Alec Perkins
99f810d043
- Signed-out visitors get the same login redirect for missing and private projects, so the redirect no longer reveals private ones. - Production refuses the console email backend; sign-in codes must never reach the logs. - Database cache shared by all workers for allauth rate limits; invite sending throttled per sender and per recipient. - Email invite links are claimed on first use and the token rotated, so a token copied from request logs is worthless. - allauth password URLs removed; adding an email requires a fresh code and notifies existing addresses. - Markdown drops remote images until uploads exist. - Project and org slugs lowercased; only superusers can grant staff status or permissions in the admin. - Container runs as a non-root user; CI actions pinned to commits. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
23 lines
774 B
Python
23 lines
774 B
Python
from django.urls import path
|
|
|
|
from . import views
|
|
|
|
app_name = "orgs"
|
|
|
|
urlpatterns = [
|
|
path("", views.org_detail, name="detail"),
|
|
path("members/", views.members, name="members"),
|
|
path("members/<str:membership_id>/", views.member_update, name="member_update"),
|
|
path("members/<str:membership_id>/remove/", views.member_remove, name="member_remove"),
|
|
path("invites/<str:invite_id>/revoke/", views.invite_revoke, name="invite_revoke"),
|
|
]
|
|
|
|
invite_urlpatterns = (
|
|
[
|
|
path("", views.my_invites, name="list"),
|
|
path("<str:invite_id>/", views.invite_show, name="show"),
|
|
path("<str:invite_id>/respond/", views.invite_respond, name="respond"),
|
|
path("t/<str:token>/", views.invite_by_token, name="by_token"),
|
|
],
|
|
"invites",
|
|
)
|