From 74b105e0bc84e98a1a31c8b18630f22ce79f9965 Mon Sep 17 00:00:00 2001 From: Paul Caskey Date: Mon, 23 Oct 2017 15:23:48 -0500 Subject: [PATCH] more UI/test changes --- assets/dsroot/config.php | 305 ++++++++++++++++++++++++++++ assets/dsroot/custom-header.php | 14 +- assets/dsroot/custom-languages.php | 74 +++++++ assets/dsroot/images/logo.png | Bin 6470 -> 9129 bytes assets/dsroot/languages.php | 314 ----------------------------- 5 files changed, 390 insertions(+), 317 deletions(-) create mode 100644 assets/dsroot/config.php create mode 100644 assets/dsroot/custom-languages.php delete mode 100644 assets/dsroot/languages.php diff --git a/assets/dsroot/config.php b/assets/dsroot/config.php new file mode 100644 index 0000000..254e5b1 --- /dev/null +++ b/assets/dsroot/config.php @@ -0,0 +1,305 @@ + or if the assertion consumer url + // check below is enabled + // Requires $useSAML2Metadata to be true + $enableDSReturnParamCheck = true; + + // If true, the return parameter is checked for Service Providers that + // don't have and extension set. Instead of this + // extension, the hostnames of the assertion consumer URLs are used to check + // the return parameter against. + // This feature is useful in case the Service Provider's metadata doesn't contain + // a extension. It increases security for Service + // Provider's that don't have an extensions. + // Requires $useSAML2Metadata and $enableDSReturnParamCheck to be true + $useACURLsForReturnParamCheck = false; + +// Whether to turn on Kerberos support for Identity Provider preselection +$useKerberos = false; + + // A Kerboros-protected page that redirects back to the WAYF script + $kerberosRedirectURL = '/myFederation/kerberosRedirect.php'; + +// If enabled, the user's IP is used for a reverse DNS lookup whose resulting +// domain name then is matched with the URN values of the Identity Providers +$useReverseDNSLookup = false; + +// Whether the JavaScript required for embedding the WAYF +// on a remote site should be generated or not +// Lowers security against phising! +// If this value is set to true, any web page in the world can +// (with some efforts) find out with a high probability from which +// organization a user is from. This could be misused for phishing attacks. +// Therefore, only enable this feature if you know what you are doing! +$useEmbeddedWAYF = false; + + // If enabled the Embedded WAYF will prevent releasing information + // about the user's preselected Identity Provider + // While this is benefical to the data protection of the user, it will also + // prevent preselecting the user's Identity Provider. Thus, users will have + // to preselect their IdP each and every time + // Requires $useEmbeddedWAYF to be true + $useEmbeddedWAYFPrivacyProtection = false; + + // If enabled, the referer hostname of the request must match an assertion + // consumer URL or a discovery URL of a Service Provider in $metadataSPFile + // in order to let the Embedded WAYF preselect an Identity Provider. + // Therefore, this option is a good compromise between data protection and + // userfriendlyness. + // Requires $useSAML2Metadata to be true and $useEmbeddedWAYFPrivacyProtection + // to be false + $useEmbeddedWAYFRefererForPrivacyProtection = false; + +// If enabled (default) Identity Providers that are in the +// "Hide From Discovery" entity category (see +// https://refeds.org/category/hide-from-discovery/) will not +// be parsed when SAML2 metadata is processed. The effect will +// be that these IdPs are not shown in the organisation drop +// down list. IdPs in this entity category, however, still can +// be manually added using the Embedded WAYF. +$supportHideFromDiscoveryEntityCategory = true; + + +// Whether or not to add the entityID of the preselected IdP to the +// exported JSON/Text/PHP Code +// Lowers security against phising! +// If this value is set to true, any web page +// in the world can easily find out with a high probability from which +// organization a user is from. This could be misused for phishing attacks. +// Therefore, only enable this feature if you know what you are doing! +$exportPreselectedIdP = false; + +// Whether to enable logging of WAYF/DS requests +// If turned on make sure to also configure $WAYFLogFile +$useLogging = false; + + // Where to log the access requests + // This log is only an audit log for access requests. + // Errors (e.g. when parsing SAML metadata) go to the syslog. + // Make sure the web server user has write access to this file! + $WAYFLogFile = '/var/log/apache2/wayf.log'; + + + +// 4. Files and path Settings +//*************************** + +// Set both config files to the same value if you don't want to use the +// the WAYF to read a (potential) automatically generated file that undergoes +// some plausability checks before being used +$IDPConfigFile = $wwwPath . 'IDProvider.conf.php'; +$backupIDPConfigFile = $wwwPath . 'IDProvider.conf.php'; + +// Use $metadataFile as source federation's metadata. +$metadataFile = $rootPath .'metadata.myFederation.xml'; + +// File to store the parsed IdP list +// Will be updated automatically if the metadataFile modification time +// is more recent than this file's +// The user running the script must have permission to create $metadataIdpFile +$metadataIDPFile = $wwwPath . 'IDProvider.metadata.php'; + +// File to store the parsed SP list. +// Will be updated automatically if the metadataFile modification time +// is more recent than this file's +// The user running the script must have permission to create $metadataIdpFile +$metadataSPFile = $wwwPath . 'SProvider.metadata.php'; + +// File to use as the lock file for writing the parsed IdP and SP lists. +// The user running the script must have permission to write $metadataLockFile +$metadataLockFile = '/tmp/wayf_metadata.lock'; + +// Use an absolute URL in case you want to use the embedded WAYF +// The default assumes that this is in the same directory like +// the WAYF script. +$imageURL = '/DS/images'; + +// Absolute URL to point to css directory +// The default assumes that this is in the same directory like +// the WAYF script. +$cssURL = '/DS/css'; + +// Absolute URL to point to javascript directory +// The default assumes that this is in the same directory like +// the WAYF script. +$javascriptURL = '/DS/js'; + + + +// 5. Appearance Settings +//************************** + +// Identifier for this particular instance of the SWITCHwayf +// This is mainly used for logging to syslog and in particular +// useful in case multiple instances of the SWITCHwayf are +// operated on the same host +$instanceIdentifier = 'ICMPwayf'; + +// Name of the federation [deprecated] +// This value is not used anymore in the standard code. +// Please ensure it is not used anymore in templates +//$federationName = 'myFederation'; + +// URL to send user to when clicking on federation logo +// Insert %s as macro to be substituted by the language (e.g. 'en', 'de', 'fr', ...) the WAYF uses +// Set to an empty string to hide the logo + +$federationURL = 'http://www.internet2.edu/'; + +// Absolute URL to the federation logo that should be displayed in the Embedded WAYF +// Set to an empty string to hide the logo +$logoURL = 'images/federation-logo.png'; + +// Absolute URL to the small federation logo that should be displayed in the +// embedded WAYF. Make sure the dimensions (in particular the height of the logo) +// is small, ideally not larger than 120x30 pixel +//$smallLogoURL = 'http://ds.example.org/SWITCHwayf/images/small-federation-logo.png'; + +// Support contact email address +$supportContactEmail = 'admin@incommon.org'; + +// Absolute URL to the logo of the organization operating this Discovery Service +// Set to an empty string to hide the logo +//$organizationLogoURL = 'https://ds.example.org/SWITCHwayf/images/organization-logo.png'; +$organizationLogoURL = 'images/organization-logo.png'; + +// Absolute URL to the organization's web page +// Insert %s as macro to be substituted by the language (e.g. 'en', 'de', 'fr', ...) the WAYF uses +//$organizationURL = 'http://www.example.org/'; + +// Absolute URL to an FAQ page +// This entries local string is 'faq' in languages.php +// Insert %s as macro to be substituted by the language (e.g. 'en', 'de', 'fr', ...) the WAYF uses +// Set to an empty string to hide the logo +//$faqURL = 'http://www.example.org/%s/myFed/faq/'; + +// Absolute URL to a help/support page +// Insert %s as macro to be substituted by the language (e.g. 'en', 'de', 'fr', ...) the WAYF uses +// Set to an empty string to hide the logo +//$helpURL = 'http://www.example.org/%s/myFed/help/'; + +// Absolute URL to a privacy policy page +// Insert %s as macro to be substituted by the language (e.g. 'en', 'de', 'fr', ...) the WAYF uses +// Set to an empty string to hide the logo +//$privacyURL = 'http://www.example.org/%s/myFed/privacy/'; + + + +// Development mode settings +//************************** +// If the development mode is activated, PHP errors and warnings will be displayed +// on pages the SWITCHwayf generates +$developmentMode = $cds_settings['CDS_DEVELOPMENTMODE']; + +?> \ No newline at end of file diff --git a/assets/dsroot/custom-header.php b/assets/dsroot/custom-header.php index bfbf93d..63e0315 100644 --- a/assets/dsroot/custom-header.php +++ b/assets/dsroot/custom-header.php @@ -90,9 +90,17 @@ function init(){
diff --git a/assets/dsroot/custom-languages.php b/assets/dsroot/custom-languages.php new file mode 100644 index 0000000..a59a23b --- /dev/null +++ b/assets/dsroot/custom-languages.php @@ -0,0 +1,74 @@ +sample HTML content'; +// +// +// Set a locale to an empty string ('') in order to hide it +// Note that any string in custom-languages.php will survive updates + +// In particular you might want to override these three locales or set the +// to an empty string in order to hide them if they are not needed. +$langStrings['en']['about_federation'] = 'About Internet2 ICMP'; // This string can be hidden by setting it to '' +$langStrings['en']['about_organisation'] = 'About Internet2'; // This string can be hidden by setting it to '' +$langStrings['en']['additional_info'] = 'Internet2 a member-owned advanced technology community founded by the nation’s leading higher education institutions in 1996.'; // This string can be hidden by setting it to '' + +// Generic strings +$langStrings['en']['faq'] = 'FAQ'; // This string can be hidden by setting it to '' +$langStrings['en']['help'] = 'Help';// This string can be hidden by setting it to '' +$langStrings['en']['privacy'] = 'Data Privacy'; // This string can be hidden by setting it to '' +$langStrings['en']['title'] = 'Organization Selection'; +$langStrings['en']['header'] = 'Select your organization'; +$langStrings['en']['make_selection'] = 'You must select an organization.'; +$langStrings['en']['settings'] = 'Default organization for this web browser'; +$langStrings['en']['permanent_select_header'] = 'Permanently set your organization'; +$langStrings['en']['permanent_cookie'] = 'On this page you can set a default organization for this web browser. Setting a default organization will henceforth redirect you directly to your organization when you access certain services that require login. Don\'t use this feature if you use several user accounts from multiple organizations.'; +$langStrings['en']['permanent_cookie_notice'] = 'The organization selected by default will be:'; +$langStrings['en']['permanent_cookie_note'] = 'You can reset this default setting on the page: %s'; +$langStrings['en']['delete_permanent_cookie_button'] = 'Reset'; +$langStrings['en']['goto_sp'] = 'Save and continue'; +$langStrings['en']['permanently_remember_selection'] = 'Remember selection permanently and bypass this step from now on.'; +$langStrings['en']['confirm_permanent_selection'] = 'Are you sure you want to make the selected organization your default organization? Don\'t proceed if you have several user accounts from multiple organizations.'; +$langStrings['en']['save_button'] = 'Save'; +$langStrings['en']['access_host'] = 'In order to access the service %s please select or search the organization you are affiliated with.'; +$langStrings['en']['select_idp'] = 'Select the organization you are affiliated with.'; +$langStrings['en']['search_idp'] = 'Enter the name of the organization you are affiliated with...'; +$langStrings['en']['remember_selection'] = 'Remember selection for this web browser session.'; +$langStrings['en']['invalid_user_idp'] = 'There may be an error in the data you just submitted.
The value of your input \'%s\' is invalid.
Only the following values are allowed:'; +$langStrings['en']['contact_assistance'] = 'Please contact %s for assistance.'; +$langStrings['en']['no_arguments'] = 'No arguments received!'; +$langStrings['en']['arguments_missing'] = 'The web server received an invalid query because there are some arguments missing
The following arguments were received:'; +$langStrings['en']['valid_request_description'] = 'A valid request needs at least the arguments shire and target with valid values. Optionally the arguments providerID, origin and redirect can be supplied to automtically redirect the web browser to an organization and to do that automatically for the current web browser session'; +$langStrings['en']['valid_saml2_request_description'] = 'A valid SAML2 request needs at least the arguments entityID and return with valid values. Instead of the return argument, metadata for the Service Provider can include a DiscoveryResponse endpoint. Optionally the arguments isPassive, policy and returnIDParam can be supplied to automtically redirect the web browser to an organization and to do that automatically for the current web browser session'; +$langStrings['en']['invalid_query'] = 'Error: Invalid Query'; +$langStrings['en']['select_button'] = 'Select'; +$langStrings['en']['login'] = 'Login'; +$langStrings['en']['login_with'] = 'Login with:'; +$langStrings['en']['other_federation'] = 'From other federations'; +$langStrings['en']['logged_in'] = 'You are already authenticated. Proceed.'; +$langStrings['en']['most_used'] = 'Most frequently used organizations'; +$langStrings['en']['invalid_return_url'] = 'The return URL \'%s\' is not a valid URL.'; +$langStrings['en']['unverified_return_url'] = 'The return URL \'%s\' could not be verified for Service Provider \'%s\'.'; +$langStrings['en']['unknown_sp'] = 'The Service Provider \'%s\' could not be found in metadata and is therefore unknown.'; +$langStrings['en']['no_idp_found'] = 'No organization found for this search text'; +$langStrings['en']['no_idp_available'] = 'No organization available'; +$langStrings['en']['last_used'] = 'Last used'; + +?> \ No newline at end of file diff --git a/assets/dsroot/images/logo.png b/assets/dsroot/images/logo.png index dbb2c7cff81e7fb217a5d3e29654959407007e86..f3a2d76fa1bfdf0190a8975980c3a935185bf2c5 100644 GIT binary patch literal 9129 zcmZ`<~$EDe!mito^lETtO!5m%>y-jgl-`AM4>uwToNPwB{?`nwssO8h^OtV1$~+XJGlkX1;!rJ>f>Q0!HxVw`>Rh!cB(Rmt7M za4kho7jO;P`Q3g=IFe*00+W9P;QyC^T}CU9%JeeQ$mlH1%lW!V6kS)oEM$S?e!h6+ zxdD>c(!fdnA|Si~JsL^zjVJ5*^f%DFqLkD=r^dKJWzx;1f5me*POTi1dmWF{2@b-y zBPXoeeGbXZ=9u~@k3u@0H=jz%2~%UQ31R{h0>b)TnQPgG`n}-mhpbytwS5WEGTpN{ zL$jI8+L-hOaz(15=j|z`X zNlX+@Z*_;Co}Az1i5r`vRNmWLfSRpZYnK4MvvmzSDL`l8quQ$ddHe>WW*jY#v;g}a z=QG)xGLllnCTB0Q{<5U{I?>iVjt~)L`(@Vt__x~j?^g;63h`NqloNFewl&nc&5C(D`{elBW$S~aV;?PF?Vt6T^w8gWt$VRP zN?1V(mR5h1$hdl;cU(uT@j;Zu6t4K~jyiEfVnvlUhiW*A1gi$WsmIfbeiv1CvOIb| zr&YhvR{N(8_=jCx&OI0ZA{(1X=8l3~UBx*%6irN2m1@NKU#rpJ@q!`^aRk&V;H0r|1~mJ%{UNx)64>(N zKSu0RczF?0Fj**f#6&_>r_8}YDhw@75E-9?LHkW zVQzxYVmG$JzM1*o&X z9v{C{s-*&E2jX-DCP$PL*DS7UdRO6TqdSN*iv*2jz6@2EvbskwabAg*=og4CWu*Ff zZ4Wm}s53|%(=94Q(`kOMx}avK<>iJ5i>E8+$&fG)!U-}n(+rZrJTWXe5C$VA+-R1^ z1||E1l6GTSZbid5CigzA=SbWzNIzsm>`t;13Wo%TSU6j&=CA6Kz$$Z}r!q4q$kQBN z#2pQka7e!vY%P1|H}lUzt(!z7W^uTZJUZ&nbdA*EnS_bAgaO@l!0hL7>qzjqj=g6# zT;oSz*yOC90at#!! zMV8U?O?Q<&zzhnZS{nsc4=jDna@0TZrjOg$rc5kN8rayOX82t0{i(@NCgQF;84Mto zf-1<1eAP3pvmQfPw4<~hhszY^N(Me{8>^nxs~!y8JOg)6_-IFD*yE2Uxf=G3o(v5Q z^?M=z%Bf7WYR&rRSwf2Eb~b9mZX^F^Y{;MlH+P;IX<(rC`erPDW8&GVGz?WE=G(ko zP~>8OXmBbR7>K{sw6S5iu@gnLZl7|N6~Z>UYxH?AHO8vEq5EgINR>5JVwgqBSAn62 zw)*WZAx{MesFK?VxMkRHR!T|^dUv~-?czz;y)<{44%IO#H8qEDnuJ$WqhZG>HBjhA zk$df>itCY0ZzYY}7ZTRD^RLP2?Uq-^WdhqF*jLfD8?9Wq2}W+*t$K5zV+LzH3@UO8 zYNd&X%P^59zY!IQq<`SIro30QMsoc+&-_mk z<#CJeu--3&uG$dfWAc@4`jp5^Pzx~E^--L6wuZPgf}xPsF`)D%ZQ3el6j52djTS3{ z1v<@M(i>PjwxGqmcm7616z%$nBFI~-Oj>GPbK?hvio|3^R8<ZPRtC_jz9eyuSB!5mMm^qXE+%V3ViF5>zC@+}j|4T-9> zpRxdWn<8&%6J<9SSheMRXZ#B(r|%&DWRA~(Xl-R>H*c6o(;A*KvdTUzxwt=Vv}iba zYanNNV7)K`RMarx<}Lq)Ui_h~h1<^eZpoi7*Q9+vL_j%tmc4>fgDLOjn5CUo_fZjT z2&#p6_-b=!HQGem!ZwqX2$1KDojx>QT2u7d`2WPuzjFKee7by}PfAr^;q17$grL#7#IvQaI zV?8#6gc*b%)CFH!0yae!SQ!~d-bCKX5&iA*PW1d@s#VbU`Y_`d)+grCGBI~h8j(_7 zdMHf+_=p~znRsMuy!q{&?~*;Z$-Zs#)S$dTgVZ=hjp%iZ6!kzndzU5P^NYy#A4zv< zQ>CF5gGuOW__S`>?;6VciL(Cco{H^*o{XzX^{JV_x5tQiLF2&9znYWJ5hQ?@#hTq| z6h_MoW2;cIugPn2B9m~&h;|C4*qy(D}gu(a>ZC2Gqpp&jio=Xh!&cRJ^!u@95=JXzO38@VA}Ec(R- zI#I3?q@#`tZTOhMp!apN$+Hj7KiwP9Xj)3k+rA>BvMWv6nt?xk;dBgiFGGT2<)Ukxat-cSiSQgnc%_+(V0 zM(q(sXsW@;hfwlP?f6ic-j%#oZia}9!c3dqc)86ARScDgYR0i$ZsLb`$}5-E{S00Z zz%O-*!Ytmv*_{X6jp8oyeae$`1l{6~O2& z%@rZvA5!q$6^l?F+@AzYE=s4Jj7*nwrVX?t96tUE4f_v;s@60JYxwynjarx`k$c<-SRQt{Spbh) z>8fGpfy5z3jL3y~?~{XP3*EfuB1G0=cYEfS2VcW0c%4Cbag{LDbYyz}FA-_!=)rnQ zC$nASgk-9tQI2czI=J;Jey$d6Jx}OWnxbYQOq6iCv~w$zwp9SyA1$m>E6ZtY!CiM& zW06K;!eJrPPN>mcb+z$Ft#yAgTgj%R?_KAtRV7e2ndHvsFx%w3mX>e0DWA-3E#FT^Wv@w0M)Z07 z>w!xb`&PL@ytM0KnellF#wR%#8@sF#DKkm)-N9KX>R1iNcuTsXD~#uE4yCZmu(}55 z&v^V)$%OOw9Ip|wutNL;(&&|$jlDpmDZz)QRABJ%V>qw4(i1Kjy-Nli)+OGkLWnsh?Yr+0vDtiDr@0udQwNy9IbOrYUf|QI&nvTT>=)mgz<>V9nz)u1J#)Qqa z!&i9A^TbvkZF-gfDxxS8$V$Rn#N4-bdu(KSZpz(ckK|AST$V21LPzHj{V`=uQjwzp@WqgtjGbl9}(Qt_RK$bJ{TW= zJeJgQ-zV-jjRLMK{r0CnRfCwfRZ5@=R&3 z4xesaN71!^%HMdyfAR)lK9uMHv1m6-HHdFGLD;5O=zLPZB>qfnRb9QbRNa(XP~-?T zJUYI$(cZ~+CFI*?Xz4^8(ZKB0OCa@i@xgtS+@E&JruHd@Zy?+fHPSDKRy4ah`n))j zW>58v9C`-L*$lWFy>%?MZVT0@B0g9@)>iS+F*?huL{|}2bNlH37qG=E1e=3fXVz$F zK`^66X`c6^bGukEs!`>@*?Vic$AzLkJnw(|PvCRdhAqpHmpIMOnTWWXMIx5I2m+oQ zb}4Ch<&L-yY@$XUPY;NAt6uqlaZ7Tcp;lxSSZme54ude#|fM$5K}RFS+UR)_HNyXEEN%P$t{3#l%WCfK8KQ zT@n8Ns>*}-)ZOWWY>^6Uha+}i}+WMDY@5&hek?^8mb6SrY3ccnJ7QAEol|gFz=i!gvA2#ke ztn7^6^Xrn??0fD-NmPgIfT20Fs#ob!&UCq`BSID#@Q7sC;?rysvmDB{>j!IE9bKKn`oZZZ`cjflewB2a@?*SX;0Z9e zOmQX|>YmJ!*i~(cyv^F)-q(SoGOlRq0x6mU#=GkA0IWfeh=q-CScX(wQ?&7DfokIfVj;g3rIK;o%e`iuagkjg zl`54*o2$tXJ6y2z?C`WihFP$Lc26yq{VlD}ojO(kFWT69ksb(UOTC{;DMgzrfRHI% z&HcDws+UrQc8OD>myu3%gIfbrkBUSB~c8UmlEm^@a zwaxm@YvFg5El?Ic!D*6|ncSgG3GLD-S&SCHxjk(y@)MNDsjQzhWdTvJx?%@E8FQ{F z%hj<686m!EpFKKq-ll251LR&uX`V?tH_pP`Dz0-`62l|Rw4CK|I;?EwP!q8&HKdCyN; zF(p^WYtIXSZ%MvhY-fzSA!=>nZoIa&Fuc@S!HG$4XG8_fAJq9TFYJVD1boLLPR6bV zR=LT2Sm5$QMrmzJKg;_NBGg1}tIasmJiEs0ULl`rC&-D?Q2#QC(#L)m-^Hdzpl|rq zB9*WGbEQM#0VRd_ypY}v{btk5)6yh5i$=$VJ zjN4z|R?IU;@0Qj&oEm%Z8QC+4jF0Q)#2mnPTe*GsO{FVM%NsZO*1XqhZPdSq`)2qY z@UA&|MO$)a5Ac()|0)SE{%nmrD6of?oFa6QL)~RxQ0C=fh2`TGZDhxD5O`oR5{K6M z(C@@r0eP|D>89J_D5-lE^?|@`XkEr3!2DT(ba|F!APJo1YBwyjy6z!&`0`+5;>euY z()Wl90`meo1~lifCugxVb_uj};$`Vh8Owk zn|Y4LzUGq^jvTv#nA$E`ZhSW1WH{!Bg^G;L^BM=qF|x4mlR0CAyd>W7DC;HJ{dmb) zY~{kbC%%M+0106XSr62O7mlN2H6w9*nWFAJx1fqra7H*2vh}=!{#!Xn9Y z0Ip8hc=w|B#YRDYfLH|Gdm85~@iEgJ#w!?hJ6>h|L(og_k1}CB=I`ee!M2n4u%-8` zpP%38V|P#|&Hq5)wQqens)s@)US#=PeCT7L|7GDQ>=7_nbY2I`{Sidbehi4lj{mIOGI6w0ut zdpnxi=Q3tAuCpT(xidi{qz^^?LyWDTE|h7`nSaFxzzP>_bf2sZ{pkvlNZlZ7tYzNa zmo(9vyPs@jEJ0CIi+0Jz=6t}1Oz5(^ilBM zbGzr6sGkp}%ccO zb$))X-gpGNN5(u|fNBmwVPC)wivYs<3SHwsvcfK7U$r`;d=u;J7uXoX zzhY|_h*@OhDdl)>C*AC#$&a)cs;K6rT#DV2AUt~b{XM&!Xg)bC>BkN~iC_@gc9JT2 zkEEe+1a!;BUShj34MdBx$wGJ`vT_m%yKRfgxYA$Zpoi8myZI&n8nB$>u?%~!DjD7A zN4yIAlM$o>}xWwSMddSf^iVuTGTHGq`334b>l$c?Sfcw+`jV`q(t z8*u`yLhvi7W=GNm=FBG2C-YsC`~|V(BeO7t8#Pj??=yt3+cG%;#{A1j?&xPAu2@3Y zI}&gVwUOvFPF*pjl{>Ts>_)wit@0J__<9&0jV+V3bKv^PLsYsrVI8RR1})e<oy|k;PKyN)Z9M#HYkY3oQu8lU|E8y(AI{LFjK<)~ zN@+^>okE{xzp7KCtSIf>#~2=6c30bPeoZgdtww9KTwDJfD+oZcvO2!F_$X&{)7KYp z1V8ReFBSB1Wlc=@bHr|?F&@FN$0wd6@}ko9w4;i#fRXT(Yat!m{i=m=16%xV18pG;8cC^R$^?m8>p$V7ZCE%v)%^}mEY;MHnSD8avMjxJ$hFLgGO=Hkzo6RQ57_x} z%(cF|E^u9TdYXqm#Wa&Ddq)4Y&>nJH7|Ge+s`z-Gb-wIl>gDO2u`QX&xp1Y+iq{ir z+)C;?aq8rKaT%oYCu0wsQrCOEoacpdc~=0x^egOwdbNd*+_zo``*d5Inj=Sd>anu8 zoZl9}lp~w2`m8!4LlYk@YC@4&y`@h3+cwFD^`iN&MagO215KtMGW@V3dczYS7fD^l z_x&W~_osuL;Mj1$SH3fo@JRv!R3gTMpw=2*;(im)|7DKP063dX>gsmH7DI!WPz+xolApVvS7J-#0z-z}L5j77 zcq#Y-F$uT|WDTcZ7 zjPKnf3P4U+-FPy3YC!vja&ChVmhj8ShfpkS{RJ$?|qNU_23#Yj=5P?Zl(#IUStERYxqlJ!W1THrSOD-RDn($lDe7 zeV2!D%0^dQ|E{uERWI}d8-f*)h(wY8_KUI!4M5r7xbA;Zz98?{2(!c(+HS?6 z9ThxI6Ap%oRBWthd__^<89`JkFkBtB7)223LjSk^n|5a)a_=hKu=P+jxh~$vixKi{ zNzh{MRH014Sh6hLuzB#x#%+B~T<8jYDb$)frK$k8bF_FtTgGF8oH|Je zB)fRh)6v)Nk8atuu()h%PY4PMe8Lyu2t@d3!gE@s-8F@%`W=#F{f25i4=D)~slcpf zCIZ}N6CWLr2&9E)KjV*aCqIMeQ%P(}9!Uru9^};eE@s-ns#@B_lM-pGeE!PqOJ5l; zT>kMNb=!m@lO%Pwq77R*zqhnChF4TK1%={zq3X2nd38e4?Ba30ed&3O$vyR6w^JOK zGB{|b`4ap7@_X1rP0t;+W)tjTP8qNxn2T@bcfE$=hWIir!??@lPjv%aK&&C;WYXR>sxb_Q)C$}9(o<_Fg z25K$Lmm)uU`R_C2^16`}-fq$$2F=cYCFkRuykxOVUV>z?+&lP!>21M1l>e%_7|Wkb zCJ|XFik0C8#>6n(9B^Fn2<-lgA=uiuM_1eoHwS_71hhI+PJ}7@4y{Fz?28lb)_h*)Eu#iYu!tMCKF`%ww12+RVY^{(^zVSaI3i zV>S3fv)e6)XQ#)ok9XG{9}@p-90sy(ZYpuP~MD*QPmErm1ID5y9lJkR4JGNg>wC^-Vl{t1{P{X@e zRiTAH#XxPI`xmsae)Rr=A?&!7E0_XHmwm`+ z;vh_wEP|V^wXD7ri#Lgb?oX>k;w*uRy={Y;O`$#bSh{B|xB*zE?8#9be4zmSH!pB! zIr@WJV8_z`l+uD|_d2?fZW~4S#LO1V195IMc!PBt_V9wk+cki*_OFfMf02S0Y}_)b z_uBRL=tK8*@BeeKfga*pc0o$t4AQN)uffR?dt8Dg!5?Qs5WuGGvi+|{n(xSOTtlcq dLhlU$uRXbGq4lE??C}~r6-9N0@|W)e{tu}ST6_Qi literal 6470 zcmb7IbwHF|vqzC;>0CMl=~_ThkXTY$LPA>D1*A(lmyk|DkR_B}Iur?6T0jRP} z-~7VB=bE>nx-uSWjCB(rZa69FDB_bJL&MA)503(k`@1&aUhaU0$Mi)L zs$>*kwNoJP!lpSru+Fo=l4!f~`2D?Q@zB$8_W6^DWVggcD z7`*_MITaIY01Xd+W5hm`r;e5=s(_f?Ed9y%nYqu8*IO#9sw(x2yNpl%T;1w5UXt^z z-1@3;)D?2^?%6d|~e;teQ1?hE~Ykt1oa)4ju?zTL4eH9=*qZVW$y?UQ6C zEG$WIwkY^S!3rILnt9>9AFjgw+`sgC-*mdR%U1a*8z;UcWro>X-lUB;DbN0$)cnb* z>?_Wxc#hiokW|atW}UVg5lH2=+uw0aCT%UqxE6=MPmy_Y4nq+Oj#sc5hj_lgX1PnA>mso?r|-J{9GD^^XG`HJw2%KldgQiva9dSLni{gsJ290WN@kp zfMF5-1p`!p;Y#bl_MAmGOgRwAM#_-iV+WHxs8CAK21~9h%>3(>Hay3#U9H!9xoI_R^oA`(t$BF4oV! z`otBPgp~ng;sc4=5F^GT26}v3`H6898NjnCO|*bCb>?p;F%qo*4TIi6D7u~K0%7t-i$mTD;J6qc=@T12s5~AsVE}i0*@`7fS7PO$G+?z^P zsqxAR$I@nxLp-o-OKD8_ZtMox9`Bek@Y+2ziy)fC2o^E z3NWV!#K>^i;OXJk>mvGuiF0W%u=pp*T6=2Z^qgQxOGb;83fhba+82afX}7)(<)fL2 zh=T6CBp}MNt<#}+IYb^5b=PV0)pVCq5OMKsxl+8vmWH?fgIV1h5wJl{Poz=LX3fjM z5AL+9G1Tr`v^i45Pf}p zVvhF$zhB7d7BZl6yn}HZEw-Ziq3JtIGUJ#DCZipK^_@K6NY(%L$8 z>;pwt98(FO&op{57PL+{l#-^nIOhvxEw?U=#J~oVMaRj{=Dyy&J@U!n_QBxu8zw?9 zLKxzj=ML*QdHALUWZcxRS)LkWV=1d-aZl)^r$^Zni`2?U6TFA2@I)CQmi(lAF^YFk zpRFAC=dC8*jNY(-P>ET+NA9G*&fF?bVf|q2 zot=|2r8Z+4*0C>SiYgx_MfbLq(LTk*swH<`T?Sq94|vx_fY-I8zVjGwpf;Pg>UyMy zu*W-J-qk2LOvS>v<+{I(nI1dHdIUx}c3=O@Ga(iJUZUdeMEC>#H+^`;wjm(}Egy3X z2~0=#gLuCub#;c0@_;jW(kZZA7cBQN!KLq9Qh0>k`40srv(M3d*YTU?Lp*LkG80mC z2V+dMe+~%9G(N~kZvQhQQ_T$?P#X&hE z>uuC*cIAKArd~%X*v_Kr(Ek2;H!-N`QXDB z^N5#|%l_|T|NPi{qc}SozC_OXbhH~ivFslh%_jA}p89JhVV49qf*RCB{?EP-`;%z7 z$Sk&NO5p7ZO+S7-`D49ORv2oyW?b%xDy4=PE--eOu$g#(WQ}4)_=UlxaNU+e3+X6f zl`%J2vl+Id5|p@DDU!LNaYL2o;rJ;OpM0xm{rkNG#v_(z{QJX>RlPso%r>&vd6%5U zVxHZ!UkEo(Cia(BVW(wtG9A)3j#%sj*TVY;qvm=!kOZ$RA+`At% zOTs!?N6rI|J38_WovMe4BQMM4rU%R?{6b)am!UEo6$8>U9woSAB8HnvLg9p_TeT`) z%CpG42uX{{ZpTxiTf4T|!)ML0d7N+`X0Z#R!5(&z(oWsk*w32K(#L+@Z(ZVJtsAA@ zP?uC^th|a7C5i{COUKDKXY!RuHT(Y zc5?ajTZCJt8Gd>p{lXE}b{pPiSkV-FZPIaPY;~&V`aQJIq!~2N|E%Ey^2e;MoCNnD z>S_9}CADkS%!bzw1;K|djJ~|jSxrabqTtFh#Y$!OXC}KS^)1g)>8~4$H-F!eygu=G zCouh?v-thBjYZ>|cfvbQh-qTl-SOds1A|Q^uep{2b`<2s$wf^Q6jtaD;;Ty_*%Ukz z??3Lq5%qn8yl$3)aispLOHOwQ0_i~)7Z=#dM2EE1$~#KMMe}Wc_xCsiw!OW5ZkD!6S$?CT@zvaZ9t*5vT;0_!$3hLKElflJpQ(y=Vv zO)fpj$F}B$Itz{8m(i`vxSWtLKmCiD^CNZztZGo|ISS|TabLem3>_?6l({EL0Ikl* z-I^)%3)J}-TrbK>6@RMKH|GkoC-#~YmG@a6!sH(@N!H;)u5+Kq*49?3+2-{ba2Y1S z?pZ}at$|!Mds8{4m%mP~F3Rp>(=I2r!!G}DV6EokXnB{1IXw0KR{cWg6wuDw(DiRH zmDmcN$C@gfzN_39eA6}>9eqNsM$)GjpF^SF`yay)p8e&@Q%{m;NH=+)DsX{?#l^KS z2=+lmWYyZKJdIIA)jU{s_qti;>g(z^5|9o7<%Xv+IM*kJr1kt?6wHr2j0HAF=t> zbF*eeIN&@AMB1bF!E6rA}UZ_D-I#h!xpVm<3favNcRMjFfXLaO)^YYrEoC^vBs08VcE4 z-E=&jYtnly^%Fkc3PXxaW!(7lFJGE~XE>stW~O{9G>F+6Km5oMO=|Fj86m)CP~#$ExZwvL7_EQWQKaB*c$HY-vVbzBU3X z7M7i)vfKD$5({O|G_Hj-Dgc($T!<*CG=?h}E;J9M(J! zR@Z*Ez6lOJ`@t9}Tbsr0*&b@Y;uSkNJVK1oe6MuenrF_h&wl;++osr?4~x`C-z)_T zIq^0g>PAc#z2ctOcvuqW!a2pX+2R>Or$=mS`MIEgTF%}bXifIS+gl=+v~#XO@$2jA zx?g(zI|${#vUK=aKp%W$;tM-}oBE3ER^Go(mu%=d4bfp_bkDEQ-xj_MrSrh0O|OFy z&mApjiqh53v{l3WAae1t!>qL;WQVOc)#1)|0cjDTeKX znGcz*n{4TQ7uu$4u-pgXL;S)*Mn;rTQvRRzNzDeZz9A8tx41=uoufgS1!drp^v8Sr zdR%^v;&z+ji7@fxFBkvq2@aohk{XNCMadBu8nESgYL!%)^vM~P@LvMC3avr@q~f0EH-}ip9h)<$VVQlSrbxli7rv4J(G}&S7!+v>Kg9nRq~c2 zwxtApRIKV;rGMMd``Hni7v@}yD0EI7cC1gM_n*+(%MdoS0jl|itj@uIox}8?`I@mf z6bwi>Q)Kb@G^FRCf{o^P6c3kP(5yVZ&*KXB`RpJ1Tz5sM zF^t6gg)&8uMP0Ri4?8$JVpYpmzF|b2ssLJgR>tRix*BKT%t}A={kb=tzm!pRSGa55J_`CWzJ>kf)O!@NE?Z%C z6F5hjxvgIJb_2@0uvE<$d0`90`Sx9_BohYNKhV;-GCrQ+v)gu)kcO49K+on^tlnH; z%af!x#f8^%B}-i=CDL0hPRjFZP{4!e8St!W@kr9-T6iuMc`UuXTSH@Va#rJdOS+18 zAEtsiFdA`+(iZ$_J1045y|nNAu3>gVgc}58$IRcJz2z~3hMaE=@$c>M_Z_N6t&8Jl z>D5|!bvPhJ)9Bh}7q~o;nGu-vV(pVy`c1d|h>0A3+HLuEOWp&%2{ zE&0blo_zFc$Us$0Rv&U8ZczQHG+!~|elk-tomnp4;YuF1_eCdckJS-*Ggk-{D;KSJ z{tb8~zOt}niE&ORk(E&D)#TyTyqjknR0;8Zaml??Olw?P&wD_Ru)Be(2=h0CkBB4~ySP4Jm3)FERc(;iuJ#a&j-%E`1WGDj{|yd%8-^ z$`w0*b$L$vEe&s0>bep$izh)91G89@T}Pkd1SvWS-EDg;H?1s>a##*}OV-M+eJgl& zQ;Hk9cL?@5uV;}_d#avoo@heh#StaxiTQT6>t+d`6DYLm2tN6yP;>rj30xT?Sm<7z zwwv4aQ2O;|f5y7tqek?|Jy9XQ0tTU|=aPw!+_<%w;FKTV0CULv>96__{Ag1eI0HAS z6)=-(BKP{yMtR_uUtU>p)))|5=cSd*|K%cA z+TOsAVV;$GRR2^SfI8E*4Q*zTa>$dU*SVR6WTu(ETn!ahcz~&Bpk%9J;-(!u0U?H zTFQ{ir0WIyx_W)-DH`dOOahuN=O_E)E>P~Txf(1?wu!~nmTE0-0ym^K^8fJWzJYC= zi=!_FQn;IXfI{qHsg&rGa{SXH**mS8u=wkvM+tIHArv}3G$~S{_Gce422| z+|da$2e+SdZM6aMPU9W0Ody`3$2$)^Ut%0i;|Fey4d1ynLpR-?7V2YYn^*iHY}fX% zK?kwU;!@P5RPN2<*{Li(Q81saWtk)Y?A0xPkAZm0RI;jANxF%c=JW_|P@i{OZp|{* zoN&~EB8cWhoY=qZJU%DjdS86kKpa(?(lSexEPLp%L;_ph0IFezwBNW{^A$+~!hg|1 zapHXRNEs<3-{s#nJahoUl4GL7tFjLU^q$=2*vhzHn84D)qv?60%V&j}Z-Uioh!=yH zm}H{lH@2XJ53{t@>Xa=EJh&HvIvP=SryhzwFoBE*pAPlk3WZ&U)N4Q^+oey{vczfW zKqBmp$fHXjw8mA)j67gPBFW$dyQGR4vP7S!eg+u?=QHGKRcge;Wv^oe7Z9vAV#x5< zRJ9BYI%M*y(IiK2^fZOgdQxghh_%xNsT-bJTB#NBh!zT|)E4A0;@MNKXG+}ou?*&X z=L{}ywT~bs@nsa8)4=fJlr{P1-Tg$ zi+dT*4Sp9rQ6c4^O(gEgM_=6XZp|0_Pk>4#wJZkW)fA)D=D-&o`$1VuRVs25OLX&7)R#Bb@8LM(NAN znL6buVV**V1FF3(8mi};6|g>blZ)d`5_3d-QmnVDOLH?}K$?}9_Uf2qcMP}0;Zygt z)gi$OcaI8#f!M}-i(^envSIf8wqMnkZ}<7WP%7Ah8KFc{aVXkaYJ41`4Ncy(7i-0= zbi~C7@J9G)sX><3im>2&b0+BnE@coW-K=nhC{aMyIEB4k0@4Mp7rM$6tw_# zBtSPFH_cjvKpf$fJ?9~s9BA7~|H!X6ob?0E!Yn%=d||I92F8AR!yS(d)kk&}rMxig zQokjJ8^_cE+q+MrTyxGVtV}7c-*_sI10BbiTVX(!NvogTR%LS}mXC_4E;sYT>4!6~ zGJq~$ssV{1+KO9=uT24`UngmY`PK!8WFZTA%O%~qahd^4Rj^Y_f7vo*q!bfChnx2c zg1L8_zX`TMabr@&wJ`cYvi!C{e(aUUY2a~{(19*L3dh8NKio;d4awh+C%jt7kH*2n zFL5Akcp{GTB)gfwR1-JC696YCtsFPSN|^xAvHvL!Lgb8=h({oD%w7pEb!(CX3`K}N z4M<0{u@{ars;HvI0|t~GH}IZe3X}iBvbO24JR7;Yccjb?(s`Wum@ zsw%zqe8|6ENY*fiM8CQ^_1k8*z_|hWbb=mKl#<*1=dV~-(+Co+;CTIiN9I9Qaj+`L z?3+LU4G!TP$B$1SJnLY#vhE`MJKJG*n<{#LVr5|c(<}~d#d|CX0MM8FJUHwYPjP@( z5X`Gr-a~*x&J_y*%J~<2NXxq(W86;0$pC9T-cJ1aSYm)Y)O%OF3?R(oq^ci={<`X_ zR0yoW%w(>Fdnf$Gsl(YdO(9hLA7#n=JOa1*x^S3yc&Mg1gy|&ao|QTFaO>v(@u zQ`>}a=O)fs@f@*YgO94e0Z@pW04DgpGjt~aPCfGo=LNLnb