user admin sensitive_post_parameters needs method_decorator

[zbohm]

Decorator sensitive_post_parameters does not work with class method and method_decorator(sensitive_post_parameters) also does not help.

contrib/auth/admin.py:

@sensitive_post_parameters()
def user_change_password(self, request, id, form_url=''):
    if not self.has_change_permission(request):
        raise PermissionDenied
    user = get_object_or_404(self.queryset(request), pk=id)
    if request.method == 'POST':
        raise Exception("Show me the debug page.")

do not hide POST parameters on the output:

Variable 	Value
password_form 	u'1'
csrfmiddlewaretoken 	u'BC3JzQcQAUlhnEGKwykvJfNfRCN28NA2'
old_password 	u'oldpassword'
new_password1 	u'newpassword'
new_password2 	u'newpassword'

[zbohm]

It is possible to use method_decorator. I have used it the wrong way in the previous case.

tests/regressiontests/views/views.py

@@ -11 +11 @@
 from django.views.decorators.debug import (sensitive_post_parameters,
                                            sensitive_variables)
 from django.utils.log import getLogger
+from django.utils.decorators import method_decorator
 
 from . import BrokenException, except_args
 
@@ -212 +213 @@
 
 class Klass(object):
 
-    @sensitive_variables('sauce')
+    @method_decorator(sensitive_variables('sauce'))
     def method(self, request):
         # Do not just use plain strings for the variables' values in the code
         # so that the tests don't return false positives when the function's
@@ -226 +227 @@
             send_log(request, exc_info)
             return technical_500_response(request, *exc_info)
 
-    @sensitive_post_parameters("password", "secret-key")
+    @method_decorator(sensitive_post_parameters("password", "secret-key"))
     def method_post(self, request):
         request.method = 'POST'
         request.POST._mutable = True

[Collin Anderson]

You are correct that sensitive_post_parameters does not work with class methods and you did correctly conclude that method_decorator(sensitive_post_parameters) works correctly. But you also correctly noticed that this is not working for user admin.

​https://github.com/django/django/blob/master/django/contrib/auth/admin.py.
We need to change these two cases from @sensitive_post_parameters() to @method_decorator(sensitive_post_parameters())

[Tim Graham]

Is it ok to add an assertion to detect misuse of the decorator (see patch)?

[Collin Anderson]

would hasattr(request, 'POST') be better than isinstance?

[Tim Graham]

That wouldn't work -- for one thing, it would prevent GET requests. It's also less specific than the isinstance check. A view always (as far as I can think) receives an HttpRequest as the first argument. In the case where method_decorator isn't used, sensitive_post_parameters receives the class of the method that's being decorated which would cause the assertion to fail.

[Tim Graham <timograham@…>]

In 425d076d0c8cf7376a1478d118c58bcff5b1b74d:

Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth

Thanks Collin Anderson for the report.

[Tim Graham <timograham@…>]

In 97254154ab43d7973fba09ccd7ab548866f83e03:

[1.6.x] Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth

Thanks Collin Anderson for the report.

Backport of 425d076d0c from master

[Tim Graham <timograham@…>]

In 61de57260b4b2bb54fe3c494d104b85e957c9be2:

[1.5.x] Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth

Thanks Collin Anderson for the report.

Backport of 425d076d0c from master

[Tim Graham <timograham@…>]

In 75d2bcda10f00366e6d847f2c90db3e772433e46:

Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth

Thanks Collin Anderson for the report.

Backport of 425d076d0c from master