def validate_trust_root(openid_request):
 trusted_roots = getattr(settings, 'OPENID_PROVIDER_TRUSTED_ROOT', None)
 if (not trusted_roots):
  return True
 if ((not hasattr(openid_request, 'trust_root')) or (not openid_request.trust_root)):
  log.error('no trust_root')
  return False
 trust_root = TrustRoot.parse(openid_request.trust_root)
 if (not trust_root):
  log.error('invalid trust_root')
  return False
 if ((not hasattr(openid_request, 'return_to')) or (not openid_request.return_to)):
  log.error('empty return_to')
  return False
 if (not trust_root.validateURL(openid_request.return_to)):
  log.error('invalid return_to')
  return False
 if (not any((r for r in trusted_roots if fnmatch.fnmatch(trust_root, r)))):
  log.error('non-trusted root')
  return False
 return True

def validate_trust_root ( openid_request ) : trusted_roots = getattr ( settings , 'OPENID_PROVIDER_TRUSTED_ROOT' , None ) if ( not trusted_roots ) : return True if ( ( not hasattr ( openid_request , 'trust_root' ) ) or ( not openid_request . trust_root ) ) : log . error ( 'no trust_root' ) return False trust_root = TrustRoot . parse ( openid_request . trust_root ) if ( not trust_root ) : log . error ( 'invalid trust_root' ) return False if ( ( not hasattr ( openid_request , 'return_to' ) ) or ( not openid_request . return_to ) ) : log . error ( 'empty return_to' ) return False if ( not trust_root . validateURL ( openid_request . return_to ) ) : log . error ( 'invalid return_to' ) return False if ( not any ( ( r for r in trusted_roots if fnmatch . fnmatch ( trust_root , r ) ) ) ) : log . error ( 'non-trusted root' ) return False return True
only allow openid requests from valid trust roots .