diff options
| -rw-r--r-- | docs/deployment/installation.rst | 10 | ||||
| -rw-r--r-- | patchwork/settings/production.example.py | 12 | ||||
| -rw-r--r-- | releasenotes/config.yaml | 1 | ||||
| -rw-r--r-- | releasenotes/notes/use-secrets-and-fall-back-to-random-SystemRandom-for-keys-9ceb496919a1bb6f.yaml | 5 |
4 files changed, 23 insertions, 5 deletions
diff --git a/docs/deployment/installation.rst b/docs/deployment/installation.rst index d422573..f477a11 100644 --- a/docs/deployment/installation.rst +++ b/docs/deployment/installation.rst @@ -254,9 +254,15 @@ This should be a random value and kept secret. You can generate and a value for .. code-block:: python - import string, random + import string + try: + import secrets + except ImportError: # Python < 3.6 + import random + secrets = random.SystemRandom() + chars = string.ascii_letters + string.digits + string.punctuation - print(repr("".join([random.choice(chars) for i in range(0,50)]))) + print("".join([secrets.choice(chars) for i in range(50)])) Once again, store this in ``production.py``. diff --git a/patchwork/settings/production.example.py b/patchwork/settings/production.example.py index c6aa2f2..8058537 100644 --- a/patchwork/settings/production.example.py +++ b/patchwork/settings/production.example.py @@ -21,9 +21,15 @@ from .base import * # noqa # You'll need to replace this to a random string. The following python code can # be used to generate a secret key: # -# import string, random -# chars = string.letters + string.digits + string.punctuation -# print repr("".join([random.choice(chars) for i in range(0,50)])) +# import string +# try: +# import secrets +# except ImportError: # Python < 3.6 +# import random +# secrets = random.SystemRandom() +# +# chars = string.ascii_letters + string.digits + string.punctuation +# print("".join([secrets.choice(chars) for i in range(50)])) SECRET_KEY = os.environ['DJANGO_SECRET_KEY'] diff --git a/releasenotes/config.yaml b/releasenotes/config.yaml index cd31940..bb6f215 100644 --- a/releasenotes/config.yaml +++ b/releasenotes/config.yaml @@ -10,4 +10,5 @@ sections: - [deprecations, Deprecation Notes] - [fixes, Bug Fixes] - [api, API Changes] + - [security, Security Notes] - [other, Other Notes] diff --git a/releasenotes/notes/use-secrets-and-fall-back-to-random-SystemRandom-for-keys-9ceb496919a1bb6f.yaml b/releasenotes/notes/use-secrets-and-fall-back-to-random-SystemRandom-for-keys-9ceb496919a1bb6f.yaml new file mode 100644 index 0000000..7b101cb --- /dev/null +++ b/releasenotes/notes/use-secrets-and-fall-back-to-random-SystemRandom-for-keys-9ceb496919a1bb6f.yaml @@ -0,0 +1,5 @@ +--- +security: + - | + Change the recommended method for generating the Django secret key to use a + cryptographically secure random number generator. |