mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
34b9fb21c8
- gunicorn.conf.py was gunicorn's sample file: pages of generic comments, a broken link and examples of the eventlet worker the panel no longer has. Only the panel's own comments stay; every setting keeps its value. - docker-compose.yml: the backups hold the database, keys and certificates, not "both". - accounts' system checks point to settings.py.template, which has the middleware they ask for (the README does not list it). - The authorization matrix test names doc/permissions.md, where the roles table is; the keymap list no longer cites a dead page.
53 lines
2 KiB
Python
53 lines
2 KiB
Python
from django.conf import settings
|
|
from django.core.checks import Error, Tags, Warning, register
|
|
|
|
|
|
@register(Tags.security)
|
|
def password_change_middleware_check(app_configs, **kwargs):
|
|
middleware = list(settings.MIDDLEWARE)
|
|
required = "accounts.middleware.ForcePasswordChangeMiddleware"
|
|
authentication = "django.contrib.auth.middleware.AuthenticationMiddleware"
|
|
if required not in middleware or (
|
|
authentication in middleware
|
|
and middleware.index(required) < middleware.index(authentication)
|
|
):
|
|
return [
|
|
Error(
|
|
"ForcePasswordChangeMiddleware must follow AuthenticationMiddleware.",
|
|
hint=f"Add '{required}' to MIDDLEWARE in webvirtcloud/settings.py, as settings.py.template does.",
|
|
id="accounts.E001",
|
|
)
|
|
]
|
|
return []
|
|
|
|
|
|
@register(Tags.security)
|
|
def login_required_middleware_check(app_configs, **kwargs):
|
|
middleware = list(settings.MIDDLEWARE)
|
|
required = "django.contrib.auth.middleware.LoginRequiredMiddleware"
|
|
old = "login_required.middleware.LoginRequiredMiddleware"
|
|
if old in middleware or required not in middleware:
|
|
return [
|
|
Error(
|
|
"MIDDLEWARE must use Django's LoginRequiredMiddleware.",
|
|
hint=f"In webvirtcloud/settings.py replace '{old}' with '{required}' "
|
|
"and delete LOGIN_REQUIRED_IGNORE_VIEW_NAMES, as settings.py.template does.",
|
|
id="accounts.E002",
|
|
)
|
|
]
|
|
return []
|
|
|
|
|
|
@register()
|
|
def obsolete_settings_check(app_configs, **kwargs):
|
|
if hasattr(settings, "SHOW_PROFILE_EDIT_PASSWORD"):
|
|
return [
|
|
Warning(
|
|
"SHOW_PROFILE_EDIT_PASSWORD is no longer used.",
|
|
hint="Remove it from webvirtcloud/settings.py. Whether a user may change their own "
|
|
"password is the 'Can change password' permission, per user or group.",
|
|
id="accounts.W001",
|
|
)
|
|
]
|
|
return []
|
|
|