From 7470c2d3d0097d4717f68863c1f69162a256df08 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 11 Aug 2025 12:57:08 +0200 Subject: [PATCH] fix CSRF --- data/db.sqlite3 | Bin 0 -> 172032 bytes docker-compose.yml | 11 ++++++----- subscribarr/settings.py | 15 +++++++++++++++ 3 files changed, 21 insertions(+), 5 deletions(-) create mode 100644 data/db.sqlite3 diff --git a/data/db.sqlite3 b/data/db.sqlite3 new file mode 100644 index 0000000000000000000000000000000000000000..2f95468efb51120e6375e82aeaa4ef34f49f4a2d GIT binary patch literal 172032 zcmeI5e{36Be%Lu8C5p1Bv3J+z?%H0DX#2c6S=7vs!yj7gX=zz&)0Sjgve&CU>=DD6 zAvw};hMpNpq7R3zoZVdSf;4SXw78;0f#T8zZBQV8qyZY-HSMA44-`#uK!XHn(q#YW zCBYq#1VP#&SD@ebX84m$OKQ0oW$%XED|=&KS)D9k9-jp!f2C zUZJR)x~t1ZuSH(VOfH#|a>*A*1LsLg$I&g*0p|{Hl+E&~^cydX2F_;kvP}@^&_)E$ zP1m$sy{s#;3z~-Zm`SC@q<9J%U+!vrc!yFpmF3?*305}qvZ7cG($bJmEY>xza`EgKIXemn< zZS7G*x3!{TnJ&bx+pKF&kp$LI73pL~6t9Ir#qE{~soO6K$gnCfYt4o+biSpfOj^pm zH3m9bW6h_!b+p-7b$7TUshpS*mPSECYpmO;h{l~plhENImrjYPv~V*7N?O4SlgSI- zPOKd%YLY2I66b@U38pih28Sn)w3rt7+|7~Ez~vkHZtiqG+gi=qX^%&d3<$Mi=y>p1 zF`LW4MfS^=`!yXpb){S`mC8oh?*_)%>*m|9u5DcFi z4K7Anr%UOX)b6vMv5{bsQMY8XVzo}m&{F`BXec;6PR=eA>FKP~OmMy>SJNvtJ=y4- z0oy~T#)4Ov);T)iq4{~J0Nx_pu8 zzJs9advGdrIz|ur=?R087ec3}Bjg-F=M(@r{=YQ&F9UGY|J&@pVgEV%57@7=E~~Js zY>GY0hNk{v>i4JqFD_6pHF@~ z`J0p921WQm0!RP}AOR$R1dsp{Kmter2|O19Y>2tQMBun+mtNGobSlJLWFo3&Xz)h@ zZw-}p9(SOnFzT*o(N2z2{CibI91Vg)W*FWVgzQ~*VI*U!K?5Uc2&G~ zI>gK}<3w*)>G`uECc}iO`u>BzbLT_M8%)^mqrdj7SL=7wU;FB-Ax2`tq__U6S7^gA zzsvqZ%9k&Mm_=r+-D!V)%&TvA+h2d?T!_grV_wJom8WUtDD8USaP_6vLd=`YsNeHI z^^0D$-|;~83l!ui>35*+)C(czG86JWria5PUkWiZOsMT9Eo8mIwr{j>ibhDtbBLBi zX-EXAx~_xgNjmaDUu9Rt39rIe+f^|^Ln262ca=s?hL~w)gsP{9;p5c&5nnMa3VTJq zN?J5VV||1uqrc(kKQhZuEuEwH(3wyK?g8-Pzf&Bf#lE&qF&zI#X6Q`ll###xkFe7L z_WSJbv%kjv3-+g3lfB0#p$I=n00|%gB!C2v01`j~NB{{S0VIF~etZa=jD!N`Pq*%+ zC#R6kjfVnPE*^CK|7p?co09ysmsVhAib+jsr{ zY%mnKe6j0vgVXgrIuZ(;j*$!g^c2Di4E&t#z5Y**|3{{z0DA^D_(1|l00|%gB!C2v z01`j~NB{{S0VL2(VE;=arvk z6NaV8M%8ue3-j|rPD}{tY(hu~e0m|v=hC@sSx716v?jtM{&E>9%V(5aPLeXbmd#3h zs;nwCOA)hH_)o zdHdnx<&v_kzPGzlDp<+o2kGW|`a!|&b0NLJ3yEYpnMAUTU*YYs_j_ygsL6rsZ>hw5-*hmHJwcH8MRbOm2+ZBN-0_{t7Q00SuLexUd+h3 zEYu`(sf>^+mEmcpa#@j7h1~x?!v0Bs{R`OO2MHhnB!C2v01`j~NB{{S0VIF~kN^@m z-UP;jrx|hzWh5G$j&x2kkn8_}lgHaNv>pi{0VIF~kN^@u0!RP}AOR$R1dsp{IGg}| z{vSIRV1LN|FSrNb2kiIQKVpB6{cr4Vu>Xnu4*MIrvm&u`;Xagz#9U88lDcg z&wd%+5@@kHJSFgb_8~ki;5NI=F0wgzYQWs#yl9&C#_AK4LO1H0&?byq78>8DZbbFd? zM_;1b7wPr|x;;ggTz~let z01;In0VIF~kN^@u0!RP}AOR$R1dsp{_>2=EfB%0e^7R1wyX-Hre}jF8&9W~|{n^xS zPW}9pJGC@*Ci<7r{}TOX^n++2Iyw0plYejW{mIu({ErjgJYk(kP5hsUe>d^>C(0Aj z#CYWUk^da|1yF<^B!C2v01`j~NB{{Sfg=()cWE@hT(}b1(Y4)T!_n*|+2qI%j{M** zLhZ%bh^iTytF`OBpPoeAlYm!Do0X1)_mfJzIt>!%FGplmZ7YE9v~HGzy1C3a?Om?d z9nE!hv*NUkfHJOCIDY|zg*V21WBSB>n|d0&<~8tb>ucbf*xg{}JT#b<#)+wY(!}C! zQRy6rX7XWbxucn`X}Nk?S7cYW%(nTYg6poyorPv^EQfs`hBfpZ8EpEh*VOlBSX1An zfu_kH|Be2>zd;&Hx%Oza<=R6;OSmY=U7QVh!_pS=#)AHwodk)wOpscoSf&fJ z$8FZNHhI5{BZc!PKv;Mq=$qFk?wi=tV8UzQ+u7H^x3#;$OavOtNaXcMO>$7HVA_A8Q+>tIWgKdsZ%&RLWO;^I^{&zx2;onnE~M$ zf!Nn6B$C9)P6=NBKjQL?Vn_f9AOR$R1dsp{Kmter2_OL^fCP>)0do95!v5C)`#)iW zA0&VTkN^@u0!RP}AOR$R1dsp{KmthM7!ZgBlZ>l5?ps@$VKmFSnJ_FxHb!0v<|11T z+#}E^Hyr1!EoV;EcC30r)$sj)$6#2|L?nO&kN^@u0!RP}AOR$R1dsp{KmwnV03QE; zN`TlL2_OL^fCP{L50!RP}AOR$R1dsp{Kmter z2_OL^@F@w9>;F^1Uk|XCroKBh7JcKypHBSWi93;>9p4K7-LW5xZH`?E{(A7If_F!z z0^bbehjtd;7+U;13xo0JsSR}@fgddbAAa$4ICkX<^EVr=TrxCSQLKjPI`k>eJwL)r z>&yB3%iR6^wUuQq-cuLnUXSZ)oYUcPuN8RW^xB>K+}eYc74GhOVKu+L$=zPwC{ox1@xY)J*cFvDl4iCZLN)6>j;%?ru4R7d7SUof^sK2andGPZuC z%wJ_~^$xnCI4)-(Fr{URzq; z;Nt2QJVoE?2?@W~8SXlfTc;VcuvWNV$giwy`i0BayM6APOP!q18>^xubyC92{sJ40 zRdUR}+!=lPQ0cB9bGp8hNX@1cNy&*Cr8powH6&mMgbvWyHP!=72$0U8kmND5KRX38 z42Hq$bs5iH6LO2BD$xGDPrj&0drYX+}J2+Z2Zwp=QBED2#?<$t3e6M`L41 z%OOQ$y-_hl;uD2L$G!v8r)Tx>>Y2MEV`Q1xq@MVDD~|T4p_z)-_cPezL0{$TBuQU| zmNWaCOgJ__&peU4>D2U!P2Vx%_?~wPMtbzN){;*BC*{)FIqO+6U>pxwP@oo&8v4-v z(;2+}|D$yzh~6LpB!C2v01`j~NB{{S0VIF~kN^@GMj#6BVw_|`0ruasU!S@;`3I5Y z_}>oy>DV8RogU3Hq2QSlp9g_^fx@u1J!K&Ft33tB=f{UE7mh71GGCqZ&WzeNoL$~Bys z4=+rIWBEMu)k051KzDub-fa!_V9ojAF)=9kiGspYb5Kta#=)jB~)mP)BqvghuLfktQj z0BT*T{Ukm3mx~Tql|UzjL6drOLc4q=m!Xdi9yy>eqc# zhgx?t%sdI7hf92?V4xPC#g`r+MNuwELRt~MD}9I3e8qRK?>hUTZM>m}E0~A$`mBya z?(NYA*LW_T3&%DkW`B7I2znjP>0E*=se&M9_*Cy$dQvYRHi8E!8fL#IOX81y^Foh1 z8;(5$EAt0i*$N6tETu(3$P6>`%n^+2*K@dy?U35P^J+NeNX(Pq(@ktSR+MrIUrLJQ zAtB^pc(d!Y960~S3v#l@!4HNOOe142|TI15{?xL%!mGd+@Wc> zH;vHg-bta(i~jr^cIV{4+Wm?4=~@Yfd(L~a153gGkDDQ$EWR9$NfPtnw719HL)yz* zy?nj07Y?K9iG0>rw$tVjFj86Hfu|jF|uE-cjo9#dw0*q@%sM} zQwfS80VIF~kN^@u0!RP}AOR$R1dsp{IK~9<`2QFW9-58>kN^@u0!RP}AOR$R1dsp{ zKmthMhy?KX|A?Sa3<)3sB!C2v01`j~NB{{S0VIF~kian}fXDyGc<|74B!C2v01`j~ zNB{{S0VIF~kN^@u0!Ji3-v1Xkc|>6pLjp(u2_OL^fCP{L5{5$ zKN|SuK=hwXd}Ta8`XPM%?0>$t5}pigAtD3u`mJ*6p zn=i?xsoBo_PHNtJJo$V|N@tVOy!W_tXFi=xWs`!E6ST6VCAR97k3aZ_g)24A^?I-B zl`7{bRq{&nQj>FB%dSm-{J}qpPUOq*NPf<#Yo0_S$u9T+ zLqH8Ld+>CZ+X5}r4~Mkkc4c_HKXuxHmsx^*B02$sZgMbI8V3W%Rdm~Mpc{*G8@5Tg zz^EE3*Qh(Xs&T5dYc515q7$pK&fRIKjcu9x_=BGVOm$s>CfXc4?6s^ZE=S);PhT+# zo#eN42O4a^F!`4bPnc&=!Wb%jcuK~ZGoXgb>8H3r3t*?{jyCE zxGjTqx2>jZ$`##{;C6LGy$S=dBbOiol&WkwT*cOEFl^8wI^mB$4N$Hs+bX94^d`J% zo(4fhb2-JZAVdir5=-E#Y;fJ-XXs_k8%HqJgmEEyNwfkt-Q4C1AAj(T8a&LDSfPPI zZj~TU&|n3zhqCTo<#u6$LECS*@Qssocqx5_D_b^KhBqRZszbWg7QFzEPF&Mq@cf!Z z?gorZ`$u$QNp4iCF6oa9+in$VcfDYP!8FSahpN^z61dJ)BILA2*C0)=a*Ex&O2cJa z)9M^~KZa+_F5n?U2JvXl!Hlb4^+Ic|Y&2Y$bVQ7X$raDlZb&4KU|!8}1`s8Nc|%ds z;KdTtUySEXy+&X5N?w{verV*&5^Y4jty?u2-Y*+}U*tt;j?c~s0w?ebQhGs1CDN&E zI>#SSli@QTEsR1sOYYBp^W5NP3}6pfy0@5Q0K18HX-q>$%+@mWU`a21U07! zQYw=v2@*+G59Mu$LhgpOWszws_XJGIBJ{3>k7i^saGrtKKkVo7>h^XKqgGq$`_Ns_9g!OJf|3z?5qz2^A{{pvvc!0y09;0rk*@${IzZp$@!c<}O^kY127 z3!;?Bq%!F=yr$g`>%N*y^21yRf>+p|{mCmA$Xc8uY#+kt*nqF1L;5$LHFl+Rs%N21 z^L$d3m5flLvAeG6rXt%WosTf;D!1N*Oq%@Hnvk=*l)IgG8oS3W%lKg@w zCL~dW-K5^w>D1(;pNt0~cINkIzxGCvB)+dLk$K`%StB+*Yv@4M%cMGKFDc8Cs6y5& zWohWFLDJi9II@@XcH~-Jw_$B0Qxx)$wGE4^H{Tj0o!zz)+)Y@bVBf<}gLKqf3(CoE z5hOX&fkn_;86dN1j(G*vV{exPW<9+6NH?0Wt4UVehh(;|$&VY51a)&qhx`RSkn~FT z1!*MEk@I$mY_4uV6oV+q3o`7Fst__N1T~BU1Q3Zpuo;#)2)Jp_9?}Cu1>`E&IiV(R z>yATH4#WVYQP|P*9F!q>xe&6@y~WiUup?OlgNQK@kTtNFE5KCocf&}G!rSX%E?W>@ zF3I|2kch?->_S4iB`MBJ{B(B~qLRj(?+)GJ^}dr`1_J_l&aY~P6NDYi8Hjhso7Lbg z7-7nFXOX)D`?i48TLCn~fxT16F{YnCA^A4I9SXXKDvqo| z?McwHOYk;?jqEfJNw6>#giJyb1Sy#wm?VBpD*fRXM_`gH?azMn<*$$gyR$(T1_)O# zdu-?iS#2O^Db;74E|Qo{ik<0_l`?8hNTqXdj6n7hZjxz0)0?4sJAbf*ks}o^E0U=~ zR&27c(Ulgmpl)!hmZ>W;w+y4Hxik-HT(^;QD7w<$2IM)D+mK;xyb79OU%g@a``6G9 zI1Bp%kRBaJhh5|ZcUOj--5|#lP8AkWvVLmjmeqv0peY9IK3ZmiyVF`@SF8pM*s5+A znoV~mxohywF5O$5V2vPgO~Q^&KXTkibDd?wTCf1SM|99_g&gRRX$c1luu!}3wlOjj z{KGpE)20Qs(HU21&>ax43e2%!x1>9Sj9d-oC>Tv5s=d3} zninK`p0@AV3bf9?XDbB@Vj{_lLV8Gac{Ldc@BjbopYA{lkpL1v0!RP}AOR$R1dsp{ zKmter34B@tc>Moq31WLBfCP{L5>sj! z%>EAhzd!pnqlHKS2_OL^fCP{L5mFA5#+gT7A z#=WK7f(aem;%{4bMcyggxhLKe#ND@-Zr!R^u0L|MwUkr4_E0O_F5G*RZ(V>CB~IWM zr1SzWB$631C+42SgA|fn-!7$+k4vV!RWox|#!Bw&rW&r4dc2e5`LcT)A?4PW7t-&% zy<9Ihwl>R4*6jy-+XZ>aE$rUAySen1q|t z=GN}q=hhyqtZ;YN3#<9{P44#cCYOJ3|4v~IG_EeM-M$X7Zm_Q^n z($R1Qjk+qknp%{>ee%uKYg&7pVUV^o!)TUu6N2-QVQNc(DLdLhV?J|lZY-uPG6CIG zwLRyNp}Sg9ZnzfxT|6+Bi^73bpWlCJHXPfSVfJ%WiMl156$?~3jt*h0?bUT#D-y?w zvZSQNbUN89^145t3TxMw-{s=Hl|$RdxjSq9f@HRJ^%bAlPtSy7Gc(MSD|DXss_p%C zxpzkQRuaW6XL=?{ij44(IZfu3?>u-d$2nKqbK8W)yG1f4kD zvx8MnUt_VW7j+S2j{P*xPHVY&_-XMgpc;jR;jb-LCU)(ZCv z`IVJTzi|2b%zpNAIHu&8{ms64X6ujx8YM@u^?J`t6ICfKrDVRtzF&0upt;sB*bc~+ z&i-)gZ_qQ}_O~y=d}H#=lM6?+9g+pOMW$R*=2L>46Z)oCe}~*tCRo3G+oJ<|dKL#E zq}p0wIY?a$$K*w3|3QzlHERbv8a7Uuw31Di$1|%;GAEp7hwofgMy-p0s_YRU0 z568Z;$UKQ1(QK-Yj!;=Dr;{1EXM_eid+pEx8W3;$GQ68-@Qh4&!X8YG&v@7WKMJrP zv)^IA$$s?w_V!T|5h&h$q zb(q+4=2UIRswY%!tk!h%t*)v(DOd&hTe7(UcZxR34aebA(*uI7!+1fU zPtB0%vksDcDlI1A?!HVml}qQOOiIdT<+Q3~6j4a?NlDbQrJ-(Q`JDg$KYafGF$!=r g6$u~#B!C2v01`j~NB{{S0VIF~kiat$AkY8*f5}L}LI3~& literal 0 HcmV?d00001 diff --git a/docker-compose.yml b/docker-compose.yml index 80855a2..562d1c4 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -8,11 +8,15 @@ services: environment: # Django - DJANGO_DEBUG=true + - USE_X_FORWARDED_HOST=true + - DJANGO_SECURE_PROXY_SSL_HEADER=true + - DJANGO_CSRF_COOKIE_SECURE=true + - DJANGO_SESSION_COOKIE_SECURE=true - DJANGO_ALLOWED_HOSTS=* - DJANGO_SECRET_KEY=change-me - DB_PATH=/app/data/db.sqlite3 - NOTIFICATIONS_ALLOW_DUPLICATES=false - - DJANGO_CSRF_TRUSTED_ORIGINS="https://subscribarr.example.com,https://app.example.org" + - DJANGO_CSRF_TRUSTED_ORIGINS="https://subscribarr.local.js-devop.de" # App Settings (optional, otherwise use first-run setup) #- JELLYFIN_URL= #- JELLYFIN_API_KEY= @@ -33,8 +37,5 @@ services: # Cron schedule (default every 30min) - CRON_SCHEDULE=*/30 * * * * volumes: - - subscribarr-data:/app/data + - ./data:/app/data restart: unless-stopped - -volumes: - subscribarr-data: diff --git a/subscribarr/settings.py b/subscribarr/settings.py index dbc63d9..5761348 100644 --- a/subscribarr/settings.py +++ b/subscribarr/settings.py @@ -116,6 +116,21 @@ if not CSRF_TRUSTED_ORIGINS: CSRF_TRUSTED_ORIGINS = ['https://subscribarr.local.js-devop.de'] +USE_X_FORWARDED_HOST = os.getenv('USE_X_FORWARDED_HOST', 'False').lower() == 'true' +if os.getenv('DJANGO_SECURE_PROXY_SSL_HEADER', '').lower() in ('1', 'true', 'yes'): + SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') + +# Secure cookies when served over HTTPS (optional) +CSRF_COOKIE_SECURE = os.getenv('DJANGO_CSRF_COOKIE_SECURE', 'False').lower() == 'true' +SESSION_COOKIE_SECURE = os.getenv('DJANGO_SESSION_COOKIE_SECURE', 'False').lower() == 'true' + +# Optional cookie domain override (for subdomain setups) +_cookie_domain = os.getenv('DJANGO_COOKIE_DOMAIN', '').strip() +if _cookie_domain: + CSRF_COOKIE_DOMAIN = _cookie_domain + SESSION_COOKIE_DOMAIN = _cookie_domain + + # Internationalization # https://docs.djangoproject.com/en/5.2/topics/i18n/