Rendering error when displaying an agora about agora-ciudadana

[edulix]

Hi Xavi: I'm not sure what's the problem, but you shouldn't use sqlite. BTW, I recommend you to try with this deployment script: https://github.com/agoravoting/agora-ciudadana-box

[xaviarias]

Thanks Edulix. I'll try with the agora box.

[xaviarias]

After having several problems with the deployment script, I have changed the database to PostgreSQL. The site works much faster than SQL Lite, but the error still appears.

I think is a security issue, regarding at the line authentication.py line 161:

if request.META.get('HTTP_AUTHORIZATION') ...
else:
    username = request.GET.get('username') or request.POST.get('username')
    api_key = request.GET.get('api_key') or request.POST.get('api_key')
    ...

Neither the headers or GET/POST data contain API Key. In debug mode I have set the request.META dictionary to {'HTTP_AUTHORIZATION' : 'apikey xavi:xxxxxxxxxxxxxxxx'} with the proper API Key and it works fine.

The request is generated in agora_view.html line 93:

var ajax_data = {
    'tallied_elections': {% rest request '/agora/' agora.id '/tallied_elections/?limit=3' %},
    'agora': {% rest request '/agora/' agora.id '/' %},
    'user_permissions': {% custom_rest request "POST" '{"action":"get_permissions"}' '/agora/' agora.id '/action/' %}
};

The custom rest request in POST to obtain user permissions must be authenticated in order to succeed.
In any case, the error should not produce this error page. Instead, receiving a 401 Ajax response should only display a blank content.

Searching about the AttributeError 'str' object has no attribute 'get', it seems that the response returned to Django is a string instead of HttpResponse, but debugging the code becomes too complex to find out the exact place.

Could you look ajax_data to see where the headers are managed and maybe add the Authorization header?

[xaviarias]

Last commit solved the issue, thanks @danigm !