allow only AJAX requests for post votes, otherwise it makes CSRF possible

[osqa.git] / settings.py

diff --git a/settings.py b/settings.py
index 0db3f3b9ba2759b333d9c262fcb1d88c4678a99f..cd153f4aef101e455ca63fb81d41bd4fe7a528b1 100644 (file)
--- a/settings.py
+++ b/settings.py
@@ -7,14 +7,12 @@ SITE_ID = 1
 ADMIN_MEDIA_PREFIX = '/admin_media/'
 SECRET_KEY = '$oo^&_m&qwbib=(_4m_n*zn-d=g#s0he5fx9xonnym#8p6yigm'
 
-TEMPLATE_LOADERS = [
-    'django.template.loaders.filesystem.load_template_source',
-    'django.template.loaders.app_directories.load_template_source',
-    'forum.modules.template_loader.module_templates_loader',
-    'forum.skins.load_template_source',
-]
+CACHE_MAX_KEY_LENGTH = 235
 
 MIDDLEWARE_CLASSES = [
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.middleware.csrf.CsrfResponseMiddleware',
+    'forum.middleware.django_cookies.CookiePreHandlerMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'django.middleware.common.CommonMiddleware',
     'forum.middleware.extended_user.ExtendedUser',
@@ -22,7 +20,9 @@ MIDDLEWARE_CLASSES = [
     'forum.middleware.request_utils.RequestUtils',
     'forum.middleware.cancel.CancelActionMiddleware',
     'forum.middleware.admin_messages.AdminMessagesMiddleware',
+    'forum.middleware.custom_pages.CustomPagesFallbackMiddleware',
     'django.middleware.transaction.TransactionMiddleware',
+    'forum.middleware.django_cookies.CookiePostHandlerMiddleware',
 ]
 
 TEMPLATE_CONTEXT_PROCESSORS = [
@@ -51,6 +51,23 @@ ALLOW_MAX_FILE_SIZE = 1024 * 1024
 # User settings
 from settings_local import *
 
+if DEBUG:
+    TEMPLATE_LOADERS = [
+        'django.template.loaders.filesystem.load_template_source',
+        'django.template.loaders.app_directories.load_template_source',
+        'forum.modules.template_loader.module_templates_loader',
+        'forum.skins.load_template_source',
+    ]
+else:
+    TEMPLATE_LOADERS = [
+        ('django.template.loaders.cached.Loader',(
+            'django.template.loaders.filesystem.load_template_source',
+            'django.template.loaders.app_directories.load_template_source',
+            'forum.modules.template_loader.module_templates_loader',
+            'forum.skins.load_template_source',
+            )),
+    ]
+
 try:
     if len(FORUM_SCRIPT_ALIAS) > 0:
         APP_URL = '%s/%s' % (APP_URL, FORUM_SCRIPT_ALIAS[:-1])
@@ -71,16 +88,25 @@ for path in app_url_split[1].split('/')[1:]:
 if FORCE_SCRIPT_NAME.endswith('/'):
     FORCE_SCRIPT_NAME = FORCE_SCRIPT_NAME[:-1]
 
-from forum import modules
-modules.init_modules_engine(SITE_SRC_ROOT, DISABLED_MODULES)
+#Module system initialization
+MODULES_PACKAGE = 'forum_modules'
+MODULES_FOLDER = os.path.join(SITE_SRC_ROOT, MODULES_PACKAGE)
+
+MODULE_LIST = filter(lambda m: getattr(m, 'CAN_USE', True), [
+        __import__('forum_modules.%s' % f, globals(), locals(), ['forum_modules'])
+        for f in os.listdir(MODULES_FOLDER)
+        if os.path.isdir(os.path.join(MODULES_FOLDER, f)) and
+           os.path.exists(os.path.join(MODULES_FOLDER, "%s/__init__.py" % f)) and
+           not f in DISABLED_MODULES
+])
 
 [MIDDLEWARE_CLASSES.extend(
         ["%s.%s" % (m.__name__, mc) for mc in getattr(m, 'MIDDLEWARE_CLASSES', [])]
-                          ) for m in modules.MODULE_LIST]
+                          ) for m in MODULE_LIST]
 
 [TEMPLATE_LOADERS.extend(
         ["%s.%s" % (m.__name__, tl) for tl in getattr(m, 'TEMPLATE_LOADERS', [])]
-                          ) for m in modules.MODULE_LIST]
+                          ) for m in MODULE_LIST]
 
 
 INSTALLED_APPS = [
@@ -109,6 +135,13 @@ try:
 except:
     pass
 
+# Try loading Gunicorn web server
+try:
+    import gunicorn
+    INSTALLED_APPS.append('gunicorn')
+except ImportError:
+    pass
+
 if not DEBUG:
     try:
         import rosetta