fix: fixing security

Author: roniahmadi

frontend/function_view/detail_view.py

@@ -11,8 +11,8 @@ def get(self, request, slug):
         gambar = None
         try:
             gambar = GambarProduk.objects.filter(produk_id=produk.id)
-        except Exception:
-            pass
+        except Exception as e:
+            print(e)
         return render(
             request,
             "home_detail.html",

frontend/views.py

@@ -172,7 +172,7 @@ def post(self, request, id):
         for p in userprofileaddress:
             p.is_primary = False
             p.save()
-        return redirect("/toko/{}/alamat".format(id))
+        return redirect(reverse("alamat_toko", id))
 
 
 @method_decorator(csrf_exempt, name="dispatch")
@@ -518,7 +518,9 @@ def get(self, request, id):
         settingweb = self.configuration.api_key_pi
         header = {"Authorization": "Key " + settingweb}
         postdata = requests.post(
-            "https://api.minepi.com/v2/payments/" + id + "/approve", headers=header
+            "https://api.minepi.com/v2/payments/" + id + "/approve",
+            headers=header,
+            timeout=5000
         )
         if postdata.status_code == 200:
             return JsonResponse(postdata.json())
@@ -553,6 +555,7 @@ def get(self, request, id):
             "https://api.minepi.com/v2/payments/" + id + "/complete",
             data=datas,
             headers={"Authorization": "Key " + api_key},
+            timeout=5000
         )
         if postdata.status_code == 200:
             cart = Cart.objects.get(pk=request.GET.get("id"))
@@ -577,6 +580,7 @@ def get(self, request, id):
         cancel = requests.get(
             "https://api.minepi.com/payments/" + id + "/cancel",
             headers={"Authorization": "Key " + api_key},
+            timeout=5000
         )
         print(cancel.json())
         return JsonResponse(cancel, safe=False)
@@ -633,6 +637,7 @@ def setcomplete(self, request, cart_id, identifier, param):
             "https://api.minepi.com/v2/payments/" + identifier + "/complete",
             data=datas,
             headers={"Authorization": "Key " + api_key},
+            timeout=5000
         )
 
         if postdata.status_code == 200:
@@ -659,7 +664,8 @@ def get(self, request, param):
 
         data_url = "https://api.minepi.com/v2/payments/" + param
         requestdata = requests.get(
-            data_url, headers={"Authorization": "Key " + api_key}
+            data_url, headers={"Authorization": "Key " + api_key},
+            timeout=5000
         )
 
         cart_id = request.GET.get("cart_id")

projekpi/pi_customer.py

@@ -1,6 +1,4 @@
 class PiCustomer:
-    api = ""
-    token = ""
-
     def initialize(self, api, token):
-        pass
+        self.api = api
+        self.token = token

projekpi/pi_network.py

@@ -49,7 +49,7 @@ def get_balance(self):
 
     def get_payment(self, payment_id):
         url = self.base_url + "/v2/payments/" + payment_id
-        re = requests.get(url, headers=self.get_http_headers())
+        re = requests.get(url, headers=self.get_http_headers(), timeout=10000)
         self.handle_http_response(re)
 
     def create_payment(self, payment_data):
@@ -82,7 +82,7 @@ def create_payment(self, payment_data):
 
             obj = json.dumps(obj)
             url = self.base_url + "/v2/payments"
-            re = requests.post(url, data=obj, json=obj, headers=self.get_http_headers())
+            re = requests.post(url, data=obj, json=obj, headers=self.get_http_headers(), timeout=10000)
             parsed_response = self.handle_http_response(re)
 
             identifier = parsed_response["identifier"]
@@ -138,7 +138,7 @@ def submit_payment(self, payment_id, pending_payment):
 
     def approved_payment(self, identifier):
         url = self.base_url + "/v2/payments/" + identifier + "/approve"
-        re = requests.post(url, headers=self.get_http_headers())
+        re = requests.post(url, headers=self.get_http_headers(), timeout=10000)
         self.handle_http_response(re)
 
     def complete_payment(self, identifier, txid):
@@ -149,24 +149,24 @@ def complete_payment(self, identifier, txid):
 
         obj = json.dumps(obj)
         url = self.base_url + "/v2/payments/" + identifier + "/complete"
-        re = requests.post(url, data=obj, json=obj, headers=self.get_http_headers())
+        re = requests.post(url, data=obj, json=obj, headers=self.get_http_headers(), timeout=10000)
         self.handle_http_response(re)
 
     def cancel_payment(self, identifier):
         obj = {}
         obj = json.dumps(obj)
         url = self.base_url + "/v2/payments/" + identifier + "/cancel"
-        re = requests.post(url, data=obj, json=obj, headers=self.get_http_headers())
+        re = requests.post(url, data=obj, json=obj, headers=self.get_http_headers(), timeout=10000)
         self.handle_http_response(re)
 
     def cancel_payment_user(self, identifier):
         url = self.base_url + "/v2/payments/" + identifier + "/cancel"
-        re = requests.post(url, headers=self.get_http_headers())
+        re = requests.post(url, headers=self.get_http_headers(), timeout=10000)
         self.handle_http_response(re)
 
     def get_incomplete_server_payments(self):
         url = self.base_url + "/v2/payments/incomplete_server_payments"
-        re = requests.get(url, headers=self.get_http_headers())
+        re = requests.get(url, headers=self.get_http_headers(), timeout=10000)
         res = self.handle_http_response(re)
         return res["incomplete_server_payments"]
 

projekpi/settings.py

@@ -23,7 +23,7 @@
 # See https://docs.djangoproject.com/en/4.2/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = "django-insecure-k=#8wq*kz%tackrz%qsxybf155lf6kkg!5at6&x%yn5h086xms"
+SECRET_KEY = os.environ.get("SECRET_KEY")
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
@@ -201,19 +201,14 @@
 
 AUTH_USER_MODEL = "profiles.UserProfile"
 
-# EMAIL_USE_TLS = os.getenv('EMAIL_USE_TLS',False)
-# EMAIL_HOST = os.getenv("EMAIL_HOST",'geraipi')
-# EMAIL_PORT = os.getenv("EMAIL_PORT",465)
-# EMAIL_HOST_USER = os.getenv("EMAIL_HOST_USER",'[email protected]')
-# EMAIL_HOST_PASSWORD = ("EMAIL_HOST_PASSWORD",'geraipi')
-
 EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
-EMAIL_HOST = "testnet.geraipi.id"
-EMAIL_USE_TLS = False
-EMAIL_PORT = 465
+
+EMAIL_USE_TLS = os.getenv('EMAIL_USE_TLS',False)
+EMAIL_HOST = os.getenv("EMAIL_HOST",'geraipi')
+EMAIL_PORT = os.getenv("EMAIL_PORT",465)
 EMAIL_USE_SSL = True
-EMAIL_HOST_USER = "[email protected]"
-EMAIL_HOST_PASSWORD = "Ahmadi123@"
+EMAIL_HOST_USER = os.getenv("EMAIL_HOST_USER",'[email protected]')
+EMAIL_HOST_PASSWORD = ("EMAIL_HOST_PASSWORD",'geraipi')
 
 CKEDITOR_UPLOAD_PATH = "uploads/"
 CKEDITOR_FILENAME_GENERATOR = "utils.get_filename"