mirror of
https://github.com/postgres/pgweb.git
synced 2025-08-06 09:57:57 +00:00
ea9becd746
* Get rid of the django_markwhat dependency, and implement our own classes to get more control. In passing also remove django-markdown, because we never used that. * Instead of trying to clean markdown with regexps, use the bleach library (NEW DEPENDENCY) with special whitelisting of allowed tags based off standard markdown. This means that one can input links or formatting in HTML if one prefers, as long as it renders to the same subset of tags that markdown allows. * Replace javascript based client side preview with an actual call to a preview URL that renders the exact result using the same function, since the use of showdown on the client was increasingly starting to differ from the server, and since that cannot be kept secure the same way. Rewrite the client side javascript to work better with the now longer interval between updates of the preview. Long in planning, but never got around to it. Suggestion to use bleach for escaping from David Fetter.
183 lines
6.9 KiB
Python
183 lines
6.9 KiB
Python
# Django settings for pgweb project.
|
|
|
|
import os
|
|
PROJECT_ROOT = os.path.abspath(os.path.dirname(__file__))
|
|
|
|
DEBUG = False
|
|
|
|
ADMINS = (
|
|
('PostgreSQL Webmaster', 'webmaster@postgresql.org'),
|
|
)
|
|
|
|
MANAGERS = ADMINS
|
|
|
|
DATABASES = {
|
|
'default': {
|
|
'ENGINE': 'django.db.backends.postgresql_psycopg2',
|
|
'NAME': 'pgweb',
|
|
}
|
|
}
|
|
|
|
# Local time zone for this installation. Choices can be found here:
|
|
# http://en.wikipedia.org/wiki/List_of_tz_zones_by_name
|
|
# although not all choices may be available on all operating systems.
|
|
# If running in a Windows environment this must be set to the same as your
|
|
# system time zone.
|
|
TIME_ZONE = 'GMT'
|
|
|
|
# Language code for this installation. All choices can be found here:
|
|
# http://www.i18nguy.com/unicode/language-identifiers.html
|
|
LANGUAGE_CODE = 'en-us'
|
|
|
|
SITE_ID = 1
|
|
|
|
# If you set this to False, Django will make some optimizations so as not
|
|
# to load the internationalization machinery.
|
|
USE_I18N = False
|
|
|
|
# Absolute path to the directory that holds media.
|
|
# Example: "/home/media/media.lawrence.com/"
|
|
MEDIA_ROOT = ''
|
|
|
|
# URL that handles the media served from MEDIA_ROOT. Make sure to use a
|
|
# trailing slash if there is a path component (optional in other cases).
|
|
# Examples: "http://media.lawrence.com", "http://example.com/media/"
|
|
MEDIA_URL = ''
|
|
STATIC_URL = '/media/'
|
|
|
|
STATICFILES_DIRS = (
|
|
'media/',
|
|
)
|
|
|
|
# Make this unique, and don't share it with anybody.
|
|
SECRET_KEY = 'REALLYCHANGETHISINSETTINGS_LOCAL.PY'
|
|
|
|
MIDDLEWARE = [
|
|
'django.middleware.common.CommonMiddleware',
|
|
'django.contrib.sessions.middleware.SessionMiddleware',
|
|
'django.contrib.messages.middleware.MessageMiddleware',
|
|
'django.middleware.csrf.CsrfViewMiddleware',
|
|
'django.contrib.auth.middleware.AuthenticationMiddleware',
|
|
'pgweb.util.middleware.PgMiddleware',
|
|
]
|
|
|
|
CSRF_FAILURE_VIEW = 'pgweb.core.views.csrf_failure'
|
|
|
|
ROOT_URLCONF = 'pgweb.urls'
|
|
|
|
TEMPLATES = [{
|
|
'BACKEND': 'django.template.backends.django.DjangoTemplates',
|
|
'DIRS': ['templates', ],
|
|
'OPTIONS': {
|
|
'context_processors': [
|
|
'django.contrib.auth.context_processors.auth',
|
|
'django.contrib.messages.context_processors.messages',
|
|
'django.template.context_processors.media',
|
|
'pgweb.util.contexts.PGWebContextProcessor',
|
|
],
|
|
'loaders': [
|
|
'pgweb.util.templateloader.TrackingTemplateLoader',
|
|
'django.template.loaders.filesystem.Loader',
|
|
'django.template.loaders.app_directories.Loader',
|
|
],
|
|
},
|
|
}]
|
|
|
|
LOGIN_URL = '/account/login/'
|
|
LOGIN_REDIRECT_URL = '/account/'
|
|
LOGOUT_URL = '/account/logout/'
|
|
|
|
AUTHENTICATION_BACKENDS = (
|
|
'pgweb.util.auth.AuthBackend',
|
|
)
|
|
|
|
INSTALLED_APPS = [
|
|
'django.contrib.auth',
|
|
'django.contrib.contenttypes',
|
|
'django.contrib.messages',
|
|
'django.contrib.sessions',
|
|
'django.contrib.admin',
|
|
'django.contrib.staticfiles',
|
|
'pgweb.core.apps.CoreAppConfig',
|
|
'pgweb.mailqueue',
|
|
'pgweb.account',
|
|
'pgweb.news',
|
|
'pgweb.events',
|
|
'pgweb.quotes',
|
|
'pgweb.downloads',
|
|
'pgweb.docs',
|
|
'pgweb.contributors',
|
|
'pgweb.profserv',
|
|
'pgweb.lists',
|
|
'pgweb.security',
|
|
'pgweb.sponsors',
|
|
'pgweb.survey',
|
|
'pgweb.misc',
|
|
'pgweb.featurematrix',
|
|
'pgweb.search',
|
|
'pgweb.pugs',
|
|
'pgweb.util',
|
|
]
|
|
|
|
# Default format for date/time (as it changes between machines)
|
|
DATETIME_FORMAT = "Y-m-d H:i:s"
|
|
DATE_FORMAT = "Y-m-d"
|
|
|
|
# Configure recaptcha. Most details contain keys and are thus handled
|
|
# in settings_local.py. Override NOCAPTCHA to actually use them.
|
|
NOCAPTCHA = True
|
|
RECAPTCHA_SITE_KEY = ""
|
|
RECAPTCHA_SECRET_KEY = ""
|
|
|
|
###
|
|
# Application specific settings, likely overridden in settings_local.py.
|
|
#
|
|
# In particular, adjust the email addresses
|
|
###
|
|
SESSION_COOKIE_SECURE = True # Allow our session only over https
|
|
SESSION_COOKIE_DOMAIN = "www.postgresql.org" # Don't allow access by other postgresql.org sites
|
|
SESSION_COOKIE_HTTPONLY = True # Access over http only, no js
|
|
CSRF_COOKIE_SECURE = SESSION_COOKIE_SECURE
|
|
CSRF_COOKIE_DOMAIN = SESSION_COOKIE_DOMAIN
|
|
CSRF_COOKIE_HTTPONLY = SESSION_COOKIE_HTTPONLY
|
|
|
|
SITE_ROOT = "https://www.postgresql.org" # Root of working URLs
|
|
FTP_PICKLE = "/usr/local/pgweb/ftpsite.pickle" # Location of file with current contents from ftp site
|
|
YUM_JSON = "/usr/local/pgweb/external/yum.json"
|
|
STATIC_CHECKOUT = "/usr/local/pgweb-static" # Location of a checked out pgweb-static project
|
|
NOTIFICATION_EMAIL = "someone@example.com" # Address to send notifications *to*
|
|
NOTIFICATION_FROM = "someone@example.com" # Address to send notifications *from*
|
|
ACCOUNTS_NOREPLY_FROM = "someone@example.com" # Address to send account messages from
|
|
BUGREPORT_EMAIL = "someone@example.com" # Address to pgsql-bugs list
|
|
BUGREPORT_NOREPLY_EMAIL = "someone-noreply@example.com" # Address to no-reply pgsql-bugs address
|
|
DOCSREPORT_EMAIL = "someone@example.com" # Address to pgsql-docs list
|
|
DOCSREPORT_NOREPLY_EMAIL = "someone-noreply@example.com" # Address to no-reply pgsql-docs address
|
|
NEWS_MAIL_SENDER = "someone-noreply@example.com" # Address news is sent from
|
|
NEWS_MAIL_RECEIVER = "some-announce@example.com" # Address news is sent to
|
|
NEWS_MAIL_RECEIVER_NAME = "Some Announcement List" # Name field for sending news
|
|
NEWS_MAIL_TAGKEY = "" # Key used to sign tags for pglister delivery
|
|
FRONTEND_SERVERS = () # A tuple containing the *IP addresses* of all the
|
|
# varnish frontend servers in use.
|
|
FTP_MASTERS = () # A tuple containing the *IP addresses* of all machines
|
|
# trusted to upload ftp structure data
|
|
VARNISH_PURGERS = () # Extra servers that can do varnish purges through our queue
|
|
DO_ESI = False # Generate ESI tags
|
|
ARCHIVES_SEARCH_SERVER = "archives.postgresql.org" # Where to post REST request for archives search
|
|
ARCHIVES_SEARCH_PLAINTEXT = False # Contact ARCHIVES_SEARCH_SERVER with http instead of https
|
|
FRONTEND_SMTP_RELAY = "magus.postgresql.org" # Where to relay user generated email
|
|
OAUTH = {} # OAuth providers and keys
|
|
PGDG_ORG_ID = -1 # id of the PGDG organisation entry
|
|
|
|
# For debug toolbar, can then be fully configured in settings_local.py
|
|
DEBUG_TOOLBAR = False
|
|
INTERNAL_IPS = [
|
|
'127.0.0.1',
|
|
]
|
|
|
|
# Load local settings overrides
|
|
from .settings_local import *
|
|
|
|
if DEBUG and DEBUG_TOOLBAR:
|
|
MIDDLEWARE.append('debug_toolbar.middleware.DebugToolbarMiddleware')
|
|
INSTALLED_APPS.append('debug_toolbar')
|