From ae9b341ecfcc60e970f29cfe04306411ad26c0cf Mon Sep 17 00:00:00 2001 From: brian avery Date: Wed, 23 Nov 2016 10:55:20 -0800 Subject: bitbake: bitbake: toaster: settings set ALLOWED_HOSTS to * in debug mode This is a backport of 7c3a47ed8965c3a3eb90a9a4678d5caedbba6337 >From the commit to master: As of Django 1.8.16, Django is rejecting any HTTP_HOST header that is not on the ALLOWED_HOST list. We often need to reference the toaster server via a fqdn, if we start it via webport=0.0.0.0:8000 for instance, and are hitting the server from a laptop. This change does reduce the protection from a DNS rebinding attack, however, if you are running the toaster server outside a protected network, you should be using the production instance. [YOCTO #10586] (Bitbake rev: 449dc9b955dfbe048e380f5ab9fd61c3d1489dad) Signed-off-by: brian avery Signed-off-by: Richard Purdie --- bitbake/lib/toaster/toastermain/settings.py | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/bitbake/lib/toaster/toastermain/settings.py b/bitbake/lib/toaster/toastermain/settings.py index 74ab60462b..6572acc696 100644 --- a/bitbake/lib/toaster/toastermain/settings.py +++ b/bitbake/lib/toaster/toastermain/settings.py @@ -107,9 +107,19 @@ def getDATABASE_URL(): -# Hosts/domain names that are valid for this site; required if DEBUG is False -# See https://docs.djangoproject.com/en/1.5/ref/settings/#allowed-hosts -ALLOWED_HOSTS = [] +# Update as of django 1.8.16 release, the '*' is needed to allow us to connect while running +# on hosts without explicitly setting the fqdn for the toaster server. +# See https://docs.djangoproject.com/en/dev/ref/settings/ for info on ALLOWED_HOSTS +# Previously this setting was not enforced if DEBUG was set but it is now. +# The previous behavior was such that ALLOWED_HOSTS defaulted to ['localhost','127.0.0.1','::1'] +# and if you bound to 0.0.0.0: then accessing toaster as localhost or fqdn would both work. +# To have that same behavior, with a fqdn explicitly enabled you would set +# ALLOWED_HOSTS= ['localhost','127.0.0.1','::1','myserver.mycompany.com'] for +# Django >= 1.8.16. By default, we are not enforcing this restriction in +# DEBUG mode. +if DEBUG is True: + # this will allow connection via localhost,hostname, or fqdn + ALLOWED_HOSTS = ['*'] # Local time zone for this installation. Choices can be found here: # http://en.wikipedia.org/wiki/List_of_tz_zones_by_name -- cgit v1.2.3-54-g00ecf