ixgadmin
243d4eefcd
DEBUG was on in production, so an error rendered a full traceback and the DEBUG-only media route served /media/ixg-documents/... publicly, bypassing the document permission checks. Set DJANGO_DEBUG=False in the env files (untracked) and add friendly 500/404/403 templates. With DEBUG off Django no longer serves /static/, so nginx does: the static root moves to /var/www/ixg-platform-static (mounted into the app container) because /root is not traversable by www-data. HSTS (max-age 1y, includeSubDomains) is added to every HTTPS host, and a pragmatic CSP to the app/ops/portal locations. 'unsafe-inline' is required by the inline scripts/styles; self-hosting the CDN assets and nonces is a follow-up.
22 lines
691 B
HTML
22 lines
691 B
HTML
<!DOCTYPE html>
|
|
<html lang="en-gb">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>Not allowed</title>
|
|
<style>
|
|
body { margin: 0; font-family: system-ui, -apple-system, "Segoe UI", sans-serif; background: #f0fdf4; color: #1f2937; }
|
|
.wrap { max-width: 34rem; margin: 12vh auto; padding: 0 1.5rem; text-align: center; }
|
|
h1 { font-size: 1.5rem; color: #065f46; margin: 0 0 .75rem; }
|
|
p { line-height: 1.5; color: #475569; }
|
|
a { color: #065f46; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="wrap">
|
|
<h1>Not allowed</h1>
|
|
<p>Your account does not have access to that page.</p>
|
|
<p><a href="/">Return to the start</a></p>
|
|
</div>
|
|
</body>
|
|
</html>
|