Onion location paths

[chigby]

This pull request fixes the problem with the Onion-Location header always referring to the home page, rather than the page path requested by each individual page.

Fixes #724

[SaptakS]

So right now if the footer_settings.securedrop_onion_address is set to an onion address without https:// in the beginning (which is the case in createdevdata), the urljoin() function technically just replaces the onion address with just the request.path. Hence only the path is returned in that case. I am not sure in which format onion address is saved in prod. Maybe can add a check of some sort to append https:// in the beginning?

[chigby]

I think there is a validator on the model itself:

securedrop.org/common/models/settings.py

Lines 43 to 52 in e67c78c

	securedrop_onion_address = models.CharField(
	'SecureDrop Onion Address',
	max_length=255,
	default='secrdrop5wyphb5x.onion',
	validators=[
	RegexValidator(regex=r'\.onion$', message="Enter a valid .onion address."),
	URLValidator(schemes=['http', 'https'], message='Onion address must be a valid URL beginning with http or https'),
	],
	help_text='Address for the securedrop.org onion service. Displayed in the site footer and the Onion-Location header. Must begin with http or https and end with .onion',
	)

Though I also do see the benefit of ensuring we don't do the wrong thing in this middleware either, regardless of the overall format.

[chigby]

Maybe create dev data is what needs to be changed. Hm.

[SaptakS]

Maybe create dev data is what needs to be changed. Hm.

Possible. Hence marked it as a comment and not request changes. I think given the validator, probably safe to just update create dev data

[chigby]

Added! Thanks for the review.

[harrislapiroff]

Given that @maeve-fpf is deploying the k8s powered version of this site tomorrow which will include nginx managed onion-location headers, this PR is no longer necessary (I didn't get my review together in time, whoops). Closing without merging.