From 67f6b1080e6c728e84d5279caa0885512f9e8389 Mon Sep 17 00:00:00 2001
From: fit2bot <68588906+fit2bot@users.noreply.github.com>
Date: Fri, 30 Jul 2021 15:19:00 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E7=AE=A1=E7=90=86=E5=91=98=E5=92=8C?=
 =?UTF-8?q?=E6=99=AE=E9=80=9A=E7=94=A8=E6=88=B7=E6=94=AF=E6=8C=81=E5=8D=95?=
 =?UTF-8?q?=E7=8B=AC=E8=AE=BE=E7=BD=AEMFA=E5=92=8C=E5=AF=86=E7=A0=81?=
 =?UTF-8?q?=E9=95=BF=E5=BA=A6=20(#6562)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: 支持配置系统管理员强制MFA和独立密码长度限制

* feat: 支持配置系统管理员强制MFA和独立密码长度限制

* feat: 支持配置系统管理员强制MFA和独立密码长度限制, 翻译文件

* fix: 设置界面可设置管理员用户开启MFA，当在设置开启全局的时候，不改变用户的mfa字段状态

* fix: 修改管理员最小密码长度变量名称

* perf: 优化不同的配置

* perf: 修改check password rule

* perf: 添加配置文件

* perf: 修改profile

* perf: 优化代码

* fix: 修复bug

Co-authored-by: fit2cloud-jiangweidong <weidong.jiang@fit2cloud.com>
Co-authored-by: ibuler <ibuler@qq.com>
---
 apps/assets/models/asset.py                   |   2 +-
 apps/assets/models/node.py                    |   2 +-
 apps/jumpserver/conf.py                       |   5 +-
 apps/jumpserver/settings/custom.py            |   1 +
 apps/locale/zh/LC_MESSAGES/django.mo          | Bin 79785 -> 80516 bytes
 apps/locale/zh/LC_MESSAGES/django.po          | 136 ++++++++++--------
 apps/settings/api/common.py                   |   4 +-
 .../migrations/0002_auto_20210729_1546.py     |  29 ++++
 apps/settings/serializers/settings.py         |  14 +-
 apps/users/models/user.py                     |   9 +-
 apps/users/serializers/profile.py             |   5 +-
 apps/users/serializers/user.py                |   2 +-
 apps/users/utils.py                           |  12 +-
 apps/users/views/profile/otp.py               |  17 ++-
 apps/users/views/profile/password.py          |  52 +------
 apps/users/views/profile/reset.py             |   7 +-
 16 files changed, 168 insertions(+), 129 deletions(-)
 create mode 100644 apps/settings/migrations/0002_auto_20210729_1546.py

diff --git a/apps/assets/models/asset.py b/apps/assets/models/asset.py
index 829c13f75..91acd3d34 100644
--- a/apps/assets/models/asset.py
+++ b/apps/assets/models/asset.py
@@ -333,7 +333,7 @@ class Asset(AbsConnectivity, ProtocolsMixin, NodesRelationMixin, OrgModelMixin):
             'iconSkin': icon_skin,
             'meta': {
                 'type': 'asset',
-                'asset': {
+                'data': {
                     'id': self.id,
                     'hostname': self.hostname,
                     'ip': self.ip,
diff --git a/apps/assets/models/node.py b/apps/assets/models/node.py
index 2e3b890a5..77614276a 100644
--- a/apps/assets/models/node.py
+++ b/apps/assets/models/node.py
@@ -608,7 +608,7 @@ class Node(OrgModelMixin, SomeNodesMixin, FamilyMixin, NodeAssetsMixin):
             'isParent': True,
             'open': self.is_org_root(),
             'meta': {
-                'node': {
+                'data': {
                     "id": self.id,
                     "name": self.name,
                     "value": self.value,
diff --git a/apps/jumpserver/conf.py b/apps/jumpserver/conf.py
index e1d6ead47..495ff5d50 100644
--- a/apps/jumpserver/conf.py
+++ b/apps/jumpserver/conf.py
@@ -16,9 +16,7 @@ import json
 import yaml
 from importlib import import_module
 from django.urls import reverse_lazy
-from django.templatetags.static import static
 from urllib.parse import urljoin, urlparse
-from django.utils.translation import ugettext_lazy as _
 
 BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 PROJECT_DIR = os.path.dirname(BASE_DIR)
@@ -244,7 +242,7 @@ class Config(dict):
         'TERMINAL_TELNET_REGEX': '',
         'TERMINAL_COMMAND_STORAGE': {},
 
-        'SECURITY_MFA_AUTH': False,
+        'SECURITY_MFA_AUTH': 0,  # 0 不开启 1 全局开启 2 管理员开启
         'SECURITY_COMMAND_EXECUTION': True,
         'SECURITY_SERVICE_ACCOUNT_REGISTRATION': True,
         'SECURITY_VIEW_AUTH_NEED_MFA': True,
@@ -253,6 +251,7 @@ class Config(dict):
         'SECURITY_MAX_IDLE_TIME': 30,
         'SECURITY_PASSWORD_EXPIRATION_TIME': 9999,
         'SECURITY_PASSWORD_MIN_LENGTH': 6,
+        'SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH': 6,
         'SECURITY_PASSWORD_UPPER_CASE': False,
         'SECURITY_PASSWORD_LOWER_CASE': False,
         'SECURITY_PASSWORD_NUMBER': False,
diff --git a/apps/jumpserver/settings/custom.py b/apps/jumpserver/settings/custom.py
index 226aedc62..cc6875083 100644
--- a/apps/jumpserver/settings/custom.py
+++ b/apps/jumpserver/settings/custom.py
@@ -38,6 +38,7 @@ SECURITY_LOGIN_LIMIT_TIME = CONFIG.SECURITY_LOGIN_LIMIT_TIME  # Unit: minute
 SECURITY_MAX_IDLE_TIME = CONFIG.SECURITY_MAX_IDLE_TIME  # Unit: minute
 SECURITY_PASSWORD_EXPIRATION_TIME = CONFIG.SECURITY_PASSWORD_EXPIRATION_TIME # Unit: day
 SECURITY_PASSWORD_MIN_LENGTH = CONFIG.SECURITY_PASSWORD_MIN_LENGTH  # Unit: bit
+SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH = CONFIG.SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH  # Unit: bit
 OLD_PASSWORD_HISTORY_LIMIT_COUNT = CONFIG.OLD_PASSWORD_HISTORY_LIMIT_COUNT
 SECURITY_PASSWORD_UPPER_CASE = CONFIG.SECURITY_PASSWORD_UPPER_CASE
 SECURITY_PASSWORD_LOWER_CASE = CONFIG.SECURITY_PASSWORD_LOWER_CASE
diff --git a/apps/locale/zh/LC_MESSAGES/django.mo b/apps/locale/zh/LC_MESSAGES/django.mo
index f85dee23ae796b98671c1d164c999f343b46a3bd..0133308889c136f77eb3e0bd7882a8b61fe755d2 100644
GIT binary patch
delta 24715
zcmaLf2bfLQzyI-l#wat4-s@m=qW9iKiRdIE27`&wW=1Cm(M27-_vpl67!oB!A`vAb
zdY?hm5JUw3_vh@d`}4o|K6gLQ%4@Cfs(bCV&pG@&zjY7&$2|4-UQX{n+u^F`?>ITJ
zT0X~#P3kxu>nZ9ug+F$jLVk`@1W$V$r^P3Zvlk0~>Np*!ztP!oreO6@#~F%0VO!ca
z=;An&C@=2jI3uxenB!c)b$E>aW4k*}yyJMCRy`djBOOwQJI)Cj<nQG;neZ=6hJg`|
z6NKq7CFa4*SPb)G9kUzep*#+=;Tq(goc&lD4`T^@j_OySH#f!nPD3)e3G~OJI33I2
z9()fUn7R5m&RNP$@iG?Z>kjDO&vDXIE`w>XJ_ceNOog4z-sVtDPJFz|%<oJiqdQxK
z8E`FXfW4RzkDxkSM76t#8u*d<3e_*Lzq@0(F*W4^sD9-vUJZjN*TpQ@0=*h2oJ;@?
zM0FU6X>kH-0rOD{+HCGdO?U`(=Vwum>@Ma*Poz6h2o|AS2Gy=3vT06V)IzRAvj0iQ
z+$T^N|HML=J<45B9po%JO|c!e#L~DPHNZtohku~P`4@E~PP7{jMD18kD;GxHSQWEL
zH2bf^)R8~|j6&_md`ypPtl@6dvptGBT<0zR7iOfKbb#AFJLaHV0(HpVN7eU2%`+0U
zfVr3f*LullqP^DOIBJ4Ki#r3|JIR3RPyqGpDx(H!fok6cweaDX2`8c!ycG3Fx1bgh
zhkDI_Mx7Dw9Wt58{Eb?9nn7;EVyFpfp$2S$8nB0z2cZ@;#mdXA9EW=Ce!{GH!s_o}
zcFJ#13&}p%SMPO7lF<Z>P!*j}&pZlK;1JZa9*ugI(=h}Wq3+-S>TsUG5_kc11_Fk-
zJCXr)Bf+T8htjCel@=JJ_rE<EZC!WNz)`4)=Ai~!g*s%Lk<Te-KWc#QP!k_T?ci^y
z1>ZxB_tfHkd@Sk)vtfQLiRG~smeu<|kxUi*2D9Ves4dJe%w0fM)B^HhDJ+LtKp1KP
z5vUy+gqmn9YT*k}<E*y&^_Ye7F4R0H(5r#&l97*5hvfz4LeFq_NAjRL)<eZRq8`;y
z)Iig$ydE{-KGXsZp~n3M)&Dp2z3!+R`g1t@uS}8=ZXlCc2z9tBqu!2Ys5|S7+Twwz
z3B2Y+GsawuYWEdthqhXIkChLZ$49XLTEKY%mGK_xuoV2<U3o<;Ot}VXXL_Ip?u%+S
z7}bBGl^3FRWFuz7BdCR6LoN6@Y8(&q>TL?}S|%HoBv1skRUJ?R^hcfY$*3(~fa<sf
z^_J{IZSi5$8Tc7>_|Bsyx`o<-hp2x4SUhl~`%&#pPev8xQFl@wHDNo{Bj}E*A8JlQ
z-T4C4PHaF;v>kmPWT?02IBL8LsQUY;ai604`;YR)y-p@FSqbDqb*zB8gF0>lr#bo-
zWaaLtt?YwpHyF#}SkzAJ#vHgG)$Sr{ClgI)wEIZ1W1!yuQe?W&pem~264agTLJfET
zwF5t(w)iaSQ6!=!cxfj6f)5$WX;A%3p>C)$YA5TXJ|{Y$-jaUk`~Dw5Mjb{gfRj-Z
z%|lJR2DJk_QP1))`rcnF-$gCt8LGcC#_b=38aD^(5rm+|D~?)FHS{X*AsO9iXVgSJ
zuow=+;<y6+@i=P0)2McruoB)w?OcJe?$*{sEwBx0;(q9RROVRJI5Wqx|60jH0=k1O
z=5ExTeusJS7i^4=P#vp|a~D((wea^*Tm7Ng5!J3Iw#WXc9X*OU@hsNCr{j433RD`;
zHyyS?b)17qaVZwT)u^31j>+%}`py9AG`~ch_EZzx!<-wFQ?7`)u_mU#PG%3xN4cMu
zj0TQDy*?{Zr*|h7#8a3DUtnp>Hqm`FO;9^G2-R;gY9UKd<847bqJ8EssCJi73wva7
z@84v!^5m1;ifpJm%!?_ou*FMTyfWq@UJHY<la;-w_KQ)^dX1H1QRD4JP5hmee{$=+
z&M7i_b{A03`W9+{fXVKiWJcX-LDVy=f^BgGuEEo|2Zw#>wy!wFeKZYG<8;J83`Z>_
z8nuvNm|E}u7i2WSOw<;xL3N13AUufbZ~}G8&!XPr$Ed9inCd?BZ0JY145q~L7=X1g
z2%DhJOb1MjebArzoe|35XjH@Ts6#p1;@eOI#aa0PYJ%@kcX$ee@e1k@IMdt-0#Nl?
zQIEI)>QGn2G*}(Iny?ueHT)R0!k(x*8DWk@eMEnOnqU!Xz}2Y!aj4UL*u0I^DW{z7
z9^Us+I~<OB1S3#~dCYY7e?6I<1azoEXSiGKMXhwam8V#FHkKs55S!yqSPFB@bRS7m
z)XsE8EwnGD#=+>@S@i8JrYF8_Ci}03hY84E%->PZ{3;f~+o+D|W8AY*5;b5IOoNS3
zpLp$2k17gvhDM+kGy%1cSy&ENTK!os8BKfxi{U-1$U4jYv6vr|5O0Y3AZdcy>d(w6
zs0p^B?=?d$>^syUJ&C%J+o;c#N0=T{&9?9VJY=-8I;b<y0@a}t>JfA|BTx&CL`^sh
zGvIjCgbPu3yw1woQ42VTn)n>5-&53lo;kh`IIokIj5=0Ct*j1e3)`S3{M5=lQSBm8
z?M9#$JRQ^FVyoX`#-kQ^81;+l9BPODL@nTN%&Yf5`CPX_5!6=KMlGN|Y5~nrXP`ZD
zu$|GUJ4rv!ogg<Bq+A9S?|@oh7#6_67GHw8f%T{b?~r=`kC4$JI)}k{2X$wG^WBAH
zL9IA1>X4N(n_wQw-OX|48uNS99VeRiQ49PF^?Bng;Qh~pNy+G0=P>i44qGAAYuNy^
zVmEUHW~4j^)qex(jt`)o^=YergqbNPUFf#YX_iLaaD#>HzqYz90j;PrszaDH9FAou
z&p<tjLl!?~<?E=Ox{K=nH>&+BERLlXxgRv2pkCi;s7J67^JCm1_FpTxKtKcBMQ!yX
zRQwHUXVNToC(48xARku35?C6$qqce;X2+$d8;iH{AuL4s3ToWsOWaS`EM78t-Lj)^
zVAMb*EM5-vQCtmmr!`Sq-4yi*K1Cg-Xw<;tQ0?YmT3m@aaXab;Phv$pgPO;ida1jB
zOsD~Jp$<t2)az3jwXkNWN6;R%;7}`vn~|uAhoN?00&0OPQIB*NYQp2F@y@vQUgsJa
z4g3uCLGlLkV9+vm0VOaC<=SQkEJ(RO>JI0b>rn0DF&Iyw9_16%4*4y2&4{|uf|x_^
ze+4qx2((1qSp;g}Xmc#8!yF93HK;T3lX((#1HYqg;3{ed9-tmozzVmV6LV0mh#IFA
zW@Ub7Fc~di2A04LsAqN#%i%NBK*d(NzmRI6o@Hm$mWQDh9*J7WP}D-cKt0MCsKdAz
zwG&^V+V4iMIvgOQXLJ-b@ikP3*QojwtK4!r)U(ThzAZ$(ZWT}ihht$JhI)jnP@fNn
zPzyPa?_nb9(PUa}?|;Z@_i((2nz%fwLro0ECg^)Kn3Qrf>M#wp_$br@CR%(UYT+wT
z6Kz0^7mvDu?@{xdT+RNg;{^gbt@lv_`>k;eKn;)<gE0^45!J$^*au5vG^*Vi)K2ce
z;`lRaAumvm#P2Kj6E!U+qx_!NGUZV#s)kx&1JpBbftsir`r~J)!`T-#z(~{?7>`=O
zEYvtFQFpuv^{94R{72M+ezmgqA{h;kXn`lFmA<la%C+v+XF|nup#~_1`g|ydnxGMC
z0qw2a1GT_G=I5vz8*BB`F&F30Sw^NF72l#>k0k5dJII5Yun1}=Dq?bMj2fsVYQj%Y
zuUiD_QH)0&y4|RS9Y?jhf+_F;>V}_Va=ril>)nb}sIAU~1u+L|%j;kOHbix7ff}e2
zYKwcIUehSl9j~?c7SzJ_puRoNpdQ^rEP~Dk-W<LEMacwWC~ANR)QY1}3mA>sf$>(q
z!0MM<c`IsX;!qRqv+`L~|Es8-NU-=*^gUwqYT%R`-IeA>-DzdiLh720F(u^|sJG-3
z)B+<>1C6r!X%=6IIveXzZ`Ze|oj8HofxA}!??(1t4bpCMcOaix0=4o=m<p?-w!ATF
zfvv3kiPd*U?O+t@5q^%ku`w8gb5Z?QBZtn}jM}N6H?jZv#7iKc75Z&<&4p@M3AN(3
zSRQ*|K3t5caX)H-$5C5+5ewrz%!`?}xZnE~u>|E$u_#W#PjHvlGMTsX@kt;W^WbIF
z_w;M*h!wte|MVM!6)2y<k{Gm&zYW3aI2eau7(PZ#)IQez6Vex`L%kh!V;3+4y)Ve<
z&T?;e8@9$`l*eK-{2KMO`UW*|mK~e}`~bO0XBn!#`A+vstOw?&JPI@8YShl|MIF-L
zF$k|<TD|}G$z&k#8Z%=0ICsknVLHl{FgG@~csOc+p{T8&fI6JBQ4=gjot<^4v$7dS
z;VyiNRd(@dilugIUY`GKG6e{%!$>@iwXsgT`^?6mp6NDhfEVy1%(ut=4LAaI=ysxR
zWH0J)oxm)32Q#B*ue;!^n1*rzOsV(3JQ=OHwl!#gy2DnO2}3b84nhq$4%s?qiMa)}
z!2PH@zJogLPp~8Yi`tnE-?%#(irTR#^kyUDC8PI!zPSvuQ~nCI^#@Uh@*3(;dA@bO
z4U3}|)C~3dg`vjjhq}W-sENj-77$}DL@jjXx9oo?nN0+Ar)l=NJ5d1Dp{Q8~H9-~B
zPSi)WZ;d(eGt?H3NA27a)LXC-b(qudcNbCv)xR<7>~z@gb+@ED0o}=9%!SjjEN(_k
zd>!@P-$zZD_JBKJ2~1D9GU|~uMNRMt>JB4N3m9nS6{xeZ5!L>%my8BDgL-CnPz!l%
z1|D=@&wQAhcze`g8-%)p5vT=D!kRc6HO_CSc9&6)<R<Eo+(qr|OVp$BCi%`?X&UTB
zARC6@Sk%JSqXzm0)!{oVkH@hTCOzbCeFaqeW~dwJjQ%(neG4@wVGZJQk%f7kGh`|g
zxP)ae%VGDUvoZ1^=R}|uko$Z0gC)dlg!%-GKux>|_4%;{3*aHtxPPFwJmd)H2dkqF
z_h8JV_dkY=I<CX_@LNod_bvVubq9ezxObEVb9zXak9g%D-3dCP7CHd+?1!Ny8jE_?
z%TSN%Yt#bwVjAXmu9MLR$79stNp{q}JkXzVMbyC6P=~1w7R5eT1m|N2euuh&+gJj#
z{N(-!t&fE$M`9jafI3U@=vBvaWb)%{tH}4WduO#VFY#`u0mflL+-&jRP&@Y=^~_Tp
za|aH=9F*&#-j+{MpEJWzk7^ETN7fx<|7)<7@dO^?i(fcoc;^Iz;nS1umyqADIw}19
zK6b+s80^PEJk2*A<+f+|m83ZG8RfM4onJxpPj}Y$E6X`~j{oJ0@`&?%15!WuqPvh1
zml#!BT<em1y6dA}pBAVupN~)<G!f=#)E3UO`dz5@N3kgWiaNxvF&CD;?Cw}|)L9sa
z!8ileew&w!8eYN*_!2o+PMItGGaQvshiuDLcgs#;X394(2>&rtTyyI)V<7QDm>kQX
z+Eu|+*vM>yYUk}@f!>&mz)&lXGN+mg&9$g@JFL9d%0FTN@e>w5k9zHHS=qVn)(4^b
zXL0p9xh+rtwZh_NWz?Z*fI2jttsI3qTvJdJuEW9@i+WTS@gsa}_04X$6ShMg;!fr`
zOr=w`*&6J@4`^@@%VN5l?t<!L2Ffi_EANh)xHtN~<xmSBZ}C}HUSe)AccB)3*vi)=
z^E(g7=)Hf58Za=yz2oetatYL(RX1B<Zpz{21k?_FW%co>!+XNY*Ui7p)QRpwLeTg3
zf3?VHg0^OaH5hH>C8%e)9krlis5`!7{(;FTKS$NSMva&HmRk-%mCK=aps|&^-(vsO
zVYoH?(p+Q>Hkt>`v#3Y$05zfCZFgY-W<J!;RJHO)s0pL2Jk4B->VM!i`>$vD0|71M
z6smk3^Wr^=r@rIfac(S3yqJ|+o1tbO)P%!O6U?>v5_1D;fxE2yyO&G=ft#oWJisLQ
z8nwlKf4HVW4V)7-a3zb^G@F_oP#-kiu^5iRe7Fhq-Eac+(fbB9jyLUHcY-Wt2x^6;
zQ4Kz{cstY~?Pf+<{b+L{YQfV{hjB6L%xty#A5k}U0(HZuk?#zzbD4}Le1__n>7M(g
zQW!Nrb<`cTwQ_&d!X{xVoPio}3F?roMNRZAYQYE1ljc?PA^QIP&ud?X!S1^qvZDqp
zVwN?ln+?qtsD*rtdURdPNOQC~(_DeIXtxcu&?lHo?|;Ap_sbwHYT~M>f$L)`Y>Mj8
z!ODG6J2l*#X0AZ>-+}7C&*I;k=TP4<_fR{V{~`OYOf@pPgEpv%!mK<DHPB>pCTfED
zsD-Vx_*N^&VIc8C7C(*!DW9?WS7zWNcfKr-c>cPRLIgBm6|<q)+6+Z4q>q&cn4?h(
znr8L$Exyd$Wbt^^jUGU?KX3InAKCl=rv+Z3CQ9+AyPz~?PHafL2&%q6YT<)X15U;?
zI2&~%tF64v>JQ>4#D7K|=Aw_?aq4@?Xn>}u0otMl=#J?z3N_(4RJ$ptw`H!CccS|3
zN8RBG)FZru>h}gUUa}{y8O&hQTY^k_8dNcxSw&~mfW56e&WtganVV1(#hV8(i1H7p
zg`GhyAkpfdSot616V~e_|I7WTErJ@TiP;j>u>%&u?x=-MHJ76nxE<B+7^?kg^P0sU
zpceAf;z^&n?b7??`R5^%p9aOTGJa?cCZPtNYc8?)YIB>p59`qGXDg?9<}NfRmLgu#
z%AKtoh1#K2=zIUSk<pjUZq!OIr~>bz?)b5p^tpS-Sy6Xd8r7}_s$YGJx3PE^%tJif
z;uBG4Xby(pGV~TFbC`@)`WP!<{=eP#_9M(pc@%1^=V2!N8nv(^=6Ulz>PyOb;ZBqj
zwa|iQS+f>u;muy~{FP}<Kr8#$D#B0`M4$%rqIPH@s@*rJfsa`Ew0Rjd-fi=t`3%+m
z73$6d|8dJD_0Qo{QH_AM@O`X|9k2z);37=GEjaq6yAx&pb!~#`-wic!e=85R@>nZ>
ziCL+ikGipK7C-E@%qi3WS5SW*NW|>u|H}QNRUXs=E27#pL{0nw>Ld4KD|bh=i!#4J
zwU03up!zLGEy%l>jJEWMH8^RWMK!!)-a{Rx7pV5xUc2@AQ4^LjYoR9m5Yu8i)Hpp+
z{RW`gd(jV^X>P`ui8@@fF)41qocJ}S#$T``UNVE;@ROW!b<~zlH&>z-uoLxD?HgQy
ziKy`>Iv!vBQlDP^BO*7j$=r^$X}AZQ;49RjdEevlP1FZ<N25>^O||lDa|LE0zQxK%
zP<MVB)&8=XAerB}N2Vw~!Q7bJ&*S?;Wp&h6HNbS(7BgZ`)IcLp3mIe1Fqfbfyur#R
zP&;%9^%gy{c={wB$E!n@hm3wQRl#gn1B0<W>ir*rDRDY#!bPY7*P+_)Mcv^U)D~a0
z`e&#^7U1ui57n<Ks{IH4{5x1>+7r+nb-@%Ej+!VE)xnF}iJ2B(VQ#Vdy;gtR;#bUj
zs59`w%K4JI<CR3sTPLa4ov<kZP1wflf_fBvtvnUAkcC#>Z0<pw@*m7|7XJg){yFN=
z1}1a2zC7wi+M!<C9$qrqqDa(7?_`{Y2T@zuGP%e13D^_$5j_Sqzz&Na#<G;JSvgY*
zw_j=0Cuc*mE2^ItHO@5D_}=~2;0$U99-|J~8#7~oTP|YOFk6{D(RUclF{p7SqqcY+
zYA04$d<UxiK{xJoezXP`&4;F6pu6HsW&zYd<x!8O5o+gpm?N!zzLhtk7IN4;g_`&Z
z>X9U3dOm-gbo`Bzeqe;4R@@XbU|TDHW=5NzquNg}w_*v(XHl<RGXCaD;}k<Jv^;9z
ztx*f;fqE2u(D&#6&#hvz0#wX2m!i(ZMl6UoPy+-8xdWy{wGTnPhNV%@ya{T89#%id
z9AnNvjk5%O|Neiq1vXlPSk#L5o4=w4OtkuEW|GwI0@9)mQ!doNWw97mv2u5_H)_Gr
z=BU)X{|ZdC1`APJx5COB%~({scq<=4E$A2XGHSsOtlpEx9VZ3q11vpiVMS2mltMk4
z>S=iY73fGn1B9an9*)||FRi>5b=Y>H+MPswl-@-3PnOm-1FC<pl}n+<sgCO30kx1w
zs~_UE%s4X!)nS>H_o6!dXyp^;CDfMxVPz+sJ8_Vi3$?%!sCLa!hdK;(c!!{N+Pj>L
zJ`gsb?&Kos4(^~PeqnJZy;}}Kb<AkyHVd0&Q2nc+#%qcirvvJfvNLK2`y=CcoiSw8
za4PDvf1z99tg`rK)U(=S<?~pa@-57V88f&ORz!WIHpKU^C92;j)Pk3x7P8*_+85{j
z-$h2R&q1rWh`NItR(@jsgIcI3qdQP))WDfg@jPa6v$EL$^$1#_?~I}P4M*Si|2Q%l
zU<y{n1*kJ{Mh);W>T}=)s$Ho}?m*R1pJX4R+6_b1k48;6&El)gji`xZQSH7#ueRu@
z1@52*dWKr*D~qSi>~_dy7Deq)MYADl!gf~Q+u}n}f6|$R`u#A^TxD*}%=@p3y#(~^
zen1WUD{7@TP%FJ}<$p~7EbeJejaqO%vj}ROQmB4aQLkMi?1`aPK8n8av+({abDw}Z
zJVy=apVd8#DN*r^sMjYi>NCDPYT%EoKFS<vPB9mt#{0_3n^8Y*_n`V8@LGfO<~7uU
zZliYMG3t)|vbkR}L8t+%qU!6Q25M>cLiHbmdjF?lP27sQkw>WhudM9#&+Z1&p&DdG
z{T3`><sw#J!K{vYTk2W46Z%sQL!Ft=PzxJ@8gGil7oZlp$>QH53-vm`lF^DTS;bA%
z0DqdE9PS;ZLk*Y%RbLo2VI?a!LH&8*V~Y<qC!0%9JM*=<2b1ah|1cR1{Ihw^Of;XE
z`XBw&E(o>Y?5GLzq6V&E@kSPJj=JLrE00C}xnKoqoOsO6{LT?F`e?k4`nCE5^I*<g
z?wwXcb!cjKK(*_R`UIS2<!z{EegX9v{|cL9f!rS7KU^4ql_~E<y{^yDtA?raczplU
zXgRDzxi9JiXf0~ML#SUkiP#P^277$}b6W(Kqx=xHppd-oz|ByPsH>HuQ1eX0VEh_2
z?y0=I|N8Rzi-5MOKtA{Ns)70p?}{^VChA!i$ZyXawe?L<{d!t_6zWmTLhaZR)Iv5`
z{T}ldi(kv{bqD;DfKIi4h}$7IYJm65s%9gz4eAVZK}{HreK86T;|=@(*A;LV`ZwmH
zoT;G48HZ)D5ypGT=$Rxb<Zf|wY)ZKow#Qwl?}T)P-3gnacA_=vXL=9RpACnbQ&9_F
zhHAIT%KK3ZK4#_9s59WbMn<1#&r#n6Ig7Z@sw(OXbVc2v7xj!MT6r6$pu87{;$hST
zwTiljxgn}wd(=;`E><3bYWD^5XuQrOGJ2K^%sAAkK8<>|&rt)UE#?kb2z7_0%^GGC
z)F)+ovny(%K3EqApdRsVi~ouNdjHS+GW?c94g3JLbuUqeCv|bRoZBpI*278Ex5G+!
z9o0Wa3AbNi)B-A@#;b|?4ryuS?ii}~e+U_E)dkcuNibhpJl%WlfH}-!W>wULO;E3A
zdn=Da?OcqNH==H2H)@_AQ49JNeSiO-NTwQrH>guut)x5fM`jOH$7s}6evZ1cgQ)L{
zAFcivYC*qS{Y~?(`4}Upe}P(H_fow7T8X!m+i@nUycBgu+svz|4yjAK7D64?TBrql
zidtY-)B<{A6C8?K==Z44nPXT0U!y*NLdx*|uO!o;jQhR(2kLJ`9-&Tu%Chd;Q3$n#
zO;HQ%h<Y3PVo{uD@$axK<uj=Mf#uxx1yPT-GOAy5)WQaP$!NuI{n9GtBR_VWWtgA(
zxbp7ly@0yor>HxAfm%?K3a*(^@gk_Vs4Qyywx}EEYV}d51$sx2(Msl{2404xaTRLI
z&R|JQUeUeNim3W7sQOu``omWL6t%^{mE4_cfZCy6SOn)-d_U68>m*npWo5TvDOAIc
zQ6EfWQIBN3c^LKVuA<I>Ulq5U7ger{+UhQ--<E@sjda@bpT2(lZs0Cok<X`JEqeb?
z5!BU~;7d2_{BAKTI^ooLNdMBg6?J>a-?qvI<ZCgQo_i<K6Uw^2(0^!q5_;eZZ7){^
z8#^<7{_s+`WgUK`@`P1xCjW-`OVS-W{zY7$_w`8Qtj%oldWN^Df1h^E$seNbKE~rd
z(sJ@UNI%eKCC(ytlJxfS-k_o^sXIwmGAeWVwuS|`A*Ud9P08=ZRTdMctxpnbf0kGj
z3*mFixl7U&^v+}f<g1f%((gU`RP|&3n^34k;cqIA&|$m{s?G`4c^R>~3UECkR+08U
zFu_FfeX$Ys|Kbyz;5KuTk=NDDY-S76cTFg<BlO+l_bGp1^flvIU@R3asrZ(ZiVi2N
z(|N3J1F3ne#U~NFL`q96692L`<LRG?MP`jT*&>6ti@LmXrKk4owVsjslWN(B^WIkA
zI?@J4{N<hYsvbr9p7wKyUnTXUd>S`kdfF!?^(23f#N~Cm5@_HSd_PO}+JLW#r6td&
zpi`UtS&Lg!rxuxE)P-;>Z?7th)q+9}Vrj|WA|Gr0&QaFY;GJ>O=p9SPAi5S>gGV%&
zNO?HvxGK1UNcl+(X;bE%0aW)l{rRMG2H7|*tUl*E3tLQV1Zf9pkUDYcOQf-v0Y9W;
z8!FZi=#09S<5OGE1M+zpjNgI2>#)W7qHu~3e{AJwY6sIc1Ld!59Cf%uz7FjclOLl1
z*D_+WN!|hPH2lp5%0+BHgIA?I4gaA${GE0hAl};UxA-9QD((50_5IRRyFAwJh1EBq
z?(MZbiT2;FAFw#9Oh<=6@)zlFg;bLctw~2o`i-RP1LAWiSHg$1--fz++GNTfv3yeU
zV=O-eZ_sZtu}0|ojGaob4B2SZ5Bm=I8v`CAjj@5_@EUPl38Z?I`PuBd2H@wUHl)*}
zoz#t_Z4pvEZYYzDu>wmID~{PL_JuxU|793{Ncw&ixI^;G&>Flgx25AY(x-~kb|(2V
zr1vQ6J9H#z9`V+g9Cwj)rJ~Ia^>d5PAH?^NA40z<^zHvho9rI?(ZEB8jI3PO0b(~W
z1V`g$e0x=~Hr*{&fqpCKA3}q{q++D(@3hZg`8T+ix{Z4NX)M@|j`v72NV;k=c#!35
z(dI`6e`ReWa5r@yVlWP-PFEeuY3MhO@<mb(%BQdzZ5rSk(!a!XmBiJ4+<!+3<>*wH
zbeRUa%Dedft3Oq?C+Q1Y7k>iw{hxv<|0j7}KaqYWt+f8@i0`(E(wTwOr6k`<9k`~F
zf1ppdASOOY<y_JPf*oy;eE1$|2C++Ycuw0bc#iT6JV3fgOjmYH$2hU%7trSu(&ywi
z62DBUNBWy`ZS|$DJ!M_q5_HmUtSc5!kUwrY^Jv(DhSL?``hfgeQf1nIitkf@411w2
ze#!W*q?9L<^!qEN#lA!R{JBXQZ82YCoxd0wmuJvlskmi>sd5YXW~8+iOHP|-OgMse
zhp6v{<tabKKdsFX@?VmY(Y7mAqn@lYpS-SK<~nQdJO3>Rt|0}{co-?1hFLI;H9k*X
z*EH+YigIbo_p~;JDc2!ii@I%Y^Z)wqdUD;Vt4iub{TbSpVO1S5mEQmC6h5S)6nS0W
zlKRou&&qQ#6ZM}FZ%#Y_&yoCeYg`G`MHAnPx)zatN}ocMi;=n$`<U`~HlEs)rHw9c
z91U7op$qvb<X2!98n33oO3LBZF@kt@QW;VXlCBB(8*S9&xwX@uxu+4Yh&QbrS>H8K
z|FwmO>HYuAI(<XKsnqFD3_sg~)b?ZI4@kj^+hBzl;7iK-EuGq8$H;#{zbP1F{qrz(
z7xIg(97o+Gn=cRfYy26{ch$8)Dw_(<rBhn#sB$Ip`K<GD@}H4T6F;v?uKF%cUE&RC
zcaW5a{6xkaMSdXp#Wwy6^1e&+M^Smy$^~p|uG63%jrU?|>a!4kpEkde_p?E+k^kEA
zMW~CXZD&$t;=1PJkEAE$FA*O@%E~w`u_LJpaqoBhr-Dtog~4n?i1K%8G`fIY8RWW6
zl-Am+{xJ2+iJv7EpiK`2xnf8)DK{q_CF#mSnne3&R`xJXO+EiBRAgj;3sk<n23n(q
z_?i?#T@t))ZS-fZ(exQWdTN~>QeT=un-j}V(p3lj>GKahqMV!hHMGl1N+kJicRrQD
zq!OfFigBH!(|43VM*Ytl$FK(J7xMaBh&iOx47Sua2s>dCb`H_53FWWJ=Vpwz*9~G>
zsCz_OK-y15eSQAxs!965^54+#6#3e8-bA`jnoapz{OFyD&RBc(FG*b|$`Ry$CI9x?
zYMHO7>q`D3e9RcnumZ`umBy2(*hH{~H6B6iD*20~T^4IfV_hS$I4LjrO%@A$XHiAT
zSEueCV^qVW?2;}o<w2zSq`7X$7j_1~L<Xu#!}e5;CFNw0Y{V|1KjnwC$wyjCYDOAD
z(iKX*uGF**B+VjUlyPQ~*L4mP@eb)asV(hi;^)@S_x$4t==zwH$Yd$#w2kyVdH&ML
z*@d;S9qOuKchr<YR*?!4OJT8=v?)W|ia6fa+WohcttmgFJjKSSOZ#z@f79!Bl3;aB
z#9*rLOgc_kS2+UZh)=NcQu8ITjFxXpyP>rEmhva0*BXSYjf?NUmua7ucwbTp@(Zob
zo1B8KKd5+3=aQ^!kquA)uaJrmPeR&G+x(<)<o8*dLgfFV|6e$Y6h~S@o0+8kq@PIn
zh;<+pBOh-4e3NSb^$n=&?mHDx<SSZyKY4!^wSaOcgXro{tcJDUO?e6VvsS12vE)OQ
zv8y=s_38i6+MFT&CFRokxJzyWy=}aKiY%m-7U)cU9r8Vic}TY??;$lNHXM6n9((?I
znIM>a3hTR$`f66!jQlqi7gb4z^jZ`q(-bo(%JnIO+$4QTEPynRw1Rj))RmqAbCLg=
z#cZKn2Fe?Wm#3`j0I@#Swh!g9wg6ux|2as#uH2~e=lfTL@+(pZ9dlWOwRpe=QvGM-
zR}<T(0@tc{>Xs4j%>pJ9J4M|`q+rT-aXfWth<}Z`GGIwep}%9vN<~>3t|Wa#{+h3e
z`=1k(e<7vf4tn5G(k4~mb{j0cnVJ66NwsPF+{XBUawXcfA$>!;Ke08j#w1<m_51%7
z!PTVaq^l%dt7zPZbjJpNK`h4Vau7RCelX4=jiqh~hB4@H>_N&(+D9r$N=N<YwC{^y
zlpCS0e@N?f`oE%bGZnuR$V&M!=EmtZ;daV%$X6p)6!UY38)(0Tl#Fzf_$%5pB>y3<
zp-mNH56E{T4I}^d`iC}|NV90OndDtcO+f~Xq|sK=PAbb0D}_5qx(bn|TRxgLjcmYd
z46uZ{f|QF<Ux0i!^2PC2(!1AV>L-&@6Rbp<Mw-gs@jJZ<_GX~@@3ihk`9ASKiTy<W
z0;xR%cOWGp|MtpECbN|X;?LCU8j2_IC&m~`(&bMqf_#6s=-j7VUH>0vHOK_80|lwv
zNM2U}`R~d1Bc)*A?}`16J28;9x+>ei%5Nn<#rmqOtFntTn)o78O8PG&c94{uG>lY4
z&wngQR~Ts&jb@X6VZa1ZA?h;QMAykbqE1&Q@{z<BkS}Gi_4v~ABZx1xyxQyff^sC5
z;s*Y<y3dLdxN8e2$AHD`?tZsPvr(=~{c%!CtNW3<oea>9*e9gR8vUKC1Nqy;->1z5
zTuA$*p4iPDE@v!Wt!L>P4I=su3X2Sm3X2>V-Zd<EK%dZoq2UpsT_VDY2Y2lm*0on~
zcyzUrJxj+->hp1uCSgNjuJ$RPq*vIG*r2`vp4QD8)D8|E5Z%+M-K}?cpWp!u6WlF4
zs$WFtkat62eKcS&t>2CI3yq2z)HkwQFkQoY59l2n5!R<ibkEpa{R(+JQ8CT?Z;yG?
zzkJO5k^N$iMmA32SG!eg`e7|n=Ik0dq+fJ!_wcZYZp;|or$=zBu&$9|(ZMV)w)42~
z<gwSMbW5JOOtav~uz_KbQDMP-`bGzbM(9qv#nzjB%j1n05**&A-+*YRS!iTb&(MhA
zZlTek!O?xW<<LlX=>Jg_9X8lz{ZCbR*XaMV>$~;u^so7L+KBL||8s!<ul_#+#MYVH
z&EpA;{c2vPBuPWH^|3D&UI<98P0+JBvAU3da(fQ3f2=$07dvy)(`30ryGDoi?ZdA0
z9}pfH7R=s+cOMcwr0;-8J(}22+cSG&*X)?!A5%AeyFU%XV;{$d1SD<$VQAN0v6&9t
z_M{At>Ke)eiw^G{7W?vWLr<0-Re~eBh4!mbvSdWxuAvb<`$k1qDO;&>Osyl;1H+?q
z7Sthj_>sRd=d+`hxM)hkq~$kvO-Y!x<<_jV5BGj~drMs6%8`jnSI6|d+%x9*<syN#
zyLJtWiqgHrJimNCTjIo#iHj!Q+PwVM^l=F@<|Ry5N3A*L#FdQY6ZXa@OxXFq)H?r(
zZ5elK*{H-tBNMhxyEA)VLj0Q88&{HfQrW<>)+SDfi%ENJW3q(!SqvSs=UT~_=hvFW
zwzz&Kd6K#uyn=s>4NN_0SpwrM7?ZGRZsO)0vFrYtm^`+|za5k3+Oj)g)q;d+Qxc}n
zNSwEYTf4ntL&Dfmw>R&ib=>SEo|S&yZ(|b1u6Aziouh@!-kLaN^UYoHzVr4!f_l&v
zWCuB7|E=YJg73EUot6LI^1p)qY8ux#nP;wlz<+H^+@(NI#(+S3ec0`|M;SbU{>c*O
zeS2$Fd>sGUDb_EpQw~q-q?r?Arri8y(VayjZ?743XFZQ>l=eSvL$D{6C+<*Q&qw}q
z%M|oHOmTbEtc2+k-me!IT*y<<&Q4tYQl7=0R0;dOxix!r;@q8g=5CL>R@zh7lPzJ*
Z=>Poy&COrdQ$E1$p*?I@*3;7e{{iBr3fcew

delta 23953
zcmYk^2YgQF-^cND6O!0Fwpg+E-m7S<l-gSmdqy<&ZSPT{_TGCm2(fBaX{{Djdqs@a
zEJc;)^S#f{|LJ*Nm-qGiUE^HmI_KPXLZAQGmwxM?_<66V@%z@{DCOrkS#d{B$C;nV
zalWXftmABJ={WfkIL>xF?{S>pTRYA^+|t%@NI5;*JI*vbhC{G%2ghkf|I;{`IBzG%
z8HwBQ3YO^XIHwq&Jj`)o9mnfj>Ebx)7%-=+<D8|##_o=j9*6aCoWwW_ljD3$ifb_g
zMk8x=PMUvU4&oF&9VZhOMXt&D6iZ-zEP`ItxXoCA^E+p#WGC?k3u4Azj#CnAVNv|r
zT#c8A&*OF6+}m-|;M6{jlM<I=65NW(FxEV7o;Pn{QraJ5TF&phrIHR)^mQD6%#G?$
z2sKeT^Ak)<+z7QZVVDAYp~elh{20`ZO~xRchni;_2I78H|KsRQMdb_?E#M~V3SOE{
zKlcigq9)9a1+cK?n;~7D?$-W0CM1r>{P+m-VY>eA!Yd<>meUZMW3&G3zwXTz5<0<6
zOpT9GD|N!%I0<S;vZ5B6-||&374es52h_9CAM@fw%WpyLz(GudKU@ArIQyTH#8VP_
zXq*A=gqcw%DufzP9kXC#)Wg%)+GnCpxCXV5{g@U{qsHAvwZBBopDe=7hoCOBf|rU0
z)I;5?_Na*>Q3EETR=xuDR%}Hr_!#OQUchvC4fXmyM?DiM2f8QDj#_vbRKG^3`MY3x
z^hQ$Agwrgs7`32ii;r7;4fQ%b!;JXK+Eae*IGKs_qE1j9)!r1-V;{?pMcw=P7=TNW
zTkdt%QPI8Kg?aEW>I&jf592E=f}TkCnJ9+ZkqW3Qse^j&o1@-}NYt}50@ZISYTo&%
z^Bh1uTPHEK-v9Gd`22D1p(c2MI`LD?fd8OYoMw<aVHQ+AKk5prVQy@SWpFT-!mU^l
z@1S-l`(SqmE1(uo6;tc||CCB`Y=v6D6x0G{p{`^x>O>n+0}r8Y#ZT6L7K4bdqfYb+
zHBagxt{G9!N)F71`A|Dj8@(FX!x~1T?%^`bj5{qpi#lN(Y5@;XC-@6B{vXuSoOY;d
zUbCF}8S0s8je0BkqAqCkQ1)M2JCB4WUT$tQcbW%L{Z62E<`;{vS$xlYhFZuwtbi$o
zxzEU_s0Fvg{MZ4tBa?=)|C)HFbzFd&V57zRF*EUL%!Ch6D^EDwU2rDUM7dFKQ6aMu
z79*~Q+M%JS@lmLUdoyaM_j##k;5pRmaSOH5c+|arjCzXSp-vPy!rg(?sBu|Q`NEhB
zOIyA<>O#7rPB<8K3np6oBGbExie96AsGT^4n(!j(UR_7MHqTHK{%h?i**Q%dgc=`$
z8dnZ8Vl~vb7N`s8Z0-Hgw;(t6Iuohr-hYGYxB&I~tVQj_70iOSQT^VdwlZL(YcA9+
zsf>CyzQT^!7S->2)P-F}&36a2a}P1O-v75$bT0x%xhKeG=EGp}B~TN5g}S2FsIBaZ
z`WzUFdOK#JE?_RI|0;_&qi$s^>cl^ycHj~w;rvcK6+L9nmB8eq-GyXCO_&QcK{3?C
zRZv@92Q^^>)PmYs9FDru(Wnzm!a_I?3*%ALf}f#R6TYINjvuf*rWoUHU0u}HhN2c2
zi8}Et)WQ~+Yf<y;KrLiH>Q<dIub?h04s+sD{2bGawfDd6Sa(HTP%H0=+Ujs~1nLBn
zu?0q<cH|Gtif^$d290y$R#=@l5;bl&Cc;Bl0FR?~?%6o@Unlg8w`TzLG-pFS?L|>f
zb9K~}w?s`CYWBcf!~;+h&OyC3YfumE9t^<?m;>Ko3Cuddy(JC2RJ3J7Py?r<7O)&O
z;diK8bJ#qG>UR_U@rC98K`l7RL^q!m6BFk_Ex3^7OIyA&W+U&dMJ1R@s3k^Y0P!-^
zJzj6|F4TkvQ78Vv;?vfC0d>o+qweuT)c9nR+zZKsy3hisTU7;{>HB{ql{F-O!@W3S
zvOA#S6!(^Vj+&@F>LKcdT1X^nAtO*bG#+(=Z&5qA9@Re<^{gC2_5T(1xo`zD=>305
zMO&S0s(Y`qVglkam=w!nAbx_Hr~&Hpq7CZA{m~Ccn&VLYCZitCd6wUankUxcqnK3h
z{|PF|@B#+oZ4AJK)7%pzL$zl?-Q)bIr@10(;nguYHbnJnhgx7y)P;;R$DkhO@u>Ni
zqE{2HqmmqBQ5}9nJ=M2Nzv<jB;(Vy5I1IJb<50I^KI*Anh8yq~)WbD=hP&kpQ43ya
z@p_B5&tU(H(GWx8ON__jSneD5qqQ6A7I;xBo`NZGHfq5uQCqwn^;Vol^}A(0G+&_Z
z{W~mxely*1MQ5`AdPwS#(1gt}C3Z%A;zgkD*$h;_`KSf0LM>z)md1nD{ugQiAFvPx
z%yP$-#@xi!Fd=rr?AX;yMO!`IT#q`z&#0}vgj(1Q)R)bls4MY{az9{_VH)E6sCg=(
z7S;~+Ec8b8AA-6Cqs@t^g?gt`(Fx~bT3m@bVGQbuk6C;cwSeoWPqvq+aj9p!C(MQ+
z#D!7g8lx804z+{*Q70T~@mQpv*O^X59p|G~ya`j|9=C(@lX(%-lD~!ek?JLChmwEm
zE+8H1gC{p?i)*7!{2A)RjZyc$4f2>d<1wk;{|s~7iF2W@pe*Xj+M*WL9rNNa%dbFP
z;TH5Q)cgtc>|DcO{1bISDdxHh$%48ydCk(8Snq!=Rq%7vi5sClP}*X8?1;K|gUk`A
zhi5G6HCu^#Z4a53F&*&>)cAmT?uBGW-MSK}_WJ0}K&7K42Ak7SSF#edh0&-5?ML-L
zjGEwgEQya%Tby&gn=goptD$z_Q`GpTsQ#_6FixA#{+FN<OG5AQAE>PjT;RSg=}-$P
zkDB09)E3sad>hox^g^8|95vpH<#94<{v)Uzeu<g!9qPh@7P9|J<Xq_fO+{tY2|J@c
zIwMf8PbB&#Mol!?@-tEW=A#y{2=&aYNA1u))H8ApHSZl%zZa+rcD#$+E6axEh;yM%
z&<b_pP}IQgsApp^>Ma<DTF`vdR<A<!-)!+t^8o6E$59u09<{J1s9WjvTkM`N3u?k#
zs18L?6W2t29@N7e*b=pX!5D<o%+(k|ydP8HUGt^2Ctl*d71>d@uo|*6UZ;UuaXO%`
zG#s<wXv~C5P*=7aHSzc6IaL4Km<OMuo`s;LuGvr*kQ;RYg;6_D5p|22`eLu+bfcmZ
zjzLYd6f@#c)B>(y5&RpoV%}x$XMRo8M3JZup2?_(bQ5aJx1$z*0JV@GPzyPOx|P>3
z&`ae36+I*`Py-SzcLyX#-J=Ys6Bj`}wVzvi6N}rTZe3UO?I4yU9*vrJC+5fFm;;}p
zJ{MB0VE?s}5GqBnB<kLTqE6Hg^)L>xcoeGt6b#0>=({zjt^Xd?{|C#TLM`Be<>OI1
z@fdZUzgKYoHDThF?iHj#oj4n6U_R8tSOGP01G6b=f;Je8JyEx4DrzCISOULC^?Q!m
zNzW?xgC`?uA+=Yr|GFm)NMyq{=(}Qb6ly^eQCmC<b<Y>0PP7gEa2M*~+>09jGwK=m
z6}5nysCk~CF8B@VRweSTb{o>8R+Piy{HO^^T3ija(9bMxj@tTA%XdeOk3_wmBT*-q
zjatAei=$BsJYsrJTEjWi4&1^|@B`|t_+*W{zz(Pd^g!*vAk+e;pmrt-b)qGx*K9ND
z7W{~M*xsTRlxnTpFBn-cKmSqDm6k_;tnD^9^)V4~GYr8t=!av_cS}&?W}&WpDQaui
zVQJifiSdEupQ0A_4)uBmt<x>z{uifGfJ6-}i#<_Sv;sB3X4IAKKrP@1Y6pI__AAzY
z+u~>FPy1`siJbLroC!5PCu%1`l-K)TmWsBvDr({{P%CYZfj9)Ukg?_z)RoRcy&X$X
z3yen1bJ*I?TK+2PZF+>7_g~b*nsEdBuZN`o6?LeBy7Dj0R;U$+p|-jQ24Exx;z)}p
zTYD5HA-@cD>o%e;Xgg|QM^WQ{K|O0%Hn9KNqBkV;372N0yTW4T=ctZhs1=XFGB_J^
z;Yrk$|A|`QJJi+&ZgM~IGGR{QnwSqeV-cK+zhdkr_P-#N>6`g+3-_2oTlmT)9*8;c
z2I}ki1Gd3(TixGcXQQ5(->?{_*v60GSQQ815Ddc?sPnYk?*4)^7WGi?^it6kUd254
z7IlR=zH>V^#X`j6u|9r>`r37(-4kcTMucA?Yjc*P+8ge0zr4DkKKVwY?)`k!!?^>K
zqjw*bR8&r4TD*ek@QLO9cDm0-ddyBfAF6*H)CA2j8HQm}3`d<{1nSutk9t<7U<&*e
zN8u`bsrNr*7x#rk));pIqcE>JVmR)_8d!9<d++*Te&Quq2ajVbOtHuPnXfzQ;ah>a
zpmmrL_hArTK<&t%m`v}#U#$Dkq()sqPSh0?L0wrH)Rok<xGw6-n_znEh`O>ts1r;;
z?a)$l8*0IaP&@Gu^$h)mzW2Y;UU!RIq888-Ghrm^y`O2$!_34>QMV!%^>F@<dbr+T
zFy`6kE~GXlA#RJBryHikzNqtf(W@(+LPbWQR=5yDaW(1+{r9^&kPX!@mst>Xf|95m
zsDkSM1!l#LsIB&*c5DvnZCHhcFv$V-Un?nlz@4BbYRem8YHWwv(tel?Ct@jFgF5kL
z)aO7P>VyFY-7CwBX^2apZpA041vW)pU}w|<`W*DSi3KF|kgP%t*pHgvH0l%U7HT06
z%>>`OuW4q?PQD@Pq3esffPtt5j>c*@4K>dxRKJU;TXNM)Mfc<mYHMGhcH|$_O8pP<
zJYZ_fgTqk^TY;KrC#wHmEQ80fIR1;;`l5&3{<TpT&;s=^_d_kzJJ2elu_}ofsFj_@
z3U~oaV#*`-QHp#<Ih`>#W;p6v5%me!4z<APsLzq*m=|}U=DUj8=?uqw|2oF^KNUUI
zJx~wNIMl#}SQNLRcIJlV<I#`!9cK0LGu;pFGm!nbyCXGFJ69JqZzI$#?S*-9IBLgN
zVp_fb(Ny$s9LJn^5p{ysm<a#HLYVMJ_cbeq1&CW=9vq8W=z1)Im#{D<KH+}pl)@au
ztx?a)P}H~un49xE2d&`_<|0mT(p^Yi%tu@oL$I&q=b(0IH|n0ALQNcpS<vq%_iYG9
zeU4N?-IC_0o#=s8*}0+UeL^MnXC5NlaGHk#cb##+Y>u3z0|Qc@b3dYIVsHZfy#NQ3
z4?52ijx&*0+DUhTi(&jPxRH3)Z+xK<SG~j+4snIc?m`};cGz>p-v7i`+}9%wrluha
z>RBja)<SJzOKTsD0mM_VAkIcTqz6%-6VFjQmg=he43xuQ;;&Hs2cY^bxyt30rLvC%
zx6OHh(TcCRTh;Hn`x=cxeS*z1*Pym?2PVN|mOqPnt*)Do%-5*5D$xzMJ(-!wYn2eQ
z6slu&i|bn41Ov&pwtN`sH43+QinY%}jbCA|H@Be{7GoYoJrmw@R5bBj%#V*zTOV}O
z{aP)8YM+RjcoyoRoNpd7AE4S(-{Q9^%!vA^?ut6`LQIS6Q1k6WUPG_*gLSxQ-mwl(
zEq-hI-*zWThgp~)r^Qvw&&}qTg7(g+_j~~AO2=3{2X%pKe0o_4mFy&bF`uCZq`KpF
z%#C^|D_C653^gNB3z}x}dh?)p!P*~L?0?t2b=gq=it3c5qAjXpHb!k_2X(-%s1-+A
zJk8?8s1rw9e8$@2%$H`OICp${vyfQ>eLw#<r=k<~MBhVYPC@O=DvOVxPI%Sg*JkQ_
z?)ZYJds_mv@Jbff!<@uTEgy-x;0gD*|9a?VTVlU?()<l|!n>Flop^VkznKoTz?>FW
zM=hW}Y5~nLA$GO)p5`FbyyN28e@(pH8rGRR&BLfKkuz8bA7U=daNqsRuYmd-=!TkS
zFzU)in$u7VTwv{cEdM>~AwA`_%2n&|$b62P=nd*&O#HyTHJMN+Dv7$X3K)o0P~Qc0
zQ73GV8aD#<T`?1NYuBJI=%B^k%TzSs3)BhUVj%iIbRU}3sFmh3%bK;#Ca6!wPG*10
zdr|XDH|Lov%uTLdXBQPM;Cs|PJ8u4F#+!ee{*U-{q+bx~t!RN7-v<lgK-7tsS$+fR
z!nULOAF%j5rs4T>Zuu(wJZ}2`;ZBelHE|x)Ru(d=qP{a4p|*6Qxg2!?v8WTBwD=}!
zo~P#Ds0F^qWP1Mt{&YK}$7IA=F$os1d}$0Ju4L^U&AzA;4nr+)s^yoOo6J4t52%Iw
zYVl?C>V)xBw4%SP!+YzH=&`$?G^l|&P*)s+>R-*;KeM=*#T`)nds`e~j>5X+r(65Q
z$LzmWevO1Ce2TiFx2T0BdE&-FsP=r=7E7R>;u)wDZLs$3n38xeYWz>A`7fdRJwna%
z9QBsGd&2%Jk>#m7FfZx~%b@OI1JuCIs0n+TgUoT}EYyjXn%`Oe7;3&>EPiCZHWPWD
z*%qTtl*0_c<itfVC00T$pq{n2u(&<yqqUbg-P*UAF{p6|FdzPeTIdVYoA|lA!c3?I
zltc}vVAipGW7I-gS-yuEX^zF*w9iESoWIlZPf+u|GZVgW=TGA5b%HFB2W!%?gvAk<
zhIkYf$JrJiv-lEfhXVg{PY{IKiR`F_R=0dZ)I8129;jO~9DTq4&!M6fuJk2%m@JOL
z9OMsJ{yOSed4zfJB^JiaFWm*!MSU&|!Vuhw`W5UV>V$t{dQAMvT~Jo3_rI7WYNEcC
znxanBA9X8+niI`$Q43ySu1EFXW^pX)iVvaYJCE9#r>K5u{&wfhie4oOP?4oj6IU@m
zG3%ig@)hdJ+gm)=oQc}<C8&G91smagT!a;0vm5vuY9}VVab5O?_g@q5A)yohfQnC9
zeA(h#sDY1BSLXlL?U&iihZ<iR^>ckC%#1BD2qRDnoQmqV2z8#7Z`pr+)NZrHUhDXy
zc?mV(zWD?-@D*x73IB0-E-R{Eh*<>Hue4bM^(-|&?Q|c@5Assc%Ep=Bq9$66sc;i&
zqW!3WCsF;+V*<Qu#-kpthnNVRckb_ii7^FXZcK_Lu^3i0y?v;BMPdnRYoD2Z|GEna
z!u;g3;|i>cz7tuy^WN>}Z>BKQV-5Oe#d_Ed_3Ugwo#za4VP5Ap6<zTYH{rZ86Mk^-
zT`JTL<VWp58C3sjW*xIW>ifS5W=Agu;1bl1t;N(BgX!=DCf4`=bt*bRocY}RfLd`f
z$Kz`+fm(T0)a%s9@&hn4@krE<WD7A9F2!KngBkEL>J~gho$p`tz5hu(?tpBlD=dfF
z;u@$EHb*^dJ<KtdUxezv)!c*HnIotxKZ!cguc&!$qITki<r60GxZnS&sHj6WREOfI
zfz{3WsAr&+#bZ$Yzd<cvCF+Emt$mky1a&LUTKohx?w!Rc6MEeDKWjpd?`bb!RzxkJ
z9%?`f)V=MATHqYiYr6)uGuyE&p2QjG@pE@@CT1aCi~0^Zf*Svq<^2+QJ-**kgA=(O
zo1nJ7pT*<N6{vv+P!pX-_4{D$=@YvPE@4(h-HLkVSC(&y+OaOE3+v~#hB2rC-&n(3
zbA!3xJd0Y$9rK0d6Z*SbodLBYWy}Vs6LqzC2x@1eOz$!(I`L-I7Vkg}xPkhC;W=u>
znFBn&-{13~;__xq^9xk}X66ViLc9j`7M(|pdxLr=5(fIt<8^XT(E`e#uB<X@g<n{{
zrNtf0-l%&$1VeB;YWyYiEgUueIqEh1fO-ZpC2{93gKDqs)61uyCEBAV>SYcvhgkb4
z)Cs1W%TWv7VeLoFbEs$II%>YZun_)ZaX$X4P5Gke`}x0&DkN%}Us{JYs4eScac?sM
z)qkkP6HyD9VJ<~2bgQ)=M$K~q^+EKj<sYK&=l^F^bWh%+CeFrR0&0SSsEMnfwy?g%
z-BAzOU{t?Zs87VzsPV_m^QiH+EPjTX=RInC=H$Hp+KN)i-GLR&x@Hs9fKZEvqxw&_
zc&51owdETvK7=~)Y4bX2fsaxBQl)So=8zP;|9WaGlF$})M7`g=P*<`THPHstiDNB)
z$l}weaTm-R<^%HuYW%;b`I4t}=gExvde7;lqAe_mny5Ca<Cmz9)Haq6vwUCFtr}+W
zLM%+Y4s+oJ)CpgsJ|P2Ad3=94ofb8&Ch9z)s0;G;v`V-&3`V^+V=TWIHQ_3YcbI!o
z3q5S{8PvoVEq~Me(|l|Cr*>~aI^@E=PC+UfSOvABx~Pd8U?psgdIsiNdo=3(k45!+
zhT6gRs1LBzY20}#quOhs?s-GYcQJcopuYbjsHo!z)D}&#cmrxdF{l$9u>3jmy7>rw
zTW$uVbx)WPHE&T=dnME_EcH-72eg!&-wCrse{(qM-c3RcoQ>L{Rj3KKSiILfhH1&4
zK`r=>`4H9r8R~U=kKHgRog0rt-_QT^spteNQ3E!kCW=KpgoiAD5_O{AP@n0KP!p$0
z?~W^AmNjdc4N>#8wYW3tht&S*dH*#*q;>eloQqn}64VZ?L+!|J)R)Q;)P&Eh{WWTy
zfDEoVQR6G3-uq9m8g@Zl;2PBU=nTC7O2k^?xOF&<`dRLZ#W$?|5Ay};EqQBkx*(6^
zN1O%qtOTPLUJ5mTEz37VEwq#6hk2=JrIS!Ain4|Us0r4ZF{pmWt^J(kubYoCEA8)5
z3&@huwWwJGHNJ`24s||nH!50TUvro_$(&=ZG`FD!?nj;QC~D$cmVadV=cp@9naS;!
zAN8wPZPfYNB0n{IogP&5Q8*6s;~dO^2T?n412y1@`3}`DFthuKR}vLBMcwNWxF46H
zKHA%5@%aAR^6^-Q_##%oZ2aS4dcFV6si<Rbtcc%Yc|42y;0es;PMjC@@YTiUI1oqU
zDJ+c*v%3o!hx)+Tg1UgC7N19*=OG4TnjFll_rDYsed#nsZP|F#>$Mb%;!&K1FHrY(
ze6Z_$RR2vDA4A=WOQ;>YjatAHYyV)T$?4|vqE{1^p`xexQ)}pmnjqZtnp4gBsApge
z>V%suAA@~~kK!>boy+6<x1hJEXXUfp9^bF$U2r_{*xbDTpHfMh$Gs;_P+L45zrcOi
z0t559-vu2}CtiYD_-fSea=TH#+nq9Rpf2DUs^5EyQ-`?Yv!mMchIrjXNlR2f-Mc!d
zThIpeoiGY@@0OvSi62o{ei!xdJ+?R~pU3zA1)meO&_$?+dnKy>4%Cle2Q0qerJ{~E
zQ1|K{YO7wEY4f{Jd2!UeZj73s7iz*Ws4JOfE-=@kJ~4Ng2T|uaiM8+?>Xv)c7jPSj
zp(ZSAR!2?zIcf`=qZZi1;vwcVa~V#iJsQhn)q?K$NYuEos0GYM&9@NwF7Y~BEO8h^
zX}Ew|NV!7pt*Bu(N9B8?CX6&Em~&AJUW<B$c36BHwR2A_4k+x7PmjLu|GZSRqGG6y
zHL)_b#%wqbHSsR<2x=i`QCoQ#b!FL$xZfFhQSAj#<4U30tDAMr2G~pQe^V+t@nO_L
zuAl}!w)h{^6{RTZS{c>9hdBoIkS;=fY3)TV;2>(A6R5v}xrkawu43-zO#$@gCDDqC
zJ~~I@N?d{Z8;v@}?Z<D_+b|rp^(#;d{SNi?AH#z9*z%c5xW82wM!hW^Q2mFY-mV#_
zajQ$%&;O@MXr&iWE4+<-vpNqjH?dR7y|O&0E6b0Xu%uZV_0w+))I38`3!RASKM%E#
z6{z_Spmyq5Dc=7QR8El4NAN#b3=5Zbuc!^GeFCa|532p4wP!Bl@%=|7wNX3N6SWiH
zU;*4~`8d>0Cn@XpD~{^d)JsJjM_R)M)YhLdAEIteqH^v%&WDQYSlkV@r4vv;R4zs~
z&MBwM<Jhi%<0hp!xez~oz$Mq2QY!)PA74gJZW{8_u$RP0%4g(mq3@usZ?`E5=))cH
zt-Ld1x>CPEx-)%qP!f^rj^{BYeZQdXPs-=?n?|mf&6%G1JaV%V@cz#u`3J$*6uwEF
z*EH_Hk4ItRJWQ6JegjC3rKF-BK%Y4{hW3v~N#e5v+#Tmj@{_FX8}hwv&Yy7|eWsAp
z=a18x%2@08C8-3&ljwAfToPX=elMhco_YiF2k681lJl*#wWO|N5q-X(zJYqUFT*dS
z^yx-@0A8W}B<=GlJE-d@%Jb(uqA{UOrsPlLMpC*`Z%@aUlv0$l<aGE`kEK4AqVI}w
zzU=@1af0eF`c%h0^x@;<e}^9C#*{L4KCfOA9iLjKf(-n4Y@yS3>sXvypd%OUy(#-G
z|1I@FHs*Iz{k+uqn)e-Lsn?|cREy_Q=cB^Oulv8A##bbcY5*tsiTWn$tF7}+oI<Q)
zGWFrqSK=l5rJ|mYa)q`v#1pZRI@&QA3sVA^w;uhD*_`Ld-6C$EK%c)H+3f1tk>s1#
z_cz^@$UmT7$p)$45dFb%g_HgF2qWN4b>hgsU=AIrm~%O~Kw{oXrzYwL)7td;osxh!
zm+pTQm7yd?qmGW$n^JW2pd6#VkG5BoY?OAy{jKkhjL%QK1N{n9*Jnp8B{_Y5C12J0
zZ728fxc9MwzU%*o%2P@VgYr@yF%kUlD8M9*Nd!^WQ>N0QA3}7@ARbKruj$jtPIjF5
z<B`mAiqBF{O#dp>o8u7O|CR);DMuNUljO&vj8*hMO!OyhizvOx@ps40L`r|k$0I8f
z_hM{n472<@4533X`3Nj)bB{J#({~o%KTc0Nru@%jZ|SgvMjg$_&%uS5p0eJTWtUh~
z1pVIAFO=K@oAkbo+f3i-lp~aQ+I}HlpMG1B-%Ffp6yKr!zfOlPHi44!==2%>jZY{U
zX{&%E$koE9lo{&C@s@ga+WFpc`V(Kac}7ydM_WV6P1^pz;*_<NINH9)1{7~nuB0l7
zUX+i=Ee52v6&9mYQ_2~OpW#&Emz<~%eqtxo*l6Ns6dg0Hzrvi<4^X~W14kF?i5M5?
z$Nk?!@EyITlGsh-1zbW&LhdB-D%_+|cC^7?tzOOCVJ2j*%=Di{*-UOAemw3m=f@)v
z7u}b(WeI)Hzy4{3LWk$psTnRIr=uSoBZ(j55X&uho16$cK|0GfvRKVqDG!Ku)0T?z
zjyM|oF;@Wf;yRbkA7q2RA~D<Q6X;lrvX}OPsH1`ga9qS5|2dIzyUCrP-y`a|Dg7vg
z=<^13w9*{J9c)~jY1hw#<m<-AC>;w>?lWO1ozhxIH5Z}ir=V%JkYlv9rSEMl!j|qJ
zp9X`8zq3A{(tn)Q_fglOzXv!-pE~^f>C9w;T-HI2IVhtkNy%>|pNRTc^e67dpqj*s
zh?`<2;sELkDSe1jQ*KcP66@$`R;FJK>IEqmsq3greW>354@?|R`FISW!v^ASNfg3!
zblhs~b*NvW{YM;cxop%^QuNQPI-XMBNS`ro=#;14ma>`>Nzw5ueYEwz>hpgW$qe`-
zR->UDr6}bX9a@t60h3U&P(MV!<FtKFT}Qn69Ot<yXCd{BlusxZ>0g3da)Y{#KPXv<
zKOWwFOg4<Nh0JvH|4$=-0pk1dnctp$$9UR9Y@)|DgP-+JVJ@YQj->QkK{-Qt%J@1M
ziqmOZOS$CE={|ooX#9(T3+zNgiBHq%F}Y$kaS5Av4<4~PU7QzI-(*(7uPJNP$Z^y1
zs(-`0M^)ii%DKGy{{N0jGdJh^v#<@|FR+}PoV*Y5PYj$x(Q$#2(H1qy`Yxa?*4k5$
z3#UHP;v39!hg_`ntxueYQdhCAzZgMx9D(N;^fPrG*XXc?oF6&;Y=4;e0QEuC(^D!E
z|EozjexqEZ?5BS+au4a3+!pzkoIh>)eP72bVjXSi=iN(ilu9eg5;yPrGb@9WP(CI9
z1CyPmUr8IdksgUDXJ{);(NUAO>y*msW4U5fzhLYI8}~DH9UrWns@L~lqPL*-1<5^h
z*i8AFco%V1N+U`;;wCmYEAcq$nOWR&Oh%iITrN&QyK03ED0;(m%%r@e{u$$=C{2i;
zY5&(T$<HK$82AeY)2W{gilJ>kr6QdZ(w>hpkvP)Y+mhF@&Bghb{A}hpMW1SvLlhlz
z$^T1zqm5fdE||G4=*Q%`l<_3G<0MQ+Lp<KM&b^uN03`?cHuM=rn~q2q=Lr5wX+@ik
z6gKWY^*oGAZn2-~>%<>9h<lf0()u>=FS7=XiK+ii2mVpRcdTZj#MCFaq3_R<^!dly
z1I>2$+WO?Q`C1WIBmX|?T%EL0H|zMRc)ufiP|MRSltaX|ZRB<0Jd{zyUGNnBBA7wP
zdCCZKV~B5}j+3;%CVoOahBA%Pg0}C;|3Jw@tm7`ZhxF^LCodP5t|JY}W;T)HWt0Mx
zD&$g7x={a}l7ar2m~1{}C;81-iE@?FllVOo52CLBxy=6_D`{)-pWFstohPp&0|ICa
z|4-w`fwyUkB6vglRq8s9Q@RpQpnr(vl9&r=+e_PXVh_HzIhWyd;*kHG<2T}IAK!~}
z47fshK!-S+tRl{#bS0OQiFaAvgB@(5AnLOz^O@{#`skQR{o^r#dUfmj6Un|-S9>tU
zo1Z@xGeHYVMLI7-9W(wjNp0#|D3{$P=MMFQ)SFu@Uf8&O*nu*DvWI*<JcHF4^O}?A
zru;(A4zE+6#3G`vD03-=xxe%AFFMu1UJOh|JtOs9lv<RM6puYORcJd+pX|i`%vGMY
zcc|k}>}2&-cG6xrp8lWUOMUYENuVRGb$m`e9rd(y_|^txGJPHSV-#b)q)%#2x{bDO
zlv3oA5g)R7)VC}pJ-OjFez1}p>Fk_~IlpuHKa=<MHS>y)E5N`qbZkiOH{$Opq@0zM
z8=T~l_04A9CfATY>nNKjI_5Gy9}cE%B_)HMcntL>6mN4nj<e1hP=oqpI%T18F{Kgl
z35>^YD0yk?gddMU+H?%G+-*1f-=9&IzlUM;EyDOw=to(h-#k}Q$zt8FVq-eAwn6!*
z*P}fxm%Wx;O5zIi`P<qx>=dOXeYVr4<1uX=F%3B#*(t-RM^o-lkD)!(+P>0n9?vXT
zZeFL;HtJWIFbAcm_MD>)x!HIYQ&XDSA}ae@*%|!N>N{z_YztEA1*I<i{~=$OdI8jt
z!Am8n1;3Cu@t;9yd|m$kj|xoihxP4dW@2&I=+cC?hnS9%mU5VR4wK7I(Q%SEIc8?u
z8%hyMA&Pet9U4=L(xH%D>0fjlNBNB0U0g>;9p~vc5Kj}op}vCBm-6vANc{t27LZs^
zeK7TH6diYn%TOjVwi3D0lt&4<|J_OIsBLD!FRebD{9#`!Un&f2PyG|hYRY0Jn1wUR
zm!O`Cx{jWd{^VX^VlF5eKczi8WjEy;;`Yqn34i<eH&5?q&@q{TZS3TV8xVgy29e)j
z{RUt|+6vM5;bRB<oU+tn5AEeCqZxOE{v&LzuZT-gA4<QlmNfi8Vi={UCa_LR$yX;=
z&nCM|K7rkyht!|Yc8ao-_T%&|PyKK5Ybk4pA2`t=t*@txD%r1PR8+s>(Wm=)JpP@#
z59rq`bZ~U;@O+-6!C`$uJN60-u3x7{RJ{Q^q7p`w2<Q|V5!SVD_~58~5yKM&M-1*4
z7CkSbSwQsjVP7VV?l7^7e^A5VK4B4&eZzYO4+!hpJFHJcaM$p@1N%iEozcZVy5`(C
zPf&0~c=xVd!@`~Vp?wC1_Ubh_xO<;|10$m2=6CjZYD9m&uwBCFJxk66Mn|p7?H7G=
z)A0n}&l(1YcJ3S=Hef(-M7Pk0;O+y0yL1m95E0xvG@?_tu+G5|eS;&r_v#hgF)VoC
z0OC+}3=3vl-!8sdr|>YAu7&|&5k-S5cMPxEgbtm<x`Ynw6%kyJHFWN-s~Zp;8XO+l
zr*q%l?&Rv5AiQeS@F}?i8V~H$jTtINo%<(u^wh0y6Gv~@mCBQ>clSPBKVDRHOw1I&
zw040_T!VY}?Hm?Wec!I=5BqWiM(6n<-V>ei$J(B#uTNBp-gn|fhNxd|c8#iWD`!;i
zTfe7?pS0)R;xX~F*WH^K6Zg%u__f=j*WFI+NfWm(Hg4jsdy_`qTQtdSopn8ZRP3Ei
zQN8aLO|*S)+{BGhQFoiFwq#25&AZqAqYwWvHc51|zbE)7{j6d9{+ai-?2O+#Hu~!O
zw*GVX_<NGYbWQA;l_1U9HF5m!rrnz~C2sP%`v;=p#;uMS7U-Gl7ZaSqlPWN#QjjOm
zFQ$1G&zc0@_)VMc?jCt}_lCHsdmfCN7B_KQ{DQIC<+w%L;uepL+cy6Gij6Gp?*2t_
z6Bowqjivei&aro6*Sh`gj2x|<4}P$B-u*4B;zsUc<L@tD7r!d@!Gan07R9>Le(ZH`
z*}k}aGw$w=y}NhygOPLNW<<Sso3_xCeN*oqm=d>Ubj1=CN)|0qwtUeNMT-|JS-NnE
z;?(%RB33C`Jmy_CPt!y(eR6ved6LC#S#WReuKT{LjS0`=Y3-NR4IGzy>y~r2xj*Ok
kJdHV4z>_yH=4naKB2Ucx(w>^0xi8CjO2?Ec>uKcoe^a7gg8%>k

diff --git a/apps/locale/zh/LC_MESSAGES/django.po b/apps/locale/zh/LC_MESSAGES/django.po
index 64901bb1d..ba3f42c3b 100644
--- a/apps/locale/zh/LC_MESSAGES/django.po
+++ b/apps/locale/zh/LC_MESSAGES/django.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: JumpServer 0.3.3\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2021-07-27 15:57+0800\n"
+"POT-Creation-Date: 2021-07-28 18:36+0800\n"
 "PO-Revision-Date: 2021-05-20 10:54+0800\n"
 "Last-Translator: ibuler <ibuler@qq.com>\n"
 "Language-Team: JumpServer team<ibuler@qq.com>\n"
@@ -25,7 +25,7 @@ msgstr ""
 #: orgs/models.py:24 perms/models/base.py:49 settings/models.py:29
 #: terminal/models/storage.py:23 terminal/models/task.py:16
 #: terminal/models/terminal.py:100 users/forms/profile.py:32
-#: users/models/group.py:15 users/models/user.py:551
+#: users/models/group.py:15 users/models/user.py:555
 #: users/templates/users/_select_user_modal.html:13
 #: users/templates/users/user_asset_permission.html:37
 #: users/templates/users/user_asset_permission.html:154
@@ -61,7 +61,7 @@ msgstr "激活中"
 #: orgs/models.py:27 perms/models/base.py:57 settings/models.py:34
 #: terminal/models/storage.py:26 terminal/models/terminal.py:114
 #: tickets/models/ticket.py:73 users/models/group.py:16
-#: users/models/user.py:584 xpack/plugins/change_auth_plan/models.py:77
+#: users/models/user.py:588 xpack/plugins/change_auth_plan/models.py:77
 #: xpack/plugins/cloud/models.py:35 xpack/plugins/cloud/models.py:98
 #: xpack/plugins/gathered_user/models.py:26
 msgid "Comment"
@@ -99,7 +99,7 @@ msgstr "动作"
 #: terminal/backends/command/models.py:18
 #: terminal/backends/command/serializers.py:12 terminal/models/session.py:38
 #: tickets/models/comment.py:17 users/models/user.py:176
-#: users/models/user.py:747 users/models/user.py:773
+#: users/models/user.py:751 users/models/user.py:777
 #: users/serializers/group.py:19
 #: users/templates/users/user_asset_permission.html:38
 #: users/templates/users/user_asset_permission.html:64
@@ -179,7 +179,7 @@ msgstr "格式为逗号分隔的字符串, * 表示匹配所有. "
 #: applications/serializers/attrs/application_type/vmware_client.py:26
 #: assets/models/base.py:176 assets/models/gathered_user.py:15
 #: audits/models.py:100 authentication/forms.py:15 authentication/forms.py:17
-#: ops/models/adhoc.py:148 users/forms/profile.py:31 users/models/user.py:549
+#: ops/models/adhoc.py:148 users/forms/profile.py:31 users/models/user.py:553
 #: users/templates/users/_select_user_modal.html:14
 #: xpack/plugins/change_auth_plan/models.py:47
 #: xpack/plugins/change_auth_plan/models.py:278
@@ -515,7 +515,7 @@ msgstr "标签管理"
 #: assets/models/cluster.py:28 assets/models/cmd_filter.py:26
 #: assets/models/cmd_filter.py:67 assets/models/group.py:21
 #: common/db/models.py:70 common/mixins/models.py:49 orgs/models.py:25
-#: orgs/models.py:437 perms/models/base.py:55 users/models/user.py:592
+#: orgs/models.py:437 perms/models/base.py:55 users/models/user.py:596
 #: users/serializers/group.py:33 xpack/plugins/change_auth_plan/models.py:81
 #: xpack/plugins/cloud/models.py:104 xpack/plugins/gathered_user/models.py:30
 msgid "Created by"
@@ -529,7 +529,7 @@ msgstr "创建者"
 #: assets/models/label.py:25 common/db/models.py:72 common/mixins/models.py:50
 #: ops/models/adhoc.py:38 ops/models/command.py:29 orgs/models.py:26
 #: orgs/models.py:435 perms/models/base.py:56 users/models/group.py:18
-#: users/models/user.py:774 xpack/plugins/cloud/models.py:107
+#: users/models/user.py:778 xpack/plugins/cloud/models.py:107
 msgid "Date created"
 msgstr "创建日期"
 
@@ -587,7 +587,7 @@ msgstr "带宽"
 msgid "Contact"
 msgstr "联系人"
 
-#: assets/models/cluster.py:22 users/models/user.py:570
+#: assets/models/cluster.py:22 users/models/user.py:574
 msgid "Phone"
 msgstr "手机"
 
@@ -613,7 +613,7 @@ msgid "Default"
 msgstr "默认"
 
 #: assets/models/cluster.py:36 assets/models/label.py:14
-#: users/models/user.py:759
+#: users/models/user.py:763
 msgid "System"
 msgstr "系统"
 
@@ -1151,7 +1151,7 @@ msgstr "用户代理"
 #: audits/models.py:105
 #: authentication/templates/authentication/_mfa_confirm_modal.html:14
 #: authentication/templates/authentication/login_otp.html:6
-#: users/forms/profile.py:64 users/models/user.py:573
+#: users/forms/profile.py:64 users/models/user.py:577
 #: users/serializers/profile.py:102
 msgid "MFA"
 msgstr "多因子认证"
@@ -1641,7 +1641,8 @@ msgid "Show"
 msgstr "显示"
 
 #: authentication/templates/authentication/_access_key_modal.html:66
-#: users/models/user.py:463 users/serializers/profile.py:99
+#: settings/serializers/settings.py:148 users/models/user.py:463
+#: users/serializers/profile.py:99
 #: users/templates/users/user_verify_mfa.html:32
 msgid "Disable"
 msgstr "禁用"
@@ -2020,7 +2021,7 @@ msgstr ""
 "div>"
 
 #: notifications/backends/__init__.py:11 users/forms/profile.py:101
-#: users/models/user.py:553
+#: users/models/user.py:557
 msgid "Email"
 msgstr "邮件"
 
@@ -2213,7 +2214,7 @@ msgstr "组织审计员"
 msgid "GLOBAL"
 msgstr "全局组织"
 
-#: orgs/models.py:434 users/models/user.py:561
+#: orgs/models.py:434 users/models/user.py:565
 #: users/templates/users/_select_user_modal.html:15
 msgid "Role"
 msgstr "角色"
@@ -2276,7 +2277,7 @@ msgid "Favorite"
 msgstr "收藏夹"
 
 #: perms/models/base.py:51 templates/_nav.html:21 users/models/group.py:31
-#: users/models/user.py:557 users/templates/users/_select_user_modal.html:16
+#: users/models/user.py:561 users/templates/users/_select_user_modal.html:16
 #: users/templates/users/user_asset_permission.html:39
 #: users/templates/users/user_asset_permission.html:67
 #: users/templates/users/user_database_app_permission.html:38
@@ -2289,7 +2290,7 @@ msgstr "用户组"
 #: tickets/serializers/ticket/meta/ticket_type/apply_application.py:77
 #: tickets/serializers/ticket/meta/ticket_type/apply_asset.py:43
 #: tickets/serializers/ticket/meta/ticket_type/apply_asset.py:81
-#: users/models/user.py:589
+#: users/models/user.py:593
 msgid "Date expired"
 msgstr "失效日期"
 
@@ -2585,60 +2586,72 @@ msgstr "RDP 地址"
 msgid "RDP visit address, eg: dev.jumpserver.org:3389"
 msgstr "RDP 访问地址, 如: dev.jumpserver.org:3389"
 
-#: settings/serializers/settings.py:147
+#: settings/serializers/settings.py:149
+msgid "All users"
+msgstr "所有用户"
+
+#: settings/serializers/settings.py:150
+msgid "Only admin users"
+msgstr "仅管理员"
+
+#: settings/serializers/settings.py:152
 msgid "Global MFA auth"
 msgstr "全局启用 MFA 认证"
 
-#: settings/serializers/settings.py:148
-msgid "All user enable MFA"
-msgstr "强制所有用户启用多因子认证"
+#: settings/serializers/settings.py:155
+msgid "Admin user MFA auth"
+msgstr "所有管理员启用 MFA"
 
-#: settings/serializers/settings.py:151
+#: settings/serializers/settings.py:156
+msgid "Admin user enable MFA"
+msgstr "强制管理员启用 MFA"
+
+#: settings/serializers/settings.py:159
 msgid "Batch command execution"
 msgstr "批量命令执行"
 
-#: settings/serializers/settings.py:152
+#: settings/serializers/settings.py:160
 msgid "Allow user run batch command or not using ansible"
 msgstr "是否允许用户使用 ansible 执行批量命令"
 
-#: settings/serializers/settings.py:155
+#: settings/serializers/settings.py:163
 msgid "Enable terminal register"
 msgstr "终端注册"
 
-#: settings/serializers/settings.py:156
+#: settings/serializers/settings.py:164
 msgid ""
 "Allow terminal register, after all terminal setup, you should disable this "
 "for security"
 msgstr "是否允许终端注册，当所有终端启动后，为了安全应该关闭"
 
-#: settings/serializers/settings.py:160
+#: settings/serializers/settings.py:168
 msgid "Limit the number of login failures"
 msgstr "限制登录失败次数"
 
-#: settings/serializers/settings.py:164
+#: settings/serializers/settings.py:172
 msgid "Block logon interval"
 msgstr "禁止登录时间间隔"
 
-#: settings/serializers/settings.py:165
+#: settings/serializers/settings.py:173
 msgid ""
 "Tip: (unit/minute) if the user has failed to log in for a limited number of "
 "times, no login is allowed during this time interval."
 msgstr ""
 "提示：（单位：分）当用户登录失败次数达到限制后，那么在此时间间隔内禁止登录"
 
-#: settings/serializers/settings.py:169
+#: settings/serializers/settings.py:177
 msgid "Connection max idle time"
 msgstr "连接最大空闲时间"
 
-#: settings/serializers/settings.py:170
+#: settings/serializers/settings.py:178
 msgid "If idle time more than it, disconnect connection Unit: minute"
 msgstr "提示：如果超过该配置没有操作，连接会被断开 （单位：分）"
 
-#: settings/serializers/settings.py:174
+#: settings/serializers/settings.py:182
 msgid "User password expiration"
 msgstr "用户密码过期时间"
 
-#: settings/serializers/settings.py:175
+#: settings/serializers/settings.py:183
 msgid ""
 "Tip: (unit: day) If the user does not update the password during the time, "
 "the user password will expire failure;The password expiration reminder mail "
@@ -2648,53 +2661,57 @@ msgstr ""
 "提示：（单位：天）如果用户在此期间没有更新密码，用户密码将过期失效； 密码过期"
 "提醒邮件将在密码过期前5天内由系统（每天）自动发送给用户"
 
-#: settings/serializers/settings.py:179
+#: settings/serializers/settings.py:187
 msgid "Number of repeated historical passwords"
 msgstr "不能设置近几次密码"
 
-#: settings/serializers/settings.py:180
+#: settings/serializers/settings.py:188
 msgid ""
 "Tip: When the user resets the password, it cannot be the previous n "
 "historical passwords of the user"
 msgstr "提示：用户重置密码时，不能为该用户前几次使用过的密码"
 
-#: settings/serializers/settings.py:184
+#: settings/serializers/settings.py:192
 msgid "Password minimum length"
 msgstr "密码最小长度"
 
-#: settings/serializers/settings.py:187
+#: settings/serializers/settings.py:196
+msgid "Admin user password minimum length"
+msgstr "管理员密码最小长度"
+
+#: settings/serializers/settings.py:199
 msgid "Must contain capital"
 msgstr "必须包含大写字符"
 
-#: settings/serializers/settings.py:189
+#: settings/serializers/settings.py:201
 msgid "Must contain lowercase"
 msgstr "必须包含小写字符"
 
-#: settings/serializers/settings.py:190
+#: settings/serializers/settings.py:202
 msgid "Must contain numeric"
 msgstr "必须包含数字"
 
-#: settings/serializers/settings.py:191
+#: settings/serializers/settings.py:203
 msgid "Must contain special"
 msgstr "必须包含特殊字符"
 
-#: settings/serializers/settings.py:192
+#: settings/serializers/settings.py:204
 msgid "Insecure command alert"
 msgstr "危险命令告警"
 
-#: settings/serializers/settings.py:194
+#: settings/serializers/settings.py:206
 msgid "Email recipient"
 msgstr "邮件收件人"
 
-#: settings/serializers/settings.py:195
+#: settings/serializers/settings.py:207
 msgid "Multiple user using , split"
 msgstr "多个用户，使用 , 分割"
 
-#: settings/serializers/settings.py:203
+#: settings/serializers/settings.py:215
 msgid "Enable WeCom Auth"
 msgstr "启用企业微信认证"
 
-#: settings/serializers/settings.py:210
+#: settings/serializers/settings.py:222
 msgid "Enable DingTalk Auth"
 msgstr "启用钉钉认证"
 
@@ -4069,7 +4086,7 @@ msgstr "不能和原来的密钥相同"
 msgid "Not a valid ssh public key"
 msgstr "SSH密钥不合法"
 
-#: users/forms/profile.py:160 users/models/user.py:581
+#: users/forms/profile.py:160 users/models/user.py:585
 #: users/templates/users/user_password_update.html:48
 msgid "Public key"
 msgstr "SSH公钥"
@@ -4086,39 +4103,39 @@ msgstr "系统审计员"
 msgid "Force enable"
 msgstr "强制启用"
 
-#: users/models/user.py:530
+#: users/models/user.py:534
 msgid "Local"
 msgstr "数据库"
 
-#: users/models/user.py:564
+#: users/models/user.py:568
 msgid "Avatar"
 msgstr "头像"
 
-#: users/models/user.py:567
+#: users/models/user.py:571
 msgid "Wechat"
 msgstr "微信"
 
-#: users/models/user.py:578
+#: users/models/user.py:582
 msgid "Private key"
 msgstr "ssh私钥"
 
-#: users/models/user.py:597
+#: users/models/user.py:601
 msgid "Source"
 msgstr "来源"
 
-#: users/models/user.py:601
+#: users/models/user.py:605
 msgid "Date password last updated"
 msgstr "最后更新密码日期"
 
-#: users/models/user.py:604
+#: users/models/user.py:608
 msgid "Need update password"
 msgstr "需要更新密码"
 
-#: users/models/user.py:755
+#: users/models/user.py:759
 msgid "Administrator"
 msgstr "管理员"
 
-#: users/models/user.py:758
+#: users/models/user.py:762
 msgid "Administrator is the super user of system"
 msgstr "Administrator是初始的超级管理员"
 
@@ -4709,24 +4726,24 @@ msgstr ""
 "    <br>\n"
 "    "
 
-#: users/views/profile/otp.py:107 users/views/profile/otp.py:146
-#: users/views/profile/otp.py:166
+#: users/views/profile/otp.py:107 users/views/profile/otp.py:147
+#: users/views/profile/otp.py:167
 msgid "MFA code invalid, or ntp sync server time"
 msgstr "MFA验证码不正确，或者服务器端时间不对"
 
-#: users/views/profile/otp.py:190
+#: users/views/profile/otp.py:191
 msgid "MFA enable success"
 msgstr "多因子认证启用成功"
 
-#: users/views/profile/otp.py:191
+#: users/views/profile/otp.py:192
 msgid "MFA enable success, return login page"
 msgstr "多因子认证启用成功，返回到登录页面"
 
-#: users/views/profile/otp.py:193
+#: users/views/profile/otp.py:194
 msgid "MFA disable success"
 msgstr "多因子认证禁用成功"
 
-#: users/views/profile/otp.py:194
+#: users/views/profile/otp.py:195
 msgid "MFA disable success, return login page"
 msgstr "多因子认证禁用成功，返回登录页面"
 
@@ -5277,6 +5294,9 @@ msgstr "旗舰版"
 msgid "Community edition"
 msgstr "社区版"
 
+#~ msgid "All user enable MFA"
+#~ msgstr "强制所有用户启用 MFA"
+
 #~ msgid "Application category"
 #~ msgstr "应用类别"
 
diff --git a/apps/settings/api/common.py b/apps/settings/api/common.py
index 85e1c941f..27e3eff54 100644
--- a/apps/settings/api/common.py
+++ b/apps/settings/api/common.py
@@ -122,6 +122,7 @@ class PublicSettingApi(generics.RetrieveAPIView):
                 "TICKETS_ENABLED": settings.TICKETS_ENABLED,
                 "PASSWORD_RULE": {
                     'SECURITY_PASSWORD_MIN_LENGTH': settings.SECURITY_PASSWORD_MIN_LENGTH,
+                    'SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH': settings.SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH,
                     'SECURITY_PASSWORD_UPPER_CASE': settings.SECURITY_PASSWORD_UPPER_CASE,
                     'SECURITY_PASSWORD_LOWER_CASE': settings.SECURITY_PASSWORD_LOWER_CASE,
                     'SECURITY_PASSWORD_NUMBER': settings.SECURITY_PASSWORD_NUMBER,
@@ -160,7 +161,8 @@ class SettingsApi(generics.RetrieveUpdateAPIView):
 
     def get_object(self):
         items = self.get_fields().keys()
-        return {item: getattr(settings, item) for item in items}
+        obj = {item: getattr(settings, item) for item in items}
+        return obj
 
     def parse_serializer_data(self, serializer):
         data = []
diff --git a/apps/settings/migrations/0002_auto_20210729_1546.py b/apps/settings/migrations/0002_auto_20210729_1546.py
new file mode 100644
index 000000000..986818cd4
--- /dev/null
+++ b/apps/settings/migrations/0002_auto_20210729_1546.py
@@ -0,0 +1,29 @@
+# Generated by Django 3.1 on 2021-07-29 07:46
+
+from django.db import migrations
+
+
+def migrate_security_mfa_auth(apps, schema_editor):
+    setting_model = apps.get_model("settings", "Setting")
+    db_alias = schema_editor.connection.alias
+
+    mfa_setting = setting_model.objects.using(db_alias).filter(name='SECURITY_MFA_AUTH').first()
+    if not mfa_setting:
+        return
+
+    if mfa_setting.value:
+        mfa_setting.value = 1
+    else:
+        mfa_setting.value = 0
+    mfa_setting.save()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('settings', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.RunPython(migrate_security_mfa_auth)
+    ]
diff --git a/apps/settings/serializers/settings.py b/apps/settings/serializers/settings.py
index f2e11c17f..1039fd557 100644
--- a/apps/settings/serializers/settings.py
+++ b/apps/settings/serializers/settings.py
@@ -143,9 +143,13 @@ class TerminalSettingSerializer(serializers.Serializer):
 
 
 class SecuritySettingSerializer(serializers.Serializer):
-    SECURITY_MFA_AUTH = serializers.BooleanField(
-        required=False, label=_("Global MFA auth"),
-        help_text=_('All user enable MFA')
+    SECURITY_MFA_AUTH = serializers.ChoiceField(
+        choices=(
+            [0, _('Disable')],
+            [1, _('All users')],
+            [2, _('Only admin users')],
+        ),
+        required=False, label=_("Global MFA auth")
     )
     SECURITY_COMMAND_EXECUTION = serializers.BooleanField(
         required=False, label=_('Batch command execution'),
@@ -183,6 +187,10 @@ class SecuritySettingSerializer(serializers.Serializer):
         min_value=6, max_value=30, required=True,
         label=_('Password minimum length')
     )
+    SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH = serializers.IntegerField(
+        min_value=6, max_value=30, required=True,
+        label=_('Admin user password minimum length')
+    )
     SECURITY_PASSWORD_UPPER_CASE = serializers.BooleanField(
         required=False, label=_('Must contain capital')
     )
diff --git a/apps/users/models/user.py b/apps/users/models/user.py
index a8a60f44a..f921058fa 100644
--- a/apps/users/models/user.py
+++ b/apps/users/models/user.py
@@ -464,14 +464,19 @@ class MFAMixin:
         (1, _('Enable')),
         (2, _("Force enable")),
     )
+    is_org_admin: bool
 
     @property
     def mfa_enabled(self):
-        return self.mfa_force_enabled or self.mfa_level > 0
+        if self.mfa_force_enabled:
+            return True
+        return self.mfa_level > 0
 
     @property
     def mfa_force_enabled(self):
-        if settings.SECURITY_MFA_AUTH:
+        if settings.SECURITY_MFA_AUTH in [True, 1]:
+            return True
+        if settings.SECURITY_MFA_AUTH == 2 and self.is_org_admin:
             return True
         return self.mfa_level == 2
 
diff --git a/apps/users/serializers/profile.py b/apps/users/serializers/profile.py
index c1caf1f99..3ba22ac7b 100644
--- a/apps/users/serializers/profile.py
+++ b/apps/users/serializers/profile.py
@@ -32,7 +32,7 @@ class UserUpdatePasswordSerializer(serializers.ModelSerializer):
 
     def validate_new_password(self, value):
         from ..utils import check_password_rules
-        if not check_password_rules(value):
+        if not check_password_rules(value, user=self.instance):
             msg = _('Password does not match security rules')
             raise serializers.ValidationError(msg)
         if self.instance.is_history_password(value):
@@ -106,7 +106,8 @@ class UserProfileSerializer(UserSerializer):
         fields = UserSerializer.Meta.fields + [
             'public_key_comment', 'public_key_hash_md5',
             'admin_or_audit_orgs', 'current_org_roles',
-            'guide_url', 'user_all_orgs'
+            'guide_url', 'user_all_orgs', 'is_org_admin',
+            'is_superuser'
         ]
         read_only_fields = [
             'date_joined', 'last_login', 'created_by', 'source'
diff --git a/apps/users/serializers/user.py b/apps/users/serializers/user.py
index f9b2c46ee..c718f29ec 100644
--- a/apps/users/serializers/user.py
+++ b/apps/users/serializers/user.py
@@ -122,7 +122,7 @@ class UserSerializer(CommonBulkSerializerMixin, serializers.ModelSerializer):
         if self.instance and not password:
             # 更新用户, 未设置密码
             return
-        if not check_password_rules(password):
+        if not check_password_rules(password, user=self.instance):
             msg = _('Password does not match security rules')
             raise serializers.ValidationError(msg)
         return password
diff --git a/apps/users/utils.py b/apps/users/utils.py
index 374ead56f..9d4d3e32d 100644
--- a/apps/users/utils.py
+++ b/apps/users/utils.py
@@ -295,10 +295,12 @@ def check_otp_code(otp_secret_key, otp_code):
     return totp.verify(otp=otp_code, valid_window=otp_valid_window)
 
 
-def get_password_check_rules():
+def get_password_check_rules(user):
     check_rules = []
     for rule in settings.SECURITY_PASSWORD_RULES:
         key = "id_{}".format(rule.lower())
+        if user.is_org_admin and rule == 'SECURITY_PASSWORD_MIN_LENGTH':
+            rule = 'SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH'
         value = getattr(settings, rule)
         if not value:
             continue
@@ -306,7 +308,7 @@ def get_password_check_rules():
     return check_rules
 
 
-def check_password_rules(password):
+def check_password_rules(password, user):
     pattern = r"^"
     if settings.SECURITY_PASSWORD_UPPER_CASE:
         pattern += '(?=.*[A-Z])'
@@ -317,7 +319,11 @@ def check_password_rules(password):
     if settings.SECURITY_PASSWORD_SPECIAL_CHAR:
         pattern += '(?=.*[`~!@#\$%\^&\*\(\)-=_\+\[\]\{\}\|;:\'\",\.<>\/\?])'
     pattern += '[a-zA-Z\d`~!@#\$%\^&\*\(\)-=_\+\[\]\{\}\|;:\'\",\.<>\/\?]'
-    pattern += '.{' + str(settings.SECURITY_PASSWORD_MIN_LENGTH-1) + ',}$'
+    if user.is_org_admin:
+        min_length = settings.SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH
+    else:
+        min_length = settings.SECURITY_PASSWORD_MIN_LEN
+    pattern += '.{' + str(min_length-1) + ',}$'
     match_obj = re.match(pattern, password)
     return bool(match_obj)
 
diff --git a/apps/users/views/profile/otp.py b/apps/users/views/profile/otp.py
index caed50532..7966dda8e 100644
--- a/apps/users/views/profile/otp.py
+++ b/apps/users/views/profile/otp.py
@@ -2,6 +2,7 @@
 import time
 
 from django.urls import reverse_lazy, reverse
+from django.shortcuts import get_object_or_404
 from django.utils.translation import ugettext as _
 from django.views.generic.base import TemplateView
 from django.views.generic.edit import FormView
@@ -33,6 +34,16 @@ logger = get_logger(__name__)
 class UserOtpEnableStartView(UserVerifyPasswordView):
     template_name = 'users/user_otp_check_password.html'
 
+    def form_valid(self, form):
+        # 开启了 OTP IN RADIUS 就不用绑定了
+        resp = super().form_valid(form)
+        if settings.OTP_IN_RADIUS:
+            user_id = self.request.session.get('user_id')
+            user = get_object_or_404(User, id=user_id)
+            user.enable_mfa()
+            user.save()
+        return resp
+
     def get_success_url(self):
         if settings.OTP_IN_RADIUS:
             success_url = reverse_lazy('authentication:user-otp-settings-success')
@@ -85,7 +96,11 @@ class UserOtpEnableBindView(AuthMixin, TemplateView, FormView):
             session_user = get_object_or_none(User, pk=user_id)
 
         if session_user:
-            if all((is_auth_password_time_valid(self.request.session), session_user.mfa_enabled, not session_user.otp_secret_key)):
+            if all((
+                    is_auth_password_time_valid(self.request.session),
+                    session_user.mfa_enabled,
+                    not session_user.otp_secret_key
+            )):
                 return True
         return False
 
diff --git a/apps/users/views/profile/password.py b/apps/users/views/profile/password.py
index e2cd8f8e2..e2dde8e92 100644
--- a/apps/users/views/profile/password.py
+++ b/apps/users/views/profile/password.py
@@ -4,65 +4,20 @@ import time
 from django.conf import settings
 from django.contrib.auth import authenticate
 from django.shortcuts import redirect
-from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic.edit import UpdateView, FormView
-from django.contrib.auth import logout as auth_logout
+from django.views.generic.edit import FormView
 
 from common.utils import get_logger
-from common.permissions import (
-    IsValidUser,
-    UserCanUpdatePassword
-)
-from common.mixins.views import PermissionsMixin
 from ... import forms
-from ...models import User
 from ...utils import (
     get_user_or_pre_auth_user,
-    check_password_rules, get_password_check_rules,
 )
 
-__all__ = ['UserPasswordUpdateView', 'UserVerifyPasswordView']
+__all__ = ['UserVerifyPasswordView']
 
 logger = get_logger(__name__)
 
 
-class UserPasswordUpdateView(PermissionsMixin, UpdateView):
-    template_name = 'users/user_password_update.html'
-    model = User
-    form_class = forms.UserPasswordForm
-    success_url = reverse_lazy('users:user-profile')
-    permission_classes = [IsValidUser, UserCanUpdatePassword]
-
-    def get_object(self, queryset=None):
-        return self.request.user
-
-    def get_context_data(self, **kwargs):
-        check_rules = get_password_check_rules()
-        context = {
-            'app': _('Users'),
-            'action': _('Password update'),
-            'password_check_rules': check_rules,
-        }
-        kwargs.update(context)
-        return super().get_context_data(**kwargs)
-
-    def get_success_url(self):
-        auth_logout(self.request)
-        return super().get_success_url()
-
-    def form_valid(self, form):
-        password = form.cleaned_data.get('new_password')
-        is_ok = check_password_rules(password)
-        if not is_ok:
-            form.add_error(
-                "new_password",
-                _("* Your password does not meet the requirements")
-            )
-            return self.form_invalid(form)
-        return super().form_valid(form)
-
-
 class UserVerifyPasswordView(FormView):
     template_name = 'users/user_password_verify.html'
     form_class = forms.UserCheckPasswordForm
@@ -74,9 +29,6 @@ class UserVerifyPasswordView(FormView):
         if not user:
             form.add_error("password", _("Password invalid"))
             return self.form_invalid(form)
-        if not user.mfa_is_otp():
-            user.enable_mfa()
-            user.save()
         self.request.session['user_id'] = str(user.id)
         self.request.session['auth_password'] = 1
         self.request.session['auth_password_expired_at'] = time.time() + settings.AUTH_EXPIRED_SECONDS
diff --git a/apps/users/views/profile/reset.py b/apps/users/views/profile/reset.py
index ba9cfd9b7..46d09ab7e 100644
--- a/apps/users/views/profile/reset.py
+++ b/apps/users/views/profile/reset.py
@@ -82,8 +82,9 @@ class UserResetPasswordView(FormView):
         if not user:
             context['errors'] = _('Token invalid or expired')
             context['token_invalid'] = True
-        check_rules = get_password_check_rules()
-        context['password_check_rules'] = check_rules
+        else:
+            check_rules = get_password_check_rules(user)
+            context['password_check_rules'] = check_rules
         return context
 
     def form_valid(self, form):
@@ -100,7 +101,7 @@ class UserResetPasswordView(FormView):
             return self.form_invalid(form)
 
         password = form.cleaned_data['new_password']
-        is_ok = check_password_rules(password)
+        is_ok = check_password_rules(password, user)
         if not is_ok:
             error = _('* Your password does not meet the requirements')
             form.add_error('new_password', error)