stephenmcd/mezzanine

Mezzanine dynamic settings overwriting new ALLOWED_HOSTS behaviour

Aberta

#1.714 aberto em 21 de dez. de 2016

 (1 comentário) (0 reação) (0 responsável)Python (1.648 forks)batch import
bughelp wanted

Métricas do repositório

Stars
 (4.686 estrelas)
Métricas de merge de PR
 (Nenhuma PRs mesclada em 30d)

Description

Hello,

Since Django 1.9.11 and 1.10.3, ALLOWED_HOSTS is now checked in debug environment too, with the convenient behaviour of interpreting [] (or any false value) to the usual localhost environment.

But Mezzanine dynamic settings in turn replace the [] I explicitly set in my local settings to SitesAllowedHosts().

The warning message says You haven't defined the ALLOWED_HOSTS settings which is not really correct when [] has a meaning.

I ran into this because I imported a production database dump and I opened http://localhost:8000 but the database contains a Site with the production URL.

I could fix this with:

diff --git a/mezzanine/utils/conf.py b/mezzanine/utils/conf.py
index 402309ef..f0fd35ec 100644
--- a/mezzanine/utils/conf.py
+++ b/mezzanine/utils/conf.py
@@ -57,7 +57,7 @@ def set_dynamic_settings(s):
                             and s['MIDDLEWARE'] is not None \
                             else 'MIDDLEWARE_CLASSES'
 
-    if not s.get("ALLOWED_HOSTS", []):
+    if s.get("ALLOWED_HOSTS") is None:
         warn("You haven't defined the ALLOWED_HOSTS settings, which "
              "Django requires. Will fall back to the domains "
              "configured as sites.")

But the warning would never appear because the default settings already set ALLOWED_HOSTS to a not-None value: https://github.com/stephenmcd/mezzanine/blob/master/mezzanine/project_template/project_name/settings.py#L95

What should we do about it? Completely remove ALLOWED_HOSTS from settings.py because it should only be set in local_settings.py? Explicitly setting ALLOWED_HOSTS = SitesAllowedHosts() in the project template?

Guia do colaborador