st-tu-dresden/inloop

Registration view doesn't protect sensitive POST parameters

martinmo opened this issue · 0 comments

In the unlikely event that an unhandled exception occurs during processing of a POST request to the registration view, the admin(s) will receive a copy of the request payload as part of the error report. Unfortunately, this currently includes the password in plain text. A correctly behaved registration view should hide all POST parameters in error reports.

Reason: In contrast to the Django-provided password change views, the registration views by django-registration are by default not protected with the sensitive_post_parameters() decorator.

I've disabled the registration form until this issue is fixed.