[Web] improve validation of Client UIDs
[mygpo.git] / mygpo / settings.py
blobed454275631e01f9438d51749f206809d03a1e13
1 # Django settings for mygpo project.
3 # This file is part of my.gpodder.org.
5 # my.gpodder.org is free software: you can redistribute it and/or modify it
6 # under the terms of the GNU Affero General Public License as published by
7 # the Free Software Foundation, either version 3 of the License, or (at your
8 # option) any later version.
10 # my.gpodder.org is distributed in the hope that it will be useful, but
11 # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public
13 # License for more details.
15 # You should have received a copy of the GNU Affero General Public License
16 # along with my.gpodder.org. If not, see <http://www.gnu.org/licenses/>.
19 import sys
20 import os.path
21 import dj_database_url
23 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
25 # http://code.djangoproject.com/wiki/BackwardsIncompatibleChanges#ChangedthewayURLpathsaredetermined
26 FORCE_SCRIPT_NAME=""
28 DEBUG = True
29 TEMPLATE_DEBUG = DEBUG
31 ADMINS = ()
33 MANAGERS = ADMINS
35 DATABASES = {
36 'default': dj_database_url.config(
37 default='postgres://mygpo:mygpo@localhost/mygpo'),
40 COUCHDB_DATABASES = {
41 'mygpo.directory':
42 {'URL': 'http://127.0.0.1:5984/mygpo_categories'},
44 'mygpo.users':
45 {'URL': 'http://127.0.0.1:5984/mygpo_users'},
47 'mygpo.categories':
48 {'URL': 'http://127.0.0.1:5984/mygpo_categories'},
50 'mygpo.userdata':
51 {'URL': 'http://127.0.0.1:5984/mygpo_userdata'},
54 # Maps design documents to databases. The keys correspond to the directories in
55 # mygpo/couch/, the values are the app labels which are mapped to the actual
56 # databases in COUCHDB_DATABASES. This indirect mapping is used because
57 # COUCHDB_DATABASES is likely to be overwritten in settings_prod.py while
58 # COUCHDB_DDOC_MAPPING is most probably not overwritten.
59 COUCHDB_DDOC_MAPPING = {
60 'categories': 'categories',
61 'userdata': 'userdata',
62 'users': 'users',
65 # Local time zone for this installation. Choices can be found here:
66 # http://en.wikipedia.org/wiki/List_of_tz_zones_by_name
67 # although not all choices may be available on all operating systems.
68 # If running in a Windows environment this must be set to the same as your
69 # system time zone.
70 TIME_ZONE = 'UTC'
72 # Language code for this installation. All choices can be found here:
73 # http://www.i18nguy.com/unicode/language-identifiers.html
74 LANGUAGE_CODE = 'en-us'
76 SITE_ID = 1
78 # If you set this to False, Django will make some optimizations so as not
79 # to load the internationalization machinery.
80 USE_I18N = True
82 STATIC_ROOT = 'staticfiles'
83 STATIC_URL = '/media/'
85 STATICFILES_DIRS = (
86 os.path.abspath(os.path.join(BASE_DIR, '..', 'htdocs', 'media')),
89 # List of callables that know how to import templates from various sources.
90 TEMPLATE_LOADERS = (
91 'django.template.loaders.app_directories.Loader',
94 MIDDLEWARE_CLASSES = (
95 'django.middleware.cache.UpdateCacheMiddleware',
96 'django.middleware.common.CommonMiddleware',
97 'django.middleware.csrf.CsrfViewMiddleware',
98 'django.middleware.cache.FetchFromCacheMiddleware',
99 'django.contrib.sessions.middleware.SessionMiddleware',
100 'django.contrib.auth.middleware.AuthenticationMiddleware',
101 'django.middleware.locale.LocaleMiddleware',
102 'django.contrib.messages.middleware.MessageMiddleware',
105 ROOT_URLCONF = 'mygpo.urls'
107 TEMPLATE_DIRS = ()
109 INSTALLED_APPS = (
110 'django.contrib.contenttypes',
111 'django.contrib.messages',
112 'django.contrib.admin',
113 'django.contrib.humanize',
114 'django.contrib.auth',
115 'django.contrib.sessions',
116 'django.contrib.staticfiles',
117 'djcelery',
118 'mygpo.core',
119 'mygpo.podcasts',
120 'mygpo.chapters',
121 'mygpo.search',
122 'mygpo.users',
123 'mygpo.api',
124 'mygpo.web',
125 'mygpo.publisher',
126 'mygpo.subscriptions',
127 'mygpo.history',
128 'mygpo.favorites',
129 'mygpo.data',
130 'mygpo.userfeeds',
131 'mygpo.suggestions',
132 'mygpo.directory',
133 'mygpo.maintenance',
134 'mygpo.share',
135 'mygpo.administration',
136 'mygpo.pubsub',
137 'mygpo.podcastlists',
138 'mygpo.votes',
139 'mygpo.db.couchdb',
142 try:
143 import debug_toolbar
144 INSTALLED_APPS += ('debug_toolbar', )
146 except ImportError:
147 print >> sys.stderr, 'Could not load django-debug-toolbar'
150 TEST_EXCLUDE = (
151 'django',
152 'couchdbkit',
155 TEST_RUNNER='mygpo.test.MygpoTestSuiteRunner'
157 ACCOUNT_ACTIVATION_DAYS = 7
159 AUTHENTICATION_BACKENDS = (
160 'django.contrib.auth.backends.ModelBackend',
161 'mygpo.web.auth.EmailAuthenticationBackend',
164 SESSION_ENGINE = "django.contrib.sessions.backends.cached_db"
166 # TODO: use (default) JSON serializer for security
167 # this would currently fail as we're (de)serializing datetime objects
168 # https://docs.djangoproject.com/en/1.5/topics/http/sessions/#session-serialization
169 SESSION_SERIALIZER = 'django.contrib.sessions.serializers.PickleSerializer'
172 from django.conf.global_settings import TEMPLATE_CONTEXT_PROCESSORS
174 TEMPLATE_CONTEXT_PROCESSORS += (
175 "mygpo.web.google.analytics",
176 "mygpo.web.google.adsense",
178 # make the debug variable available in templates
179 # https://docs.djangoproject.com/en/dev/ref/templates/api/#django-core-context-processors-debug
180 "django.core.context_processors.debug",
182 # required so that the request obj can be accessed from templates.
183 # this is used to direct users to previous page after login
184 'django.core.context_processors.request',
187 MESSAGE_STORAGE = 'django.contrib.messages.storage.session.SessionStorage'
189 USER_CLASS = 'mygpo.users.models.User'
191 LOGIN_URL = '/login/'
193 CSRF_FAILURE_VIEW='mygpo.web.views.security.csrf_failure'
196 # The following entries should be set in settings_prod.py
197 DEFAULT_FROM_EMAIL = ''
198 SECRET_KEY = ''
199 GOOGLE_ANALYTICS_PROPERTY_ID=''
200 DIRECTORY_EXCLUDED_TAGS = ()
201 FLICKR_API_KEY = ''
203 MAINTENANCE = os.path.exists(os.path.join(BASE_DIR, 'MAINTENANCE'))
206 LOGGING = {
207 'version': 1,
208 'disable_existing_loggers': True,
209 'formatters': {
210 'verbose': {
211 'format': '%(asctime)s %(name)s %(levelname)s %(message)s',
214 'filters': {
215 'require_debug_false': {
216 '()': 'django.utils.log.RequireDebugFalse'
219 'handlers': {
220 'console':{
221 'level': 'DEBUG',
222 'class': 'logging.StreamHandler',
223 'formatter': 'verbose'
225 'mail_admins': {
226 'level': 'ERROR',
227 'filters': ['require_debug_false'],
228 'class': 'django.utils.log.AdminEmailHandler'
231 'loggers': {
232 'django': {
233 'handlers': ['console'],
234 'propagate': True,
235 'level': 'WARN',
237 'mygpo': {
238 'handlers': ['console'],
239 'level': 'INFO',
241 'celery': {
242 'handlers': ['console'],
243 'level': 'DEBUG',
248 # minimum number of subscribers a podcast must have to be assigned a slug
249 PODCAST_SLUG_SUBSCRIBER_LIMIT = 10
251 # minimum number of subscribers that a podcast needs to "push" one of its
252 # categories to the top
253 MIN_SUBSCRIBERS_CATEGORY=10
255 # maximum number of episode actions that the API processes immediatelly before
256 # returning the response. Larger requests will be handled in background.
257 # Handler can be set to None to disable
258 API_ACTIONS_MAX_NONBG=100
259 API_ACTIONS_BG_HANDLER='mygpo.api.tasks.episode_actions_celery_handler'
262 ADSENSE_CLIENT = ''
263 ADSENSE_SLOT_BOTTOM = ''
265 # enabled access to staff-only areas with ?staff=<STAFF_TOKEN>
266 STAFF_TOKEN = None
268 # Flattr settings -- available after you register your app
269 FLATTR_KEY = ''
270 FLATTR_SECRET = ''
272 # Flattr thing of the webservice. Will be flattr'd when a user sets the "Auto-Flattr gpodder.net" option
273 FLATTR_MYGPO_THING='https://flattr.com/submit/auto?user_id=stefankoegl&url=http://gpodder.net'
275 # The User-Agent string used for outgoing HTTP requests
276 USER_AGENT = 'gpodder.net (+https://github.com/gpodder/mygpo)'
278 # Base URL of the website that is used if the actually used parameters is not
279 # available. Request handlers, for example, can access the requested domain.
280 # Code that runs in background can not do this, and therefore requires a
281 # default value. This should be set to something like 'http://example.com'
282 DEFAULT_BASE_URL = ''
285 ### Celery
287 BROKER_URL='redis://localhost'
288 CELERY_RESULT_BACKEND='redis://localhost'
290 CELERY_SEND_TASK_ERROR_EMAILS = True,
291 ADMINS=ADMINS,
292 SERVER_EMAIL = "no-reply@example.com",
295 ### Google API
297 GOOGLE_CLIENT_ID=''
298 GOOGLE_CLIENT_SECRET=''
300 # URL where users of the site can get support
301 SUPPORT_URL=''
304 # Elasticsearch settings
306 ELASTICSEARCH_SERVER = os.getenv('ELASTICSEARCH_SERVER', '127.0.0.1:9200')
307 ELASTICSEARCH_INDEX = os.getenv('ELASTICSEARCH_INDEX', 'mygpo')
308 ELASTICSEARCH_TIMEOUT = float(os.getenv('ELASTICSEARCH_TIMEOUT', '2'))
310 # time for how long an activation is valid; after that, an unactivated user
311 # will be deleted
312 ACTIVATION_VALID_DAYS = int(os.getenv('ACTIVATION_VALID_DAYS', 10))
314 import sys
315 if 'test' in sys.argv:
316 SECRET_KEY = 'test'
319 INTERNAL_IPS = os.getenv('INTERNAL_IPS', '').split()
321 try:
322 from settings_prod import *
323 except ImportError, e:
324 import sys
325 print >> sys.stderr, 'create settings_prod.py with your customized settings'