Merge branch 'harden' into 'beta'

Harden Django project configuration

See merge request bde/nk20!194

apps/api/serializers.py

@@ -60,12 +60,12 @@ class OAuthSerializer(serializers.ModelSerializer):
     def get_profile(self, obj):
         # Display the profile of the user only if we have rights to see it.
         return ProfileSerializer().to_representation(obj.profile) \
-            if PermissionBackend.has_perm(get_current_request(), obj.profile, 'view') else None
+            if PermissionBackend.check_perm(get_current_request(), 'member.view_profile', obj.profile) else None
 
     def get_note(self, obj):
         # Display the note of the user only if we have rights to see it.
         return NoteSerializer().to_representation(obj.note) \
-            if PermissionBackend.has_perm(get_current_request(), obj.note, 'view') else None
+            if PermissionBackend.check_perm(get_current_request(), 'note.view_note', obj.note) else None
 
     def get_memberships(self, obj):
         # Display only memberships that we are allowed to see.

apps/permission/fixtures/initial.json

@@ -2903,6 +2903,70 @@
 			"description": "(Dé)bloquer la note de son club et indiquer que cela a été fait manuellement"
 		}
 	},
+	{
+		"model": "permission.permission",
+		"pk": 186,
+		"fields": {
+			"model": [
+				"oauth2_provider",
+				"application"
+			],
+			"query": "{\"user\": [\"user\"]}",
+			"type": "view",
+			"mask": 1,
+			"field": "",
+			"permanent": true,
+			"description": "Voir ses applications OAuth2"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 187,
+		"fields": {
+			"model": [
+				"oauth2_provider",
+				"application"
+			],
+			"query": "{\"user\": [\"user\"]}",
+			"type": "create",
+			"mask": 1,
+			"field": "",
+			"permanent": true,
+			"description": "Créer une application OAuth2"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 188,
+		"fields": {
+			"model": [
+				"oauth2_provider",
+				"application"
+			],
+			"query": "{\"user\": [\"user\"]}",
+			"type": "change",
+			"mask": 1,
+			"field": "",
+			"permanent": true,
+			"description": "Modifier une application OAuth2"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 189,
+		"fields": {
+			"model": [
+				"oauth2_provider",
+				"application"
+			],
+			"query": "{\"user\": [\"user\"]}",
+			"type": "delete",
+			"mask": 1,
+			"field": "",
+			"permanent": true,
+			"description": "Supprimer une application OAuth2"
+		}
+	},
 	{
 		"model": "permission.role",
 		"pk": 1,
@@ -2933,7 +2997,11 @@
 				126,
 				161,
 				162,
-				165
+				165,
+				186,
+				187,
+				188,
+				189
 			]
 		}
 	},
@@ -3314,7 +3382,11 @@
 				182,
 				183,
 				184,
-				185
+				185,
+				186,
+				187,
+				188,
+				189
 			]
 		}
 	},

note_kfet/settings/base.py

@@ -24,6 +24,15 @@ ALLOWED_HOSTS = [
     os.getenv('NOTE_URL', 'localhost'),
 ]
 
+# Use secure cookies in production
+SESSION_COOKIE_SECURE = not DEBUG
+CSRF_COOKIE_SECURE = not DEBUG
+
+# Remember HTTPS for 1 year
+SECURE_HSTS_SECONDS = 31536000
+SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+SECURE_HSTS_PRELOAD = True
+
 
 # Application definition