minor: use django.conf.settings over dojo.settings everywhere#14434
minor: use django.conf.settings over dojo.settings everywhere#14434fopina wants to merge 3 commits intoDefectDojo:devfrom
Conversation
🔴 Risk threshold exceeded.This pull request modifies a sensitive file (dojo/reports/widgets.py) flagged by the scanner for a configured codepath edit; review is needed or adjust allowed authors/paths in .dryrunsecurity.yaml.
🔴 Configured Codepaths Edit in
|
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
We've notified @mtesauro.
Comment to provide feedback on these findings.
Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]
Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing
All finding details can be found in the DryRun Security Dashboard.
valentijnscholten
added
the
affects_pro
|
Let's verify it doesn't break Pro. |
|
@valentijnscholten for those without access to pro, was that a good or a bad run? 😄 |
dojo/apps.py
Outdated
|
|
||
| from dojo.location.models import Location # noqa: PLC0415 raised: AppRegistryNotReady | ||
|
|
||
| auditlog.register(Location) |
There was a problem hiding this comment.
Question (for everybody) -- we're using pghistory now right? So we could actually just get rid of this entirely maybe? (By which I mean: leave location/models.py updated as it is, and just don't touch this file at all.)
There was a problem hiding this comment.
And yes, registering Location with auditlog is my fault. ;-)
There was a problem hiding this comment.
I think it should go indeed
There was a problem hiding this comment.
Should I just remove apps.py changes then, leaving the rest?
5 participants
Description
I was having issues when setting DJANGO_MODULE_SETTINGS to a custom module and noticed
dojo.settingswas imported directly in some placesdojo/wsgi.py)mainapp/wsgi.pyand it is currently hereapp.ready()to avoid triggering LazySettings evaluation at model import time