From e4aa5c6e6e8e33556d52d21bc7ddd9531d0ac5c1 Mon Sep 17 00:00:00 2001 From: Danielle McLean Date: Sat, 23 Jun 2018 13:43:15 +1000 Subject: [PATCH] Loosen the checks on IndieAuth parameters so that generic OAuth 2.0 clients like Paw.app can be used --- lemonauth/views/indie.py | 7 +++---- lemonauth/views/token.py | 4 ++-- lemoncurry.paw | Bin 20309 -> 25996 bytes 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/lemonauth/views/indie.py b/lemonauth/views/indie.py index e1c7c28..1a80454 100644 --- a/lemonauth/views/indie.py +++ b/lemonauth/views/indie.py @@ -29,7 +29,7 @@ def canonical(url): @method_decorator(csrf_exempt, name='dispatch') class IndieView(TemplateView): template_name = 'lemonauth/indie.html' - required_params = ('me', 'client_id', 'redirect_uri') + required_params = ('client_id', 'redirect_uri') @method_decorator(login_required) @method_decorator(render_to(template_name)) @@ -43,9 +43,8 @@ class IndieView(TemplateView): 'parameter {0} is required'.format(param) ) - me = canonical(params['me']) - user = urljoin(utils.origin(request), request.user.url) - if user != me: + me = request.user.full_url + if 'me' in params and me != canonical(params['me']): return utils.forbid( 'you are logged in but not as {0}'.format(me) ) diff --git a/lemonauth/views/token.py b/lemonauth/views/token.py index 9178d3e..72543f0 100644 --- a/lemonauth/views/token.py +++ b/lemonauth/views/token.py @@ -34,12 +34,12 @@ class TokenView(View): return utils.bad_req( 'this endpoint only supports response_type=code' ) - if code.client_id != post.get('client_id'): + if 'client_id' in post and code.client_id != post['client_id']: return utils.forbid('client id did not match') if code.redirect_uri != post.get('redirect_uri'): return utils.forbid('redirect uri did not match') - if code.me != post.get('me'): + if 'me' in post and code.me != post['me']: return utils.forbid('me did not match') return utils.choose_type(req, { diff --git a/lemoncurry.paw b/lemoncurry.paw index 1a5de7a19bd39153d88546d8c03bc2d8d9f27df5..f6706f7ff7ac0c7d9ac3efaa90184d284304943d 100644 GIT binary patch delta 12212 zcmd6Nd3+Pq`u90AlY{_5*g`_WR>;;6$TCT0XlR=@tu0MxO3S`EnM|NkTId4EmQzG8 zB8nKV3%Id}h>8m?h^XMMCb);?2kKCHjK-za!;GeNpxum1f`PKh$+Tek(VEev^4?>nw+A9MYg(TetYr z3(+Ffh|WffQ4{Jw%h5WNMg*OQHls_>rRZ{WExHcvLN}tD&@Je8bT_&O9YIIY!{`z8 z1UiPELm!|I(MRZG^eOrbeU83C-=cq^U(l}@V-@a;`(qs*g7w&phvU(B9CqRH*n_<| zh&f!0OK>EOr{G#V70w@hFkFpoW>jQMtlk0iZ8=g;azw)-ivR+x8uk0 z6ZlDd3_pXP#mDg}{3?DEe~kZ$Kf|BnZ}7MHU-%aaQ!45Vsvk9g(o-X-k<=KL%(I>JI8o z>L7I=^#JuG^%V6qb&Pt3Izhcmy-s~deMEgieM)^r{XqRp>*xXWV0s9xr-#yJx`4LQ z9@fzLCC@K0x0?-%B5+AElq9pP^6DFVQd4Z_w}2AJSjb-_YOFKhXc8e_UotRkIc6SSi1L!6{wfo@2qPCF!;o7D=m3PpFKmFOHYmRNS8)o2Z|5<4lJzFcVPklLmv zTb2lo%_kKTbfOJA(O5K;7)f7ZJBiLme?uG51(}x_i)tg{B_`s? zeq$5bx>NozdzL|$Ezk{`QXlJR7ZOcUq)}{dY-tu+&)J1C=x(%l8Q4fmdO@AjkfTp0kh=;JGi1=njV^gJNV9)lP;qOKFqv$Sl5Z#9k z5kCo#;4X9+J%Ao09O21CQkc0!JtqAq+OPwSAqLsnG6|oQZEGWD*|zfeGxFz7GAj4^ z^JvR$x@jmd(E1;GT%2E7TNi%+I_7whIYSAv&Pu0)az21Q;9 z`U8oKyI@$Yv~p=vquAJ9E;KbI1aa}SsnLRoo^b_YQ=`<}UL7fzxVoVGrm3Xc?RTeK zf?M#qSYF~?yeGlC#H2eVqyj0oL?6`1vs*ebR6 zgzA&n1n1)fSCZx3E|&GOEGmYPx&vI&=v^ouT5 z41niSo`6dXq__mQEtw1^6mtNkF=8OWbAC_CbDL~CziuZ`Dz;U9> zD?6PHNRlg&N+n$aFTzhE$oc%4(%#nI1>jwwT^=O!j$!2FT6x~y$T`izl16d59GeTq z6=W^b=ekdXvk zoJR<{f=R(ErFb$ft2zz57VuJf4brRzW7Pbn_?G5M1t09Z76}Sv1a(n?)FG6hZ&Lwyt9)#j} zFyzlEq>jX9M`Jb8ISTE&5-1*ujVQVU8%XUAJdDI4uUs_V*oa5SiDWn#m`fxDXvFVKVAk(smMTZyYl6hMseIn-uqPcv61djBlJg$T!`CNWjDZZ4L zWIb+hq&4%!xFHK5F=96vzd$#Z4|q5+3Bk-81fH^@TLA8`k}K(!5`xFeCRveRFaR6! znYIi8nXQj!CEm*f*3CAa8!cC0@kx>Jb&>w@S3FCr_tgoK}W zNvxOvG-pg67s$$1R0YgQWixf++UFO3tmdbAGoQ12=_2g zJMKXBs2$9+kep2la>K90t9!~~yaul&i%26WRAd(>vN?>XKj}x9oH@>uv31E_kY@M- zP_1|qVB4&qS`4U~vUsKqQsQ>bCK-i1;I^^pKdynx@fD~+(U8rgjreldw&82Llq0@I zQI0LU@OAilyn`$y%SbCJoV8qNZIs1zTNdpNvPc|F^f{zA$w&tfbn%AY&P2r?(D zGVvXXio|!~0|5VSd=E_E6uvL7BJo4=l(N61opiv|mXj4Qxni;sj+}}-N11LH6*3(I zrzlQ%8l3R-z|S;2obWt8fu<=OSWVXEIq(90sha~YlQlWxzxF2*yp`nvOxpl5@%5$okB9v)=d} zmgOw|9tx!mP$=Qk_$P86IUk5Q&up0XYnBj0fe=b%1O%WINt-7G1(Nm#N`p>OS_R=o zKzBhF+nk8BTxx1rx&-7y7b_?opnBTu%v*^XL=8qWWO+?4BwI*%7agdf)G$S7Q%2C) zn|D$s%1kaI7n8y{QuFf0)|Te%U1db0WXqjFs4mA-W94%_>61IRgXpFlRH1_J60#N0 z^@CNMg9K47vwrwhJs`1^AI(%4nju$oGnC?}(4T7?Y7$jUm5|HG-^t}&j-<+D-dV`7 zE?!cVGMs#ILrs=HHm`ScAR{;yQDHbj! z+rip7US6$S%klD~5z}Q}QcyDX0WM{uB;s3mBYV)1Lqj=aT}Qf)me8>*e^AlH%W zbJJQWPa|L2P;35VWg=U-lUlD>c_-PG(6vqo+A@Wr!$1$oGMm z_Xh%;tWQB(BqR=Wiq8i!FX-{|nPvSIZ4v)(${UXqNJ;@gaCs6b5P^{7UA$a41O?WU z3MSlM$;;*nk;(s7i2QYNlk~GJ$3immaRHFHqBj9)EdgrKBL=yYC+T;4l=S)E)HV_; zL1_mN{ZKoAvQ5JL1<>|>Uh?w^P73&WxnNRin=w4k3xX(s?&UyCE(LTTf5LutbWJuXn{iDVKA2{tL_%80Rk4z#@&?C0Y_ zI}z%Kmv+N0Lm{9 zDf%3{=kPnmvJ&`gG z2SPYpUQy15yX z0*W(e1AtDKSZEMHIU-0<7kLs8HEfyRJ-urF!@3NhB>A9+16k__KR}%YYs;H-B?CS; z50F?6e$deJ`U6SP$NKWLcL)5yJ%|HJ+~c8Sf$9}{RRLh0 zHxGE3)IH=jQaGbE+k{ngF?C3Wkgq1F2SG?u z4^c-zP=Mg29;F@wA$bS66NG~-Z4Z#U;N5ZHh?VIn5{^^Pp}C59y@wp^7O&Jv>V=$m zrCucW=1lR5Jf?x1k&|3+bct8$Z5Z)g>OE!dvUt4@jzi@BtOfocUIVG1KT~d3#4Ghr zFvOMitvxi^=hPQyo}$SfAP?m=+1J#!fCn8U{vFhJ=5$rYDex$s=$)Os2x`1oEf?yh~%vSDHJc zDw>l^TN=A1E0xNTLd?g>ljN4JB|{IVN9MRmk0MWW`GX$wM^4f<;0JA|9ZK{56z!tN zgWaDZPlMfMP97uAz&mziu5kQ3z3Z_L9YhOg4i>_5b{+0=iGgr+o@~Vc-7&?$cf%Bjr*J}##+N_km7q#Uxl(>u z?<^-lR+AE-u7iHK3pB5xW2oLXXK7%Gb#BQ}TKK!4&;0RB!Zg z`Z>i?Uz2aL7V64N^ow%!Hr01!5Bj`HzlJ2mLEn)d@(y~Fe!JU2?~w0v!@n;Nm(LIM zM>z+50uK6&{=C~kKZ1i!lb`;=K|&COa3h} zqn4At9!%EAOH3d6+91TA0T2GD+(jKEer5nV#SD@s*NHJH?!;7fVh!1c&&pFj zW*E%n`9P1r!3<|cpoMaCvlBC&SVLxX0cA!rV`V4b2OZ4-nYEL#FxF12>cr|UJ2MX1 z&iNh~<3byD!4v&{VEd7y zrk-hFrZLlHC=gh|RQ)<}|4yvy!~=3<5W3P`rkFcRUV+Sf=xyA<^=y1H2}VSXa$4%d zgF5k$?!?5Tm_-0c5lu{ECqT~jJeejLP(JK3O92qGOtuUhr2hkzmS^(Od zLDI6Dxq#WkT*z$h#HLPc?!?18@rWF}Ei$}(^N7jF!lr->%{lT4*}+4Q9i<17-efq@ zZJ9TV7AsDe+B&jxa~j;w(#mul77k9%UZyX2}zs*p{31 z)AFqI@tirHW622se2P(a0AyL>kX=&PiJb}>NQd3+&`i3xK>_qSu=cg$?Y6g>cV;XR zmPUkjfnd}N8r=oRiTr3HDxtPhJ3wmRLmj1_%sg0PN{^u}w2gMqPLL)OVB?PuHvI%) z+fNZai7uhTbU9rC8-O;_o9NAu{Vt&|g?&Dk!#m0HzbHBdEJrB{tqja9i+ z<*Lc58LG2Xi&g0*sutBURhz0qwL-NZt0J>NVB-s*hElsJ>PGtomKu zOFcquQM2l5b&Wcvu2t8m=cpH{Thzggq&0&yLo`D*MvX}`Tr*NLS~Est z(bzN&jZ@>*EYvh=S~cyO?V8it(b|BP(@xZew8h#v+C|zW+7|6H?Q-o(?JDgW?Rna* z+HKlvwAX2OX!mJv)!wGPLwiX3i1sn<6WXV=$F$FCU(&v!{e8%f`o8*pdYyitez1O| zew;o%LGRJC`hcF(NA=V6Gxf9ebM=ybxqhX7m41zWou25|>o@4n*KgEs(toZ0S^vw> zF@_RDgJHU1reU^Wu3@oZrD3&Ut$`TU8#Wj&GF)!hZn(y9onePzpW!~k{e}k&4;hXc z9x*&-c*5|M;iTbp!<$CNXf&FP!;K@2qtnLmMvu{F3>Z1%L}P<-p7AVW!k9EJF|IQb z<9g!;rBM7-gKeqV$&t2OHJENdrW&x`%Jf(_M2`u-Dx^#I%;~v^oi+rGd8Dbv&yV7 z4>p_3!_6bjqs?}6p?REnyxDD@Xf8Kbnybu{&GqK#=9%W%X3?B7FEXEPZZltPzSexb zd8c`|d5?Lod7t?f^M3Q~<~z-IneQCUW z1zYqMgJqb-Y#Cv3TE<)4X^YR|w*)PvmU2slp9ld*0t6PtyfyFv0i80VclchYu#tP#rmN23F|Y~(AC-tiRcijk5K#4Ye6*E#>@+~nNsyx4h#bDQ&O=e5ooowqyhbl&B> z$9d3s$oYu#G3RI89`1hb0q!C0DEA2WJoh5^GWRO?7MFg9dyo4E_c`|s_Z{~GcbdmM z!>jpT`~cp}kKjk~1^igv%G-G#AL5H)@6alK4Zn^j{CfU!eiy%o-^<_3-^$;{-^(B2 zAK@S4pWvV8-{s%uKj1&&|H*&Kf6jl&f6af(|2FaLiCZUrThyzlcTwM>enq;X;YFj0 z3erWEB3qH8$Xnzu3KsE2WkvNx(~4#k%_^ExG_Pnukx(QSNkvDBo+>(4^i61HXi2Cg zv@FyX>Ikh5ofrCBXj5o&=;F{7p>3h7L)V6G3_Tw@8G0e~Qs|Y?YoRwnZ-w3oy%+jN z=)=&*p-)1eg}w-V75XOhUFe6<=}DSNx=8~krTIxklddd&wD{HH*NfjQe!KYH;xCH7 zF8;RohvL)4KbO!Y>XKe1y-Nm_j4iR2*h>ma#+8gOahG^Y*pfiW#FC3j?kXKuI;pgz zG+bIC)2H()QBjr7KHUm98mWS4v9Pmu@IMKa9fKa35%Egwy7*r_V=>G<*$@~UjAkI*X7@qe;=VDs)#1iJJL7O zFETVTEMks~h}a@rWMU)~DUOsz%Ak!~8L5h-Cr9px9Eu!{ykGHq<={$vrJ-_IrMc2k zIj(YirKi$Y>8~uV3|E#{R#Z-@Tu>=gij`93!pg?V#g$7cTPl}TzEb&a<@;y$uCi7Y zRZXfYsR~z>SH-KQRn4fHRW-lrtg1v+vT8}y(yG>~_Nuj2q-uTDhN_FIF0Z<>YFpLS zRoAAguCKbO>gKAG)g{#p)zhnIR?n`UTisaQRNY*?th%kbqk3I+XZ5+&=T%=^eO>jA z>Rr`0RNq*AQ}xZ&w^rX)eaB?OF* zHTTxsS95>OlQk!5UaEPe=CztPYCfp>q~^1lFKWK3`6?y22ddvopn+S_aIti8APt#}|_6OYB? z@%s3*cp|*MFeH^w)`Gx5vg=_}*g;=AH|;(O!!;s@e~;)ml8 z#*f4wjvtFZA3qs?A^uYQ?Ydrded_wv4X7Jjr>`^A4XYboH?nSY-IzK{ovp60Zd~2? zI(MD7j;#ySO{%-DZg1Vbx)W2!*UzYLs&B4eR^MK~y#Cz!^XoU(Us!)}{U!BR)n8qI zZTVExhhN9rH1f2#gi{j>GYH54}Z8vG4&8xA)dZ#dQPI#Pb%S+w%Q zyqkT`y*9jg;K?e98aSYPS4cyvBvrRdOETe_`TD;u1~b>ym@>y}W@fIBjX6*qrE$g@ rwcs_Gs+a?(Gp#XO=8@R%16IHz&a0>!VGsFH>P6Tq{$u9Ul=c4y24SCf delta 9509 zcmd^kd3+P)+V-mk%Pz%qH++#4R=HkL;(>!xFDjkFQUhT3w+N^nzs7A-}ig}f5~r1XEMumU-x$1 z^DH|GPd^P;cFih248(uZ4!2mFD z)k0Ua7EA%t!3;1HM8N{E1S|t9!INMuSPwRW&0rgN7VHN91h0YD!2$3Fcn7=>j(~5# zIq)qw555OKfFHp{a0y%oH^8spKj04d6GGSyc7PqB5~^S~mNA@0O!CcoC_DirEnwM1UJKNa68-qcfuFoKKKfJ4<3Xc zz{Bt(cpQEP&%iI?Id~CXf>+@!cnAIl?;?a`s3S^7Dx^Ufs3*!s`KS--ivlQ!3Q>Rb z02+=SL?KjxB4{G2Ll2|qEHoF*LkrO|v>e6I6X;2_8ErvZ(KfUlJ%?UI`_Vh-UGzRW zgpQ&U=rlTqzD4KJcjyATh%TXjqhHZ)=q|d4C0L4OSdKg6E;tSM#Cn{KP1uTA?7|)# z#D%yR_rrtmP&^WcaRnZaC*aArF^Xs4*?1mah!^4IIEL5YO?WfjhPUJA@bma3ydS@g z-^PdW5qu1vz+d36@OStczK(CWa76B{WY1IbV_hE$NLWIAagi^&sY9oa;lBYVl~PZ&qu?aMS zX{0AHknGqwrgQ2nFlQ6U0$oWe=|J=+0Rc_mQ7|{wL88xl6wCwjM+_?U*VTn)j2u)t zxO`$H+;CE~e<4`B5%eT!#2CM39$30bI6c0%9IS}l4X2iX<=`SF%F$jTTh?S0XzlPfq#q|RBEknsH>_OPb{$$ z5>t|Z?`g0h2Bn>&PlIQ`e2S}7JmCbrW)rc-0c-(VhYu;yXY)PQn4t9)FbZQHx zBs67EZAD}=*ba7r`D2A!)z(FtkDjJCY^C@)@H{O9FOXiuK|I7hYG8@&fymUxNPR;h zB=&%pK=EeqBG?P|5hr1ZYctpnUIwoaj_|}y2|p<95q%TP*$6U8SAlFHklq!D)DyKp zq_BTT_}xTwiQhj2i+3wJfurCU_y`;q*a9cONxGc?r|D-k_*^_D9A8bm#7BCQJdw$K z(ud^JPha}UC4TW(E|G{N$0j8eBnbpxptSBwG9m?tolP2p6mYM*T`ug@YW5Xyl~%uN zq*rXZ%$#-;+!kW#7Wj!2lA=xEXYdQTj}%kW4#?8|zX_(ONK(R-yTX1NkvH!{1Qu_B z7&0Q%{$zj%iJC3?8n&lUy0teUd@>ejKg>HJ5~_&QWqGq^&Car9jcaVIs-QcSoHOKL z9ei%6vZ6AVtz@}e4M5UH~c2|Zjmy&)2qCA}2mF2i_u7`6ta-DWcnBB%YD_s?_Ojk)y z-V@@Tk}lk0JM+@X*o z7T`U6AW%f_6l8gi$I02CE~!h(Ru z7NB?Xv(BL1@3#kCZbyJEWbIB@VZdQ?Ic;t>U@IzcP#Df2>k0;4E~mX+5$_5Vu#T+Q zY-OM5>@l4UD8Npz3n<Yg9A$jL}rM=m%!$PE&&@$Mr?!} z8A-EvW?Ba46|y#)XcJkR4;JsBh594t2RaylK{0zfQ7{kEqCJ|F#j`l}Nm@v#C~yF= z>~*Vq!)Pm#!Egu|1ZpUfu_Qz?5|1y1!`n6{I0B9&5#fthX~g(MRu!OTMf zw&t!wizTd}Z3IRrw(%mWa*8S($1|)`gOGCxdTNMeoT6uJPoQV?uU?!A>%d^KtVhU1 zVozXegfp6JIh-!m^2*I{CY%KyA>+veQbn>yO$*gkh03cV^>MUBDBImh=LFJu0#XH$ zBv@P|{B9%~GCE%O;WDwV!{u-Vg})N6q6VCRPqfx`_*C5WqG6LrH8pKAsiDT@liD_Q zeM)mg#LGIP9V9woD|Nys?bW0#cnW?>9wD=7q+T_28}@lTLb}oj z5w(jD5nuf+LcSFu0&G;m@=Y&fNt64Syx`$b6DLI?`%IJTiV45G50oh=hB>eizcdc^_fg z6%m6ZBEE%W5k)7bI;a^E>OdhWv)8slLMgOcmx>{~gsf-@S=0%o{#|~cZYT|@$x^b6 zEN}KK(h7mtgLG>SRFo;eY1JP{FZ`ZP6p7zWVw|Fq9ApMMlq;YFCy>20P!TU4iwls) z$VyrjR*4MflgHZxYD_#Pgef&HHqA6#2vk%+1ND??Pn&9i?nA|3sL1$g@?;C+XaE}2 zR(hbpXbAZ)vL<0xsbEH{_CO>4#`0)^}YSz-~zhs`p~^ZyVZ zj&e4_g+sZHa)&#Y4LKvZ9@^M)ZEV<8=?Rrr^5NJXZKv2X?b`kC(;uM<7w0NxL%D8O zgr)j}4Tp2x_E0Fd!X9BmwsH?u8|9+@uvbPr<>f9ux6&S>`ok4sb3=k=aR{eWIwDlH zc>d@5qo9y>d@4Jf0Z*abY4f|eBB}zMLC#Gjg3D!h+F84xT3l3oxOsYt!{(uXdZ<<^ zaum7fS7CvRD<~`qx(aNr0>8uU;)+}a?tn8I2-*S;sx1nGoX1{R;AVqG1#T*EY)-qo zkaZOm`HS2|g?4w4DjC+rIsGmt7x36!&O$0|sG6|3g8m@yEGTk%Y&>VT2i!rbd+c_q zsXTsHz~wFoaCZ7Y-s$EF1NNdIHG=9JkCP9&i>UtK{dRh@g8yEBpz&w|7$z3be~=Ai zMssCClTc0Dl8I{36tbQ?oye1Vp=M^$uA17?Rnc@IS6aI&dW6?`?X)UE4Ek;YgaI}=x%q?U)*&KU2)Okz--U_sm_8asV z*}4&}BHKvzh`RU`B^FDxT7c3jKG0g)chFO49i4rs96}q=Gc-Qw$k8A(9a)udl6c zj4kYQX?XJs0`vnIg?^+Cd4n9FLN!<$ZWP*HznaS0IPaIi;%Ctn!P1rwWgPuX-W08k zmu=x`x#TTcz7O@CBbM(w)YJif^U%a&{s0f6Kj~xMCGU(LSQ4nMom3U+AF30dfdN>& z8AG7Mn7l`^A0)8Laz!JOcIR6MvCclK@QA%JWv|bsbtU++jw7QtRb+Y)z#RHEuc(< zd7PYRh1m<+1(-JS@kZ<*pZxz|a({I{rg~h|-#CxL?1TG?FokeDNw-tv(*(>V!8pwO zD9k^C6lTm=*cRuy!nQaE;DKO_i1Rb@c`MGr`2H5050Ep>A&G|xnB)W}s2i2QR7Nq4 z#p7BqeL*q(i<}jMhPt<+RSt&fu$fUFDd%!s4%!viN{=Jg?WO~0Wu=?7g*o0H_IP4Y zZHT>A&{^cWk{Z(EzMR~w)|+s4Pnfn3dU*wHzAR^t(8*tD!!`#UA$bQIirq`gj&)bH zi#w+$S5Bv1`o2iPz(&TO9Nwb975x)2^KJhlZCKffp9K%$T{O3^lAGiTeUJ7R!5*xg9IC2m zE^PP(yoYjychlMF8mZibU&MRKb#jAbm$gyH%~|=f(2%-Ns@l^RMe*4P9}teIKr%<) zC85N@cW76_?^1IPipJcchWr#aW2o@#1eHgrDdhv(R*vKNV-OMt^`FVFq$C0IBt9)T zbT6IFSu%JN{tTZXzmR_?82y*PXzKunzXo$QgKQwDENf{ZbWFgyK!fVXm5z)~KGV=b$NZkzj4l{xACdFtkX^ZhT{uz{u-u|8Z+3M|I@g3@IaYDzx zkv|gH{uHpac1Z>{dz)bx2_t2aL=-}axJ&LeLC^$YoTzb%P-`yn<*{=mqlHXkQm6_q z7}R!VXF4&RL0D*6O%OLhNlVjWQkgUgNo?SZx(PDPm>8{qskOQ?bgtOJWKkri!D`09 z7@2Iax(P}t5c)c@2_`kcc1=)5ca1|UtEwXkAk62#4JNHI$JiMMs1OF7CfK2gIxsPv zGcLvpinqY&^j+&du$NTQ3Ef55EsT%p&EzrpO|WAVOm2emCYX|d=NCds1Jp!GQkq@I z6bYkF2I-R6?=QGG+8G#tlE_FpktTi^BG}eCBQZn8nTQ$245xgL6uo|eDQg{xm~!!$ z7!6HO*#uRBAB1*I$M+^0a4qj;n_w65X!Be&yuLOzVT7l7LGg7m7r9*7L<;)v=wL4p7Ibb zrz<~|bmeCvuBO#@3az*ecp9D_#WV3Ecn&7`QMwkifUX5C!OJkMi}-Q88b68G(R#N5 zZ=@?jTj|QsPP_|0k9XrecrRTcdKte;*NEQ0Z{c_Fd-#3)0bMIPia)|1)AgcL_%uF) zuj1dC6h=qahH~k;kezWd1DKJ_7-k$3Vk(&lbZsbF&D1k9nYqj&x-hhiS;4GfHZi-H z*O+&hBg{$WEb}#UjycaEV(5G(k{|eX__=$s+Ah0tkfsXllGDNrNz?zQRzVG zAn6e4Na;A~Wa%{N4CyTCZ0Q2&V(C)pa_N6b*Gkt(*GsoaKbD@5o|2xHo{@ebJuCf6 z`i=Bk>37oar9Vn9Nv}w+NpDDRNpDMkk^U;Zo8(M#CFLjeO&Xt6m2@cSaJySFsjQu> zy{w~5E;GyAvOHNInO{~UE0*<_MF+};$wIP;vdOYq*;Ls~*=$)<)+AdZi^*2Y*2vb% z*2&h(w#jzLK2F}6{95vXS<@Zux%Gi|gDOD*e6&n@%6|X2>QyfsdsW__m zL~&B_sp1R8S;be1Zxk05*AzDtw-mP(e<in)w5sl^OjQq+US(97RAyDKs+Y>Ha;jXapem|b zq*|id)9pf9fx1q;P`y~aRJ~mNnED^;4eE{RE$VIR9qK(%^*;4}^(*Rk)F;)Ssy|bI zuKt($OZC_4bL#Wz3+a8*i_`n3Pfb6O{zLl3^vmg2)32xhp^<6i8ihusN!6rj(luI5 zFO6H1r|F~dYXX{qn!%d;HKm#|&3H|fW|C&IrdBgmQ?H3?7HO7f_Gk`i4r@Nt9Mc@v zoYkDuoYzDzXfA24Xs&5)Xnxl++9a(^+dBA+5&Br z_Kfzb_PX|__9yMnI;d->Yp?65lk2+ZQgvy%be&db(3x~*U9OJPd2~Kqo~}sOPd7kU zq8qM@>Y8+Ob@O!#b&GXNb<1^+=~n4tQQd0Y8r@pmI^BBR2Hi&8X5CiZcHKVRo$jbR z)7{*CQO2H(Lm7uNKFm0laXjN}#<`6185c4xWn9U)mT@EFKN-Jg{F!ktvt4F~%;e0J z%x;;PnLRS~nZ`_0ra6<%i7=5|ELSLz$q@S#>)lb#W)JLQG zCjDIfeEkajDt%19TK}|ur+%0IdHrtv9{pbZOZvC{|UNHV(ylA{^ylT8|ylMO?yCi#f z_Q>pL_V?MpW&e?V*91(+lwwkuI-62WX{K~jPm|GPGMP=RsnB$vsh??psl+tcbib+8 zG|V)@G}`on>2yv>&e)uXa>{cma_Vy)$yt>X%UPYXCTDHVx}5bn8*-u>b2jH}&Dn0w zH0PKt=2CNoxzaqrJkdPO95pX6FETGNFEg(&KV#l$-eo>%{?UBNe8qgte8c>Q`JM$@ z7>m@>&Z4pCE!mbFi^bxy6j_Qb{VfA6gDgWV4_Jm;hFeBj-m)CFd}z64O|@FAR;$hG zu(DRaHE1oe_KR8vSWB!S>qP5hYpr#vb*6Qxb-DF1>ndx^y4t$Ny4JeRy1p0FE4f!n zFV0qGn`*1KHQFAw&9E)7Ew(MSt+1`MJ#JfPd)oGlZIf-6?SSn~+uOExZ3k_KY=>yn#}3D{j+Y$=9B(?_c0}KIeBe0ZIO_P+amMk5bmZ_>H5j_GuNI=R_CHFFS zj62SK!ky$k<-X;9;4X5Pxf|Rq?l$)ecbA7e<|VwG@4~0@X?!}bk({2~5h{v3avzrg>% zU*xaw*ZG_LPyEmBk?sfGVRyv6%(LF}qGzAyWzTD#1D+$EW1i!l6P`~!pLxFVocCPt z{NTCa1zzlxc$2&`Z%1#6SLN;O?dnbUYP~`4KfHUQ-o4)a-dDY^dk=e0cu#pxd(U{k z@SgX6@4e`~;=S&@>AmB<>jOUIV|>Xzg-_+{?9=*s`V78oUyje>bNSppudlbS&{yM| z>TB>#^Ud(h^3C=|eUJL)`4;#V`Ih*W`5yDF^2L0seQSJced~OidNaL~d#Ci~ddKo2 z2l7tjoyz+x?~A;%c^C7p1bJV99kEN^lOMrj!DW##^#3gdmk-_F!p>{4