From: Sophie Brun <sophie@offensive-security.com>
Date: Fri, 8 Jul 2022 15:21:43 +0200
Subject: Do not keep SECRET_KEY in /etc/defectdojo/settings.*

Bug-Kali: https://gitlab.com/kalilinux/packages/defectdojo/-/issues/1
---
 dojo/settings/settings.dist.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/dojo/settings/settings.dist.py b/dojo/settings/settings.dist.py
index 2978bef..9f00285 100644
--- a/dojo/settings/settings.dist.py
+++ b/dojo/settings/settings.dist.py
@@ -349,8 +349,12 @@ TEMPLATE_DEBUG = env("DD_TEMPLATE_DEBUG")
 SITE_URL = env("DD_SITE_URL")
 ALLOWED_HOSTS = tuple(env.list("DD_ALLOWED_HOSTS", default=["localhost", "127.0.0.1"]))
 
-# Raises django's ImproperlyConfigured exception if SECRET_KEY not in os.environ
-SECRET_KEY = env("DD_SECRET_KEY")
+# Make the SECRET_KEY unique, and don't share it with anybody.
+try:
+    with open('/var/lib/defectdojo/server', 'r') as f:
+        SECRET_KEY = f.read().strip()
+except IOError:
+        SECRET_KEY = 'z4Y8bxQ$bERZy4Mtn7!JA_Pt6Vo?Qe'
 
 # Local time zone for this installation. Choices can be found here:
 # http://en.wikipedia.org/wiki/List_of_tz_zones_by_name
