From 4e317c8aaecce652b25e3fde312b6a09a1b921d6 Mon Sep 17 00:00:00 2001
From: Thomas Merkel <tm@core.io>
Date: Mon, 11 Aug 2014 21:50:13 +0200
Subject: [PATCH] add allow hosts for django app

---
 copy/tmp/kumquat-settings.py             | 1 -
 copy/var/zoneinit/includes/50-kumquat.sh | 5 +++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/copy/tmp/kumquat-settings.py b/copy/tmp/kumquat-settings.py
index 15822de..6d86aa2 100644
--- a/copy/tmp/kumquat-settings.py
+++ b/copy/tmp/kumquat-settings.py
@@ -15,7 +15,6 @@
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = False
 TEMPLATE_DEBUG = False
-ALLOWED_HOSTS = []
 
 # Application definition
 
diff --git a/copy/var/zoneinit/includes/50-kumquat.sh b/copy/var/zoneinit/includes/50-kumquat.sh
index e60905e..b26f658 100644
--- a/copy/var/zoneinit/includes/50-kumquat.sh
+++ b/copy/var/zoneinit/includes/50-kumquat.sh
@@ -7,6 +7,8 @@ MYSQL_ROOT=$(mdata-get mysql_pw)
 MYSQL_KUMQUAT=${MYSQL_KUMQUAT:-$(mdata-get mysql_kumquat_pw 2>/dev/null)} || \
 MYSQL_KUMQUAT=$(od -An -N8 -x /dev/random | head -1 | tr -d ' ');
 mdata-put mysql_kumquat_pw "${MYSQL_KUMQUAT}"
+
+ALLOWED_HOST=$(hostname)
 SECRET_KEY=$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-100})
 
 # check if database exists already
@@ -39,6 +41,9 @@ cat >> /opt/kumquat/kumquat_web/settings.py <<EOF
 # Make this unique, and don't share it with anybody.
 SECRET_KEY = "${SECRET_KEY}"
 
+# Allow only the hostname and localhost to access
+ALLOWED_HOSTS = ['127.0.0.1', 'localhost', '${ALLOWED_HOST}']
+
 # Database
 # https://docs.djangoproject.com/en/1.6/ref/settings/#databases
 DATABASES = {