[Django] #36990: Referrer header required for django.contrib.gis.forms.widgets.OSMWidget

[Django]

#36990: Referrer header required for django.contrib.gis.forms.widgets.OSMWidget
------------------------+--------------------------------------
Reporter: diestl | Type: Bug
Status: new | Component: GIS
Version: 6.0 | Severity: Normal
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------+--------------------------------------
The OSMWidget does not set the referrer header (or does not configure open
layers to set the referrer header) when making tile requests to the OSM
tile server. As per the OSM tile usage policy
(https://operations.osmfoundation.org/policies/tiles/), these requests are
being blocked.

The OSMWidget is the default widget used in the django admin interface
when using the `django.contrib.gis.admin.options.GISModelAdmin` admin base
class for geometry fields such as
`django.contrib.gis.db.models.PolygonField`.

To reproduce this, you need a very simple model:

{{{#!python
from django.contrib.gis.db import models


class TmpModel(models.Model):
geometry = models.PolygonField(geography=True)
}}}

and admin:

{{{#!python
from .models import TmpModel
from django.contrib.gis import admin


@admin.register(TmpModel)
class DatasetAdmin(admin.GISModelAdmin):
pass
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36990>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#36990: Referrer header required for django.contrib.gis.forms.widgets.OSMWidget
------------------------+--------------------------------------

Reporter: diestl | Owner: (none)

Type: Bug | Status: new
Component: GIS | Version: 6.0

Severity: Normal | Resolution:

Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------+--------------------------------------

Changes (by diestl):

* cc: diestl (added)

--
Ticket URL: <https://code.djangoproject.com/ticket/36990#comment:1>

[Django]

#36990: Referrer header required for django.contrib.gis.forms.widgets.OSMWidget
------------------------+--------------------------------------
Reporter: diestl | Owner: (none)
Type: Bug | Status: new
Component: GIS | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------+--------------------------------------
Changes (by diestl):

* Attachment "permission_denied_osm_scaled.png" added.

--
Ticket URL: <https://code.djangoproject.com/ticket/36990>

[Django]

#36990: Referrer header required for django.contrib.gis.forms.widgets.OSMWidget
------------------------+--------------------------------------
Reporter: diestl | Owner: (none)
Type: Bug | Status: new
Component: GIS | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------+--------------------------------------
Changes (by diestl):

* Attachment "permission_denied_osm_scaled.png" added.

Screenshot illustrating the issue in the admin interface

[Django]

#36990: Referrer header required for django.contrib.gis.forms.widgets.OSMWidget
------------------------+--------------------------------------
Reporter: diestl | Owner: (none)
Type: Bug | Status: new
Component: GIS | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------+--------------------------------------
Changes (by diestl):

* Attachment "permission_denied_osm_scaled.png" removed.

[Django]

#36990: Referrer header required for django.contrib.gis.forms.widgets.OSMWidget
------------------------+--------------------------------------
Reporter: diestl | Owner: (none)
Type: Bug | Status: new
Component: GIS | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------+--------------------------------------

Comment (by steph):

The referrer policy is fixed in OpenLayers 10.8 (see
https://github.com/openlayers/openlayers/issues/17088). Within Django, the
referenced js/css for OpenLayers needs to be updated. It is currently
7.2.2 (see
https://github.com/django/django/blob/main/django/contrib/gis/forms/widgets.py#L78-L88).

I tested a update quickly and it seems to work but I don't have the
ability to do a in-depth test of all related features to ensure the update
has no side-effects.
--
Ticket URL: <https://code.djangoproject.com/ticket/36990#comment:2>

[Django]

#36990: Referrer header required for django.contrib.gis.forms.widgets.OSMWidget
------------------------+--------------------------------------
Reporter: diestl | Owner: (none)
Type: Bug | Status: new
Component: GIS | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------+--------------------------------------

Comment (by diestl):

Replying to [comment:2 steph]:

> I tested a update quickly and it seems to work

Thank you for this, I wasn't sure if just upgrading was going to work or
whether some additional configuration was going to be needed. I struggled
following along with how even OSM end's up being used by the OSMWidget.

> but I don't have the ability to do a in-depth test of all related
features to ensure the update has no side-effects.

Is it a matter of testing that all the widget capabilities like drawing,
deleting, editing and so on of geometries still works? I can't imagine
that this change would have an impact beyond that. If so, I think I'm well
placed to do that test, though you will just have to take my word for it.
--
Ticket URL: <https://code.djangoproject.com/ticket/36990#comment:3>

[Django]

#36990: Referrer header required for django.contrib.gis.forms.widgets.OSMWidget
------------------------+--------------------------------------
Reporter: diestl | Owner: (none)
Type: Bug | Status: new
Component: GIS | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------+--------------------------------------
Comment (by diestl):

I can confirm at least that creating, editing and deleting features
(Polygon and MultiPolygon in my case) works when using the OSMWidget, if
openlayers is updated to 10.8 like so:
https://github.com/django/django/compare/main...EnvSys:django:upgrade-
openlayers

There is also a reference to OpenLayers 7.2.2 in
https://github.com/django/django/blob/e3038897992d1c47f70ffb84ec1109b8d6a68bb9/js_tests/tests.html#L159-L159,
which presumably should also be updated... I am not in a good position to
test that.
--
Ticket URL: <https://code.djangoproject.com/ticket/36990#comment:4>

[Django]

#36990: Referrer header required for django.contrib.gis.forms.widgets.OSMWidget
------------------------+------------------------------------

Reporter: diestl | Owner: (none)
Type: Bug | Status: new
Component: GIS | Version: 6.0
Severity: Normal | Resolution:

Keywords: | Triage Stage: Accepted

Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------+------------------------------------

Changes (by David Smith):

* stage: Unreviewed => Accepted

Comment:

I was also able to reproduce the issue. I also did a small test to upgrade
to the latest version of OpenLayers and saw that the "access blocked"
error no longer appear.
--
Ticket URL: <https://code.djangoproject.com/ticket/36990#comment:5>