cd /srv/wiki
./venv/bin/python manage.py check

System check identified no issues (0 silenced).

#: Should urls be case sensitive?
URL_CASE_SENSITIVE = getattr(django_settings, "WIKI_URL_CASE_SENSITIVE", False)

#: The editor class to use -- maybe a 3rd party or your own...? You can always
#: extend the built-in editor and customize it!
EDITOR = getattr(
    django_settings, "WIKI_EDITOR", "wiki.editors.markitup.MarkItUp"
)

#: Whether to use Bleach or not. It's not recommended to turn this off unless
#: you know what you're doing and you want to use the other options.
MARKDOWN_SANITIZE_HTML = getattr(
    django_settings, "WIKI_MARKDOWN_SANITIZE_HTML", True
)

cd /srv/wiki
./venv/bin/python manage.py shell -c 'from wiki.conf import settings as w; print("CACHE_TIMEOUT =", w.CACHE_TIMEOUT); print("REVISIONS_PER_MINUTES =", w.REVISIONS_PER_MINUTES)'

32 objects imported automatically (use -v 2 for details).

CACHE_TIMEOUT = 600
REVISIONS_PER_MINUTES = 5

./venv/bin/python manage.py shell -c '
from wiki.conf import settings as w
for k in sorted(x for x in dir(w) if x.isupper()):
    print(k, "=", repr(getattr(w, k)))
'

ACCOUNT_HANDLING = True
ACCOUNT_SIGNUP_ALLOWED = True
ANONYMOUS = True
ANONYMOUS_CREATE = False
ANONYMOUS_UPLOAD = False
ANONYMOUS_WRITE = False
CACHE_TIMEOUT = 600
CAN_ADMIN = None
CAN_ASSIGN = None
CAN_ASSIGN_OWNER = None
CAN_CHANGE_PERMISSIONS = None
CAN_DELETE = None
CAN_MODERATE = None
CAN_READ = None
CAN_WRITE = None
CHECK_SLUG_URL_AVAILABLE = True
EDITOR = 'wiki.editors.markitup.MarkItUp'
GROUP_MODEL = 'auth.Group'
LOG_IPS_ANONYMOUS = True
LOG_IPS_USERS = False
LOST_AND_FOUND_SLUG = 'lost-and-found'
MARKDOWN_HTML_ATTRIBUTES = {'a': ['href', 'title', 'class', 'id', 'target', 'rel'], 'abbr': ['title', 'class', 'id', 'target', 'rel'], 'acronym': [ ...
MARKDOWN_HTML_STYLES = []
MARKDOWN_HTML_WHITELIST = frozenset({'tr', 'li', 'br', 'code', 'b', 'hr', 'pre', 'abbr', 'figcaption', 'dt', 'thead', 'acronym', 'h5', 'h3', 'dl', ...
MARKDOWN_KWARGS = {'extensions': ['markdown.extensions.footnotes', 'markdown.extensions.attr_list', 'markdown.extensions.footnotes', 'mark ...
MARKDOWN_SANITIZE_HTML = True
MESSAGE_TAG_CSS_CLASS = {10: 'alert alert-info', 40: 'alert alert-danger', 20: 'alert alert-info', 25: 'alert alert-success', 30: 'alert alert-w ...
REVISIONS_MINUTES_LOOKBACK = 2
REVISIONS_PER_HOUR = 60
REVISIONS_PER_HOUR_ANONYMOUS = 10
REVISIONS_PER_MINUTES = 5
REVISIONS_PER_MINUTES_ANONYMOUS = 2
SHOW_MAX_CHILDREN = 20
STORAGE_BACKEND = <django.core.files.storage.DefaultStorage object at 0x7c04095fafc0>
URL_CASE_SENSITIVE = False
URL_CONFIG_CLASS = None
USE_BOOTSTRAP_SELECT_WIDGET = True
USE_SENDFILE = False
WIKILINKS_TRAILING_SLASH = True
WIKI_LANGUAGE = 'markdown'

./venv/bin/python manage.py diffsettings | grep WIKI_

WIKI_ACCOUNT_HANDLING = True  ###
WIKI_ACCOUNT_SIGNUP_ALLOWED = True  ###

cd /srv/wiki
echo 'WIKI_CACHE_TIMEOUT = 300' >> wikisite/settings.py

./venv/bin/python manage.py shell -c 'from wiki.conf import settings as w; print("CACHE_TIMEOUT =", w.CACHE_TIMEOUT)'

32 objects imported automatically (use -v 2 for details).

CACHE_TIMEOUT = 300

WIKI_ACCOUNT_HANDLING = True  ###
WIKI_ACCOUNT_SIGNUP_ALLOWED = True  ###
WIKI_CACHE_TIMEOUT = 300  ###

sed -i '/^WIKI_CACHE_TIMEOUT = 300$/d' wikisite/settings.py
./venv/bin/python manage.py shell -c 'from wiki.conf import settings as w; print("CACHE_TIMEOUT =", w.CACHE_TIMEOUT)'

32 objects imported automatically (use -v 2 for details).

CACHE_TIMEOUT = 600

current editor: wiki.editors.markitup MarkItUp

MARKDOWN_KWARGS: {'extensions': ['markdown.extensions.footnotes', 'markdown.extensions.attr_list', 'markdown.extensions.footnotes', 'markdown.extensions.attr_list', 'markdown.extensions.def_list', 'markdown.extensions.tables', 'markdown.extensions.abbr', 'markdown.extensions.sane_lists'], 'extension_configs': {'wiki.plugins.macros.mdx.toc': {'title': 'Contents'}}}

WIKI_MARKDOWN_KWARGS = {
    "extension_configs": {
        "wiki.plugins.macros.mdx.toc": {"title": "Contents of this article"},
    },
}

whitelist size: 37
sorted whitelist: ['a', 'abbr', 'acronym', 'b', 'blockquote', 'br', 'code', 'dd', 'div', 'dl', 'dt', 'em', 'figcaption', 'figure', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'ul']

_default_attribute_whitelist = bleach.ALLOWED_ATTRIBUTES
for tag in MARKDOWN_HTML_WHITELIST:
    if tag not in _default_attribute_whitelist:
        _default_attribute_whitelist[tag] = []
    _default_attribute_whitelist[tag].append("class")
    _default_attribute_whitelist[tag].append("id")
    _default_attribute_whitelist[tag].append("target")
    _default_attribute_whitelist[tag].append("rel")

_default_attribute_whitelist["img"].append("src")
_default_attribute_whitelist["img"].append("alt")
_default_attribute_whitelist["td"].append("align")

if MARKDOWN_HTML_STYLES and not _project_defined_attrs:
    MARKDOWN_HTML_ATTRIBUTES["*"] = "style"

POST: 302 /xss-demo/
GET /xss-demo/: 200
contains alert(1)      : True   (仅作为纯文本出现)
contains onerror       : False
contains javascript:   : False
contains evil.example  : False
渲染正文: <div class="wiki-article">alert(1)</div>

WIKI_CAN_WRITE = lambda user, article=None: user.is_staff

if ACCOUNT_HANDLING:
    LOGIN_URL = reverse_lazy("wiki:login")
    LOGOUT_URL = reverse_lazy("wiki:logout")
    SIGNUP_URL = reverse_lazy("wiki:signup")
else:
    LOGIN_URL = getattr(django_settings, "LOGIN_URL", "/")
    LOGOUT_URL = getattr(django_settings, "LOGOUT_URL", "/")
    SIGNUP_URL = getattr(django_settings, "WIKI_SIGNUP_URL", "/")

LOGIN_REDIRECT_URL = reverse_lazy("wiki:get", kwargs={"path": ""})

ws.REVISIONS_PER_MINUTES = 2
ws.REVISIONS_MINUTES_LOOKBACK = 2

patched: REVISIONS_PER_MINUTES = 2
editor1 created: False superuser: False
login editor1: True
edit #1: status=302 spam_msg=None
edit #2: status=302 spam_msg=None
edit #3: status=200 spam_msg=Spam protection: You are only allowed to create or edit 2 article(s) per 2 minutes.

ConnectionRefusedError: [Errno 111] Connection refused

# ===== 基础安全 =====
DEBUG = False
ALLOWED_HOSTS = ["wiki.example.internal"]
# SECRET_KEY 用下面命令生成后填入，勿用示例值：
# python -c "from django.core.management.utils import get_random_secret_key as g; print(g())"
SECRET_KEY = "<生成的随机串>"

# ===== 权限与账户：内网团队，禁自助注册，匿名只读 =====
WIKI_ACCOUNT_HANDLING = True
WIKI_ACCOUNT_SIGNUP_ALLOWED = False      # 由管理员建号
WIKI_ANONYMOUS = True                    # 匿名可读
WIKI_ANONYMOUS_WRITE = False             # 匿名不可写（默认值，显式声明）
WIKI_ANONYMOUS_UPLOAD = False

# ===== 反滥用：放宽到团队正常编辑密度 =====
WIKI_REVISIONS_PER_MINUTES = 10
WIKI_REVISIONS_PER_HOUR = 200
WIKI_REVISIONS_PER_MINUTES_ANONYMOUS = 2
WIKI_REVISIONS_PER_HOUR_ANONYMOUS = 10

# ===== 渲染安全：保持默认白名单净化 =====
WIKI_MARKDOWN_SANITIZE_HTML = True
WIKI_MARKDOWN_HTML_STYLES = []

# ===== 附件与图片 =====
WIKI_ATTACHMENTS_EXTENSIONS = ["pdf", "doc", "docx", "xlsx", "pptx", "txt", "png", "jpg"]
WIKI_ATTACHMENTS_PATH_OBSCURIFY = True
WIKI_IMAGES_PATH_OBSCURIFY = True
# 大附件多时配合 Nginx 开启 sendfile（需安装 django-sendfile）：
# WIKI_ATTACHMENTS_USE_SENDFILE = True

# ===== 缓存 =====
WIKI_CACHE_TIMEOUT = 300

# ===== 通知邮件 =====
NYT_SEND_EMAILS = True
NYT_EMAIL_SENDER = "wiki-notifications@example.internal"
EMAIL_HOST = "smtp.example.internal"
EMAIL_PORT = 25

# ===== TLS 由反向代理终结时补充（真机 HTTPS 场景）=====
# SESSION_COOKIE_SECURE = True
# CSRF_COOKIE_SECURE = True
# SECURE_SSL_REDIRECT = True
# SECURE_HSTS_SECONDS = 31536000

WARNINGS:
?: (security.W004) You have not set a value for the SECURE_HSTS_SECONDS setting. If your entire site is served only over SSL, you may want to consider setting a value and enabling HTTP Strict Transport Security. Be sure to read the documentation first; enabling HSTS carelessly can cause serious, irreversible problems.
?: (security.W008) Your SECURE_SSL_REDIRECT setting is not set to True. Unless your site should be available over both SSL and non-SSL connections, you may want to either set this setting True or configure a load balancer or reverse-proxy server to redirect all connections to HTTPS.
?: (security.W009) Your SECRET_KEY has less than 50 characters, less than 5 unique characters, or it's prefixed with 'django-insecure-' indicating that it was generated automatically by Django. Please generate a long and random value, otherwise many of Django's security-critical features will be vulnerable to attack.
?: (security.W012) SESSION_COOKIE_SECURE is not set to True. Using a secure-only session cookie makes it more difficult for network traffic sniffers to hijack user sessions.
?: (security.W016) You have 'django.middleware.csrf.CsrfViewMiddleware' in your MIDDLEWARE, but you have not set CSRF_COOKIE_SECURE to True. Using a secure-only CSRF cookie makes it more difficult for network traffic sniffers to steal the CSRF token.
?: (security.W018) You should not have DEBUG set to True in deployment.

System check identified 6 issues (0 silenced).

django-wiki (attachment plugin) not USE_LOCAL_PATH and APPEND_EXTENSION:
You have configured to append .upload and not use local paths. That won't
work as all your attachments will be stored and sent with a .upload
extension. You have to trust your storage backend to be safe for storing
the extensions you have allowed.

  File "/srv/wiki/venv/lib/python3.12/site-packages/wiki/plugins/notifications/management/commands/wiki_notifications_create_defaults.py", line 26, in subscribe_to_article
    settings_map[user], __ = Settings.objects.get_or_create(
  File "/srv/wiki/venv/lib/python3.12/site-packages/django/db/models/query.py", line 669, in create
    obj.save(force_insert=True, using=self.db)
  File "/srv/wiki/venv/lib/python3.12/site-packages/django_nyt/models.py", line 238, in save
    raise ValueError("A user must have a default settings object")
ValueError: A user must have a default settings object

from django.contrib.auth import get_user_model
from django_nyt.models import Settings
from wiki.models import Article

U = get_user_model()
involved = set()
for a in Article.objects.all():
    if a.owner:
        involved.add(a.owner)
    for r in a.articlerevision_set.exclude(user=None).values("user"):
        involved.add(U.objects.get(id=r["user"]))
print("involved users:", sorted(u.username for u in involved))
missing = [u for u in involved if not Settings.objects.filter(user=u).exists()]
print("users WITHOUT any Settings row:", [u.username for u in missing])
for u in missing:
    Settings.objects.create(user=u, is_default=True)
print("after fix:", list(Settings.objects.values("user__username", "is_default")))

./venv/bin/python manage.py shell < fix_nyt.py
./venv/bin/python manage.py wiki_notifications_create_defaults

32 objects imported automatically (use -v 2 for details).

involved users: ['admin', 'editor1']
users WITHOUT any Settings row: ['editor1']
after fix: [{'user__username': 'admin', 'is_default': True}, {'user__username': 'editor2', 'is_default': True}, {'user__username': 'editor1', 'is_default': True}]

Created 8 subscriptions on  4 articles