Registration view doesn't protect sensitive POST parameters
martinmo opened this issue · 0 comments
martinmo commented
In the unlikely event that an unhandled exception occurs during processing of a POST request to the registration view, the admin(s) will receive a copy of the request payload as part of the error report. Unfortunately, this currently includes the password in plain text. A correctly behaved registration view should hide all POST parameters in error reports.
Reason: In contrast to the Django-provided password change views, the registration views by django-registration are by default not protected with the sensitive_post_parameters()
decorator.
I've disabled the registration form until this issue is fixed.