Skip to content

fix: seguridad, accesibilidad y cleanup frontend #378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devsart95 wants to merge 3 commits into
base: dev
Choose a base branch
from
Open

fix: seguridad, accesibilidad y cleanup frontend #378

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8061ed2
fix(seguridad): hardening backend — API, settings y modelos
devsart95 Mar 25, 2026
24476ae
fix(seguridad): sanitizar XSS frontend y protección de formularios
devsart95 Mar 25, 2026
619a7e3
fix(a11y): accesibilidad, performance y cleanup frontend
devsart95 Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion conf/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,8 @@ SECRET_KEY=changeme
DATABASE_URL=postgis://postgres:changeme@db:5432/ayudapy
POSTGRES_USER=postgres
POSTGRES_PASSWORD=changeme
POSTGRES_DB=ayudapy
POSTGRES_DB=ayudapy
ALLOWED_HOSTS=localhost,127.0.0.1
SECURE_HSTS_SECONDS=0
SECURE_SSL_REDIRECT=False
CSRF_TRUSTED_ORIGINS=
270 changes: 134 additions & 136 deletions conf/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@

import os
import environ

env = environ.Env(
# set casting, default value
DEBUG=(bool, False)
Expand All @@ -21,76 +22,74 @@
# See https://docs.djangoproject.com/en/2.2/howto/deployment/checklist/

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = env('SECRET_KEY')
SECRET_KEY = env("SECRET_KEY")

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = env('DEBUG')

ALLOWED_HOSTS = ['*']
DEBUG = env("DEBUG")

DEBUG_PROPAGATE_EXCEPTIONS = True
ALLOWED_HOSTS = env.list("ALLOWED_HOSTS", default=["localhost", "127.0.0.1"])


# Application definition

INSTALLED_APPS = [
'django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.humanize',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
'leaflet',
'django.contrib.gis',
'core',
'org',
'widget_tweaks',
'rest_framework',
'rest_framework_gis',
'django_filters',
'simple_history',
'pipeline',
'admin_honeypot',
"django.contrib.admin",
"django.contrib.auth",
"django.contrib.contenttypes",
"django.contrib.humanize",
"django.contrib.sessions",
"django.contrib.messages",
"django.contrib.staticfiles",
"leaflet",
"django.contrib.gis",
"core",
"org",
"widget_tweaks",
"rest_framework",
"rest_framework_gis",
"django_filters",
"simple_history",
"pipeline",
"admin_honeypot",
]

MIDDLEWARE = [
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'simple_history.middleware.HistoryRequestMiddleware',
"django.middleware.security.SecurityMiddleware",
"django.contrib.sessions.middleware.SessionMiddleware",
"django.middleware.common.CommonMiddleware",
"django.middleware.csrf.CsrfViewMiddleware",
"django.contrib.auth.middleware.AuthenticationMiddleware",
"django.contrib.messages.middleware.MessageMiddleware",
"django.middleware.clickjacking.XFrameOptionsMiddleware",
"simple_history.middleware.HistoryRequestMiddleware",
]

ROOT_URLCONF = 'conf.urls'
ROOT_URLCONF = "conf.urls"

TEMPLATES = [
{
'BACKEND': 'django.template.backends.django.DjangoTemplates',
'DIRS': ['templates'],
'APP_DIRS': True,
'OPTIONS': {
'context_processors': [
'django.template.context_processors.debug',
'django.template.context_processors.request',
'django.contrib.auth.context_processors.auth',
'django.contrib.messages.context_processors.messages',
"BACKEND": "django.template.backends.django.DjangoTemplates",
"DIRS": ["templates"],
"APP_DIRS": True,
"OPTIONS": {
"context_processors": [
"django.template.context_processors.debug",
"django.template.context_processors.request",
"django.contrib.auth.context_processors.auth",
"django.contrib.messages.context_processors.messages",
],
},
},
]

WSGI_APPLICATION = 'conf.wsgi.application'
WSGI_APPLICATION = "conf.wsgi.application"


# Database
# https://docs.djangoproject.com/en/2.2/ref/settings/#databases
# Parse database connection url strings like psql://user:[email protected]:8458/db
DATABASES = {
'default': env.db(),
"default": env.db(),
}


Expand All @@ -99,31 +98,28 @@

AUTH_PASSWORD_VALIDATORS = [
{
'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
},
{
'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
},
{
'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
},
{
'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
},
]


# Internationalization
# https://docs.djangoproject.com/en/2.2/topics/i18n/

LOCALE_PATHS = (
os.path.join(BASE_DIR, 'locale'),
LOCALE_PATHS = (os.path.join(BASE_DIR, "locale"),)

)
LANGUAGE_CODE = "es"

LANGUAGE_CODE = 'es'

TIME_ZONE = 'America/Asuncion'
TIME_ZONE = "America/Asuncion"

USE_I18N = True

Expand All @@ -135,117 +131,119 @@
# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/2.2/howto/static-files/

STATIC_ROOT= os.path.join(BASE_DIR, 'allstatic')
STATICFILES_DIRS = [
os.path.join(BASE_DIR, "static")
]
STATIC_URL = '/static/'
STATIC_ROOT = os.path.join(BASE_DIR, "allstatic")
STATICFILES_DIRS = [os.path.join(BASE_DIR, "static")]
STATIC_URL = "/static/"

MEDIA_ROOT = 'media/'
MEDIA_URL = '/media/'
MEDIA_ROOT = "media/"
MEDIA_URL = "/media/"


LEAFLET_CONFIG = {
'DEFAULT_CENTER': (-25.292, -57.551),
'DEFAULT_ZOOM': 11,
'MIN_ZOOM': 3,
'MAX_ZOOM': 18,
'RESET_VIEW': False,
'NO_GLOBALS': False,

'PLUGINS': {
'markercluster': {
'css': 'https://leaflet.github.io/Leaflet.markercluster/dist/MarkerCluster.Default.css',
'js': 'https://leaflet.github.io/Leaflet.markercluster/dist/leaflet.markercluster-src.js',
'auto-include': True,
"DEFAULT_CENTER": (-25.292, -57.551),
"DEFAULT_ZOOM": 11,
"MIN_ZOOM": 3,
"MAX_ZOOM": 18,
"RESET_VIEW": False,
"NO_GLOBALS": False,
"PLUGINS": {
"markercluster": {
"css": "https://leaflet.github.io/Leaflet.markercluster/dist/MarkerCluster.Default.css",
"js": "https://leaflet.github.io/Leaflet.markercluster/dist/leaflet.markercluster-src.js",
"auto-include": True,
},
'fullscreen': {
'css': 'https://api.mapbox.com/mapbox.js/plugins/leaflet-fullscreen/v1.0.1/leaflet.fullscreen.css',
'js': 'https://api.mapbox.com/mapbox.js/plugins/leaflet-fullscreen/v1.0.1/Leaflet.fullscreen.min.js',
'auto-include': True,
"fullscreen": {
"css": "https://api.mapbox.com/mapbox.js/plugins/leaflet-fullscreen/v1.0.1/leaflet.fullscreen.css",
"js": "https://api.mapbox.com/mapbox.js/plugins/leaflet-fullscreen/v1.0.1/Leaflet.fullscreen.min.js",
"auto-include": True,
},
}
},
}


REST_FRAMEWORK = {
'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.PageNumberPagination',
'PAGE_SIZE': 25,
'DEFAULT_RENDERER_CLASSES': (
'rest_framework.renderers.JSONRenderer',
"DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination",
"PAGE_SIZE": 25,
"DEFAULT_RENDERER_CLASSES": (
"rest_framework.renderers.JSONRenderer",
#'rest_framework.renderers.BrowsableAPIRenderer', # Uncomment this like if you want to use the nice API view for dev
)
),
"DEFAULT_PERMISSION_CLASSES": [
"rest_framework.permissions.AllowAny",
],
"DEFAULT_THROTTLE_CLASSES": [
"rest_framework.throttling.AnonRateThrottle",
"rest_framework.throttling.UserRateThrottle",
],
"DEFAULT_THROTTLE_RATES": {
"anon": "100/hour",
"user": "300/hour",
},
}

# Redirect to home URL after login (Default redirects to /accounts/profile/)
LOGIN_REDIRECT_URL = '/'
LOGIN_REDIRECT_URL = "/"

# Configs related to django-pipeline
STATICFILES_FINDERS = (
'django.contrib.staticfiles.finders.FileSystemFinder',
'django.contrib.staticfiles.finders.AppDirectoriesFinder',
'pipeline.finders.CachedFileFinder',
'pipeline.finders.PipelineFinder'
"django.contrib.staticfiles.finders.FileSystemFinder",
"django.contrib.staticfiles.finders.AppDirectoriesFinder",
"pipeline.finders.CachedFileFinder",
"pipeline.finders.PipelineFinder",
)
PIPELINE = {
'PIPELINE_ENABLED': True,
'PIPELINE_COLLECTOR_ENABLED': True,
'JAVASCRIPT': {
'table-view.js': {
'source_filenames': (
'scripts/table-view.js',
),
'output_filename': 'scripts/table-view.min.js',
"PIPELINE_ENABLED": True,
"PIPELINE_COLLECTOR_ENABLED": True,
"JAVASCRIPT": {
"table-view.js": {
"source_filenames": ("scripts/table-view.js",),
"output_filename": "scripts/table-view.min.js",
},
'list.js': {
'source_filenames': (
'scripts/list.js',
),
'output_filename': 'scripts/list.min.js',
"list.js": {
"source_filenames": ("scripts/list.js",),
"output_filename": "scripts/list.min.js",
},
'list-donation.js': {
'source_filenames': (
'scripts/list-donation.js',
),
'output_filename': 'scripts/list-donation.min.js',
"list-donation.js": {
"source_filenames": ("scripts/list-donation.js",),
"output_filename": "scripts/list-donation.min.js",
},
'leaflet-patch.js': {
'source_filenames': (
'scripts/leaflet-patch.js',
),
'output_filename': 'scripts/leaflet-patch.min.js',
"leaflet-patch.js": {
"source_filenames": ("scripts/leaflet-patch.js",),
"output_filename": "scripts/leaflet-patch.min.js",
},
'requests-linechart.js': {
'source_filenames': (
'scripts/requests-linechart.js',
),
'output_filename': 'scripts/requests-linechart.min.js',
"requests-linechart.js": {
"source_filenames": ("scripts/requests-linechart.js",),
"output_filename": "scripts/requests-linechart.min.js",
},
'libs/apexcharts.js': {
'source_filenames': (
'libs/apexcharts.js',
),
'output_filename': 'libs/apexcharts.min.js',
"libs/apexcharts.js": {
"source_filenames": ("libs/apexcharts.js",),
"output_filename": "libs/apexcharts.min.js",
},
"libs/bulma-calendar/bulma-calendar.js": {
"source_filenames": ("libs/bulma-calendar/bulma-calendar.js",),
"output_filename": "libs/bulma-calendar/bulma-calendar.min.js",
},
'libs/bulma-calendar/bulma-calendar.js': {
'source_filenames': (
'libs/bulma-calendar/bulma-calendar.js',
),
'output_filename': 'libs/bulma-calendar/bulma-calendar.min.js',
}
},
'STYLESHEETS': {
'libs/bulma-calendar/bulma-calendar.css': {
'source_filenames': (
'libs/bulma-calendar/bulma-calendar.min.css',
),
'output_filename': 'libs/bulma-calendar/bulma-calendar.min.css',
"STYLESHEETS": {
"libs/bulma-calendar/bulma-calendar.css": {
"source_filenames": ("libs/bulma-calendar/bulma-calendar.min.css",),
"output_filename": "libs/bulma-calendar/bulma-calendar.min.css",
}
},
'CSS_COMPRESSOR': 'pipeline.compressors.yuglify.YuglifyCompressor',
'JS_COMPRESSOR': 'pipeline.compressors.yuglify.YuglifyCompressor'
"CSS_COMPRESSOR": "pipeline.compressors.yuglify.YuglifyCompressor",
"JS_COMPRESSOR": "pipeline.compressors.yuglify.YuglifyCompressor",
}

STATICFILES_STORAGE = 'pipeline.storage.PipelineStorage'
STATICFILES_STORAGE = "pipeline.storage.PipelineStorage"

DEFAULT_AUTO_FIELD = "django.db.models.AutoField"

DEFAULT_AUTO_FIELD = 'django.db.models.AutoField'
# Security headers
SECURE_HSTS_SECONDS = env.int("SECURE_HSTS_SECONDS", default=0)
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
SESSION_COOKIE_SECURE = not DEBUG
CSRF_COOKIE_SECURE = not DEBUG
SECURE_SSL_REDIRECT = env.bool("SECURE_SSL_REDIRECT", default=False)
CSRF_TRUSTED_ORIGINS = env.list("CSRF_TRUSTED_ORIGINS", default=[])
X_FRAME_OPTIONS = "DENY"
Loading