[gnome-continuous-yocto/gnomeostree-3.28-rocko: 3358/8267] bitbake: toaster: settings set ALLOWED_HOSTS to * in debug mode

[Emmanuele Bassi <ebassi src gnome org>]

commit 7c3a47ed8965c3a3eb90a9a4678d5caedbba6337
Author: brian avery <brian avery intel com>
Date:   Fri Nov 4 12:27:06 2016 +0000

    bitbake: toaster: settings set ALLOWED_HOSTS to * in debug mode
    
    As of Django 1.8.16, Django is rejecting any HTTP_HOST header that is
    not on the ALLOWED_HOST list.  We often need to reference the
    toaster server via a fqdn, if we start it via webport=0.0.0.0:8000 for
    instance, and are hitting the server from a laptop. This change does
    reduce  the protection from a DNS rebinding attack, however, if you are
    running the toaster server outside a protected network, you should be
    using the production instance.
    
    [YOCTO #10578]
    
    (Bitbake rev: 7f51149453c96a3f1da64ea85306518fd2b65f21)
    
    Signed-off-by: brian avery <brian avery intel com>
    Signed-off-by: Michael Wood <michael g wood intel com>
    Signed-off-by: Richard Purdie <richard purdie linuxfoundation org>

 bitbake/lib/toaster/toastermain/settings.py |   16 +++++++++++++---
 1 files changed, 13 insertions(+), 3 deletions(-)
---
diff --git a/bitbake/lib/toaster/toastermain/settings.py b/bitbake/lib/toaster/toastermain/settings.py
index 3dfa2b2..aec9dbb 100644
--- a/bitbake/lib/toaster/toastermain/settings.py
+++ b/bitbake/lib/toaster/toastermain/settings.py
@@ -60,9 +60,19 @@ DATABASES = {
 if 'sqlite' in DATABASES['default']['ENGINE']:
     DATABASES['default']['OPTIONS'] = { 'timeout': 20 }
 
-# Hosts/domain names that are valid for this site; required if DEBUG is False
-# See https://docs.djangoproject.com/en/1.5/ref/settings/#allowed-hosts
-ALLOWED_HOSTS = []
+# Update as of django 1.8.16 release, the '*' is needed to allow us to connect while running
+# on hosts without explicitly setting the fqdn for the toaster server.
+# See https://docs.djangoproject.com/en/dev/ref/settings/ for info on ALLOWED_HOSTS
+# Previously this setting was not enforced if DEBUG was set but it is now.
+# The previous behavior was such that ALLOWED_HOSTS defaulted to ['localhost','127.0.0.1','::1']
+# and if you bound to 0.0.0.0:<port #> then accessing toaster as localhost or fqdn would both work.
+# To have that same behavior, with a fqdn explicitly enabled you would set
+# ALLOWED_HOSTS= ['localhost','127.0.0.1','::1','myserver.mycompany.com'] for
+# Django >= 1.8.16. By default, we are not enforcing this restriction in
+# DEBUG mode.
+if DEBUG is True:
+    # this will allow connection via localhost,hostname, or fqdn
+    ALLOWED_HOSTS = ['*']
 
 # Local time zone for this installation. Choices can be found here:
 # http://en.wikipedia.org/wiki/List_of_tz_zones_by_name