddleware
+from django.http import HttpResponseNotFound
 from django.utils import translation
+from django.shortcuts import render
+
 logger = logging.getLogger('admin_logout_logger')
+Honeypot_logger = logging.getLogger("honeypot_logger")
 
 class AutoLogoutMiddleware(MiddlewareMixin):
     """
@@ -149,16 +153,46 @@ def process_request(self, request):
         request.LANGUAGE_CODE = translation.get_language()
 
 
+
 class SecurityHeadersMiddleware:
     """
     Middleware to add security headers that help mitigate vulnerabilities
     in third-party JavaScript libraries and prevent common attacks.
     """
-    
+   
+# Honeypot Middleware
+
+class HoneypotMiddleware:
+    """
+    Middleware to detect and log requests to honeypot (fake) paths.
+    Normal users will never visit these paths.
+    If triggered, log the attempt and return a 404 page.
+    """
+
+    # Fake paths attackers often try
+    HONEYPOT_PATHS = [
+        "/admin-secret",
+        "/Main-admin",
+        "/superuser",
+        "/dashboard-old",
+        "/backup.sql",
+        "/db.dump",
+        "/config.php",
+        "/env.bak",
+        "/administration-login",
+        "/auth-test",
+        "/secure-login",
+        "/test-page",
+        "/debug/",
+        "/old-site/"
+    ]
+
+
     def __init__(self, get_response):
         self.get_response = get_response
 
     def __call__(self, request):
+
         response = self.get_response(request)
 
         # Content Security Policy to prevent XSS and code injection
@@ -197,4 +231,31 @@ def __call__(self, request):
             'gyroscope=()'
         )
 
-        return response
+        return response
+
+        path = request.path
+
+        # Check if the request path is in honeypot traps
+        if path in self.HONEYPOT_PATHS:
+            ip = self.get_client_ip(request)
+            ua = request.META.get("HTTP_USER_AGENT", "unknown")
+
+            Honeypot_logger.warning(
+                f"HONEYPOT TRIGGERED: Path={path}, IP={ip}, User-Agent={ua}"
+            )
+
+            # Return fake 404 so attacker doesn't know it’s a trap
+            return render(request, "404.html", status=404)
+
+        # Otherwise continue normally
+        return self.get_response(request)
+
+    def get_client_ip(self, request):
+        """Extract client IP address from headers"""
+        x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
+        if x_forwarded_for:
+            ip = x_forwarded_for.split(",")[0]
+        else:
+            ip = request.META.get("REMOTE_ADDR", "")
+        return ip
+

core/settings.py

@@ -156,6 +156,7 @@
     # 'core.middleware.AutoLogoutMiddleware',  # TEMPORARILY DISABLED - causing OAuth redirect issues
 
     "django_user_agents.middleware.UserAgentMiddleware",
+    "core.middleware.HoneypotMiddleware",
     # "core.middleware.LogRequestMiddleware",  # TEMPORARILY DISABLED - causing OAuth redirect issues
     # "home.views.force_oauth_redirect_middleware", # DISABLED - causing redirect loops
 
@@ -529,6 +530,11 @@
             'level': 'INFO',
             'propagate': False,
         },
+        "honeypot_logger": {
+            "handlers": ["console"],
+            "level": "WARNING",
+            "propagate": False,
+        },
     },
 }
 

core/urls.py

@@ -13,6 +13,8 @@
     1. Import the include() function: from django.urls import include, path
     2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
 """
+from django.conf import settings
+from django.conf.urls.static import static
 from django.contrib import admin
 from django.conf.urls.i18n import i18n_patterns
 from django.urls import include, path
@@ -115,10 +117,19 @@
     path("api/tip/today/", views.tip_today, name="tip_today"),
 
 
+
    ]
 
 
 
 urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT) + static(settings.STATIC_URL, document_root=settings.STATIC_ROOT) + static('/static/assets/', document_root=settings.BASE_DIR / 'custom_static/assets')
 
 
+
+] 
+
+# Static & media files (served by Django in dev)
+urlpatterns += static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)
+urlpatterns += static('/static/assets/', document_root=settings.BASE_DIR / 'custom_static/assets')
+urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
+