collecstatic --clear is too lax about warning users
|Reported by:||loic84||Owned by:||loic84|
|Has patch:||no||Needs documentation:||no|
|Needs tests:||no||Patch needs improvement:||no|
STATIC_ROOT is not set in the settings.py that ships with the default project template, so STATIC_ROOT = '' from global_settings.py is used instead.
'' is a valid relative path, which means "from the current directory", so common case, you would wipe your whole project, worse case you can wipe your system (assuming you have sufficient privileges).
This is made worse by another bug: we don't display the affected directory.
The isinstance(self.storage, FileSystemStorage) (1) check fails because self.storage is not yet evaluated and still resolves to ConfiguredStorage (2) which is not a FileSystemStorage subclass.
Finally I think --dry-run should print a message that confirms that the command is really run in dry-run mode. Currently, when you do --dry-run --clear, you get a scary warning that you will delete files and you even have to confirm by typing "yes" just like the real command, that's enough to make you doubt that the --dry-run is effective.
I suggest the following:
- Set global_settings.STATIC_ROOT to None.
- Add STATIC_ROOT = os.path.join(BASE_DIR, 'static') to the default template.
- Have management commands refuse to run when settings.STATIC_ROOT == None.
- Evaluate Command.storage one way or another.
- Add a warning when the command is run with --dry-run mode.
Change History (13)
comment:1 Changed 19 months ago by erikr
- Cc eromijn@… added
- Needs documentation unset
- Needs tests unset
- Patch needs improvement unset
- Triage Stage changed from Unreviewed to Accepted
comment:2 Changed 19 months ago by jezdez
- Summary changed from collecstatic --clear can potentially wipe clean a user's system. to collecstatic --clear is too lax about warning users
comment:3 Changed 19 months ago by loic84
- Owner changed from nobody to loic84
- Status changed from new to assigned
comment:5 Changed 18 months ago by Tim Graham <timograham@…>
- Resolution set to fixed
- Status changed from assigned to closed