Fixes #172

Introduce some creative code around setting of ALLOWED_HOSTS that defaults to ['*'].  Also added PAPERLESS_ALLOWED_HOSTS to paperless.conf.example with an explanation as to what it's for

docs/changelog.rst

@@ -1,6 +1,14 @@
 Changelog
 #########
 
+* 0.3.2
+  * Fix for #172: defaulting ALLOWED_HOSTS to ``["*"]`` and allowing the user
+    to set her own value via ``PAPERLESS_ALLOWED_HOSTS`` should the need
+    arise.
+
+* 0.3.1
+  * Added a default value for ``CONVERT_BINARY``
+
 * 0.3.0
   * Updated to using django-filter 1.x
   * Added some system checks so new users aren't confused by misconfigurations.

paperless.conf.example

@@ -92,3 +92,11 @@ PAPERLESS_SHARED_SECRET=""
 # PAPERLESS_CONSUMPTION_DIR.  If you tend to write documents to this directory
 # very slowly, you may want to use a higher value than the default (10).
 # PAPERLESS_CONSUMER_LOOP_TIME=10
+
+# If you're planning on putting Paperless on the open internet, then you
+# really should set this value to the domain name you're using.  Failing to do
+# so leaves you open to XSS attacks.
+# Just remember that this is a comma-separated list, so "example.com" is fine,
+# as is "example.com,www.example.com", but NOT " example.com" or "example.com,"
+#PAPERLESS_ALLOWED_HOSTS="example.com,www.example.com"
+

src/paperless/settings.py

@@ -29,7 +29,11 @@ DEBUG = True
 
 LOGIN_URL = '/admin/login'
 
-ALLOWED_HOSTS = []
+ALLOWED_HOSTS = ["*"]
+
+_allowed_hosts = os.getenv("PAPERLESS_ALLOWED_HOSTS")
+if allowed_hosts:
+    ALLOWED_HOSTS = _allowed_hosts.split(",")
 
 # Tap paperless.conf if it's available
 if os.path.exists("/etc/paperless.conf"):
@@ -197,7 +201,7 @@ FORGIVING_OCR = bool(os.getenv("PAPERLESS_FORGIVING_OCR", "YES").lower() in ("ye
 GNUPG_HOME = os.getenv("HOME", "/tmp")
 
 # Convert is part of the ImageMagick package
-CONVERT_BINARY = os.getenv("PAPERLESS_CONVERT_BINARY")
+CONVERT_BINARY = os.getenv("PAPERLESS_CONVERT_BINARY", "convert")
 CONVERT_TMPDIR = os.getenv("PAPERLESS_CONVERT_TMPDIR")
 CONVERT_MEMORY_LIMIT = os.getenv("PAPERLESS_CONVERT_MEMORY_LIMIT")
 CONVERT_DENSITY = os.getenv("PAPERLESS_CONVERT_DENSITY")

src/paperless/version.py

@@ -1 +1 @@
-__version__ = (0, 3, 0)
+__version__ = (0, 3, 2)