settings - DEBUG hardening

DEBUG is something that should never be turned in on prod.  As such,
lets be extremely specific on what we expect to process.

As we'll be taking this in from the environment, it's ensured we will
get a string.  So we'll always get and only handle this in string
form.  If it's anything else, it's an operational error and we bail.

(Note: bool('0') is truthy, so we make sure we leverge our string -> int
-> bool every time, so corectness can be noticed if it is not)
This commit is contained in:
Sachi King 2017-04-30 11:52:40 +10:00
parent 46b85fa778
commit bb573ebee4

View file

@ -13,7 +13,19 @@ BASE_DIR = PACKAGE_ROOT
### USER SETTINGS ### USER SETTINGS
DEBUG = True DEBUG = os.environ.get('SYMPOSION_APP_DEBUG', '0')
if isinstance(DEBUG, str):
try:
i = int(DEBUG)
if not i in [0, 1]:
raise ValueError("not 0 or 1")
DEBUG = bool(i)
except ValueError:
sys.exit('DEBUG env var must be set to string value of a 0 or 1')
else:
sys.exit('DEBUG env var is in unexpected format. Should be a string'
'containing either a 0 or a 1 - Got type %s' % type(DEBUG))
DATABASES = { DATABASES = {
"default": { "default": {
"ENGINE": "django.db.backends.sqlite3", "ENGINE": "django.db.backends.sqlite3",