Roman Donchenko
4aa0be3df5
Currently, all source files are located in `/home/django`, and owned by `django`. This means that if there's any vulnerability that lets an attacker overwrite files in the server, they can replace source files with their own code, and potentially get that code executed. That's pretty bad, so I want to harden against that. Make all source files owned by root, and move them to `/opt/cvat`. Add a `manage.py` symlink in `/home/django` for backwards compatibility. It happens that if a script is a symlink, Python does not add the symlink's directory to `sys.path`, which is great for us, since that lets us avoid a writable directory on there. Still, even though `/home/django/manage.py` is owned by root, an attacker could potentially be able to delete it and replace it with their own malicious file. To be a bit more safe, replace `~/manage.py` calls in backend scripts with `django-admin`. To make sure CVAT can still find the data directory, add a new environment variable, `CVAT_BASE_DIR` and set it in the Docker image. This also fixes a minor bug: we no longer override the `HOME` environment variable in the `Dockerfile`, so now it's automatically set by `Docker` depending on the current user.
39 lines
747 B
INI
39 lines
747 B
INI
[run]
|
|
branch = true
|
|
|
|
source =
|
|
cvat.apps
|
|
utils.dataset_manifest
|
|
cvat-sdk/
|
|
cvat-cli/
|
|
|
|
omit =
|
|
cvat/settings/*
|
|
*/tests/*
|
|
*/test_*
|
|
*/_test_*
|
|
*/migrations/*
|
|
|
|
[report]
|
|
# Regexes for lines to exclude from consideration
|
|
exclude_lines =
|
|
# Have to re-enable the standard pragma
|
|
pragma: no cover
|
|
|
|
# Don't complain about missing debug-only code:
|
|
def __repr__
|
|
if\s+[\w\.()]+\.isEnabledFor\(log\.DEBUG\):
|
|
|
|
# Don't complain if tests don't hit defensive assertion code:
|
|
raise AssertionError
|
|
raise NotImplementedError
|
|
|
|
# Don't complain if non-runnable code isn't run:
|
|
if 0:
|
|
if __name__ == .__main__.:
|
|
|
|
# don't fail on the code that can be found
|
|
ignore_errors = true
|
|
|
|
skip_empty = true
|