Upgrade Django to 6.0 with built-in CSP support + wagtail-localize (#444). Fix #443

apps/core/factories.py

@@ -29,7 +29,8 @@ def _create(cls, model_class, *args, **kwargs):
         home = HomePage.objects.first()
         if not home:
             root = Page.get_first_root_node()
-            home = HomePage(title="Wagtail User Guide", slug="home-x")
+            locale = kwargs.get("locale")
+            home = HomePage(title="Wagtail User Guide", slug="home-x", locale=locale)
             root.add_child(instance=home)
             site = Site.objects.first()
             if site:

apps/core/templates/base.html

@@ -116,7 +116,7 @@
         {% include "components/search_modal.html" %}
 
         {# Global javascript #}
-        <script nonce="{{ request.csp_nonce }}">var languageCode = '{{ self.locale.language_code }}';</script>
+        <script nonce="{{ csp_nonce }}">var languageCode = '{{ self.locale.language_code }}';</script>
         <script src="{% url 'javascript-catalog' %}"></script>
         <script src="{% manifest 'main.js' %}"></script>
 

apps/guide/settings/base.py

@@ -61,6 +61,7 @@
     "django.contrib.contenttypes",
     "django.contrib.sessions",
     "django.contrib.messages",
+    "django.contrib.postgres",
     "whitenoise.runserver_nostatic",  # Must be before `django.contrib.staticfiles`
     "django.contrib.staticfiles",
     "django.contrib.sitemaps",
@@ -72,6 +73,7 @@
 MIDDLEWARE = [
     "django.middleware.security.SecurityMiddleware",
     "django_permissions_policy.PermissionsPolicyMiddleware",
+    "django.middleware.csp.ContentSecurityPolicyMiddleware",
     # Whitenoise middleware is used to server static files (CSS, JS, etc.).
     # According to the official documentation it should be listed underneath
     # SecurityMiddleware.
@@ -101,6 +103,7 @@
                 "django.template.context_processors.request",
                 "django.contrib.auth.context_processors.auth",
                 "django.contrib.messages.context_processors.messages",
+                "django.template.context_processors.csp",
             ],
         },
     },
@@ -222,37 +225,41 @@
     "usb": [],
 }
 
-# Content Security policy settings
-# http://django-csp.readthedocs.io/en/latest/configuration.html
-if "CSP_DEFAULT_SRC" in env:
-    MIDDLEWARE.append("csp.middleware.CSPMiddleware")
-
-    CSP_REPORT_ONLY = env.get("CSP_REPORT_ONLY", "false").lower() == "true"
+# Content Security Policy settings
+# https://docs.djangoproject.com/en/6.0/ref/middleware/#django.middleware.csp.ContentSecurityPolicyMiddleware
 
-    CSP_INCLUDE_NONCE_IN = ["script-src", "style-src"]
+if "CSP_DEFAULT_SRC" in env:
+    from django.utils.csp import CSP
 
-    # The “special” source values of
+    # The "special" source values of
     # 'self', 'unsafe-inline', 'unsafe-eval', and 'none' must be quoted!
-    # e.g.: CSP_DEFAULT_SRC = "'self'" Without quotes they will not work as intended.
+    # e.g.: CSP_DEFAULT_SRC="'self'" Without quotes they will not work as intended.
 
-    CSP_DEFAULT_SRC = env.get("CSP_DEFAULT_SRC").split(",")
+    csp_policy = {
+        "default-src": env.get("CSP_DEFAULT_SRC").split(","),
+    }
     if "CSP_SCRIPT_SRC" in env:
-        CSP_SCRIPT_SRC = env.get("CSP_SCRIPT_SRC").split(",")
+        csp_policy["script-src"] = env.get("CSP_SCRIPT_SRC").split(",") + [CSP.NONCE]
     if "CSP_STYLE_SRC" in env:
-        CSP_STYLE_SRC = env.get("CSP_STYLE_SRC").split(",")
+        csp_policy["style-src"] = env.get("CSP_STYLE_SRC").split(",") + [CSP.NONCE]
     if "CSP_IMG_SRC" in env:
-        CSP_IMG_SRC = env.get("CSP_IMG_SRC").split(",")
+        csp_policy["img-src"] = env.get("CSP_IMG_SRC").split(",")
     if "CSP_CONNECT_SRC" in env:
-        CSP_CONNECT_SRC = env.get("CSP_CONNECT_SRC").split(",")
+        csp_policy["connect-src"] = env.get("CSP_CONNECT_SRC").split(",")
     if "CSP_FONT_SRC" in env:
-        CSP_FONT_SRC = env.get("CSP_FONT_SRC").split(",")
+        csp_policy["font-src"] = env.get("CSP_FONT_SRC").split(",")
     if "CSP_BASE_URI" in env:
-        CSP_BASE_URI = env.get("CSP_BASE_URI").split(",")
+        csp_policy["base-uri"] = env.get("CSP_BASE_URI").split(",")
     if "CSP_OBJECT_SRC" in env:
-        CSP_OBJECT_SRC = env.get("CSP_OBJECT_SRC").split(",")
+        csp_policy["object-src"] = env.get("CSP_OBJECT_SRC").split(",")
     if "CSP_REPORT_URI" in env:
-        CSP_REPORT_URI = env.get("CSP_REPORT_URI")
+        csp_policy["report-uri"] = [env.get("CSP_REPORT_URI")]
 
+    report_only = env.get("CSP_REPORT_ONLY", "false").lower() == "true"
+    if report_only:
+        SECURE_CSP_REPORT_ONLY = csp_policy
+    else:
+        SECURE_CSP = csp_policy
 # Internationalization
 # https://docs.djangoproject.com/en/4.0/topics/i18n/
 

apps/guide/settings/production.py

@@ -36,9 +36,6 @@
 # https://docs.djangoproject.com/en/3.2/ref/settings/#secure-hsts-include-subdomains
 SECURE_HSTS_INCLUDE_SUBDOMAINS = False
 
-# https://docs.djangoproject.com/en/stable/ref/settings/#secure-browser-xss-filter
-SECURE_BROWSER_XSS_FILTER = True
-
 # https://docs.djangoproject.com/en/stable/ref/settings/#secure-content-type-nosniff
 SECURE_CONTENT_TYPE_NOSNIFF = True