#25017: settings.DISALLOWED_USER_AGENTS should throw PermissionDenied exception
-------------------------------------+-------------------------------------
Reporter: fschiettecatte | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: Core (Other) | Version: 1.8
Severity: Normal | Keywords: DISALLOWED_USER_AGENTS,
| PermissionDenied
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
The check against settings.DISALLOWED_USER_AGENTS should throw a
PermissionDenied exception as opposed to returning an
HttpResponseForbidden() so that handler403 is invoked.
Code touched would be:
https://github.com/django/django/blob/master/django/middleware/common.py#L10
{{{
from django.core.exceptions import PermissionDenied
}}}
https://github.com/django/django/blob/master/django/middleware/common.py#L47-56
{{{
if 'HTTP_USER_AGENT' in request.META:
for user_agent_regex in settings.DISALLOWED_USER_AGENTS:
if user_agent_regex.search(request.META['HTTP_USER_AGENT']):
logger.warning('Forbidden (User agent): %s', request.path,
extra={
'status_code': 403,
'request': request
}
)
raise PermissionDenied
}}}
https://github.com/django/django/blob/master/tests/middleware/tests.py#L254-261
{{{
@override_settings(DISALLOWED_USER_AGENTS=[re.compile(r'foo')])
def test_disallowed_user_agents(self):
with patch_logger('django.request', 'warning') as log_messages:
request = self.rf.get('/slash')
request.META['HTTP_USER_AGENT'] = 'foo'
with self.assertRaises(self, PermissionDenied):
CommonMiddleware().process_request(request)
self.assertEqual(log_messages, ['Forbidden (User agent):
/slash'])
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/25017>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/057.3cddae40648cf2a3b3adff762904b00c%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
