PapaTutuWawa/etesync-server
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Only enable browsable API when debugging is on.

Browse Source 
The reason for that is that the API may expose data that shouldn't be exposed,
such as the list of users on the service.
This commit is contained in:
Tom Hacohen 2020-09-13 14:17:25 +03:00
parent 3de1d48b9e
commit 00cf2d83a0
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
django_etebase/views.py
View File

@ -91,7 +91,7 @@ def msgpack_decode(content):
class BaseViewSet(viewsets.ModelViewSet):
authentication_classes = tuple(app_settings.API_AUTHENTICATORS)
permission_classes = tuple(app_settings.API_PERMISSIONS)
renderer_classes = [JSONRenderer, MessagePackRenderer, BrowsableAPIRenderer]
renderer_classes = [JSONRenderer, MessagePackRenderer] + [BrowsableAPIRenderer] if settings.DEBUG else []
parser_classes = [JSONParser, MessagePackParser, FormParser, MultiPartParser]
stoken_id_fields = None