Ticket #17460: hidden_settings3.patch

docs/ref/settings.txt

@@ -758 +758 @@
 
 If you define custom settings, `django/views/debug.py`_ has a ``HIDDEN_SETTINGS``
 regular expression which will hide from the DEBUG view anything that contains
-``'SECRET'``, ``'PASSWORD'``, ``'PROFANITIES'``, or ``'SIGNATURE'``. This allows
-untrusted users to be able to give backtraces without seeing sensitive (or
-offensive) settings.
+``'API'``, ``'TOKEN'``, ``'KEY'``, ``'SECRET'``, ``'PASS'``,
+``'PROFANITIES'_LIST``, or ``'SIGNATURE'``. 
+This allows untrusted users to be able to give backtraces without seeing 
+sensitive (or offensive) settings.
 
+Note that due to how regular expression matching works ``'PASS'`` will also 
+match PASSWORD, just as ``'TOKEN'`` will also match TOKENIZED and so on.
+
 Still, note that there are always going to be sections of your debug output that
 are inappropriate for public consumption. File paths, configuration options, and
 the like all give attackers extra information about your server.

django/views/debug.py

@@ -14 +14 @@
 from django.utils.importlib import import_module
 from django.utils.encoding import smart_unicode, smart_str
 
-HIDDEN_SETTINGS = re.compile('SECRET|PASSWORD|PROFANITIES_LIST|SIGNATURE')
+HIDDEN_SETTINGS = re.compile('API|TOKEN|KEY|SECRET|PASS|PROFANITIES_LIST|SIGNATURE')
 
 CLEANSED_SUBSTITUTE = u'********************'