From 61de57260b4b2bb54fe3c494d104b85e957c9be2 Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Fri, 2 Aug 2013 14:46:17 -0400 Subject: [PATCH] [1.5.x] Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth Thanks Collin Anderson for the report. Backport of 425d076d0c from master --- django/contrib/auth/admin.py | 5 +++-- django/views/decorators/debug.py | 6 ++++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/django/contrib/auth/admin.py b/django/contrib/auth/admin.py index 6b32570b9cd..3c87830787c 100644 --- a/django/contrib/auth/admin.py +++ b/django/contrib/auth/admin.py @@ -16,6 +16,7 @@ from django.views.decorators.csrf import csrf_protect from django.views.decorators.debug import sensitive_post_parameters csrf_protect_m = method_decorator(csrf_protect) +sensitive_post_parameters_m = method_decorator(sensitive_post_parameters()) class GroupAdmin(admin.ModelAdmin): @@ -89,7 +90,7 @@ class UserAdmin(admin.ModelAdmin): return False return super(UserAdmin, self).lookup_allowed(lookup, value) - @sensitive_post_parameters() + @sensitive_post_parameters_m @csrf_protect_m @transaction.commit_on_success def add_view(self, request, form_url='', extra_context=None): @@ -120,7 +121,7 @@ class UserAdmin(admin.ModelAdmin): return super(UserAdmin, self).add_view(request, form_url, extra_context) - @sensitive_post_parameters() + @sensitive_post_parameters_m def user_change_password(self, request, id, form_url=''): if not self.has_change_permission(request): raise PermissionDenied diff --git a/django/views/decorators/debug.py b/django/views/decorators/debug.py index 78ae6b14425..a611981e791 100644 --- a/django/views/decorators/debug.py +++ b/django/views/decorators/debug.py @@ -1,5 +1,7 @@ import functools +from django.http import HttpRequest + def sensitive_variables(*variables): """ @@ -62,6 +64,10 @@ def sensitive_post_parameters(*parameters): def decorator(view): @functools.wraps(view) def sensitive_post_parameters_wrapper(request, *args, **kwargs): + assert isinstance(request, HttpRequest), ( + "sensitive_post_parameters didn't receive an HttpRequest. If you " + "are decorating a classmethod, be sure to use @method_decorator." + ) if parameters: request.sensitive_post_parameters = parameters else: