Opened 11 years ago
Closed 11 years ago
#24545 closed Bug (fixed)
sensitive_post_parameters disclosure in csrf_exempt wrapper
| Reported by: | H0neyBadger | Owned by: | nobody |
|---|---|---|---|
| Component: | Uncategorized | Version: | 1.7 |
| Severity: | Normal | Keywords: | sensitive_post_parameters |
| Cc: | Triage Stage: | Unreviewed | |
| Has patch: | no | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
Hello,
I currently developing on 'Django Rest framework' and I try to hide some parameters in django error report.
Unfortunately, the csrf_exempt method in the Traceback reveals sensitive post data to the admin
I think adding request in the wrapper should do the trick
def wrapped_view(request, *args, **kwargs):
return view_func(request, *args, **kwargs)
Exception filter: SafeExceptionReporterFilter
Decorator : @sensitive_post_parameters
Debug = False
Django 1.7.7
Python 3.4.2
Attachments (1)
Change History (2)
by , 11 years ago
| Attachment: | django error report.png added |
|---|
comment:1 by , 11 years ago
| Resolution: | → fixed |
|---|---|
| Status: | new → closed |
It looks like this is addressed in Django 1.8 because HttpRequest.__repr__() no longer includes GET/POST variables; see 788fa9fffa0105d391b8fe35f2894bc5b4e29066.
error report example