#35930: Database password visible on debug page in local variable
-------------------------------------+-------------------------------------
Reporter: bytej4ck | Owner: Baha
| Sdtbekov
Type: Bug | Status: closed
Component: Error reporting | Version: dev
Severity: Normal | Resolution: needsinfo
Keywords: db, password, | Triage Stage:
exposed | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Jacob Walls):
Yeah, the failure has to be "occasional" enough to not prevent the
development server from booting. I know this is lazier than writing a unit
test, but two quick reproducers:
- Start your db, boot the development server, stop the db, and visit
another page that makes a db query.
- Or, while keeping your db up, fiddle with simulating a "random" failure
like this:
{{{#!diff
diff --git a/django/db/backends/postgresql/base.py
b/django/db/backends/postgresql/base.py
index c864cab57a..8f653f0078 100644
--- a/django/db/backends/postgresql/base.py
+++ b/django/db/backends/postgresql/base.py
@@ -181,6 +181,9 @@ class DatabaseWrapper(BaseDatabaseWrapper):
_named_cursor_idx = 0
_connection_pools = {}
+ # Simulate an occasional failure.
+ denominator_will_become_zero = 5
+
@property
def pool(self):
pool_options = self.settings_dict["OPTIONS"].get("pool")
@@ -308,6 +311,11 @@ class DatabaseWrapper(BaseDatabaseWrapper):
# default when no value is explicitly specified in options.
# - before calling _set_autocommit() because if autocommit is on,
that
# will set connection.isolation_level to
ISOLATION_LEVEL_AUTOCOMMIT.
+ self.denominator_will_become_zero -= 1
+ # Simulate occasional failure.
+ 1 / self.denominator_will_become_zero
+ print(self.denominator_will_become_zero)
+
options = self.settings_dict["OPTIONS"]
set_isolation_level = False
try:
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/35930#comment:7>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/010701936b74150f-2e9c86ab-897a-49f0-a636-16b882678983-000000%40eu-central-1.amazonses.com.
