raise Http404 with error messages in the require_show_toolbar and fix… #955
Conversation
…ed the outdated/misleading docs about the SHOW_TOOLBAR_CALLBACK configuration.
Codecov Report
@@ Coverage Diff @@
## master #955 +/- ##
=======================================
Coverage 83.46% 83.46%
=======================================
Files 28 28
Lines 1578 1578
Branches 235 235
=======================================
Hits 1317 1317
Misses 192 192
Partials 69 69
Continue to review full report at Codecov.
|
| raise Http404( | ||
| 'You do not have the permission to access debug-toolbar' | ||
| ' urls. Please check your INTERNAL_IPS and' | ||
| ' SHOW_TOOLBAR_CALLBACK configurations' |
There was a problem hiding this comment.
The idea behind raising a 404 instead of a 403 is that unprivileged users shouldn't even be aware of Django debug toolbar's existence. From the user's perspective, the resource "doesn't exist" instead of "the resource exists, but you aren't authorized to access it". This message looks to be leaking this information now. I think it shouldn't.
|
@glasslion, I'm not sure if you're still working on this. I've proposed an alternative PR in #961. If you prefer to continue with this, I can close mine, no problem. If you want to reuse the wording I've added to the change log, also no problem. |
|
Closing in favour of the merged #961. |
This PR provides an hint messages when raises 404 , and fix the outdated/misleading doc. See #954