mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-04 19:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed #17460 -- Extended the HIDDEN_SETTINGS constant in with a few more sensible names of settings to hide in the debug view. Many thanks to chomik, lpiatek and tomaszrybak.

Browse source 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17481 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Jannis Leidel 2012-02-09 18:58:45 +00:00
parent f0a1633425
commit ec5e2f0ccc
4 changed files with 1153 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/ref/settings.txt
View file

@ -756,15 +756,24 @@ Default: ``False``
A boolean that turns on/off debug mode.
If you define custom settings, `django/views/debug.py`_ has a ``HIDDEN_SETTINGS``
regular expression which will hide from the DEBUG view anything that contains
``'SECRET'``, ``'PASSWORD'``, ``'PROFANITIES'``, or ``'SIGNATURE'``. This allows
untrusted users to be able to give backtraces without seeing sensitive (or
offensive) settings.
If you define custom settings, `django/views/debug.py`_ has a
``HIDDEN_SETTINGS`` regular expression which will hide from the DEBUG view
anything that contains ``'API'``, ``'TOKEN'``, ``'KEY'``, ``'SECRET'``,
``'PASS'``, ``'PROFANITIES_LIST'``, or ``'SIGNATURE'``. This allows untrusted
users to be able to give backtraces without seeing sensitive (or offensive)
settings.
Still, note that there are always going to be sections of your debug output that
are inappropriate for public consumption. File paths, configuration options, and
the like all give attackers extra information about your server.
.. versionchanged:: 1.4
``'PASSWORD'`` changed to ``'PASS'``. ``'API'``, ``'TOKEN'``, ``'KEY'``
were added.
Note that due to how regular expression matching works ``'PASS'`` will also
match PASSWORD, just as ``'TOKEN'`` will also match TOKENIZED and so on.
Still, note that there are always going to be sections of your debug output
that are inappropriate for public consumption. File paths, configuration
options, and the like all give attackers extra information about your server.
It is also important to remember that when running with :setting:`DEBUG`
turned on, Django will remember every SQL query it executes. This is useful