Browse Source

[desktop] Allow the SECRET_KEY to be generated from a script

Erick Tryzelaar 10 years ago
parent
commit
d48608cbff

+ 4 - 0
desktop/conf.dist/hue.ini

@@ -20,6 +20,10 @@
   # This is used for secure hashing in the session store.
   # This is used for secure hashing in the session store.
   secret_key=
   secret_key=
 
 
+  # Execute this script to produce the Django secret key. This will be used when
+  # `secret_key` is not set.
+  ## secret_key_script=
+
   # Webserver listens on this address and port
   # Webserver listens on this address and port
   http_host=0.0.0.0
   http_host=0.0.0.0
   http_port=8888
   http_port=8888

+ 4 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -26,6 +26,10 @@
   # This is used for secure hashing in the session store.
   # This is used for secure hashing in the session store.
   secret_key=
   secret_key=
 
 
+  # Execute this script to produce the Django secret key. This will be used when
+  # `secret_key` is not set.
+  ## secret_key_script=
+
   # Webserver listens on this address and port
   # Webserver listens on this address and port
   http_host=0.0.0.0
   http_host=0.0.0.0
   http_port=8000
   http_port=8000

+ 15 - 0
desktop/core/src/desktop/conf.py

@@ -142,6 +142,13 @@ SECRET_KEY = Config(
   help=_("Used in hashing algorithms for sessions."),
   help=_("Used in hashing algorithms for sessions."),
   default="")
   default="")
 
 
+SECRET_KEY_SCRIPT = Config(
+  key="secret_key_script",
+  help=_("Execute this script to produce the Django secret key. This will be used when `secret_key` is not set."),
+  type=coerce_password_from_script,
+  private=True,
+  default=None)
+
 USER_ACCESS_HISTORY_SIZE = Config(
 USER_ACCESS_HISTORY_SIZE = Config(
   key="user_access_history_size",
   key="user_access_history_size",
   help=_("Number of user access to remember per view per user."),
   help=_("Number of user access to remember per view per user."),
@@ -987,6 +994,14 @@ def get_redaction_policy():
   return LOG_REDACTION_FILE.get()
   return LOG_REDACTION_FILE.get()
 
 
 
 
+def get_secret_key():
+  secret_key = SECRET_KEY.get()
+  if secret_key is None:
+    secret_key = SECRET_KEY_SCRIPT.get()
+
+  return secret_key
+
+
 def get_ssl_password():
 def get_ssl_password():
   password = SSL_PASSWORD.get()
   password = SSL_PASSWORD.get()
   if password is None:
   if password is None:

+ 1 - 1
desktop/core/src/desktop/settings.py

@@ -339,7 +339,7 @@ EMAIL_USE_TLS = desktop.conf.SMTP.USE_TLS.get()
 DEFAULT_FROM_EMAIL = desktop.conf.SMTP.DEFAULT_FROM.get()
 DEFAULT_FROM_EMAIL = desktop.conf.SMTP.DEFAULT_FROM.get()
 
 
 # Used for securely creating sessions. Should be unique and not shared with anybody. Changing auth backends will invalidate all open sessions.
 # Used for securely creating sessions. Should be unique and not shared with anybody. Changing auth backends will invalidate all open sessions.
-SECRET_KEY = desktop.conf.SECRET_KEY.get() + str(AUTHENTICATION_BACKENDS)
+SECRET_KEY = desktop.conf.get_secret_key() + str(AUTHENTICATION_BACKENDS)
 if SECRET_KEY == "":
 if SECRET_KEY == "":
   import uuid
   import uuid
   SECRET_KEY = str(uuid.uuid4())
   SECRET_KEY = str(uuid.uuid4())

+ 18 - 0
desktop/core/src/desktop/tests.py

@@ -727,6 +727,24 @@ class BaseTestPasswordConfig(object):
         reset()
         reset()
 
 
 
 
+class TestSecretKeyConfig(BaseTestPasswordConfig):
+
+  def get_config_password(self):
+    return desktop.conf.SECRET_KEY
+
+  def get_config_password_script(self):
+    return desktop.conf.SECRET_KEY_SCRIPT
+
+  def get_password(self):
+    return desktop.conf.get_secret_key()
+
+  def test_read_password_from_script(self):
+    self.run_test_read_password_from_script()
+
+  def test_config_password_overrides_script_password(self):
+    self.run_test_config_password_overrides_script_password()
+
+
 class TestDatabasePasswordConfig(BaseTestPasswordConfig):
 class TestDatabasePasswordConfig(BaseTestPasswordConfig):
 
 
   def get_config_password(self):
   def get_config_password(self):