add CSP & .env variables

Pipfile

@@ -6,7 +6,7 @@ name = "pypi"
 [packages]
 bs4 = "*"
 pandas = "*"
-openai = "*"
+openai = "==0.28.1"
 tiktoken = "*"
 python-decouple = "*"
 matplotlib = "*"
@@ -25,6 +25,7 @@ reportlab = "*"
 mock = "*"
 pypdf = {extras = ["crypto"], version = "*"}
 coverage = "*"
+django-csp = "*"
 
 [dev-packages]
 

core/settings.py

@@ -37,6 +37,7 @@
     "django.contrib.auth.middleware.AuthenticationMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "csp.middleware.CSPMiddleware",
     "django_htmx.middleware.HtmxMiddleware",
 ]
 
@@ -111,3 +112,59 @@
 
 
 DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+
+# django-csp headers:
+
+CSP_STYLE_SRC = (
+    "'self'",
+    "use.fontawesome.com",
+    "'unsafe-inline'",
+    )
+
+CSP_SCRIPT_SRC = ("'self'",
+     )
+
+CSP_IMG_SRC = ("'self'",
+    "data:",
+    "blob:",
+    )
+
+CSP_FONT_SRC = ("'self'",
+    "data:",
+    )
+
+CSP_CONNECT_SRC = ("'self'",)
+CSP_OBJECT_SRC = ("'none'", )
+CSP_BASE_URI = ("'self'", )
+CSP_FRAME_ANCESTORS = ("'self'" )
+CSP_FORM_ACTION = (
+    "'self'",
+    )
+CSP_INCLUDE_NONCE_IN = ('script-src', 'style-src' )
+CSP_MANIFEST_SRC = ("'self'", )
+CSP_WORKER_SRC = ("'self'", )
+CSP_MEDIA_SRC = ("'self'", )
+CSP_CONNECT_SRC = ("'self'",)
+CSP_DEFAULT_SRC = ("'none'",)
+
+
+# Security settings for production:
+
+SECURE_SSL_REDIRECT = config("SECURE_SSL_REDIRECT", default=True, cast=bool)
+SESSION_COOKIE_SECURE = config("SESSION_COOKIE_SECURE", default=True, cast=bool)
+CSRF_COOKIE_SECURE = config("CSRF_COOKIE_SECURE", default=True, cast=bool)
+
+SECURE_BROWSER_XSS_FILTER = config("SECURE_BROWSER_XSS_FILTER", default=True, cast=bool)
+SECURE_CONTENT_TYPE_NOSNIFF = config(
+    "SECURE_CONTENT_TYPE_NOSNIFF", default=True, cast=bool
+)
+
+SECURE_HSTS_SECONDS = config("SECURE_HSTS_SECONDS", default=15768000, cast=int)
+SECURE_HSTS_INCLUDE_SUBDOMAINS = config(
+    "SECURE_HSTS_INCLUDE_SUBDOMAINS", default=True, cast=bool
+)
+SECURE_HSTS_PRELOAD = config("SECURE_HSTS_PRELOAD", default=True, cast=bool)
+
+SECURE_REFERRER_POLICY = config(
+    "SECURE_REFERRER_POLICY", default="no-referrer-when-downgrade"
+)

requirements.txt

@@ -1,66 +1,67 @@
 -i https://pypi.org/simple
-aiohttp==3.8.5 ; python_version >= '3.6'
+aiohttp==3.9.1 ; python_version >= '3.8'
 aiosignal==1.3.1 ; python_version >= '3.7'
 asgiref==3.7.2 ; python_version >= '3.7'
-async-timeout==4.0.3 ; python_version >= '3.7'
+async-timeout==4.0.3 ; python_version < '3.11'
 attrs==23.1.0 ; python_version >= '3.7'
 beautifulsoup4==4.12.2 ; python_full_version >= '3.6.0'
 bs4==0.0.1
-certifi==2023.7.22 ; python_version >= '3.6'
-cffi==1.15.1
-charset-normalizer==3.2.0 ; python_full_version >= '3.7.0'
-contourpy==1.1.0 ; python_version >= '3.8'
-coverage==7.3.1
+certifi==2023.11.17 ; python_version >= '3.6'
+cffi==1.16.0 ; python_version >= '3.8'
+charset-normalizer==3.3.2 ; python_full_version >= '3.7.0'
+contourpy==1.2.0 ; python_version >= '3.9'
+coverage==7.3.2
 crispy-bootstrap5==0.7
-cryptography==41.0.3
-cycler==0.11.0 ; python_version >= '3.6'
+cryptography==41.0.7
+cycler==0.12.1 ; python_version >= '3.8'
 django==4.1
 django-cleanup==8.0.0
 django-crispy-forms==2.0
-django-htmx==1.16.0
-exceptiongroup==1.1.3 ; python_version < '3.11'
-fonttools==4.42.1 ; python_version >= '3.8'
+django-csp==3.7
+django-htmx==1.17.2
+exceptiongroup==1.2.0 ; python_version < '3.11'
+fonttools==4.46.0 ; python_version >= '3.8'
 frozenlist==1.4.0 ; python_version >= '3.8'
-idna==3.4 ; python_version >= '3.5'
-importlib-resources==6.0.1 ; python_version < '3.10'
+idna==3.6 ; python_version >= '3.5'
+importlib-resources==6.1.1 ; python_version < '3.10'
 iniconfig==2.0.0 ; python_version >= '3.7'
 joblib==1.3.2 ; python_version >= '3.7'
 kiwisolver==1.4.5 ; python_version >= '3.7'
-matplotlib==3.7.2
+matplotlib==3.8.2
 mock==5.1.0
 multidict==6.0.4 ; python_version >= '3.7'
-numpy==1.25.2 ; python_version >= '3.9'
-openai==0.28.0
-packaging==23.1 ; python_version >= '3.7'
-pandas==2.1.0
-pillow==10.0.0 ; python_version >= '3.8'
-plotly==5.16.1
+numpy==1.26.2 ; python_version >= '3.9'
+openai==0.28.1
+packaging==23.2 ; python_version >= '3.7'
+pandas==2.1.4
+pillow==10.1.0 ; python_version >= '3.8'
+plotly==5.18.0
 pluggy==1.3.0 ; python_version >= '3.8'
-pyarrow==13.0.0
+pyarrow==14.0.1
 pycparser==2.21
-pyparsing==3.0.9 ; python_full_version >= '3.6.8'
-pypdf[crypto]==3.15.5
-pytest==7.4.2
-pytest-django==4.5.2
+pyparsing==3.1.1 ; python_full_version >= '3.6.8'
+pypdf[crypto]==3.17.2
+pytest==7.4.3
+pytest-django==4.7.0
 python-dateutil==2.8.2 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'
 python-decouple==3.8
 pytz==2023.3.post1
-regex==2023.8.8 ; python_version >= '3.6'
-reportlab==4.0.4
+regex==2023.10.3 ; python_version >= '3.7'
+reportlab==4.0.7
 requests==2.31.0 ; python_version >= '3.7'
-scikit-learn==1.3.0
-scipy==1.11.2 ; python_version < '3.13' and python_version >= '3.9'
+scikit-learn==1.3.2
+scipy==1.11.4 ; python_version >= '3.9'
 six==1.16.0 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'
 soupsieve==2.5 ; python_version >= '3.8'
 sqlparse==0.4.4 ; python_version >= '3.5'
 tenacity==8.2.3 ; python_version >= '3.7'
 threadpoolctl==3.2.0 ; python_version >= '3.8'
-tiktoken==0.4.0
+tiktoken==0.5.2
 tomli==2.0.1 ; python_version < '3.11'
 tqdm==4.66.1 ; python_version >= '3.7'
-typing-extensions==4.7.1 ; python_version < '3.10'
+typing-extensions==4.9.0 ; python_version < '3.10'
 tzdata==2023.3 ; python_version >= '2'
-urllib3==2.0.4 ; python_version >= '3.7'
-yarl==1.9.2 ; python_version >= '3.7'
+urllib3==2.1.0 ; python_version >= '3.8'
+yarl==1.9.4 ; python_version >= '3.7'
 youtube-transcript-api==0.6.1
-zipp==3.16.2 ; python_version < '3.10'
+zipp==3.17.0 ; python_version < '3.10'

static/js/_base.js

@@ -0,0 +1,20 @@
+document.addEventListener('htmx:afterRequest', function(evt) {
+    changeSelectedExpert();
+});
+
+function changeSelectedExpert() {
+    const currentExpert = document.querySelector('#title').textContent.substring(4);
+    const selectElement = document.querySelector('.select');
+    const options = selectElement.options;
+
+    // Loop through all the options and set defaultSelected
+    for (let i = 0; i < options.length; i++) {
+        if (options[i].value === currentExpert) {
+            options[i].defaultSelected = true;
+            options[i].selected = true;
+        } else {
+            options[i].defaultSelected = false;
+        }
+    }
+
+}

templates/_base.html

@@ -10,6 +10,7 @@
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css">
     <script defer src="{% static 'js/mdb.min.js' %}"></script>
     <script defer src="{% static 'js/htmx.min.js' %}"></script>
+    <script defer src="{% static 'js/_base.js' %}"></script>
 </head>
 <body class="fade" hx-headers='{"X-CSRFToken": "{{ csrf_token }}"}'>
 
@@ -63,30 +64,7 @@ <h1 class="title">{{ title }}</h1>
     </div>
 
     {% block extra_js %}
-    <script>
-
-        document.addEventListener('htmx:afterRequest', function(evt) {
-            changeSelectedExpert();
-        });
-
-        function changeSelectedExpert() {
-            const currentExpert = document.querySelector('#title').textContent.substring(4);
-            const selectElement = document.querySelector('.select');
-            const options = selectElement.options;
-
-            // Loop through all the options and set defaultSelected
-            for (let i = 0; i < options.length; i++) {
-                if (options[i].value === currentExpert) {
-                    options[i].defaultSelected = true;
-                    options[i].selected = true;
-                } else {
-                    options[i].defaultSelected = false;
-                }
-            }
 
-        }
-
-     </script>
     {% endblock %}
     </body>
     </html>

templates/expert_form.html

@@ -1,16 +1,12 @@
-{% extends "_base.html" %}
-{% load crispy_forms_tags %}
-{% block content %}
+{% extends "_base.html" %} {% load crispy_forms_tags %} {% block content %}
 
-{% comment %} <h1 class="text-danger">{% if object %}Edit Expert{%else %}Add Expert{% endif %}</h1> {% endcomment %}
 <form method="post">
-    {% csrf_token %}
-    {{ form|crispy }}
-    <button class="btn btn-block btn-danger" type="submit">Save</button>
+  {% csrf_token %} {{ form|crispy }}
+  <button class="btn btn-block btn-danger" type="submit">Save</button>
 </form>
 
 <div class="my-4">
-    <a class="btn btn-block btn-dark" href="{% url 'expert-list' %}">Cancel</a>
+  <a class="btn btn-block btn-dark" href="{% url 'expert-list' %}">Cancel</a>
 </div>
 
 {% endblock %}