Add support for both report-only and content-security CSP headers #50
Conversation
security/middleware.py
Outdated
| err_msg = 'Middleware requires either CSP_STRING or CSP_DICT setting' | ||
| report_err_msg = 'Middleware requires either CSP_REPORT_STRING, ' \ |
There was a problem hiding this comment.
We prefer to do line continuation using brackets.
report_err_msg = (
'Middleware requires either CSP_REPORT_STRING, '
'CSP_REPORT_DICT setting, or neither. If neither, '
...
)
MartinPetkov
force-pushed
the
feature/44_support_both_csp_headers
branch
2 times, most recently
from
4cbcf6d to
8d2989a
Compare
security/middleware.py
Outdated
| def __init__(self): | ||
| # sanity checks | ||
| csp_mode = getattr(django.conf.settings, 'CSP_MODE', None) | ||
| self._csp_mode = getattr(django.conf.settings, 'CSP_MODE') or 'enforce' |
There was a problem hiding this comment.
You still need the 'None'. If you don't supply CSP_MODE getattr will raise an exception.
MartinPetkov
force-pushed
the
feature/44_support_both_csp_headers
branch
2 times, most recently
from
66236ad to
c1383cb
Compare
|
Why @MartinPetkov ! |
|
It's just been a while and I thought it was forggoten and no one was watching it. I'm happy to reopen and contribute it. |
Also refactor __init__ to reduce complexity. Refs sdelements#44
MartinPetkov
force-pushed
the
feature/44_support_both_csp_headers
branch
from
c1383cb to
8a4c067
Compare
|
Rebased and updated. Tried running tox with Python 3.8, seems like only the Pep tests failed. PTAL. |
Bumps [python-dateutil](https://github.com/dateutil/dateutil) from 2.8.0 to 2.8.1. - [Release notes](https://github.com/dateutil/dateutil/releases) - [Changelog](https://github.com/dateutil/dateutil/blob/master/NEWS) - [Commits](dateutil/dateutil@2.8.0...2.8.1) Signed-off-by: dependabot-preview[bot] <[email protected]>
…l-2.8.1 Bump python-dateutil from 2.8.0 to 2.8.1
And adjust tox so all tests pass
We need to stay pinned to python3.6 for the time being |
Done, reverted to Python 3.6. Tested with the |
|
Ping? |
|
Sorry for the slow response, we’ve all been busy doing a two week hackathon. We’ll be starting regular sprint work again soon, so hopefully someone can take a look then 😄 |
Sounds good, just making sure it didn't get lost forever. Hope the hackathon was fun! |
|
Gave this a quick test, thanks for cleaning up all the flake8 warnings as well. |
Also refactor init to reduce complexity and fix
tox.iniand tox test failuresFixes #44