Consider the case where there is a login form that provides the usual username and password fields. When the form is submitted and an error occurs (eg. database is offline) paste will send an error report that contains the plaintext password (as part of the WSGI variables paste.parsed_formvars).
Ideally, it would be nice if you could prevent the error report from including the contents of certain form variables (in this case, "password" but I could imagine there being other sensitive fields that people might want to exclude) so perhaps the configuration of paste could accept a list of keys to filter. For example, a change password form would likely have 3 password fields with unique names (such as new_password, old_password & confirm_password). In lieu of that, is there any way now (sans modifying the Paste source code) that would prevent passwords from ever appearing in the error report? I know that I can modify Paste's errormiddleware.py and add paste.parsed_formvars to the hide_vars of Supplmente.extraData(self) but this isn't an ideal solution (since it removes all form vars and requires a local source code change to Paste which the next Paste version will overwrite). Similarly I could hardcode some logic in there just to strip out the "password" but that too has the same caveat wrt Paste upgrades. Does anybody know of a better solution? Phil --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "pylons-discuss" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/pylons-discuss?hl=en -~----------~----~----~----~------~----~------~--~---
