diff options
| author | Tim Graham <timograham@gmail.com> | 2013-08-02 14:46:17 -0400 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2013-09-13 10:18:55 -0400 |
| commit | 75d2bcda10f00366e6d847f2c90db3e772433e46 (patch) | |
| tree | 50b128997b73c294506c3a837a691c072715c2e0 | |
| parent | cca302cde6b524992d89add9b9f293d86ac8fba0 (diff) | |
Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth
Thanks Collin Anderson for the report.
Backport of 425d076d0c from master
| -rw-r--r-- | django/contrib/auth/admin.py | 7 | ||||
| -rw-r--r-- | django/views/decorators/debug.py | 6 |
2 files changed, 10 insertions, 3 deletions
diff --git a/django/contrib/auth/admin.py b/django/contrib/auth/admin.py index f14b3d219b..336e90a27b 100644 --- a/django/contrib/auth/admin.py +++ b/django/contrib/auth/admin.py @@ -17,6 +17,8 @@ from django.views.decorators.csrf import csrf_protect from django.views.decorators.debug import sensitive_post_parameters csrf_protect_m = method_decorator(csrf_protect) +sensitive_post_parameters_m = method_decorator(sensitive_post_parameters()) + class GroupAdmin(admin.ModelAdmin): search_fields = ('name',) @@ -83,7 +85,7 @@ class UserAdmin(admin.ModelAdmin): self.admin_site.admin_view(self.user_change_password)) ) + super(UserAdmin, self).get_urls() - @sensitive_post_parameters() + @sensitive_post_parameters_m @csrf_protect_m @transaction.commit_on_success def add_view(self, request, form_url='', extra_context=None): @@ -113,7 +115,7 @@ class UserAdmin(admin.ModelAdmin): return super(UserAdmin, self).add_view(request, form_url, extra_context) - @sensitive_post_parameters() + @sensitive_post_parameters_m def user_change_password(self, request, id, form_url=''): if not self.has_change_permission(request): raise PermissionDenied @@ -170,4 +172,3 @@ class UserAdmin(admin.ModelAdmin): admin.site.register(Group, GroupAdmin) admin.site.register(User, UserAdmin) - diff --git a/django/views/decorators/debug.py b/django/views/decorators/debug.py index 5c222963d3..381e9dd722 100644 --- a/django/views/decorators/debug.py +++ b/django/views/decorators/debug.py @@ -1,5 +1,7 @@ import functools +from django.http import HttpRequest + def sensitive_variables(*variables): """ @@ -62,6 +64,10 @@ def sensitive_post_parameters(*parameters): def decorator(view): @functools.wraps(view) def sensitive_post_parameters_wrapper(request, *args, **kwargs): + assert isinstance(request, HttpRequest), ( + "sensitive_post_parameters didn't receive an HttpRequest. If you " + "are decorating a classmethod, be sure to use @method_decorator." + ) if parameters: request.sensitive_post_parameters = parameters else: |