2016-06-17 02:30:48 +02:00
|
|
|
|
|
|
|
# For the Dev VM environment, we use the same settings as the
|
2016-07-20 05:42:43 +02:00
|
|
|
# sample prod_settings.py file, with a few exceptions.
|
2016-07-20 05:45:50 +02:00
|
|
|
from .prod_settings_template import *
|
2016-10-06 01:42:24 +02:00
|
|
|
import os
|
2017-03-05 00:34:09 +01:00
|
|
|
from typing import Set
|
2016-06-17 02:30:48 +02:00
|
|
|
|
2016-07-16 16:13:17 +02:00
|
|
|
LOCAL_UPLOADS_DIR = 'var/uploads'
|
2017-09-24 00:39:19 +02:00
|
|
|
EMAIL_LOG_DIR = "/var/log/zulip/email.log"
|
2016-10-27 23:14:23 +02:00
|
|
|
# Check if test_settings.py set EXTERNAL_HOST.
|
|
|
|
EXTERNAL_HOST = os.getenv('EXTERNAL_HOST')
|
|
|
|
if EXTERNAL_HOST is None:
|
2017-10-02 08:32:09 +02:00
|
|
|
EXTERNAL_HOST = 'zulipdev.com:9991'
|
2016-07-19 14:35:08 +02:00
|
|
|
ALLOWED_HOSTS = ['*']
|
2017-03-18 01:58:45 +01:00
|
|
|
|
|
|
|
# Uncomment extra backends if you want to test with them. Note that
|
|
|
|
# for Google and GitHub auth you'll need to do some pre-setup.
|
|
|
|
AUTHENTICATION_BACKENDS = (
|
|
|
|
'zproject.backends.DevAuthBackend',
|
|
|
|
'zproject.backends.EmailAuthBackend',
|
2017-08-16 18:19:03 +02:00
|
|
|
'zproject.backends.GitHubAuthBackend',
|
|
|
|
'zproject.backends.GoogleMobileOauth2Backend',
|
2017-03-18 01:58:45 +01:00
|
|
|
)
|
|
|
|
|
2016-06-17 02:30:48 +02:00
|
|
|
EXTERNAL_URI_SCHEME = "http://"
|
|
|
|
EMAIL_GATEWAY_PATTERN = "%s@" + EXTERNAL_HOST
|
|
|
|
NOTIFICATION_BOT = "notification-bot@zulip.com"
|
|
|
|
ERROR_BOT = "error-bot@zulip.com"
|
|
|
|
NEW_USER_BOT = "new-user-bot@zulip.com"
|
|
|
|
EMAIL_GATEWAY_BOT = "emailgateway@zulip.com"
|
2017-10-19 04:09:53 +02:00
|
|
|
PHYSICAL_ADDRESS = "Zulip Headquarters, 123 Octo Stream, South Pacific Ocean"
|
2016-06-17 02:30:48 +02:00
|
|
|
EXTRA_INSTALLED_APPS = ["zilencer", "analytics"]
|
|
|
|
# Disable Camo in development
|
|
|
|
CAMO_URI = ''
|
2016-06-03 01:02:58 +02:00
|
|
|
OPEN_REALM_CREATION = True
|
|
|
|
|
2017-07-14 16:44:07 +02:00
|
|
|
EMBEDDED_BOTS_ENABLED = True
|
|
|
|
|
2016-07-19 06:44:48 +02:00
|
|
|
SAVE_FRONTEND_STACKTRACES = True
|
2016-08-12 20:09:38 +02:00
|
|
|
EVENT_LOGS_ENABLED = True
|
2017-07-09 01:41:52 +02:00
|
|
|
SYSTEM_ONLY_REALMS = set() # type: Set[str]
|
2016-04-24 17:08:51 +02:00
|
|
|
USING_PGROONGA = True
|
2016-10-17 18:11:16 +02:00
|
|
|
# Flush cache after migration.
|
|
|
|
POST_MIGRATION_CACHE_FLUSHING = True # type: bool
|
2016-10-27 12:06:44 +02:00
|
|
|
|
|
|
|
# Enable inline open graph preview in development for now
|
|
|
|
INLINE_URL_EMBED_PREVIEW = True
|
2017-03-22 21:08:56 +01:00
|
|
|
|
|
|
|
# Don't require anything about password strength in development
|
|
|
|
PASSWORD_MIN_LENGTH = 0
|
passwords: Express the quality threshold as guesses required.
The original "quality score" was invented purely for populating
our password-strength progress bar, and isn't expressed in terms
that are particularly meaningful. For configuration and the core
accept/reject logic, it's better to use units that are readily
understood. Switch to those.
I considered using "bits of entropy", defined loosely as the log
of this number, but both the zxcvbn paper and the linked CACM
article (which I recommend!) are written in terms of the number
of guesses. And reading (most of) those two papers made me
less happy about referring to "entropy" in our terminology.
I already knew that notion was a little fuzzy if looked at
too closely, and I gained a better appreciation of how it's
contributed to confusion in discussing password policies and
to adoption of perverse policies that favor "Password1!" over
"derived unusual ravioli raft". So, "guesses" it is.
And although the log is handy for some analysis purposes
(certainly for a graph like those in the zxcvbn paper), it adds
a layer of abstraction, and I think makes it harder to think
clearly about attacks, especially in the online setting. So
just use the actual number, and if someone wants to set a
gigantic value, they will have the pleasure of seeing just
how many digits are involved.
(Thanks to @YJDave for a prototype that the code changes in this
commit are based on.)
2017-10-03 19:48:06 +02:00
|
|
|
PASSWORD_MIN_GUESSES = 0
|