open source

backup_date.txt

@@ -1 +1 @@
-Wed Nov 27 02:09:40 AM PST 2024
+Wed Nov 27 06:22:42 PM PST 2024

backup_init_date.txt

@@ -1 +1 @@
-Wed Nov 27 02:06:07 AM PST 2024
+Wed Nov 27 06:19:51 PM PST 2024

barcode/idscan.py

@@ -32,6 +32,7 @@ def scan_id(scan_path, instance):
         return False
     result = response['ParseImageResult']
     document = result[list(result.keys())[0]]
+    if list(result.keys())[0] in settings.BANNED_ID_TYPES: return False
     exp_date = document['ExpirationDate']
     exp_date = datetime.strptime(exp_date, '%Y-%m-%d').replace(tzinfo=utc)
     if exp_date < timezone.now().date():

config/crontab

@@ -1,15 +1,3 @@
-#@reboot  /usr/bin/finishsetup
-0 4 * * 1 sudo apt-get update && sudo apt-get upgrade -y && sudo reboot
-0 0 1 * * sudo certbot renew --quiet
-#*/5 * * * * /home/team/lotteh/venv/bin/python /home/team/lotteh/routine_caption.py
-#* * * * * /home/team/lotteh/venv/bin/python /home/team/lotteh/crypto_trading.py
-#*/30 * * * * /home/team/lotteh/venv/bin/python /home/team/lotteh/process_recordings.py
-#0 */12 * * * sh -c "sudo backup" team
-#*/10 * * * * sudo systemctl start apache2
-#*/10 * * * * sudo systemctl start daphne
-#*/10 * * * * sudo systemctl start celery
-0 * * * * sudo systemctl start clamav-daemon
-#@reboot  /usr/bin/finishsetup
 0 4 * * 1 sudo apt-get update && sudo apt-get upgrade -y && sudo reboot
 0 0 1 * * sudo certbot renew --quiet
 #*/5 * * * * /home/team/lotteh/venv/bin/python /home/team/lotteh/routine_caption.py

email_list.txt

@@ -1,5 +1,3 @@
-team,jasper.camber.holton@gmail.com
-Daisy,jasper.camber.holton@gmail.com
 abtest abtest,a13148467632@gmail.com
 ZAnix,zin.bra@yandex.ru
 ABitraky,uconquallkolesa@gmail.com
@@ -48,6 +46,8 @@ sexybeauty69,jamescook312@outlook.com
 beautifulsweetheart54,mikexxxx@gmail.com
 perfectwoman92,ebojajuje04@gmail.com
 lovelybeast15,yasen.krasen.13+85607@mail.ru
+Daisy,jasper.camber.holton@gmail.com
 bustylover76,bagsikpogi4@gmail.com
 Guest821841,duqotayowud23@gmail.com
 gorgeousbeauty43,adinatanat@gmail.com
+team,jasper.camber.holton@gmail.com

feed/templatetags/app_filters.py

@@ -797,4 +797,4 @@ def cryptoformat(amount):
 
 @register.filter('replspace')
 def replspace(text):
-    return text.replace(' ', '+')
+    return str(text).replace(' ', '+')

scripts/ijson.py

@@ -0,0 +1,106 @@
+"""
+Serialize data to/from JSON
+"""
+
+import datetime
+import decimal
+import json, ijson
+import uuid
+
+from django.core.serializers.base import DeserializationError
+from django.core.serializers.python import Deserializer as PythonDeserializer
+from django.core.serializers.python import Serializer as PythonSerializer
+from django.utils.duration import duration_iso_string
+from django.utils.functional import Promise
+from django.utils.timezone import is_aware
+
+
+class Serializer(PythonSerializer):
+    """Convert a queryset to JSON."""
+
+    internal_use_only = False
+
+    def _init_options(self):
+        self._current = None
+        self.json_kwargs = self.options.copy()
+        self.json_kwargs.pop("stream", None)
+        self.json_kwargs.pop("fields", None)
+        if self.options.get("indent"):
+            # Prevent trailing spaces
+            self.json_kwargs["separators"] = (",", ": ")
+        self.json_kwargs.setdefault("cls", DjangoJSONEncoder)
+        self.json_kwargs.setdefault("ensure_ascii", False)
+
+    def start_serialization(self):
+        self._init_options()
+        self.stream.write("[")
+
+    def end_serialization(self):
+        if self.options.get("indent"):
+            self.stream.write("\n")
+        self.stream.write("]")
+        if self.options.get("indent"):
+            self.stream.write("\n")
+
+    def end_object(self, obj):
+        # self._current has the field data
+        indent = self.options.get("indent")
+        if not self.first:
+            self.stream.write(",")
+            if not indent:
+                self.stream.write(" ")
+        if indent:
+            self.stream.write("\n")
+        json.dump(self.get_dump_object(obj), self.stream, **self.json_kwargs)
+        self._current = None
+
+    def getvalue(self):
+        # Grandparent super
+        return super(PythonSerializer, self).getvalue()
+
+
+def Deserializer(stream_or_string, **options):
+    """Deserialize a stream or string of JSON data."""
+    if not isinstance(stream_or_string, (bytes, str)):
+        stream_or_string = stream_or_string.read()
+    if isinstance(stream_or_string, bytes):
+        stream_or_string = stream_or_string.decode()
+    try:
+#        with open('/home/team/lotteh/data/security.json', 'r') as f:
+        yield from PythonDeserializer(ijson.items(stream_or_string, 'item'), **options)
+    except (GeneratorExit, DeserializationError):
+        raise
+    except Exception as exc:
+        raise DeserializationError() from exc
+
+
+class DjangoJSONEncoder(json.JSONEncoder):
+    """
+    JSONEncoder subclass that knows how to encode date/time, decimal types, and
+    UUIDs.
+    """
+
+    def default(self, o):
+        # See "Date Time String Format" in the ECMA-262 specification.
+        if isinstance(o, datetime.datetime):
+            r = o.isoformat()
+            if o.microsecond:
+                r = r[:23] + r[26:]
+            if r.endswith("+00:00"):
+                r = r.removesuffix("+00:00") + "Z"
+            return r
+        elif isinstance(o, datetime.date):
+            return o.isoformat()
+        elif isinstance(o, datetime.time):
+            if is_aware(o):
+                raise ValueError("JSON can't represent timezone-aware times.")
+            r = o.isoformat()
+            if o.microsecond:
+                r = r[:12]
+            return r
+        elif isinstance(o, datetime.timedelta):
+            return duration_iso_string(o)
+        elif isinstance(o, (decimal.Decimal, uuid.UUID, Promise)):
+            return str(o)
+        else:
+            return super().default(o)

scripts/json.py

@@ -4,7 +4,7 @@
 
 import datetime
 import decimal
-import json
+import json, ijson
 import uuid
 
 from django.core.serializers.base import DeserializationError
@@ -61,13 +61,13 @@ def getvalue(self):
 
 def Deserializer(stream_or_string, **options):
     """Deserialize a stream or string of JSON data."""
-    if not isinstance(stream_or_string, (bytes, str)):
-        stream_or_string = stream_or_string.read()
-    if isinstance(stream_or_string, bytes):
-        stream_or_string = stream_or_string.decode()
+#    if not isinstance(stream_or_string, (bytes, str)):
+#        stream_or_string = stream_or_string.read()
+#    if isinstance(stream_or_string, bytes):
+#        stream_or_string = stream_or_string.decode()
     try:
-        objects = json.loads(stream_or_string)
-        yield from PythonDeserializer(objects, **options)
+        with open('/home/team/lotteh/data/security.json', 'r') as f:
+            yield from PythonDeserializer(ijson.items(f, 'item'), **options)
     except (GeneratorExit, DeserializationError):
         raise
     except Exception as exc:

scripts/setup

@@ -260,8 +260,9 @@ PYTHON_VERSION="3.12"
 cp scripts/content.py /home/team/lotteh/venv/lib/python$PYTHON_VERSION/site-packages/pyxb/binding/content.py
 cp scripts/pwa_webpush_forms.py /home/team/lotteh/venv/lib/python$PYTHON_VERSION/site-packages/pwa_webpush/forms.py
 cp scripts/webauth_views.py /home/team/lotteh/venv/lib/python$PYTHON_VERSION/site-packages/webauth/views.py
-cp scripts/serializers_json_lowmem.py venv/lib/python$PYTHON_VERSION/site-packages/
-#cp scripts/json.py venv/lib/python$PYTHON_VERSION/site-packages/django/core/serializers/json.py
+#cp scripts/serializers_json_lowmem.py venv/lib/python$PYTHON_VERSION/site-packages/django/core/serializers/json.py
+cp venv/lib/python$PYTHON_VERSION/site-packages/django/core/serializers/json.py scripts/json.py
+#cp scripts/serializers_json_lowmem.py venv/lib/python$PYTHON_VERSION/site-packages/django/core/serializers/json.py
 cp scripts/nude.py venv/lib/python$PYTHON_VERSION/site-packages/nude.py
 # Set user settings
 sudo gpasswd -a www-data users
@@ -372,6 +373,8 @@ cat db.json.?? > db.json
 echo "Loading data, this may take a while"
 python manage.py loaddata db.json
 ./scripts/loadtables
+# Fix venv again
+cp scripts/serializers_json_lowmem.py venv/lib/python$PYTHON_VERSION/site-packages/django/core/serializers/json.py
 sudo systemctl start apache2 daphne celery celerybeat
 echo "Setup crontab/sudoers configuration"
 sudo crontab -l -u root | cat - config/crontab | sudo crontab -u root -

scripts/webauth_views.py

@@ -80,7 +80,7 @@ def post(self, request, *args, **kwargs):
         pub_key_credential = json.dumps(data.get("pubKeyCredential"))
 
         verification = verify_registration_response(
-            credential=RegistrationCredential.parse_raw(pub_key_credential),
+            credential=pub_key_credential,
             expected_challenge=challenge,
             expected_origin=settings.WEBAUTH_ORIGIN,
             expected_rp_id=settings.WEBAUTH_RP_ID,
@@ -124,6 +124,7 @@ def get(self, request, *args, **kwargs):
                                 "usb",
                                 "ble",
                                 "nfc",
+                                "internal",
                             ],
                         }
                         for credential_id in credential_ids
@@ -136,18 +137,27 @@ def get(self, request, *args, **kwargs):
     def post(self, request, *args, **kwargs):
         challenge = bytes.fromhex(request.session.pop("webauth_challenge"))
 
-        credential = AuthenticationCredential.parse_raw(request.body.decode())
-        device = WebAuthDevice.objects.get(credential_id=credential.raw_id)
-
-        verification = verify_authentication_response(
-            credential=credential,
-            expected_challenge=challenge,
-            expected_rp_id=settings.WEBAUTH_RP_ID,
-            expected_origin=settings.WEBAUTH_ORIGIN,
-            credential_public_key=device.public_key,
-            credential_current_sign_count=device.sign_count,
-            require_user_verification=False,
-        )
+        credential = request.body.decode()
+        c = json.loads(credential)
+        print(json.dumps(c))
+        devices = WebAuthDevice.objects.filter(user=request.user)
+#credential_id=c['rawId'].encode())
+        verification = None
+        for device in devices:
+            try:
+                verification = verify_authentication_response(
+                    credential=credential,
+                    expected_challenge=challenge,
+                    expected_rp_id=settings.WEBAUTH_RP_ID,
+                    expected_origin=settings.WEBAUTH_ORIGIN,
+                    credential_public_key=device.public_key,
+                    credential_current_sign_count=device.sign_count,
+                    require_user_verification=False,
+                )
+                break
+            except:
+                pass
+        if not verification: raise Exception('No valid devices with this credential')
 
         device.sign_count = verification.new_sign_count
         device.save()

users/middleware.py

@@ -3,6 +3,7 @@
 from django.shortcuts import get_object_or_404
 from django.contrib import messages
 from users.models import Profile
+from security.models import SecurityProfile
 from django.shortcuts import redirect
 from django.urls import reverse
 import urllib, json
@@ -84,6 +85,8 @@ def middleware(request):
             if request.user.is_authenticated and (request.user.profile.enable_two_factor_authentication or request.user.profile.vendor) and not request.path.startswith('/accounts/tfa/') and not request.path.startswith('/accounts/logout/') and not request.path.startswith("/face/") and not request.path.startswith("/verify/"):
                 if not request.user.profile.phone_number or len(request.user.profile.phone_number) < 11:
                     return HttpResponseRedirect(reverse('users:tfa_onboarding'))
+            if not hasattr(request.user, 'profile'): Profile.objects.create(user=request.user)
+            if not hasattr(request.user, 'security_profile'): SecurityProfile.objects.create(user=request.user)
             response = get_response(request)
             if request.COOKIES.get('user_signup', False):
                 request.user_signup = True