Module `collectives`#

Module containing the whole collectives Flask application

This file is the entry point to build the collectives Flask application. It imports all the submodule and contains the application factory.

Typical usage example:

import collectives

collectives.create_app().run(debug=True)

class collectives.ReverseProxied(app): Wrapper around WSGI environ to make Flask aware of actual proxy url scheme

collectives.check_default_secrets(app)

Log a critical message if insecure default secrets are still in use.

With the default SECRET_KEY, anyone can forge a session cookie and impersonate any account (including the administrator); with the default ADMINPWD the admin account is trivially accessible. Nothing is logged in testing mode.

Parameters:: app (flask.Flask) – The application being configured.
Returns:: True if a default secret is in use.

collectives.create_app(config_filename='config.py', extra_config=None)

Flask application factory.

This is the flask application factory for this project. It loads the other submodules used to runs the collectives website. It also creates the blueprins and init apps.

Parameters:

config_filename (string) – name of the application config file relative to instance/.
extra_config (dict) – Additionnal configuration not in the config file

Returns:

A flask application for collectives

Return type:

flask.Flask

collectives.refuse_private_uploads()

Never serve the files of the private upload set.

Flask-Uploads serves every configured upload set under /_uploads/, including the private one (collectives/private_assets), whose files (e.g. SecretFile configuration items) are only read by the server.

collectives.serve_documents_as_attachments(response)

Make browsers download uploaded documents instead of displaying them.

Uploaded documents are served from the site’s origin, both by Flask-Uploads (/_uploads/documents/) and as static files. A browser displays some of them itself (e.g. GPX files, served as XML) and would run the scripts they contain, so every document other than a safe image is sent as an attachment.

Parameters:: response (flask.Response) – The response about to be sent.
Returns:: The same response, with Content-Disposition set if needed.

collectives.set_security_headers(response)

Add defensive HTTP headers to every response.

HSTS is only sent when the request was made over HTTPS (as seen through the reverse proxy), so that plain HTTP development setups are not affected.

Parameters:: response (flask.Response) – The response about to be sent.
Returns:: The same response, with headers added.

Module collectives

Module collectives#

Module `collectives`#