finnandClaude Opus 5.5
2b1160862a
Login: - One message for unknown email, wrong password and deactivated account. Before, "This account is not enabled!" only appeared after the right password and confirmed valid credentials. - Email and password must be non-empty strings. A missing password field became the string "None" and logged in a user with that password. Forms: - "Create user" no longer renders the password back into the HTML after a validation error. - Password fields for a new password use autocomplete="new-password", so a password manager does not fill in the admin's own password. The email fields on the create pages use autocomplete="off". - Email addresses are limited to 64 characters in the local part and 254 in total (RFC 5321). Longer ones caused a database error and HTTP 500. - alerts.html no longer translates flash messages a second time. Running str.format() again on an already formatted message was fragile and logged "Unknown translation" for every German message. All flashes now translate when flashing, "Invalid data" included. Debug mode: - The Docker image sets MAX_PRODUCTION=1, and the app refuses to start in debug mode then. FLASK_DEBUG=1 in production would otherwise enable the fixed secret key, cookies without Secure, no HSTS and query arguments (including password hashes) in the log. - make run-dev and run-dev-as-prod bind to 127.0.0.1. Other: - A denied access is logged with the logger at debug level instead of print. PermissionDenied loses its unused message, it is deliberately answered with a 404. - Fix the typo in /user/<id>/ser-toggle-can-use-different-alias-domain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
42 lines
1.2 KiB
Docker
42 lines
1.2 KiB
Docker
# Build stage: compile the wheels (psycopg2 needs gcc and libpq-dev)
|
|
FROM python:3.15-slim-trixie AS build
|
|
|
|
RUN apt-get update && \
|
|
apt-get install --no-install-recommends -y gcc libc-dev libpq-dev && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
COPY requirements.txt .
|
|
RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt
|
|
|
|
# Runtime stage: no compiler and no tools besides what db-setup.sh needs
|
|
FROM python:3.15-slim-trixie
|
|
|
|
RUN apt-get update && apt-get upgrade -y && \
|
|
apt-get install --no-install-recommends -y libpq5 postgresql-client wait-for-it && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=build /wheels /wheels
|
|
RUN pip install --no-cache-dir /wheels/* && rm -rf /wheels
|
|
|
|
RUN groupadd --system --gid 10001 max && \
|
|
useradd --system --uid 10001 --gid max --no-create-home --shell /usr/sbin/nologin max
|
|
|
|
WORKDIR /app
|
|
|
|
ENV PYTHONPATH=/app/
|
|
ENV FLASK_APP=max.app
|
|
# Refuses to start in debug mode, see max/app.py
|
|
ENV MAX_PRODUCTION=1
|
|
|
|
# Owned by root, so the app cannot modify its own code
|
|
COPY max/ ./max
|
|
COPY scripts/prod/ .
|
|
# Precompile, since the app cannot write __pycache__ at runtime
|
|
RUN python -m compileall -q max
|
|
|
|
USER max
|
|
|
|
ENTRYPOINT ["./entrypoint.sh"]
|
|
CMD ["gunicorn", "-w", "1", "-b", "0.0.0.0:8000", "max.app:app"]
|