fixup! Add @sensitive_post_parameters

archesproject · Nov 26, 2024 · f6e27bc · f6e27bc
1 parent 171cdff
commit f6e27bc
Show file tree

Hide file tree

Showing 3 changed files with 52 additions and 31 deletions.
diff --git a/arches/app/views/api/__init__.py b/arches/app/views/api/__init__.py
@@ -24,6 +24,7 @@
 from django.core.exceptions import ObjectDoesNotExist, ValidationError
 from django.core.files.base import ContentFile
 from django.views.decorators.csrf import csrf_exempt
+from django.views.decorators.debug import sensitive_variables
 from django.utils import translation
 from django.utils.decorators import method_decorator
 from django_ratelimit.decorators import ratelimit
@@ -1128,6 +1129,7 @@ def get(self, request, plugin_id=None):
 
 
 class SearchExport(View):
+    @sensitive_variables("user_cred")
     @method_decorator(
         ratelimit(
             key="header:http-authorization", rate=settings.RATE_LIMIT, block=False

diff --git a/arches/app/views/api/auth.py b/arches/app/views/api/auth.py
@@ -18,10 +18,12 @@ class Login(LoginView, APIBase):
 
     http_method_names = ["post"]
 
-    @sensitive_variables()
-    @sensitive_post_parameters()
     @method_decorator(
-        ratelimit(key="post:username", rate=settings.RATE_LIMIT, block=False)
+        (
+            sensitive_variables(),
+            sensitive_post_parameters(),
+            ratelimit(key="post:username", rate=settings.RATE_LIMIT, block=False),
+        )
     )
     def post(self, request):
         if getattr(request, "limited", False):

diff --git a/arches/app/views/auth.py b/arches/app/views/auth.py
@@ -87,22 +87,24 @@ def get(self, request):
                 },
             )
 
-    @sensitive_variables()
-    @sensitive_post_parameters()
     @method_decorator(
-        ratelimit(
-            key="post:username",
-            rate=(
-                (
-                    "{}/{}".format(
-                        int(settings.RATE_LIMIT.split("/")[0]) * 2,
-                        settings.RATE_LIMIT.split("/")[1],
+        (
+            sensitive_variables(),
+            sensitive_post_parameters(),
+            ratelimit(
+                key="post:username",
+                rate=(
+                    (
+                        "{}/{}".format(
+                            int(settings.RATE_LIMIT.split("/")[0]) * 2,
+                            settings.RATE_LIMIT.split("/")[1],
+                        )
                     )
-                )
-                if isinstance(settings.RATE_LIMIT, str)
-                else settings.RATE_LIMIT
+                    if isinstance(settings.RATE_LIMIT, str)
+                    else settings.RATE_LIMIT
+                ),
+                block=False,
             ),
-            block=False,
         )
     )
     def post(self, request):
@@ -371,9 +373,13 @@ def get(self, request):
         }
         return JSONResponse(messages)
 
-    @sensitive_variables()
-    @sensitive_post_parameters()
-    @method_decorator(ratelimit(key="user", rate=settings.RATE_LIMIT, block=False))
+    @method_decorator(
+        (
+            sensitive_variables(),
+            sensitive_post_parameters(),
+            ratelimit(key="user", rate=settings.RATE_LIMIT, block=False),
+        )
+    )
     def post(self, request):
         messages = {
             "invalid_password": None,
@@ -429,9 +435,13 @@ class PasswordResetConfirmView(auth_views.PasswordResetConfirmView):
 
 @method_decorator(csrf_exempt, name="dispatch")
 class UserProfileView(View):
-    @sensitive_variables()
-    @sensitive_post_parameters()
-    @method_decorator(ratelimit(key="post:username", rate=settings.RATE_LIMIT))
+    @method_decorator(
+        (
+            sensitive_variables(),
+            sensitive_post_parameters(),
+            ratelimit(key="post:username", rate=settings.RATE_LIMIT),
+        )
+    )
     def post(self, request):
         username = request.POST.get("username", None)
         password = request.POST.get("password", None)
@@ -452,9 +462,13 @@ def post(self, request):
 
 @method_decorator(csrf_exempt, name="dispatch")
 class GetClientIdView(View):
-    @sensitive_variables()
-    @sensitive_post_parameters()
-    @method_decorator(ratelimit(key="post:username", rate=settings.RATE_LIMIT))
+    @method_decorator(
+        (
+            sensitive_variables(),
+            sensitive_post_parameters(),
+            ratelimit(key="post:username", rate=settings.RATE_LIMIT),
+        )
+    )
     def post(self, request):
         if settings.OAUTH_CLIENT_ID == "":
             message = _("Make sure to set your OAUTH_CLIENT_ID in settings.py")
@@ -473,9 +487,13 @@ def post(self, request):
 
 @method_decorator(csrf_exempt, name="dispatch")
 class ServerSettingView(View):
-    @sensitive_variables()
-    @sensitive_post_parameters()
-    @method_decorator(ratelimit(key="post:username", rate=settings.RATE_LIMIT))
+    @method_decorator(
+        (
+            sensitive_variables(),
+            sensitive_post_parameters(),
+            ratelimit(key="post:username", rate=settings.RATE_LIMIT),
+        )
+    )
     def post(self, request):
         if settings.OAUTH_CLIENT_ID == "":
             message = _("Make sure to set your OAUTH_CLIENT_ID in settings.py")
@@ -583,8 +601,7 @@ def post(self, request):
 
 @method_decorator(never_cache, name="dispatch")
 class TwoFactorAuthenticationLoginView(View):
-    @sensitive_variables()
-    @sensitive_post_parameters()
+    @method_decorator((sensitive_variables(), sensitive_post_parameters()))
     def post(self, request):
         username = request.POST.get("username", None)
         password = request.POST.get("password", None)
@@ -730,7 +747,7 @@ def post(self, request):
 
 @method_decorator(csrf_exempt, name="dispatch")
 class Token(View):
-    @sensitive_variables()
+    @method_decorator(sensitive_variables())
     def get(self, request):
         if settings.DEBUG:
             data = {