diff --git a/boofilsic/settings.py b/boofilsic/settings.py index ece449b8..1c44d33b 100644 --- a/boofilsic/settings.py +++ b/boofilsic/settings.py @@ -41,6 +41,7 @@ env = environ.FileAwareEnv( # when True: user will not be able to register unless with invite token # (generated by `neodb-manage invite --create`) NEODB_INVITE_ONLY=(bool, False), + NEODB_ENABLE_LOCAL_ONLY=(bool, False), # Mastodon/Pleroma instance allowed to login, keep empty to allow any instance to login NEODB_LOGIN_MASTODON_WHITELIST=(list, []), # DATABASE @@ -91,7 +92,6 @@ env = environ.FileAwareEnv( SSL_ONLY=(bool, False), NEODB_SENTRY_DSN=(str, ""), NEODB_FANOUT_LIMIT_DAYS=(int, 9), - NEODB_FORCE_CLASSIC_REPOST=(bool, False), ) # ====== End of user configuration variables ====== @@ -196,6 +196,8 @@ REDIRECT_URIS = env( # for sites migrated from previous version, either wipe mastodon client ids or use: # REDIRECT_URIS = f'{SITE_INFO["site_url"]}/users/OAuth2_login/' +ENABLE_LOCAL_ONLY = env("NEODB_ENABLE_LOCAL_ONLY") + # Timeout of requests to Mastodon, in seconds MASTODON_TIMEOUT = env("NEODB_LOGIN_MASTODON_TIMEOUT", default=10) # type: ignore TAKAHE_REMOTE_TIMEOUT = MASTODON_TIMEOUT @@ -237,7 +239,6 @@ DOWNLOADER_RETRIES = env("NEODB_DOWNLOADER_RETRIES") DISABLE_CRON = env("NEODB_DISABLE_CRON") FANOUT_LIMIT_DAYS = env("NEODB_FANOUT_LIMIT_DAYS") -FORCE_CLASSIC_REPOST = env("NEODB_FORCE_CLASSIC_REPOST") # ====== USER CONFIGUTRATION END ====== DATABASE_ROUTERS = ["takahe.db_routes.TakaheRouter"] @@ -416,6 +417,8 @@ SILENCED_SYSTEM_CHECKS = [ "fields.W344", # Required by takahe: identical table name in different database ] +TAKAHE_SESSION_COOKIE_NAME = "sessionid" + MEDIA_URL = "/m/" MEDIA_ROOT = env("NEODB_MEDIA_ROOT", default=os.path.join(BASE_DIR, "media")) # type: ignore diff --git a/takahe/views.py b/takahe/views.py index 3d07909f..31e3503f 100644 --- a/takahe/views.py +++ b/takahe/views.py @@ -11,15 +11,15 @@ from loguru import logger from .models import TakaheSession from .utils import Takahe -_TAKAHE_SESSION_COOKIE_NAME = "sessionid" - @login_required def auth_login(request): """Redirect to the login page if not yet, otherwise sync login info to takahe session""" Takahe.sync_password(request.user) # if SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies" in Takahe - session = SessionStore(session_key=request.COOKIES.get(_TAKAHE_SESSION_COOKIE_NAME)) + session = SessionStore( + session_key=request.COOKIES.get(settings.TAKAHE_SESSION_COOKIE_NAME) + ) session._session_cache = request.session._session # type: ignore session["_auth_user_backend"] = "django.contrib.auth.backends.ModelBackend" session_key: str = session._get_session_key() # type: ignore @@ -46,7 +46,7 @@ def auth_login(request): expires_time = time.time() + max_age expires = http_date(expires_time) response.set_cookie( - _TAKAHE_SESSION_COOKIE_NAME, + settings.TAKAHE_SESSION_COOKIE_NAME, session_key, max_age=max_age, expires=expires, @@ -61,5 +61,5 @@ def auth_login(request): def auth_logout(request: HttpRequest): response = redirect("/account/logout") - response.delete_cookie(_TAKAHE_SESSION_COOKIE_NAME) + response.delete_cookie(settings.TAKAHE_SESSION_COOKIE_NAME) return response diff --git a/users/account.py b/users/account.py index df27ceba..e4d0d22b 100644 --- a/users/account.py +++ b/users/account.py @@ -211,7 +211,9 @@ def register_new_user(request, **param): new_user = User.register(**param) request.session["new_user"] = True auth_login(request, new_user) - return redirect(reverse("users:register")) + response = redirect(reverse("users:register")) + response.delete_cookie(settings.TAKAHE_SESSION_COOKIE_NAME) + return response def login_existing_user(request, existing_user): @@ -223,6 +225,7 @@ def login_existing_user(request, existing_user): del request.session["next_url"] else: response = redirect(reverse("common:home")) + response.delete_cookie(settings.TAKAHE_SESSION_COOKIE_NAME) return response @@ -232,7 +235,9 @@ def logout(request): if request.method == "GET": # revoke_token(request.user.mastodon_site, request.user.mastodon_token) auth_logout(request) - return redirect(reverse("users:login")) + response = redirect(reverse("users:login")) + response.delete_cookie(settings.TAKAHE_SESSION_COOKIE_NAME) + return response else: raise BadRequest()