From 780303f780a64f35f06b51327dd1c0e13857175b Mon Sep 17 00:00:00 2001 From: Spitap Date: Wed, 19 Jul 2023 11:23:52 +0200 Subject: [PATCH] Changed how secret key is generated on deploy --- modoboa/core/commands/deploy.py | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/modoboa/core/commands/deploy.py b/modoboa/core/commands/deploy.py index dc6e1b8b3..7c5a760da 100644 --- a/modoboa/core/commands/deploy.py +++ b/modoboa/core/commands/deploy.py @@ -3,7 +3,9 @@ import getpass import os from os.path import isfile +import secrets import shutil +import string import subprocess import sys @@ -81,6 +83,10 @@ class DeployCommand(Command): "--admin-username", default="admin", help="Username of the initial super administrator" ) + self._parser.add_argument( + "--secret-key-length", default=60, type=int, + help="Specify the length of the secret key" + ) def _exec_django_command(self, name, cwd, *args): """Run a django command for the freshly created project @@ -156,6 +162,14 @@ class DeployCommand(Command): official_exts = ModoAPIClient(url).list_extensions() return [extension["name"] for extension in official_exts] + def _generate_secret_key(self, secret_key_length): + """Generate a secret key since the one generated by django + is marked as insecure. + """ + c = string.ascii_letters + string.digits + string.punctuation + secret_key = ''.join(secrets.choice(c) for i in range(secret_key_length)) + return secret_key + def find_extra_settings(self, extensions): """Install one or more extensions. @@ -233,7 +247,7 @@ class DeployCommand(Command): tpl = self._render_template( "%s/settings.py.tpl" % self._templates_dir, { "db_connections": connections, - "secret_key": mod.settings.SECRET_KEY, + "secret_key": _generate_secret_key(parsed_args.secret_key_length), "name": parsed_args.name, "allowed_host": allowed_host, "lang": parsed_args.lang,