mirror of
https://git.linux-kernel.at/oliver/ivatar.git
synced 2025-11-14 04:04:03 +00:00
d37ae1456c
- Add comprehensive file validation with magic bytes, MIME type, and PIL checks - Implement malicious content detection and polyglot attack prevention - Add EXIF data sanitization to prevent metadata leaks - Enhance UploadPhotoForm with security validation - Add security logging for audit trails - Include comprehensive test suite for security features - Add python-magic dependency for MIME type detection - Update configuration with security settings - Add detailed documentation for file upload security Security features: - File type validation (magic bytes + MIME type) - Content security scanning (malware detection) - EXIF data sanitization (privacy protection) - Enhanced logging (security event tracking) - Comprehensive test coverage Removed rate limiting as requested for better user experience.
47 lines
1.3 KiB
Plaintext
47 lines
1.3 KiB
Plaintext
# -*- coding: utf-8 -*-
|
|
"""
|
|
Example local configuration file for ivatar
|
|
Copy this to config_local.py and customize for your environment
|
|
"""
|
|
|
|
import os
|
|
|
|
# Override logs directory for production deployments
|
|
# LOGS_DIR = "/var/log/ivatar"
|
|
|
|
# Override logs directory for development with custom location
|
|
# LOGS_DIR = os.path.join(os.path.expanduser("~"), "ivatar_logs")
|
|
|
|
# File upload security settings
|
|
# ENABLE_FILE_SECURITY_VALIDATION = True
|
|
# ENABLE_EXIF_SANITIZATION = True
|
|
# ENABLE_MALICIOUS_CONTENT_SCAN = True
|
|
|
|
# Example production overrides:
|
|
# DEBUG = False
|
|
# SECRET_KEY = "your-production-secret-key-here"
|
|
# ALLOWED_HOSTS = ["yourdomain.com", "www.yourdomain.com"]
|
|
|
|
# Database configuration (if not using environment variables)
|
|
# DATABASES = {
|
|
# 'default': {
|
|
# 'ENGINE': 'django.db.backends.postgresql',
|
|
# 'NAME': 'ivatar_prod',
|
|
# 'USER': 'ivatar_user',
|
|
# 'PASSWORD': 'your-db-password',
|
|
# 'HOST': 'localhost',
|
|
# 'PORT': '5432',
|
|
# }
|
|
# }
|
|
|
|
# Email configuration
|
|
# EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
|
|
# EMAIL_HOST = 'smtp.yourdomain.com'
|
|
# EMAIL_PORT = 587
|
|
# EMAIL_USE_TLS = True
|
|
# EMAIL_HOST_USER = 'noreply@yourdomain.com'
|
|
# EMAIL_HOST_PASSWORD = 'your-email-password'
|
|
|
|
# Example: Override logs directory for production
|
|
# LOGS_DIR = "/var/log/ivatar"
|