Fixed #17460 -- Extended the HIDDEN_SETTINGS constant in with a few more...

from django.utils.importlib import import_module

from django.utils.encoding import smart_unicode, smart_str

HIDDEN_SETTINGS = re.compile('SECRET|PASSWORD|PROFANITIES_LIST|SIGNATURE')

HIDDEN_SETTINGS = re.compile('API|TOKEN|KEY|SECRET|PASS|PROFANITIES_LIST|SIGNATURE')

CLEANSED_SUBSTITUTE = u'********************'

A boolean that turns on/off debug mode.

If you define custom settings, `django/views/debug.py`_ has a ``HIDDEN_SETTINGS``

regular expression which will hide from the DEBUG view anything that contains

``'SECRET'``, ``'PASSWORD'``, ``'PROFANITIES'``, or ``'SIGNATURE'``. This allows

untrusted users to be able to give backtraces without seeing sensitive (or

offensive) settings.

Still, note that there are always going to be sections of your debug output that

are inappropriate for public consumption. File paths, configuration options, and

the like all give attackers extra information about your server.

If you define custom settings, `django/views/debug.py`_ has a

``HIDDEN_SETTINGS`` regular expression which will hide from the DEBUG view

anything that contains ``'API'``, ``'TOKEN'``, ``'KEY'``, ``'SECRET'``,

``'PASS'``, ``'PROFANITIES_LIST'``, or ``'SIGNATURE'``. This allows untrusted

users to be able to give backtraces without seeing sensitive (or offensive)

settings.

.. versionchanged:: 1.4

    ``'PASSWORD'`` changed to ``'PASS'``. ``'API'``, ``'TOKEN'``, ``'KEY'`` 

    were added.

Note that due to how regular expression matching works ``'PASS'`` will also

match PASSWORD, just as ``'TOKEN'`` will also match TOKENIZED and so on.

Still, note that there are always going to be sections of your debug output

that are inappropriate for public consumption. File paths, configuration

options, and the like all give attackers extra information about your server.

It is also important to remember that when running with :setting:`DEBUG`

turned on, Django will remember every SQL query it executes. This is useful

.. toctree::

   :maxdepth: 1

   1.4-beta-1

   1.4-alpha-1

   1.3-beta-1

   1.3-alpha-1