Merge branch 'main' into feature/cyber-challenges-quiz-compiler-clean

Author: kri2tle

core/middleware.py

@@ -1,191 +1,27 @@
-import logging
-from django.utils.timezone import now
-from django.shortcuts import redirect
-
-from django.contrib.auth import logout
-from django.utils.deprecation import MiddlewareMixin
-from django.urls import reverse
-from django.conf import settings
-from django.middleware.locale import LocaleMiddleware
-from django.utils import translation
-logger = logging.getLogger('admin_logout_logger')
-
-class AutoLogoutMiddleware(MiddlewareMixin):
-    """
-    Middleware to log out users (except superusers) when they leave the admin area.
-    """
-    def process_request(self, request):
-        user = request.user
-        if user.is_authenticated:
-            is_admin_page = request.path.startswith('/admin')
-            if not user.is_superuser:
-                if not is_admin_page and request.session.get('admin_session'):
-                    logout(request)
-                    request.session.pop('admin_session', None)
-                    logger.info(f"User {user.username} has been logged out after leaving the admin area.")
-                elif is_admin_page:
-                    request.session['admin_session'] = True
-
-
-
-
-
-class LogRequestMiddleware:
-    """
-    Middleware to log IP address and accessed URL.
-    """
-
-    def __init__(self, get_response):
-        self.get_response = get_response
-
-    def __call__(self, request):
-        # Process the request
-        response = self.get_response(request)
-
-        # Log the IP and page accessed
-        if request.user.is_authenticated:
-            session_ip = request.session.get('ip_address')
-            session_ua = request.session.get('user_agent')
-            session_token = request.session.get('session_token')
-            current_ip = self.get_client_ip(request)
-            current_ua = request.META.get('HTTP_USER_AGENT')
-
-            # Skip hijacking checks for OAuth authentication paths to prevent redirect loops
-            is_oauth_path = (
-                request.path.startswith('/complete/') or 
-                request.path.startswith('/oauth/') or
-                request.path == '/dashboard/' or
-                'oauth' in request.path or
-                'complete' in request.path or
-                'azuread' in request.path
-            )
-            
-            # Check if user was authenticated via OAuth
-            is_oauth_user = request.session.get('oauth_authenticated', False)
-            
-            # Check if this is a social auth completion
-            is_social_auth = 'social' in request.path or 'complete' in request.path
-            
-            # If this is an OAuth path, dashboard, OAuth user, or social auth, set session data instead of checking
-            if is_oauth_path or is_oauth_user or is_social_auth:
-                # Set session data for OAuth users to prevent future hijacking checks
-                request.session['ip_address'] = current_ip
-                request.session['user_agent'] = current_ua
-                request.session['session_token'] = request.session.session_key
-                logger.info(f"OAuth/social auth path/user detected - setting session data for user {request.user.email}")
-            else:
-                # Only perform hijacking checks for non-OAuth paths
-                # Check for IP address mismatch
-                if session_ip and session_ip != current_ip:
-                    logger.warning(f"Session IP mismatch! Session IP: {session_ip}, Current IP: {current_ip}")
-                    request.session.flush()
-                    return redirect('login')  # Redirect to login
-
-                # Check for User-Agent mismatch
-                if session_ua and session_ua != current_ua:
-                    logger.warning(f"Session UA mismatch! Session UA: {session_ua}, Current UA: {current_ua}")
-                    request.session.flush()
-                    return redirect('login')
-
-                # Check for session token mismatch
-                if session_token and session_token != request.session.session_key:
-                    logger.warning(f"Session token mismatch! Session token: {session_token}, Current session ID: {request.session.session_key}")
-                    request.session.flush()
-                    return redirect('login')
-
-        # Log the IP and accessed URL if no hijacking is detected
-        self.log_request(request)
-
-        return response
-
-        # Continue processing the request
-        return self.get_response(request)
-    
-
-
-    def log_request(self, request):
-        ip = self.get_client_ip(request)
-        path = request.path
-
-        # Log the information
-        logger.info(f"IP: {ip} accessed {path}")
-    def get_client_ip(self, request):
-        """
-        Extracts client IP address from request headers.
-        """
-        x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
-        if x_forwarded_for:
-            ip = x_forwarded_for.split(',')[0]
-        else:
-            ip = request.META.get('REMOTE_ADDR')
-        return ip   
-
-
-
-        
-try:
-    from django.utils.translation import LANGUAGE_SESSION_KEY  # Django 4+
-except Exception:
-    LANGUAGE_SESSION_KEY = 'django_language'
-
-class LocaleMiddlewareDefaultEnglish(LocaleMiddleware):
-    """
-    1) If a language cookie or session exists => Respect the user's selected language
-    2) If neither exists => Ignore the browser's Accept-Language setting and force settings.LANGUAGE_CODE (English)
-    """
-    def process_request(self, request):
-        # check cookie/session
-        cookie_name = getattr(settings, "LANGUAGE_COOKIE_NAME", "django_language")
-        lang = request.COOKIES.get(cookie_name)
-
-        if not lang and hasattr(request, "session"):
-            lang = request.session.get(LANGUAGE_SESSION_KEY)
-
-        if not lang:
-            # No user selection => Force default to English, ignore Accept-Language
-            lang = settings.LANGUAGE_CODE
-
-        translation.activate(lang)
-        request.LANGUAGE_CODE = translation.get_language()
-
-
 class SecurityHeadersMiddleware:
     """
     Middleware to add security headers that help mitigate vulnerabilities
     in third-party JavaScript libraries and prevent common attacks.
     """
-    
     def __init__(self, get_response):
         self.get_response = get_response
 
     def __call__(self, request):
         response = self.get_response(request)
-        
-        # Content Security Policy to prevent XSS and code injection
         response['Content-Security-Policy'] = (
             "default-src 'self'; "
-            "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "  # unsafe-eval needed for some dev tools
+            "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
             "style-src 'self' 'unsafe-inline'; "
             "img-src 'self' data: https:; "
             "font-src 'self' https:; "
             "connect-src 'self'; "
             "frame-ancestors 'none'; "
             "base-uri 'self';"
         )
-        
-        # Prevent clickjacking
         response['X-Frame-Options'] = 'DENY'
-        
-        # Prevent MIME type sniffing
         response['X-Content-Type-Options'] = 'nosniff'
-        
-        # Enable XSS protection
         response['X-XSS-Protection'] = '1; mode=block'
-        
-        # Prevent referrer leakage
         response['Referrer-Policy'] = 'strict-origin-when-cross-origin'
-        
-        # Permissions policy
         response['Permissions-Policy'] = (
             'geolocation=(), '
             'microphone=(), '
@@ -196,5 +32,49 @@ def __call__(self, request):
             'accelerometer=(), '
             'gyroscope=()'
         )
-        
-        return response
+        return response
+
+class HoneypotMiddleware:
+    """
+    Middleware to detect and log requests to honeypot (fake) paths.
+    Normal users will never visit these paths.
+    If triggered, log the attempt and return a 404 page.
+    """
+    HONEYPOT_PATHS = [
+        "/admin-secret",
+        "/Main-admin",
+        "/superuser",
+        "/dashboard-old",
+        "/backup.sql",
+        "/db.dump",
+        "/config.php",
+        "/env.bak",
+        "/administration-login",
+        "/auth-test",
+        "/secure-login",
+        "/test-page",
+        "/debug/",
+        "/old-site/"
+    ]
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        path = request.path
+        if path in self.HONEYPOT_PATHS:
+            ip = self.get_client_ip(request)
+            ua = request.META.get("HTTP_USER_AGENT", "unknown")
+            Honeypot_logger.warning(
+                f"HONEYPOT TRIGGERED: Path={path}, IP={ip}, User-Agent={ua}"
+            )
+            return render(request, "404.html", status=404)
+        return self.get_response(request)
+
+    def get_client_ip(self, request):
+        x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
+        if x_forwarded_for:
+            ip = x_forwarded_for.split(",")[0]
+        else:
+            ip = request.META.get("REMOTE_ADDR", "")
+        return ip

core/settings.py

@@ -156,6 +156,7 @@
     # 'core.middleware.AutoLogoutMiddleware',  # TEMPORARILY DISABLED - causing OAuth redirect issues
 
     "django_user_agents.middleware.UserAgentMiddleware",
+    "core.middleware.HoneypotMiddleware",
     # "core.middleware.LogRequestMiddleware",  # TEMPORARILY DISABLED - causing OAuth redirect issues
     # "home.views.force_oauth_redirect_middleware", # DISABLED - causing redirect loops
 
@@ -529,6 +530,11 @@
             'level': 'INFO',
             'propagate': False,
         },
+        "honeypot_logger": {
+            "handlers": ["console"],
+            "level": "WARNING",
+            "propagate": False,
+        },
     },
 }
 

core/urls.py

@@ -13,6 +13,8 @@
     1. Import the include() function: from django.urls import include, path
     2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
 """
+from django.conf import settings
+from django.conf.urls.static import static
 from django.contrib import admin
 from django.conf.urls.i18n import i18n_patterns
 from django.urls import include, path
@@ -121,4 +123,9 @@
 
 urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT) + static(settings.STATIC_URL, document_root=settings.STATIC_ROOT) + static('/static/assets/', document_root=settings.BASE_DIR / 'custom_static/assets')
 
+] 
 
+# Static & media files (served by Django in dev)
+urlpatterns += static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)
+urlpatterns += static('/static/assets/', document_root=settings.BASE_DIR / 'custom_static/assets')
+urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)