Fixed #17138 -- Made the sensitive_variables decorator work with object methods.

2 files changed, 20 insertions, 9 deletions

diff --git a/django/views/debug.py b/django/views/debug.py
index 7bdf0d25ee..d95cd62017 100644
--- a/django/views/debug.py
+++ b/django/views/debug.py
@@ -155,9 +155,20 @@ class SafeExceptionReporterFilter(ExceptionReporterFilter):
         Replaces the values of variables marked as sensitive with
         stars (*********).
         """
-        func_name = tb_frame.f_code.co_name
-        func = tb_frame.f_globals.get(func_name)
-        sensitive_variables = getattr(func, 'sensitive_variables', [])
+        # Loop through the frame's callers to see if the sensitive_variables
+        # decorator was used.
+        current_frame = tb_frame.f_back
+        sensitive_variables = None
+        while current_frame is not None:
+            if (current_frame.f_code.co_name == 'sensitive_variables_wrapper'
+                and 'sensitive_variables_wrapper' in current_frame.f_locals):
+                # The sensitive_variables decorator was used, so we take note
+                # of the sensitive variables' names.
+                wrapper = current_frame.f_locals['sensitive_variables_wrapper']
+                sensitive_variables = getattr(wrapper, 'sensitive_variables', None)
+                break
+            current_frame = current_frame.f_back
+
         cleansed = []
         if self.is_active(request) and sensitive_variables:
             if sensitive_variables == '__ALL__':
diff --git a/django/views/decorators/debug.py b/django/views/decorators/debug.py
index d04967ef09..5c222963d3 100644
--- a/django/views/decorators/debug.py
+++ b/django/views/decorators/debug.py
@@ -26,13 +26,13 @@ def sensitive_variables(*variables):
     """
     def decorator(func):
         @functools.wraps(func)
-        def wrapper(*args, **kwargs):
+        def sensitive_variables_wrapper(*args, **kwargs):
             if variables:
-                wrapper.sensitive_variables = variables
+                sensitive_variables_wrapper.sensitive_variables = variables
             else:
-                wrapper.sensitive_variables = '__ALL__'
+                sensitive_variables_wrapper.sensitive_variables = '__ALL__'
             return func(*args, **kwargs)
-        return wrapper
+        return sensitive_variables_wrapper
     return decorator
 
 
@@ -61,11 +61,11 @@ def sensitive_post_parameters(*parameters):
     """
     def decorator(view):
         @functools.wraps(view)
-        def wrapper(request, *args, **kwargs):
+        def sensitive_post_parameters_wrapper(request, *args, **kwargs):
             if parameters:
                 request.sensitive_post_parameters = parameters
             else:
                 request.sensitive_post_parameters = '__ALL__'
             return view(request, *args, **kwargs)
-        return wrapper
+        return sensitive_post_parameters_wrapper
     return decorator