Skip to content

raise Http404 with error messages in the require_show_toolbar and fix… #955

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

raise Http404 with error messages in the require_show_toolbar and fix… #955

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion debug_toolbar/decorators.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,11 @@ def inner(request, *args, **kwargs):

show_toolbar = get_show_toolbar()
if not show_toolbar(request):
raise Http404
raise Http404(
'You do not have the permission to access debug-toolbar'
' urls. Please check your INTERNAL_IPS and'
' SHOW_TOOLBAR_CALLBACK configurations'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The idea behind raising a 404 instead of a 403 is that unprivileged users shouldn't even be aware of Django debug toolbar's existence. From the user's perspective, the resource "doesn't exist" instead of "the resource exists, but you aren't authorized to access it". This message looks to be leaking this information now. I think it shouldn't.

)

return view(request, *args, **kwargs)
return inner
12 changes: 9 additions & 3 deletions docs/configuration.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,9 +113,15 @@ Toolbar options

This is the dotted path to a function used for determining whether the
toolbar should show or not. The default checks are that ``DEBUG`` must be
set to ``True``, the IP of the request must be in ``INTERNAL_IPS``, and the
request must not be an AJAX request. You can provide your own function
``callback(request)`` which returns ``True`` or ``False``.
set to ``True`` and the IP of the request must be in ``INTERNAL_IPS``.
You can provide your own function ``callback(request)`` which returns
``True`` or ``False``.

For django-debug-toolbar <= 1.7, the callback should also check whether
the request is ajax. Since the 1.8 version, the ajax is checked in the
middleware, and the callback should not check the whether the request is
ajax anymore, otherwise django-debug-toolbar's own ajax requests will fail
with 404s.

Panel options
~~~~~~~~~~~~~
Expand Down