- Django 3.2 has a argon2 password hashing complexity unsuitable for single
board computers. Choose parameters suitable for Olimex Lime2 boards.
Tests:
- In a browser, login to a user without these changes. Notice the hash
parameters in sqlite3 auth_user table. Login with the changes. Notice that the
hash has been updated with latest has parameters.
- Login in Django 2.2 and Django 3.2. Login succeeds and hash parameters are
updated.
- As measured by the browser. Notice that change in login request time with and
without these changes
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
This is already the default (Django 3.2), however, setting it explicitly seems
to avoid a warning while running 'django-admin makemigrations'.
Tests:
- Add SECRET_KEY to settings.py temporarily. Run the command 'django-admin
makemigrations --pythonpath=. --settings=plinth.settings'. There should no
warnings related DEFAULT_AUTO_FIELD not being set.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Reduces the probability that plinth gives an error 500 because
the database is locked.
Test performed:
1) Lock the database:
> sqlite3 data/var/lib/plinth/plinth.sqlite3
sqlite> PRAGMA locking_mode = EXCLUSIVE;
sqlite> BEGIN EXCLUSIVE;
2) Visit plinth/apps/
3) Only after 30s plinth logs an exception:
django.db.utils.OperationalError: database is locked
Closes#1786
Related to #1443
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
[sunil: Move the timeout value to settings module as it is static]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Currently, sessions are created as files in /var/lib/plinth/sessions. If a user
does not logout, the sessions remains there ever after expiry. Cleanup these
accumulating files by running a cleanup job every week.
Adding django.contrib.sessions to apps list necessary to ensure that
'clearsessions' management command is available. This creates an empty database
table for session storage but is harmless.
Tests performed:
- When run with the change for first time, migration is run for
django.contrib.sessions app.
- Change the scheduled interval to 30 seconds in the code. Login as a user. A
new session file is created in data/var/lib/plinth/sessions. Forward the system
clock by at least 2 weeks. The session expires. Within 30 seconds the file is
also removed.
- Login, then remove the django-secret.key. In 30 seconds we see a message that
the session data is corrupt. Advance the clock by at least 2 weeks. The session
file is removed and the message about session data is no longer printed.
- Repeat for system level plinth after `./setup.py install` and `sudo -u plinth
plinth`.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
This allows for many cases of having to deal with Django objects such as models.
- Allows all modules including ones with models to be imported by Sphinx.
- Run most of the management commands using django-admin.
- Make it simpler to import all modules on REPL interactive Python shells.
Does not change any of the settings that we are passing to Django for
configuration.
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
