Ticket #18923: 0001-Fixed-18923-Add-decorator-sensitive_post_parameters_.patch

django/contrib/auth/admin.py

@@ -15 +15 @@
 from django.utils import six
 from django.utils.translation import ugettext, ugettext_lazy as _
 from django.views.decorators.csrf import csrf_protect
-from django.views.decorators.debug import sensitive_post_parameters
+from django.views.decorators.debug import sensitive_post_parameters_m
 
 csrf_protect_m = method_decorator(csrf_protect)
 
@@ -84 +84 @@
              self.admin_site.admin_view(self.user_change_password))
         ) + super(UserAdmin, self).get_urls()
 
-    @sensitive_post_parameters()
+    @sensitive_post_parameters_m()
     @csrf_protect_m
     @transaction.commit_on_success
     def add_view(self, request, form_url='', extra_context=None):
@@ -114 +114 @@
         return super(UserAdmin, self).add_view(request, form_url,
                                                extra_context)
 
-    @sensitive_post_parameters()
+    @sensitive_post_parameters_m()
     def user_change_password(self, request, id, form_url=''):
         if not self.has_change_permission(request):
             raise PermissionDenied

django/views/decorators/debug.py

@@ -69 +69 @@
             return view(request, *args, **kwargs)
         return sensitive_post_parameters_wrapper
     return decorator
+
+
+def sensitive_post_parameters_m(*parameters):
+    "sensitive_post_parameters function for class method"
+    def decorator(view):
+        @functools.wraps(view)
+        def sensitive_post_parameters_wrapper(self, request, *args, **kwargs):
+            if parameters:
+                request.sensitive_post_parameters = parameters
+            else:
+                request.sensitive_post_parameters = '__ALL__'
+            return view(self, request, *args, **kwargs)
+        return sensitive_post_parameters_wrapper
+    return decorator

tests/regressiontests/views/views.py

@@ -9 +9 @@
 from django.template import Context, RequestContext, TemplateDoesNotExist
 from django.views.debug import technical_500_response, SafeExceptionReporterFilter
 from django.views.decorators.debug import (sensitive_post_parameters,
-                                           sensitive_variables)
+                            sensitive_post_parameters_m, sensitive_variables)
 from django.utils.log import getLogger
 
 from . import BrokenException, except_args
@@ -226 +226 @@
             send_log(request, exc_info)
             return technical_500_response(request, *exc_info)
 
-    @sensitive_post_parameters("password", "secret-key")
+    @sensitive_post_parameters_m("password", "secret-key")
     def method_post(self, request):
         request.method = 'POST'
         request.POST._mutable = True