Django – Iframe – Internt explorer : problems SEC7111


I’m recently making the use of Iframe and postmessages for running a project. I run into problems while testing it for Internet Explore (not a news).

The fact is, IE is pretty bad also at stating errors, the only things that it says is that the form where blocked for security reason saying

SEC7111

I initially thought of the X-Frame-Option, and with django you can fix it by annotating the view with @xframe_options_exempt. This works but not when you POST to a view within the Iframe. This beacuse Django uses CSRF cookie while IE blocks cookie of  a third party.

The soluition is pretty easy: THERE’S NO SOLUTION. As explained in this ticket.  The best one seems to be the one of not using Iframe. Or to remove CSRF for that specific view.

A thing that took me forever to solve this problem is the fact that django can’t show you the page 403 since it’s protected for Iframing (you need to rewrite the 403handler, maybe the 403csrfhandler if existsts) and then IE tells you that the page can’t be displayed for security reasons, which at first sights it’s impossible to grasp the reason.

 

 

Annunci

“Beautiful” Django widget for Multi Selection


widtget.png
Left: django default widget / Right: final result

To be honest django is terrific, but in order to be general enough it lacks some look and feel and other stylistics things. One of the problem with forms, which generally work great, is with multi selections. You can have an item list or a checkbox list, like in the 90s. I decided to build a widget to render in a nice fashion the multi-selection case. It took me more than expected, roughly an afternoon, but I run into various problem and I’d to hack a bit the widgets. One of the biggest problem was to access the model.object in the widget since i want to display more data than just the label. Another problem that stucked me for a while was the fact that with crispy form the widget_template overiding seems not to be working (issue here).

Since I want to write less code as possible, the ingredients are:

  • use Class Based view
  • use Model Forms

And the final solution I made allowed me to cut ~50% of the code. Less code you write less bug you make.

The code, once made, is not complex. However, getting there took some time. Let’s start from the view.

rewriting the get_context  function is done for being able to pass a queryset to the formThis allows us to have two benefits:

  • we are able to display in the form field only the data that we want and not the entire list of items present in the database
  • we can pass the queryset into the widget part, usually widgets do not have access to the context

To do so, we have to modify a bit the Form

As you can see we set the queryset of a inner field and also to as widget.qs value. Note that the widget of the field is linked to the brand new widget I just made.

For the widget, I had to extend and overwrite the get_context function in order to load a specifc value from the context. This is a bit of hack, since widget should not know the request or context data, but I need it!

Finally, in the templates (that you see in the form variable) I made the bootstrap panels where I displayed the widget and other information (directly from the object).

The first template is pretty standard

The second one has a piece of code to load from the qs  variable the correct item that is displayed within the widget.

To do so I had to create a filter to get the item from the list

I also add some JS to make the whole panel green when selected.

For full code write a comment here and I’ll provide it.

A full set of the gist is here

Final

This is the result

final.png

  • It works
  • It’s (somehow) better than the plain one and quite reusable
  • It took longer than expected to implement it

Route53 and email (forwarding)


AWS is great, it has a ton of services to do whatever you had in mind and even things that you may not even thought about.

One of the services they offer is Route53, the DNS manager . I did use it to map to my loadbalancer. I moved the DNS from namecheap to AWS . The problem is that Route53 does not handle email (not forward nor anything).

There are several solutions, but the one I found the easiset is the one that involves mailgun . It allows you to forward emails to another email of yours (e.g. your gmail account), for free (right now). It should be even possible to use it as mail provider, but I never investigate that part.

To setup the email forwarding with mailgun:

  • subscribe to the service
  • create a domain, use the full domain as name without the www (don’t use the subdomain as suggested, read their docs for more info)
  • follow the DNS setup as explained by their webpage.
  • Once set up, create a route
    • Expression type: custom
    • raw expression: match_recipient(“.*@YOURDOMAIN.COM”)
    • actions: forward – YOUR EMAIL
  • Test the route with the tool at the bottom

Note that you need the raw expression beacuse in mailgun the routes are cross domain.

Mac: Volume + Play/Stop without special buttons


Edit: use karabiner

I’m using an external keyboard beacuse my mac keyboard is falling apart and on top of it I use an external screen. The keyboard I’ve is pretty basic so it does not have the special keys to change volume, set mute, play stop spotify. but there’s a soltuion.. apple script

Create an apple script (service):

  • open automator
  • select service
  • on top select “no input”
  • on the left side sarch for “Run Apple Script”

Then you can add various behaviour, for example the one for volume is (this one is volume up, for volume down is the same with 0 and minus, for mute set it to 0)


set vol to output volume of (get volume settings)
if vol > 90 then # 100 max
set volume output volume 100
else
set volume output volume (vol + 5)
end if

Or to stop/playing spotify you can use

 if application "Spotify" is running then
 tell application "Spotify"
 playpause
 end tell
end if 

Once saved (with the name you like the most), open:

  • System Preferences
  • keyboard
  • Shortcuts
  • Services
  • And on the bottom you will find all your scripts
  • Just assing a shortcut

Now you have full control even if you don’t have smart buttons . Personally I’ve:

  • volume up/down on cmd+alt+arrow up/down
  • mute cmd+alt+0
  • start/stop spotify cmd+alt+spacebar

 

Pomodoro + Super DND from Slack


I’m fund of pomodoro technique when I’ve to focus on some task, mainly coding or writing.

I’m a mac owner, and I found an handy app called Timer (that you can build for free from github) and has nice integrations with calendar and the possibility to run scripts (apple scripts)

Thus, since I don’t want to be disturbed I user the Script to:

  • Set the DND on slack
  • Set the status of slack to “working on a pomodoro”
  • (extra: stop spotify when the pomodoro is over)

This is good, the only problem is that Slack keeps showing red badges even if you are on DND. To avoid this you have to disable the badge icon app from notification menu. After a long time I found out how to do it (asking on AppleStackExchange)

The result of my script are


set appName to "Slack"
if running of application "System Preferences" then
   quit application "System Preferences"
   delay 1
end if
tell application "System Preferences"
   set the current pane to pane id "com.apple.preference.notifications"
   delay 1
   tell application "System Events"
     tell table 1 of scroll area 1 of window 1 of application process "System Preferences"
     repeat with i from 1 to (count rows)
       if value of static text 1 of group 1 of UI element 1 of row i is appName then
         select row i
         exit repeat
       end if
     end repeat
     end tell
     delay 0.2
       click checkbox "Badge app icon" of group 1 of window 1 of application process "System Preferences"
   end tell
  quit
end tell

do shell script "curl 'https://slack.com/api/dnd.setSnooze?token=THE_SLACK_TOKEN&num_minutes=$duration'"
do shell script "curl --data 'token=THE_SLACK_TOKEN&profile=%7B%22status_text%22%3A%22working%20on%20a%20pomodoro%20%22%2C%22status_emoji%22%3A%22%3Atomato%3A%22%7D' https://slack.com/api/users.profile.set"

and when ends I remove status, DND and stop spotify


if application "Spotify" is running then
tell application "Spotify"
pause

end tell
end if
do shell script "curl https://slack.com/api/dnd.endSnooze?token=THE_SLACK_TOKEN"
do shell script "curl --data 'token=THE_SLACK_TOKEN&profile=%7B%0A%20%20%20%20%22status_text%22%3A%20%22%22%2C%0A%20%20%20%20%22status_emoji%22%3A%20%22%22%0A%7D' https://slack.com/api/users.profile.set"

Docker Alpine for Django, DRF, UWSGi, Postgres and many more


I’m running a couple of project using docker as container engine. Most of them are python related project, which uses django, django rest framework, uwsgi, postgres and packages related to cryptography and much more.

Using the plain python:3 takes up a huge space, so i switched to python:3-alpine

with some problems in adding packages since they do not compile or run.


FROM python:3-alpine 
.. 
COPY requirements.txt . 
RUN set -e; \
 apk add --no-cache --virtual .build-deps \
 gcc \
 libc-dev \
 linux-headers \
 python3-dev \
 musl-dev\
 libffi-dev \
 openssl-dev \
 make \
 ; \
 apk add --no-cache postgresql-dev; \
 pip install --no-cache-dir uwsgi; \
 pip install --no-cache-dir -r requirements.txt; \
 apk del .build-deps; 
..

 

But I found a solution after wasting hours here and there..

Note:

  • that the postgresql-dev is not installed  as virtual.
  • If you want to have uwsgi use the internal routing (e.g., to avoid logs on health checks you have to install (not virtual)
    pcre pcre-dev

    and then use

     pip install --no-cache-dir -I uwsgi;

It install packages and then deletes them from the image. In the end the image is still pretty large 186MB but before it used to be around 7 times more .. (python:3 starts at ~690 MB).