From 6ff95d7cabf749c7d1f493952d0b33b172802d3c Mon Sep 17 00:00:00 2001 From: melvinsoft Date: Tue, 18 Jul 2017 10:36:53 -0300 Subject: [PATCH 1/2] Enable CORS headers http referee replace and middleware --- lms/envs/aws_appsembler.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lms/envs/aws_appsembler.py b/lms/envs/aws_appsembler.py index a2a4436fa228..944c2cba30ef 100644 --- a/lms/envs/aws_appsembler.py +++ b/lms/envs/aws_appsembler.py @@ -104,3 +104,14 @@ # if the AppsemblerUsageRouter isn't enabled, then avoid mistakes by # removing the database alias del DATABASES['appsembler_usage'] + +if FEATURES.get('ENABLE_CORS_HEADERS'): + # This middleware class and setting allows to run cross requests when we are + # under https, CORS headers requests external referers are blocked under + # https, there is a new setting in Django 1.9, but until we upgrade to that + # version we need to use this. + # Docs: https://github.com/ottoyiu/django-cors-headers#cors_replace_https_referer + CORS_REPLACE_HTTPS_REFERER = True + MIDDLEWARE_CLASSES += ( + 'corsheaders.middleware.CorsPostCsrfMiddleware', + ) From 84bf0d755d05980c13b226e03d9436de79c8db56 Mon Sep 17 00:00:00 2001 From: melvinsoft Date: Tue, 18 Jul 2017 15:12:43 -0300 Subject: [PATCH 2/2] add FEATURE setting default and remove middleware --- lms/envs/aws_appsembler.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/lms/envs/aws_appsembler.py b/lms/envs/aws_appsembler.py index 944c2cba30ef..6f681cac71eb 100644 --- a/lms/envs/aws_appsembler.py +++ b/lms/envs/aws_appsembler.py @@ -105,13 +105,10 @@ # removing the database alias del DATABASES['appsembler_usage'] -if FEATURES.get('ENABLE_CORS_HEADERS'): +if FEATURES.get('ENABLE_CORS_HEADERS', False): # This middleware class and setting allows to run cross requests when we are # under https, CORS headers requests external referers are blocked under # https, there is a new setting in Django 1.9, but until we upgrade to that # version we need to use this. # Docs: https://github.com/ottoyiu/django-cors-headers#cors_replace_https_referer CORS_REPLACE_HTTPS_REFERER = True - MIDDLEWARE_CLASSES += ( - 'corsheaders.middleware.CorsPostCsrfMiddleware', - )