The following security policy headers are set:
X-XSS-Protection: 1; mode=block -- always set
X-Frame-Options: DENY is set for all pages except for the documentation
pages, primarily because pgadmin4 loads them in an iframe which would
break.
Content-Security-Policy: <x>-src
Is set to allow the default of self only, then allowing scripts for
google analytics and fonts for google fonts. Images are allowed from everywhere.
frame-ancestors 'none' is set by the same rules as X-Frame-Options
This also adds a decorator for @script_sources to have a single view
allow extra sources, and this is used for recaptcha. A generic decorator
is also made for other types of exclusions, though we don't have any at
this point.
If the setting SECURITY_POLICY_REPORT_ONLY is set to True then the policy
will be report-only and not enforced (for testing), otherwise enforcing
mode is enabled.
The setting SECURITY_POLICY_REPORT_URI sets where to send security
policy reports, if any.
This creates a permanent redirect for any doc URL that references the
"static" path (i.e. all doc URLs), which allows a format similar to:
/docs/current/index.html
This is in response to not having "interactive" as an available option,
which should lead to shorter, less confusing URLs.
This patch brings the web-based documentation to match the current styles
on the main postgresql.org website. The CSS supports the generated markup
from the main PostgreSQL documentation and supports the new/old class
that are visible in the documentation (e.g. uppercase classes pre-v10).
Authors: Sarah Conway, Jonathan Katz
It was already storing the version as a field, the inheriting from the
actual model was never used. Remove it, since newer django tries to
access a table based on the class name..
render_to_response does not work on newer django, so it needs to be
replaced. And using a speicfic context actually overcomplicates things,
it's easier to just use a wrapper function. For those cases where we
don't need NavContext, just use render() (the new shortcut function from
django), which also removes the need to use RequestContext.
Don't say version 0.0 in the emails that are sent out. That's what we
call it internally, but the URL should have /devel/ in it. Fix this both
in the template, and then if it comes through in the form again in case
the user picked up a link elsewhere that is incorrect.
Sending from the submitters address runs afoul to DMARC and other
restrictions. Instead, send the email from a defined noreply address.
Instead, add the original submitter to both the Cc and the Reply-To
header, to make sure they receive followups.
Patch by Stephen, minor changes by Magnus
This allows us to say that "app-pgreceivexlog.html" is actually the same
as "app-pgreceivewal.html" on a different version.
Turns out the templates would already render this correctly if we could
just find the map, so it's a simple case of adding an additional join
(that the django orm can't figure out, but we can do it in manual sql).
Adds a non-django managed unique index to make sure that it's not
possible to add the same alias twice in different "directions".
Violating this will cause a django excpetion in the admin interface
since it doesn't know about it, but as this is a very uncommon operation
and admin only, we don't care about that.
Finally, we don't bother issuing varnish purges for changes here, the
admin is expected to handle those manually. These changes are supposed
to happen very seldom, and the contents are purged automatically when
the docs are loaded anyway.
This one will validate that the url is under /accounts/, which is
the only part we are going to be excluding from caching once we
move the website to https-only.
Per discussion from a long time ago, interactive docs aren't really
working out. The majority of submissions are either support questions
(which then get rejected because they cannot be answered in this
context) or pointing out docs incorrectnesses (which should be submitted
as a docs bug instead, so they can actually be fixed in the main
documentation).
Old references to /interactive/ will get redirected to /static/
automatically, and we expect to keep doing that for a long time (since
there are many links to them around the net).
This will allow us to increase the cache times in the browser for our
CSS, which almost never changes.
Enables a new value to be used in templates, {{gitrev}}, which can be
used to bust pretty much any URL. We could do this for all the images
in the templates as well, but since most of them almost never change,
we'll just enable it manually for each individual image as it becomes
necessray - or just use a ?1, ?2 etc for those.
Enabled by default for CSS and JavaScript links, since those are much
more likely to be changed without having the URL changed.
Cache times aren't increased yet - we'll do that later one we're sure
that all existing caches are expired first.
This allows us to specify both beta and rc versions.
Requires SQL:
ALTER TABLE core_version RENAME COLUMN beta TO testing;
ALTER TABLE core_version ALTER COLUMN testing TYPE integer USING CASE WHEN testing THEN 2 ELSE 0 END;
Instead of having to update this list manually in multiple places when
releasing new versions, just take the information out of the database
where it has to be anyway.
Fixes#90Closes#93
Also make the code automatically pick up wich PDF files exist in the
static checkout, and auto-detect their size, both A4 and US sizes. This
removes yet one more manual step, yay!
Fixes#163
Previously we listed both those as unsupported, which confused some users
particularly with new beta releases. While they are technically not supported
yet, it gave off the image that specific features would not be in newer
versions anymore, since they got listed as unsupported.
In passing, fix the style of the links in case they only exist in old
versions, which would put an extra | character in the version list.
This makes it possible to figure out when the docs were actually
loaded, since developer docs don't carry a version number. This is
actually going to be the docs *load* timestamp, and not build timestamp,
but they should be close enough together that it shouldn't matter.
Fixes#108
