#28217: nested calls to functions decorated with sensitive_post_parameters
produces
unexpected results which parameters are considered sensitive
---------------------------------+--------------------------------------
Reporter: Peter Zsoldos | Owner: (none)
Type: Bug | Status: new
Component: Error reporting | Version: 1.8
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Comment (by Peter Zsoldos):
Replying to [comment:1 Tim Graham]:
> I'm not sure if it's worth trying to support this use case. The
`@sensitive_post_parameters` decorator is documented to be used on a view.
Do you have a use case for nested views like this?
The use case we ran into was extending the login view
In https://github.com/PaesslerAG/django-act-as-
auth/blob/master/djactasauth/views.py the public app only has a dumbed
down custom view, but in the internal app we use there is more
customization going on in the login page (request based varying extra
context, custom redirects based on user rule, etc.). However, we didn't
want to copypaste the login logic, so we just use the
`django.contrib.auth.views.login` view function to deal with that - thus
inside our own decorated view we call another decorated view (aside: in
this case we actually would prefer overriding the django contrib sensitive
params, as the username for djactasauth would be pretty helpful debug
info).
--
Ticket URL: <https://code.djangoproject.com/ticket/28217#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.b29918adc346506c8d50010a55186ac4%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
