Error 500 on source interface and journalist interface after 1.7.0 upgrade

[emkll]

Description

Initially reported by forum user jonas.franzen in https://forum.securedrop.org/t/issues-after-update-to-1-7-0/1391

Some due to a missing variable in config.py

Jan 27 12:48:07 applicationserver python[1136]: AttributeError: module ‘config’ has no attribute ‘SESSION_EXPIRATION_MINUTES’

Steps to reproduce

TBD

Comments

Forum user dachary reports that simply adding the value to config.py resolves

[zenmonkeykstop]

This looks to be the result of recent changes in securedrop/sdconfig.py , specifically in how missing configuration values in config.py are handled. Previously all attempts to set values to their config.py values were wrapped in try/except blocks, but this was removed as part of work to support type annotation - probably with the assumption that these values would always be present, which isn't the case for older instances or instances which have an older config.py restored from a backup.

Editing config.py in live instances via an application update is risky - we don't want to overwrite cryptography values generated at install time! - so instead the safest approach is to restore the old try/except logic for now.

A point release will be required to address this issue and will be forthcoming ASAP.

[conorsch]

STR:

1. Perform fresh install of 1.7.0.
2. SSH into app, edit /var/www/securedrop/config.py and comment out the line for SESSION_EXPIRATION_MINUTES
3. Run sudo service apache2 restart
4. Observe 500s on both Source & Journalist interfaces.