From b1e666dc22dd42458c5979d76cd3e7a8bf567412 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?SAL=C4=B0H=20=C3=96ZKARA?= Date: Tue, 23 Dec 2025 11:51:23 +0300 Subject: [PATCH] Update penetration test report and alert screenshot Replaced the alert list screenshot with an updated version and revised the penetration test report to reflect new findings. Added details for a positive Cross Site Scripting (XSS) alert, updated or clarified several false positive findings (PII Disclosure, Path Traversal, SQL Injection, etc.), and removed outdated or redundant sections for improved clarity. --- docs/en/images/pen-test-alert-list-10.1.png | Bin 0 -> 47573 bytes docs/en/others/penetration-test-report.md | 84 +++++++++++--------- 2 files changed, 45 insertions(+), 39 deletions(-) create mode 100644 docs/en/images/pen-test-alert-list-10.1.png diff --git a/docs/en/images/pen-test-alert-list-10.1.png b/docs/en/images/pen-test-alert-list-10.1.png new file mode 100644 index 0000000000000000000000000000000000000000..3d930e96a81784a9ae8ebd8030691041af1efdfe GIT binary patch literal 47573 zcmbrmby!h&@!~E;i&t>>U?Igzup+^w1{5pqRvd!6OR?euWC5+K3u zPQUki&bdE3=ed`E_I|=XrBtDdu~9s72Cm5&WdFA;^ory0(oH$?J$ z0!$tN=3zaPxHclh++f+W+&cCvZ8}mc3A}}c^lK*30`3GBF=NyK`3qbB(z5i4}A0!Fol4xtf1?hFKIWzDGSsEUdSp(Bye< zr;pxJzv_`~QUx1@HPr6qtNS*sJ~>;(MuY@dya+u%mt}9M^P$PBya}7ed2ha_7hbE5 ze;CC!hgxaft#&?+O;IBub`t7fPq)n#kZX-a?TQ$AA}f}2+gwgR)LG&_R$J?aNeuuln=TcECxoFyRv1_!klmLI;(7>q{`q1aHTpVStZYQh6x7&xk z!^?i>7MAsU(2jofny%MwxKa!f#C+A)yxOYBBixMY{Im&SJu5)gz?RAL@xOdlCiyV4 zaCYYoozB>qxe;GqXuOLfilek?ROC-Hr@IrVYSrOK^Gyvh7Bv6dkm-EYY@x->Zib0` zWZJP3_UGcB8r64IUfagho!r%-VIUvTa{MleMK?_Etja^S`tzIuwv3 zpb>9uNG!)m(Bnbh2i_^BqNe9^c=j_VeR3m$Zu63P*Bq~SEqFWqAXW)~C_AG{``goi zC2QXMx#QVE>y^RYABTlzR<{|y%aa;Uy9qxY0YBpl#laSdD;@?LMMa&|ZmB~D4=k)f zd{t9FeNAo>N4MS(2O9U2)Z)^nsQ2%Y(dhhK0WuHyLr}q9;jd`CPyXT8u_?YUWt=>* zsa1TWjuI)tt2;hhl5|0d_&+|wZJYgddbnuD6UWKQ6;z`a>jnR|9P8&HVDKQr=fWX+ zqKL)m_Kd$kANjptpXQ7krVE@%<@@K(i}lc}ER z(NTXJ8ZE!wmS9+{IBD<;=zU%m+_sdF$&(qIAiJ~6DfZ*=-+XQqP@=pWi&d}4d+^(@ z2l0J@EvA1)h!s&}xAAkkRQ2enj7K=pPwb(sVa_#gfkOS!RqcqB+JfH&a_dg~#Ft!_ zvE;HCbm{2UaEULE+k#Imxln4YX?{)VIKGL_ij_`ft4CXsfd4MT*W0{-O~`VznFX*m zdG}ju;S_028`ISXdmo@qH!g1rQNldu*(k(@j0Ar|3<*|S$W^!-UfR3hkidDU=UOdd zJcTvdn3&!X)>4}!DU_AEXhwrawk2h#!A_)f1?mkhO;J$yd?^M&y>M}}uC70b#v6q+ z-cCFw4>(k8{~`?R`T?BvJnQ3D@85SSy3jWyz$OKL{u4C3eDwbbS=y|g%9i}ZjEGfB z!1pio`S=0VIx;e1M0f}IbPA-d{@wT7yPoC&FKAO#@}Fn^TZEDykv!LxIgs%Zt3!># zyZA+eo%41mU!R_4Mp386dg87M)9U*D=|x+)jnAit%`-b!yPXA;()t~ste)hKwJM*b zC8VZs+oEFY_ABjrf2il0KZF{a+!x+F^(SbRxER$_zrI)Z}d3kim6jHb;cT?J-e zXgZ>g1_)ktF$zyM*Y--zp-bIBXWcwx?|hRS{C13LJd-o~TWw2k*4_$v62W9FpPm*H z?F5kv>Ss;3dChkP1Rb0%Vq-gOzM+Be`XA@|v1C2by+)!-Z!-3hLx=AJYd0W6^J;vp zm6i%@NIvL5GJd_*Ad^ANe@gCoLMUuLawjD9Qtj0qgHnmN4+>uIal@aQ%%@VBy>G{d z$KhtA$UtD>3DxO88CB1+ONZF$?M{8BDEs0orI5nUqbCqHW;H}L(f&E!iZ=pyS>2nx z=nHSgBzv*mHSf=@Qfx{O9C(AC8Rn zJb1?jwiOOHsQyGdOiaD;;+Ar6e|%A;;hMLU&t)CAyUjbY9lg@%+!4de-;=sEmvHHv zVuMb618(EQ+Wi}k#poNQ_~W3G9h(HV=lYR&C7 zGxx`)wPq2GtnXZX1(l`hacul>wCd~XVN zr@66sb~-j95%g<<)2ApIoa@eDouSlupZD{Y8DStWdZLO8}y!X$Um^Irnvwy z?v;TlKs|D$a0gk*T-R_9&yUcPW_B}+QNQy^0`dZj7SV<2*NqSNX5~*-e2pGY$NnHZ z>0X9(1s`(PYz8U7&4;oc4b5r|Kj4#E4*ZtzWB6`m!ay`PyT@ek^E87d`$)Mp!{GUr zdhbiwA87hi2S+ko(Z@gLm}!@L7G*#wu)KebsQ z`>;S;GRmR|H3?VR7}&v7?dH*z`bRBf?YV;@uIjgJ)_kpaOTynxRp`ad!zB$L_me@* zGe*hF<9+c%i7??mcDk1F0B4%@=r&JQ`}rDOzNfsrV~FUvd@fS5gZB09oRwJ5VnF|t z#9^ZOVx+*nVd#GFnjD`XnKGKndQei)XlAiMhYMQ`AzWpsfS-E8%MfRkgZ?~6DoT?0 zu3lWn^Q@vo?;@}!le(Hs)sxBGEr;}SiPEF5Qh+<7){hVz=`W?~9H7HVR{PyO4L`>% zqAN6#(IT@qI@(-oErdmp))Dt{D>-$R$-S59Jj{hSS-Q957qgr) zpZc>kPYRbi_zI#kp#U(!w*fIc>gkIQm0K7rKd*{tFiGjpc&(l+_N#TNF-3JM3Q1gS z&e*KWzQ%^m-9u`r)LXx}B98S89)br42#maym3f%qc_z(r{Ahb!yg(2(;tgX1cLozbdInbz04&R&uUo!ak?enk-W_@?jQ={D~X@{LX+-T0y;J-N)yFgA3x$$=aH>)~Hr2WBeUie6E?umFG%Ed9Bzf|@_ zATRoO@=8Tv*;kEJR_Q#G-(#SS%^)=IPMQ~4Cs$#yRDffk}>9rSp>0v=?kjx=i4UyHB1-v}|^>(E6;TNLXX@ z_l^n#Xl<||$- z$IkbIWB`vD_Qd4NjJ$IoiQ#Hu}gsWrY9mn{l%lX0m^eC}i)LOG*;lnsN0dTQpVmn_v}0r+=Yd z4gRE4$!LcM=5TMnya3)##IGvvXt>T5IlRN+IhUvYT;YwwRa>ptwicCn<4xifQ@ZUh zHwU|3ASS308G|$?rSg<@3aqthQ+~g1SOj9HTJiMA`vH8CVmg@(MW&EO0a&l77MWY! z+-5^`TB>0!h|pK#y@KuQc)>mP=(j`wE|ULd8MHCKF|K~J&_-SzaM$vAy2;b5tRk{S zCmkNgv?_OW3}ZYQJAlvEudeyVO56IFU}`O3;bw=QfEU&pzxr6haENk}cw{bJ>g7AY zA~lSB88N`iC_=2`kjK1l1l4!8!>!F+8)cR_*g5`A`gzN=9VX)lPQ1uJC@HSBYD|zbhJAxFy2U8`K|y4Y zBHx~}_O6m`bBob$*L|0(t@dn()TGz}$_gO3ubI*S8|0Lp7$zp-3{G=he|;4oFm9W} zukkloa(?oPB*H@UYu{zRD<+p(d?@=56H;FTNDGF-V9g5k{F7&m6K!yE0*~>sl$YI& zu=snAg_TJE-=t%`uf`V*N%xTZa2XsFcWw0`|`W8?DgK+qTs zqJ9iXn#ZHI^a*&~2Ym~h@TUliLaTn)di$QlJ+^Nt=Q^v(ZI!UUgvP?o_t*r9-RS4x z&|j)Jy6vFR`)#Q2w#^Lw7m8`7Nz%V2pE7f80A7OroBCNeXf0&U zCx-{vl+b{xSWsUWgG!v1%1@g#3Y0{I8|y5DdMoeI9G~2t*!0rr?#sUUQ%uRHdHgVw zTS%HL@O<%0%&xriYwaXe-;%8Oi}bB3r&kL`lD=7QeInBoawq_HN;`v^?E&JlbY3Vf zlvbZUW5F;)$B6v$r32@+&gC`DZpYg89~RK3ouX7S-4a8umFRHh&=$a;54%sJ?Ifx3 zwtm*|2bDU28IFIh)|KpBpdLG)C4_(5q`hEtu?Yz7RcR>eJi+%9V?V}yl5{I{PF?-t z@}WqL*P9C*KpTshLd1*;Cp;-vIvbcz}YYq_$`4qAmE#=Li z=F!PtuCIf`li)bc1Oyd7=!>gpr9x)fFgRBXEM8ZoTmaazSP67K>)7+S)te%Y<9lzJ zTW!x~w-{I~6nt{TuAkq@Lqi@K%-{uYC=`(Yo^5r%Y8qMT$Wjnv{Tm2mXC!MCFJ>1s zb25u$&bZ4wD?yL7ksoPR^z}~8Gk@WD-Ht^M70wZ>Gy;onw7=4(DViIaeLZ)-5HKZXNIB2 zOgyb;d;0`?NY_Bo@YQ*UF#JXFX(SW27p!`|2}bZrBu%^y_{NLyb-dO6)TIm!r}%o! z*#QF;fTuVpqn#w^vt^k9Dd+9be}uEO#30NPMBL%n??*m} zC`mL*{i`OeQ~e_aeMlmX-FXf?g4JdRs2`Xc^OszlKeoMrJ7=Q8<6HWq zpMWld)kalSEq4m)skvBv=>(u!3rNyOM|byF)M*(M$=~}brebw5H$J^Ws1;QPkg3)t zVOW0FC+?uV^wDLA9TXKio$z83Gr9ZRQBQ7(C zL((}e`z}6jdZszwxx300d+Qb3+)zxfE#{`@uRBN;*-JTg%_h`xH{Y%Yax*D9%akV+ z)!X-V9Ou4Yb?NAqr;8TYwp2mOp_+;1YLm%%Ef7;L(G9*c+ejv&26vfSd^x!t3gu;{ z+4L!D;LTVS-8yA?&`aI?nsVPrzPWdMm9nADo>>s@@KxLF_lW|;$iYA^I(@_ZI|)B( zDeQ~9902T6;llo$h0Ozr!#I)AGWU%bs(KeBW^3%V(pfVv(Aw#Cl3m1qq0L{~f_gu* z*!~$!au7?Ba(UTNNUuhk&mY1qI^vf6!)o~18pQO&fn(mv(<;#G48{E3%c zr~o&{uAYkLQ|n{p5x%x!(dXz%K|Vj_Z#xYw>9o(?!cm)Fugle5*IMQ$%x2>$)fH%p zg5fOpLimCr`5qf~I*c@JMtumm$<2P-(PP0MN7+zr9vi%={lJB(s?n6!^X(7XmPp!0 zFTNF~$l!T&bn|v%GyY<69R}r|@vq@YmvqG)bnM3UrsM-;(gCAXSZ?MYdM?W zPoY%YzLtm6(|ZKFRZ5tZ<+Id?(k1Dodm5+bGsiuoGtOM1qjqnZ@cRk-_ccT>^ z<>b=Ly(rIUZdp#xX~}N;CVTQFC*X9>Zo%B-1s(^YxZ2A6%2#KNh~+yUsrc2)k9taq zdWy!rrK@m3H=B;{0^-SfesyI|fd=o}lcp?WA$|oFhV${5*R4)UT1zsh9q9C{ayCB^ zX2GotALb1m84&=D08FTDFZ=sTHJ?BKiQ$DhMQ=z?fT}i3IqPfRj$9(d5F4HtjH%#TNYVv;R)lQCz*rcCCSdUc$b5I|~rnmPQ zu{CaJ8t9dDV_&E#rP(F89iDujr|~YN)Bg2mw_k0llyqFO)nhM=*iS0K|08G7tm76S zYpL!n0!T4im34Z}iH|X+4tCn>BdK4`gXnl^d0T-CNCl&a^ROYlec!SMOh3I=B=<+OXO=QA5S)u zg%#ajfNwVE*TzxJo>ZjF`}_%*s%tcGb$J3Vxn7J$Hl%-<({9RhvPqA*zh*9fMn3Cp zt#dyMqa9lI{e$aW8i0~^gF7KK$)lM|S?n|UwH)Md5^@lk5=O$^o0xx*J_XTyUx7$M z3ZSI3GQIFtyWe$_`eYP#4a1Y#KK~f`d_x6!^x|B%%Jk1)T!ZL_Sw0*0s(wX#WZXLe zB!N$W%!XI(N$l=s5$9Lxo$0-|e@x#LjlTzQQ;X^AaET#_=uy9I_7Gsz2baP4s{nMG z?oPR%%;>|J97lie6FAy()eL%;kVlp;yHLod%X}5+Fc%S-glH#%SE#CaKof*L|J(_$ zW~z8rH`Mp8;3?;PePl?8Vp=u({d5D{Zt+&(VPDvJG{-TGAKKT-oelS9wz0s>!TTtZ z`tB0}&dI5~3p~Y2UoOCaw$A^f(lD2lVd@0PZqMNnrMkrnWsOTGYMOx1_Ltge6BxVR z7eEJ6Isw>5AIHgl{+axNh*je6_nwWI%}}X`x*cib^bGI?&!|uNfLdy}4@2}|@TwW9 zy+pJnF>*R+8Y_)n@7V6Yms+^$B0s5X=@=X-I+uyP9C9-7U~m35%7BzWmFgL3PAw%c zByZsfn7BYaB#l^Z?qO6PYCwJqAW^@IG8`mrpLb-xre=<9D$3>c`CfRj@0V-*O}mO# zM8sikA%@YFkJ=N9R`1>yv{=FT7La|@6b@2)bLjYIc-3OkcBKoKey+vXpNt-8+KLuDBW^x=!RKwSr=jSM=cg!vpUX(8-G@V`Y zpSoTIZF1Of82SqOpTk$z&RW9K+VwTAuB}8l-jD*aNfo7ALYNF82^G~W_;7DsX+&9X z)?VqMebRQ)7Uml%u2M@v^jtSX=~_PWLkVyOOeH&bW##hD!m2^oJW9RG)&U&*Ohdrx zMiAV)=Na&2IDY5jGX~GOV>3yVM+x>P^8h-)kI})WY_LhO)W|BM>1;o^AYHELhXHZ0 zmTt9AFV_nU_l*eXFl~A^v#;fxsV%aQaI)qpEzd=nm~X9xhegx$eBww7c*vdMKc}XZ ze>2K9WuVSip^U8o2o0D_1xp^N&S0*5-}?Xz#&AlkIy<0-1YAGh=Q9oI>jAfKRZUHB zp7rZt?tw>T{u^Om{4?uK#v1C!_pAJ!Z+?z1$_6~x>cn}87JT2mSWA>OSUFSUomwK+ zykk5mN_=Z6#@_$#c9dJ%k5`yiJeiqh=!Q*gPgQ_RD4i_5g8!=I(U*zymqoO{b!c$> zyO9j^)g|uV#dzw*A@i2a0`nJ9txnsK!!9aBu@*n@=WvG~Vdm7f_k-cO zLl-^)M!Tpj^>Ip9)7|X{vX{iwXY88B6a=Is{NfL)H(zGXAedyeyq}giHPfZGq=gPm zrIO*VPfX1CzjyUdZcG{0VczK5%fG8yR8%5XTA^>=1}TWr*jKDSpF0tRgLaNnB#%dF z>|7oE1$!DFa-F#axyVEt%##5V_#pQ2ua-={?Ra&3&fX&E+IZ-(-yQSMcPsfgz;8<1Bor9X@A$E-cq>+<-(awJ2S-C(gF(`pp9N>C^^`W8<;bb z6wUP8js8_k&dw~Xp(?9WI#Gb6WVbmselTaWRX-NtARihy7{RQR^Ns<6Hg5xw4}{l{ z_*vh7J*3Yp6faR^mxm0uYPjIkw_;l{rJ$zCuGy(_fAbf z=t1o^n{q=oSH&8v0B0TH(l=zc)Tx^LhH#Mpk%_nMA`=-_KHW5~^rg{lr^Ne8KVAgF1sY z#caj35So0Hv^6B3>&kJW&nKXSVdCa~o{?Al>Mw?_$4@k{Q z@l!NxWI%pMMaAx1MWx=8H*IZ?@CLkI&2r{NHgm1D+VUf6ZPrSZDhwrKcMtQ zV#FP)9W_q<}xb&cU7p{SKTc|Q_^&FiIXb15U^wAAii69D+^ zhndcQ(%fpM|A3N(^MY#imzYF$zDIgab;u|_FSTC1m5xBra7%f-=x>(FOZ*`71LxSQ z7)1QuU&Pb=cXLF(6F?;YBVP=1ei8?amk_<{&-ASV5b>BO|Dq;?^y4)J6J`t@_wAE){`zG{|#Y%P6Gg&UR}J}(OyBw5a9>tqZ*v$8q<>|{|n zlJOJRV4YG7j^kg<V8cdr$NTZwyN*HryB)P zQrCNsmJ5$~Z*6KKW;C{`OeLp7OAM|wHR@KF{02kA{m|YjTZE&4j@0Dv5xf?;Ny$=8 z+`2MGNO23REk&4l#o|Z{)R7*)X3LpiLPIO-b$Ss9XV}=GpB!s%_%k%BELk)3A;UKk zYL;{CvQ{JSn8(wPD$o3b`gI5IX= zTUjebr0QF&`5FzUo3^86CqcH}L%zg=@k#Kt%?o3P}Vq}m1Sm4t$Vexe86jp<={Nq3L=CZ zV5@YkP3>Mgc7+-xnR0R!r_kyO{*f}u15Swpk%5Gs2g{OGSl8?Ki#UEgfQ$ z8N;ChAmy4nvLw6eWjT3wV-_>%pV=xic92Ty&SzLr)Zlg>_*LG0GlCAPj-w_~@FZ-r zDYoK$SjL=fQ0}7k5KETPm!C{xMA$3SgWha${hA$0qNjB{=>3G5{ok6}Bmy)Qrf_<; z_`3Yw(Ai7}Q)uLo=0YQRu90}@IN1ED7i2uyenO(5wV3{Ju;RegC(X^@+@ll!f!ozU z;Suj)Jl)~hFIb|ZMs$P2NSRQ1bWAJ8=N+%z74|*a=efZQP72p!NT_u^XJh+1N*;Q&Ow#DKAz}erN?k4u^=;cb ziQR$MJiHjQt3$rd){Ac_NKx3$Km6u|&{*E#z%wMZc*9=%R@NqxJrZ7XI62{%S6yKu zNb@`h9b+_a8K1Lf0PPar)+z<}=5ow3_Zi@yufkyGajj)(jooEz70)R&@Grt2KIJJ= zoeQTKpd8e^)XaYWi8A)cciPQz&66RipU;f3Q5eBC@Cf1Ib_qF2T(W@IvChH|wpX2f zwM99SDuauBdc|1G0v?rEYqRIe!*F!Xs(RF~6nASy@y937@RQ^T!*yp*d6Xp#Ne;&@ zjhX9jzU|FZy8BDBkc|7NQe&!yc7>8nj;!F+5OWtaI-RWx9GG ztpvShw=&$2xsqN2w9Nnn4~95ucn#h_a5KA<4)3q?&#}BgrJejqMYHndk?c_CeA@)1 zNTYijgj_}4<)T56p;VvNPDelKn}>GWiuAo`vMrTI6kYVek!M$L4n@-Q!Ajr^f35q8 zN3vbcc~QF*trG#{G%4fyB>cv~6D#`KUv0!wEC-jilj&GO%U^%jp_gSM zlP6te?)Mp^wbFfHKPEK&<~%+2l+y9f2i%{bJrCp8<=!u-qa(Y&;HHNF5zy0Mywt)w z$V^!??#*b6Mp~mkB!9@kbD?!jWQ$*FP|bxjGO*twf1zn!K{dOBUk3s@u56pGM6&~w zU?frd5a1BZl&;H6?#=bv1QercA*r^=uPDn{*_3x8n#S9prHKfXWdW7h?)i3asl3Kx z)$h5IzjiwJ4zKc*NRKAAVwIp6cEfpk8Ag8#$dE@*Xc4PCllkV_zOA^4nY11^E+1Fp z3o;w?r3B52@6jV%UNDN%PkR;0g%l_bNhi`S6XP|ch=`AziZUz+vx3o2;Mo%8q=Xhi_xmB{GJ?GE*r3;>V z4R=z-r&&*~RR5{9isDVgmEl{wS~swX)>BLF+XGJ|3ocStq!;8+pOg&x$uy`VSmWuWH-9phW%T` zO_xXGrNYDRkb=YW@1-FXm-}l3P*IBwA>_y;vS1FNP0R561^M}H`o}6fuOqfTZLya) zuZ!uYp6|7DfiF*GPi(#wWpa|Dqzl`3y9&TcTIXslsn-QC8Ax$!q08u}ju+PRtZpPE zhWoD}+A5VXQZXloV43ieb9F@WMCbA?!L1(l5-pLcI^-nyxSCmq+j?)^=+jxU&BWb@ z*h!*US%UD)!e}=!=S-J`?V_vv`6B$uueG`ip$7}_mXNCe_ffasf*ONJ8jovPfIVdI zkR8o=*ITt*9+Ei@vey}y@O-f6Vm7fSOo=)~9Yq*(zm7d+a>*$~?i*&+681~*OSxtb z+Wfeq!)N825;pm+K>8!~ouZbhnFI$iu~=D87I}(%!k^b*rQ?fn7jJ|H(Dr7z{Y#0o za$kBk*GA}qt$1mBvAj;@ z0z2i*)Vm&ONA20CE;0+N3K`PY^Z9jRX7g4TnFF_6JT_X!l@7XtxhAyB19!~aa^ZHD zO)%}{!}3yEX7eg4@fJcXoEe`@}>n?F^?MzI=Y{mwc@(_ z#{WX&)oU}728idUhqb`nezP3J^mY$!(_I~bH9?Rxjed=M`Ziy3>gXGxM z8pL^_|6N!hP2b;yBCo_lY}8RGYP$*eORO(WfLi%MB-BarS-*=2BzGqkqtvxghy70( z`vmH5mi~X4u}6K*e+lN5dU}(;GxVc}NY?3{dsMU6_VH)rN49ij>NJ<7=roMz`beZ` zlJfVthtZ6h6ex`6G#k<3>M;@#I|HUnXl}~-_BR~YzPrm%jEZ%T^BfMqTS*#x(6@ki z`fx&KymG0n;%}CrqyfLG%n&7l;#f6KUfRtsrYnQ%I}3X*NCut<3XG}K{<9RClrtDp62@B~8Sp6~UW{^OnPV{J2^Huije z!xKpliSn!C6wcfQj|uDDp+egyY(%yN~emKslKQ|cUF>l{p~^=v@!3@n@ILU!7Wu;gFB6V3~=n` z&rlW1w8{KhOYR=`AvB79lJj6S9X@v0vb#=USYA4 zR{3({9L)u=Jr;+`)Jl?)5*5mcmZ}1Kgp`=jx{*DnyW-Ja(bfxjn`e#l=(A(geWpCUIbN#2;d%qmu02EJy*Ug;Xo zrUsG72mw7$4F}VLyj{V9Vo@U!%HRLg1KH9-;x`N2rV%QLa6(4x4#C#RmWUF2TryPn zP?vIqs3lU@uc``@8@s_FJ#NQqX{e*0kWRtEMW{df60y~D9A~e^n9$+)z!Rs(@G71R z4sfyC0!6cr-hLvgoWX93#flyf4f={>X`ntjb}NQ_+*}4B=KvSw-MA`;4638SuXlJ>N69_Zd9pwmWYOwkyU}jndL)uzE4NYH1%*7r`M;Ek zo6f$3s+v^043PY7IRZ-N-Nh5BWV2=iJqRQaQ3jar-MhE_bA&T?3F{Z}3=vt}0}Rq1 z);z`y3$I!Soywhj@@hyaon=iyh3suNpgM`!DvW{E!LnBidKE+Nuxd`lufp|;<^)>| zHm*&vHPIhGJQ0E^T<|)N8ZTeg0K$ucO$jzeFj#brU(;#D+`Y92TDXBLAg@mR7m}+# z(|+9nMt`m2|0ALCGH&Z2=>K#?L*bRSn=x+!1d;mN>D_NnqI|q{?9{+9RtY5P2m0l1 z#8Mj{!oK&yFi)~d+)v+Tn^iScxYP<7pM(9#PZVQO0F~|zf$gPu$zEQ1VK>>>rFbLQ zSipSE6>;CPH2bL~a&TUD3mzuRgHcg+X3pd2o2gF#V(})!5n1<0q(MODyC#X`!LAl( z#c_Kb?CZYy{jjQa?09Th%Tq?+1urX}lk-HUH&9$Raax)Ez(1D1OFH>ib#$>T$eUl# zp|%DWL!QP-MurW`>|O=`3-`%69vJ!XlQh&jL4R(u+UJ@H0Yg1oZ|zvpx_Z-AOT*Nd0l{q%<4Xkfn@ux;_7fU9CR+3#DUcSxPCVs@%KG|OMN92M|L zUT-I9>)jf5^>FbIZGltV=rBs{5zlGSr6+=$;kXZkB{LpMc}i!8CTiCz!%f9+dTS@b zTXV; zH?5!DeAZ&MTlmSUr5G0Lylim-dd{09L zLv-G4P!g>yDOgDm{8MW3xp7pvHVsphT{|m`U^5s)=HW56DwEF1TosVpa6PKe?VuZZ zJTh-6VW1ofdL&4dZylFP*6uGes$mzX;P1KD*mo_T&-8?^ph#mOl(75{-5bTQb9#wb zQ}!n}WE~Yw%UA`!*x#{&fC* zDUOLfnT$|3^mu&q@%(YpY$I%;+NQ0#;TiDK2#eN;gY|xiSw>) zceekaBFIbbei}Tr0T6owBqrvH{+wFw=DXp~S;9+W-~33gMnEb*okTbQ8MPD1WyRn# z^mag2Flt%ev9gsf0pUoO#2z*?c-_v?@`VgAkAF4%ihU9F7ojyHwVxh+_Z33J=S|X^ zw3sP{3j-Gn4{>pE z$HTK)j0o>0aGZ43bc$&Fc#F2-82YX*&%>h$C0T&eU8UbRA9s<3^`2q)@p~&J{LI}= zCd7DyU#jNp`J1I8a!fG?OCHWNElE-A_F}TzK1x@CHNA1x;1|H(eVFPO8yR<=1z}{c zY7M3qx5m^-j39ZSUI=c`wW>A@%9<1}d|r;`<}N15$Lpr0ggEB8;f-@434?YGpps!6 z8zFnvd7dYQNDtLlU}H5jS+Q&^2;>kZjno3AlkItQ*0(JJkb2S{zcIn3mPJt}-zS3( zSmqWNI(iqFW);+Gjnfs_o0|WGWhck8aymL7$z=hsj5h@T#=u+hij{093lgSw>QhkL z5+k=1>fl z1QA54F7N6wD)(q3Qvavx#>9z?CydMJZ~gCAZ;E_*Nu)DkF7ef;$~^YO5Lw+fsiWBx z9b!s8f@!Z_=Ph^*MV$kz`mF(|kOl1HdC6tsEFU{48#s}7&XILNc)p5sf!|_S%Nae( z*(qr#EuV#$g^9a9nb0E_b|RIHt1XE4q#S&!i5-}hn!QW`-)Zr8J4NO3|G>D}l$#OF zrJ;!RSCby&NNi+wL6VBoYQpqWp__|$wvB$#MZIf!k5`Zd4KoNG3jM+?|Mm^~u2f04 zD65T{GITjQFg2%~TuY}k5Ko5mKv0L}F8CX!uExPz3B7a?s6bn87D=iDBBqK!Pqafw zUuc0HDT1JRueRbjP-xrK?C9xOV|%EQKs-V8t;LkEd;90UQO;uabQyZ~sDZBBM%Y+S z;>QCPfknSJ*l`?&-NOi(<>5?Cdt}I6_3|eN*??a=*CPb*%mVuU)>o;EB>vE@x9I&k59dDI# z{D8x<)Zm~H!@iKcu;mJp4e}#`u5Yl;?aAA6EL7$TA7Z2g99JVq+2c64lZS$$0-*PU zMQt|VW+|JTKy5F3oK^K5auYbgA{~x9ndDH20y255w>6tL+WyKo!D;b))GDwlr72Gj zWd{ga89KRP`t?r~iF83sB-q+g!V{cG`*?xO6$fIppFfPUl^joB7Volr`$%GPvT{Lc z)jT*!Gbbu0o1#83lfEP4+B!vkEz*=OXAu8mirAD+GJ=0eA5iw1-lTS_j%Mr|>LhzP zwkK;r7%3C5w^bC=r$~9!?*9}2#k)f{!0iFog2Musd+CTrlTi3Kavh9P|L^_DNuN|wH6|J^<&7} z?X$@4WG7T4enQxbGL;z6w+x$Zx4W;ayNS%K!~B<7IJ?4(xDp&Id6zg%UB0yYcZ>+X zE{<-&)HA0bGLC7f<1+B1E5Qawt1LQWNA1fgWDs*R4KT%l2-m~vpJ{v4QF}XUg{{%p zK4?_dkxuee6uD8cU3^#$v@u^BEfw87el*DZw}C@$Y`RvAM~{OVhsmU4oyGU28*l1{ z$PgGyS?krSkJnrMhc7~cMrqHB6&yT`_Px**uwjqw(HOz+Zu9_SOG%TwvS#e>*N<_s?+w z^8fC*K*6WK0?#|CBhTDlj&8=IA2H%ce045y%~mA>o9J8dj_S^U1QO?`XH~XCwxB01 zGp%)ib50%uj%p^ZkD>8;&pMTW_DxQVhAKZ;u`o z+m8k54fwDxd^_2`c!cXO+(KQJnaar;=2}Q=)#0zdh4HjD{No3ip8xOCo+d=gfIK@0 z@Ez)KSFwU+O@JG7%5Z9prGmz+T{_z-oi8Kdw{9r6m^y(Gum%)*Gc*?GR0|AfU8_6q zNtJ5~fK zj7@_MD&-vZJqMR&fAzbSI(h0a$spjV*^ zz}shi1N^uo(|uz?bOLl%qJ1FS#XM_~=X+Wrl+4SFqLNU(fA<3Tvv!PH-RJFMb3Fib zCm~T6yBXC(kilWNRn{0l^c(niTZ{%nKS9w&o;81lB>jTxWtS#}%<@qso$4l;VUQkjgl)W*PP!wye&{#C(q$3kQMt_b z+#!Oro&cs8Ef}f^3G;div<&35xD~fq|Mqifb2ovFKES?=EwD-rtGe$REB9J;!ePh6+aC2x@szr!TV$MS~s&4@V6&xJ* z2R7+55L!xyPU}lvul?=hOP4XCFiM?->|&$zly${4-ndWT5vzTm zV^$dFCPSjd)C<=6N4C*1mzxUky?V|6A)bg!#u)ad{}yKwB$acu*NXhiQKC+JQoPMK z+^y%p6$!7?j`}@e@3kvPr~O4}3H=D_@$wKRqGLy#Zr`_C=lJ3m2|;v`Y5VWrJ?#JL6`X!spm&Qon@Ac8ljP4Idmbc3(W(<<9Aa7kXzRtQ2|ym-be6M;`v~d_ zLPIvQ+0oL$kYMxcd+L)$JQ8UuvU1hL>iVxzX@Z(MQ&=%DtI}BcDBU;T;%u@X z@(e3GA}25Vd~H-*!9yVXN3Sq(pw`&*(b_}yeF6QZ(=<=ynzk6vEa!l6tv@Uh{$1*K z!JCRv{GF$mC(UvGh6m>-Yu+zw3Y;Y41~AQe|LgyAXp2Dp<0<)D)uOa`7^QGP0f-Cc zlz;EBUIzSaYWdIq%Ht*c8M`{!0O53aQyQDgY-+sAcc66y$W@{P?Ie(njfrY24HOSK z@z!Z6PPYeFvZt0?=+>vKR;h@Aeiec?UrxeMy|X;Yh|jkGd!O0;uORW7f;8v+f}$hi zR~>58?qp&>+kCmWP8sOT2!FwFnW+}6p531oSvZ{=`sd5|4n3ZHyHf0tx$)UMb=1rRNToxi$o49){!b=b#8c-f&Lx@ewW_In z(iP=_Q5RKXsBrEA83oWU2vRbtBjR9pwy+ha%%Yy0+H<_;-XO0g6%{QnqsiUEQ=~l{ z;gD~nn`EMszL}dpC>gvOg8k^sLQw9v`JJfD^}p?@t=QmC5v{Q z{KHNe6%Iq@dOF>~jKb659T(jtQ=j>Y&GH~Q3r<%MSVEd|XWOb|7SrXa_59N25OtDe zR21$YC^>bOGmqA!30jbhtu&!m)qIpw$-M@I6p%^4NCvdGU91aY-Nls_rg{??xAVI0 zyq%vEb)p|@y_D*6ogJjPM3$nhHtd)lyctYS+2!Y?$C7(LluY-hD_0TaLH-k<6lYM> zHteSDG6zn6K2G)i_S3wlrGuMr73y?MjWJ(oov44cy||(FoR@PcAk-~Ju2e$37HGi~ zvQKqHj0P>oWvE(L;2n>?=)?cRoKQHKx-qK*Q*+&`T}Vw*y_jP=SP3}=CS@7DanEA-HSf zngn-u8c1+=cXtQ`mxcs)cXyXYgWqa0?=v&^zW09f^Z)^2SD&@l+H3Eo?+Qxj zHy!Pd5G@LgHDv}|3_@IBUMf6R-LaF_k@(*dB2M?wR#FptDj8WQHUnOjg(eDj9^6Mc zBn<$Y8D-DG0Og7ny^#ZK4r5r{jfHi6RGpf4ZG)p!%B!UiT-)y$%t*nTF8yWY-PCiOgz3un31I_$!>d+=bB7-nyHe^}~OIanw+Rgg?W4Q%(sntec z>-SP$``;j_oWC#eVZoej_n?ezMlH2168MNXGNq=j{hFLq%y?qRMTK=j8HEO%$PJVL zE0N=eEW&EOz(FrtOpS9lSHYNSzxLj9(J5$acRU|2F*SzaJb7oENc2%cSS+1v+Llq# zr;(-$V?XM;asHg*HvG?cT{gJ=dF2BgLP5*g`(>>)|^^G4u^V-W`c;*`oqn0_&SI#*9gWNl?FX z3Y$q#PLop6tX6S9Ii<4FU7D4+TtKBz-q$vyV%dwvx6b0xk`kQEC3(UFu0bt6t4w?O z4Hv81Md0g-TycN`MYa8wD9m2PUh1=-K{6A0vp1c0GW`nF#0`wAyP~pdKL?cJuYa07 z>Z!#yAyJehGx}i0DM`0vz6ynE#OKy;QWZ+DR@x;e*;Ltrt2Bl@jl;DmH)nA6O34)` zcEXdz$Rev5B&G=6a9?6&y3mS!@wmQhHj@dc+%{1VyI~rlN`(KL_%MjS*xCL~PpV{Q zBK;}1W1e03sTGSR&GRC&@Vwcx*BGv8qo&!CDPMVRG)qT0QeDQq9+0OL8~~v%x-xDF z2Ze<*U)yF|SE0HbB^~6Q^sA(8cXn zoy(2XF{6VY>P$E`+bphjVes(?U@M$>f1N6%^gy`er0;QEUU+^m|JGvICIF}BG*~G` zeh>BHg{$smQ)hSF&q%&4+oD;eO7Rjkn?l|2U(+)mwC`L$8#axbvu!%mMe7B!3p>~@ zCZ1q6I!2~qmt@2AoxZqD_znlr@-g!H50?rZp(~RUJvY*1jv~2{VWNdDnlF@mi>(}$ zwx+hx4$WC|Tt+QnQ)Hg)0G71INxY^!zWiR6uFYVT6T=xt*?*4L6e&XDZb%{312y^`@7+v3m|{OXZTr zgLeFBEWWTjaJN?bh`^-Nrw#(1@zpy}EFe<;OizmOLO;1z_^~RdU;ViP0C?|%Iv%Cu z_y07YQXY)|KdTLG27klEJv(#&>t;G1|Avbo{=f99il7d7J^td<`+~IG==D3NE%JBU z{IHD3o_$+Q+V$;c@cS|ojvurMp2p6rYxAlsJA6W z^kS(6W!!UH045~}$xZ~7vrTz_igO14R$&bM->4C8oP_>YkHc_ng>Aw0?a{=5YzlrU zzmb@S^*KdlIj+IyC|Od_ zNOgdJN-z`rn*~aZs!f}o!l9_I{S~wPLmG8yYmn7=65rxbYG^ZlGlJBe5J_X)=0o{H z*`g95Re9OsE_G(mkS;dAtkb=uwy$Zp1Ad=PZbPER)gD0kJVRBD4{VIi?n>;g?L#f1 zU|Y$@E#!anLF4~jAB;XDR?7$V27~q&Q&nfo?F($Hk71lE{Rc08>OCsm6qY5xM9WmL zWC1O(ROtE^dg@4GrW;kZrZNP9j7~eMn&?|ZHiI6^1jHT4l2&FWtkgv8J5uj+VA6}EJj{ZjGJ4`_OJl>b+z5>Kfh^QhlZVOljrjVcO|59XLrr3 zCTmINXQ`)7y>6M@o_~Idx%nb!|B=p-%|FrAP24SYaL{598n{0}OtX@?y|ZapP-KBN zMq5ioE9z5u;_k2bp3#kBbML^m_=LT%K5tJNN@PZ)8Jd%fG!{To3L^mFw{3b7g<4!% zMX}Zs(0pa0G5Jeub7w=$T^1r_b>)IY2d1ictj}_-6-^S;c266yR0@TFxUBJ1)fW}l zkj$ti#C->Zi`s0FZ=e`%vBmaIYTG`-e}Y{|Hb?)ZNJUQcj3vDDJ;U`pJdTX(wCTsM zO&O%otCiE>4=_ZnESWd-vlt}L=aQ;~X^}UWiyOXW85PHzQ&ft<%IFQsVl@S_=!;1R z(kF-QKyaaOP#lQbulT^kfvssijdq;_+j2jbaZgaK`iRb522>Smfz<2I_J(pdJ=v2( zT^oyK*i^Qxa{{8zDwN@g!9t7N$zMcm)V~U^PvESvrgtr|f9}HBRoIJuqC1bEim&|a zKDupp%-zK%M{B&sL4`6>!Og5A+Xj`z$?FR?BTsU;kJx({gi<69 zfpNFaPdyaAPDID#Wia4M+BJ@^JU>ZTgq$Ugmkf2hSs|~7(A)|-cnm;4?d?ui6#zR9 zo`QiMYP@E;{X%*asZQwI?45lX#_&?qc820NR1D{Rdx5@22zt&=;^$Wy3c@;3?2DI| z5;@r)ChntgOa{vL!|S>-Y$dt!YE?#l=#0iEqB!()NZ{5W46X|Jv&dv7)9~s}s3)OJ z6&Ib>-jO-N*$m;sJ#T795i1fuF1WC!I#$g0o{v1GOQjz1)l3VmSkxd<4vdaDE6L|Ab3loT z%l_CFUdDS5v85V+;Q+R}G5Dy*JX})-wz_R; zCN)V3$$EzRGWJ7v{Oh!fC*JTcYhMb<5~7xcG6fVcm`MJ5iW(Is^$NQMN_mzRo#X9= z-j!Kp^sO>eDBaFIu>cgK}J!z4mLq_jZb{Y~|)cw_XX1rJb>cG9N+xK)|E1%AO z`oP`_+28Tv&h?_|Drn&-4BKi^T%+Ra-OPR8@|Yt`(1YW9={cZA<^H>Q&eAmfRT*I* z{|1?|RT3d_{80kJtjT)?Ph||$>c~GS*U6U%KL~yOo!Iief}uDqa=7@WljO%4#U4`b zT!in6?{)}Q>E8BUkZXA~6OS$@dbcy&NEXQAIh6G;(MTK zo99c~=`omuL8qINwGToma15Vp(%!toS+|$m(|9_2Tge9<{lH0S6q3YUZcr+D;w0ch zaJ_%m-Tv$o|QY)bt*nvcy+gDbr$FvbsckG{TWR5y||BmWCF8AE~ns@ zdqISL$tEi?@9J=&G28O7zRZ5<>U3+vvs!!bnU`$hI1dI^t&u7m%2HoEcVUdnIIIK& z4$e5AF`#IoCOqdcT?Yq8`84hX_Jjhqxc|ty!M%U}w>Kpm9P#m?yV%0x#o@d#o-r#t zp7?n9Pb#1Szd5m@39yQy!G}yjb5Iqq4|D1YvZx_gUmm^WwYy&~}qwa?<0ljM)?GqdbCS zG!`oriKAk+1*-$=EW4P}$W4jV{Cvx@NriH00uw#ut{!eaG!5l`oho!IGOJ!fSxM+^ zdfI92&uAMnupCS+ct5?lBrBeR>yR6NpLd$OQ;&Hiwc9$u2TJccRU6Bub<*|7uk zPNBD5RR<@X@tv0tI1kf%ddP1UHJ4mEhuOYTVqzO7CtqlJ+EwS?;c=}yAxU-F9D-aD zEzI*Xfw&h(R*6}YO_@upGNX9=Hz=4?HULWZsLI*b!rVYHQ8{+|z5^u|Al`RswwXBtQ3V698$b>>} zJO*-7YflR8&1f`Ef`~=kw)2deY9@z&l{e+ucuO^FX?RSliaW^4mBTL%$E{6Xq``be zpCYiX*ZFr6CGsSk0{J3?^D1>mvL9C1lUJAI7A`l+x68$5RIGj7MzK)0V;KGalrq}P zkzIulI?In5z9f}W-IbB}di^t>#Z{BH{ghn!X!jl3d+m=RWRzj%%@d=wp$b=vfyf$( z5UOk{&Wg41ue!ezosp~U$rL;d=#WUUw$ua$kHg-*-L;ZjMC`|%Q9pc|sK>-4aiNiJ zgPnID^K2v3THnNxheEL2IaygW`C74~=y&p;tzQ^{Dz=}0*Cma{IrVMZF(WiH`Grv8 zTN>jx&Vyi2pz(#>w{DbBNTbjh#t`dyULkGz$Bve%4uLC3-6vIMv1!F)lh;}LZxoAO zrqe$4)3?$S#Kq1pqexWB6ZKOm+i>Li%9dRJjkrT^BnQ%+w-VZBg@8?z`{$;&9H4sY+$0)4v9;cpoa1_cG8kUk6u)?q0Z= z^eoZ+VecsB9cK`QV8mwPha(NV;AX=9oJw<&Ju zEUu}kP+?JgcU{WzK4jDm95}B98MLO$t-TSa)(mB%g+`r9Ngp(4;_;82HCs&(GRjLB zVe?%ns#_z|1f(Pu!x4Jz?iYK=gl0qfF}W-va6TC6$R2+D6|KP=f17<^VhWd-X>=6R%`N>Wj<83+ zrDDbJG#Pa7XjD6PaALVubHfYsKY0D0!26)Sl$;3R4r)8+=T~lN znP4Zju9zTYnN}Z=n!sow@PD9}t}tv#;ox39`P=9j?$fKk@-ZBo;PS#%SOZX42zyb! zG=wo#-~~H;%>4+t`RE>$uQTR2!cqT$;J=obe}BDKNLgoBztngvn{A65F)P?`gXKg8 zCwk-ClXZv@IiD6Q)K+^(mOd*WzWpp}8+uuAC9dX1E3i1ZowU`h;$cPUqT_=OB!$khJppid>Nd5< zAu3XY@N?EOnQ~3KrMj%kchUs8`@}4~gjI>|U1Q0=mI@}9T0h^w>Jwp81=d0m3-6uH zYT|V%6?IvaThdm*wsSi_yy;%4DAk(n@9UpHoTYMRv?AEMkoxDBG}?fOpy({JpeL+l z5gZ%}$nK3n4hUj2nU>;O625+YPCa7oY3>pIv(z?PA=Y~orqvx2o!J}F0?(QfLW03= zJ~oye`J)-#kGoGf{^rTJ}C`P9HVg9acB8NjOpHU zkB)yl5{_W@i(X8RGUnDAurn~xqY(Nz^&O9@aldf+Z2bf4}Mdg*# zD9e>(v@1ogsr^x@`(@nyz{C9(sTsu|ATGm@3(0YIzx1OoNz-MI0^m?(U7j`(ADPp+ zcm%>}r?9b;dk&ERujVpJvNZfiB|5AUn0Pu6fUYy?)-F^N%~uOx;UGt_MG%=?^JIPM z$;gaT-WGyRG9CVIhI6-LTD=s=;Xy#oDXx}1FF>*LC3~xtvk_yP+^wyC6OAX2K^Z=I zqcn<-foYc!qQUX9vV@-HvLyC>e`(G zzPZpawThI5k7WiIkk_itNFAxG(j7Vj^u%>$n9i3LLa5GRhyI-renNRw)Si+^**LA8 zRxza$?8BVVnjCy108!X;yB9EU`_jlu9-TR<> z*BFZzs>9LXtotHE-hBY~OI0q|`3Hi<++OPxA;Si`+=0eq;@k?;Kw=6lvqE}L0n@pW zTq;wC_x%NpgCL?x^i$+y$HmY3^>5tsUVEg72xni|pfu#&R~>fCpd}icL5N3}V)j9* zBFp+=JsdvFSQEdN%PMNxl!xrRcIUoi6}ns0540;3TV;G8GniNWg}wx-@r6Cs1aAD; z0sF(-joiZgP%V&EQtt_|%&nU?LCjGwqCKmf58aD&M>l{o#JWdVxWBhlh;b&7yQq2n za=zq8jU5x@X)4`prQBRP)o(hz@wCR{^@K$1QYw_Stf1N=jS1d5M0Pa##bI#RA%{xg zw)zM*J*ZQusPIKmoI~{wN^qw3@_5B{LXZwy;ktUv#1jZ9^{W-^tw9qjwq{(LNb>xj zO{;y<8lE_j5!4oS=|DXt=o z-1R$o6xx>3$)!&o(Us_EZQyv=ClQvrI8-7*nT}|G2cj+?wz7=^9=+HHSt$SuWs}lQ z3{KS2x&1SSmPUA}91jAFz={ZZ7HqFk#a{4KB3n2+^~P~}n7H+}N%F5bOH=$N4=FCp z^M1!juS8 zwqyomN*)y$5SjQr|Fx0RiL#rFlJyiz{H}VhY{$Zin#MMU&qL=5gwe1SY%ZKNLm%bYS;Z7FeK*dXk zF1jQU&-2v9Oq`AMs3(oIjp-+yR|eE5;@*YF=Iv%uB6E<_k`yJAC+U2QT5EV!@LjK7 z_-;awg?>m0d5|)ILzHpMU<8eiqahu19=u2MpaNk^AHlwpC+> zJ+Gk;U%P<-VRB)AH3M2C$TAQ2n=cf+brKB|jl?$zsTs&!53tt?k0-GW4sO8d{F>>o zJQ8#iHhk8wKO#dqGbCY?rA#u|!?)p8!1+j+bvpe78(9Pmqw}&toco5{Ji{JFz?ODb`9)kfsh0_=5qb+Ys!iB9J zt|%L*iF(kfs2^mVBKw?DjPpz&ZkLAz$u@9*YHbRM-*DB}oK!$6Z7MwlVf|iE79KhH z9K|^R@J*vRHWa;AEe~>48WwXdp08b%iYL-}b4TU~1X8~r5=1=wL0xNkz!!L=vjlaW z?|bn*Qcx%%VoiT2e`^YK`_y7AJ@RxfjKj0MQ`l(T&msol0m41#pFRWo|Gz~5DT7Yq z7LNzvI2b?v_1eO{d3rSHA4(28EK6=q`()T+`ftA(xc6lL5dD7>PJ{}K&+5|>TDi)I z{`sT7E}m3pq>GFwl6)c{GH~R!AANFI(=(6N6H5%{pRn(y>NjWEqCAY z$j<&zV1L?>1O4T?{mZemvm6#6$RC-Z?!wDEkZpyUqKNlS7pU_V(Is?1y~|0bzH-K1m9OuLkrcGQoBo6T!)Tj585yD?Ev0=5C|}S*r}~M!zMxTsemV`%^5uq zWBnzmCR1d;>k;qF;Ik?e&V2Qsa#;k;;_K4LE@Q7st5^~R*wdZLZ3k@_5<>zmy1n0R z%${p~EX-2wNlwe3BmZ-P^{nBu-OuL>^z7KHeHnI9#2v}sdbYjnN{!SsDA#<65&K!$ z7A=u3XA^^?*`YbP#xPcx!j$YuDHC1JQn>Z2MD%j8*U4&U>GsHzuhQ`Qkj`X}(pD9t zYy`6?jq4Jt2IkRJsJ_U90AFe_4ymT1g#GzW6#X*<@O@I6P6VgJo~VhIFhgg%lwORn z{TFWje&SFtLO$ByqEp&_HF;66H$I5Kk}h1067y(!L`r~RK?T0LgfhsC%7j9~Z4E)S z<|J~as#jxua#O?cR}J1lGBfssSk7h7d$J!9aoMUFxHg-8uHmort`EMbe>A#jtl2CQ z_ru%O|Fx8`@-A_#8>>`iwxyi*+>~1gnLNn3Xl<)LL-#E5HNx5cT6ziTW)6Bdyun@@(;ncqjdp)aRO_&ISbhjdlGutP(G)mXMhUe|xp_ZMASAifUVN^%`j ziVJUFUD{jCaM#t!C{82=8tK}DyV#nQR@6ypQq8rZckD>2B2L+40zKcd7t>W@7S*tv z7qEYOBJ{J!IK+ibtE$}(l%!k!=27yQ3Rv3pXJij{~(+Hin7xl;;WOR<+HJy5+OnPX_HVk!B?IMX-~VOg;08 zj773z63>V*i6edzuk5p;m04rst>Wf8VUH=%!Ml$ubssvr4m7%a9$?=PNlQgPFlm@f z`rbClQC-Z|pbX(G@=!$D%nR-W+J{%oYoz8|Y+ zsN4zsazpwKvI8cJYnF5HG@4pGI|9G+RCj1wSH8jbcyDIhF0nGUb);4Z{^o04XMlyS zj?fPgHcM(bUmR3az*5SwqpvoAlwEeWt?aS7Ky0@hm&RAF&S_5O0OQw0 z_FRr)sVks7)Vp^{UlL`z+0F%TsOj=hJTPIK5mc>Dkv_YtsN*8l8+Rs-2zdT=2C8OK zbibPyxxdxUCW#viiUIdNnV`30P*E`Kp`I)%i0qHIyHCRCb^5r-9qOEU?cvJAM=YBg3u!ZILz#n-LeKWN{4Q3a7xW)%(^|bKkdeW&80a$z@ zXV2PkgzPe`tqqs%loPBKBkD9pRsbtLWB@%ReZ!f3{?)* zeRj1Gh$>oBa`^>9_GJjhq&Yf02q`UY3-F(4kDh(vZ~Dn7(qXf;!WxA?C5l}`i7pd= z($=7pR5WEew_44ZYjAno-PlEW-7pg?Gh^w6St&)Ca_QU-`(|HXJcVuUUSkxWRdOgPzrUg5?rBUfhi#9ML@0H(K=e3( zBO8!amc;30lD=lZnnafn%&^BhxkO?M?Df~E?*`_q6Q<5H4%H;`3+vD;9smYl%%b-KyuJgnSMlbI24i3{d&?oj8QLm*>TsrRs?vrQ@U-xiHhw)ih0n!Cm$OQjh4uC zu0|_R-pLL23)|kg#v0cwB^8)JBsc5>!H7%73ykH>f8?48Gzcajx|$sWjx3|>81`sVji>@vpl z6|hp)XKW9$Nff#!il_qWp@+?}M~kB^S4$7>`UB6?-(rXbUaw+ei6m4Ff2IB$Ex8)V zIg>R$VZ4-5U%<2{eq=`&gQ($}`g8d$GmD$dbLR8g2IAfXo%o&ahstxoCPT_Ov91P| zi{I5#gZr&|dx+32=1@{d%s#SwRY~7fd0(4FUXC+KrU*mC(2+`&{>~?Iu3t1KSm%~f zQoBJkJ&T=%IXM9sl2uq*B`x7>X!M3s)Re|!i( z_|f52*EZc<=k6PqwpVm<=KD7P#d-JZt@%wCRxtcid>A3O&brllUn!J*bol13-A<<2 zgu2h41$uPOed{@i*zuwv$pnN>P_&E_xb?bw+WJA)b92)RS+oW{<}G^_p0mTT{XiKV znrh%K&luIDkErJ1g;%Ll^O`-kN6Au-VsG8PG<C`_k985ct zZ@UDN4Kd9DUHr;>GSmDETfeHNkU_cReZDv0#Hp=l*=dQ0r#CF9md*KpqVsd!QcKZF zJCuHT%`VpE>5!M-n28OGUTzzp;j|r%()E_4tKM*HXBItlhoJcm? zEcq^T3=k7Ss9H2fgh&l9!XOkRoiu4wD2ZNOo<-xrS7!`qee8Jo0ySowL%O6Cp=M^N z-O(E#;{EBS*M^nM-=O7gOOd?CJ!A<}v{*)~u@Zx?d)u(U;gak4ys#(N@+7W@T6oDI zAlI-!_)MhqrM_J)hv_uIyD85)xvaO0lHYFLzC7=S#FBLGP1%t)&a3=uzW*Kibw@~` zO3GJ9RXK}o(Ba!pB}2MnCPigYy?%tplXf#15`>91`EIILMu;rnXrcj;;jj6}JEu-b zPG4Vj2FGs>7GUymK8!Uly^6vGlQ5mh+)vj#5-1hmQoAHo52dA)A*gw=G_9!%iA>UC z%MNOOu6V++H6XhZeEU)CP_mT5^ylmIG`ri;RDWbGDQK9H9%}xK>5C~t{k-L~J_2$# zyAEZyKn2QY=${U&M(U2l=LlV#zQr>;)5Xtm>U%4@uBhmACBf2@9D(;q6^eg++-eub z`Ovg@8!YY~p#S2%UnnGfo-;)brJ@vVVP`?1;)jA`rYXXA%5+h|Vykw$R*M+FU&sCF z`X`zE>*l6VFr=6YT*I%js!hV93gt>?o70?fAvEVvNit2UHwAlCEDzE5CFI_#&70OI znHO#W@yMjWeQsgv3vnUT8uk-Q?ko7hCJTT~ALuP4ChYcDFvJ}QGKrQtF!&LU10=jJ za-WHN+e)6!(alx(Y;H)xb#;Ut*W zK5(t~Q&uDpg@X7h8JFhds?)e{0t_qwTvw-D&fWUGL#^ae=y1!uXnH|uNe{bhJBi#qc2LGx1 ztAo#N@W5@yNDP=|?O%NZ<*F1HgLlOpe*jSl-|kmW)B-i*PN4y*{3_flvnHn0Ap)sk zB2Qz_t6(4(4GTWJKxIInBKkD{d3kN%vC3nfbd$f1A z{<={cy@E}MPf&d8**4p~=RpMl5$wQ!O;=lUEh*IgWyQ=A#A~dAMZ=8yJCRxC{0-e+xNvx1p_sjW*-3 zg1tM2g%1VZ9s+Kq-#^^Vfba%}M^Cl$i!Ltz9M-0P3`xI-C)Hdqc@;`;K4m&-rWX{n z=1)kr&yG2-J!~xIkpKcOT`j?@!9u;(!s7%8k5o9zs4Hrb-;oFLDKFSbzN3w>IzUZj zs6VQLG3z`uUA+%i$bXK44Hk-=&jPAVS~>FQqdj3m84vH!u%au#vwc+J-U*=Xs$wu+ zzRYs{$)5?a!*B4Nip-DX<-ojZEIOBtZCo}n2~9`C#3pskNuEGH{sKT;Upv$vzs-n! zx;2>99Sw%xh@8(!WuV*=0#?!dTS3NYx{SkB-*~D<$(Twu*iIO$+3I8EMsk~t-Rb_@ z-jF(ga9^H$-1lK$YM)A4h`(|lH&Gn3t~QP0nwjhRo8-QzO%1UvOFFy176M&0hSf~) z*bpztDC~UFxf}$QUX@#LBxoXVeh0=4M~R$28oSd>6@95hKd;ABj+UC+NKv}5Y^O7q z4)NI6Id3rExZ$NeZBe;Sr(LP8W!d>M!}Ya@iD+zrK_APOsW*8LTTN9D@mZgbC6HAi z>3h-O+Vj3>DJg4JGWnKE5761EqnA!h6>@ZHM!TMD-`;i;bBD^jEbfBvl`~l;Alvn6V9#mcD8n**!yd_#rDd_mGsDF9Apg z^C*d()jJN2;XIb-O*n5!Y^+H}iatOjbKhB>nRYmCIC0FLyAL!Zm)rW~-&C0QOv|?^ zkCtMo7c1oV?Vx+K0u@SdvMoQUG$#MV2YX(9n(7nQjlS>+=N~oR77P1wfAXCl3*N1~ zenrwM1>$sarzmXah(K`%ildOk17(irHI&ItZY%ggZsUso+`o`>1bc=Zx@e3Rm36*- z8Hcd&1|S5c9WgfQe2te{=tJ`w0rg2CnS|HTvR?~m58{G8`8{9?1T$B&f9 zpKR(eTCKyD2H$K=SQeGK4 zD#?-#ji^tJ4$H7|GS+Ca2Sj+KFe9`a-ZI)zjZHgc?fRG=KCODU z8R$t(V5v^7R5E)1=d&ku78AFcWV>cuLOQYi=Dja zEeVwKvY$Qk!eg1jM19CuUNj!`2`y+3`kiNy0~@=apGlM}H(n#wlS -zI@tus3T< zUO7zYB{&VoUn&-B&| z(!4Xi-nMwA^^vo05VTzU5sIU$gZAxP`2b13R8dH^2Jl;{!5eMhy7&2!{i?LnoaVNh zy=Akm)v~o_6J$%rv(Tu3?3(5s$HtTJ5MI)$%3EHHl|-v@K~CK6HF>%@-89oSWEiLV z(;Xu&{2}nJl*9E8U217J8E?yjz-usRs%Z$2bfa}8+G^TZBm7+&PE5ylb`MAIFz(=}P%83a?Db`7CI-!GsrFIX& zi7%IjhE@B%w4xxc9ecC(>4kQ6BIpJfHXNTJ|7f|aM(X_K?NswY6IOg<;!;KhTaU_@ zz15`B1I)5QK5k!xLy0IFUX#D%ln{Zuy1hU*zt9zOF1oTi zGXG#F2k9F_1pF-Zuf$R)!b%c?acMFXf9a%K)$*o^Ne+qpk*ivZ zW(`TPDvfdbs31?=0pA_g>RtT*xuY0Ifxw#1=w8K2v5RUoEy?d1wK>wc%Qi zZm&*Pb&=Ic;k3W@;zoCdlCLiEBD~LmDc=tjq3ikSNe@R42Luj}&MG(*Exk7z$j?6W ze~f|+0xo})zJ(bv6B@4m&H?}N$a3qx-5!wS0bX9=i2o=I&Q6eQ%fH%1Yv8wkTxZUD z2)DA2a$lj(QsC2V`u{P&|9eZC6MBt{S$sL*4oe;bP#%!DHwiU%u!kRw0DshYH?^M= z*6Xzc_f|%R&&n{hwa6iw}aqfZ1fiOQV!e#&t=5eK`4X zQp2-)*C({RqvCtK1$dAf-~P+91pzEnH_U%yIm^b)xd;i2pOdXvp>MKK6fnc>CI|FX zAQOF8C4;wEIN|7bp$*%#;M{5XhBNyGD>Ciu5Bu7RkY-I$LIK#qdspZd_UC(gsr#oO z?PY=d))a^N_`zB>6J2!2API`2LbFm#KK9h`Vq^N6dU`%4+yT~@wVcx)cFr4W_7@|C zt{;>3SXdu5dRZRXT$(XA5b!3gx-NYkQZ6Yc8I8tYTTM0m;JfMOU5A<8OEDfMwDy^=*?G~sn9 z;h2L%rD!-09L1UmrGTt&8@E26XiX=A@JQJPyhu+6;I)}l3f{!KB;?_b@aT^nH z&L;4q3~GKsG!O?#+ZT}>U$vw`)$`U8%K{xKF7?d`BbA}WX(9H#M5GQ)sX{|9m_M%C z%5|$7%u2XwsqR>?zh!{N#9SCY;1|NSf>tU}7OL=n$CPBs#tS9Yd|*mXMmmONNO!ck ztMCTi8edZwjUk6}%(xzM<+gfTnxHz9D-Oon8)-oVJGdvA$ijwaACO|Ee(dBNTWmN` zR)+)TU$4;Uv(a(Vy-Ls@68?V9LhuRzIe=Aw-rwN7pLX)`M{m4NNbh!YCVId_rS^?K zR&Ci&@mVGfH^iqKxTr7$U(e!(J0XRyuRi*e*+YMo!`3ZXYl7Ka^+7s-9FI-yM9E!#GF%8?JPJj2zTg6aQ;er z-uI;k2XLmEl)rd<0;rhn2WJ`OKKyGpH{RzvI(NE!#_K9D#lN<^wfOpO3fujM>YSAJ zF9SbIJeJXah+q527CdS0oaqrPndzms`?#sg%$*CvZ3hHt;~Qn|n-ClqPSk9m>g?<| zTopr@QmwcoS{};4*M)^cFyb}xF0P#K_O-CeqXDbVATPCnefbGhx7`~5PHkZc% z@pxF9I$*bR5!RUoco8B0la2hp@wg7ofAP2<70*98ebGaJz0qv0jq+b!064GVfAs8s z<7Z}pS9r`)F45P`_I9n>K!eKOX*CiQkARh{aB%~QCuhrh0xq+!2CPMVIUZV}skYa# zng_C(X3=THrq-WHTVov?Nn!WAIZtpxbDqA4slId%Q|AlW3}{$<7!Cc-wT)d>>z`QA zjcNz@Z?s`rZws#qR(%J(W9POcAGSoC}%sb26=_f2%rFE+%<*eJhhBKCbKVb6qG8a3Z@l zT0W?^uww0L2Cn<>9nkN#4tpQOW!t_Xt#LK1`AR>z%j<|0oJHzHQtNl{IG?T=c&-@r z4{Y{_KTN+bR3!&SC2EhPq#BW*){)fL>5wHI)GFTZk3-blKUU__Yle2hXLBZ+usujp zcx`0w64(UVL6RBk@EjED*9E{H5yc;ha1rFVbgi|a#+H?Z{cPwl6x7P#9urHhM3C)g z2Nb!ujOfKltpIk`Fey-1^O_#=4k6P_h<#8HjV022^jsNlL2b!+@{JL==!ETHR0(^)_iPG}g@o&3k^84i!xu8Hi-hxlgn|thN~TQ5c!hB}~+d$L+4(bz&-S4R#NI z0MZsE_S}2|1S}Lf8p`YbymThY*e1D)4ImGA8b^-X56$QH?yS2x(R6v|C3m!zs=$`* zJ~R-i)snX9BYN0v-Vy?RifGb-oBo`?Fg|ZrmO`_OCM+b765yLoIJ}k{sq-z@_7YCN z19wyCkF44vMs-BrCmh}PmPf?j=Lz@dWN%c{nVQ^$qF0gMWW4$oCsx8>4Gk+=po>dh ze>(>(9~e~=`8}|F?mUBe#_DUj^!FRjv>7nKGP4+b_u|=^L;$YzA>Jzy>^E=v(KOp! zFZNtYp$*KCC!EQtCw(xH_7x4^Y2Z@N7Q?ze(JWiN!RDDczvFD!GLa~5z|+K0qp)wY z6j16+5I^>e76?pBGkLDJT0=!bf8#PvaN5p4#%>U%J}Ql_-P|tM&xBWt(pu0R~o;PB%CwM{2JT z5KSHnb{%$57m1~gfhw%e^eOvrfxcD(J0hZ zzh*T(&OCDh4o1g*u%u#T_J!ZjtotR0T)Ncm?gHf1gkM0Zk#bp9{pPhb&hc)|%ypCH zxWPmLRx*3%@&Qd#rg-D7vqv_`_jHO-Uwbbh?Bbiry>C`Vudv?t#CtLb>!@u=g`UcF zJZGJw?;Y&dwIG`2i}mWARsawyB77iaOZ;N&P3J)42m%L0gVqcr|3 z_RGfy4vuC7KCAs+g@E@qZcs%(DowP{!twMq=n>FwUQ6-FwO-$*cD{ScmDfB|CB<>v z;2anhon7GUs4Fiw&2zH?uDeWY^^>8jHm4~sj``Ut$l=>>2{es&sqwL4%^gsqNpfcP z3%lr)w+JS1WXCe8opBqoSd`M~uw<)U*qQ=AD9QQGer{4^JkQ`-V?Li6+NV z#`<`=P^sw*Kc_u4RFSnj+N3S+87u?#{#Lw&%f!KU$&O}$zNBt`;Pz!`ZiA{SB@lt! z%o&+K`lztOp*JxV(D%3Zv$sg^5)Z-$&}A5KdTg|xD+vW&|I1xfPH&${uM7cF%u~0_ zs6a}iqf(pcp);Pfhx|3^d$BUirB#;+Z!=%=e67Mn9L z!`rvkb#b#NXG#K67DvXsn=p$qb$JD1QFsgF8Y%6Zlx|b{hoyPqax)%hntaYV6CXk> zn2p}!tBE*L$9ta@dG-7Xik=-DeK-tFBX6?+CahaAPo|)4O|WrA_!0@WDR`M}r&Q~u z$$NY)1;5@%_8guDFYX;3!n>Y*FZ1mDHPnoCUC!|5bGcDN=4r$CKBNT}lbrr&QYRgfJ-ftae3Z1{ZTcGKYRv9Trgb?_@)wPyv9m56QzF1EO{FZIo=OF%ox1G z15SoZkqi}3Dy;#N9e4?C(L;XAJi4s63H~a?vUEA8Pwe9*xAr>oR$!<9k3x(8l!*Up zXz~9YP5^oBI8EM=hA9d?Xpgv9ei@MTPB_O4F@I;>Mxc46G6DTCBNJ41kh%TWFulY5 z_Uk9un3gmC9~?5(C-DQCK&Tl|?oy4{!dA8o_Qw%>vHVAjL1v=#LfT}exkCYV5$i18 zJcglB($K0!@1hleU%AUIy;Fkz5Tkq_@ED!frTnTDo2 z@}BR+utgvJ7DwTo2Eg{H1=a%xj)RP7Ti!5pdYF^za^s8gOABA;vn_q**w#%6&NZLf zPFilT$H(RV*1j3jaXY&F9#*n?z(du8%{p;feGus52BDsm5I{0UH+m+zbsB2)Qs>a( z0rkm4asVy1v3)!KE)E7mZE6Cw@u!k?UI%vw<1J_csuc$S`-b&n+2@H$(r@kek!LL-+j>RW^5{ap;#xr)V;;u;C@Q-A)37DB94NWR#Qw`c~h_9#gk@T`Ipa$!^o*G6-d~+<3f;SKQoIWUV9}utA}0;BnG?x0BCr+`}|U`nBkbH z%sbj0Y7VH@AUu52DO+0}_s^;#EZ%6@3k2?9+@u359WS!qsNAKN3m-!J{*V<&M6qec zm1=wp-USvx`KD)=3M=X5*Jw%M9sS@hugiF&_NK-VsW0X1+v9I)*$Vy4j6OJ5CHuh? z61cG6GnjN{w|yNg?iqUqS>+OLzq^P`Sk6ehK6<+RN)PgGo|?DLWtUyzzVe{T;%s~# zeNQEYK^|H-yv?YsN@;dhAgJrnr|kalow5ZCXXn9`5M5%@ldguZ* zXcPI@adnD*^zaM35U<_b=@evzl_-XP(%o0Vr5pnw^yJH%B_Y zl&!o~_R-2gvZ25J=XFf^tb0jWxoUItkuw=iFw5`uoQk8|I2FbhJ` zY;VT`wgw(4@P$U+^6W-Z+42YD>z<3%7`&`blp6fMYp5c5_U%JO3zisaOYTps#GL#Q z+f)6iwB6k*Ky@5@zk7mJ8QlxeQgs9?AyQdL3ZG|Jum0&_Sj7H@TD_Q#PLrPRYj?pl z!VQAN{;)k|KF$nNH>~I?S3?y8D2&F^pblTT6t_}PO(sJ6QnkdQ?s%LOz8$@^g)I#yC~ z>QVXpDg3-x=ZUd>XZ`!p3lX{aWdFZk)Y445$uJketHA0Dsu-(#0liC?@|H%T?GeO= zdt7+_OO@>w$g+2H+Ves{6{TmkAIpd|OxkR8ItpvRwZ%C0u-NoEnf$ZmYJw(V1FXw& zBxdarRugg8mz7ddLmHLUrEhG@A6)+y73KFS^^G_5NBjqvBgQIU0#=Q^jYb}77 z3;4==1oYJFY=AHr{S(GR@_&%le{ZA%R-ZD*gmoSY8U$om<%@bqMbim+Id~pXR;E3OkB+_uCGW z4eFE<=KZ*jz!iR-LxJf!@Y3?-?@8grA?VCN;Fw0FwLIyPaZ)G?!MPG#Et7r&vF#X0 z0c8(5HfTVDY37z2rfAt8}=j7;G_A(I+IF-NA#^LV3~2k2VGDxU0|w{)NnT zHTMQ$MFC0CgZzuviBSnK1a_yjd{S4aM!duKS?ewXi2(J{3Svp1SZijM}=2r6Vd-`nEfHcFi&&jYbHUf8a?7U3m0&ZE$#)$YS z<`vZPY1JvVg}QEPh(H0vcJW<_i2hLO+e{rmb-Zf^54s+bgYW;ugb9#Z;XZma{fKPA zadT!={%*(@8BC8N9d61eS0(;Aie5YbLi}_Q~yyfjjU(t=D#zOt#dUa@Ac*vCbQGq=s zMnj;&YPg)ad{WxmKD(|quK3wa=h?3MPMV--=&ji?-H4$P2@Nh+c^=uZUmzCkDxir? z{Pe1e!e1G|fap!;@`3$2Y|~~RE#+zxd;p4^16;yv&R0e@LV7}+?I`}z1Kfm6W1)=fwDH}95UK?nR>7EwlPhb zWW~_6&;hHofK(Q9Pd{X5+l*0oFy>K77p5|ZLQ?A}*HkGuJ{N79Nw3pbq)L1z;NJu%T*%&X-5c7M&EXgOqkIr?S4tI40 zbfaY<J67h^0)oz^C3>w&b{61xcUA!8}_&w!3>5 zJN0Tv?G7EQ^@}Mh=R!ONpO9^Ac4CyL8?Yz60J?6&uu17 zhU%8Z{~T9Kl8^LHz3LED&|+1l!0pDFa#6)ipz4(J{Q_1wN6*u|$9c4`>(J(M!@+ls-Y!mAl4Np?(?u(9}8wT74pc z0<=iEC2=*j&3cv4yMYW}aZ0pybGyidvX5~6puc{^jvz) zF}xBiCq}97c;fq*K{%hwP_>OOdu_SOY1T+Qg~uhfg_AnqPt$H;tuIOm+bc-^r8(}l z7y2>fsDhiCCED;g1U#O9(W-M!)XjUHf$v-<3J!%DYN6Z5t&EfJPJ(4D-xMZ9`?&ht zQL|L8oRP7kmfk5O6dd>fEq8e~dL(@P_=fi*;Jevmha+pLF!BO}^#j{kR~Ppt2r5@5 z@<*#vPi8ac?fQ}*P{+$B^fD^BMb;9drw!vt0oryW<-P1JQBH=J8Up@hPNZ@;l z4q9!*7T+I)SM}%qDE?O_Js^6{JNTQb!~o&;-jD!5>P1s>|DU)tkc~khkKsc4Cu9xm zxp@EX{Qc)(;^2qGU2P^#*DT*5f3V_IlSg!9*_^*H<>Z(@w0~9MN^i$!DHfrZY+DaI zNKT7-MmLkMmHs3gZ zWR7|>D!+XnC8t<*|s;YrLB-(>+TK z5Mmz}r3^-VMV}%Pj_>ju_SSZtGWC4_8?%44c%J@VN()edp=K7@ zwX|u*@V-m34$uSfud7+4zOyLkI)qu4GO+?Lg&=*^Q31ev>zfQHI$vSKscK_phop4I z?|pqA4=BBd2fj5$x^qGLG`j$KQU1(he!L%mH-@e--;+~>hL_AWX{1>Z8@kQFJP2h> zRjMy9)R4lA%4_UXv?DZG?7>(2?g|^dx69B+ccTjNc4XF1oK5ENR9g8d{Oo{yP`lP< z2#F`MR&}|t)$vQctVg3^u7%^;Cg-~Ak%5X$edbbJgN8Aye#862-!$P2 zpmwM?pa&}il3o0;WfKT-ycJcy_(2Qk^7)Ny(JiOU+CnPwV}bMS@n=WI?Vn?*qo;rH zz}ZxLNP0J?$rw!>t8I~3blQbQt(+)q=tn3t;lQPv`$&?yi@yK@D3JVANsNK#vnM-& z5YfT-whiDv5_6|MgE5%+*XgCRZMb!2vvz$dknZO67npte?hp_)KCIDH$KlFiR{+M5laJ;(*3 zqvx5)v_k{rSwv}@>=tS~ntvv;RD>?1wuM6@&_1C-If^Bw3~VxlE&S**{P932+z%nNZp+594OpcJhSf zL?!ICC$5YG*n4#U+$69#O&7g39DDzgA64ZdZsbSf#HUv_kwzj<%FE9B2(Q)nrYq#~ zwQ?@^ny=I(&D_4l1%J1fNv=)OoiIYTTg7ebA0g1uH7rkPlds&^TwK0RaO>JM=bWuH z^!(_ncX~=;W9`$Q_z$4doE)^w^H}z$1I2lyDa48uyP@^3MpOG8Uug`U2~{!9ZE|hP z&MtkC@q@`qh#@X*VrkoBQ7Unj6xu+0E{?_GT_{F1H-dHMN*oozHZsf*>77(+&CNMR z)4&wb<`ypV!YsI7L)Ql>ls00Ny!9Or)UpulNinOBD45Tm1buRzq9EGZit6j88{T65 ziVjeCZ^EKzA+^50balT*421&o{|v$}QNmHzL^ISos*QjYLYk=*|8Ud!?k5YW7|qRy zskbLZHUOL*}(dpz?PQDWKByT{n-0m0gYuEW&x|!CK_nCw>t8h03 zT6lBHCqR3Y(ZA=6l)|1edkCG9xR0!+$xAzfbSW~8+k2-J@qS-*va(t8`?ff3S9PxN zxZk8HJZ6p#e*1_w_?STE2GlNY1(2-T*@#*JRzh*4tD>4PitT(MkgXp{UnB8)_$ytc zN+p@i!b1nq3=)F9TGGXMsg#j5Hss)J{-~ro*Jh~E@Qk&Rz4<_8(x){;v~wMWDvGbGzS z6|r5HDn$0&Q3!4a6}GDhm5r2j(*qaYySVa@iRa`rdy8&39b^6jz+ELfa$olb;-<0{ zZwfP_gT`tJTU=TDjrx z=sQ-H+kNX)0T%P_nF;g4a9w;&o}eH%g1??hT(RG4S3FnCO-N&TM9`!%1N=Jv^ZEOP z9kw1gp(QuDn(OP1REXLR6zAZfyc z6Dso_XOM3Gl*M-(-|Q$q_KU>p%KZ`k{_@iEZ8~*$t8mLusT6wMbqo#g+jIzJ{!@~a zpVyDi&ENyMcKX-h{^?#UhlYl`%?5~Ui8WWu1hQJIfj57PqHYv8>kS8Mh%mn@Hik=# z_cxsR;%o^4fd0iY3MQ~&?sVLg7>>AHca^J<$I+GO>Jlj5BquIA-2SXFnm+u~z5hdr z|6e9?=`%l{5k-bMlYqXHR4)sCk2MFSZy zPn1>vxhi@7G?-c4(#2eOUK|61?47Knm|FG?2@d3O`6&6L-KS`^6p>NxaOL5&)i=vL z{-jBVI?yLcpJ&4nb&ke270S29SgXyFnDN3C{O!f7c<|>eF-qBT^!lpUtFju~-dE2_}~Fq`M2Q8>}mkxQ@vvd!PeETFkaw-AG3$ z6J}JELiN{{P-H6Z($Djc^^yD@xy$_ZV`|a1)?8~WJOJ8UBni8`$lDBiT-w0TulH4O zr%}1Y2EAS-3w17-EMWKadc0(@Xg*D{iM}=3qfPZ)ed}__5yLia#{1#uD$(KkD&wE}2GMB8xCR%(CGmxuUb4Y=qy`Wll{-;VA6urC z4zl7bjQUE4309_7NZ2;a)&*et0{`hc5#EtOXntw!TgoWbs7^u-wfd~vUot-2w+_Ge zwoN^y=A>yV;aM_}gup30v7rC?K4hcXIvGl3YddAXgrXRlw5f9`!S=(m43#NxOAaO8 zdfpMCp}IB9Fmw5lxbm=;JG`P4Vo(|IhN~&j{!t49QX!@PJLfX|=$7LBQnc&-9pZnC z^p+T~_DX!7LtO!ARoy?Dsk7vU>$dD)?xxdTXlZl+{=xk|K(V38FA;APNT?Tg;;Bg@ z4j8ktfe@S+{a_Eh1}6W2KXP=dt3{y7Ycf!rIMA6$_f(g@u7i(g_l#b#g?$8=l$ao1 zxjjyi8}O6$Hv_a~;iUwxluPC$yFWjj7ZNO%V&%%XvHY`|JU{Zx61Jq}djuBx{KQ_@ zV?h7uxq`j7ROxdZ{wvst*)(6hs+Ts(YN`qyD;8L4zyXj4$_8CL5M2_6j>%M=-p8BA z3@y1tSUgNW+<=*T4?o}i*bwc&W22ZplYu}Cm9gw!j#IXHix?XoB{NMm~(L+7)<9<`bDV|RTQSaGw) z8T{>0{5&e0&2}v)A|%0;JY35nHyrQig4HP?mLn!Y-BnJ=h*Xo-GX~LzU09pmdHKpz zGH&`P#8aJX;(q0J>=7>m;8ed@+iSL_d6W*uhfikHAlo$NUkC2MgoPQv6UARj%oc9B zi#4eB1a;y?{0wglmZu{cUkdy(oHmaPig;giBiA0Ik8v6d?d7v(MebCBw)5FpF?mC7 z-z+}9$5sL?;t5YqG&}Jie(5~~BHorhI{CE%F9^l0lR_Td`sByx#6M}=D67qHvT4@m z0YuPjCl-B;uV-9*ZUb%{3}viSAU4ih-VsAEq&?^^v80{f*z^5{R`0CLz-woG=XiXs zBB5#_232S3TTewTG<)!}nz42`OEeh;$to%Hg`=7LKpY17b+6TEz2eE^Q+g!AMG>ge zeSATb4p7}5x9eoKF66he`~sY_!V zYFDZ7=%^J?TB<&5+ls6Y^W$6owm-crBkI8u`cP@K9`zA*Y9Lg<|MGMqEa`V9zfbdS zyhGmSJ-1OeYwf&8?W1uTFD4RoL^dRU4tTum)o=~;9UtYVZdP|Yr?XUG?~ z_V1DBUp|J+he!#+aa7unM7}#$*K@O%{?*YdP8ipHrrE3Hd7-83k2Qky@_(@6vN`jy zKNi17$sRpD1@cttP<)Z?a;crUg+VQv`KWwm-lQ{9B(Z2K}*;^F2iUDhIxjqFaXd1kSMym zDGAll{K7%=b4;3G`Wwm-iDDxszV zw_nrzdu3z70KqR_ZlZaup!O5?`g%&aXlMTl&rERn^MXn}AxKq!E|?t%co5D&otu%4SQ$$zMq+kY2t z1pgc?gFBd`BE-Y3#Ow zFe7%2J5pjaXPBu}Eea!J6sa5}@Uia@t$f_xG`qV(91TBoi@1IFO@xbY0Idci9GCJa z1IuhYY7IP5ID<{HuR!slQF^3EFo$nip3V0X7pZHqSfENm%LjG_q5-k^Ak5`>QCa;i zl@#vRTbg5)eQnAmX*CW zQ}c22#g{5fK^10U;02P-q-UF1K_tWud;IAsGNPr)UM)p?LOFIX|9~yq)bIt}rgM4jNkD0eP6~S_VbCWll51=1k8? zUEYBET#DXjN`cKrN~z0~)H&)tv8&o2Jh2R5|KZ(DFax|i+*(_{49p4Th)X6J1PM3V zKMPqMb9Z>~n?nDKwWJsoiSd!eOq?h<#qz=cZb-C6f6Ko2QBH523Duc=U`(5$k4}`c zEV_W7H(i$>3~is&yKoCCO$hOQy2J3qFLQ965HL|)L_Q(L!pfsq=zjO{*AFz$@0s^U z*cBbX^D9nd4&K)Pt~9nT707ngsXp!55v%XsKSZY_j~rcbKx-OsqK8lK6EFB~H z^n#Gqx=)yMnCWuVBDGy-3GZO_Tp;4HL0DuhKWr~E8@f2*#caR8?4B&A5Ml6Hy%Weo&7#g8-(o z$@+t4z2+8=?BRo>+fZH$C2YXjG-rsu(BINRnNjv=8dAQjVWx;T)`baSA(h`a@_;s&(C47v$Ql)8s1d zRC7uxcgn|Zi)*l2C=z`)Wh%j+?9)1y;_EYg{0vFCS?98%^USLyM0U}Rp3eZ15#2is zcFPPVHsjM&*9V{E+?)DySZ?8IIdd;N6?bzBE>uchn0fGiSiH4#q_$l0 zXPw#4==@PPGlP`0YToAw2cqCE6H8g8i%ZmM<5i%#3VKd3^2WwF2&>|w@cWA9I!M{^ z&^Kw|4q9-|>h)~X2KxqV&R7Eo?L#P)q>%;x&8Obq`y8M41Y=B&nY*JFFZtS%4meU99BSMzrZ}YE{+fOAgCUe&k`t!I4 z(<53DYb^muJ7vi)_y_mtHktc(UzQ-`_*fSR&BNW)?N{!E#^(e&92><@MNQy-UkO5D zvgzpouWp|hKChQr6MU85;q9Bt?ANgFan(&{D!1 z_uKRYVq`Uy8`F=TDe^l&%Y~hgA)ZUXHF#f=tQ$Xp54@oeDkk@Z$dB<{x@fhvh)}sc zRQE2{OV8{A)#=^7h(r35*z+o_pG?frj)d^T+sb0T4F)M8>FFV(;iZy->U|s%&M_@8mQy9k!bI z%4(;$mo?lhnXN3EYOF}IW&v6R&m~q_UHNb(*-q8$1-f##wM@(ZieG@7scTCZ%C$(Q zSnYFgG55HzTi@ph`Q&LF_26Qq*b_Ou@Du5tm0Vc6x>W$qtd~vGx6gz44i@&OclAH! z=SWE5m3RK!N$A^i&ra#MM}b$#;n>36Mk$qd1|#I#@%R7?-SWLdEBEYlIXn^lfx1s^ zlJcXdb=2zH*1VmmFDnN;#_}ovQ<%Z3pE}xT9Saz(J+-OIw>e1H7cjL0Q^NOi4=~66 z+T;kvixjptq~a4bk}8IG`LdNaJiP~~6l`*uYenm9(ONsVgBL>6mBX={;B0(uX=q_S zIX**#MKbL#j*gIaQuT#Vv)Y%`K8C1-C9AqX3Yf9l44d*mC&-Gq1oS{@X4tu`1aFcc ziPu|O$+%NQyF#@QC;)_Cbw6@SwfGQ0&Bl(X_l}oKH?vAUW7)IF_I%DRa8kOtmlsjx z<(e;0rr4=h=A`_Si*<7HQ-87YR6m=ImFG+fB@8m#rF^LPjYzXA+s&39#x7ggjETG`?KGvy)cshy{psltOoO+kik%-k{51a1`Gp&$B#bgu zxAU<-yNlZMa{kOLI8>=7+fPs+V|GwDnlTyLT=yFfVYy*h!3dXXE7)KDpN#D$qu1^ji6 z1{Ds4;VQK{jCy9dwuD=gp^4hprh=&TPZwsevHc0wvxX><((XCG`Nym0Ed8*ntsDDy z!6W9v$~pHG87Z~ZKjiO(9Pg~Z)wIEpfMOF=`PROa9z82U2t-spux`sJ0nvSWT)Jm? z9JD3$$8uB)g@u_*?MN;UzrxywcTE)!sb@lswi+Orj*@X45(>+m@h8Mrtcli;rc{Qd zrva(Z&NdY@y?nJ*2DFZ}9P z!T(X!wovWPyngDYPRAl z+n$b{^apo>j<$*S`&XT44K?h=7Ceo6;OOoL3z{pk*SHt!PwX64{RCiS`a$Qzw4=lo z3c=4?v4#}+J^F*@xGl;BqwFbk1NIQZkn@Uq7E>aNcpN`xzb5?7^F~s7)VnW(Fes-T2g`XH^?_< zdRkZVDSKX@*MEytT)L`&DJ}KbXO8RGI#23AbTm)BIQwsN&J~Kf(>k%P_G~Vn1j_t1 zat&I7Ok7Iaw!woZ1!c6chg>>VsoO|ReWRX$V4a|ldPx~JVHLjvUr4N zNSI!Ulcik<)NDsdTiipay+eziON3s}W6=EvOM{nYpn>}@7qd;og)=4|*Xe7b0 zG2n1|%S?NpGq|8Ljn= zx&wl5b99`+>L`ewID^Z{PeDM)mXj}E=@1jAc?4E>eV+uA5&deazqTrF)|5tPfsFCM zM#@Xke$5s^gO5)fmhZbI4u&d$+T>wJ=Y1V;*2+c@BL>RUZrK!TjRZg=*lshQ_tuE9 z(olR(DLLoipLf`166{+tmjQvcBtQANFy#02K#Xgmc~<9sim`p#OJmcyqS?A4KHLoW z;)}a&yQ`Jnf~~LD8v{dNm2G!_>C;RziAf0#uJGdmHJCnIlUg#7-?DS3Q|Q-W3HeRW z{R_)rlc#LT(*+D8f!kY2d{2;VEs8CgQAH({zOS{fhbUInRFhu)JpO(hm!Q0dr#J8F zQtu>{OsTmCT99l=@&ewJlhEpA%A7{>y?J;hqS<3EnfYAR0Sg7~>2JtCXUre+NFJJ}~gZcVBN4ti95F093d`qAz!w#So0w3usNK z^Kg?A?8R13!pn{s-1l^Jw1lkh%m#UlS)m^9Fj?>10kY*brfa~9hOE8a#u)dSBlRyi zl|xpo@ZPKDYD~ceDbjnlva}C$>!zgU!itc;;lc!Bmngr(JW(olf8bVQfS&n1WcZ}r zG4$X)-Eew|Aq9JyKJs$)*KySZeZlhUn|H!toPTl=0si*AD$a&C2HY&~U_p@gPmYQ9 xAL+?0K*!=vfj%T~(0_C+lK;3T{{xIMfBoTOdntW-SvUGavQi+)Qt@{m{}-xP+t>gA literal 0 HcmV?d00001 diff --git a/docs/en/others/penetration-test-report.md b/docs/en/others/penetration-test-report.md index 13086fb2a0..534d4759bf 100644 --- a/docs/en/others/penetration-test-report.md +++ b/docs/en/others/penetration-test-report.md @@ -17,53 +17,75 @@ In the next sections, you will find the affected URLs, attack parameters (reques There are high _(red flag)_, medium _(orange flag)_, low _(yellow flag)_, and informational _(blue flag)_ alerts. -![penetration-test-9.1.0](../images/pen-test-alert-list-9.1.png) +![penetration-test-9.1.0](../images/pen-test-alert-list-10.1.png) > The informational alerts are not mentioned in this document. These alerts are not raising any risks on your application and they are optional. -### Spring4Shell [Risk: High] - False Positive +### Cross Site Scripting (Reflected) [Risk: High] - Positive -- *[POST] - https://localhost:44349/Account/ForgotPassword* (attack: **class.module.classLoader.DefaultAssertionStatus=nonsense**) -- *[POST] - https://localhost:44349/Account/Login* (attack: **class.module.classLoader.DefaultAssertionStatus=nonsense**) -- *[POST] - https://localhost:44349/Account/Login?ReturnUrl=%2FSettingManagement* (attack: **class.module.classLoader.DefaultAssertionStatus=nonsense**) +- *[GET] - https://localhost:44305/Identity/OrganizationUnits/AddMemberModal?title=SelectAUser&organizationUnitId=...&OrganizationUnitName=%3C%2Fh5%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Ch5%3E* +- *[GET] - https://localhost:44305/Identity/OrganizationUnits/AddRoleModal?organizationUnitId=...&OrganizationUnitName=%3C%2Fh5%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Ch5%3E* +- *[GET] - https://localhost:44305/Saas/Host/Tenants/ImpersonateTenantModal?tenantId=...&tenantName=%3C%2Fh5%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Ch5%3E* **Description**: -The application appears to be vulnerable to CVE-2022-22965 (otherwise known as Spring4Shell) - remote code execution (RCE) via data binding. +Cross-site Scripting (XSS) is an attack technique that involves echoing attacker-supplied code into a user's browser instance. **Explanation**: -ABP Framework is built on top of ASP.NET Core and does not use the Spring Framework. This application does not rely on Java-based technologies, making it immune to vulnerabilities like Spring4Shell. The detection is a false positive as there are no Spring dependencies in the project. +This is a **Positive** alert. The application reflects the `OrganizationUnitName` and `tenantName` parameters without proper encoding in the modal headers, allowing for the execution of arbitrary JavaScript. We have created an **internal issue** to track this vulnerability, and it will be fixed in the next release. -### Absence of Anti-CSRF Tokens [Risk: Medium] — False Positive +### PII Disclosure [Risk: High] - False Positive -* *[GET] - https://localhost:44349/Account/LinkUsers/LinkUsersModal?returnUrl=/SettingManagement* -* *[GET] — https://localhost:44349/Account/Manage* (same URL with different query parameters) -* *[GET] - https://localhost:44349/HostDashboard* -* *[GET] - https://localhost:44349/SettingManagement?handler=RenderView&id=Volo.Abp.Account* (other several URLs) +- *[GET] - https://localhost:44305/* (Evidence: 639002492030480000) +- *[GET] - https://localhost:44305/?page=...* -**Description**: +**Description**: -No Anti-CSRF tokens were found in an HTML submission form. -A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a website has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has in a website. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf. +The response contains Personally Identifiable Information, such as CC number, SSN and similar sensitive data. -**Explanation:** +**Explanation**: -This is a **false-positive** alert because ABP provides the Anti-CSRF token via a cookie as seen on the following screenshot: +This is a **false-positive** alert. The detected numbers (e.g., `639002492030480000`) are cache-busting timestamps (`_v` parameter) generated by the framework for static assets. They coincidentally match the pattern of Credit Card numbers (pattern matching) but are not sensitive data. -![Absence of Anti-CSRF Token](../images/pen-test-alert-remote-os-command-injection.png) +### Path Traversal [Risk: High] - False Positive -### Application Error Disclosure [Risk: Medium] - False Positive +- *[GET] - https://localhost:44305/Account/Login?returnUrl=Login* +- *[GET] - https://localhost:44305/api/account/security-logs?action=\security-logs* -- *[GET] — https://localhost:44349/AuditLogs* +**Description**: -**Description**: +The Path Traversal attack technique allows an attacker access to files, directories, and commands that potentially reside outside the web document root directory. + +**Explanation**: + +This is a **false-positive** alert. ABP Framework automatically validates `returnUrl` parameters and ensures they are local to the application or within a whitelist. The application does not return file contents based on these parameters. + +### SQL Injection [Risk: High] - False Positive + +- *[GET] - https://localhost:44305/AbpPermissionManagement/PermissionManagementModal?providerKey=AbpSolution16711_Swagger+AND+1%3D1+--+* +- *[GET] - https://localhost:44305/Account/Manage?CurrentPassword=ZAP%27+AND+%271%27%3D%271%27+--+* + +**Description**: + +SQL injection may be possible. -This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page. +**Explanation**: + +This is a **false-positive** alert. ABP Framework uses Entity Framework Core, which inherently uses parameterized queries, preventing standard SQL injection attacks. Manual verification showed that injecting SQL syntax into parameters like `providerKey` results in the input being treated as a literal string (resulting in no match or default behavior) rather than altering the query structure. + +### SQL Injection - SQLite [Risk: High] - False Positive + +- *[POST] - https://localhost:44305/Account/ForgotPassword?returnUrl=%2FAccount%2FManage* (Attack: `case randomblob(100000) ...`) +- *[POST] - https://localhost:44305/FeatureManagement/FeatureManagementModal* + +**Description**: + +SQL injection may be possible. **Explanation**: -There are only one URL that is reported as exposing error messages. This is a **false-positive** alert. The [Audit Logging Module](../modules/audit-logging.md), shows request & response details and exception information, these are not sensitive information and only can be seen by the users whose related permissions are granted. +This is a **false-positive** alert. Similar to the standard SQL Injection alert, the application uses parameterized queries. The detected delays are likely due to application processing variations or network latency rather than successful SQL injection. ### Content Security Policy (CSP) Header Not Set [Risk: Medium] — Positive (Fixed) @@ -238,23 +260,7 @@ A cookie has been set with its `SameSite` attribute set to `none`, which means t Ensure that the `SameSite` attribute is set to either `lax` or ideally `strict` for all cookies. We discussed setting the **SameSite** attribute to `strict` in the following issue [github.com/abpframework/abp/issues/14215](https://github.com/abpframework/abp/issues/14215) and decided to leave this change to the final developer. -### Information Disclosure - Debug Error Messages [Risk: Low] — False Positive - -* *[GET] - https://localhost:44349/AuditLogs* - -**Description:** - -The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages. - -**Solution:** - -Disable debugging messages before pushing them to production. - -**Explanation:** - -The response of the endpoints above return localization texts which are not real error messages. As there is no real error in the backend side, this vulnerability is a **false-positive** alert. -![Information Disclosure - Debug Error Messages](../images/pen-test-information-disclosure.png) ### Strict-Transport-Security Header Not Set [Risk: Low] - False Positive