maykinmedia / django-simple-certmanager

MIT License
0 stars 0 forks source link

[#13] prevent download of private keys #14

Closed pi-sigma closed 1 year ago

pi-sigma commented 1 year ago

Fixes #13 (partly)

codecov-commenter commented 1 year ago

Codecov Report

Merging #14 (947d7b6) into main (a8bb42d) will increase coverage by 0.31%. The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main      #14      +/-   ##
==========================================
+ Coverage   99.26%   99.57%   +0.31%     
==========================================
  Files          15       16       +1     
  Lines         406      470      +64     
==========================================
+ Hits          403      468      +65     
+ Misses          3        2       -1     
Impacted Files Coverage Δ
simple_certmanager/admin.py 100.00% <100.00%> (ø)
tests/test_admin.py 100.00% <100.00%> (ø)
tests/test_certificates.py 100.00% <100.00%> (ø)
simple_certmanager/models.py 100.00% <0.00%> (+1.49%) :arrow_up:

:mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more

pi-sigma commented 1 year ago

At the moment, private keys can still be downloaded by modifying the URL in the address bar of the browser. To prevent this, the view for the private key should not be created. This can be achieved by modifying the admin.PrivateMediaMixin.get_urls method in django-privates. I tried to achieve the same result by overwriting that method in the simple_certmanager.admin.CertificateAdmin class, but to no avail.