catborise 6f44461c28 feat(security): every page carries a Content-Security-Policy that needs no template change ... A small middleware sends object-src 'none', base-uri 'self', form-action 'self' and frame-ancestors 'none': no plugin content, no injected <base> redirecting relative URLs, no form posting to another origin, no framing. script-src and style-src are left out: the templates still hold inline scripts, event handlers and javascript: URLs, which an enforced script policy would block. The middleware is added to the settings template, which the update steps and each Docker container rebuild settings.py from.		2026-10-19 15:49:39 +03:00
..
tests	feat(security): every page carries a Content-Security-Policy that needs no template change	2026-10-19 15:49:39 +03:00
__init__.py	Initial commit	2015-02-27 10:53:51 +02:00
asgi.py	fix references to django 3 migration	2021-06-15 14:29:20 +03:00
common_tags.py	fix: render the 404 page for logged-in users	2026-10-04 01:08:11 +03:00
middleware.py	feat(security): every page carries a Content-Security-Policy that needs no template change	2026-10-19 15:49:39 +03:00
serializers.py	fix(api): typed URLs and accurate response schemas	2026-10-04 01:08:11 +03:00
settings-dev.py	fix(static): collectstatic writes to staticfiles/, and its output is no longer committed	2026-10-07 16:31:56 +03:00
settings.py.template	feat(security): every page carries a Content-Security-Policy that needs no template change	2026-10-19 15:49:39 +03:00
urls-api.py	feat(operations): jobs API	2026-10-14 23:27:57 +03:00
urls.py	feat(operations): jobs page	2026-10-14 23:27:57 +03:00
wsgi.py	fix: stop ignoring SIGCHLD process-wide	2026-10-04 13:40:53 +03:00
wsgi_custom.py	fix references to django 3 migration	2021-06-15 14:29:20 +03:00