<div dir="ltr">bump.<div>-brian</div><div>an intel employee</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Nov 4, 2016 at 5:30 AM, Michael Wood <span dir="ltr"><<a href="mailto:michael.g.wood@intel.com" target="_blank">michael.g.wood@intel.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 04/11/16 12:27, Michael Wood wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
From: brian avery <<a href="mailto:brian.avery@intel.com" target="_blank">brian.avery@intel.com</a>><br>
<br>
As of Django 1.8.16, Django is rejecting any HTTP_HOST header that is<br>
not on the ALLOWED_HOST list. We often need to reference the<br>
toaster server via a fqdn, if we start it via webport=<a href="http://0.0.0.0:8000" rel="noreferrer" target="_blank">0.0.0.0:8000</a> for<br>
instance, and are hitting the server from a laptop. This change does<br>
reduce the protection from a DNS rebinding attack, however, if you are<br>
running the toaster server outside a protected network, you should be<br>
using the production instance.<br>
<br>
[YOCTO #10578]<br>
<br>
Signed-off-by: brian avery <<a href="mailto:brian.avery@intel.com" target="_blank">brian.avery@intel.com</a>><br>
Signed-off-by: Michael Wood <<a href="mailto:michael.g.wood@intel.com" target="_blank">michael.g.wood@intel.com</a>><br>
---<br>
lib/toaster/toastermain/settin<wbr>gs.py | 16 +++++++++++++---<br>
1 file changed, 13 insertions(+), 3 deletions(-)<br>
<br>
diff --git a/lib/toaster/toastermain/sett<wbr>ings.py b/lib/toaster/toastermain/sett<wbr>ings.py<br>
index 3dfa2b2..aec9dbb 100644<br>
--- a/lib/toaster/toastermain/sett<wbr>ings.py<br>
+++ b/lib/toaster/toastermain/sett<wbr>ings.py<br>
@@ -60,9 +60,19 @@ DATABASES = {<br>
if 'sqlite' in DATABASES['default']['ENGINE']<wbr>:<br>
DATABASES['default']['OPTIONS'<wbr>] = { 'timeout': 20 }<br>
-# Hosts/domain names that are valid for this site; required if DEBUG is False<br>
-# See <a href="https://docs.djangoproject.com/en/1.5/ref/settings/#allowed-hosts" rel="noreferrer" target="_blank">https://docs.djangoproject.com<wbr>/en/1.5/ref/settings/#allowed-<wbr>hosts</a><br>
-ALLOWED_HOSTS = []<br>
+# Update as of django 1.8.16 release, the '*' is needed to allow us to connect while running<br>
+# on hosts without explicitly setting the fqdn for the toaster server.<br>
+# See <a href="https://docs.djangoproject.com/en/dev/ref/settings/" rel="noreferrer" target="_blank">https://docs.djangoproject.com<wbr>/en/dev/ref/settings/</a> for info on ALLOWED_HOSTS<br>
+# Previously this setting was not enforced if DEBUG was set but it is now.<br>
+# The previous behavior was such that ALLOWED_HOSTS defaulted to ['localhost','127.0.0.1','::1'<wbr>]<br>
+# and if you bound to <a href="http://0.0.0.0" rel="noreferrer" target="_blank">0.0.0.0</a>:<port #> then accessing toaster as localhost or fqdn would both work.<br>
+# To have that same behavior, with a fqdn explicitly enabled you would set<br>
+# ALLOWED_HOSTS= ['localhost','127.0.0.1','::1'<wbr>,'<a href="http://myserver.mycompany.com" rel="noreferrer" target="_blank">myserver.mycompany.com</a>'] for<br>
+# Django >= 1.8.16. By default, we are not enforcing this restriction in<br>
+# DEBUG mode.<br>
+if DEBUG is True:<br>
+ # this will allow connection via localhost,hostname, or fqdn<br>
+ ALLOWED_HOSTS = ['*']<br>
# Local time zone for this installation. Choices can be found here:<br>
# <a href="http://en.wikipedia.org/wiki/List_of_tz_zones_by_name" rel="noreferrer" target="_blank">http://en.wikipedia.org/wiki/L<wbr>ist_of_tz_zones_by_name</a><br>
</blockquote>
<br></div></div>
Should also say that this is needed for backport because the requirements for django was effectively also added as a backported to the version we are currently using i.e Django>1.8,<1.9<br>
<br>
More info in Brian's cover letter on the toaster mailing list.<br>
<br>
<a href="https://lists.yoctoproject.org/pipermail/toaster/2016-November/005300.html" rel="noreferrer" target="_blank">https://lists.yoctoproject.org<wbr>/pipermail/toaster/2016-Novemb<wbr>er/005300.html</a><span class="HOEnZb"><font color="#888888"><br>
<br>
Michael</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
-- <br>
______________________________<wbr>_________________<br>
bitbake-devel mailing list<br>
<a href="mailto:bitbake-devel@lists.openembedded.org" target="_blank">bitbake-devel@lists.openembedd<wbr>ed.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/bitbake-devel" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/bitbake-devel</a><br>
</div></div></blockquote></div><br></div>