Skip to content

Commit 784f3dd

Browse files
davegaeddertdavegaeddert
committed
Working on csp and nonce support
1 parent a0fd8f1 commit 784f3dd

File tree

31 files changed

+508
-207
lines changed

31 files changed

+508
-207
lines changed

‎example/app/settings.py‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,27 @@
2727
"app.users",
2828
]
2929

30+
31+
def DEFAULT_RESPONSE_HEADERS(request):
32+
"""
33+
Strict CSP policy for testing CSP nonce support.
34+
"""
35+
nonce = request.csp_nonce
36+
return {
37+
"Content-Security-Policy": (
38+
f"default-src 'self'; "
39+
f"script-src 'self' 'nonce-{nonce}'; "
40+
f"style-src 'self' 'nonce-{nonce}'; "
41+
f"img-src 'self' data: https://www.gravatar.com; "
42+
f"font-src 'self'; "
43+
f"connect-src 'self'; "
44+
f"frame-ancestors 'self'; "
45+
f"base-uri 'self'; "
46+
f"form-action 'self'"
47+
),
48+
}
49+
50+
3051
EMAIL_BACKEND = "plain.email.backends.console.EmailBackend"
3152
EMAIL_DEFAULT_FROM = "from@example.com"
3253
SUPPORT_EMAIL = "support@example.com"

‎example/app/templates/base.html‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<title>{% block title %}Example App{% endblock %}</title>
7+
{% tailwind_css %}
8+
</head>
9+
<body>
10+
{% block content required %}{% endblock %}
11+
12+
{% toolbar %}
13+
</body>
14+
</html>

‎example/app/templates/index.html‎

Lines changed: 6 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,7 @@
1-
<!DOCTYPE html>
2-
<html lang="en">
3-
<head>
4-
<meta charset="UTF-8">
5-
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6-
<title>Document</title>
7-
{% tailwind_css %}
8-
</head>
9-
<body>
10-
Hey!
1+
{% extends "base.html" %}
112

12-
{% toolbar %}
13-
</body>
14-
</html>
3+
{% block content %}
4+
<div class="p-8">
5+
Hey!
6+
</div>
7+
{% endblock %}

‎example/app/templates/login.html‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{% extends "base.html" %}
2+
3+
{% block title %}Login{% endblock %}
4+
5+
{% block content %}
6+
<div class="p-8">
7+
<div class="max-w-md mx-auto">
8+
<h1 class="text-2xl font-bold mb-4">Login</h1>
9+
10+
<form method="post" class="flex flex-col">
11+
{% for error in form.non_field_errors %}
12+
<div class="text-red-500 border-red-500 border rounded-md p-2 mb-4">{{ error }}</div>
13+
{% endfor %}
14+
15+
<label class="text-sm mb-1" for="{{ form.email.html_id }}">Email</label>
16+
<input
17+
class="border border-gray-300 rounded-md px-3 py-2 mb-4"
18+
type="email"
19+
name="{{ form.email.html_name }}"
20+
id="{{ form.email.html_id }}"
21+
value="{{ form.email.value() or '' }}"
22+
autocomplete="email"
23+
autofocus
24+
required>
25+
26+
<label class="text-sm mb-1" for="{{ form.password.html_id }}">Password</label>
27+
<input
28+
class="border border-gray-300 rounded-md px-3 py-2 mb-4"
29+
type="password"
30+
name="{{ form.password.html_name }}"
31+
id="{{ form.password.html_id }}"
32+
autocomplete="current-password"
33+
required>
34+
35+
<button type="submit" class="bg-blue-500 hover:bg-blue-700 text-white font-bold py-2 px-4 rounded">
36+
Login
37+
</button>
38+
</form>
39+
</div>
40+
</div>
41+
{% endblock %}

‎example/app/urls.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99

1010
class LoginView(PasswordLoginView):
11-
pass
11+
template_name = "login.html"
1212

1313

1414
class IndexView(TemplateView):

‎example/pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
[project]
2-
name = "plain-demo-full"
2+
name = "example"
33
version = "0.0.0"
44
requires-python = ">=3.13"
55
dependencies = [

‎plain-admin/plain/admin/assets/admin/vendor/tippy-bundle.umd.min.js‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎plain-admin/plain/admin/assets/admin/vendor/tippy.css‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎plain-admin/plain/admin/assets/admin/vendor/tippy.umd.min.js‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎plain-admin/plain/admin/cards/base.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ def view_name(cls) -> str:
4444
def get_template_context(self) -> dict[str, Any]:
4545
context = {}
4646

47+
context["request"] = self.request
4748
context["size"] = self.size
4849
context["title"] = self.get_title()
4950
context["slug"] = self.get_slug()

0 commit comments

Comments
 (0)