j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-09 03:36:48 +00:00
Code Issues Projects Releases Wiki Activity

fix(settings): ALLOWED_HOSTS lists the server's names instead of accepting any host

Browse source
This commit is contained in:
catborise 2026-10-07 15:46:45 +03:00
parent c1381318f1
commit 9f5e8fe1c4
8 changed files with 90 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
webvirtcloud/settings.py.template
View file

@ -29,7 +29,11 @@ DEBUG = False
MAC_OUI = '52:54:10'
ALLOWED_HOSTS = ["*"]
# Host names the panel answers to. The installer writes the server's; add more
# (comma-separated, "*" for any) through the environment.
ALLOWED_HOSTS = ["localhost", "127.0.0.1", "[::1]"]
if extra_hosts := os.getenv("ALLOWED_HOSTS"):
ALLOWED_HOSTS.extend([host.strip() for host in extra_hosts.split(",") if host.strip()])
CSRF_TRUSTED_ORIGINS = ["http://localhost", "http://127.0.0.1", "http://localhost:8000", "http://127.0.0.1:8000"]
if extra_origins := os.getenv("CSRF_TRUSTED_ORIGINS"):

21
webvirtcloud/test_settings_env.py
View file

@ -7,11 +7,11 @@ import subprocess
import sys
from django.conf import settings
from django.test import TestCase, override_settings
from django.test import SimpleTestCase, TestCase, override_settings
# Env vars that change the settings; removed from the inherited environment so
# every case starts from the defaults.
CONFIG_VARS = ["WEBVIRTCLOUD_HTTPS"]
CONFIG_VARS = ["WEBVIRTCLOUD_HTTPS", "ALLOWED_HOSTS"]
def _env(env):
@ -68,3 +68,20 @@ class HttpsProfileTestCase(TestCase):
with override_settings(SECURE_SSL_REDIRECT=True):
response = self.client.get("/accounts/login/", HTTP_X_FORWARDED_PROTO="https")
self.assertNotEqual(response.status_code, 301)
class AllowedHostsTestCase(SimpleTestCase):
def hosts(self, env):
return load_settings(env, ["ALLOWED_HOSTS"])["ALLOWED_HOSTS"]
def test_allowed_hosts_default_is_not_any_host(self):
hosts = self.hosts({})
self.assertNotIn("*", hosts)
self.assertIn("localhost", hosts)
def test_allowed_hosts_extended_from_env(self):
hosts = self.hosts({"ALLOWED_HOSTS": " wvc.example.com, ,192.0.2.10 "})
self.assertEqual(hosts[-2:], ["wvc.example.com", "192.0.2.10"])
def test_allowed_hosts_star_escape(self):
self.assertIn("*", self.hosts({"ALLOWED_HOSTS": "*"}))