From 02bd2e3294b21ad3a59604bc48fb0fd2c27b695e Mon Sep 17 00:00:00 2001
From: Taizo 'Tsa6' Simpson <taizo@tsa6.net>
Date: Thu, 21 Sep 2017 17:07:42 -0400
Subject: [PATCH] Added SECRET_KEY to the options file

---
 EpisodesCommunity/settings.py | 11 ++++++++++-
 options_example.ini           |  3 +++
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 options_example.ini

diff --git a/EpisodesCommunity/settings.py b/EpisodesCommunity/settings.py
index 71bd9a4..f7c0b81 100644
--- a/EpisodesCommunity/settings.py
+++ b/EpisodesCommunity/settings.py
@@ -11,6 +11,12 @@ https://docs.djangoproject.com/en/1.11/ref/settings/
 """
 
 import os
+import configparser
+import warnings
+
+config = configparser.ConfigParser()
+config.read('options.ini')
+options = config['General']
 
 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
 BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -20,7 +26,10 @@ BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 # See https://docs.djangoproject.com/en/1.11/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = '#(5u4*zj+ppjmsa^8mu_e%$0zpou(&9vu^q02g4icb%eu%3qe8'
+SECRET_KEY = options.get('secret_key', '5up3r s3cr3t k3y')
+if '5up3r s3cr3t k3y' == SECRET_KEY:
+    warnings.warn("Using a default secret_key, change this in options.ini for production!")
+
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
diff --git a/options_example.ini b/options_example.ini
new file mode 100644
index 0000000..292ba99
--- /dev/null
+++ b/options_example.ini
@@ -0,0 +1,3 @@
+[General]
+# You MUST change this for production.  Not doing so is a major vulnerability
+secret_key=5up3r s3cr3t k3y